joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005fd50
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x40
mov eax, dword [0x101e6040]
xor eax, esp
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x5c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x54]
mov ebx, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
push edi
mov edi, edx
mov dword [esp + 0x18], edi
cmp esi, 0xffffffff
jne 0x1005fda6
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, dword [esp + 0x3c]
mov eax, 1
cmp esi, eax
cmovl esi, eax
mov eax, 0x40
cmp esi, eax
cmovg esi, eax
mov eax, dword [esp + 0x1c]
test ebx, ebx
jne 0x1005fdcd
mov dword [eax], 0x100000
xor edx, edx
mov dword [eax + 4], ebx
mov eax, 0x100000
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.10151433
add esp, 0x40
ret
lea ecx, [edi - 1]
mov edi, 4
mov eax, ecx
shr eax, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov edx, ecx
or edx, 0x1fffe00
shr edx, 8
or edx, ecx
mov ecx, dword [esp + 0x18]
mov eax, edx
shr edx, 2
shr eax, 1
cmp eax, 0x1000000
cmovbe edx, eax
lea eax, [edx + 1]
mul edi
mov ebx, eax
mov ebp, edx
mov eax, ecx
mul edi
mov edi, dword [esp + 0x14]
add ebx, eax
adc ebp, edx
cmp edi, 5
jb 0x1005fe30
mov eax, ecx
mov edx, 4
mul edx
add ebx, eax
adc ebp, edx
add ebx, 0x200000
mov dword [esp + 0x10], 1
adc ebp, 0
cmp esi, 1
jbe 0x1005fe5c
cmp edi, 5
jb 0x1005fe5c
add ebx, 0x600000
mov dword [esp + 0x10], 2
adc ebp, 0
xor edx, edx
mov eax, esi
div dword [esp + 0x10]
xorps xmm0, xmm0
mov edx, eax
movlpd qword [esp + 0x20], xmm0
mov dword [esp + 0x14], edx
cmp edx, 1
je 0x1005feb9
xor edi, edi
mov esi, ecx
shld edi, esi, 2
shl esi, 2
test edi, edi
jne 0x1005fea2
cmp esi, 0x100000
ja 0x1005fe96
mov esi, 0x100000
jmp 0x1005fea7
test edi, edi
jne 0x1005fea2
cmp esi, 0x10000000
jb 0x1005fea9
mov esi, 0x10000000
xor edi, edi
test edi, edi
jb 0x1005feb3
ja 0x1005fec1
cmp esi, ecx
ja 0x1005fec1
mov esi, ecx
xor edi, edi
jmp 0x1005fec1
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov eax, esi
or eax, edi
push 0
push dword [esp + 0x18]
jne 0x1005feed
mov eax, ecx
mov ecx, 3
mul ecx
shrd eax, edx, 1
shr edx, 1
add eax, ebx
adc edx, ebp
push edx
push eax
call fcn.10178b70
mov ebp, eax
mov ebx, edx
jmp 0x1005ff22
mov ecx, edx
mov eax, edi
add edx, 2
shr ecx, 2
add ecx, edx
mul ecx
mov dword [esp + 0x18], eax
mov eax, esi
mul ecx
add dword [esp + 0x18], edx
add esi, ebx
mov dword [esp + 0x28], eax
adc edi, ebp
push edi
push esi
call fcn.10178b70
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x10]
add ebp, eax
adc ebx, edx
mov ecx, dword [esp + 0x1c]
mov edx, ebx
mov eax, dword [esp + 0x18]
add eax, 0x200000
pop edi
mov dword [ecx], eax
mov eax, ebp
pop esi
mov dword [ecx + 4], 0
mov ecx, dword [esp + 0x44]
pop ebp
pop ebx
xor ecx, esp
call fcn.10151433
add esp, 0x40
ret
Function at 0x1005ff50
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6c
mov eax, dword [0x101e6040]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
push edi
lea eax, [esp + 0x30]
mov dword [esp + 0x20], edx
mov ebx, ecx
mov dword [esp + 0x30], 0x40
push eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [esp + 0x3c]
mov esi, dword [esp + 0x5c]
mov edx, dword [esp + 0x58]
cmp ecx, esi
ja 0x1005ff9e
mov eax, dword [esp + 0x38]
jb 0x1005ffa2
cmp eax, edx
jb 0x1005ffa2
mov eax, edx
mov ecx, esi
test ecx, ecx
jne 0x1005ffad
cmp eax, 0x1000000
jbe 0x1005ffca
add eax, 0xff000000
mov dword [esp + 0x1c], eax
adc ecx, 0xffffffff
mov dword [esp + 0x18], ecx
test ecx, ecx
ja 0x1005ffda
jb 0x1005ffca
cmp eax, 0x1000000
jae 0x1005ffda
mov dword [esp + 0x1c], 0x1000000
mov dword [esp + 0x18], 0
cmp ebx, 9
jb 0x1005ffe9
mov dword [esp + 0x14], 0x4000000
jmp 0x1006001a
cmp ebx, 7
jb 0x1005fff8
mov dword [esp + 0x14], 0x2000000
jmp 0x1006001a
cmp ebx, 5
jb 0x10060007
mov dword [esp + 0x14], 0x1000000
jmp 0x1006001a
cmp ebx, 3
sbb eax, eax
and eax, 0xfff10000
add eax, 0x100000
mov dword [esp + 0x14], eax
xor ecx, ecx
mov ebx, 0x14
mov dword [esp + 0x10], ecx
xor esi, esi
lea eax, [ebx - 1]
nop word [eax + eax]
cmp ebx, 0x14
jne 0x10060039
test esi, esi
jne 0x10060092
lea edi, [esi + 2]
mov ecx, eax
shl edi, cl
cmp edi, 0x4000000
ja 0x1006008e
lea eax, [esp + 0x28]
xorps xmm0, xmm0
push eax
sub esp, 0x10
movlpd qword [esp + 0x3c], xmm0
mov edx, edi
push dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x40]
call fcn.1005fd50
add esp, 0x1c
cmp edi, dword [esp + 0x14]
ja 0x1006008b
cmp edx, dword [esp + 0x18]
ja 0x1006008b
jb 0x10060080
cmp eax, dword [esp + 0x1c]
ja 0x1006008b
mov ecx, edi
lea eax, [ebx - 1]
mov dword [esp + 0x10], ecx
jmp 0x10060092
lea eax, [ebx - 1]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, 2
jb 0x10060030
inc ebx
cmp ebx, 0x1f
jbe 0x10060025
pop edi
mov eax, ecx
mov ecx, dword [esp + 0x70]
pop esi
pop ebx
xor ecx, esp
call fcn.10151433
mov esp, ebp
pop ebp
ret
Function at 0x10063710
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x418
mov eax, dword [0x101e6040]
xor eax, esp
mov dword [esp + 0x414], eax
mov eax, dword [esp + 0x428]
push ebx
push ebp
mov ebp, dword [esp + 0x424]
mov ebx, ecx
mov dword [esp + 0x14], eax
mov al, byte [esp + 0x434]
push esi
push edi
mov edi, dword [esp + 0x434]
cmp al, 0x4c
je 0x10063752
cmp al, 0x4b
jne 0x1006377c
push 0x200
lea eax, [esp + 0x24]
push 0
push eax
call fcn.10152e30
add esp, 0xc
lea eax, [esp + 0x20]
push 0x64
push str.._.__LongLink
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
test eax, eax
jne 0x10063794
push 0
push 0
push 0xa0000047
lea ecx, [ebx + 8]
call fcn.1001f180
xor eax, eax
jmp 0x1006393f
test edi, edi
je 0x100637ab
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100637a0
sub ecx, edx
jmp 0x100637ad
xor ecx, ecx
lea eax, [ecx + 1]
mov byte [esp + 0xa7], 0
cdq
mov esi, 0xa
mov ecx, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
mov al, cl
and al, 7
shrd ecx, edx, 3
add al, 0x30
mov byte [esp + esi + 0x9c], al
shr edx, 3
sub esi, 1
jns 0x100637c8
or ecx, edx
je 0x1006381e
mov eax, dword [esp + 0x14]
xorps xmm0, xmm0
mov ecx, dword [esp + 0x18]
movq qword [esp + 0x9c], xmm0
bswap eax
bswap ecx
mov dword [esp + 0xa4], 0
mov byte [esp + 0x9c], 0x80
mov dword [esp + 0xa0], ecx
mov dword [esp + 0xa4], eax
mov al, byte [esp + 0x43c]
lea ecx, [esp + 0x20]
movq xmm0, qword [str.00000000000]
mov byte [esp + 0xbc], al
mov eax, dword [0x101ca678]
mov dword [esp + 0x84], 0x30303030
mov dword [esp + 0x88], 0x343436
mov dword [esp + 0x8c], 0x30303030
mov dword [esp + 0x90], 0x303030
mov dword [esp + 0x94], 0x30303030
mov dword [esp + 0x98], 0x303030
movq qword [esp + 0xa8], xmm0
mov dword [esp + 0xb0], eax
call fcn.10062400
push 0x200
lea eax, [esp + 0x24]
mov ecx, ebx
push eax
push ebp
call fcn.10063560
test eax, eax
jne 0x100638c3
push eax
mov eax, dword [esp + 0x20]
lea ecx, [ebx + 8]
push dword [eax + 4]
push 0xa0000030
call fcn.1001f180
xor eax, eax
jmp 0x1006393f
test edi, edi
je 0x100638d2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
jmp 0x100638d4
xor esi, esi
test esi, esi
jle 0x1006393a
nop dword [eax + eax]
push 0x200
lea eax, [esp + 0x224]
push 0
push eax
call fcn.10152e30
add esp, 0xc
lea eax, [esp + 0x220]
push 0x200
push edi
push eax
call fcn.10160e70
add esp, 0xc
lea eax, [esp + 0x220]
mov ecx, ebx
push 0x200
push eax
push ebp
call fcn.10063560
test eax, eax
je 0x1006378d
sub esi, 0x200
add edi, 0x200
test esi, esi
jg 0x100638e0
mov eax, 1
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10151433
add esp, 0x418
ret 0x14
Function at 0x1006cfc0
Capabilities:
Clear file content

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
push edi
mov eax, dword [ebx + 8]
cmp dword [eax + 0x60], 0
je 0x1006d047
mov esi, dword [esp + 0x18]
test esi, esi
jl 0x1006d047
mov edi, dword [esp + 0x14]
jg 0x1006d047
cmp edi, 0x1000
jbe 0x1006d047
test esi, esi
jg 0x1006d047
jl 0x1006cff3
cmp edi, 0x40000000
ja 0x1006d047
mov ebp, dword [esp + 0x1c]
mov ecx, ebp
mov eax, dword [ebp]
mov eax, dword [eax + 0x4c]
call eax
or eax, edx
jne 0x1006d047
mov eax, dword [ebp]
mov ecx, ebp
push esi
push edi
mov eax, dword [eax + 0x48]
call eax
cmp eax, edi
jne 0x1006d047
cmp edx, esi
jne 0x1006d047
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x1006d02c
mov dword [ebx], edi
mov dword [ebx + 4], esi
mov eax, dword [ebp]
mov ecx, ebp
push 0
push 0
mov eax, dword [eax + 0x48]
call eax
or eax, edx
je 0x1006d047
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 0x14
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x14
Function at 0x10073300
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [esi]
cmp eax, 0x100
jg case.default.0x10073325
je 0x10073432
cmp eax, 3
ja case.default.0x10073325
jmp dword [eax*4 + 0x10073484]
mov al, byte [esi + 0x18]
mov ecx, 0xff
test al, al
movzx edx, al
cmove edx, ecx
xor ecx, ecx
movsx eax, dl
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm1, xmm0, 0
test edi, edi
jle case.0x10073325.0
mov eax, dword [esp + 0x10]
cmp edi, 0x40
jb 0x100733ac
mov esi, edi
and esi, 0xffffffc0
nop dword [eax + eax]
movups xmm0, xmmword [eax]
add ecx, 0x40
xorps xmm0, xmm1
movups xmmword [eax], xmm0
movups xmm0, xmmword [eax + 0x10]
xorps xmm0, xmm1
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [eax + 0x20]
xorps xmm0, xmm1
movups xmmword [eax + 0x20], xmm0
movups xmm0, xmmword [eax + 0x30]
xorps xmm0, xmm1
movups xmmword [eax + 0x30], xmm0
add eax, 0x40
cmp ecx, esi
jl 0x10073370
cmp ecx, edi
jge case.0x10073325.0
sub edi, ecx
nop
xor byte [eax], dl
lea eax, [eax + 1]
sub edi, 1
jne 0x100733b0
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
ret 8
test edi, edi
jle case.0x10073325.0
mov ecx, dword [esp + 0x10]
nop
mov al, byte [esi + 8]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
add dword [esi + 8], 1
adc dword [esi + 0xc], 0
sub edi, 1
jne 0x100733d0
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
ret 8
mov ebx, dword [esp + 0x10]
test ebx, ebx
je case.0x10073325.0
test edi, edi
jle case.0x10073325.0
nop
push 0
push 0x400
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.101789c0
lea ebx, [ebx + 1]
mov al, byte [eax + esi + 0x24]
xor byte [ebx - 1], al
add dword [esi + 8], 1
adc dword [esi + 0xc], 0
sub edi, 1
jne 0x10073400
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
ret 8
mov ebx, dword [esp + 0x10]
test ebx, ebx
je case.0x10073325.0
cmp dword [esi + 0x20], 0
je case.default.0x10073325
test edi, edi
jle case.0x10073325.0
push 0
push 0x400
push dword [esi + 0xc]
push dword [esi + 8]
call fcn.101789c0
mov ecx, dword [esi + 0x20]
lea ebx, [ebx + 1]
mov al, byte [eax + ecx]
xor byte [ebx - 1], al
add dword [esi + 8], 1
adc dword [esi + 0xc], 0
sub edi, 1
jne 0x10073444
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x100792b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push esi
mov esi, ecx
mov edx, dword [esi + 0x1b7dc]
mov dword [esi + 0x1cec0], 0
test edx, edx
jle 0x100794a4
push ebx
mov ebx, dword [esi + 0x1b7d8]
xor eax, eax
push ebp
push edi
test eax, eax
je 0x1007930a
lea eax, [esi + 0x1c354]
mov ecx, esi
mov dword [esi + 0x1cebc], eax
mov eax, dword [esi + 0x28]
shr eax, 0x1e
push 2
mov dword [esi + 0x1cecc], eax
call fcn.10078400
mov ebx, dword [esi + 0x1b7d8]
mov edx, dword [esi + 0x1b7dc]
jmp 0x10079320
lea eax, [esi + 0x1b7ec]
mov dword [esi + 0x1cecc], 0
mov dword [esi + 0x1cebc], eax
mov eax, dword [esi + 0x1b7e4]
mov edi, dword [esi + 0x1cec0]
mov ebp, dword [esi + 0x1cecc]
mov cl, byte [eax + edi]
mov byte [esi + 0x1ced3], cl
mov byte [esi + 0x1ced4], 0
mov word [esi + 0x1ced1], 0
mov byte [esi + 0x1ced0], 0
cmp ebp, 1
jne 0x10079374
mov byte [esi + 0x1ced4], 0x80
mov word [esi + 0x1ced1], 0x8080
mov byte [esi + 0x1ced0], 0x80
sub cl, byte [eax + edi - 1]
jmp 0x1007939d
cmp ebp, 2
jne 0x100793a6
mov byte [esi + 0x1ced4], 0x80
mov word [esi + 0x1ced1], 0x8080
mov byte [esi + 0x1ced0], 0x80
movzx eax, byte [eax + edi - 1]
imul eax, eax, 0xb
sar eax, 4
sub cl, al
add cl, 0x80
mov byte [esi + 0x1ced3], cl
mov dword [esi + 0x1cec4], edi
cmp edi, ebx
jge 0x1007948c
mov edx, dword [esi + 0x1b7dc]
nop word [eax + eax]
mov al, byte [esi + 0x1ced3]
mov ch, byte [esi + 0x1ced0]
mov ebx, dword [esi + 0x1cecc]
mov byte [esi + 0x1ced0], al
mov byte [esp + 0x12], al
mov al, byte [esi + 0x1ced4]
mov byte [esi + 0x1ced1], al
mov byte [esi + 0x1ced2], ch
mov ebp, dword [esi + 0x1b7e4]
mov byte [esp + 0x13], al
lea eax, [edx + ebp]
mov cl, byte [eax + edi]
mov byte [esi + 0x1ced3], cl
cmp ebx, 1
jne 0x1007940f
sub cl, byte [eax + edi - 1]
jmp 0x10079424
cmp ebx, 2
jne 0x1007942d
lea eax, [edx + edi]
movzx eax, byte [eax + ebp - 1]
imul eax, eax, 0xb
sar eax, 4
sub cl, al
sub cl, 0x80
mov byte [esi + 0x1ced3], cl
movzx eax, byte [esp + 0x13]
movzx ebx, byte [esp + 0x12]
movzx edi, ch
mov edx, edi
movzx ecx, cl
sub edx, eax
sub ecx, ebx
sub ebx, edi
mov eax, dword [esi + edx*4 + 0x1d2d4]
add eax, dword [esi + ecx*4 + 0x1e2cc]
mov ecx, esi
add eax, dword [esi + ebx*4 + 0x1dad0]
cdq
xor eax, edx
sub eax, edx
mov dword [esi + 0x1cec8], eax
call fcn.100794d0
mov edx, dword [esi + 0x1b7dc]
add dword [esi + 0x1cec4], edx
mov edi, dword [esi + 0x1cec4]
mov ebx, dword [esi + 0x1b7d8]
cmp edi, ebx
jl 0x100793c0
mov eax, dword [esi + 0x1cec0]
inc eax
mov dword [esi + 0x1cec0], eax
cmp eax, edx
jl 0x100792d7
pop edi
pop ebp
pop ebx
mov eax, dword [esi + 0x1b7d8]
mov ecx, dword [esi + 0x1b7e0]
mov dword [esi + 0x1b7e8], eax
mov eax, dword [esi + 0x1b7e4]
mov dword [esi + 0x1b7e0], eax
mov dword [esi + 0x1b7e4], ecx
pop esi
pop ecx
ret
Function at 0x1007b0d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, edi
mov dword [esp + 0xc], ecx
mov ecx, dword [ecx + 8]
cdq
push edx
push eax
mov esi, dword [ecx]
push ebx
call dword [esi + 0x18]
test eax, eax
je 0x1007b12e
test edi, edi
je 0x1007b125
mov edx, dword [esp + 0xc]
movzx eax, word [edx + 0x3a]
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
xor ecx, eax
shr ax, 8
movzx ecx, cl
xor ax, word [ecx*2 + 0x101938e0]
movzx eax, ax
mov word [edx + 0x3a], ax
sub edi, 1
jne 0x1007b102
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x101e45fc
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0xa0000030
push eax
call fcn.10153200
int3

Function at 0x1007c470
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1017fde6
mov eax, dword fs:[0]
push eax
push ecx
push edi
mov eax, dword [0x101e6040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [edi + 0xc], eax
mov eax, dword [0x101c5980]
mov dword [edi + 8], 0
movsd qword [edi + 0x10], xmm0
mov dword [edi + 0x18], 0xffffffff
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 2
mov dword [edi + 0x58], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x54], 0
mov dword [edi + 0x5c], eax
mov dword [edi + 0x60], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push 0x1009e660
push 0x1009e5f0
push 0x20
mov dword [edi + 0x68], eax
lea eax, [edi + 0x78]
push 0x68
push eax
mov dword [edi + 0x6c], edx
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0xff
call fcn.10178510
push 0
mov byte [edi + 0xd78], 0
push 0
mov dword [edi + 0xd80], 0
push 0
mov dword [edi + 0xd84], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0
push 0
push 0
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi + 4], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1007c690
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x28
mov eax, dword [0x101e6040]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
mov esi, edx
push eax
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x20]
mov ebp, 1
cmp eax, ebp
cmovl eax, ebp
cmp eax, 0x40
jg 0x1007c6cc
dec eax
cmp eax, ebp
jge 0x1007c6cc
mov eax, ebp
jmp 0x1007c6ec
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x20]
mov ecx, 0x40
cmp eax, 1
cmovl eax, ebp
cmp eax, ecx
cmovg eax, ecx
dec eax
test ebx, ebx
mov ecx, 0x20
cmovne eax, ebx
cmp eax, esi
cmovb esi, eax
mov eax, 2
cmp esi, eax
cmovb eax, esi
cmp eax, ecx
pop esi
cmova eax, ecx
mov ecx, dword [esp + 0x2c]
pop ebp
pop ebx
xor ecx, esp
call fcn.10151433
add esp, 0x28
ret
Function at 0x10083700
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101802eb
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x101e6040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], edi
mov esi, dword [ebp + 8]
lea ecx, [edi + 0xc]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], esi
mov eax, dword [esi]
mov dword [edi], eax
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov al, byte [esi + 8]
mov byte [edi + 8], al
mov eax, dword [0x101c5980]
mov dword [ecx], eax
lea eax, [esi + 0xc]
push eax
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.1000bdd0
mov dword [ebp - 4], 0
lea ecx, [edi + 0x18]
mov eax, dword [0x101c5980]
mov dword [ecx], eax
lea eax, [esi + 0x18]
push eax
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.1000bdd0
mov byte [ebp - 4], 1
mov eax, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov dword [edi + 0x28], eax
mov dword [edi + 0x2c], ecx
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ecx
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x3c]
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], ecx
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
mov dword [edi + 0x40], eax
mov dword [edi + 0x44], ecx
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
mov dword [edi + 0x48], eax
lea eax, [edi + 0x78]
mov dword [edi + 0x4c], ecx
movups xmm0, xmmword [esi + 0x50]
mov dword [ebp - 0x10], eax
movups xmmword [edi + 0x50], xmm0
movups xmm0, xmmword [esi + 0x60]
movups xmmword [edi + 0x60], xmm0
movq xmm0, qword [esi + 0x70]
movq qword [edi + 0x70], xmm0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov eax, 0x66666667
mov ecx, dword [esi + 0x7c]
sub ecx, dword [esi + 0x78]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x10083868
cmp eax, 0x6666666
ja 0x10083889
mov edi, dword [ebp - 0x10]
mov ecx, edi
push eax
call fcn.100830b0
mov eax, dword [esi + 0x78]
mov esi, dword [esi + 0x7c]
mov edi, dword [edi]
sub esi, eax
push esi
push eax
push edi
call fcn.101528b0
mov eax, 0x66666667
add esp, 0xc
imul esi
mov esi, dword [ebp - 0x14]
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [ebp - 0x10]
lea ecx, [ecx + ecx*4]
lea ecx, [edi + ecx*8]
mov edi, dword [ebp - 0x18]
mov dword [edx + 4], ecx
mov cl, byte [esi + 0x84]
mov eax, edi
mov byte [edi + 0x84], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.10020970
int3
Function at 0x10088160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x18]
mov ebx, ecx
push edi
xor edi, edi
mov dword [esp + 0x10], ebx
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x10088185
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
add dword [esp + 0x18], 5
push ebp
lea ebp, [edx - 4]
add ebp, ebx
lea eax, [edi + ebx]
cmp eax, ebp
jae 0x100881a6
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x100881a6
inc eax
cmp eax, ebp
jb 0x10088197
mov edx, eax
sub edx, edi
mov edi, eax
sub edx, ebx
sub edi, ebx
cmp eax, ebp
jae 0x100882a8
cmp edx, 2
jbe 0x10088235
xor esi, esi
movzx edx, byte [eax + 4]
lea ecx, [edx + 1]
test cl, 0xfe
jne 0x10088297
movzx ecx, byte [eax + 3]
mov ebx, dword [esp + 0x1c]
shl edx, 8
add ebx, edi
or edx, ecx
movzx ecx, byte [eax + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 1]
shl edx, 8
or edx, ecx
mov ecx, edx
add edx, ebx
sub ecx, ebx
cmp dword [esp + 0x24], 0
cmove edx, ecx
mov dword [esp + 0x10], edx
mov ebx, edx
test esi, esi
je 0x10088269
and esi, 6
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x10088267
mov ebx, 0x100
shl ebx, cl
mov ecx, dword [esp + 0x1c]
dec ebx
xor ebx, dword [esp + 0x10]
add ecx, edi
cmp dword [esp + 0x24], 0
je 0x10088265
add ebx, ecx
jmp 0x10088267
mov ecx, edx
shr esi, cl
test esi, esi
je 0x100881bf
cmp esi, 4
ja 0x1008825a
cmp esi, 3
je 0x1008825a
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x100881bf
or esi, 8
shr esi, 1
inc edi
jmp 0x10088190
sub ebx, ecx
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov byte [eax + 4], bl
mov eax, 5
mov ebx, dword [esp + 0x14]
add edi, eax
jmp 0x10088190
or esi, 8
mov eax, 1
shr esi, 1
add edi, eax
jmp 0x10088190
mov eax, dword [esp + 0x20]
mov ecx, edx
shr esi, cl
xor ecx, ecx
cmp edx, 2
pop ebp
cmovbe ecx, esi
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 8
ret