joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ca0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x420478
push 0x67
push esi
call edi
push 0x64
push 0x4203b0
push 0x6d
push esi
call edi
mov eax, esi
call fcn.00405d60
push 0
push esi
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x420478
push 0x4203b0
push 0
mov dword [0x4203ac], esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
je 0x405d38
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.00404e50
test eax, eax
je 0x405d42
mov edx, str.ERROR______________________________App_Already_Running
call fcn.00401870
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00405b20
push 0x493e0
call esi
jmp 0x405d48

Function at 0x406b73
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41e494]
jne 0x406b7d
repz ret
jmp fcn.0040ba1d
Function at 0x414625
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41e494]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040d1d9
and dword [ebp - 0x14], 0
cmp dword [0x420368], 0
mov dword [ebp - 0x18], eax
jne 0x4146d8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x414780
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x414780
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x420368], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42036c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x420370], eax
call edi
push eax
call esi
mov dword [0x420378], eax
test eax, eax
je 0x4146d8
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x420374], eax
mov eax, dword [0x420374]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x414731
cmp dword [0x420378], ecx
je 0x414731
push eax
call esi
push dword [0x420378]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x414731
test ebx, ebx
je 0x414731
call edi
test eax, eax
je 0x414728
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x414728
test byte [ebp - 8], 1
jne 0x414731
or dword [ebp + 0x10], 0x200000
jmp 0x414764
mov eax, dword [0x42036c]
cmp eax, dword [ebp - 0x18]
je 0x414764
push eax
call esi
test eax, eax
je 0x414764
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x414764
mov eax, dword [0x420370]
cmp eax, dword [ebp - 0x18]
je 0x414764
push eax
call esi
test eax, eax
je 0x414764
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x420368]
call esi
test eax, eax
je 0x414780
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x414782
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406b73
leave
ret
Function at 0x401135
Capabilities:
Get disk information

Disassembly:
push ebx
push ebx
push 0x184
call fcn.0040109a

Function at 0x401141
Capabilities:
Get disk information

Disassembly:
push esi
call dword [sym.imp.kernel32.dll_GetLogicalDrives]
mov esi, eax
mov edx, 0x403004
mov byte [edx], 0x41
shr esi, 1
jae 0x40120e
mov byte [edx + 2], bl
push edx
call dword [sym.imp.kernel32.dll_GetDriveTypeA]
cmp eax, 2
jne 0x40120e
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push section..data
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x40120e
push eax
push ebx
mov ecx, esp
push ebx
push ecx
push 0x400
push 0x403418
push ebx
push ebx
push 0x70c00
push eax
call dword [sym.imp.kernel32.dll_DeviceIoControl]
pop ecx
pop eax
push ecx
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
pop ecx
jecxz 0x4011bd
cmp byte [0x403420], 0xb
jne 0x40120e
mov eax, 0x403004
mov ecx, 0x403418
mov byte [eax + 2], 0x5c
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x400
mov edx, dword [eax]
mov dword [ecx], edx
mov word [ecx + 3], 0x5b20
add ecx, 5
mov byte [ecx], bl
push ecx
push eax
call dword [sym.imp.kernel32.dll_GetVolumeInformationA]
pop eax
push eax
cmp byte [eax + 5], bl
je 0x401200
inc eax
cmp byte [eax - 1], bl
jne 0x4011f4
mov word [eax - 1], 0x5d
mov byte [eax + 3], bl
push ebx
push 0x180
call fcn.0040109a
mov edx, 0x403004
inc byte [edx]
test esi, esi
jne 0x401152
pop esi
ret
Function at 0x40121f
Capabilities:
Copy file
Read file on windows
Set file attributes
Write file on windows

Disassembly:
push ebx
push ebx
push 3
push ebx
push 3
push 0xc0000000
push eax
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x40125f
push esi
push ebp
mov ebp, 0x403820
xchg esi, eax
push eax
mov eax, esp
push ebx
push eax
push 0x200
push ebp
push esi
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x40126f
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop eax
pop ebp
pop esi
push 0x10
push ebx
push str.Cannot_open_physical_device_or_device_error__no_administrator_rights__
push edi
call dword [sym.imp.user32.dll_MessageBoxA]
ret
cmp word [ebp + 0xb], 0x200
jne 0x401299
cmp word [ebp + 0xe], bx
je 0x401299
cmp byte [ebp + 0x10], bl
je 0x401299
cmp word [ebp + 0x11], bx
jne 0x401299
cmp word [ebp + 0x16], bx
jne 0x401299
cmp dword [ebp + 0x20], ebx
je 0x401299
cmp byte [ebp + 0x42], 0x29
je 0x4012a3
push 0x10
push ebx
push str.Not_FAT32_volume._Sorry__only_FAT32_is_supported_at_moment.
jmp 0x4012d0
push pe_nt_image_headers32
push 0x403008
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
push ebx
push 0x403008
push 0x40300b
call dword [sym.imp.kernel32.dll_CopyFileA]
test eax, eax
jne 0x4012dc
push 0x10
push ebx
push str.Cannot_copy_MTLD_F32
push edi
call dword [sym.imp.user32.dll_MessageBoxA]
jmp 0x4013dd
push 7
push 0x403008
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push 0x402627
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x40130f
push 0x40
push ebx
push str.Cannot_load_BOOT_F32.BIN
jmp 0x4012d0
mov ecx, esp
push eax
push ebx
push ecx
push 0x200
push 0x403a20
push eax
call dword [sym.imp.kernel32.dll_ReadFile]
pop ecx
push eax
push ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
pop eax
test eax, eax
je 0x401305
cmp dword [esp], 0x200
jne 0x401305
push esi
push edi
mov esi, 0x403a20
mov edi, 0x403820
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
add esi, 0x57
add edi, 0x57
mov ecx, 0x1a6
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.kernel32.dll_SetFilePointer]
test eax, eax
jne 0x401255
mov eax, esp
push ebx
push eax
push 0x200
push ebp
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
je 0x401255
cmp dword [esp], 0x200
jne 0x401255
movzx eax, word [ebp + 0x32]
test eax, eax
je 0x4013c3
cmp ax, word [ebp + 0xe]
jae 0x4013c3
shl eax, 9
push ebx
push ebx
push eax
push esi
call dword [sym.imp.kernel32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4013c3
mov eax, esp
push ebx
push eax
push 0x200
push ebp
push esi
call dword [sym.imp.kernel32.dll_WriteFile]
push 0x40
push str.Success
push str.Kolibri_flash_loader_was_successfully_installed__nNow_you_can_copy_the_image_kolibri.img_and_boot_
push edi
call dword [sym.imp.user32.dll_MessageBoxA]
push ebx
call dword [sym.imp.user32.dll_PostQuitMessage]
pop eax
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
pop ebp
pop esi
ret
Function at 0x40129f
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
push edi
mov dword [ebp - 0x38], esi
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov dword [ebp - 0x20], eax
mov eax, dword [0x41b5c0]
mov dword [ebp - 0x30], eax
mov eax, dword [0x41b5c4]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x34], eax
call fcn.00401298
mov ebx, dword [ebp - 0x10]
mov eax, dword [0x41b5c8]
add ebx, 0x23f
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [0x41b5cc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0x20
mov dword [ebp - 0x1c], 2
add dword [ebp - 0x1c], 3
mov ecx, dword [0xaf7e74]
mov eax, edi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x40132c
push 0x4182f0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [ebp - 4]
mov ecx, dword [0xaf7e74]
add eax, dword [ebp - 0x28]
mov edx, 0xedeb2e40
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
mov eax, dword [0xaf7e70]
cmove eax, edx
xor edx, edx
mov dword [0xaf7e70], eax
cmp ecx, 0x3eb
mov eax, dword [0xaf7dc8]
cmove eax, edx
mov dword [0xaf7dc8], eax
lea eax, [ebx + edi]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
shr eax, 5
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x14], edx
mov dword [0xaf7e6c], 0xf4ea3dee
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x18]
sub esi, eax
mov dword [ebp - 0xc], eax
mov eax, esi
mov dword [ebp - 0x18], esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
and dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
add dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
nop
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x1c]
mov edx, esi
mov eax, dword [ebp - 4]
add ebx, 0x61c88647
shr edx, cl
add edx, dword [ebp - 0x34]
mov dword [ebp - 0xc], edx
xor edx, dword [ebp - 0x20]
xor eax, edx
mov dword [ebp - 0x10], ebx
sub edi, eax
mov dword [ebp - 4], eax
dec dword [ebp - 0x24]
mov dword [ebp - 0x18], edi
jne 0x4012fa
mov dword [ebp - 0x20], esi
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d2fe
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a460]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00405535
mov dword [ebp - 0x14], eax
cmp dword [0x453624], esi
jne 0x40d3f1
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d37e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d4d1
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d4d1
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d4d1
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x453624], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x453628], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x45362c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x453634], eax
test eax, eax
je 0x40d3ee
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x453630], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d416
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d409
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d42b
push 4
pop eax
jmp 0x40d4d3
cmp dword [ebp - 0x14], esi
je 0x40d42b
push dword [0x453624]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d410
mov eax, dword [0x453630]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d489
cmp dword [0x453634], edi
je 0x40d489
push eax
call ebx
push dword [0x453634]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d489
test eax, eax
je 0x40d489
call ecx
test eax, eax
je 0x40d47e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d47e
test byte [ebp - 8], 1
jne 0x40d489
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d4b9
mov eax, dword [0x453628]
cmp eax, edi
je 0x40d4b6
push eax
call ebx
test eax, eax
je 0x40d4b6
call eax
mov esi, eax
test esi, esi
je 0x40d4b6
mov eax, dword [0x45362c]
cmp eax, edi
je 0x40d4b6
push eax
call ebx
test eax, eax
je 0x40d4b6
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x453624]
call ebx
test eax, eax
je 0x40d4d1
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d4d3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404840
mov esp, ebp
pop ebp
ret
Function at 0x40102b
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
push esp
pop ebp
and esp, 0xfffffff8
sub esp, 0x1c
mov al, byte [ecx]
and dword [esp + 0x18], 0
push ebx
push esi
mov byte [edx], al
lea eax, [edx + 1]
push edi
sub edi, edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
xor ebx, ebx
lea eax, [ecx + 1]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.004011dd
test eax, eax
je 0x40118f
lea ecx, [esp + 0x18]
call fcn.004011dd
lea ecx, [esp + 0x18]
test eax, eax
je 0x4010fe
call fcn.004011dd
test eax, eax
je 0x4010bc
push 4
xor edi, edi
pop ebx
lea ecx, [esp + 0x18]
call fcn.004011dd
lea edi, [eax + edi*2]
dec ebx
jne 0x40108e
mov edx, dword [esp + 0x1c]
or edi, edi
je 0x4010af
push edx
pop eax
sub eax, edi
mov al, byte [eax]
mov byte [edx], al
jmp 0x4010b2
mov byte [edx], 0
mov ebx, dword [esp + 0x10]
inc edx
jmp 0x4011a1
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx esi, byte [eax]
mov ecx, esi
and ecx, 1
inc eax
add ecx, 2
shr esi, 1
mov dword [esp + 0x18], eax
je 0x4010f2
or ecx, ecx
je 0x40118a
push edx
pop edi
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x4010e4
jmp 0x401186
sub ebx, ebx
inc ebx
mov dword [esp + 0x10], ebx
jmp 0x40118a
call fcn.004011bc
or edi, edi
jne 0x401133
cmp eax, 2
jne 0x40112e
lea ecx, [esp + 0x18]
jmp 0x47a0a0
sub eax, 3
jmp 0x401136
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
call fcn.004011bc
mov ecx, eax
cmp esi, 0x7d00
jb 0x40115d
inc ecx
cmp esi, 0x500
jb 0x401166
inc ecx
cmp esi, 0x80
jae 0x401171
add ecx, 2
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x40118a
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x40117d
mov dword [esp + 0x1c], edx
sub edi, edi
inc edi
jmp 0x4011a7
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
or ebx, ebx
je 0x40105e
sub edx, dword [esp + 0x14]
pop edi
pop esi
push edx
pop eax
pop ebx
push ebp
pop esp
pop ebp
ret
Function at 0x10005e48
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov dword [0x1028616c], 0x9dd
mov dword [ebp - 0x10], eax
call fcn.1000664c
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x10005e8e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov dword [0x1028616c], 0x5a7
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
jne 0x10005f4f
mov eax, dword [ebp - 0x30]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x34]
mov ecx, eax
mov edx, dword [ebp - 0x38]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x3d], bh
mov byte [ebp - 0x3e], cl
je 0x10005fad
jmp 0x10005f80
xor eax, eax
mov ecx, dword [ebp - 0x44]
add ecx, 2
mov edx, dword [ebp - 0x48]
add edx, 1
mov esi, dword [ebp - 0x2c]
cmp edx, esi
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x50], ecx
jb 0x10005f61
jmp 0x10005ec7
mov eax, dword [ebp - 0x44]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x10286168], 0x1fbc
mov dword [ebp - 0x30], edi
jmp 0x10005ec7
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + ecx*4]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], edx
jmp 0x10005ed2
mov al, byte [ebp - 0x3d]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x3c]
add edx, 1
mov ah, byte [ebp - 0x3e]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x34], edx
jne 0x10005ed2
mov al, byte [ebp - 0x3e]
test al, 1
jne 0x10005f27
jmp 0x10005f01
Function at 0x10005fbd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x10286170], 0
mov dword [0x10286174], 0
mov dword [0x1028617c], 0
mov dword [0x10286168], 0x1a14
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x1000610c
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x10286170], edx
mov dword [0x10286168], 0xfbe
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x10286174], edx
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x10286178], cl
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x10286168], 0x1d46
mov cl, byte [0x10286178]
mov edx, dword [0x10286174]
mov byte [edi + edx], cl
mov edx, dword [0x10286170]
movzx edx, byte [edi + edx]
mov ebx, dword [0x10286174]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x1028617c], ebx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
mov byte [ebx + edx], cl
mov ecx, dword [0x1028616c]
add ecx, 0x374
mov dword [0x1028616c], ecx
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x38], edx
je 0x1000610c
mov eax, dword [0x10286170]
mov ecx, dword [0x10286174]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
jmp 0x10006020
mov dword [0x1028616c], 0x20c0
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10006129
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [fcn.10006129]
mov ecx, dword [0x1028616c]
add ecx, 0xffffe02f
mov edx, dword [0x10286168]
add edx, 0xffffdbc5
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
jmp 0x10006177
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x1000618a
mov eax, dword [ebp - 0x14]
mov dword [0x1028616c], eax
mov eax, dword [ebp - 0x10]
add esp, 0x18
pop ebp
ret
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
je 0x10006158
mov eax, dword [ebp - 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
jmp 0x10006177
Function at 0x10006448
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10286174], 0
mov byte [0x10286178], 0
mov dword [0x10286168], 0x21
mov dword [0x10286170], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1000652c
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov edx, dword [0x10286174]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov eax, edi
cdq
idiv ecx
mov dword [0x10286174], edx
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x10286178], cl
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x10286178]
mov edx, dword [0x10286174]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov dword [0x10286168], 0x2cc
mov edx, dword [0x10286170]
add edx, 1
mov dword [0x10286170], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x1000649a
jmp 0x10006492
mov eax, dword [ebp - 0x1c]
mov dword [0x1028616c], 0x10da
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x10286170]
add eax, 1
mov dword [0x10286170], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1000652c
xor eax, eax
mov dword [0x10286170], 0
mov dword [ebp - 0x20], eax
jmp 0x1000649a