joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f03d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x476cd4]
jne 0x43f047
repz ret
jmp fcn.0044c506

Function at 0x4576a6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0044b28d
and dword [ebp - 4], 0
cmp dword [0x47a484], 0
mov ebx, eax
jne 0x457757
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x457808
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x457808
push eax
call fcn.0044b21b
mov dword [esp], 0x46c530
push edi
mov dword [0x47a484], eax
call esi
push eax
call fcn.0044b21b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x47a488], eax
call esi
push eax
call fcn.0044b21b
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x47a48c], eax
call esi
push eax
call fcn.0044b21b
pop ecx
mov dword [0x47a494], eax
test eax, eax
je 0x457757
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0044b21b
pop ecx
mov dword [0x47a490], eax
mov eax, dword [0x47a490]
cmp eax, ebx
je 0x4577af
cmp dword [0x47a494], ebx
je 0x4577af
push eax
call fcn.0044b296
push dword [0x47a494]
mov esi, eax
call fcn.0044b296
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4577af
test edi, edi
je 0x4577af
call esi
test eax, eax
je 0x4577a6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4577a6
test byte [ebp - 0xc], 1
jne 0x4577af
or dword [ebp + 0x10], 0x200000
jmp 0x4577e8
mov eax, dword [0x47a488]
cmp eax, ebx
je 0x4577e8
push eax
call fcn.0044b296
pop ecx
test eax, eax
je 0x4577e8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4577e8
mov eax, dword [0x47a48c]
cmp eax, ebx
je 0x4577e8
push eax
call fcn.0044b296
pop ecx
test eax, eax
je 0x4577e8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x47a484]
call fcn.0044b296
pop ecx
test eax, eax
je 0x457808
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45780a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45ce50
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2c14
call fcn.004404b0
mov eax, dword [0x476cd4]
xor eax, esp
mov dword [esp + 0x2c10], eax
mov eax, dword [esp + 0x2c18]
push edi
xor edi, edi
mov dword [esp + 0xc], eax
cmp eax, edi
je 0x45cfbb
cmp dword [esp + 0x2c20], edi
je 0x45cfbb
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov dword [esp + 0x10], edi
xor ebx, ebx
lea ebx, [ebx]
push ebx
push str..PhysicalDrive_d
lea eax, [esp + 0x30]
push 0x100
push eax
call fcn.004207b0
add esp, 0x10
push edi
push edi
push 3
push edi
push 3
push edi
lea ecx, [esp + 0x40]
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x45cf94
xor eax, eax
push 0x2710
lea edx, [esp + 0x514]
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call fcn.0043f440
add esp, 0xc
push edi
lea eax, [esp + 0x18]
push eax
push 0x2710
lea ecx, [esp + 0x51c]
push ecx
push 0xc
lea edx, [esp + 0x30]
push edx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x45cf87
push 0x3e8
lea eax, [esp + 0x12c]
push edi
push eax
call fcn.0043f440
mov edx, dword [esp + 0x534]
lea ecx, [esp + 0x134]
push ecx
push 1
push edx
lea eax, [esp + 0x528]
push eax
call fcn.0045e580
mov edx, dword [esp + 0x2c48]
mov eax, dword [esp + 0x34]
add esp, 0x1c
lea ecx, [esp + 0x128]
push ecx
push edx
push eax
call fcn.0045c7d0
test eax, eax
jne 0x45cf87
mov dword [esp + 0x10], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], edi
jne 0x45cf9e
inc ebx
cmp ebx, 0x10
jl 0x45cea0
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
mov ecx, dword [esp + 0x2c10]
xor ecx, esp
call fcn.0043f03d
add esp, 0x2c14
ret
mov ecx, dword [esp + 0x2c14]
pop edi
xor ecx, esp
xor eax, eax
call fcn.0043f03d
add esp, 0x2c14
ret
Function at 0x45d270
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x2ec
mov eax, dword [0x476cd4]
xor eax, esp
mov dword [esp + 0x2e8], eax
push edi
mov edi, dword [esp + 0x2f4]
mov dword [esp + 0x18], edi
test edi, edi
je 0x45d471
cmp dword [esp + 0x2f8], 0
je 0x45d471
push 0x64
lea eax, [esp + 0x20]
push 0
push eax
call fcn.0043f440
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 8
push 0
push 0x46c5c4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45d438
mov ecx, dword [esp + 4]
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x100]
push eax
push ebx
mov esi, 0x104
push ecx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x45d42b
lea ebx, [ebx]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 1
push 0
lea eax, [esp + 0xf8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45d3f9
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1f4]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45d3ee
push 0x64
push eax
lea eax, [esp + 0x90]
push eax
call fcn.0043f440
lea ecx, [esp + 0x1fc]
push 0x64
push ecx
lea edi, [esp + 0x9c]
call fcn.0045d160
add esp, 0x14
test eax, eax
je 0x45d3ee
cmp byte [esp + 0x24], 0
je 0x45d3b2
lea edx, [esp + 0x24]
push edx
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jge 0x45d3ee
lea eax, [esp + 0x24]
lea esi, [esp + 0x88]
mov ecx, eax
mov edx, 0x64
sub esi, ecx
lea ecx, [edx + 0x7fffff9a]
test ecx, ecx
je 0x45d3e1
mov cl, byte [esi + eax]
test cl, cl
je 0x45d3e1
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x45d3c6
jmp 0x45d3e5
test edx, edx
jne 0x45d3e6
dec eax
mov byte [eax], 0
mov esi, 0x104
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0xc]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x100]
push ecx
inc ebx
push ebx
push edx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x45d310
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
cmp byte [esp + 0x1c], 0
je 0x45d471
mov edx, dword [esp + 0x2f8]
lea ecx, [esp + 0x1c]
push ecx
push edx
push edi
call fcn.0045c7d0
xor ecx, ecx
test eax, eax
setge cl
pop edi
mov eax, ecx
mov ecx, dword [esp + 0x2e8]
xor ecx, esp
call fcn.0043f03d
add esp, 0x2ec
ret
mov ecx, dword [esp + 0x2ec]
pop edi
xor ecx, esp
xor eax, eax
call fcn.0043f03d
add esp, 0x2ec
ret
Function at 0x45d6e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x50c
mov eax, dword [0x476cd4]
xor eax, esp
mov dword [esp + 0x508], eax
push ebp
mov ebp, dword [esp + 0x514]
test edi, edi
je 0x45d85d
cmp ebp, 0x20
jb 0x45d85d
push 0x400
lea eax, [esp + 0x110]
push 0
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x400
call fcn.0043f440
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x10]
push eax
push 0x46c634
push str.Software360SafeLiveup
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x45d85d
lea eax, [esp + 0x10c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x45d770
sub eax, edx
cmp eax, 0x40
jne 0x45d85d
push ebx
lea edx, [eax + 0x40]
push esi
lea eax, [esp + 0x14]
lea esi, [esp + 0x114]
mov ecx, eax
sub esi, ecx
lea ecx, [edx - 0x60]
test ecx, ecx
je 0x45d7ae
mov cl, byte [esi + eax]
test cl, cl
je 0x45d7ae
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x45d796
jmp 0x45d7b2
test edx, edx
jne 0x45d7b3
dec eax
mov byte [eax], 0
lea eax, [esp + 0x94]
lea edx, [esp + 0x134]
mov ecx, eax
mov esi, 0x80
sub edx, ecx
lea ecx, [ecx]
lea ecx, [esi + 0x7fffff7e]
test ecx, ecx
je 0x45d7eb
mov cl, byte [edx + eax]
test cl, cl
je 0x45d7eb
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x45d7d0
jmp 0x45d7ef
test esi, esi
jne 0x45d7f0
dec eax
push 0x400
lea edx, [esp + 0x118]
push 0
push edx
mov byte [eax], 0
call fcn.0043f440
push 0x400
lea ebx, [esp + 0x124]
lea ecx, [esp + 0x24]
call fcn.0045c8d0
add esp, 0x10
lea eax, [esp + 0x94]
push eax
mov ecx, ebx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
pop ebx
test eax, eax
jne 0x45d85d
lea edx, [esp + 0xc]
push edx
push ebp
push edi
call fcn.0045c7d0
neg eax
sbb eax, eax
inc eax
pop ebp
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.0043f03d
add esp, 0x50c
ret
mov ecx, dword [esp + 0x50c]
pop ebp
xor ecx, esp
xor eax, eax
call fcn.0043f03d
add esp, 0x50c
ret

Function at 0x45d880
Capabilities:
Set registry value

Disassembly:
sub esp, 0x188
mov eax, dword [0x476cd4]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
push esi
push 0x80
lea eax, [esp + 0xc]
push 0
push eax
mov esi, ecx
call fcn.0043f440
push 0x80
lea ebx, [esp + 0x18]
mov ecx, esi
call fcn.0045c8d0
lea eax, [esp + 0x98]
mov ecx, eax
add esp, 0x10
mov edx, 0x104
sub esi, ecx
lea esp, [esp]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x45d8eb
mov cl, byte [esi + eax]
test cl, cl
je 0x45d8eb
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x45d8d0
jmp 0x45d8ef
test edx, edx
jne 0x45d8f0
dec eax
lea edx, [esp + 8]
push edx
mov byte [eax], 0
push 0x104
lea eax, [esp + 0x90]
push eax
call fcn.0045c840
lea eax, [esp + 0x88]
pop esi
lea edx, [eax + 1]
pop ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x45d916
sub eax, edx
push eax
lea ecx, [esp + 0x84]
push ecx
push 1
push 0x46c634
push str.Software360SafeLiveup
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.0043f03d
add esp, 0x188
ret
Function at 0x1013938c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10214d50]
jne 0x10139396
repz ret
jmp fcn.1013963d

Function at 0x10139eb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
call fcn.10001089
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x10139fbd
jmp 0x1013a01b
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x5c], ecx
mov dword [0x10214d30], 0x3d
mov dword [0x10214d2c], 0xffffdef4
mov edx, dword [esp + 0x1c]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x68], esi
mov esi, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.1013ab44
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x10214d2c], 0x9dd
mov dword [esp + 0x18], eax
jmp 0x1013a013
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.10139be5
lea ecx, [0x1013b21f]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x40], edx
mov dword [esp + 0x38], 0x15b000
mov edx, dword [0x10214d18]
mov dword [esp + 0x88], edx
mov edx, dword [0x10214d1c]
mov dword [esp + 0x70], edx
mov edx, dword [0x10214d20]
mov dword [esp + 0x7c], edx
mov edx, dword [0x10214d24]
mov dword [esp + 0x60], edx
mov edx, dword [0x10214d28]
mov dword [esp + 0x4c], edx
mov dword [0x10214d2c], 0x1b55
mov dword [0x10214d30], 0x19df
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
cmp word [eax], 0x5a4d
mov dword [esp + 0x20], eax
je 0x10139fdd
jmp 0x10139ff5
lea eax, [esp + 0x38]
mov dword [esp + 0xc], eax
call fcn.1013a7c8
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x18], ecx
je 0x10139f39
jmp 0x1013a013
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x1c], ecx
je 0x10139ed8
mov eax, dword [esp + 0x20]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [0x10214d2c], 0x795
mov dword [esp + 0x10], eax
jmp 0x10139fac
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x1013a236
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10214d38], 0
mov byte [0x10214d3c], 0
mov dword [0x10214d30], 0x37b
mov dword [0x10214d34], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1013a347
mov eax, dword [0x10214d30]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
mov dword [0x10214d40], 0
mov dword [ebp - 0x2c], eax
mov eax, ecx
xor esi, esi
mov dword [ebp - 0x30], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [ebp - 0x2c]
add edi, 0xffffe110
mov ebx, dword [0x10214d38]
mov esi, dword [ebp - 0x18]
movzx esi, byte [esi + ecx]
add esi, ebx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add esi, edx
mov dword [0x10214d40], esi
mov dword [0x10214d2c], edi
mov eax, esi
cdq
mov esi, dword [ebp - 0x30]
idiv esi
mov dword [0x10214d38], edx
mov dword [0x10214d30], 0x2010
mov edi, dword [ebp - 0x18]
mov bl, byte [edi + ecx]
mov byte [0x10214d3c], bl
mov dword [0x10214d2c], 0x21db
mov bl, byte [edi + edx]
mov byte [edi + ecx], bl
mov bl, byte [0x10214d3c]
mov ecx, dword [0x10214d38]
mov byte [edi + ecx], bl
mov ecx, dword [0x10214d34]
add ecx, 1
mov dword [0x10214d34], ecx
cmp ecx, 0x100
mov dword [ebp - 0x20], ecx
jl 0x1013a280
jmp 0x1013a3a7
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x10214d2c], 0x195
mov dword [0x10214d30], 0xfffff8ce
mov eax, dword [0x10214d34]
add eax, 1
mov dword [0x10214d34], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1013a347
xor eax, eax
mov ecx, 0xfffff8ce
mov dword [0x10214d2c], 0x6f3
mov dword [0x10214d34], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x1013a28e
mov dword [0x10214d2c], 0x1374
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1013a7c8
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x10214d30], 0x8e3
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x1013a806
mov eax, dword [ebp - 0x14]
add esp, 0x24
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
je 0x1013a87e
jmp 0x1013a867
mov dword [0x10214d2c], 0x192b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1013a8cc
jmp 0x1013a856
mov dword [0x10214d30], 0x27
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1013a81e
xor eax, eax
mov dword [0x10214d2c], 0x8eb
mov dword [ebp - 0x14], eax
jmp 0x1013a7fe
mov eax, dword [ebp - 0x18]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
jl 0x1013a806
mov eax, dword [ebp - 0x1c]
mov dword [0x10214d2c], 0x4c9
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x20], eax
jne 0x1013a856
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x1013a856
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff5
shl eax, 1
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp word [eax], 0x61
je 0x1013a83d
jmp 0x1013a856
mov dword [0x10214d2c], 0x157c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1013a856
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x14], eax
je 0x1013a7fe
jmp 0x1013a856
Function at 0x1013ab44
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x101e836c]
mov esi, 0xe
lea edi, [ebp - 0x2c]
mov dword [0x10214d30], 0x1712
mov ebx, dword [0x10214d2c]
add ebx, 0xffffecd1
mov dword [0x10214d2c], ebx
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], esi
call fcn.1013a3c4
mov dword [0x10214d30], 0xa58
call fcn.1013a6e8
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
call fcn.1013a025
xor ecx, ecx
mov dword [0x10214d2c], 0x4cc
cmp eax, 0
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
jne 0x1013abdf
mov eax, dword [ebp - 0x44]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [0x10214d2c], 0x1780
mov eax, dword [ebp - 0x40]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x30]
mov dword [esp + 4], ecx
mov dword [ebp - 0x48], eax
call fcn.1013a92b
xor eax, eax
mov dword [0x10214d2c], 0x6a3
mov dword [0x10214d30], 0x1c22
mov ecx, dword [ebp - 0x48]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x34]
mov dword [edx + 0x20], ecx
mov ecx, dword [ebp - 0x48]
mov dword [edx + 0x10], ecx
cmp ecx, 0
mov dword [ebp - 0x44], eax
je 0x1013abd4
mov dword [0x10214d30], 0x6cd
mov eax, dword [ebp - 0x48]
add eax, 0x1ca5
mov dword [0x10214d2c], 0x1dc0
mov dword [ebp - 0x44], eax
jmp 0x1013abd4
Function at 0x1013ae66
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov ecx, dword [0x10214d2c]
mov edx, ecx
add edx, 0xfffff6a0
mov dword [0x10214d30], edx
add ecx, 0xffffdda3
mov dword [0x10214d2c], ecx
mov dword [ebp - 0x10], eax
call fcn.1013a4dd
xor ecx, ecx
mov edx, eax
mov dword [0x10214d30], 0x3d
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x1013aecc
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x24]
mov dword [0x10214d2c], 0xffffe1e3
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
je 0x1013aff6
jmp 0x1013af6b
mov al, byte [ebp - 0x35]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x3c]
add edx, 1
mov ah, byte [ebp - 0x3d]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x44], edx
jne 0x1013af39
jmp 0x1013af62
mov eax, dword [ebp - 0x44]
mov ecx, eax
mov edx, dword [ebp - 0x48]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x35], bh
mov byte [ebp - 0x3d], cl
jne 0x1013af0e
mov al, byte [ebp - 0x3d]
test al, 1
jne 0x1013afc7
jmp 0x1013afa1
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [0x10214d30], 0xffffd675
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edx
jmp 0x1013af39
xor eax, eax
mov ecx, dword [ebp - 0x58]
add ecx, 2
mov edx, dword [ebp - 0x54]
add edx, 1
mov esi, dword [ebp - 0x30]
cmp edx, esi
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x34], eax
jb 0x1013af7b
jmp 0x1013aff6
mov eax, dword [ebp - 0x58]
movzx ecx, word [eax]
mov dword [0x10214d30], 0x257f
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x10214d2c], 0x2299
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1013b001
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x10214d34], 0
mov dword [0x10214d38], 0
mov dword [0x10214d44], 0
mov dword [0x10214d2c], 0xecf
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x1013b198
jmp 0x1013b150
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
mov edi, 0x100
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv edi
mov dword [0x10214d34], edx
mov dword [0x10214d2c], 0x2136
mov ecx, dword [ebp - 0x1c]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x34]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv edi
mov dword [0x10214d38], edx
mov dword [0x10214d2c], esi
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x10214d3c], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov edx, dword [0x10214d2c]
mov ebx, edx
add ebx, 0xffffedd9
mov dword [0x10214d2c], ebx
add edx, 0xfffff568
mov dword [0x10214d30], edx
mov cl, byte [0x10214d3c]
mov edx, dword [0x10214d38]
mov byte [edi + edx], cl
mov edx, dword [0x10214d34]
movzx edx, byte [edi + edx]
mov ebx, dword [0x10214d38]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov dword [0x10214d2c], 0x20d8
and ebx, 0xff
mov dword [0x10214d44], ebx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x30]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x30]
mov byte [ebx + edx], cl
mov dword [0x10214d30], 0x17f8
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x3c], edx
je 0x1013b198
jmp 0x1013b173
xor eax, eax
mov ecx, dword [0x10214d30]
add ecx, 0x2467
mov edx, eax
mov esi, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], eax
jmp 0x1013b05a
mov eax, 0x3c5f
mov ecx, dword [0x10214d34]
mov edx, dword [0x10214d38]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], esi
jmp 0x1013b05a
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219