joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005170
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x28
push 0xffffffffffffffff
call dword [0x10065048]
test eax, eax
jne 0x10005191
xor al, al
jmp 0x100051d5
push 2
push 0x100654d0
mov ecx, dword [ebp - 4]
push ecx
call fcn.10004580
add esp, 0xc
movzx edx, al
test edx, edx
je 0x100051c5
push 2
push 0x100654e4
mov eax, dword [ebp - 4]
push eax
call fcn.10004580
add esp, 0xc
movzx ecx, al
test ecx, ecx
jne 0x100051c9
xor al, al
jmp 0x100051d5
mov edx, dword [ebp - 4]
push edx
call dword [0x100651c4]
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x10005c40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x1007e274]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x40], 0xc20
xor eax, eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x401fffff
mov byte [ebp - 0x14], 0x43
mov byte [ebp - 0x13], 0x55
mov byte [ebp - 0x12], 0x52
mov byte [ebp - 0x11], 0x52
mov byte [ebp - 0x10], 0x45
mov byte [ebp - 0xf], 0x4e
mov byte [ebp - 0xe], 0x54
mov byte [ebp - 0xd], 0x5f
mov byte [ebp - 0xc], 0x55
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0xa], 0x45
mov byte [ebp - 9], 0x52
mov byte [ebp - 8], 0
push 0
push 3
mov ecx, dword [ebp - 0x20]
push ecx
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x40]
push eax
call dword [0x1006501c]
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
push ecx
push 0
lea edx, [ebp - 0x40]
push edx
push 1
call dword [0x10065024]
push 0
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
push 0x20000004
push 6
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [0x10065020]
mov edx, dword [ebp - 0x18]
push edx
call dword [0x1006519c]
mov eax, dword [ebp - 0x1c]
push eax
call dword [0x100651c4]
push 0x100
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [0x100651b4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003eb1d
mov esp, ebp
pop ebp
ret

Function at 0x100083c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 6
mov dword [ebp - 4], 0
jmp 0x100083e2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 9
jge 0x10008421
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x64316fc3]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000841c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x100083d9
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1000a520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061f7b
mov eax, dword fs:[0]
push eax
sub esp, 0xdc8
mov eax, dword [0x1007e274]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x1c], 0x73
mov byte [ebp - 0x1b], 0x79
mov byte [ebp - 0x1a], 0x73
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x32
mov byte [ebp - 0x15], 0x2e
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x13], 0x78
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0
lea eax, [ebp + 0xc]
mov dword [ebp - 0xd1c], eax
mov ecx, dword [ebp - 0xd1c]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0xcf4]
push eax
call dword [0x100652f4]
mov dword [ebp - 0xd1c], 0
push 0
call fcn.1000f7d0
add esp, 4
mov dword [ebp - 0xd24], eax
mov dword [ebp - 0xd20], edx
lea ecx, [ebp - 0xd24]
push ecx
call fcn.1000f730
add esp, 4
mov ecx, 9
mov esi, eax
lea edi, [ebp - 0xd18]
rep movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x40], 0x25
mov byte [ebp - 0x3f], 0x30
mov byte [ebp - 0x3e], 0x32
mov byte [ebp - 0x3d], 0x64
mov byte [ebp - 0x3c], 0x3a
mov byte [ebp - 0x3b], 0x25
mov byte [ebp - 0x3a], 0x30
mov byte [ebp - 0x39], 0x32
mov byte [ebp - 0x38], 0x64
mov byte [ebp - 0x37], 0x3a
mov byte [ebp - 0x36], 0x25
mov byte [ebp - 0x35], 0x30
mov byte [ebp - 0x34], 0x32
mov byte [ebp - 0x33], 0x64
mov byte [ebp - 0x32], 0x20
mov byte [ebp - 0x31], 0x2d
mov byte [ebp - 0x30], 0x20
mov byte [ebp - 0x2f], 0x25
mov byte [ebp - 0x2e], 0x30
mov byte [ebp - 0x2d], 0x32
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x3a
mov byte [ebp - 0x2a], 0x25
mov byte [ebp - 0x29], 0x30
mov byte [ebp - 0x28], 0x32
mov byte [ebp - 0x27], 0x64
mov byte [ebp - 0x26], 0x3a
mov byte [ebp - 0x25], 0x25
mov byte [ebp - 0x24], 0x64
mov byte [ebp - 0x23], 0x20
mov byte [ebp - 0x22], 0x3a
mov byte [ebp - 0x21], 0x3a
mov byte [ebp - 0x20], 0x20
mov byte [ebp - 0x1f], 0
mov edx, dword [ebp - 0xd04]
add edx, 0x76c
push edx
mov eax, dword [ebp - 0xd08]
add eax, 1
push eax
mov ecx, dword [ebp - 0xd0c]
push ecx
mov edx, dword [ebp - 0xd18]
push edx
mov eax, dword [ebp - 0xd14]
push eax
mov ecx, dword [ebp - 0xd10]
push ecx
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x524]
push eax
call fcn.1000f750
add esp, 0x20
push 1
push 0x40
push 0xa
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0xdd4]
call fcn.10008790
mov dword [ebp - 4], 0
push 0x10007f10
push 0xa
lea edx, [ebp - 0xcf4]
push edx
lea eax, [ebp - 0x524]
push eax
lea ecx, [ebp - 0xdd4]
push ecx
call fcn.10007370
add esp, 8
push eax
call fcn.10007370
add esp, 8
push eax
call fcn.10007090
add esp, 8
mov ecx, eax
call fcn.10009cd0
lea ecx, [ebp - 0xdd4]
call fcn.1000caf0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdd4]
call fcn.1000a070
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1003eb1d
mov esp, ebp
pop ebp
ret
Function at 0x1000f9f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xd7
mov dword [ebp - 4], 0
jmp 0x1000fa12
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1f
jge 0x1000fa51
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x26700b95]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000fa4c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000fa09
mov eax, 1
imul ecx, eax, 0x1f
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000fad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1007e274]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x44
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x2e
mov byte [ebp - 8], 0x64
mov byte [ebp - 7], 0x6c
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0
lea eax, [ebp - 0x10]
push eax
call dword [0x100651a8]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x1000fb84
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x6e
mov byte [ebp - 0x21], 0x64
mov byte [ebp - 0x20], 0x62
mov byte [ebp - 0x1f], 0x6f
mov byte [ebp - 0x1e], 0x78
mov byte [ebp - 0x1d], 0x69
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x20
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x21
mov byte [ebp - 0x11], 0
lea ecx, [ebp - 0x24]
push ecx
call fcn.1001c000
add esp, 4
call fcn.1001c250
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003eb1d
mov esp, ebp
pop ebp
ret
Function at 0x1000fd67
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x1000fd65
jmp 0x1000fd60
call fcn.1000fd67
jae 0x1000fd60
add esp, 4
jmp 0x1000fd6c
dec dword [esp]
jno 0x1000fd71
jns 0x1000fd5c
jp 0x1000fd75
add esp, 4
popf
jmp 0x1000fd7c
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000fd95
jne 0x1000fd95
inc edx
jl 0x1000fd9a
jmp 0x1000fd9c
je 0x1000fd97
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000fdb6
jne 0x1000fdb5
call 0x9304ee3d
rol byte [ebx + eax*4], 0xf0
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000fdc4
add eax, 0x1750374
jne 0x1000fdc4
call 0x35e5438e
mov byte [ebp - 0x1c], 0x25
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x25
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x25
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x25
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x25
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x25
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x25
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0
lea eax, [ebp - 0x1c]
push eax
call dword [0x10065160]
clc
jae 0x1000fe2f
jg 0x1000fdbe
pushf
push 0xa
jae 0x1000fe3c
jmp 0x1000fe37
call 0x1000fe3e
jae 0x1000fe37
add esp, 4
jmp 0x1000fe43
dec dword [esp]
jno 0x1000fe48
jns 0x1000fe33
jp 0x1000fe4c
add esp, 4
popf
jmp 0x1000fe53
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000fe6c
jne 0x1000fe6c
invalid
jl 0x1000fe71
jmp 0x1000fe73
je 0x1000fe6e
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000fe8d
jne 0x1000fe8c
call 0x9304ef14
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000fe9b
jne 0x1000fe9b
call 0x9b5c5cfe
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003eb1d
mov esp, ebp
pop ebp
ret

Function at 0x1000fee8
Capabilities:
Access peb ldr_data

Disassembly:
jae 0x1000fee6
jmp 0x1000fee1
call fcn.1000fee8
jae 0x1000fee1
add esp, 4
jmp 0x1000feed
dec dword [esp]
jno 0x1000fef2
jns 0x1000fedd
jp 0x1000fef6
add esp, 4
popf
jmp 0x1000fefd
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000ff16
jne 0x1000ff16
call 0x1fc1326a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x20], 0x20000
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10011f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xf
mov dword [ebp - 4], 0
jmp 0x10011f42
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x10011f81
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0xc3df566]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10011f7c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10011f39
mov eax, 1
shl eax, 3
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1001b2d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1007e274]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov byte [ebp - 0x2c], 0x50
mov byte [ebp - 0x2b], 0x6b
mov byte [ebp - 0x2a], 0x48
mov byte [ebp - 0x29], 0x59
mov byte [ebp - 0x28], 0x63
mov byte [ebp - 0x27], 0x71
mov byte [ebp - 0x26], 0x50
mov byte [ebp - 0x25], 0x45
mov byte [ebp - 0x24], 0x4c
mov byte [ebp - 0x23], 0x49
mov byte [ebp - 0x22], 0x79
mov byte [ebp - 0x21], 0x6e
mov byte [ebp - 0x20], 0x52
mov byte [ebp - 0x1f], 0x45
mov byte [ebp - 0x1e], 0x44
mov byte [ebp - 0x1d], 0x4f
mov byte [ebp - 0x1c], 0
mov dword [ebp - 0x40], 0x6235d4
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x72
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0xf], 0
mov dword [ebp - 0x44], 0x680f80
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0
mov dword [ebp - 0x48], 0x680f4c
xorps xmm0, xmm0
movss dword [ebp - 0x4c], xmm0
push 0x104
push 0x1007f968
push 0
call dword [0x100651ac]
push 0x1007f968
call fcn.10044250
add esp, 4
sub eax, 1
mov dword [ebp - 0x30], eax
jmp 0x1001b3b4
mov eax, dword [ebp - 0x30]
sub eax, 1
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1001b3f0
mov ecx, dword [ebp - 0x30]
movsx edx, byte [ecx + 0x1007f968]
cmp edx, 0x5c
jne 0x1001b3ee
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x104
jae 0x1001b3dd
jmp 0x1001b3e2
call fcn.1003ea43
mov ecx, dword [ebp - 0x34]
mov byte [ecx + 0x1007f968], 0
jmp 0x1001b3f0
jmp 0x1001b3ab
push str.FullScreen.ini
push 0x1007f968
call fcn.1004b580
add esp, 8
push 0x1007f968
push 0x19
push 0x100667f8
push 0x10066800
call dword [0x10065084]
cmp eax, 0xa00
jle 0x1001b429
mov dword [ebp - 0x38], 0xa00
jmp 0x1001b443
push 0x1007f968
push 0x19
push str.Width
push 0x10066810
call dword [0x10065084]
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
mov dword [0x1007f8f4], edx
push 0x1007f968
push 0x19
push 0x10066818
push 0x10066820
call dword [0x10065084]
cmp eax, 0x5a0
jle 0x1001b473
mov dword [ebp - 0x3c], 0x5a0
jmp 0x1001b48d
push 0x1007f968
push 0x19
push str.Height
push 0x10066830
call dword [0x10065084]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [0x1007f8f8], eax
push 0x1007f968
push 0x3c
push 0x10066838
push str.Screen
call dword [0x10065084]
mov dword [0x1007f8fc], eax
cmp dword [0x1007f8fc], 0x384
jle 0x1001b4c7
mov dword [0x1007f8fc], 0x384
cmp dword [0x1007f8fc], 0x3c
jge 0x1001b4da
mov dword [0x1007f8fc], 0x3c
cmp dword [0x1007f8fc], 0x3c
jle 0x1001b4f2
mov ecx, dword [0x1007f8fc]
push ecx
call fcn.1001bc40
add esp, 4
clc
jae 0x1001b4f7
rol dword [edx + 0x66], 1
pushfd
pushf
push 0xa
Function at 0x1001c250
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x8003
call dword [0x100650a0]
xor eax, eax
test eax, eax
je 0x1001c26a
jne 0x1001c269
call 0x9305b2f1
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001c278
jmp 0x1001c27a
je 0x1001c275
clc
jae 0x1001c27f
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x1001c284
jne 0x1001c284
pop eax
pushf
push 0xa
jae 0x1001c291
jmp 0x1001c28c
call 0x1001c293
jae 0x1001c28c
add esp, 4
jmp 0x1001c298
dec dword [esp]
jno 0x1001c29d
jns 0x1001c288
jp 0x1001c2a1
add esp, 4
popf
jmp 0x1001c2a8
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001c2c1
jne 0x1001c2c1
call 0x1fc1f615
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0xffffffffffffffff
call fcn.1004c3e8
clc
jae 0x1001c2de
shl byte [ecx], 1
pushf
push 0xa
jae 0x1001c2eb
jmp 0x1001c2e6
call 0x1001c2ed
jae 0x1001c2e6
add esp, 4
jmp 0x1001c2f2
dec dword [esp]
jno 0x1001c2f7
jns 0x1001c2e2
jp 0x1001c2fb
add esp, 4
popf
jmp 0x1001c302
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001c31b
jne 0x1001c31b
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x1001c320
jmp 0x1001c322
je 0x1001c31d
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001c33c
jne 0x1001c33b
call 0x9305b3c3
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001c34a
jne 0x1001c34a
call fcn.1001c40a
add byte [ebx], dh
rol byte [ebp + 0x750374c0], 0
mov esp, 0
xor eax, eax
test eax, eax
je 0x1001c358
add esi, dword [ebp]
jne 0x1001c357
call 0x9305b3df
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
out 0x74, eax
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001c366
jmp 0x1001c368
je 0x1001c363
clc
jae 0x1001c36d
jp 0x1001c354
je 0x1001c372
jne 0x1001c372
out 0x66, eax
pushfd
pushf
push 0xa
jae 0x1001c37f
jmp 0x1001c37a
call 0x1001c381
jae 0x1001c37a
add esp, 4
jmp 0x1001c386
dec dword [esp]
jno 0x1001c38b
jns 0x1001c376
jp 0x1001c38f
add esp, 4
popf
jmp 0x1001c396
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001c3af
jne 0x1001c3af
call 0x1fc1f703
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1001c293
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x8003
call dword [0x100650a0]
xor eax, eax
test eax, eax
je 0x1001c26a
jne 0x1001c269
call 0x9305b2f1
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001c278
jmp 0x1001c27a
je 0x1001c275
clc
jae 0x1001c27f
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x1001c284
jne 0x1001c284
pop eax
pushf
push 0xa
jae 0x1001c291
jmp 0x1001c28c
call 0x1001c293
jae 0x1001c28c
add esp, 4
jmp 0x1001c298
dec dword [esp]
jno 0x1001c29d
jns 0x1001c288
jp 0x1001c2a1
add esp, 4
popf
jmp 0x1001c2a8
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001c2c1
jne 0x1001c2c1
call 0x1fc1f615
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0xffffffffffffffff
call fcn.1004c3e8
clc
jae 0x1001c2de
shl byte [ecx], 1
pushf
push 0xa
jae 0x1001c2eb
jmp 0x1001c2e6
call 0x1001c2ed
jae 0x1001c2e6
add esp, 4
jmp 0x1001c2f2
dec dword [esp]
jno 0x1001c2f7
jns 0x1001c2e2
jp 0x1001c2fb
add esp, 4
popf
jmp 0x1001c302
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001c31b
jne 0x1001c31b
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x1001c320
jmp 0x1001c322
je 0x1001c31d
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001c33c
jne 0x1001c33b
call 0x9305b3c3
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001c34a
jne 0x1001c34a
call fcn.1001c40a
add byte [ebx], dh
rol byte [ebp + 0x750374c0], 0
mov esp, 0
xor eax, eax
test eax, eax
je 0x1001c358
add esi, dword [ebp]
jne 0x1001c357
call 0x9305b3df
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
out 0x74, eax
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001c366
jmp 0x1001c368
je 0x1001c363
clc
jae 0x1001c36d
jp 0x1001c354
je 0x1001c372
jne 0x1001c372
out 0x66, eax
pushfd
pushf
push 0xa
jae 0x1001c37f
jmp 0x1001c37a
call 0x1001c381
jae 0x1001c37a
add esp, 4
jmp 0x1001c386
dec dword [esp]
jno 0x1001c38b
jns 0x1001c376
jp 0x1001c38f
add esp, 4
popf
jmp 0x1001c396
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001c3af
jne 0x1001c3af
call 0x1fc1f703
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100207c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xe4
mov dword [ebp - 4], 0
jmp 0x100207e2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc
jge 0x10020821
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x45df1c07]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1002081c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x100207d9
mov eax, 1
imul ecx, eax, 0xc
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10029eb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
mov dword [ebp - 4], 0
jmp 0x10029ed2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x15
jge 0x10029f11
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x133e70b]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10029f0c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10029ec9
mov eax, 1
imul ecx, eax, 0x15
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10029f30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 5
mov dword [ebp - 4], 0
jmp 0x10029f52
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 7
jge 0x10029f91
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x28230a17]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10029f8c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10029f49
mov eax, 1
imul ecx, eax, 7
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4