joyce8/EMBER2024-capa huggingface dataset:
Function at 0x417c6c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x417ae4
mov eax, dword [0x458260]
cmp byte [eax], 0
je 0x417cd9
mov eax, dword [0x458264]
call fcn.004256e4
call fcn.004252d8
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00414d7c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x417d20
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
jmp 0x417d0f
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x458120]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x458280]
call fcn.00427f7c
push eax
call sub.USER32.DLL_LoadStringA
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.USER32.DLL_MessageBoxA
add esp, 0x444
ret

Function at 0x418990
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4189f4
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00426c00
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetACP
mov edx, eax
pop eax
call fcn.00414954
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4189fb
lea eax, [ebp - 0xc]
call fcn.00426998
ret

Function at 0x425cf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x454b3c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x425d88
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x425d68
xor eax, eax
push ebp
push 0x425d61
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x425da4
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x425d68
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
mov ax, word [0x454b3c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x454b3c], ax
mov esp, ebp
pop ebp
ret

Function at 0x42681c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x462fec], 0
je 0x42687d
cmp word [0x4631c0], 0xd7b2
jne 0x426845
cmp dword [0x4631c8], 0
jbe 0x426845
mov eax, 0x4631bc
call dword [0x4631d8]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4268a4
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile
pop edx
ret
cmp byte [0x454b4c], 0
jne 0x426899
push 0
push 0x454ba4
push str.Runtime_error_____at_00000000
push 0
call sub.USER32.DLL_MessageBoxA
pop edx
ret
Function at 0x428170
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4283a0
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x4281f3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4283a0
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x4281f3
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4283bc
push SysReAllocStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x42827c
xor eax, eax
push ebp
push 0x428275
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00427fb8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x42825a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4283dc
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x42825a
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42827c
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x428396
cmp byte [ebp - 0xd], 0
jne 0x4282c3
cmp byte [ebp - 0x12], 0
je 0x428396
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4282dc
dec ebx
cmp byte [ebx], 0x2e
je 0x4282eb
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4282db
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x428396
inc ebx
cmp byte [ebp - 0x12], 0
je 0x428328
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x428396
cmp byte [ebp - 0xd], 0
je 0x428396
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x428396
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x428adc
Capabilities:
Accept command line arguments

Disassembly:
sub dword [0x463560], 1
jae 0x428b62
mov byte [0x454b38], 2
mov dword [0x462fb0], 0x435040
mov dword [0x462fb4], 0x435052
mov byte [0x462fee], 2
mov dword [0x462f9c], 0x4277a8
call fcn.00425cc0
test al, al
je 0x428b1f
call fcn.00425cf0
call fcn.00425db4
mov word [0x462ff4], 0xd7b0
mov word [0x4631c0], 0xd7b0
mov word [0x46338c], 0xd7b0
call fcn.00427688
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x462fe0], eax
call fcn.00423dc4
mov dword [0x462fdc], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x462fd4], eax
ret

Function at 0x42aa30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x42aa4c
call fcn.0042c004
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x42aa68
test bl, 1
je 0x42aa68
call fcn.0042fae4
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x42ac4c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.0042bba0
test byte [ebp + 0xd], 0xc0
jne 0x42ac70
mov eax, dword [0x455980]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x42ac7d
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x42acaa
je 0x42acbc
sub ecx, 0x100
je 0x42acca
sub ecx, 0x100
je 0x42acd1
sub ecx, 0x100
je 0x42acc3
jmp 0x42acd8
sub ecx, 0x600
je 0x42acd1
sub ecx, 0x100
je 0x42acbc
jmp 0x42acd8
mov edi, 1
jmp 0x42acdd
mov edi, 2
jmp 0x42acdd
mov edi, 4
jmp 0x42acdd
mov edi, 5
jmp 0x42acdd
mov edi, 3
test byte [ebp + 0xd], 1
je 0x42ad04
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x4553f8]
test al, 0x80
je 0x42acfd
mov ebx, 0x80
jmp 0x42ad16
mov ebx, 1
jmp 0x42ad16
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x42ad16
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x42ad28
je 0x42ad31
dec eax
je 0x42ad3a
jmp 0x42ad43
mov dword [ebp - 4], SysStringLen
jmp 0x42ad52
mov dword [ebp - 4], 0x40000000
jmp 0x42ad52
mov dword [ebp - 4], 0xc0000000
jmp 0x42ad52
push 1
call fcn.0042bf98
pop ecx
mov ebx, eax
jmp 0x42ae42
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x42ad6e
sub eax, 0x10
je 0x42ad75
sub eax, 0x10
je 0x42ad7e
sub eax, 0x10
je 0x42ad87
jmp 0x42ad87
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x42ad8e
mov dword [ebp - 8], 1
jmp 0x42ad8e
mov dword [ebp - 8], 2
jmp 0x42ad8e
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x42adfb
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x42adf0
test byte [ebp + 0xd], 1
je 0x42adeb
mov ebx, 0x50
jmp 0x42adf0
mov ebx, 2
push ebx
call fcn.0042bf98
pop ecx
mov ebx, eax
jmp 0x42ae42
mov edi, esi
push edi
call fcn.0042abb0
pop ecx
test eax, eax
je 0x42ae0f
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x42ae1b
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0042bcc0
add esp, 8
mov ebx, eax
inc eax
jne 0x42ae42
push 4
call fcn.0042bf98
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.0042bbd4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42fa7c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x42fade
call fcn.0042fa2c
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00429850
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00429850
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x42fb5c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x456918], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x42fc36
cmp dword [0x456914], 0
jne 0x42fc36
cmp dword [0x456a0c], 0
je 0x42fbf0
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0042f92c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x42fbd6
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0042f92c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x42fbd6
lea ebx, [ebp - 0x84]
jmp 0x42fbd7
inc ebx
call fcn.0042fb18
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x42fc71
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x45691c
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00429850
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x45691f
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x42fc71
cmp dword [0x456914], 0
je 0x42fc50
cmp dword [0x456914], 0xffffffff
je 0x42fc71
push esi
call dword [0x456914]
pop ecx
mov eax, dword [0x456918]
test eax, eax
je 0x42fc71
cmp dword [0x456918], 0xffffffff
je 0x42fc71
cmp byte [eax], 0
je 0x42fc71
push esi
push eax
call fcn.0042fa7c
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4306d0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov dword [ebp - 8], 1
mov dword [ebp - 4], esi
cmp edi, 1
jne 0x430756
mov eax, dword [0x463f40]
inc dword [0x463f40]
test eax, eax
jne 0x430756
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x463f0c], eax
mov edx, dword [ebp + 0x10]
mov dword [0x436087], edx
mov ecx, dword [esi + 0x44]
push ecx
call fcn.0042b5c0
pop ecx
cmp dword [0x456954], 0
je 0x430741
call fcn.00430554
mov ebx, eax
test eax, eax
je 0x430741
mov edx, dword [ebx]
cmp dword [ebx + edx*4 + 4], 0xffffffff
je 0x430741
mov ecx, dword [ebx]
inc dword [ebx]
mov dword [ebx + ecx*4 + 4], esi
jmp 0x430756
xor eax, eax
lea edx, [ebp - 8]
push 0
push edx
mov dword [0x456954], eax
call fcn.0043055c
add esp, 8
mov ecx, dword [ebp + 0x18]
push ecx
push edi
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [esi + 0x18]
push edx
call fcn.00430864
mov ebx, eax
test edi, edi
jne 0x4307c5
test edi, edi
jne 0x430796
dec dword [0x463f40]
jne 0x430796
cmp dword [0x463f0c], 0
je 0x430796
mov eax, dword [0x463f0c]
push eax
call sub.KERNEL32.DLL_FreeEnvironmentStringsA
xor edx, edx
mov dword [0x463f0c], edx
cmp dword [0x463f40], 0
jne 0x4307c5
cmp dword [0x456954], 0
jne 0x4307c5
cmp dword [0x456944], 0
je 0x4307b7
call dword [0x456944]
push 1
lea ecx, [ebp - 8]
push ecx
call fcn.0043055c
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x430cd8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0xc]
cmp esi, 0x10
jge 0x430cfe
test esi, esi
je 0x430cfe
call fcn.0042fae4
mov dword [eax], 0x13
or eax, 0xffffffff
jmp 0x430d70
call fcn.004309ec
mov ebx, eax
test eax, eax
jne 0x430d19
call fcn.0042fae4
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x430d70
mov edx, dword [ebp + 0x10]
mov dword [ebx + 4], edx
lea edx, [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x14], ecx
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x54], eax
push edx
mov ecx, dword [ebp + 0x18]
push ecx
push ebx
push 0x430c34
push esi
mov eax, dword [ebp + 0x14]
push eax
call sub.KERNEL32.DLL_CreateThread
test eax, eax
jne 0x430d64
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x718
jne 0x430d5d
push 0x59
call fcn.0042bf98
pop ecx
jmp 0x430d70
call fcn.0042c004
jmp 0x430d70
mov dword [ebx + 8], eax
test edi, edi
je 0x430d70
mov edx, dword [ebp - 4]
mov dword [edi], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x1001bf50
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x40]
mov esi, dword [esp + 0x48]
mov cl, 4
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, ebx
or eax, edi
je 0x1001bfca
xor eax, eax
cmp esi, ebx
sbb eax, edi
mov eax, ebx
cmovb eax, esi
cmp eax, esi
ja 0x1001c0a3
mov ecx, dword [ebp + 4]
lea edx, [esp + 0x10]
push eax
push dword [esp + 0x48]
push dword [ebp]
push edx
call dword [ecx + 0xc]
add esp, 0x10
movzx eax, byte [esp + 0x10]
cmp al, 4
jne 0x1001bfd9
mov edx, dword [esp + 0x14]
mov eax, edi
mov cl, 4
cmp ebx, edx
sbb eax, 0
jb 0x1001c0af
sub ebx, edx
sbb edi, 0
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], edi
mov eax, dword [esp + 0x3c]
test esi, esi
jne 0x1001bffa
jmp 0x1001c08e
xor edx, edx
mov eax, dword [esp + 0x3c]
test esi, esi
jne 0x1001bffa
jmp 0x1001c08e
movzx ecx, byte [esp + 0x13]
movzx edi, word [esp + 0x11]
mov edx, dword [esp + 0x14]
shl ecx, 0x10
or edi, ecx
mov ecx, eax
mov eax, dword [esp + 0x3c]
test esi, esi
je 0x1001c08e
mov dword [esp + 4], edi
mov byte [esp + 3], cl
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov ebp, dword [esp + 0x44]
mov dword [esp + 8], edx
nop word cs:[eax + eax]
nop dword [eax]
mov edx, ecx
mov dword [esp + 0xc], esi
movzx esi, cl
shr ecx, 8
or edx, 3
mov eax, edx
and eax, 0xfffffffe
imul eax, edx
mov edx, ebx
shr ebx, 8
xor ah, byte [ebp]
xor dl, ah
mov byte [ebp], ah
inc ebp
movzx edx, dl
xor ebx, dword [edx*4 + 0x101cdb84]
movzx edx, bl
add edx, edi
imul edi, edx, 0x8088405
inc edi
mov edx, edi
shr edx, 0x18
xor esi, edx
xor ecx, dword [esi*4 + 0x101cdb84]
mov esi, dword [esp + 0xc]
dec esi
jne 0x1001c020
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 8]
mov dword [eax + 0x18], ecx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], edi
movzx ecx, byte [esp + 3]
mov edi, dword [esp + 4]
mov eax, dword [esp + 0x3c]
shl edi, 8
movzx ecx, cl
mov dword [eax + 4], edx
or ecx, edi
mov dword [eax], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x101cd9f0
push esi
push eax
call fcn.101cbcc0
mov dword [esp + 0x10], str.number_of_read_bytes_exceeds_limit
mov dword [esp + 0x14], 1
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 4
mov dword [esp + 0x1c], 0
push 0x101cda2c
lea eax, [esp + 0x14]
push eax
call fcn.101cb880
int3
Function at 0x10023f90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
test byte [edx], 1
je 0x10023fbe
mov esi, dword [edx + 0x30]
cmp dword [edx + 0x24], 0xffffffff
mov edi, dword [edx + 0x34]
mov ebx, dword [edx + 0x38]
mov ebp, dword [edx + 0x3c]
lea eax, [edx + 8]
mov edx, eax
je 0x100240b7
push 0
jmp 0x100240b9
xor eax, eax
cmp byte [edx + 0xe], 0
jne 0x100240ef
mov esi, dword [edx + 0x34]
mov ebx, dword [edx + 4]
mov edi, dword [edx + 0x30]
movzx eax, byte [edx + 0xc]
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 8], esi
jmp 0x10023ff5
add ebx, ecx
mov dword [edx + 4], ebx
mov ah, al
xor al, 1
test ebx, ebx
je 0x10024016
cmp ebx, esi
jae 0x10024010
cmp byte [edi + ebx], 0xbf
jg 0x10024016
jmp 0x100240f9
jne 0x100240f9
cmp ebx, esi
je 0x100240c7
movzx ecx, byte [edi + ebx]
movzx ebp, cl
test cl, cl
jns 0x1002407d
mov edx, edi
movzx edi, byte [edi + ebx + 1]
and ebp, 0x1f
and edi, 0x3f
cmp cl, 0xdf
jbe 0x10024068
movzx esi, byte [edx + ebx + 2]
shl edi, 6
and esi, 0x3f
or esi, edi
cmp cl, 0xf0
jb 0x1002406f
movzx ecx, byte [edx + ebx + 3]
shl esi, 6
and ebp, 7
shl ebp, 0x12
and ecx, 0x3f
or ecx, esi
mov esi, dword [esp + 8]
or ebp, ecx
jmp 0x10024078
shl ebp, 6
or ebp, edi
jmp 0x10024078
shl ebp, 0xc
or ebp, esi
mov esi, dword [esp + 8]
mov edi, edx
mov edx, dword [esp]
test ah, 1
jne 0x100240db
mov ecx, 1
cmp ebp, 0x80
jb 0x10023ff0
mov ecx, 2
cmp ebp, 0x800
jb 0x10023ff0
cmp ebp, 0x10000
mov ecx, 4
sbb ecx, 0
jmp 0x10023ff0
push 1
push ebp
push ebx
push edi
push esi
call fcn.100239b0
add esp, 0x20
jmp 0x100240f4
test ah, 1
mov byte [edx + 0xc], al
jne 0x100240e0
mov ecx, dword [esp + 4]
mov byte [edx + 0xe], 1
xor eax, eax
jmp 0x100240ef
mov esi, ebx
mov byte [edx + 0xc], al
mov ecx, dword [esp + 4]
mov eax, 1
mov dword [ecx + 4], esi
mov dword [ecx + 8], esi
mov dword [ecx], eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [edx + 0xc], al
push 0x101d3a98
push esi
push ebx
push esi
push edi
call fcn.101cbe90
int3
Function at 0x100250b0
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
mov dword [esi + 0x6c], esp
mov dword [esi + 0x78], 0xffffffff
mov dword [esi + 0x74], 0x100285a0
mov edi, dword [ebp + 0xc]
mov eax, dword fs:[0]
mov dword [esi + 0x70], eax
lea eax, [esi + 0x70]
mov dword fs:[0], eax
movsd xmm2, qword [edi + 0x60]
movsd xmm1, qword [edi + 0x58]
movsd xmm0, qword [edi + 0x68]
movsd qword [esi + 0x28], xmm2
movsd qword [esi + 0x20], xmm1
movsd xmm2, qword [edi + 0x48]
movsd xmm1, qword [edi + 0x50]
movsd qword [esi + 0x30], xmm0
movsd qword [esi + 0x18], xmm1
movsd qword [esi + 0x10], xmm2
movzx eax, byte [0x10283b09]
push 8
push 0x28
call fcn.10013860
add esp, 8
test eax, eax
mov dword [esi + 0xc], eax
je 0x1002525c
lea ecx, [edi + 0x48]
movsd xmm2, qword [ecx + 0x18]
movsd xmm1, qword [ecx + 0x10]
movsd xmm0, qword [ecx + 0x20]
movsd qword [eax + 0x18], xmm2
movsd qword [eax + 0x10], xmm1
movsd xmm2, qword [ecx]
movsd xmm1, qword [ecx + 8]
movsd qword [eax + 0x20], xmm0
lea ecx, [esi + 0x10]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm2
push 0x48
push edi
push ecx
mov ebx, eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], ebx
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov dword [esi + 0x60], 0x101d5cec
mov dword [esi + 0x64], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 4], eax
mov eax, dword [ebx + 0x14]
mov dword [esi + 8], eax
movzx eax, byte [0x10283b09]
push 4
push 0x48
call fcn.10013860
add esp, 8
test eax, eax
je 0x10025271
movsd xmm0, qword [ebx]
movsd xmm1, qword [ebx + 8]
mov ecx, edi
mov edi, eax
movsd xmm2, qword [ebx + 0x28]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov eax, dword [esi + 4]
movsd xmm1, qword [ebx + 0x20]
movsd xmm0, qword [ebx + 0x18]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 8]
mov dword [edi + 0x14], eax
movsd qword [edi + 0x20], xmm1
movsd xmm1, qword [ebx + 0x30]
movsd qword [edi + 0x28], xmm2
movsd xmm2, qword [ebx + 0x38]
movsd qword [edi + 0x18], xmm0
movsd qword [edi + 0x30], xmm1
movsd xmm1, qword [ebx + 0x40]
mov ebx, dword [ebp + 8]
movsd qword [edi + 0x38], xmm2
movsd qword [edi + 0x40], xmm1
push 0x48
push ecx
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esi + 0xc]
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x50], 0x101d5cec
mov dword [ebx + 0x54], eax
mov eax, dword [esi + 0x70]
mov dword [ebx + 0x58], edi
mov dword fs:[0], eax
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0x78], 2
push 0x28
push 8
call fcn.101cb670
add esp, 8
jmp 0x10025284
mov dword [esi + 0x78], 3
push 0x48
push 4
call fcn.101cb670
add esp, 8
ud2