joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b8e00
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp edx, 1
jne 0x4b8e24
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
call dword [edx + 0x34]
mov dword [ebp - 8], eax
lea esi, [esi]
cmp dword [ebp - 8], 0
je 0x4b8eea
mov esi, esi
xor eax, eax
push 0x4b8ecb
push ebp
push 0x414920
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.0040d2c0
mov eax, dword [ebp - 8]
mov byte [eax + 0xc], 0
mov eax, dword [ebp - 8]
mov byte [eax + 0xe], 0
mov edx, 1
mov eax, 0x596448
call fcn.0043a580
mov edx, dword [ebp - 8]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
call fcn.004b9090
mov edx, dword [ebp - 8]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 8]
call fcn.004b9100
mov edx, dword [ebp - 8]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 8]
call fcn.004b9170
mov edx, dword [ebp - 8]
mov dword [edx + 0x30], eax
mov dword [ebp - 0xc], 1
cmp dword [ebp - 8], 0
je 0x4b8ec0
cmp dword [ebp - 4], 0
je 0x4b8ec0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x44]
nop
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x4b8eea
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c1b30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
je 0x4c1b4b
jmp 0x4c1b58
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
nop
cmp dword [ebp - 0xc], 0
je 0x4c1b60
jmp 0x4c1b68
jmp 0x4c1c16
xor eax, eax
push 0x4c1bf3
push ebp
push 0x414920
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_LoadResource
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x14], 0
jne 0x4c1b9e
jmp 0x4c1bc4
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_SizeofResource
mov ebx, eax
mov eax, dword [ebp - 0xc]
push dword [eax + 0x14]
call sub.kernel32.dll_LockResource
mov edx, eax
mov eax, dword [ebp - 0xc]
mov ecx, ebx
call fcn.00438610
mov esi, esi
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
jne 0x4c1bd3
jmp 0x4c1be8
cmp dword [ebp - 8], 0
jne 0x4c1bdb
jmp 0x4c1be8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
mov esi, esi
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x4c1c16
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4c3a00
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
cmp dword [esi + 0x14], 0xca
jne 0x4c3a34
mov eax, esi
call fcn.004c7e30
cmp byte [esi + 0x40], 0
je 0x4c3a2c
mov dword [esi + 0x14], 0xcf
mov bl, 1
jmp 0x4c3ae5
mov dword [esi + 0x14], 0xcb
nop
cmp dword [esi + 0x14], 0xcb
jne 0x4c3ac4
mov eax, dword [esi + 0x184]
cmp byte [eax + 0x10], 0
je 0x4c3abc
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4c3a68
mov eax, esi
mov edx, dword [esi + 8]
call dword [edx]
lea esi, [esi]
mov eax, esi
mov edx, dword [esi + 0x184]
call dword [edx]
mov edi, eax
test edi, edi
jne 0x4c3a80
xor bl, bl
jmp 0x4c3ae5
cmp edi, 2
je 0x4c3aba
lea esi, [esi]
cmp dword [esi + 8], 0
je 0x4c3a58
cmp edi, 3
je 0x4c3a98
cmp edi, 1
jne 0x4c3a58
mov eax, dword [esi + 8]
add dword [eax + 4], 1
mov eax, dword [esi + 8]
mov edx, dword [eax + 4]
cmp edx, dword [eax + 8]
jl 0x4c3a58
mov edx, dword [esi + 8]
mov eax, dword [esi + 0x110]
add dword [edx + 8], eax
mov esi, esi
jmp 0x4c3a58
mov esi, esi
mov eax, dword [esi + 0x70]
mov dword [esi + 0x78], eax
jmp 0x4c3adc
cmp dword [esi + 0x14], 0xcc
je 0x4c3adc
mov ecx, dword [esi + 0x14]
mov eax, esi
mov dl, 0x14
call fcn.004c3e40
lea esi, [esi]
mov eax, esi
call fcn.004c3af0
mov bl, al
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e8030
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax - 8]
call sub.user32.dll_GetClipboardData
mov edx, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x14], 0
jne 0x4e805e
jmp 0x4e80cc
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalSize
mov edx, dword [ebp - 8]
mov dword [edx - 0x1c], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x1c], 0
jg 0x4e807a
jmp 0x4e80cc
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalLock
mov edx, dword [ebp - 8]
mov dword [edx - 0x18], eax
xor eax, eax
push fcn.004e8010
push ebp
push 0x4145a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.004e8010
mov byte [ebp - 0xc], 1
mov al, byte [ebp - 0xc]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e87f0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x2c]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
xor eax, eax
push fcn.004e87d0
push ebp
push 0x4145a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4e8843
jmp 0x4e88c0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
call fcn.0045fb00
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x2c]
call fcn.0045fa50
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
call fcn.00460210
mov ebx, eax
mov eax, str._DataSize
push eax
push dword [ebp - 0x18]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x24]
mov edx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
mov eax, ebx
call fcn.00461420
mov eax, dword [ebp - 0xc]
mov byte [eax - 0x10], 0
jmp 0x4e8917
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
xor eax, eax
push fcn.004e87b0
push ebp
push 0x4145a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
call dword [ebx + pe_nt_image_headers32]
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004e87b0
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.user32.dll_SetClipboardData
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
mov eax, ebp
call fcn.004e87d0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x515120
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 1
je 0x51513b
jmp 0x515148
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call dword [edx + 0x34]
mov dword [ebp - 0xc], eax
nop
cmp dword [ebp - 0xc], 0
je 0x515150
jmp 0x515158
jmp 0x51520a
xor eax, eax
push 0x5151e7
push ebp
push 0x414920
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0xc]
mov edx, 0
call fcn.0040d2c0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x20], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], 0
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x34], 0
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0xc], 0
jne 0x5151c9
jmp 0x5151dc
cmp dword [ebp - 8], 0
jne 0x5151d1
jmp 0x5151dc
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
call dword [edx + 0x44]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
jmp 0x51520a
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x553150
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0
xor eax, eax
push fcn.00553130
push ebp
push 0x4145a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x5daae8]
lea eax, [ebp - 0x10]
call fcn.0040a430
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextLengthW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040a730
cmp dword [ebp - 0xc], 0
jg 0x5531aa
jmp 0x5531cc
mov eax, dword [ebp - 0xc]
lea eax, [eax + 1]
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x5531bd
mov eax, 0x5e52f0
push eax
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextW
mov dword [ebp - 0xc], eax
lea esi, [esi]
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040a730
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x18]
call fcn.0040aea0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
test edx, edx
je 0x5531f5
mov edx, dword [edx - 4]
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x553201
mov eax, 0x5e52f0
call fcn.00430020
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00553130
mov esp, ebp
pop ebp
ret
Function at 0x5549a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov edx, 0x5db1e0
call fcn.0040ead0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00554990
push ebp
push 0x4145a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0x34]
mov edx, 0
call fcn.00408980
mov eax, dword [ebp - 0xc]
mov edx, fcn.004e5210
mov dword [eax + 0x2c], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
mov dword [edx + 0x24], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [edx + 0x28], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
mov dx, 0
call fcn.004092e0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
lea eax, [eax + 0x30]
call fcn.00408980
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov dword [edx + 0x10], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x14]
mov dword [edx + 0x18], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x18]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 0xc]
lea ecx, [eax + 0x10]
mov eax, dword [ebp - 0xc]
lea edx, [eax + 0xc]
mov eax, dword [ebp - 4]
call fcn.00552720
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00555040
mov eax, dword [ebp - 4]
test dword [eax + 0x28], 0x10
je 0x554aa5
jmp 0x554ac4
mov eax, dword [ebp - 4]
call fcn.00508910
test al, al
je 0x554ab3
jmp 0x554ac4
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x24]
or eax, 0x8000000
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x24], eax
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00554990
mov esp, ebp
pop ebp
ret
Function at 0x1029e70d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x102f7eb8]
jne 0x1029e717
repz ret
jmp fcn.102a0a4d

Function at 0x102a157f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1029d2f6
and dword [ebp - 4], 0
cmp dword [0x102f950c], 0
mov ebx, eax
jne 0x102a1630
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x102a16e1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x102a16e1
push eax
call fcn.1029d284
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x102f950c], eax
call esi
push eax
call fcn.1029d284
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x102f9510], eax
call esi
push eax
call fcn.1029d284
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x102f9514], eax
call esi
push eax
call fcn.1029d284
pop ecx
mov dword [0x102f951c], eax
test eax, eax
je 0x102a1630
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1029d284
pop ecx
mov dword [0x102f9518], eax
mov eax, dword [0x102f9518]
cmp eax, ebx
je 0x102a1688
cmp dword [0x102f951c], ebx
je 0x102a1688
push eax
call fcn.1029d2ff
push dword [0x102f951c]
mov esi, eax
call fcn.1029d2ff
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x102a1688
test edi, edi
je 0x102a1688
call esi
test eax, eax
je 0x102a167f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x102a167f
test byte [ebp - 0xc], 1
jne 0x102a1688
or dword [ebp + 0x10], 0x200000
jmp 0x102a16c1
mov eax, dword [0x102f9510]
cmp eax, ebx
je 0x102a16c1
push eax
call fcn.1029d2ff
pop ecx
test eax, eax
je 0x102a16c1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x102a16c1
mov eax, dword [0x102f9514]
cmp eax, ebx
je 0x102a16c1
push eax
call fcn.1029d2ff
pop ecx
test eax, eax
je 0x102a16c1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x102f950c]
call fcn.1029d2ff
pop ecx
test eax, eax
je 0x102a16e1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x102a16e3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x102a1f9a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0xffffffff
cmp ecx, 0
sete bl
cmp eax, 0
sete bh
and bl, bh
test bl, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jne 0x102a201b
jmp 0x102a205e
mov dword [0x102f7320], 0xffffc994
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
jmp 0x102a201b
xor eax, eax
mov ecx, dword [ebp - 0x20]
mov dx, word [ecx]
mov dword [0x102f731c], 0x26b6
shr dx, 1
movzx esi, dx
cmp dx, 0
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], eax
je 0x102a20bb
jmp 0x102a20ee
mov eax, dword [ebp - 0x18]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [0x102f731c], 0xe77
mov eax, dword [ebp - 0x24]
add eax, 0x24
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x28]
mov esi, dword [ecx + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x31]
and bh, bl
test bh, 1
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x1c], esi
jne 0x102a20d8
jmp 0x102a1fe6
mov dword [0x102f7320], 0x25ed
mov dword [0x102f731c], 0x14fc
mov ecx, dword fs:[0x18]
mov dword [0x102f731c], 0xffffeafc
add ecx, 0x30
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
mov dword [0x102f7320], 0xffffd3cf
mov ecx, dword [ecx + 0xc]
add ecx, 0x14
mov edx, dword [ebp - 0x10]
cmp edx, 0
setne bl
mov esi, ecx
mov dword [ebp - 0x40], ecx
mov byte [ebp - 0x31], bl
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [eax]
mov edx, dword [ebp - 0x40]
cmp eax, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], ecx
je 0x102a201b
jmp 0x102a2026
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff8
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], eax
jmp 0x102a201b
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x38]
mov dx, word [ecx + eax*2]
mov si, dx
add si, 0xffbf
mov di, dx
add di, 0x20
cmp si, 0x1a
mov dword [ebp - 0x48], eax
mov word [ebp - 0x4a], dx
mov word [ebp - 0x4c], di
jb 0x102a2122
mov ax, word [ebp - 0x4a]
mov word [ebp - 0x4c], ax
mov ax, word [ebp - 0x4c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x48]
cmp word [ecx + edx*2], ax
sete bl
cmp ax, 0
sete bh
mov al, bl
xor al, 1
or bh, al
test bh, 1
mov byte [ebp - 0x4d], bl
jne 0x102a2164
mov dword [0x102f731c], 0x667
mov eax, dword [ebp - 0x48]
add eax, 1
mov ecx, dword [ebp - 0x2c]
cmp eax, ecx
mov dword [ebp - 0x30], eax
jb 0x102a20ee
mov al, byte [ebp - 0x4d]
test al, 1
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
jne 0x102a1fd4
jmp 0x102a20bb
Function at 0x102a25b4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x102f7328], 0
mov byte [0x102f732c], 0
mov dword [0x102f731c], 0x1f87
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [0x102f7324], 0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x102f7324]
add eax, 1
mov dword [0x102f7324], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x102a25f9
xor eax, eax
mov dword [0x102f731c], 0xd51
mov dword [0x102f7324], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x102f7330], 0
mov dword [0x102f731c], 0x17de
mov edi, dword [0x102f7328]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x102f7330], esi
mov dword [0x102f7320], 0x51e
mov dword [0x102f731c], 0xffffe312
mov eax, esi
cdq
idiv ecx
mov dword [0x102f7328], edx
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x102f732c], cl
mov dword [0x102f731c], 0x1980
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov esi, dword [0x102f731c]
add esi, 0x1ff7
mov dword [0x102f7320], esi
mov cl, byte [0x102f732c]
mov esi, dword [0x102f7328]
mov byte [ebx + esi], cl
mov dword [0x102f731c], 0x5e6
mov esi, dword [0x102f7320]
add esi, 0xfffffd1a
mov dword [0x102f7320], esi
mov esi, dword [0x102f7324]
add esi, 1
mov dword [0x102f7324], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x102a2638
mov dword [0x102f731c], 0x1e31
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x102a2b69
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x58
mov eax, dword [ebp + 8]
mov dword [0x102f7320], 0x26de
mov dword [ebp - 0x10], eax
call fcn.102a217a
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov dword [0x102f7320], 0xe73
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x102a2bb9
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x102f731c], 0x16bd
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
je 0x102a2ce2
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x24]
add eax, dword [eax + ecx + 0x24]
mov dword [ebp - 0x34], eax
xor eax, eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
jmp 0x102a2c43
mov al, byte [ebp - 0x3d]
test al, 1
jne 0x102a2cb9
jmp 0x102a2c88
mov eax, dword [ebp - 0x44]
add eax, 1
mov cl, byte [ebp - 0x45]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x3d]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x4c], eax
jne 0x102a2c5d
jmp 0x102a2c0c
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov ecx, eax
mov edx, dword [ebp - 0x58]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bh
mov byte [ebp - 0x3d], cl
je 0x102a2c0c
jmp 0x102a2c19
mov eax, dword [ebp - 0x54]
add eax, 2
mov ecx, dword [ebp - 0x50]
add ecx, 1
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], ecx
xor eax, eax
mov ecx, dword [ebp - 0x60]
mov edx, dword [ebp - 0x2c]
cmp ecx, edx
mov esi, dword [ebp - 0x5c]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], eax
jb 0x102a2c43
jmp 0x102a2ce2
mov eax, dword [ebp - 0x54]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [ebp - 0x64], edi
mov dword [0x102f731c], 0x22a3
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x102a2d34
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x102f731c], 0x1927
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x102a2d82
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x102a2e0e
jmp 0x102a2e54
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
je 0x102a2dd3
jmp 0x102a2db2
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x102a2e32
jmp 0x102a2e54
mov dword [0x102f731c], 0x9f6
mov eax, dword [ebp - 0x18]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], eax
jl 0x102a2d82
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
jne 0x102a2e54
mov dword [0x102f731c], 0x21a9
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2], 0x6f
je 0x102a2d6a
jmp 0x102a2e54
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x102a2e54
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x102a2d9a
jmp 0x102a2e54
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov dx, word [eax + ecx*2 - 0xe]
mov word [ebp - 0x22], dx
mov eax, 1
mov cx, word [ebp - 0x22]
cmp cx, 0x6c
mov dword [ebp - 0x28], eax
je 0x102a2e5b
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x102a2e5b
mov eax, dword [ebp - 0x28]
add esp, 0x28
pop ebp
ret