joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fd14
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x11c], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
xor eax, eax
push ebp
push 0x45fef8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea eax, [ebp - 0x114]
call fcn.0045d84c
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 4]
mov ecx, 0x45ff14
call fcn.00404e34
mov eax, dword [ebp - 4]
call fcn.00409320
test al, al
je 0x45fecd
lea eax, [ebp - 0x110]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 0x118]
lea eax, [ebp - 0x110]
call fcn.00409910
mov edx, dword [ebp - 0x118]
lea eax, [ebp - 8]
mov ecx, 0x45ff38
call fcn.00404e34
push 0
mov eax, dword [ebp - 8]
call fcn.00404fac
push eax
mov eax, dword [ebp - 4]
call fcn.00404fac
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebp - 8]
call fcn.00409320
test al, al
je 0x45fecd
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404bb4
xor eax, eax
push ebp
push 0x45fec3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4163fc]
call fcn.00403c24
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x45fe8c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x45fe76
lea ecx, [ebp - 0x120]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x120]
lea edx, [ebp - 0x11c]
call fcn.004089d8
mov edx, dword [ebp - 0x11c]
mov eax, 0x45ff4c
call fcn.004050f8
test eax, eax
jle 0x45fe70
mov byte [ebp - 9], 1
jmp 0x45fe76
dec ebx
cmp ebx, 0xffffffff
jne 0x45fe35
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45fe93
mov eax, dword [ebp - 0x10]
call fcn.00403c54
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45feff
lea eax, [ebp - 0x124]
mov edx, 5
call fcn.00404b40
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b40
ret
Function at 0x45ff5c
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd44
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x29c], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404f9c
xor eax, eax
push ebp
push 0x4600f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x460110
call fcn.004050f8
mov ebx, eax
test ebx, ebx
jle 0x45ffb1
lea eax, [ebp - 4]
push eax
lea edx, [ebx + 2]
mov ecx, 0x7fffffff
mov eax, dword [ebp - 4]
call fcn.00405014
mov edx, dword [ebp - 4]
mov eax, 0x46011c
call fcn.004050f8
mov ebx, eax
test ebx, ebx
jle 0x45ffd8
lea eax, [ebp - 4]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00405014
lea eax, [ebp - 0x198]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
xor ecx, ecx
push ebp
push 0x4600cc
push dword fs:[ecx]
mov dword fs:[ecx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x298]
mov edx, dword [ebp - 4]
call fcn.00409790
lea eax, [ebp - 0x298]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x4600b5
mov edx, dword [eax + 0xc]
test edx, edx
je 0x4600af
mov ebx, dword [edx]
test ebx, ebx
je 0x4600a9
lea eax, [ebp - 0x29c]
push eax
movzx eax, byte [ebx]
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 0x2b8], 0
movzx eax, byte [ebx + 1]
mov dword [ebp - 0x2b4], eax
mov byte [ebp - 0x2b0], 0
movzx eax, byte [ebx + 2]
mov dword [ebp - 0x2ac], eax
mov byte [ebp - 0x2a8], 0
movzx eax, byte [ebx + 3]
mov dword [ebp - 0x2a4], eax
mov byte [ebp - 0x2a0], 0
lea edx, [ebp - 0x2bc]
mov ecx, 3
mov eax, 0x460128
call fcn.00409e00
mov edx, dword [ebp - 0x29c]
mov eax, esi
call fcn.00404b70
mov byte [ebp - 5], 1
jmp 0x4600b9
mov byte [ebp - 5], 0
jmp 0x4600b9
mov byte [ebp - 5], 0
jmp 0x4600b9
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4600d3
call sub.wsock32.dll_WSACleanup
ret
Function at 0x460134
Capabilities:
Create http request
Delete file
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x418], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x46028b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
xor edi, edi
push 0
push 0
push 0
push 0
push 0x4602a0
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x460272
push 0
push 0x80000000
push 0
push 0
mov eax, ebx
call fcn.00404fac
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov ebx, eax
test ebx, ebx
jne 0x4601b0
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x460272
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, dword [ebp - 4]
call fcn.00404fac
push eax
call sub.kernel32.dll_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x4601eb
push ebx
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x460272
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x414]
push eax
push ebx
call sub.wininet.dll_InternetReadFile
cmp dword [ebp - 0x10], 0
je 0x460227
push 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x414]
push eax
push esi
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x460227
add edi, dword [ebp - 0x14]
jmp 0x4601eb
push esi
call sub.kernel32.dll_CloseHandle
push ebx
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
cmp edi, 0xc350
seta byte [ebp - 5]
cmp byte [ebp - 5], 0
jne 0x460272
mov eax, dword [ebp - 4]
call fcn.00404fac
mov edx, eax
lea eax, [ebp - 0x418]
call fcn.00404d14
mov eax, dword [ebp - 0x418]
call fcn.00404fac
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460292
lea eax, [ebp - 0x418]
call fcn.00404b1c
ret
Function at 0x4607ec
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404f9c
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x46081c
xor edx, edx
mov dword [eax], edx
xor eax, eax
push ebp
push 0x460922
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00404b1c
push 0
push 0
push 0
push 0
push 0x460934
call sub.wininet.dll_InternetOpenA
mov edi, eax
test edi, edi
je 0x4608fc
push 0
push 0x80000000
push 0
push 0
lea edx, [ebp - 0x41c]
mov eax, dword [ebp - 4]
call fcn.00406a20
mov eax, dword [ebp - 0x41c]
call fcn.00404fac
push eax
push edi
call sub.wininet.dll_InternetOpenUrlA
mov esi, eax
test esi, esi
je 0x4608f6
mov dword [ebp - 0x18], 4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x20000013
push esi
call sub.wininet.dll_HttpQueryInfoA
lea eax, [ebp - 0x10]
push eax
push 0x400
lea eax, [ebp - 0x418]
push eax
push esi
call sub.wininet.dll_InternetReadFile
lea edx, [ebp - 0x418]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 0x10]
call fcn.00404c0c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404de8
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x10], 0
jne 0x46089f
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00406a70
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
setne bl
push esi
call sub.wininet.dll_InternetCloseHandle
push edi
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460929
lea eax, [ebp - 0x41c]
call fcn.00404b1c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404b40
ret
Function at 0x40ac03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x40ac47
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x40ac16
jmp 0x40ac47
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x40ac37
pop esi
pop ebp
ret

Function at 0x40b99f
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40b9d4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40b9fe
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40b9fe
test edi, edi
je 0x40b9cb
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40b9cb
test edi, edi
je 0x40ba06
mov eax, edi
jmp 0x40b9cd
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40b9cd
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_m_in_w32_d_0000000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.0040e51c
add esp, 0xc
int3
Function at 0x40e550
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
push eax
mov dword [sym.TestMacroForEach.exe_gMozillaPoisonSize], eax
call fcn.0040b99f
pop ecx
mov ecx, dword [sym.TestMacroForEach.exe_gMozillaPoisonSize]
mov dword [sym.TestMacroForEach.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40e588
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestMacroForEach.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x10002464
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10028240]
jne 0x1000246e
repz ret
jmp fcn.1000434f

Function at 0x10003d9a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100026a4
and dword [ebp - 4], 0
cmp dword [0x100297f4], 0
mov ebx, eax
jne 0x10003e4b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10003efc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10003efc
push eax
call fcn.10002632
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100297f4], eax
call esi
push eax
call fcn.10002632
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100297f8], eax
call esi
push eax
call fcn.10002632
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100297fc], eax
call esi
push eax
call fcn.10002632
pop ecx
mov dword [0x10029804], eax
test eax, eax
je 0x10003e4b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10002632
pop ecx
mov dword [0x10029800], eax
mov eax, dword [0x10029800]
cmp eax, ebx
je 0x10003ea3
cmp dword [0x10029804], ebx
je 0x10003ea3
push eax
call fcn.100026ad
push dword [0x10029804]
mov esi, eax
call fcn.100026ad
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10003ea3
test edi, edi
je 0x10003ea3
call esi
test eax, eax
je 0x10003e9a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10003e9a
test byte [ebp - 0xc], 1
jne 0x10003ea3
or dword [ebp + 0x10], 0x200000
jmp 0x10003edc
mov eax, dword [0x100297f8]
cmp eax, ebx
je 0x10003edc
push eax
call fcn.100026ad
pop ecx
test eax, eax
je 0x10003edc
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10003edc
mov eax, dword [0x100297fc]
cmp eax, ebx
je 0x10003edc
push eax
call fcn.100026ad
pop ecx
test eax, eax
je 0x10003edc
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100297f4]
call fcn.100026ad
pop ecx
test eax, eax
je 0x10003efc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10003efe
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10012214
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov esi, dword [0x10028150]
add esi, 0x1ff0
mov dword [0x10028150], esi
mov dword [0x10028154], 0x2369
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
jmp 0x10012264
mov dword [0x10028150], 0x236c
mov eax, dword [ebp - 0x34]
add eax, 0x1d36
mov dword [ebp - 0x38], eax
jmp 0x10012372
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x10014446]
mov dh, byte [eax + 0x10014417]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
jne 0x10012264
lea eax, [ebp - 0x24]
mov dword [0x10028150], 0x2213
mov dword [ebp - 0x3c], eax
call fcn.10012b19
mov dword [esp], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], eax
call fcn.10011fa0
xor ecx, ecx
mov dword [0x10028150], 0x1b06
cmp eax, 0
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x38], ecx
je 0x10012372
mov eax, dword [ebp - 0x40]
mov dword [0x10028150], 0x8b
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x34], eax
call fcn.1001282a
xor eax, eax
mov ecx, dword [ebp - 0x34]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x10028154], 0x1162
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov dword [0x10028150], 0x1ca3
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x2c], ecx
mov ecx, dword [0x10028150]
mov esi, dword [ebp - 0x34]
mov dword [edx + 0x14], esi
add ecx, 0xfffff50a
mov dword [0x10028150], ecx
cmp esi, 0
mov dword [ebp - 0x38], eax
jne 0x1001224a
mov eax, dword [ebp - 0x38]
add esp, 0x4c
pop esi
pop ebp
ret
Function at 0x100126a3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov dword [0x10028150], 0x18f8
mov dword [0x10028154], 0x716
mov dword [ebp - 0x10], eax
call fcn.10013355
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov dword [0x10028150], 0x84
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x100126fd
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov dword [0x10028154], 0x1f6e
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
je 0x1001281f
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + ecx*4]
mov dword [0x10028150], 0x18f8
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov ecx, eax
mov edx, dword [ebp - 0x44]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x4d], bh
mov byte [ebp - 0x4e], cl
je 0x100127bd
mov eax, dword [ebp - 0x4c]
add eax, 1
mov cl, byte [ebp - 0x4d]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x4e]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x48], eax
jne 0x1001276c
mov al, byte [ebp - 0x4e]
test al, 1
jne 0x100127f0
jmp 0x100127c6
xor eax, eax
mov ecx, dword [ebp - 0x3c]
add ecx, 2
mov edx, dword [ebp - 0x40]
add edx, 1
mov esi, dword [ebp - 0x2c]
cmp edx, esi
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], eax
jb 0x10012748
jmp 0x1001281f
mov eax, dword [ebp - 0x3c]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov dword [0x10028150], 0x1919
mov ecx, dword [edx + ecx*4]
mov dword [0x10028154], 0x2305
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1001298a
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov dword [ebp - 0x10], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x10], eax
mov ecx, 0x1d94
xor edx, edx
mov dword [0x10028150], 0x1d94
mov esi, dword [ebp - 0x10]
mov esi, dword [esi + 0x10]
mov esi, dword [esi + 0x3c]
mov dword [0x10028154], 0x663
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov edx, ecx
add edx, 0xffffee53
mov esi, dword [ebp - 0x18]
cmp word [esi + eax*2], 0
mov edi, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], edi
je 0x10012a21
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [0x10028154], 0x1740
cmp eax, 0x104
mov ecx, dword [ebp - 0x2c]
mov edx, eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x30], eax
jl 0x100129d3
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
mov dword [0x10028150], ecx
mov edx, dword [ebp - 0x28]
add edx, 0x92b
mov dword [0x10028154], edx
mov edx, dword [ebp - 0x18]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x34], eax
jne 0x10012b0f
mov eax, dword [ebp - 0x28]
add eax, 0x26e
mov dword [0x10028154], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x34]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x10012b0f
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x34]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x10012b0f
mov dword [0x10028154], 0x242f
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x34]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x10012b0f
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x34]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x10012b0f
mov dword [0x10028150], 0xb47
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x34]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x10012b0f
mov eax, 0xbb1
mov ecx, 0xffffebdf
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x34]
mov di, word [edx + esi*2 - 0xe]
cmp di, 0x6c
sete bl
cmp di, 0x6c
mov byte [ebp - 0x35], bl
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], eax
je 0x10012af6
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [0x10028150], eax
mov cl, byte [ebp - 0x35]
and cl, 1
movzx eax, cl
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10013061
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1002815c], 0
mov byte [0x10028160], 0
mov edi, dword [0x10028150]
mov ebx, edi
add ebx, 0xfffff94b
mov dword [0x10028150], ebx
add edi, 0xfffff4bc
mov dword [0x10028154], edi
mov dword [0x10028158], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x100130d0
mov dword [0x10028150], 0x228d
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x10028150], 0x15fe
mov eax, dword [0x10028158]
add eax, 1
mov dword [0x10028158], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x100130d0
xor eax, eax
mov ecx, 0x15fe
mov edx, dword [0x10028154]
add edx, 0xffffe975
mov dword [0x10028154], edx
mov dword [0x10028158], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, 0x100
mov dword [0x10028164], 0
mov dword [ebp - 0x28], eax
mov eax, ecx
xor esi, esi
mov dword [ebp - 0x2c], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [ebp - 0x28]
add edi, 0xfffff092
mov dword [0x10028150], edi
mov edi, dword [0x1002815c]
mov ebx, dword [ebp - 0x18]
movzx esi, byte [ebx + ecx]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x10028164], esi
mov dword [0x10028150], 0x1b9f
mov eax, esi
cdq
mov esi, dword [ebp - 0x2c]
idiv esi
mov dword [0x1002815c], edx
mov dword [0x10028154], 0x5eb
mov bl, byte [ebx + ecx]
mov byte [0x10028160], bl
mov dword [0x10028150], 0x2e0d
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov bl, byte [0x10028160]
mov ecx, dword [0x1002815c]
mov byte [esi + ecx], bl
mov ecx, dword [0x10028150]
add ecx, 0xffffef68
mov dword [0x10028150], ecx
mov edx, dword [0x10028158]
add edx, 1
mov dword [0x10028158], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
jl 0x10013129
jmp 0x100130be
Function at 0x100134e3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x10028158], 0
mov dword [0x1002815c], 0
mov dword [0x10028168], 0
mov dword [0x10028150], 0x9e1
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x1001365b
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov edi, edx
add edi, 1
add eax, 1
mov dword [ebp - 0x2c], edx
cdq
idiv esi
mov dword [0x10028158], edx
mov dword [0x10028150], 0x1dd9
mov ebx, dword [ebp - 0x20]
movzx ebx, byte [ebx + edx]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x1002815c], edx
mov dword [0x10028154], 0x1e0f
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x30]
mov cl, byte [ecx + esi]
mov byte [0x10028160], cl
mov dword [0x10028150], 0x26f3
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov dword [0x10028154], 0x1d23
mov cl, byte [0x10028160]
mov edx, dword [0x1002815c]
mov byte [ebx + edx], cl
mov edx, dword [0x10028158]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x1002815c]
movzx ecx, byte [ebx + ecx]
add ecx, edx
mov dword [0x10028150], 0x56a
and ecx, 0xff
mov dword [0x10028168], ecx
mov dword [0x10028154], 0x23da
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
xor cl, byte [edx + esi]
mov byte [0x1002816c], cl
mov dword [0x10028150], 0x2294
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], cl
mov dword [0x10028154], 0x643
mov ecx, dword [ebp - 0x10]
cmp edi, ecx
mov dword [ebp - 0x34], edi
je 0x1001365b
mov eax, dword [0x10028158]
mov ecx, dword [0x1002815c]
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
jmp 0x10013546
mov dword [0x10028154], 0x1234
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret