joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b704
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov dword [ebp - 4], ecx
cmp ebx, 0x124
jb 0x100b885
mov edi, dword [ebp + 0xc]
cmp edi, ebx
ja 0x100b885
test edi, edi
je 0x100b885
test ebx, ebx
je 0x100b885
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea ecx, [ebx + 0x10]
push ecx
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, dword [ebp + 0x14]
mov dword [esi], eax
test eax, eax
jne 0x100b794
mov ecx, 0x8007000e
mov esi, ecx
mov eax, dword [section..data]
cmp eax, section..data
je 0x100b88a
test byte [eax + 0x1c], 1
je 0x100b88a
push ecx
push 0x10018e4
push 0x27
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
jmp 0x100b88a
mov dword [eax], edi
mov eax, dword [esi]
mov dword [eax + 4], ebx
mov eax, dword [esi]
push ebx
push dword [ebp + 8]
add eax, 0x10
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 4]
mov esi, dword [esi]
mov eax, dword [eax + 8]
add esp, 0xc
cmp edi, 8
lea eax, [eax + esi + 0x10]
mov dword [ebp + 0x10], edi
mov ecx, 0x4cb2f
jl 0x100b828
mov edx, edi
shr edx, 3
mov ebx, edx
shl ebx, 3
sub edi, ebx
mov dword [ebp + 0x10], edi
movzx edi, byte [eax + 1]
imul ecx, ecx, 0x2fe8ed1f
movzx ebx, byte [eax + 2]
imul edi, edi, 0x25
add edi, ebx
movzx ebx, byte [eax + 3]
imul edi, edi, 0x25
add edi, ebx
movzx ebx, byte [eax + 4]
imul edi, edi, 0x25
add edi, ebx
movzx ebx, byte [eax + 5]
imul edi, edi, 0x25
add edi, ebx
movzx ebx, byte [eax + 6]
imul edi, edi, 0x25
add edi, ebx
imul edi, edi, 0x25
sub edi, ecx
movzx ecx, byte [eax]
imul ecx, ecx, 0x1a617d0d
add edi, ecx
movzx ecx, byte [eax + 7]
add ecx, edi
add eax, 8
dec edx
jne 0x100b7d5
mov edx, dword [ebp + 0x10]
dec edx
je 0x100b876
dec edx
je 0x100b86d
dec edx
je 0x100b864
dec edx
je 0x100b85b
dec edx
je 0x100b852
dec edx
je 0x100b849
dec edx
jne 0x100b87e
movzx edx, byte [eax]
imul ecx, ecx, 0x25
add ecx, edx
inc eax
movzx edx, byte [eax]
imul ecx, ecx, 0x25
add ecx, edx
inc eax
movzx edx, byte [eax]
imul ecx, ecx, 0x25
add ecx, edx
inc eax
movzx edx, byte [eax]
imul ecx, ecx, 0x25
add ecx, edx
inc eax
movzx edx, byte [eax]
imul ecx, ecx, 0x25
add ecx, edx
inc eax
movzx edx, byte [eax]
imul ecx, ecx, 0x25
add ecx, edx
inc eax
movzx eax, byte [eax]
imul ecx, ecx, 0x25
add ecx, eax
mov dword [esi + 0xc], ecx
xor esi, esi
jmp 0x100b88a
mov esi, 0x80070057
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x100cded
Capabilities:
Enumerate process modules

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 0
push edi
mov edi, 0x200
jne 0x100ce38
mov ecx, 0x8000ffff
mov edi, ecx
mov eax, dword [section..data]
cmp eax, section..data
je 0x100ceed
test byte [eax + 0x1c], 1
je 0x100ceed
push ecx
push 0x10018f8
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
jmp 0x100ceed
mov ecx, esi
call fcn.0100cd53
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 4], eax
test eax, eax
je 0x100ce83
lea ebx, [esi + 0xc]
push ebx
push edi
push eax
mov dword [esi + 8], edi
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x100cea6
mov eax, dword [esi + 8]
cmp eax, dword [ebx]
jne 0x100cee7
cmp edi, 0x200
jne 0x100cee7
mov edi, 0x1000
jmp 0x100ce38
mov ecx, 0x8007000e
mov edi, ecx
mov eax, dword [section..data]
cmp eax, section..data
je 0x100ceed
test byte [eax + 0x1c], 1
je 0x100ceed
push ecx
push 0x10018f8
push 0x10
jmp 0x100ce28
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100ceba
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jge 0x100cee7
mov eax, dword [section..data]
cmp eax, section..data
je 0x100cee9
test byte [eax + 0x1c], 1
je 0x100cee9
push edi
push 0x10018f8
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
jmp 0x100cee9
xor edi, edi
test edi, edi
jge 0x100cef4
mov ecx, esi
call fcn.0100cd53
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x100cff7
Capabilities:
Check if file exists
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x101a018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
xor esi, esi
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x5c], esi
mov byte [ebp - 0x55], 0
mov dword [ebp - 0x60], esi
call fcn.0100d7b7
cmp dword [edi + 4], esi
jne 0x100d058
mov ecx, 0x8000ffff
mov esi, ecx
mov eax, dword [section..data]
cmp eax, section..data
je 0x100d1bd
test byte [eax + 0x1c], 1
je 0x100d1bd
push ecx
push 0x10018f8
push 0x16
jmp 0x100d1b2
cmp byte [edi + 0x1c], 0
jne 0x100d08c
mov ecx, 0x8000ffff
mov esi, ecx
mov eax, dword [section..data]
cmp eax, section..data
je 0x100d1bd
test byte [eax + 0x1c], 1
je 0x100d1bd
push ecx
push 0x10018f8
push 0x17
jmp 0x100d1b2
lea eax, [ebp - 0x5c]
push eax
push esi
jmp 0x100d0d1
inc dword [ebp - 0x60]
cmp dword [ebp - 0x5c], 0
je 0x100d0ca
cmp byte [ebp - 0x55], 0
jne 0x100d0b9
push 1
push dword [edi + 0x14]
lea ecx, [ebp - 0x54]
call fcn.0100d8de
mov esi, eax
test esi, esi
jl 0x100d107
mov byte [ebp - 0x55], 1
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x54]
call fcn.0100df65
mov esi, eax
test esi, esi
jl 0x100d12e
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x60]
push ebx
mov ecx, edi
call fcn.0100ceff
mov esi, eax
test esi, esi
jge 0x100d093
cmp esi, 0x80070103
je 0x100d14a
test esi, esi
jge 0x100d14a
mov eax, dword [section..data]
cmp eax, section..data
je 0x100d15a
test byte [eax + 0x1c], 1
je 0x100d15a
push esi
push 0x10018f8
push 0x1a
jmp 0x100d121
mov eax, dword [section..data]
cmp eax, section..data
je 0x100d15a
test byte [eax + 0x1c], 1
je 0x100d15a
push esi
push 0x10018f8
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
jmp 0x100d15a
mov eax, dword [section..data]
cmp eax, section..data
je 0x100d15a
test byte [eax + 0x1c], 1
je 0x100d15a
push esi
push 0x10018f8
push 0x19
jmp 0x100d121
cmp byte [ebp - 0x55], 0
je 0x100d158
lea ecx, [ebp - 0x54]
call fcn.0100d7d7
xor esi, esi
test esi, esi
jge 0x100d1bd
cmp byte [ebp - 0x55], 0
je 0x100d1bd
lea ecx, [ebp - 0x54]
call fcn.0100d7d7
push dword [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100d1bd
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 2
je 0x100d1bd
call edi
test eax, eax
jle 0x100d196
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x100d1bd
test byte [eax + 0x1c], 1
je 0x100d1bd
push ecx
push 0x10018f8
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
lea ecx, [ebp - 0x54]
call fcn.0100d8c0
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01010f65
leave
ret 4
Function at 0x100d1dd
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 0
push edi
mov byte [ebp - 1], 0
jne 0x100d21d
mov edi, 0x8000ffff
mov eax, dword [section..data]
cmp eax, section..data
je 0x100d2a7
test byte [eax + 0x1c], 1
je 0x100d2a7
push edi
push 0x10018f8
push 0x1c
jmp 0x100d2f3
lea eax, [ebp - 1]
push eax
push dword [esi + 0x14]
call fcn.01005bba
mov edi, eax
test edi, edi
jge 0x100d24e
mov eax, dword [section..data]
cmp eax, section..data
je 0x100d2a7
test byte [eax + 0x1c], 1
je 0x100d2a7
push edi
push 0x10018f8
push 0x1d
jmp 0x100d2f3
cmp byte [ebp - 1], 0
jne 0x100d2ad
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100d2a5
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x100d2a5
call esi
test eax, eax
jle 0x100d27e
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x100d2a5
test byte [eax + 0x1c], 1
je 0x100d2a5
push ecx
push 0x10018f8
push 0x1e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
xor edi, edi
mov eax, edi
pop edi
pop esi
leave
ret
push 1
push dword [esi + 0x18]
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x100d2a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100d2d3
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jge 0x100d2a5
mov eax, dword [section..data]
cmp eax, section..data
je 0x100d2a7
test byte [eax + 0x1c], 1
je 0x100d2a7
push edi
push 0x10018f8
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
jmp 0x100d2a7
Function at 0x100d8de
Capabilities:
Check if file exists
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
cmp dword [ebx + 0x4c], 0
push esi
push edi
mov byte [ebp - 1], 0
je 0x100d92c
mov ecx, 0x8000ffff
mov edi, ecx
mov eax, dword [section..data]
cmp eax, section..data
je 0x100da90
test byte [eax + 0x1c], 1
je 0x100da90
push ecx
push 0x10019cc
push 0xa
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
jmp 0x100da90
cmp dword [ebp + 8], 0
jne 0x100d95d
mov ecx, 0x8000ffff
mov edi, ecx
mov eax, dword [section..data]
cmp eax, section..data
je 0x100da90
test byte [eax + 0x1c], 1
je 0x100da90
push ecx
push 0x10019cc
push 0xb
jmp 0x100d91c
xor eax, eax
cmp byte [ebp + 0xc], al
push 0x1000000
sete al
push 4
push 0x10019dc
push dword [ebp + 8]
lea esi, [ebx + 4]
mov ecx, esi
lea eax, [eax + eax + 1]
mov dword [ebx + 0x4c], eax
mov eax, dword [esi]
call dword [eax + 4]
mov edi, eax
test edi, edi
jge 0x100d9b2
mov eax, dword [section..data]
cmp eax, section..data
je 0x100da8c
test byte [eax + 0x1c], 1
je 0x100da8c
push edi
push 0x10019cc
push 0xc
jmp 0x100da76
cmp byte [ebp + 0xc], 0
push 0
mov ecx, esi
je 0x100da26
push 1
call fcn.01012cc6
mov edi, eax
test edi, edi
jge 0x100d9f0
mov eax, dword [section..data]
cmp eax, section..data
je 0x100da8c
test byte [eax + 0x1c], 1
je 0x100da8c
push edi
push 0x10019cc
push 0xd
jmp 0x100da76
mov ecx, esi
mov byte [ebp - 1], 1
call fcn.01012e69
mov edi, eax
test edi, edi
jge 0x100da1d
mov eax, dword [section..data]
cmp eax, section..data
je 0x100da8c
test byte [eax + 0x1c], 1
je 0x100da8c
push edi
push 0x10019cc
push 0xe
jmp 0x100da76
mov dword [ebx + 0x4c], 2
jmp 0x100da8a
push 2
call fcn.01012cc6
mov edi, eax
test edi, edi
jge 0x100da4f
mov eax, dword [section..data]
cmp eax, section..data
je 0x100da8c
test byte [eax + 0x1c], 1
je 0x100da8c
push edi
push 0x10019cc
push 0xf
jmp 0x100da76
mov ecx, esi
call fcn.01011f33
mov edi, eax
test edi, edi
jge 0x100da83
mov eax, dword [section..data]
cmp eax, section..data
je 0x100da8c
test byte [eax + 0x1c], 1
je 0x100da8c
push edi
push 0x10019cc
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
jmp 0x100da8c
mov dword [ebx + 0x4c], 4
xor edi, edi
test edi, edi
jge 0x100daee
mov ecx, ebx
call fcn.0100d7d7
cmp byte [ebp - 1], 0
je 0x100daee
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100daee
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x100daee
call esi
test eax, eax
jle 0x100dac7
and eax, 0xffff
or eax, 0x80070000
mov ecx, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x100daee
test byte [eax + 0x1c], 1
je 0x100daee
push ecx
push 0x10019cc
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1011aa5
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp eax, 0xffffffff
je 0x1011ac2
cmp dword [esi + 0x20], edi
je 0x1011acc
mov edi, 0x80041002
jmp 0x1011c5b
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x10], eax
cmp eax, edi
jne 0x1011ae8
mov edi, 0x80041007
jmp 0x1011c5b
cmp eax, 0xffffffff
jne 0x1011b3b
mov eax, dword [section..data]
cmp eax, section..data
je 0x1011c56
test byte [eax + 0x1c], 1
je 0x1011c56
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push 0x1001e38
call fcn.01011a52
pop ecx
pop ecx
call edi
push eax
push 0x1001d70
push 0x2c
mov eax, dword [section..data]
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
jmp 0x1011c56
cmp dword [ebp - 4], edi
ja 0x1011c0e
cmp eax, dword [esi + 8]
ja 0x1011c0e
push edi
push eax
push edi
push 2
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
mov dword [esi + 0x1c], ebx
cmp ebx, edi
jne 0x1011ba0
mov eax, dword [section..data]
cmp eax, section..data
je 0x1011c56
test byte [eax + 0x1c], 1
je 0x1011c56
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push 0x1001e00
call fcn.01011a52
pop ecx
pop ecx
call edi
push eax
push 0x1001d70
push 0x2e
jmp 0x1011b26
mov ecx, dword [esi + 0x18]
mov eax, ecx
xor edx, edx
div dword [esi + 0x2c]
push 0
sub ecx, edx
mov edi, ecx
push edi
push 0
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x20], eax
test eax, eax
jne 0x1011bfd
mov eax, dword [section..data]
cmp eax, section..data
je 0x1011c56
test byte [eax + 0x1c], 1
je 0x1011c56
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push eax
push 0x1001dcc
call fcn.01011a52
pop ecx
pop ecx
call edi
push eax
push 0x1001d70
push 0x2f
jmp 0x1011b26
mov ecx, dword [esi + 0x18]
sub ecx, edi
add ecx, eax
mov dword [esi + 0x28], edi
mov dword [esi + 0x24], ecx
xor edi, edi
jmp 0x1011c62
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x1011c56
test byte [ecx + 0x1c], 1
je 0x1011c56
push dword [esi + 8]
push eax
push dword [ebp - 4]
push 0x1001d88
call fcn.01011a52
mov eax, dword [section..data]
add esp, 0x10
push dword [esi + 8]
push dword [esi + 0x10]
push dword [ebp - 4]
push 0x1001d70
push 0x2d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01003373
mov edi, 0x80041005
mov ecx, esi
call fcn.01011956
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1012196
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
push esi
je 0x10121b6
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10121b6
cmp esi, 0x10000
jbe 0x10121c0
mov eax, 0x80070057
jmp 0x1012240
cmp dword [ecx + 0x40], 1
jne 0x10121cd
mov eax, 0x80041008
jmp 0x1012240
mov eax, dword [ecx + 0xc]
cmp eax, 0xffffffff
jne 0x10121dc
mov eax, 0x80041002
jmp 0x1012240
push 0
lea ecx, [ebp - 4]
push ecx
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x10121fa
cmp dword [ebp - 4], esi
jne 0x10121fa
xor eax, eax
jmp 0x1012240
mov eax, dword [section..data]
cmp eax, section..data
je 0x101223b
test byte [eax + 0x1c], 1
je 0x101223b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push 0x10020f8
call fcn.01011a52
pop ecx
pop ecx
call esi
push eax
mov eax, dword [section..data]
push 0x1001d70
push 0x29
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
mov eax, 0x80041006
pop esi
leave
ret 8

Function at 0x1012f4c
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
cmp eax, 0xffffffff
jne 0x1012f60
mov eax, 0x80041002
pop esi
ret
cmp dword [esi + 0x40], 3
je 0x1012f6d
mov eax, 0x80041008
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1012fc0
mov eax, dword [section..data]
cmp eax, section..data
je 0x1012fb9
test byte [eax + 0x1c], 1
je 0x1012fb9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push 0x10029c8
call fcn.01011a52
pop ecx
pop ecx
call esi
push eax
mov eax, dword [section..data]
push 0x1001d70
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
mov eax, 0x80041006
pop esi
ret
push edi
mov ecx, esi
call fcn.01012b95
mov edi, eax
xor eax, eax
cmp edi, eax
jge 0x101300e
mov eax, dword [section..data]
cmp eax, section..data
je 0x1013007
test byte [eax + 0x1c], 1
je 0x1013007
push edi
push 0x1002988
call fcn.01011a52
mov eax, dword [section..data]
pop ecx
pop ecx
push edi
push 0x1001d70
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01011846
mov eax, 0x80041006
jmp 0x1013014
mov dword [esi + 0x18], eax
mov dword [esi + 0x40], eax
pop edi
pop esi
ret
Function at 0x1013048
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x101305d
mov eax, dword [ebp + 0x10]
jmp 0x10130e9
mov eax, esi
and eax, 3
sub esi, eax
mov eax, dword [ebp + 0x10]
test esi, esi
jle 0x10130e4
mov ecx, dword [ebp + 8]
lea edx, [esi - 1]
shr edx, 2
push ebx
inc ecx
inc edx
push edi
movzx edi, byte [ecx - 1]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x101a030]
movzx edi, byte [ecx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x101a030]
movzx edi, byte [ecx + 1]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x101a030]
movzx edi, byte [ecx + 2]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x101a030]
add ecx, 4
dec edx
jne 0x1013078
pop edi
pop ebx
jmp 0x10130e4
mov ecx, dword [ebp + 8]
movzx ecx, byte [esi + ecx]
movzx edx, al
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x101a030]
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x10130cd
pop esi
pop ebp
ret 0xc

Function at 0x1015201
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [edi + 0xc]
cmp dword [eax], 0
mov esi, 0x1000
jne 0x1015229
push esi
push esi
push eax
call fcn.01015d2a
test eax, eax
jne 0x1015319
lea eax, [edi + 0x10]
cmp dword [eax], 0
jne 0x1015241
push esi
push esi
push eax
call fcn.01015d2a
test eax, eax
jne 0x1015319
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x18]
push ebx
mov bx, word [ebp + 0x14]
movzx eax, bl
add eax, 0xb15dcb
imul eax, eax, 0x25
movzx ecx, bh
add eax, ecx
test edx, edx
je 0x1015277
imul eax, eax, 0x25
lea ecx, [edx + 8]
movzx edi, byte [ecx]
add eax, edi
mov edi, dword [ebp + 8]
imul eax, eax, 0x25
inc ecx
movzx ecx, byte [ecx]
add eax, ecx
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
jbe 0x10152a1
mov dword [ebp + 8], ecx
mov cl, byte [esi]
mov byte [ebp + 0x17], cl
sub cl, 0x61
inc esi
cmp cl, 0x19
ja 0x1015293
xor byte [ebp + 0x17], 0x20
movzx ecx, byte [ebp + 0x17]
imul eax, eax, 0x25
add eax, ecx
dec dword [ebp + 8]
jne 0x1015281
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
mov word [esi + 4], bx
test edx, edx
je 0x10152b4
movzx eax, word [edx + 8]
jmp 0x10152b6
xor eax, eax
cmp dword [ebp + 0x20], 0
mov word [esi + 6], ax
je 0x10152d2
movzx eax, bx
lea eax, [edi + eax*2 + 0x408]
inc word [eax]
movzx eax, word [eax]
jmp 0x10152d4
xor eax, eax
push dword [ebp + 0x1c]
mov word [esi + 8], ax
push dword [ebp + 0x18]
lea eax, [ebp - 4]
push dword [edi + 0x10]
push eax
call fcn.01015b24
pop ebx
test eax, eax
jne 0x1015319
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x10152fe
push 0x44
pop eax
jmp 0x1015319
push 0x14
push esi
mov word [esi + 0xa], ax
push dword [edi + 0xc]
push 0
call fcn.01015ab1
test eax, eax
jne 0x1015319
inc dword [edi + 0x404]
pop edi
pop esi
leave
ret 0x1c
Function at 0x10159f6
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp ecx, dword [edi + 8]
ja 0x1015a0c
push 0x57
pop eax
jmp 0x1015a53
mov eax, dword [edi + 0xc]
push esi
lea esi, [eax + ecx - 1]
mov ecx, dword [edi]
dec eax
not eax
and esi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
test ecx, ecx
jne 0x1015a36
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
jmp 0x1015a42
push ecx
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
test eax, eax
jne 0x1015a4b
push 8
pop eax
jmp 0x1015a52
mov dword [edi], eax
mov dword [edi + 8], esi
xor eax, eax
pop esi
pop edi
pop ebp
ret 8

Function at 0x1015b97
Capabilities:
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push dword [eax + 0xc]
add eax, 0x10
push eax
push 0
call dword [sym.imp.ntdll.dll_RtlComputeCrc32]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
pop ebp
ret 8

Function at 0x1015d2a
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
test edi, edi
je 0x1015d86
lea eax, [edi - 1]
not eax
and eax, edi
cmp edi, eax
jne 0x1015d86
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0x10
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
jne 0x1015d65
push 8
jmp 0x1015d88
cmp dword [ebp + 0xc], 0
mov dword [esi + 0xc], edi
je 0x1015d7d
push dword [ebp + 0xc]
push esi
call fcn.010159f6
mov edi, eax
test edi, edi
jne 0x1015d89
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor edi, edi
jmp 0x1015d93
push 0x57
pop edi
test esi, esi
je 0x1015d93
push esi
call fcn.010159ac
mov eax, edi
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x1015e9d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
or dword [ebp - 8], 0xffffffff
push esi
push edi
push dword [ebp + 0x10]
lea eax, [ebp - 0x14]
xor esi, esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], 3
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 1
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
call fcn.01015c5c
mov edi, eax
cmp edi, esi
jne 0x1015fc7
push ebx
mov ebx, 0xea
test esi, esi
je 0x1015efd
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor esi, esi
lea eax, [ebp + 0x14]
push eax
push 0x10
push dword [ebp + 0x14]
call fcn.0101597e
test eax, eax
jl 0x1015f73
mov eax, dword fs:[0x18]
push dword [ebp + 0x14]
mov eax, dword [eax + 0x30]
push 8
pop edi
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
je 0x1015fc6
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x14]
push esi
push 2
push eax
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
test eax, eax
jge 0x1015f7a
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edi, eax
cmp edi, ebx
jne 0x1015f60
mov eax, dword [esi + 8]
mov dword [ebp + 0x14], eax
dec dword [ebp - 0xc]
cmp edi, ebx
jne 0x1015fb7
cmp dword [ebp - 0xc], 0
jg 0x1015ee2
jmp 0x1015fc6
mov edi, 0x216
jmp 0x1015fc6
cmp dword [esi + 4], 3
je 0x1015f87
mov edi, 0x65d
jmp 0x1015fc6
mov eax, dword [esi + 8]
cmp eax, 0x10
jae 0x1015f96
mov edi, 0x5b6
jmp 0x1015fc6
cmp dword [esi + 0x10], eax
je 0x1015fa0
push 9
pop edi
jmp 0x1015fc6
push dword [esi + 0x18]
lea eax, [esi + 0x1c]
push eax
movzx eax, word [esi + 0xe]
push eax
lea eax, [ebp - 4]
push eax
call fcn.01015e12
mov edi, eax
test edi, edi
jne 0x1015fc6
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
and dword [ebp - 4], edi
mov dword [ecx], eax
pop ebx
cmp dword [ebp - 8], 0xffffffff
je 0x1015fd6
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
test esi, esi
je 0x1015fef
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 4], 0
je 0x1015ffd
push dword [ebp - 4]
call fcn.01015b65
mov eax, edi
pop edi
pop esi
leave
ret 0x10