joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e345
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x432024]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0041e284
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x41e394
cmp dword [ebp - 0x1c], 5
jb 0x41e3ac
jmp 0x41e3a8
cmp dword [ebp - 0x10], 1
jne 0x41e3ac
cmp dword [ebp - 0x1c], 4
ja 0x41e3a8
jne 0x41e3ac
cmp dword [ebp - 0x18], 0
jbe 0x41e3ac
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x422788
call fcn.0041e15e
test eax, eax
jge 0x41e3cd
mov byte [0x433018], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041e4d6
add ebp, 0x78
leave
ret

Function at 0x41e4d6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x432024]
jne 0x41e4e0
repz ret
jmp fcn.0041ea70
Function at 0x406580
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4000]
push edi
or ebp, 0xffffffff
jmp 0x4065a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4065a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x406598
mov eax, 1
add ebx, ebx
jne 0x4065bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4065b0
jne 0x4065cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4065b0
xor ecx, ecx
sub eax, 3
jb 0x4065e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x406652
mov ebp, eax
add ebx, ebx
jne 0x4065eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4065f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40661c
inc ecx
add ebx, ebx
jne 0x406608
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4065fd
jne 0x406619
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4065fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40663c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40662d
jmp 0x40659e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40663c
add edi, ecx
jmp 0x40659e
pop esi
mov edi, esi
mov ecx, 0x1900
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x406677
cmp byte [edi], 1
jne 0x40665c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x40665a
lea edi, [esi + 0x4000]
mov eax, dword [edi]
or eax, eax
je 0x4066bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6078]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40667d
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x607c]
or eax, eax
je 0x4066b9
mov dword [ebx], eax
add ebx, 4
jmp 0x40669a
call dword [esi + 0x608c]
mov ebp, dword [esi + 0x6080]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4066f3
sub esp, 0xffffff80
jmp 0x4025e4
Function at 0x41d1d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x43bcf3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x44b19c]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
xor ebx, ebx
push ebx
call fcn.0041cea0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [esp + 0x18], ebx
mov dword [ecx], 0x44da60
or eax, 0xffffffff
mov dword [esi + 0x40], eax
mov dword [esi + 0x3c], eax
push ebx
push 0x443bea
mov byte [esp + 0x20], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], bl
mov byte [esi + 0x2c], bl
mov dword [esi + 0x30], ebx
call fcn.0041e020
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x41feef
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x44da6c], 0
push esi
jne 0x41fe62
call fcn.0041fd88
test eax, eax
je 0x41fea5
mov eax, dword [0x44da6c]
cmp eax, 1
jne 0x41fe83
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x41fea5
pop esi
ret
push eax
call dword [0x44da74]
test eax, eax
jne 0x41feed
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x41fea9
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x44da6c]
call dword [0x44da74]
mov edi, eax
test edi, edi
je 0x41fece
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x41feea
mov edi, esi
add esi, 0xff0
push edi
push dword [0x44da6c]
call dword [0x44da70]
add edi, 0x10
cmp edi, esi
jb 0x41fed6
mov eax, edi
pop edi
pop esi
ret
jmp 0x41fe4f

Function at 0x42021d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44b19c]
jne 0x420227
repz ret
jmp fcn.004244e1

Function at 0x42698f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x4269c0
call fcn.0042463c
mov dword [eax], esi
call fcn.00424629
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004220fc
add esp, 0x14
push 0x16
pop eax
jmp 0x426a15
test dword [ebp + 0xc], 0xfffffff9
jne 0x42699c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4269ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042464f
pop ecx
call fcn.00424629
mov eax, dword [eax]
jmp 0x426a15
test al, 0x10
jne 0x426a13
test al, 1
je 0x426a13
test byte [ebp + 0xc], 2
je 0x426a13
call fcn.0042463c
mov dword [eax], 5
call fcn.00424629
mov dword [eax], 0xd
jmp 0x4269e4
xor eax, eax
pop esi
pop ebp
ret
Function at 0x435630
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
cmp dword [ebp + 8], 0
je 0x43565e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x43565e
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x30]
movzx eax, byte [edx + 0x28]
test eax, eax
je 0x4356b7
push 0
push ecx
mov ecx, esp
push 0
call fcn.00407ac0
push 0
push 0x80ca0000
push 0x442548
push ecx
mov ecx, esp
lea edx, [ebp - 0x10]
push edx
call fcn.00407ac0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x30]
call fcn.0040f0d0
jmp 0x4356e7
push 0
push ecx
mov ecx, esp
push 0
call fcn.00407ac0
push 0
push 0x90000000
push 0x44254c
push ecx
mov ecx, esp
lea edx, [ebp - 0x10]
push edx
call fcn.00407ac0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x30]
call fcn.0040f0d0
mov dword [ebp - 0x1c], 0
push 0x67
mov ecx, 0x44e608
call fcn.004070f0
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x1c], eax
push 1
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x30]
add ecx, 4
call fcn.00407f90
mov ecx, dword [ebp - 0x30]
call fcn.00435520
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [ebp - 0x30]
add ecx, 4
call fcn.00407ff0
test eax, eax
je 0x435741
mov ecx, dword [ebp - 0x30]
call fcn.0040e700
cmp dword [ebp + 8], 0
je 0x435759
cmp dword [ebp - 0x18], 0
je 0x435759
push 1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret 4
Function at 0x10019058
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x350
cmp dword [edx], 0
jl 0x10019070
cmp dword [edx], eax
jb 0x1001911e
cmp dword [edx], eax
jbe 0x1001907e
cmp dword [edx + 4], 0
jne 0x1001907e
xor eax, eax
pop ebp
ret
push ebx
push esi
push edi
xor esi, esi
mov ebx, 0x7fffffff
mov ecx, dword [edx + esi*4 + 0xc]
xor ecx, dword [edx + esi*4 + 8]
and ecx, ebx
xor ecx, dword [edx + esi*4 + 8]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x10305108]
xor ecx, dword [edx + esi*4 + 0x728]
mov dword [edx + esi*4 + 8], ecx
inc esi
cmp esi, 0x188
jb 0x10019088
mov edi, 0x34f
jmp 0x100190e7
mov ecx, dword [edx + esi*4 + 0xc]
xor ecx, dword [edx + esi*4 + 8]
and ecx, ebx
xor ecx, dword [edx + esi*4 + 8]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x10305108]
xor ecx, dword [edx + esi*4 - 0x618]
mov dword [edx + esi*4 + 8], ecx
inc esi
cmp esi, edi
jb 0x100190bf
mov ecx, dword [edx + 8]
xor ecx, dword [edx + 0xd44]
and ecx, ebx
xor ecx, dword [edx + 0xd44]
mov eax, ecx
shr ecx, 1
and eax, 1
pop edi
pop esi
pop ebx
mov eax, dword [eax*4 + 0x10305108]
xor eax, dword [edx + 0x724]
xor eax, ecx
mov dword [edx + 0xd44], eax
and dword [edx], 0
mov eax, dword [edx]
mov ecx, dword [edx + eax*4 + 8]
inc eax
mov dword [edx], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop ebp
ret

Function at 0x1001914f
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
push 0xd48
inc edi
push edi
call fcn.1012ef43
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1001916f
call fcn.10016f7f
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi], edi
mov edx, dword [esi]
mov eax, dword [esi + edx*4 + 4]
shr eax, 0x1e
xor eax, dword [esi + edx*4 + 4]
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [esi + edx*4 + 8], ecx
inc dword [esi]
cmp dword [esi], 0x350
jb 0x10019177
mov dword [esi + 4], edi
mov eax, esi
pop edi
pop esi
pop ebp
ret
Function at 0x1003d769
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov eax, dword [0x1030b908]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc8], eax
push 0x1014fcc8
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xbc], edi
call fcn.100139c3
mov ecx, dword [edi + 0xc]
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.1001f0e3
lea ecx, [ebp - 0xb8]
call fcn.10013aa3
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x34]
mov edx, 0x101556b0
xor ecx, ecx
sub edx, dword [ebp + 0x10]
sub esi, eax
push 0x20
pop ebx
cmp ecx, dword [ebp + 0x10]
jae 0x1003d7e4
lea eax, [esi + ecx]
mov al, byte [ebp + eax - 0x34]
jmp 0x1003d7e7
mov al, byte [edx + ecx]
mov byte [ebp + ecx - 0x34], al
inc ecx
cmp ecx, ebx
jb 0x1003d7d6
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x34]
push ebx
push eax
call fcn.1014a022
add esp, 0xc
cmp dword [edi + 4], 3
push 0x10
pop esi
jl 0x1003d820
push 0x32
pop edi
lea eax, [ebp - 0x14]
push eax
push esi
push eax
call fcn.1014a022
add esp, 0xc
sub edi, 1
jne 0x1003d80d
xor eax, eax
lea edi, [ebp - 0x54]
cmp dword [ebp + 0x14], esi
push 8
cmovbe esi, dword [ebp + 0x14]
pop ecx
rep stosd dword es:[edi], eax
push esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.10128bc0
mov esi, dword [ebp - 0xc0]
add esp, 0xc
test esi, esi
je 0x1003d851
mov edi, dword [esi + 4]
jmp 0x1003d853
xor edi, edi
push 0x40
cmp edi, ebx
lea eax, [ebp - 0xb4]
push 0
cmovg edi, ebx
push eax
mov dword [ebp - 0xc4], edi
call fcn.10128a60
add esp, 0xc
test esi, esi
je 0x1003d87a
add esi, 0xc
jmp 0x1003d87f
mov esi, 0x1014e2b4
push edi
lea eax, [ebp - 0xb4]
push esi
push eax
call fcn.10128bc0
mov eax, dword [ebp - 0xbc]
add esp, 0xc
cmp dword [eax + 4], 2
jne 0x1003d8b5
push dword [ebp + 0x14]
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0xb4]
push edi
push eax
call fcn.10149e80
add esp, 0x10
jmp 0x1003d913
mov esi, dword [ebp - 0xc4]
push 0x13
pop edx
mov dword [ebp - 0xb8], edx
push 8
xor eax, eax
lea edi, [ebp - 0x74]
pop ecx
rep stosd dword es:[edi], eax
mov edi, dword [ebp - 0xbc]
xor ecx, ecx
cmp dword [edi + 0x38], eax
jle 0x1003d8eb
mov al, byte [ebp + ecx - 0x54]
xor al, dl
mov byte [ebp + ecx - 0x74], al
inc ecx
cmp ecx, dword [edi + 0x38]
jl 0x1003d8db
push dword [ebp + 0x14]
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0xb4]
push esi
push eax
call fcn.10149e80
mov edx, dword [ebp - 0xb8]
add esp, 0x10
sub edx, 1
mov dword [ebp - 0xb8], edx
jns 0x1003d8c4
mov ecx, 0x101556cf
lea edx, [ebp - 0x95]
sub ecx, ebx
sub edx, ebx
mov al, byte [ecx + ebx]
cmp al, byte [edx + ebx]
jne 0x1003d92f
sub ebx, 1
jne 0x1003d922
mov ecx, dword [ebp - 0xc8]
lea eax, [ebp - 0xb4]
push ebx
push eax
call fcn.10013a5d
lea ecx, [ebp - 0xc0]
call fcn.10013aa3
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc8]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10127041
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1007db79
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
inc edi
cmp dword [ebp + 0x10], edi
jne 0x1007dc1f
mov eax, dword [ebp + 0xc]
shl eax, 3
cmp eax, 0x7fffffff
ja 0x1007dca5
mov esi, dword [ebp + 0x14]
imul esi, dword [ebp + 0x18]
cmp eax, esi
cmovl esi, eax
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
cmp esi, edi
jle 0x1007dc9e
mov ebx, edi
and ebx, 0x80000007
jns 0x1007dbc9
dec ebx
or ebx, 0xfffffff8
inc ebx
mov eax, edi
mov cl, 7
sub cl, byte [ebp - 8]
cdq
and edx, 7
add eax, edx
mov edx, dword [ebp + 8]
sar eax, 3
mov dword [ebp + 0x10], eax
push 7
mov ch, byte [eax + edx]
mov eax, dword [ebp - 4]
mov dl, byte [eax + edx]
mov al, ch
shr dl, cl
mov cl, 7
sub cl, bl
shr al, cl
xor dl, al
movzx ecx, ch
pop eax
sub eax, ebx
test dl, 1
mov edx, dword [ebp + 8]
je 0x1007dc09
bts ecx, eax
jmp 0x1007dc0c
btr ecx, eax
mov eax, dword [ebp + 0x10]
inc edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov byte [eax + edx], cl
cmp edi, esi
jl 0x1007dbba
jmp 0x1007dc9e
mov eax, dword [ebp + 0x10]
imul eax, dword [ebp + 0x14]
cdq
and edx, 7
lea ecx, [edx + eax]
sar ecx, 3
cmp dword [ebp + 0x10], 0x10
jne 0x1007dc86
mov esi, dword [ebp + 0xc]
cmp ecx, esi
jae 0x1007dc9e
mov edi, dword [ebp + 8]
or ebx, 0xffffffff
inc edi
sub esi, ecx
add edi, ecx
sub ebx, ecx
dec esi
shr esi, 1
inc esi
movzx edx, byte [ebx + edi]
movzx eax, byte [ebx + edi + 1]
movzx ecx, byte [edi - 1]
shl dx, 8
or dx, ax
shl cx, 8
movzx eax, byte [edi]
or cx, ax
add dx, cx
movzx ecx, dx
mov eax, ecx
mov byte [edi], cl
shr eax, 8
lea edi, [edi + 2]
mov byte [edi - 3], al
sub esi, 1
jne 0x1007dc4e
jmp 0x1007dc9e
cmp ecx, dword [ebp + 0xc]
jae 0x1007dc9e
mov esi, dword [ebp + 8]
mov edx, esi
sub edx, ecx
mov al, byte [edx + ecx]
add byte [ecx + esi], al
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x1007dc92
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1012ef00
int3
Function at 0x1009ff96
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1030b908]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
call fcn.100a1693
test al, al
je 0x1009fffa
push 0x18
call fcn.10126fbc
mov esi, eax
pop ecx
test esi, esi
je 0x1009fff3
push 0
mov dword [esi], 0x1021c210
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
lea ecx, [esi + 0xc]
mov dword [esi + 4], eax
call fcn.10030bbc
lea ecx, [esi + 0x10]
call fcn.10030bbc
lea ecx, [esi + 0x14]
call fcn.10030bbc
jmp 0x100a008f
xor esi, esi
jmp 0x100a008f
push 0x1c
call fcn.10126fbc
mov esi, eax
pop ecx
test esi, esi
je 0x100a0017
mov ecx, esi
call fcn.100b446c
mov dword [esi], 0x1021c1ec
jmp 0x100a0019
xor esi, esi
push ebx
mov ebx, 0x104
lea eax, [ebp - 0x108]
push ebx
push 0
push eax
call fcn.10128a60
add esp, 0xc
lea eax, [ebp - 0x108]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec eax
pop ebx
cmp eax, 0x102
ja 0x100a008f
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x10c]
call fcn.100139c3
push str.Fonts
lea ecx, [ebp - 0x10c]
call fcn.10013d51
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x10c]
call fcn.10001d76
push eax
mov ecx, esi
call fcn.100b4514
lea ecx, [ebp - 0x10c]
call fcn.10013aa3
mov ecx, dword [ebp - 4]
mov eax, edi
mov dword [edi], esi
xor ecx, ebp
pop edi
pop esi
call fcn.10127041
mov esp, ebp
pop ebp
ret

Function at 0x100a740b
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jle 0x100a74c7
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0xff
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x100a744b
movzx ecx, byte [ecx]
xor edx, edx
movzx eax, byte [esi + 3]
imul eax, ecx
mov ecx, 0xff
div ecx
inc dword [ebp + 0x18]
mov edx, ecx
jmp 0x100a744e
mov al, byte [esi + 3]
cmp al, dl
jne 0x100a7467
mov al, byte [esi]
mov byte [edi + 2], al
mov al, byte [esi + 1]
mov byte [edi + 1], al
mov al, byte [esi + 2]
mov byte [edi], al
add esi, 4
jmp 0x100a74b3
test al, al
je 0x100a7462
movzx ecx, al
mov ebx, edx
lea eax, [edi + 2]
mov dword [ebp - 0xc], ecx
sub ebx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], 3
mov edi, eax
movzx eax, byte [esi]
imul eax, ecx
movzx ecx, byte [edi]
imul ecx, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov ecx, dword [ebp - 0xc]
inc esi
mov byte [edi], al
dec edi
sub dword [ebp - 4], 1
jne 0x100a7484
mov edi, dword [ebp + 8]
inc esi
mov ebx, dword [ebp + 0x10]
mov edx, 0xff
add edi, dword [ebp + 0x14]
sub ebx, 1
mov dword [ebp + 8], edi
mov dword [ebp + 0x10], ebx
jne 0x100a742a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100a74cc
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call fcn.10093ab5
cmp dword [ebp + 0x1c], 0
mov eax, dword [eax + 0x10c]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x18], ecx
je 0x100a7519
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 0x20]
push dword [ebp + 0x24]
call fcn.100800ff
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0x20]
push dword [ebp + 8]
call fcn.100a7287
add esp, 0x18
jmp 0x100a75f6
mov eax, dword [ebp + 0x14]
add eax, 0xfffffffd
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
test eax, eax
jle 0x100a75f6
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
add ebx, 3
push edi
mov edi, dword [ebp + 0x20]
mov dword [ebp + 0x1c], eax
push 1
lea eax, [ebx - 3]
push eax
push edi
push dword [ebp + 0x24]
call fcn.100800ff
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
je 0x100a7572
movzx ecx, byte [ecx]
xor edx, edx
movzx eax, byte [ebx]
imul eax, ecx
mov ecx, 0xff
div ecx
inc dword [ebp + 0x1c]
jmp 0x100a7574
mov al, byte [ebx]
add ebx, 4
mov edx, 0xff
mov dword [ebp - 0x14], ebx
cmp al, dl
jne 0x100a75a0
mov al, byte [edi]
mov byte [esi], al
mov al, byte [edi + 1]
mov byte [esi + 1], al
add esi, 2
mov al, byte [edi + 2]
add edi, 3
mov byte [esi], al
mov eax, dword [ebp - 8]
inc eax
add esi, eax
jmp 0x100a75e6
test al, al
jne 0x100a75ac
add esi, dword [ebp + 0x14]
add edi, 3
jmp 0x100a75e6
movzx ecx, al
mov ebx, edx
mov dword [ebp - 0x10], ecx
sub ebx, ecx
mov dword [ebp - 4], 3
movzx eax, byte [edi]
imul eax, ecx
movzx ecx, byte [esi]
imul ecx, ebx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov ecx, dword [ebp - 0x10]
mov byte [esi], al
inc esi
inc edi
sub dword [ebp - 4], 1
jne 0x100a75bd
add esi, dword [ebp - 8]
mov ebx, dword [ebp - 0x14]
sub dword [ebp - 0xc], 1
mov ecx, dword [ebp - 0x18]
jne 0x100a7545
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100a98b2
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x1c]
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x14]
push esi
add ebx, 0xfffffffd
push edi
test edx, edx
je 0x100a999b
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x10], ebx
jle 0x100a9a5a
mov esi, dword [ebp + 0xc]
mov ecx, 0xff
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
movzx eax, byte [ebx + eax]
mov dword [ebp - 8], eax
cmp eax, ecx
jne 0x100a9912
mov al, byte [esi]
mov byte [edi], al
mov al, byte [esi + 1]
add esi, 2
mov byte [edi + 1], al
mov al, byte [esi]
mov byte [edi + 2], al
add edi, 3
mov eax, dword [ebp + 0x14]
mov byte [edx], cl
add eax, 0xfffffffe
jmp 0x100a9980
test eax, eax
jne 0x100a991e
add edi, 3
add esi, dword [ebp + 0x14]
jmp 0x100a9985
movzx ebx, byte [edx]
mov eax, ebx
imul eax, dword [ebp - 8]
push 3
cdq
idiv ecx
mov edx, dword [ebp - 8]
mov cl, dl
sub cl, al
mov eax, dword [ebp + 0x1c]
add cl, bl
pop ebx
mov byte [eax], cl
imul eax, edx, 0xff
movzx ecx, cl
cdq
idiv ecx
mov edx, 0xff
sub edx, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
movzx eax, byte [esi]
imul eax, dword [ebp - 8]
movzx ecx, byte [edi]
imul ecx, edx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov edx, dword [ebp - 0xc]
mov byte [edi], al
inc edi
inc esi
sub ebx, 1
jne 0x100a9954
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x1c]
add eax, 0xfffffffd
mov ebx, dword [ebp - 4]
add esi, eax
inc ebx
inc edx
mov dword [ebp - 4], ebx
mov dword [ebp + 0x1c], edx
cmp ebx, dword [ebp + 0x10]
jl 0x100a98e5
jmp 0x100a9a5a
xor edx, edx
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], edx
jle 0x100a9a5a
mov edi, dword [ebp + 0xc]
mov ecx, 0xff
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x18]
movzx eax, byte [edx + eax]
mov dword [ebp + 0x1c], eax
cmp eax, ecx
jne 0x100a99dd
mov al, byte [edi]
mov byte [esi], al
mov al, byte [edi + 1]
mov byte [esi + 1], al
mov al, byte [edi + 2]
mov byte [esi + 2], al
mov byte [esi + 3], cl
add esi, 4
add edi, 3
jmp 0x100a9a4b
test eax, eax
jne 0x100a99e9
add esi, 4
add edi, dword [ebp + 0x14]
jmp 0x100a9a4d
movzx ebx, byte [esi + 3]
mov eax, ebx
imul eax, dword [ebp + 0x1c]
push 3
cdq
idiv ecx
mov edx, dword [ebp + 0x1c]
mov cl, dl
sub cl, al
imul eax, edx, 0xff
add cl, bl
mov byte [esi + 3], cl
movzx ecx, cl
pop ebx
cdq
idiv ecx
mov edx, 0xff
sub edx, eax
mov dword [ebp + 0x1c], eax
mov dword [ebp - 0xc], edx
movzx eax, byte [edi]
imul eax, dword [ebp + 0x1c]
movzx ecx, byte [esi]
imul ecx, edx
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov edx, dword [ebp - 0xc]
mov byte [esi], al
inc esi
inc edi
sub ebx, 1
jne 0x100a9a1e
mov ebx, dword [ebp + 0x14]
inc esi
mov edx, dword [ebp - 8]
add ebx, 0xfffffffd
add edi, ebx
inc edx
mov dword [ebp - 8], edx
cmp edx, dword [ebp + 0x10]
jl 0x100a99b4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret