joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e0310
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e137
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x547770]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edx, dword [esi + 0x50]
mov ebx, dword [esi + 0x54]
xor eax, eax
mov edi, ebx
mov ecx, edx
rep stosd dword es:[edi], eax
lea eax, [edx*4]
mov dword [ebp - 4], 4
push ebx
cmp eax, 0x10
jb 0x4e0364
call fcn.004de6c0
jmp 0x4e0369
call fcn.00444fc0
mov edx, dword [esi + 0x3c]
mov ebx, dword [esi + 0x40]
xor eax, eax
mov edi, ebx
mov ecx, edx
rep stosd dword es:[edi], eax
add esp, 4
lea ecx, [edx*4]
mov byte [ebp - 4], 3
push ebx
cmp ecx, 0x10
jb 0x4e0392
call fcn.004de6c0
jmp 0x4e0397
call fcn.00444fc0
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x2c]
add esp, 4
mov edi, edx
xor al, al
push edx
mov byte [ebp - 4], 2
rep stosb byte es:[edi], al
call fcn.00444fc0
mov edx, dword [esi + 0x24]
mov ecx, dword [esi + 0x20]
mov edi, edx
xor al, al
push edx
mov byte [ebp - 4], 1
rep stosb byte es:[edi], al
call fcn.00444fc0
mov edx, dword [esi + 0x18]
mov ecx, dword [esi + 0x14]
mov edi, edx
xor al, al
push edx
mov byte [ebp - 4], 0
rep stosb byte es:[edi], al
call fcn.00444fc0
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 8]
mov edi, edx
xor al, al
push edx
mov dword [ebp - 4], 0xffffffff
rep stosb byte es:[edi], al
call fcn.00444fc0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4e0b80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50e212
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x547770]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 1
mov dword [ebp - 0x14], esi
call fcn.004d8f10
xor ebx, ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [ebp - 4], 2
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 0xb
call fcn.004f4550
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 0xc
call fcn.004f4550
mov byte [esi + 0x5c], 1
lea edi, [esi + 0x60]
push 1
mov ecx, edi
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x18], edi
call fcn.004d8f10
lea eax, [edi + 0x10]
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov ecx, 0x10
mov dword [eax + 0x48], ecx
mov byte [eax + 0x41], 1
mov dword [eax + 0x4c], eax
lea eax, [edi + 0x60]
mov dword [eax + 0x48], ecx
mov byte [eax + 0x41], 1
mov dword [eax + 0x4c], eax
mov eax, dword [edi + 0xac]
push eax
mov byte [ebp - 4], 0xf
call fcn.004f8970
mov dword [edi], vtable.CryptoPP::SHA1.0
add esp, 4
mov dword [esi], vtable.CryptoPP::PK_MessageAccumulatorImpl_class_CryptoPP::SHA1_.0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ba901
mov esp, ebp
pop ebp
ret
Function at 0x4f8970
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
pop ebp
ret

Function at 0x4fc710
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor eax, eax
push esi
mov dword [ebp - 0x14], eax
push edi
mov edi, edi
movzx eax, byte [eax + 0x52dba0]
mov esi, eax
shr esi, 6
mov edi, esi
and edi, 2
mov dword [ebp - 8], edi
and esi, 1
mov ecx, eax
shr ecx, 5
mov edx, ecx
mov edi, ecx
mov dword [ebp - 4], esi
mov esi, ecx
and edi, 1
mov ecx, eax
shr ecx, 7
mov dword [ebp - 0xc], ecx
lea ebx, [eax + eax]
xor ebx, eax
lea ecx, [ebx + ebx]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
imul ebx, ebx, 0x1b000000
xor ecx, eax
shl ecx, 0x19
xor ecx, ebx
mov ebx, edi
imul ebx, ebx, 0x1b000000
xor ecx, ebx
and esi, 2
mov ebx, esi
imul ebx, ebx, 0x1b000000
xor ecx, ebx
mov ebx, dword [ebp - 4]
imul ebx, ebx, 0x1b000000
xor ecx, ebx
mov ebx, dword [ebp - 8]
imul ebx, ebx, 0x1b000000
xor ecx, ebx
and edx, 4
mov dword [ebp - 0x10], edi
imul edi, edi, 0x11b00
mov ebx, edx
imul ebx, ebx, 0x1b000000
xor ecx, ebx
mov ebx, dword [ebp - 0x18]
add ebx, ebx
add ebx, ebx
xor ebx, eax
shl ebx, 8
xor ebx, edi
mov edi, esi
imul edi, edi, 0x11b00
xor ebx, edi
mov edi, dword [ebp - 4]
imul edi, edi, 0x11b00
xor ebx, edi
mov edi, dword [ebp - 8]
imul edi, edi, 0x11b00
xor ebx, edi
mov edi, edx
imul edi, edi, 0x11b00
xor ebx, edi
or ecx, ebx
mov ebx, dword [ebp - 0x10]
imul ebx, ebx, 0x11b0000
lea edi, [eax*8]
xor edi, eax
shl edi, 0x10
xor edi, ebx
mov ebx, esi
imul ebx, ebx, 0x11b0000
xor edi, ebx
mov ebx, edx
imul ebx, ebx, 0x11b0000
xor edi, ebx
lea ebx, [eax*4]
or ecx, edi
mov edi, dword [ebp - 0xc]
xor ebx, eax
add ebx, ebx
imul edi, edi, 0x11b
imul esi, esi, 0x11b
imul edx, edx, 0x11b
xor ebx, edi
mov edi, dword [ebp - 0x10]
imul edi, edi, 0x11b
xor ebx, edi
xor ebx, esi
xor ebx, edx
xor ebx, eax
or eax, ecx
or ebx, ecx
xor edx, edx
or edx, eax
mov eax, dword [ebp - 0x14]
xor ecx, ecx
or ebx, ecx
mov dword [eax*8 + 0x550430], edx
mov dword [eax*8 + 0x550434], ebx
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x100
jl 0x4fc720
pop edi
pop esi
mov byte [0x550c31], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ff640
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50f61e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x547770]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
or eax, 0xffffffff
xor ebx, ebx
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
lea ecx, [esi + 0x14]
mov dword [esi], vtable.TiXmlAttribute.0
mov eax, 0xf
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], ebx
mov dword [ebp - 4], ebx
mov byte [ecx], bl
mov dword [esi + 0x44], eax
mov dword [esi + 0x40], ebx
mov byte [esi + 0x30], bl
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov byte [ebp - 4], 2
mov dword [ebp - 0x10], edx
lea ebx, [ebx]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4ff6b0
sub eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004083e0
mov edx, dword [ebp + 0xc]
mov eax, edx
lea ecx, [eax + 1]
mov dword [ebp + 8], ecx
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4ff6d0
sub eax, dword [ebp + 8]
lea ecx, [esi + 0x30]
push eax
push edx
call fcn.004083e0
mov dword [esi + 0x10], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4ff9c0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50f683
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x547770]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
or ecx, 0xffffffff
mov dword [esi + 8], ecx
mov dword [esi + 4], ecx
xor edx, edx
mov dword [esi + 0xc], edx
mov dword [esi + 0x30], edx
mov ebx, 0xf
mov dword [esi + 0x34], ebx
mov byte [esi + 0x20], dl
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], 1
mov dword [esi + 0x3c], edx
mov dword [esi + 0x40], edx
lea eax, [esi + 0x44]
mov dword [esi], vtable.TiXmlElement.0
mov dword [eax + 8], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0xc], edx
mov dword [eax], vtable.TiXmlAttribute.0
mov dword [eax + 0x28], ebx
mov dword [eax + 0x24], edx
mov byte [eax + 0x14], dl
mov dword [eax + 0x44], ebx
mov dword [eax + 0x40], edx
mov byte [eax + 0x30], dl
mov dword [ebp - 4], edx
mov dword [eax + 0x10], edx
mov dword [eax + 0x50], eax
mov dword [eax + 0x4c], eax
mov ecx, dword [ebp + 8]
mov eax, ecx
lea ebx, [eax + 1]
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], edx
mov dword [esi + 0x18], edx
mov dword [ebp + 8], ebx
mov bl, byte [eax]
inc eax
cmp bl, dl
jne 0x4ffa62
sub eax, dword [ebp + 8]
push eax
push ecx
lea ecx, [esi + 0x20]
call fcn.004083e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4ffdd0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50f723
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x547770]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor ebx, ebx
or eax, 0xffffffff
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov dword [esi + 0x30], ebx
mov edx, 0xf
mov dword [esi + 0x34], edx
mov byte [esi + 0x20], bl
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
lea ecx, [esi + 0x4c]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ecx + 0x14], edx
mov dword [ecx + 0x10], ebx
mov dword [ebp - 4], ebx
mov byte [ecx], bl
mov dword [esi + 0x70], eax
mov dword [esi + 0x6c], eax
push ebx
push 0x51ceaf
mov byte [ebp - 4], 1
mov dword [esi + 0x68], 4
mov byte [esi + 0x74], bl
mov byte [esi + 0x44], bl
mov dword [esi + 0x48], ebx
call fcn.004083e0
mov dword [esi + 0x70], ebx
mov dword [esi + 0x6c], ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x35007b00
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
push edi
pushal
sub esp, 4
mov al, 1
inc al
jne 0x35007b1c
add esp, 0x90
add esp, 4
popal
pushal
push ebx
mov bx, 0xdb30
xor bl, bl
jne 0x35007b24
pop ebx
popal
mov dword [ebp - 8], 0
jmp 0x35007b3c
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x35007b9a
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
jmp 0x35007b5d
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 8
jge 0x35007b8b
mov eax, dword [ebp - 4]
and eax, 1
je 0x35007b7b
mov ecx, dword [ebp - 4]
shr ecx, 1
xor ecx, 0xedb88320
mov dword [ebp - 0x10], ecx
jmp 0x35007b83
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x35007b54
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x414], edx
jmp 0x35007b33
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
cmp dword [ebp - 0x14], 0
je 0x35007bdf
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, dword [ebp - 4]
and eax, 0xff
mov ecx, dword [ebp - 4]
shr ecx, 8
xor ecx, dword [ebp + eax*4 - 0x414]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
add edx, 1
mov dword [ebp + 8], edx
jmp 0x35007ba1
mov eax, dword [ebp - 4]
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x941920
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x515000]
push edi
jmp 0x94193a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x941941
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x941930
mov eax, 1
add ebx, ebx
jne 0x941953
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x941964
jne 0x941983
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x941983
dec eax
add ebx, ebx
jne 0x941970
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x941948
add ebx, ebx
jne 0x94197f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x9419d5
xor ecx, ecx
sub eax, 3
jb 0x94199b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x941a0a
sar eax, 1
mov ebp, eax
jmp 0x9419a6
add ebx, ebx
jne 0x9419a6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x941974
inc ecx
add ebx, ebx
jne 0x9419b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x941974
add ebx, ebx
jne 0x9419c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9419b6
jne 0x9419d2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9419b6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9419f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9419e6
jmp 0x941936
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9419f4
add edi, ecx
jmp 0x941936
pop esi
mov edi, esi
mov ecx, 0x7b9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x941a12
cmp byte [edi], 9
jne 0x941a12
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x941a17
lea edi, [esi + 0x53f000]
mov eax, dword [edi]
or eax, eax
je 0x941a86
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x541f70]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x541ff8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x941a44
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x542000]
or eax, eax
je 0x941a80
mov dword [ebx], eax
add ebx, 4
jmp 0x941a61
call dword [esi + 0x541ffc]
mov ebp, dword [esi + 0x542004]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x941aba
sub esp, 0xffffff80
jmp 0x403b73
Function at 0x1019a477
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101acae0]
jne 0x1019a481
repz ret
jmp fcn.1019bf6b

Function at 0x1019d25f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1019a57c
and dword [ebp - 4], 0
cmp dword [0x101af018], 0
mov ebx, eax
jne 0x1019d310
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1019d3c1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1019d3c1
push eax
call fcn.1019a50a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101af018], eax
call esi
push eax
call fcn.1019a50a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101af01c], eax
call esi
push eax
call fcn.1019a50a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101af020], eax
call esi
push eax
call fcn.1019a50a
pop ecx
mov dword [0x101af028], eax
test eax, eax
je 0x1019d310
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1019a50a
pop ecx
mov dword [0x101af024], eax
mov eax, dword [0x101af024]
cmp eax, ebx
je 0x1019d368
cmp dword [0x101af028], ebx
je 0x1019d368
push eax
call fcn.1019a585
push dword [0x101af028]
mov esi, eax
call fcn.1019a585
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1019d368
test edi, edi
je 0x1019d368
call esi
test eax, eax
je 0x1019d35f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1019d35f
test byte [ebp - 0xc], 1
jne 0x1019d368
or dword [ebp + 0x10], 0x200000
jmp 0x1019d3a1
mov eax, dword [0x101af01c]
cmp eax, ebx
je 0x1019d3a1
push eax
call fcn.1019a585
pop ecx
test eax, eax
je 0x1019d3a1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1019d3a1
mov eax, dword [0x101af020]
cmp eax, ebx
je 0x1019d3a1
push eax
call fcn.1019a585
pop ecx
test eax, eax
je 0x1019d3a1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101af018]
call fcn.1019a585
pop ecx
test eax, eax
je 0x1019d3c1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1019d3c3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1019ede9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov dword [0x101ac56c], 0x1dce
mov dword [ebp - 0x10], eax
call fcn.1019fd24
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x1019ee2f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x101ac568], 0x18ed
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
je 0x1019ee93
jmp 0x1019eec9
mov eax, dword [ebp - 0x34]
movzx ecx, word [eax]
mov dword [0x101ac568], 0x1941
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x101ac56c], 0x92b
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x30]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x38]
mov ecx, eax
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x41], bh
mov byte [ebp - 0x42], cl
je 0x1019ef2d
jmp 0x1019ef01
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + ecx*4]
mov dword [0x101ac56c], 0x1dce
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edx
jmp 0x1019ee9e
mov eax, dword [ebp - 0x40]
add eax, 1
mov cl, byte [ebp - 0x41]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x42]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x38], eax
jne 0x1019ee9e
mov al, byte [ebp - 0x42]
test al, 1
jne 0x1019ee66
jmp 0x1019ef3a
xor eax, eax
mov ecx, dword [ebp - 0x34]
add ecx, 2
mov edx, dword [ebp - 0x50]
add edx, 1
mov esi, dword [ebp - 0x2c]
cmp edx, esi
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x4c], ecx
jb 0x1019eedb
jmp 0x1019ee93
Function at 0x1019f272
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x1019f344
mov dword [0x101ac568], 0x3d46
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x1019f378
jmp 0x1019f39a
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov dword [0x101ac568], ecx
add esp, 0x24
pop esi
pop ebp
ret
mov eax, 0x18d0
mov ecx, 1
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
je 0x1019f2c4
jmp 0x1019f39a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x1019f2d6
jmp 0x1019f39a
mov dword [0x101ac568], 0x636
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1019f2a2
jmp 0x1019f39a
mov eax, dword [ebp - 0x24]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], eax
jge 0x1019f35a
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
jne 0x1019f32d
mov eax, dword [ebp - 0x28]
mov dword [0x101ac56c], 0x258e
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
je 0x1019f30e
jmp 0x1019f39a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x1019f39a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1019f2fa
mov eax, 0x1088
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
jmp 0x1019f2c4
Function at 0x1019f55c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101ac574], 0
mov byte [0x101ac578], 0
mov edi, dword [0x101ac568]
add edi, 0xfffff8e9
mov dword [0x101ac56c], edi
mov dword [0x101ac570], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1019f5c4
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov dword [0x101ac570], 0
mov dword [ebp - 0x20], eax
jmp 0x1019f600
mov eax, dword [ebp - 0x1c]
mov dword [0x101ac568], 0x7c1
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x101ac56c], 0x17ea
mov eax, dword [0x101ac570]
add eax, 1
mov dword [0x101ac570], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1019f5c4
jmp 0x1019f5b3
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x101ac57c], 0
mov edi, dword [0x101ac574]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x101ac57c], esi
mov dword [0x101ac568], 0xa1b
mov eax, esi
cdq
idiv ecx
mov dword [0x101ac574], edx
mov dword [0x101ac56c], 0xd32
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x101ac578], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x101ac578]
mov esi, dword [0x101ac574]
mov byte [ebx + esi], cl
mov esi, dword [0x101ac570]
add esi, 1
mov dword [0x101ac570], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x1019f600
jmp 0x1019f5ab
Function at 0x1019fa59
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x101ac56c], 0x1e49
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
jmp 0x1019fb28
mov eax, dword [ebp - 0x34]
mov dword [0x101ac568], 0x2091
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x38], eax
call fcn.1019f3b7
xor eax, eax
mov ecx, dword [ebp - 0x38]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x101ac568], 0x1f7a
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x1c], ecx
mov dword [0x101ac56c], 0x8aa
mov ecx, dword [ebp - 0x38]
mov dword [edx + 0x3c], ecx
add ecx, 0x1a2f
mov esi, dword [ebp - 0x38]
cmp esi, 0
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], eax
je 0x1019fb1f
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add esp, 0x50
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x101a14a8]
mov dh, byte [eax + 0x101a1479]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
jne 0x1019fb28
lea eax, [ebp - 0x24]
mov dword [0x101ac56c], 0x1a22
mov ecx, dword [0x101ac568]
add ecx, 0xffffefe3
mov dword [0x101ac568], ecx
mov dword [ebp - 0x44], eax
call fcn.1019ef67
mov dword [esp], eax
mov eax, dword [ebp - 0x44]
mov dword [esp + 4], eax
call fcn.1019eb74
cmp eax, 0
mov dword [ebp - 0x34], eax
jne 0x1019fa80
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret