joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006000
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x100a5428]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push 0
push eax
lea ecx, [ebp - 0x214]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x10006055
push str.Unable_to_retreive_Path_from_Win_library:_n
call fcn.100028f0
mov ebx, str.Utilities
call fcn.10002fd0
add esp, 4
xor al, al
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10075b7f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10006060
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x214]
push edx
mov ecx, esi
call fcn.10001a60
mov ecx, dword [ebp - 8]
xor ecx, ebp
mov al, 1
pop ebx
call fcn.10075b7f
mov esp, ebp
pop ebp
ret
Function at 0x10013bd0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x950
mov eax, dword [0x100a5428]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x11c
lea eax, [ebp - 0x928]
push 0
push eax
call fcn.100775d0
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea ecx, [ebp - 0x928]
push ecx
mov dword [ebp - 0x928], 0x11c
call edi
test eax, eax
jne 0x10013c41
lea edx, [ebp - 0x928]
push edx
mov dword [ebp - 0x928], 0x114
call edi
test eax, eax
jne 0x10013c41
xor al, al
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10075b7f
mov esp, ebp
pop ebp
ret
push 7
push str.UNKNOWN
mov ecx, esi
call fcn.10001a60
mov eax, dword [ebp - 0x918]
movzx ecx, byte [ebp - 0x80e]
mov edx, dword [ebp - 0x920]
push eax
mov eax, dword [ebp - 0x924]
push ecx
push edx
push eax
lea ecx, [ebp - 0x808]
push str.OS_INFOLIST_::_n_MajorVerison_:_lu_nMinorVersion_:_lu_n_productType:_lu_n_platformId:_lu_n
push ecx
call fcn.1007691b
lea edx, [ebp - 0x808]
add esp, 0x18
push edx
call fcn.100028f0
mov ebx, str.DWANative
call fcn.10002f70
mov eax, dword [ebp - 0x924]
add esp, 4
sub eax, 4
mov ebx, 1
je 0x10013d83
sub eax, ebx
je 0x10013d21
sub eax, ebx
je 0x10013cd5
push 7
push str.UNKNOWN
mov ecx, esi
call fcn.10001a60
mov al, bl
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10075b7f
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x920]
cmp eax, ebx
jne 0x10013cfc
push esi
cmp byte [ebp - 0x80e], bl
jne 0x10013cf2
mov edx, str.Win7
jmp 0x10013dd2
mov edx, str.Server2008R2
jmp 0x10013dd2
test eax, eax
jne 0x10013dd7
push esi
cmp byte [ebp - 0x80e], bl
jne 0x10013d17
mov edx, str.Vista
jmp 0x10013dd2
mov edx, str.Server2008
jmp 0x10013dd2
mov eax, dword [ebp - 0x920]
cmp eax, 2
jne 0x10013d74
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call edi
test eax, eax
jne 0x10013d45
push esi
mov edx, str.Server2003
call fcn.10002820
push 0x59
call edi
test eax, eax
je 0x10013d58
push esi
mov edx, str.Server2003
call fcn.10002820
lea eax, [ebp - 0x94c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp byte [ebp - 0x80e], bl
jne 0x10013dd7
mov edx, 0x10096a58
jmp 0x10013dd1
cmp eax, ebx
je 0x10013d6d
test eax, eax
jne 0x10013dd7
mov edx, str.2000
jmp 0x10013dd1
mov eax, dword [ebp - 0x920]
cmp eax, 0x5a
jne 0x10013dae
push 2
push 0x10096a6c
mov ecx, esi
call fcn.10001a60
mov al, bl
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10075b7f
mov esp, ebp
pop ebp
ret
cmp eax, 0xa
jne 0x10013dba
mov edx, 0x10096a74
jmp 0x10013dd1
test eax, eax
jne 0x10013dd7
cmp dword [ebp - 0x918], 2
mov edx, str.NT4.0
je 0x10013dd1
mov edx, 0x10096a88
push esi
call fcn.10002820
mov ecx, dword [ebp - 4]
pop edi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.10075b7f
mov esp, ebp
pop ebp
ret
Function at 0x10014250
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10089b2b
mov eax, dword fs:[0]
push eax
sub esp, 0x234
mov eax, dword [0x100a5428]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x204
lea eax, [ebp - 0x214]
push 0
push eax
mov dword [ebp - 0x218], 0
call fcn.100775d0
add esp, 0xc
xor ecx, ecx
push 0x2e
mov ebx, 0x104
mov word [ebp - 0x234], cx
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
lea ecx, [ebp - 0x234]
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
call fcn.10001a60
mov dword [ebp - 4], 0
cmp dword [ebp - 0x220], 8
mov eax, dword [ebp - 0x234]
jae 0x100142f8
lea eax, [ebp - 0x234]
lea edx, [ebp - 0x23c]
push edx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1001434f
push 0
push ebx
lea ecx, [ebp - 0x218]
push ecx
push 0
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
cmp dword [ebp - 0x220], 8
jb 0x10014348
mov edx, dword [ebp - 0x234]
push edx
call fcn.10076031
add esp, 4
xor al, al
jmp 0x100143ea
mov edx, dword [ebp - 0x23c]
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x238]
push ecx
push 0
push 0
push str.MHz
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1001438e
push str.Failed_in_Registry_Query
call fcn.100028f0
mov ebx, str.DWANative
call fcn.10002fd0
add esp, 4
mov eax, dword [ebp - 0x238]
push eax
lea ecx, [ebp - 0x218]
push 0x10096930
push ecx
call fcn.1007691b
lea eax, [ebp - 0x218]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100143b2
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x218]
push edx
mov ecx, edi
call fcn.10001a60
cmp dword [ebp - 0x220], 8
jb 0x100143e8
mov eax, dword [ebp - 0x234]
push eax
call fcn.10076031
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10075b7f
mov esp, ebp
pop ebp
ret
Function at 0x100144a0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x100a5428]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x40
lea eax, [ebp - 0x250]
push 0
push eax
call fcn.100775d0
add esp, 0xc
lea ecx, [ebp - 0x250]
push ecx
mov dword [ebp - 0x250], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x10014511
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_in_getting_Global_Memory_status_:_d
call fcn.100028f0
mov ebx, str.DWANative
call fcn.10002fd0
add esp, 8
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10075b7f
mov esp, ebp
pop ebp
ret
push 0x204
lea edx, [ebp - 0x20c]
push 0
push edx
mov dword [ebp - 0x210], 0
call fcn.100775d0
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0x248]
add esp, 0xc
push eax
push ecx
call fcn.10014410
shrd eax, edx, 0x14
shr edx, 0x14
push edx
push eax
lea edx, [ebp - 0x210]
push str._llu
push edx
call fcn.1007691b
lea eax, [ebp - 0x210]
add esp, 0x18
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10014570
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x210]
push eax
mov ecx, esi
call fcn.10001a60
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop ebx
call fcn.10075b7f
mov esp, ebp
pop ebp
ret
Function at 0x10016d10
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x100a5428]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0
push 0x26
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x10016d45
push str.Unable_to_retreive_drivePath__from_Win_library
jmp 0x10016dc2
lea ecx, [ebp - 0x210]
push 0x100929f4
push ecx
call fcn.100769ba
add esp, 8
test eax, eax
je 0x10016dbd
push str.drivePath_retreived
call fcn.100028f0
mov ebx, str.DWANative
call fcn.10002f70
lea eax, [ebp - 0x210]
add esp, 4
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10016d80
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x210]
push edx
mov ecx, esi
call fcn.10001a60
push 1
mov eax, 0x100929f4
mov ecx, esi
call fcn.10006680
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10075b7f
mov esp, ebp
pop ebp
ret
push str.Failed_to_get_drivePath
call fcn.100028f0
mov ebx, str.DWANative
call fcn.10002fd0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor al, al
pop ebx
call fcn.10075b7f
mov esp, ebp
pop ebp
ret

Function at 0x100174e0
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call fcn.10012f70
cmp dword [eax + 0xe4], 0
je 0x10017511
push str._IPC_Channel_already_opened_...
call fcn.100028f0
mov ecx, 0x10094194
call fcn.10002cc0
add esp, 4
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
lea eax, [ebp - 4]
push eax
push 0x10017050
push 0
push 0
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x1001753f
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.10012f70
mov dword [eax + 0xe4], esi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001e300
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x1001e32d
push esi
push edi
jmp 0x1001e310
movzx esi, byte [edx]
movzx esi, byte [esi + 0x10099610]
lea edi, [eax*8]
xor esi, edi
dec ecx
xor eax, esi
inc edx
test ecx, ecx
jg 0x1001e310
pop edi
pop esi
ret
Function at 0x1001e390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [esi*8]
push edi
mov edi, dword [ebp + 8]
cmp eax, 0x400
jbe 0x1001e3b2
mov esi, 0x80
cmp esi, dword [edi]
jne 0x1001e3bf
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x100a8150]
test eax, eax
je 0x1001e3ca
call eax
lea ecx, [esi*8]
push ecx
call fcn.1001b050
mov esi, eax
mov eax, dword [0x100a8154]
add esp, 4
mov dword [ebp - 4], esi
test eax, eax
je 0x1001e3ea
call eax
test esi, esi
je 0x1001e3b6
mov edx, dword [edi + 0xc]
push edx
call fcn.1001b360
add esp, 4
push esi
mov dword [edi + 0xc], esi
call dword [0x100a666c]
mov ebx, eax
shr ebx, 3
add esp, 4
lea eax, [ebx*8]
push eax
push 0
push esi
mov dword [ebp + 0xc], ebx
mov dword [edi], ebx
call fcn.100775d0
mov ecx, dword [edi + 8]
add esp, 0xc
mov dword [edi + 8], 0
test ecx, ecx
je 0x1001e4cf
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
xor eax, eax
test edx, edx
jle 0x1001e463
movzx edi, byte [esi]
movzx edi, byte [edi + 0x10099610]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc esi
test edx, edx
jg 0x1001e442
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
xor edx, edx
div ebx
mov eax, dword [ebp - 4]
lea eax, [eax + edx*8]
test eax, eax
je 0x1001e4ab
mov esi, dword [eax]
test esi, esi
je 0x1001e481
mov edx, dword [eax + 4]
jmp 0x1001e483
xor edx, edx
inc esi
mov dword [eax], esi
mov dword [eax + 4], ecx
test edx, edx
je 0x1001e4ab
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x1001e4a3
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x1001e4c4
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x1001e4c4
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x1001e4ba
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x1001e436
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001e5d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0xc], 0
je 0x1001e615
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, esi
test esi, esi
jle 0x1001e60f
push ebx
lea esp, [esp]
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x10099610]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x1001e5f0
mov edi, dword [ebp + 8]
pop ebx
xor edx, edx
div dword [edi]
jmp 0x1001e617
xor edx, edx
mov eax, dword [ebp + 0xc]
push esi
push eax
mov eax, edi
call fcn.1001e4e0
add esp, 8
pop edi
test eax, eax
je 0x1001e630
mov eax, dword [eax + 8]
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1001e640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, eax
mov eax, dword [edi]
test eax, eax
je 0x1001e689
mov ecx, dword [ebp + 8]
xor eax, eax
mov edx, ebx
test ebx, ebx
jle 0x1001e67e
nop
movzx esi, byte [ecx]
movzx esi, byte [esi + 0x10099610]
lea ebx, [eax*8]
xor esi, ebx
dec edx
xor eax, esi
inc ecx
test edx, edx
jg 0x1001e660
mov ebx, dword [ebp + 0xc]
xor edx, edx
div dword [edi]
mov esi, edx
mov dword [ebp - 4], esi
jmp 0x1001e693
mov dword [ebp - 4], 0
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
push ebx
push eax
mov edx, esi
mov eax, edi
call fcn.1001e4e0
add esp, 8
test eax, eax
je 0x1001e6d6
mov ecx, dword [ebp + 0x10]
mov ebx, dword [eax + 8]
test ecx, ecx
jne 0x1001e6c4
mov edx, esi
mov ecx, edi
call fcn.1001e580
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [eax + 8], ecx
mov ecx, dword [ebp + 8]
mov dword [eax + 0xc], ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x10], 0
je 0x1001e76f
push 0x14
call fcn.1001b050
mov esi, eax
mov eax, dword [ebp + 0x10]
add esp, 4
test esi, esi
je 0x1001e771
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], edx
mov dword [esi + 0x10], ebx
mov dword [esi + 8], eax
inc dword [edi + 4]
mov eax, dword [edi + 4]
cmp eax, 0xa
jb 0x1001e739
mov ecx, dword [edi]
add ecx, ecx
cmp eax, ecx
jbe 0x1001e739
lea edx, [eax + eax]
push edx
push edi
call fcn.1001e390
add esp, 8
test eax, eax
je 0x1001e739
cmp dword [edi], 0
je 0x1001e739
mov edx, dword [ebp + 8]
mov ecx, ebx
call fcn.1001e300
xor edx, edx
div dword [edi]
mov dword [ebp - 4], edx
mov eax, dword [edi + 0xc]
test eax, eax
je 0x1001e756
mov ecx, dword [ebp - 4]
lea edx, [eax + ecx*8]
mov eax, esi
call fcn.1001e330
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi + 8]
mov dword [esi], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x1001e765
mov dword [eax + 4], esi
mov dword [esi + 4], 0
mov dword [edi + 8], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001fa00
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
mov eax, dword [0x100a5428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ecx, [ebp - 0x110]
push ecx
push 0x104
push eax
push edx
mov dword [ebp - 0x348], 0x200
call fcn.1001f870
add esp, 0x10
test eax, eax
jne 0x1001fbae
mov eax, dword [0x100a8160]
test eax, eax
jne 0x1001fa73
lea eax, [ebp - 0x340]
push eax
mov dword [ebp - 0x340], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
cmp dword [ebp - 0x330], 2
sete al
inc eax
mov dword [0x100a8160], eax
cmp eax, 2
jne 0x1001fad1
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x110]
push ecx
push 0
push 0xfde9
call edi
mov ebx, eax
lea edx, [ebx + ebx]
push edx
call fcn.1007610d
mov esi, eax
add esp, 4
test esi, esi
je 0x1001fb98
push ebx
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x110]
push eax
push 0
push 0xfde9
call edi
test eax, eax
jne 0x1001fade
push esi
call fcn.100765fc
add esp, 4
xor esi, esi
jmp 0x1001fade
lea ebx, [ebp - 0x110]
call fcn.1001e920
mov esi, eax
test esi, esi
je 0x1001fb98
mov eax, dword [0x100a8160]
test eax, eax
jne 0x1001fb18
lea ecx, [ebp - 0x228]
push ecx
mov dword [ebp - 0x228], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
cmp dword [ebp - 0x218], 2
sete al
inc eax
mov dword [0x100a8160], eax
cmp eax, 2
mov eax, esi
jne 0x1001fb56
cmp word [esi], 0
je 0x1001fb3b
cmp word [eax], 0x5c
je 0x1001fb36
add eax, 2
cmp word [eax], 0
jne 0x1001fb25
jmp 0x1001fb3b
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0x344]
push eax
mov ecx, eax
push ecx
lea edx, [ebp - 0x348]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x1001fb89
cmp byte [esi], 0
je 0x1001fb70
jmp 0x1001fb60
cmp byte [eax], 0x5c
je 0x1001fb6d
inc eax
cmp byte [eax], 0
jne 0x1001fb60
jmp 0x1001fb70
mov byte [eax], 0
lea ecx, [ebp - 0x344]
push ecx
mov edx, ecx
push edx
lea eax, [ebp - 0x348]
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.100765fc
add esp, 4
test edi, edi
jne 0x1001fbae
mov eax, 0x200
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10075b7f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x348]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10075b7f
mov esp, ebp
pop ebp
ret
Function at 0x10040540
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
test ebx, ebx
jne 0x1004055a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov ecx, 0x44
call fcn.1001b5e0
mov edi, eax
test edi, edi
je 0x10040551
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebx]
or eax, 2
push eax
push ecx
push esi
call fcn.100400d0
mov edx, dword [ebp + 0x10]
add esp, 0xc
mov dword [edi], eax
mov eax, dword [ebx + 8]
push edx
push eax
push esi
call fcn.10040200
mov ecx, dword [ebp + 0x10]
add esp, 0xc
push 0
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
push ecx
push eax
push esi
call fcn.1003fd40
mov edx, dword [ebp + 0x10]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
push edx
push eax
push esi
call fcn.100400d0
mov ecx, dword [ebp + 0x10]
add esp, 0x1c
push 0
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
push ecx
push eax
push esi
call fcn.1003fd40
mov edx, dword [ebp + 0x10]
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x18]
push edx
push eax
push esi
call fcn.100400d0
mov edx, dword [ebp + 0x10]
mov dword [edi + 0x18], eax
mov cl, byte [ebx + 4]
add esp, 0x1c
mov byte [edi + 4], cl
mov eax, dword [ebx + 0x1c]
push edx
push eax
push esi
call fcn.10040540
mov ecx, dword [ebp + 0x10]
add esp, 0xc
push 0
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x28]
push ecx
push eax
push esi
call fcn.1003fd40
mov edx, dword [ebp + 0x10]
push 0
mov dword [edi + 0x28], eax
mov eax, dword [ebx + 0x2c]
push edx
push eax
push esi
call fcn.1003fd40
mov dword [edi + 0x2c], eax
add esp, 0x20
xor eax, eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov cx, word [ebx + 6]
mov edx, 0xfff7
mov dword [edi + 0x24], eax
and cx, dx
or eax, 0xffffffff
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov word [edi + 6], cx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100478b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, edx
cmp byte [edx], al
je 0x100478c9
inc ecx
cmp byte [ecx], al
jne 0x100478c4
sub ecx, edx
and ecx, 0x3fffffff
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 4]
push esi
xor esi, esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], ecx
test ecx, ecx
jle 0x100479c6
push edi
nop
cmp esi, 2
jge 0x100478f8
xor esi, 1
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10047949
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
lea edx, [esi + esi*2]
mov edi, dword [eax + edx*8]
mov dl, byte [ecx]
test dl, dl
je 0x1004792e
movzx eax, byte [edi]
movzx edx, dl
mov dl, byte [edx + 0x10099610]
cmp dl, byte [eax + 0x10099610]
jne 0x1004792e
mov dl, byte [ecx + 1]
inc ecx
inc edi
test dl, dl
jne 0x10047911
movzx ecx, byte [ecx]
movzx edx, byte [edi]
movzx edx, byte [edx + 0x10099610]
movzx ecx, byte [ecx + 0x10099610]
sub ecx, edx
mov eax, dword [ebp - 4]
jne 0x100479b5
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
lea edx, [esi + esi*2]
mov esi, dword [ecx + edx*8 + 0x14]
cmp dword [esi + 0x10], 0
je 0x10047995
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, ebx
test ebx, ebx
jle 0x1004798e
jmp 0x10047970
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x10099610]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x10047970
mov ebx, dword [ebp - 0xc]
xor edx, edx
div dword [esi + 4]
jmp 0x10047997
xor edx, edx
mov eax, dword [ebp + 0xc]
push ebx
push eax
lea eax, [esi + 4]
call fcn.1001e4e0
add esp, 8
test eax, eax
je 0x100479cc
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
jne 0x100479c5
mov esi, dword [ebp - 8]
inc esi
mov dword [ebp - 8], esi
cmp esi, dword [ebp - 0x10]
jl 0x100478f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x100479b5
Function at 0x10047a70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, esi
cmp byte [esi], al
je 0x10047a8b
inc ecx
cmp byte [ecx], al
jne 0x10047a86
sub ecx, esi
and ecx, 0x3fffffff
mov dword [ebp - 0xc], ecx
mov ecx, dword [edx + 4]
xor ebx, ebx
mov dword [ebp - 0x10], ecx
test ecx, ecx
jle 0x10047b41
mov ecx, dword [edx + 8]
mov dword [ebp - 8], ecx
push edi
lea ecx, [ecx]
mov ecx, ebx
cmp ebx, 2
jge 0x10047aba
xor ecx, 1
lea edx, [ecx + ecx*2]
mov ecx, dword [ebp - 8]
mov esi, dword [ecx + edx*8 + 0x14]
lea ecx, [ecx + edx*8]
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x10047b18
mov edi, dword [ecx]
mov cl, byte [edx]
test cl, cl
je 0x10047b00
jmp 0x10047ae0
movzx eax, byte [edi]
movzx ecx, cl
mov cl, byte [ecx + 0x10099610]
cmp cl, byte [eax + 0x10099610]
jne 0x10047afd
mov cl, byte [edx + 1]
inc edx
inc edi
test cl, cl
jne 0x10047ae0
mov eax, dword [ebp - 4]
movzx edx, byte [edx]
movzx ecx, byte [edi]
movzx ecx, byte [ecx + 0x10099610]
movzx edx, byte [edx + 0x10099610]
sub edx, ecx
jne 0x10047b36
test esi, esi
je 0x10047b32
mov eax, dword [ebp + 8]
push eax
add esi, 0x14
push esi
mov esi, dword [ebp - 0xc]
call fcn.1001e5d0
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
jne 0x10047b40
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x10047ab0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10047bd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp byte [eax], 0
je 0x10047be9
inc eax
cmp byte [eax], 0
jne 0x10047be3
mov ecx, dword [edi]
mov esi, dword [edi + 0x24]
sub eax, ecx
and eax, 0x3fffffff
cmp dword [esi + 0x14], 0
mov ebx, eax
mov dword [ebp - 4], ebx
je 0x10047c3b
xor eax, eax
mov edx, ebx
test ebx, ebx
jle 0x10047c31
jmp 0x10047c10
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x10099610]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x10047c10
mov edi, dword [ebp + 8]
mov ebx, dword [ebp - 4]
xor edx, edx
div dword [esi + 0x14]
mov dword [ebp + 8], edx
jmp 0x10047c42
mov dword [ebp + 8], 0
mov eax, dword [edi]
mov edx, dword [ebp + 8]
push ebx
push eax
lea eax, [esi + 0x14]
call fcn.1001e4e0
add esp, 8
test eax, eax
je 0x10047c63
mov edx, dword [ebp + 8]
lea ecx, [esi + 0x14]
call fcn.1001e580
call fcn.10047b50
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret