joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426397
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0041cfc0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x426432
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x45c540]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x426432
cmp eax, 1
je 0x426453
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x426432
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x4263ff
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x42642e
xor eax, eax
inc eax
jmp 0x426472
cmp edi, eax
jae 0x426436
xor eax, eax
jmp 0x426472
cmp eax, esi
jae 0x42643d
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x45c540]
jmp 0x426456
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x426686
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x45c904], ebx
push esi
push edi
jne 0x426706
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x426741
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42f3ec
push edi
call esi
test eax, eax
mov dword [0x45c904], eax
je 0x426741
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x45c908], eax
call esi
cmp dword [0x45c540], 2
mov dword [0x45c90c], eax
jne 0x426706
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x45c914], eax
je 0x426706
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x45c910], eax
mov eax, dword [0x45c910]
test eax, eax
je 0x42674b
call eax
test eax, eax
je 0x426732
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x45c914]
test eax, eax
je 0x426732
test byte [ebp - 8], 1
jne 0x42674b
cmp dword [0x45c54c], 4
jb 0x426745
or byte [ebp + 0x12], 0x20
jmp 0x42676a
xor eax, eax
jmp 0x42677a
or byte [ebp + 0x12], 4
jmp 0x42676a
mov eax, dword [0x45c908]
test eax, eax
je 0x42676a
call eax
mov ebx, eax
test ebx, ebx
je 0x42676a
mov eax, dword [0x45c90c]
test eax, eax
je 0x42676a
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x45c904]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x427430
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x427449
or eax, 0xffffffff
jmp 0x4274aa
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x4274a6
push 0x3d
push esi
call fcn.00428252
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x4274a6
cmp esi, eax
je 0x4274a6
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x45c560]
sete cl
cmp eax, dword [0x45c564]
mov dword [ebp - 8], ecx
jne 0x42748c
mov edi, eax
call fcn.004273cf
mov dword [0x45c560], eax
cmp eax, ebx
jne 0x4274e5
cmp dword [ebp + 0xc], ebx
je 0x4274ae
cmp dword [0x45c568], ebx
je 0x4274ae
call fcn.0042435e
test eax, eax
je 0x4274e5
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x4274b7
xor eax, eax
jmp 0x4274a9
push 4
call fcn.0041dfb3
cmp eax, ebx
pop ecx
mov dword [0x45c560], eax
je 0x4274a6
mov dword [eax], ebx
cmp dword [0x45c568], ebx
jne 0x4274e5
push 4
call fcn.0041dfb3
cmp eax, ebx
pop ecx
mov dword [0x45c568], eax
je 0x4274a6
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x45c560]
call fcn.00427382
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x427546
cmp dword [esi], ebx
je 0x427546
lea esi, [esi + edi*4]
push dword [esi]
call fcn.0041d905
cmp dword [ebp - 8], ebx
pop ecx
jne 0x427529
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x427587
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x427520
mov eax, edi
shl eax, 2
push eax
push dword [0x45c560]
call fcn.00423c53
cmp eax, ebx
pop ecx
pop ecx
je 0x427587
jmp 0x427582
cmp dword [ebp - 8], ebx
jne 0x4275f2
cmp edi, ebx
jge 0x427555
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x45c560]
call fcn.00423c53
cmp eax, ebx
pop ecx
pop ecx
je 0x4274a6
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x45c560], eax
cmp dword [ebp + 0xc], ebx
je 0x4275dc
push dword [ebp - 4]
call fcn.00421cb0
inc eax
inc eax
push eax
call fcn.0041dfb3
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x4275dc
push dword [ebp - 4]
push esi
call fcn.00422dd0
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x4275d5
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.0041d905
pop ecx
cmp dword [ebp - 8], ebx
je 0x4275ea
push dword [ebp - 4]
call fcn.0041d905
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x4274a9
push dword [ebp - 4]
call fcn.0041d905
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x4274b3
Function at 0x428026
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0041cfc0
mov eax, dword [0x432154]
push ebx
push esi
push 1
xor esi, esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.0042554e
or ebx, 0xffffffff
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x428159
push 2
push esi
push dword [ebp + 8]
call fcn.0042554e
add esp, 0xc
cmp eax, ebx
je 0x428159
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x4280f9
mov ebx, 0x1000
push ebx
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.004242b0
push 0x8000
push dword [ebp + 8]
call fcn.00428585
add esp, 0x14
mov dword [ebp - 0x100c], eax
cmp edi, ebx
mov eax, ebx
jge 0x4280af
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp + 8]
call fcn.0041f64d
add esp, 0xc
cmp eax, 0xffffffff
je 0x4280cf
sub edi, eax
test edi, edi
jg 0x4280a7
jmp 0x4280e7
call fcn.0041de90
cmp dword [eax], 5
jne 0x4280e4
call fcn.0041de87
mov dword [eax], 0xd
or esi, 0xffffffff
push dword [ebp - 0x100c]
push dword [ebp + 8]
call fcn.00428585
pop ecx
pop ecx
jmp 0x428141
jge 0x428141
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042554e
push dword [ebp + 8]
call fcn.0042400c
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebx
jne 0x428141
call fcn.0041de87
mov dword [eax], 0xd
call fcn.0041de90
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], eax
push 0
push dword [ebp - 0x1008]
push dword [ebp + 8]
call fcn.0042554e
add esp, 0xc
mov eax, esi
pop edi
jmp 0x42815b
mov eax, ebx
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.00422ef9
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..retplne
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x2dd34a9
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..reloc
nop
mov ebx, 0x4304d8
mov ecx, 0x71fd1103
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10001519
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x70
xor eax, eax
lea ecx, [esp + 0x58]
mov dword [esp + 0x54], ecx
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x50]
mov ecx, esp
mov dword [ecx], 0xf1eb68
mov ecx, dword [sym.imp.GDI32.dll_BeginPath]
mov dword [esp + 0x4c], eax
call ecx
sub esp, 4
xor ecx, ecx
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], ecx
mov eax, dword [esp + 0x44]
mov ecx, 0xaf286bcb
mov dword [esp + 0x40], eax
mul ecx
mov eax, dword [esp + 0x40]
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0x13
mov ecx, dword [esp + 0x40]
sub ecx, eax
or ecx, 4
sub ecx, 7
mov dword [esp + 0x3c], ecx
je 0x10001589
jmp 0x100015a6
mov eax, esp
mov dword [eax + 4], 0xe12
mov dword [eax], 0xa27675
mov eax, dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call eax
sub esp, 8
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x40]
add eax, 1
cmp eax, 0x395
mov dword [esp + 0x44], eax
jne 0x10001556
xor eax, eax
xor ecx, ecx
mov edx, dword [esp + 0x4c]
sub edx, 2
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], edx
je 0x10001669
jmp 0x100015d9
mov eax, dword [esp + 0x4c]
sub eax, 0x29
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
je 0x10001669
jmp 0x100015f0
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov edx, 0xc
mov esi, 0x12e6cc
mov dword [esp + 0x68], esi
mov esi, dword [esp + 0x54]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0xc
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
call fcn.101656a0
mov eax, esp
lea ecx, [esp + 0x58]
mov dword [eax + 8], ecx
lea ecx, [esp + 0x68]
mov dword [eax + 4], ecx
mov dword [eax], ecx
mov dword [eax + 0xc], 0xd4b
mov eax, dword [sym.imp.KERNEL32.dll_CreatePipe]
call eax
sub esp, 0x10
mov ecx, dword [esp + 0x20]
add ecx, 1
cmp ecx, 0xa
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], ecx
jne 0x100015f0
mov eax, dword [esp + 0x4c]
add eax, 1
cmp eax, 0x4b
mov dword [esp + 0x50], eax
jne 0x10001531
lea esp, [ebp - 4]
pop esi
pop ebp
ret

Function at 0x101673f7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x102b69b0]
jne 0x10167401
repz ret
jmp fcn.10168dbc
Function at 0x1016a9db
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10166194
and dword [ebp - 4], 0
cmp dword [0x102b81cc], 0
mov ebx, eax
jne 0x1016aa8c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1016ab3d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1016ab3d
push eax
call fcn.10166122
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x102b81cc], eax
call esi
push eax
call fcn.10166122
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x102b81d0], eax
call esi
push eax
call fcn.10166122
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x102b81d4], eax
call esi
push eax
call fcn.10166122
pop ecx
mov dword [0x102b81dc], eax
test eax, eax
je 0x1016aa8c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10166122
pop ecx
mov dword [0x102b81d8], eax
mov eax, dword [0x102b81d8]
cmp eax, ebx
je 0x1016aae4
cmp dword [0x102b81dc], ebx
je 0x1016aae4
push eax
call fcn.1016619d
push dword [0x102b81dc]
mov esi, eax
call fcn.1016619d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1016aae4
test edi, edi
je 0x1016aae4
call esi
test eax, eax
je 0x1016aadb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1016aadb
test byte [ebp - 0xc], 1
jne 0x1016aae4
or dword [ebp + 0x10], 0x200000
jmp 0x1016ab1d
mov eax, dword [0x102b81d0]
cmp eax, ebx
je 0x1016ab1d
push eax
call fcn.1016619d
pop ecx
test eax, eax
je 0x1016ab1d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1016ab1d
mov eax, dword [0x102b81d4]
cmp eax, ebx
je 0x1016ab1d
push eax
call fcn.1016619d
pop ecx
test eax, eax
je 0x1016ab1d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x102b81cc]
call fcn.1016619d
pop ecx
test eax, eax
je 0x1016ab3d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1016ab3f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1016bbef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov ecx, dword [0x102b5f40]
add ecx, 0x205c
mov dword [0x102b5f3c], ecx
mov dword [0x102b5f40], 0x879
mov dword [ebp - 0x10], eax
call fcn.1016cfee
xor ecx, ecx
mov edx, eax
mov dword [0x102b5f3c], 0xfffff7a8
mov esi, dword [eax + 0x3c]
mov dword [0x102b5f40], 0x2416
mov dword [0x102b5f3c], 0x1348
mov esi, dword [eax + esi + 0x78]
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov ebx, dword [eax + esi + 0x24]
mov dword [0x102b5f3c], 0x254a
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
je 0x1016bd62
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bh
mov byte [ebp - 0x46], cl
je 0x1016bcf8
mov eax, dword [ebp - 0x44]
add eax, 1
mov cl, byte [ebp - 0x45]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x46]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x40], eax
jne 0x1016bca7
mov al, byte [ebp - 0x46]
test al, 1
jne 0x1016bd35
jmp 0x1016bd01
xor eax, eax
mov dword [0x102b5f3c], 0x150d
mov ecx, dword [ebp - 0x38]
add ecx, 2
mov edx, dword [ebp - 0x34]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
jb 0x1016bc8d
jmp 0x1016bd62
mov eax, dword [ebp - 0x38]
movzx ecx, word [eax]
mov dword [0x102b5f40], 0x2552
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x102b5f3c], 0xfffff15b
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x28]
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1016bd6d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [0x102b5f40], 0x2455
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [0x102b5f40], 0x15ac
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
je 0x1016bdd8
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
jl 0x1016bdab
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov edx, dword [0x102b5f3c]
add edx, 0xffffed2c
mov dword [0x102b5f3c], edx
mov edx, dword [ebp - 0xc]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jne 0x1016bec9
xor eax, eax
mov dword [0x102b5f3c], 0x2d1a
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x20], eax
jne 0x1016bec9
xor eax, eax
mov dword [0x102b5f3c], 0x6a7
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x20], eax
jne 0x1016bec9
xor eax, eax
mov dword [0x102b5f3c], 0x468
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x20], eax
jne 0x1016bec9
xor eax, eax
mov dword [0x102b5f3c], 0xffffe829
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x20], eax
jne 0x1016bec9
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x20], eax
jne 0x1016bec9
xor eax, eax
mov dword [0x102b5f40], 0x401
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
jne 0x1016bec9
mov eax, 1
mov dword [0x102b5f3c], 0x2389
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add esp, 0x20
pop ebp
ret
Function at 0x1016c427
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x102b5f48], 0
mov byte [0x102b5f4c], 0
mov dword [0x102b5f40], 0x2449
mov dword [0x102b5f3c], 0x109e
mov dword [0x102b5f44], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1016c495
xor eax, eax
mov dword [0x102b5f44], 0
mov ecx, dword [ebp - 0x20]
add ecx, 0x1d78
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x1016c4e1
mov eax, dword [ebp - 0x1c]
mov dword [0x102b5f40], 0x206
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x102b5f3c]
mov esi, eax
add esi, 0xfffff9d0
mov dword [0x102b5f3c], esi
mov esi, dword [0x102b5f44]
add esi, 1
mov dword [0x102b5f44], esi
cmp esi, 0x100
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
jl 0x1016c495
jmp 0x1016c478
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov edx, 0x3a46
mov esi, 0x100
mov dword [0x102b5f50], 0
mov edi, dword [0x102b5f48]
mov ebx, dword [ebp - 0x18]
movzx ebx, byte [ebx + eax]
add ebx, edi
mov dword [ebp - 0x2c], eax
xor edi, edi
mov dword [ebp - 0x30], edx
mov edx, edi
mov edi, dword [ebp - 0x10]
div edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add ebx, edx
mov dword [0x102b5f50], ebx
mov dword [0x102b5f40], ecx
mov dword [0x102b5f3c], 0xe04
mov eax, ebx
cdq
idiv esi
mov dword [0x102b5f48], edx
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
mov cl, byte [ecx + esi]
mov byte [0x102b5f4c], cl
mov dword [0x102b5f40], 0x18fd
mov ebx, dword [ebp - 0x18]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x102b5f4c]
mov edx, dword [0x102b5f48]
mov byte [ebx + edx], cl
mov dword [0x102b5f3c], 0x169e
mov edx, dword [0x102b5f44]
add edx, 1
mov dword [0x102b5f44], edx
cmp edx, 0x100
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
jl 0x1016c4e1
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1016c6fc
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x102b5f3c], 0x204b
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov cl, byte [eax + 0x1027c62e]
mov dl, byte [eax + str.M9:_]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x30], eax
jne 0x1016c71e
lea eax, [ebp - 0x24]
mov dword [0x102b5f40], 0x1bbe
mov dword [0x102b5f3c], 0x14
mov dword [ebp - 0x34], eax
call fcn.1016c87e
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.1016c95b
mov dword [0x102b5f3c], 0xeeb
mov dword [0x102b5f40], 0xfffffe15
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x1016c844
mov eax, dword [ebp - 0x38]
mov dword [0x102b5f3c], 0x2578
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.1016c2e0
xor eax, eax
mov dword [0x102b5f40], 0x145b
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x44], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x18], ecx
mov esi, dword [0x102b5f40]
add esi, 0xffffec67
mov dword [0x102b5f3c], esi
add ecx, 0x1d23
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x1016c83b
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret