joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1017f6d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
mov eax, 8
imul ecx, eax, 0
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + ecx + 0x78]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
jmp 0x1017f715
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 0x14]
jae 0x1017f7ab
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + 0x18]
jb 0x1017f738
jmp 0x1017f7ab
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x20]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
shl eax, 2
add edx, eax
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
add edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
jne 0x1017f75b
jmp 0x1017f70c
push 0x811c9dc5
mov eax, dword [ebp - 0x18]
push eax
call fcn.1017b200
add esp, 8
cmp eax, 0xf652bc95
jne 0x1017f7a6
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x24]
mov eax, dword [ebp - 8]
lea ecx, [edx + eax*2]
add ecx, dword [ebp + 8]
mov dx, word [ecx]
mov word [ebp - 4], dx
movzx eax, word [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x1c]
lea eax, [edx + eax*4]
add eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
add eax, dword [ebp + 8]
jmp 0x1017f7ad
jmp 0x1017f70c
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10180e90
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov dword [ebp - 8], 0
jmp 0x10180eb1
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 5
jge 0x10180ed7
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10180ecd
mov eax, dword [ebp - 4]
mov byte [eax], 1
jmp 0x10180ed7
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10180ea8
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx]
test edx, edx
jne 0x10180efd
call fcn.10180c30
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10180efd
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0
call dword [ebp - 0x10]
add esp, 4
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x10181000
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 1], 0
call fcn.10180a80
cmp dword [ebp + 8], eax
jne 0x101810e2
cmp dword [ebp + 0x10], 0
jbe 0x101810dd
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x101810dd
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shl eax, 1
push eax
lea ecx, [ebp - 0x10]
call fcn.10180e20
lea ecx, [ebp - 0x10]
call fcn.1000e300
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [ebp - 0x10]
call fcn.1000e300
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp - 0x10]
call fcn.1000e300
push eax
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x101810bb
mov byte [ebp - 2], 1
jmp 0x101810bf
mov byte [ebp - 2], 0
mov dl, byte [ebp - 2]
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
test eax, eax
je 0x101810d5
lea ecx, [ebp - 0x10]
call fcn.10180e70
lea ecx, [ebp - 0x10]
call fcn.10180e50
jmp 0x10181182
mov ecx, dword [ebp + 0x10]
add ecx, 4
push ecx
lea ecx, [ebp - 8]
call fcn.10180e20
lea ecx, [ebp - 8]
call fcn.1000e300
test eax, eax
je 0x1018117a
lea ecx, [ebp - 8]
call fcn.1000e300
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1018117a
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x10]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
add eax, 4
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.1000e300
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp - 8]
call fcn.1000e300
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x10181160
mov byte [ebp - 3], 1
jmp 0x10181164
mov byte [ebp - 3], 0
mov dl, byte [ebp - 3]
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1018117a
lea ecx, [ebp - 8]
call fcn.10180e70
lea ecx, [ebp - 8]
call fcn.10180e50
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10181190
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
cmp dword [ebp + 0xc], 0
je 0x101811b2
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x28]
call fcn.10180f60
movzx ecx, al
test ecx, ecx
jne 0x101811b9
xor al, al
jmp 0x10181310
mov byte [ebp - 1], 0
call fcn.10180a80
cmp dword [ebp + 8], eax
jne 0x101812a4
push 0xd
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x10181250
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1018124e
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1018124e
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp + 0x10]
ja 0x10181244
push 0
push 0
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [ebp - 1], 1
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x101812a2
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x101812a2
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x101812a2
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x101812a2
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp + 0xc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [ebp - 1], 1
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x1018130d
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x1018130d
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x1018130d
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1018130d
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp + 0x10]
ja 0x10181303
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x14]
add eax, 4
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [ebp - 1], 1
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10181320
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0xc], 0
call fcn.10180a80
cmp dword [ebp + 8], eax
jne 0x10181407
push 0xd
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x10181398
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10181396
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10181396
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x10181405
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x10181405
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10181405
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x10181405
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 1], cl
add dword [ebp - 8], 1
cmp byte [ebp - 1], 0
jne 0x101813d7
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x10181457
call fcn.1001a730
cmp dword [ebp + 8], eax
je 0x10181457
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x10181457
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10181457
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10181457
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10181820
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp + 8]
push eax
push str.start
lea ecx, [ebp - 0x18]
push ecx
call fcn.10027210
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.10010eb0
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
lea ecx, [ebp - 0x18]
call fcn.1000b7f0
lea ecx, [ebp + 8]
call fcn.1000b7f0
mov esp, ebp
pop ebp
ret
Function at 0x101914b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x109979e0]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.10010eb0
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov dword [ebp - 8], 0
jmp 0x101914f6
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x1019153b
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 8]
mov al, byte [edx + 0x38]
mov byte [ecx + 0x141], al
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x10191529
mov byte [ebp - 1], 1
jmp 0x1019152d
mov byte [ebp - 1], 0
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 8]
mov al, byte [ebp - 1]
mov byte [edx + 0x38], al
jmp 0x101914ed
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x244]
mov eax, dword [ecx + 0x248]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x24c], edx
mov dword [ecx + 0x250], eax
cvtsi2ss xmm0, dword [ebp - 0x14]
cvtsi2ss xmm1, dword [ebp - 0x10]
push ecx
movss dword [esp], xmm1
push ecx
movss dword [esp], xmm0
lea ecx, [ebp - 0x1c]
call fcn.100287d0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x244], edx
mov dword [ecx + 0x248], eax
mov esp, ebp
pop ebp
ret
Function at 0x101bbcb0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0xc], ecx
push 0x18
call fcn.10217960
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x101bbcdf
mov ecx, dword [ebp - 4]
call fcn.101bca60
mov dword [ebp - 8], eax
jmp 0x101bbce6
mov dword [ebp - 8], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x109be028
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0x101bbbb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret

Function at 0x101c7250
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x101c7283
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
xor eax, dword [ebp + 0xc]
mov ecx, 0x1000193
mul ecx
push eax
mov edx, dword [ebp + 8]
add edx, 1
push edx
call fcn.101c7250
add esp, 8
mov dword [ebp - 4], eax
jmp 0x101c7289
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x101c7290
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x811c9dc5
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x101c72ce
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
xor edx, dword [ebp - 8]
mov dword [ebp - 4], edx
imul eax, dword [ebp - 4], 0x1000193
mov dword [ebp - 4], eax
jmp 0x101c729d
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x101cf310
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
mov edx, dword [esi + 0x10]
mov ebx, dword [esi + 0x28]
sub edx, 8
test ebx, ebx
je case.default.0x101cf34a
mov eax, ebx
and eax, 0xfffffffc
mov eax, dword [eax + 0x38]
test eax, eax
jns 0x101cf33d
mov ecx, dword [esi + 0x1c]
sub ecx, eax
cmp edx, ecx
jb 0x101cf38d
cmp edx, dword [esi + 0x1c]
jbe case.default.0x101cf34a
mov ecx, dword [edx + 4]
mov eax, ecx
and eax, 7
jmp dword [eax*4 + 0x101cf470]
movzx ecx, byte [ecx - 3]
mov eax, 0xfffffff8
shl ecx, 3
sub eax, ecx
add edx, eax
jmp 0x101cf37c
cmp dword [edx - 8], 1
jne case.0x101cf34a.3
mov ebx, dword [ebx + 0x34]
jmp case.0x101cf34a.3
and ecx, 0xfffffff8
sub edx, ecx
test ebx, ebx
jne 0x101cf328
test edi, edi
jne 0x101cf43b
jmp 0x101cf435
test edi, edi
je 0x101cf42f
mov eax, dword [ebx + 0x34]
mov dword [esi + 0x28], eax
lea eax, [edx + 8]
push ecx
push esi
mov dword [esi + 0x10], eax
call fcn.101cfaf0
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
mov eax, ebx
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebx
ret
mov dword [esi + 0x28], 0
mov eax, dword [esi + 0x1c]
add eax, 8
push eax
push esi
mov dword [esi + 0x10], eax
call fcn.101cfaf0
add esp, 8
mov eax, dword [esi + 8]
mov eax, dword [eax + 0xc8]
test eax, eax
je 0x101cf468
push esi
call eax
add esp, 4
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
push ecx
sbb al, 0x10
imul esi, ebx, 0xf363101c
sbb al, 16
ja 0x101cf471
sbb al, 0x10
push ecx
sbb al, 16
in al, 0xf3
sbb al, 0x10
outsb dx, byte [esi]
sbb al, 0x10
outsb dx, byte [esi]
sbb al, 0x10
Function at 0x101d2180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x14]
mov eax, esi
sub eax, ebx
push edi
mov edi, dword [esp + 0x1c]
sub eax, 0x40
push edi
sar eax, 2
push eax
push ebx
call fcn.101d18b0
mov ecx, eax
add esp, 0xc
test ecx, ecx
jne 0x101d2237
lea ebp, [ebx + 0x40]
sub esi, 4
cmp esi, ebp
jbe case.0x101d2208.17
mov eax, dword [esi]
mov ecx, eax
shr ecx, 8
movzx edx, al
movzx ebx, cl
mov cx, word [edx*2 + 0x1021fa00]
and cx, 7
cmp cx, 2
jne 0x101d21ef
cmp edi, ebx
jb 0x101d21b2
cmp edx, 0x2a
jne case.0x101d2208.17
shr eax, 0x10
cmp edi, eax
ja 0x101d21b2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp cx, 1
jne 0x101d21b2
cmp ebx, edi
jne 0x101d21b2
add edx, 0xfffffff0
cmp edx, 0x27
ja case.0x101d2208.17
movzx ecx, byte [edx + 0x101d2314]
jmp dword [ecx*4 + 0x101d2300]
mov ecx, dword [esp + 0x14]
mov edi, eax
mov eax, esi
shr edi, 0x10
sub eax, ecx
sub eax, 0x40
push edi
sar eax, 2
push eax
push ecx
call fcn.101d18b0
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x101d21b2
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov eax, 0x1021e574
pop ebx
ret
mov ecx, dword [esp + 0x14]
shr eax, 0x10
not eax
pop edi
mov ecx, dword [ecx + 0x10]
pop esi
pop ebp
pop ebx
mov ecx, dword [ecx + eax*4]
mov eax, dword [esp + 0x10]
add ecx, 0x10
mov dword [eax], ecx
mov eax, str.global
ret
mov ecx, eax
shr ecx, 0x10
movzx edx, cl
mov ecx, dword [esp + 0x14]
not edx
mov ecx, dword [ecx + 0x10]
mov edx, dword [ecx + edx*4]
mov ecx, dword [esp + 0x20]
add edx, 0x10
mov dword [ecx], edx
mov ecx, dword [esi - 4]
cmp cl, 0x10
jne 0x101d22b2
shr ecx, 8
movzx edx, cl
lea ecx, [ebx + 1]
cmp edx, ecx
jne 0x101d22b2
shr eax, 8
xor eax, dword [esi - 4]
test eax, 0xffff0000
jne 0x101d22b2
pop edi
pop esi
pop ebp
mov eax, str.method
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, str.field
pop ebx
ret
mov ecx, dword [esp + 0x14]
shr eax, 0x10
mov edx, dword [ecx + 0x38]
test edx, edx
jne 0x101d22df
mov eax, dword [esp + 0x20]
mov edx, 0x10221b15
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov eax, str.upvalue
pop ebx
ret
test eax, eax
je 0x101d22ef
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x101d22e3
sub eax, 1
jne 0x101d22e3
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov eax, str.upvalue
pop ebx
ret
Function at 0x101d6160
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x10c
mov eax, dword [0x1027d280]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x118]
push ebx
mov ebx, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x118]
push edi
mov edi, dword [esp + 0x128]
push eax
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x101d61d5
cmp dword [esp + 0x12c], 0
jne 0x101d61d5
push 0x1021ee08
push 0x1021ee0c
push eax
push esi
call fcn.101ce6b0
push edi
push 0x1021ee10
push eax
push esi
call fcn.101ce6b0
push 0xfffffffffffffffe
push esi
call fcn.101cc3b0
add esp, 0x28
jmp 0x101d61df
push edi
push esi
call fcn.101cc120
add esp, 8
push 0x105
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x101d623d
cmp eax, 0x105
je 0x101d623d
lea eax, [esp + 0xc]
push 0x5c
push eax
call sub.VCRUNTIME140.dll_strrchr
add esp, 8
test eax, eax
je 0x101d623d
mov byte [eax], 0
lea eax, [esp + 0xc]
push eax
push 0x1021ec04
push 0
push 0xffffffffffffffff
push esi
call fcn.101cc940
add esp, 0xc
push eax
push esi
call fcn.101ce6b0
push 0xfffffffffffffffe
push esi
call fcn.101cc3b0
add esp, 0x18
jmp 0x101d624b
push str.unable_to_get_ModuleFileName
push esi
call fcn.101cfa50
add esp, 8
push ebx
push 0xfffffffffffffffe
push esi
call fcn.101cc580
mov ecx, dword [esp + 0x120]
add esp, 0xc
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.102180b0
add esp, 0x10c
ret
Function at 0x101da5e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov ecx, dword [ebp + 0x10]
mov edx, 1
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x3c], esi
lea edi, [eax + ecx*8]
cmp edi, dword [ebx + 0x14]
jae 0x101da646
nop dword [eax]
mov eax, dword [edi + 4]
cmp eax, 0xfffffffb
jne 0x101da659
mov eax, dword [edi]
test edx, edx
je 0x101da638
push dword [esp + 0x3c]
mov esi, dword [eax + 0xc]
add eax, 0x10
push esi
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp eax, esi
je 0x101da680
xor edx, edx
mov esi, dword [esp + 0x3c]
add edi, 8
cmp edi, dword [ebx + 0x14]
jb 0x101da610
push 0
push edx
push ebx
call fcn.101ce530
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0xfffffff2
jae 0x101da687
test edx, edx
je 0x101da638
movsd xmm0, qword [edi]
sub esp, 8
movsd qword [esp], xmm0
push str._.14g
push esi
call sym.gs.dll_fprintf
add esp, 0x10
test eax, eax
jle 0x101da638
mov edx, 1
jmp 0x101da63a
sub edi, dword [ebx + 0x10]
sar edi, 3
push 4
inc edi
push edi
push ebx
call fcn.101cf4b0
int3
Function at 0x101daf00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov cl, byte [ebp + 0x81]
mov eax, dword [ebp + 0x210]
mov dl, cl
mov bl, byte [ebp + 0x82]
and dl, 0xc
neg dl
mov byte [esp + 0xb], bl
sbb dl, dl
and dl, 4
neg eax
sbb al, al
and cl, 3
and al, 0xe
shl cl, 3
or dl, al
mov al, byte [ebp + 0x1e0]
or dl, cl
and al, 1
or dl, al
cmp bl, dl
je 0x101db165
mov al, dl
mov byte [ebp + 0x82], dl
and al, 3
lea ebx, [ebp + 0xb10]
push esi
push edi
cmp al, 1
jne 0x101daf9a
movzx ecx, word [0x1021fbce]
movzx esi, word [0x1021fbd4]
add ecx, 0x10001c30
movzx edi, word [0x1021fbda]
add esi, 0x10001c30
movzx eax, word [0x1021fbe2]
add edi, 0x10001c30
movzx ebp, word [0x1021fbe8]
jmp 0x101dafba
mov ecx, dword [ebx + 0x39c]
mov esi, dword [ebx + 0x3a8]
mov edi, dword [ebx + 0x3b4]
movzx eax, word [0x1021fbe4]
movzx ebp, word [0x1021fbea]
lea eax, [eax + 0x10001c30]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x14], eax
lea ebp, [ebp + 0x10001c30]
mov dh, dl
mov dword [esp + 0x18], ebp
xor dh, byte [esp + 0x13]
mov al, dl
and al, 6
mov dword [ebx + 0x398], ecx
mov dword [ebx + 0x3a4], esi
mov dword [ebx + 0x3b0], edi
test dh, 6
je 0x101db055
mov edi, ebx
test al, al
jne 0x101db03c
lea esi, [ebx + 0x26c]
mov ecx, 0x55
rep movsd dword es:[edi], dword [esi]
test dl, 0x10
je 0x101db0ca
mov dword [ebx + 0x114], 0x10004aca
mov dword [ebx + 0x118], 0x10004aca
mov dword [ebx + 0x11c], 0x10004aca
mov dword [ebx + 0x120], 0x10004aca
jmp 0x101db0ca
test dl, 2
mov ecx, 0x10004aaf
mov eax, 0x10004ad7
cmovne eax, ecx
mov ecx, 0x55
rep stosd dword es:[edi], eax
jmp 0x101db0ca
test al, al
jne 0x101db0ca
mov dword [ebx + 0x12c], ecx
mov dword [ebx + 0x138], esi
mov dword [ebx + 0x144], edi
test dl, 0x10
je 0x101db09a
mov dword [ebx + 0x114], 0x10004aca
mov dword [ebx + 0x118], 0x10004aca
mov dword [ebx + 0x11c], 0x10004aca
mov dword [ebx + 0x120], 0x10004aca
jmp 0x101db0ca
mov eax, dword [ebx + 0x380]
mov dword [ebx + 0x114], eax
mov eax, dword [ebx + 0x384]
mov dword [ebx + 0x118], eax
mov eax, dword [ebx + 0x388]
mov dword [ebx + 0x11c], eax
mov eax, dword [ebx + 0x38c]
mov dword [ebx + 0x120], eax
mov ebp, dword [esp + 0x20]
test dh, 8
je 0x101db11b
lea edi, [ebx + 0x154]
test dl, 8
jne 0x101db10f
mov ecx, 0xaa
nop dword [eax]
nop word [eax + eax]
movzx eax, word [ecx + 0x1021fb38]
lea edi, [edi + 4]
add eax, 0x10001c30
add ecx, 2
mov dword [edi - 4], eax
cmp ecx, 0x136
jb 0x101db0f0
jmp 0x101db11b
mov ecx, 0x46
mov eax, 0x10004b54
rep stosd dword es:[edi], eax
test dl, 8
jne 0x101db134
mov eax, dword [esp + 0x14]
mov dword [ebx + 0x154], eax
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x160], eax
test dl, 1
je 0x101db163
test byte [esp + 0x13], 1
jne 0x101db163
mov ax, word [ebp + 0x758]
lea edi, [ebp + 0xa90]
add ax, ax
mov ecx, 0x20
dec ax
movzx eax, ax
mov edx, eax
shl edx, 0x10
or eax, edx
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret