joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x102f615c], 0
mov dword [0x102f6160], 0
mov dword [0x102f616c], 0
mov dword [0x102f6154], 0x1984
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x100138c3
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x100137c5
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x102f615c], edx
mov dword [0x102f6154], 0x1a0e
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x102f6160], edx
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x102f6164], cl
mov dword [0x102f6154], 0xcb8
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x102f6164]
mov edx, dword [0x102f6160]
mov byte [edi + edx], cl
mov edx, dword [0x102f615c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x102f6160]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov dword [0x102f6154], 0x1352
and ebx, 0xff
mov dword [0x102f616c], ebx
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x2c]
mov ch, byte [edx + ebx]
mov dword [0x102f6158], 0x150a
mov dword [0x102f6154], 0xfffff1a1
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x100138c1
mov eax, dword [0x102f615c]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x102f6160]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], edx
jmp 0x100137c5
jmp 0x100138c3
mov dword [0x102f6154], 0x1ed6
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100139c0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x80]
lea ecx, [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.10012920
lea ecx, [0x10013950]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x74], edx
mov dword [0x102f6158], 0x2ba
mov dword [esp + 0x2c], 0x133c00
mov edx, dword [0x102f6140]
mov dword [esp + 0x50], edx
mov edx, dword [0x102f6144]
mov dword [esp + 0x7c], edx
mov edx, dword [0x102f6148]
mov dword [esp + 0x6c], edx
mov edx, dword [0x102f614c]
mov dword [esp + 0x54], edx
mov edx, dword [0x102f6150]
mov dword [esp + 0x34], edx
mov dword [0x102f6154], 0x131d
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
je 0x10013aca
jmp 0x10013ae2
lea eax, [esp + 0x80]
mov ecx, dword [0x102f6158]
add ecx, 0xffffffca
mov dword [0x102f6158], ecx
add eax, 8
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.100131a0
mov dword [0x102f6154], 0x7f2
mov ecx, esp
lea edx, [esp + 0x28]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov ecx, dword [0x102f6154]
add ecx, 0x51e
mov dword [0x102f6154], ecx
mov dword [esp + 0x10], eax
jmp 0x10013b37
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
je 0x10013b03
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [0x102f6158], 0x4b9
mov dword [esp + 0x1c], eax
jmp 0x10013a4a
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov dword [esp + 0x5c], eax
mov dword [0x102f6154], 0xffffdb9d
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x78], eax
call fcn.10013d30
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
je 0x10013a5e
mov eax, dword [esp + 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x10013d30
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov dword [0x102f6154], 0x275
mov dword [ebp - 0x10], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov edx, 0x15b1
mov esi, dword [ebp - 0x10]
mov esi, dword [esi + 0x10]
mov esi, dword [esi + 0x3c]
mov dword [0x102f6154], 0x15b1
mov edi, dword [0x102f6158]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edx
jmp 0x10013e3e
xor eax, eax
mov dword [0x102f6158], 0x1cb9
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x2c], eax
je 0x10013eca
jmp 0x10013f06
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x38]
xor esi, esi
mov dword [0x102f6158], edx
mov edx, dword [ebp - 0x20]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x2c], esi
je 0x10013eb0
jmp 0x10013f06
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
mov dx, word [eax + ecx*2 - 0x10]
mov word [ebp - 0x3e], dx
xor eax, eax
mov cx, word [ebp - 0x3e]
cmp cx, 0x6c
mov dword [ebp - 0x2c], eax
je 0x10013eee
jmp 0x10013f06
xor eax, eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x2c], eax
je 0x10013d87
jmp 0x10013f06
mov eax, 1
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffc98
mov dword [0x102f6158], ecx
mov dword [ebp - 0x2c], eax
jmp 0x10013f06
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
add edx, 0xfffff7df
mov esi, dword [ebp - 0x20]
cmp word [esi + ecx*2], 0
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ebx
je 0x10013dae
mov eax, 0x15f6
mov dword [0x102f6154], 0x15f6
mov ecx, dword [ebp - 0x44]
add ecx, 1
cmp ecx, 0x104
mov edx, dword [ebp - 0x48]
mov esi, eax
mov edi, ecx
mov ebx, dword [ebp - 0x48]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x24], eax
jl 0x10013e3e
jmp 0x10013dae
xor eax, eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x2c], eax
je 0x10013e05
jmp 0x10013f06
xor eax, eax
mov dword [0x102f6158], 0x119b
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x2c], eax
je 0x10013ddd
jmp 0x10013f06
xor eax, eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x2c], eax
je 0x10013e22
mov eax, dword [ebp - 0x2c]
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x405710
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40572e
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40576f
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0xd8d058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00d8d1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd8d07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd8d06a
add dl, dl
jne 0xd8d089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd8d0dc
xor eax, eax
add dl, dl
jne 0xd8d096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd8d17d
add dl, dl
jne 0xd8d0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd8d0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd8d0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd8d0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd8d0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd8d075
mov eax, 1
add dl, dl
jne 0xd8d0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd8d0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd8d0e1
sub eax, ebx
mov ebx, 1
jne 0xd8d128
mov ecx, 1
add dl, dl
jne 0xd8d10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd8d119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd8d105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd8d075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd8d13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd8d14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd8d136
cmp eax, 0x7d00
jae 0xd8d16d
cmp eax, 0x500
jb 0xd8d168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd8d075
cmp eax, 0x7f
ja 0xd8d170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd8d075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd8d19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd8d075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x50c610
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
jmp 0x50c62a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50c631
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50c620
mov eax, 1
add ebx, ebx
jne 0x50c643
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50c638
jne 0x50c654
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50c638
xor ecx, ecx
sub eax, 3
jb 0x50c668
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50c6da
mov ebp, eax
add ebx, ebx
jne 0x50c673
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x50c680
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x50c6a4
inc ecx
add ebx, ebx
jne 0x50c690
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50c685
jne 0x50c6a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50c685
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50c6c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50c6b5
jmp 0x50c626
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50c6c4
add edi, ecx
jmp 0x50c626
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x50c723
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xeacc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xeb24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50c6e1
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xeb2c]
or eax, eax
je 0x50c71d
mov dword [ebx], eax
add ebx, 4
jmp 0x50c6fe
call dword [esi + 0xeb28]
mov ebp, dword [esi + 0xeb30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50c757
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x1000ee90
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x1001e108]
xor eax, esp
mov dword [esp + 0x190], eax
mov eax, dword [esp + 0x19c]
sub eax, 0
je 0x1000eed2
dec eax
jne 0x1000eee2
mov eax, dword [esp + 0x198]
lea ecx, [esp]
push ecx
push 2
mov dword [0x1001e7f4], eax
call dword [sym.imp.wsock32.dll_WSAStartup]
mov dword [0x1001e3d8], eax
jmp 0x1000eee2
call dword [sym.imp.wsock32.dll_WSACleanup]
mov dword [0x1001e7f4], 0
mov ecx, dword [esp + 0x190]
xor ecx, esp
mov eax, 1
call fcn.10017ff3
add esp, 0x194
ret 0xc

Function at 0x1000f4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1000f4cf
pop dword [ebp - 0x28]
mov eax, 0x1000f4cf
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x3c457fdb
add dword [ebp - 0x38], 0x120cc570
mov dword [ebp - 0x34], 0x87b616db
sub dword [ebp - 0x34], 0x5582ca96
mov dword [ebp - 0x30], 0x3e8a52a5
sub dword [ebp - 0x30], 0xf23e0e77
mov dword [ebp - 0x2c], 0x45932013
add dword [ebp - 0x2c], 0xba6cdfed
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xd65b4d2d
add dword [ebp - 0x38], 0x9e171c29
mov dword [ebp - 0x34], 0xb5448f44
sub dword [ebp - 0x34], 0x73d82dcf
mov dword [ebp - 0x30], 0x84b7f739
add dword [ebp - 0x30], 0xdeb77533
mov dword [ebp - 0x2c], 0x17743b81
sub dword [ebp - 0x2c], 0x17743b81
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x35879
push 0
call eax
mov ecx, 0x6c3f7717
add ecx, 0x93c0cd1b
xor esi, esi
add esi, eax
mov edx, 0x10021a00
add edx, dword [ebp - 0x28]
mov edi, 0x97bcb6bc
sub dword [ebp - 0x24], edi
mov ebx, dword [edx]
add dword [ebp - 4], ebx
xor ebx, edi
mov dword [ebp - 0x18], 0xf54ded
mov dword [esi], ebx
mov dword [ebp - 0x18], 0x40017351
add esi, 0x75567404
add esi, 0x8aa98c00
add edx, 0xb4de1516
sub edx, 0xb4de1512
loop 0x1000f5d8
add eax, 0x5c414e80
sub eax, 0x5c404ae5
xor ebx, ebx
add ebx, eax
add eax, 0x366ccd57
sub eax, 0x366ccd52
mov ecx, 0x3d047d2
sub ecx, 0xf3d047d2
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x101c48c5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10340670]
jne 0x101c48cf
repz ret
jmp fcn.101c6b86

Function at 0x101c7f49
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.101c3dc1
and dword [ebp - 4], 0
cmp dword [0x10341ad8], 0
mov ebx, eax
jne 0x101c7ffa
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x101c80ab
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x101c80ab
push eax
call fcn.101c3d4f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10341ad8], eax
call esi
push eax
call fcn.101c3d4f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10341adc], eax
call esi
push eax
call fcn.101c3d4f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10341ae0], eax
call esi
push eax
call fcn.101c3d4f
pop ecx
mov dword [0x10341ae8], eax
test eax, eax
je 0x101c7ffa
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.101c3d4f
pop ecx
mov dword [0x10341ae4], eax
mov eax, dword [0x10341ae4]
cmp eax, ebx
je 0x101c8052
cmp dword [0x10341ae8], ebx
je 0x101c8052
push eax
call fcn.101c3dca
push dword [0x10341ae8]
mov esi, eax
call fcn.101c3dca
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x101c8052
test edi, edi
je 0x101c8052
call esi
test eax, eax
je 0x101c8049
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x101c8049
test byte [ebp - 0xc], 1
jne 0x101c8052
or dword [ebp + 0x10], 0x200000
jmp 0x101c808b
mov eax, dword [0x10341adc]
cmp eax, ebx
je 0x101c808b
push eax
call fcn.101c3dca
pop ecx
test eax, eax
je 0x101c808b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x101c808b
mov eax, dword [0x10341ae0]
cmp eax, ebx
je 0x101c808b
push eax
call fcn.101c3dca
pop ecx
test eax, eax
je 0x101c808b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10341ad8]
call fcn.101c3dca
pop ecx
test eax, eax
je 0x101c80ab
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x101c80ad
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x101c92f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x1033fd50], 0
mov byte [0x1033fd54], 0
mov dword [0x1033fd44], 0x2578
mov dword [0x1033fd4c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jmp 0x101c93fe
mov eax, dword [0x1033fd48]
add eax, 0xffffee3c
mov dword [0x1033fd44], eax
mov dword [0x1033fd4c], 0
mov eax, 0x100
mov dword [0x1033fd58], 0
mov ecx, dword [0x1033fd50]
mov edx, dword [0x1033fd4c]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + edx]
add edi, ecx
mov dword [ebp - 0x1c], eax
mov eax, edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
div ecx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add edi, edx
mov dword [0x1033fd58], edi
mov dword [0x1033fd44], 0x135a
mov eax, edi
cdq
mov edi, dword [ebp - 0x1c]
idiv edi
mov dword [0x1033fd50], edx
mov ecx, dword [0x1033fd4c]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov dl, byte [eax + ecx]
mov byte [0x1033fd54], dl
mov esi, dword [ebp - 0x24]
mov dl, byte [eax + esi]
mov byte [eax + ecx], dl
mov dl, byte [0x1033fd54]
mov edi, dword [0x1033fd50]
mov byte [eax + edi], dl
mov edi, dword [0x1033fd4c]
add edi, 1
mov dword [0x1033fd4c], edi
cmp edi, 0x100
jl 0x101c934e
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [0x1033fd48], 0xf4
mov eax, dword [0x1033fd4c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x1033fd44], 0x198b
mov eax, dword [0x1033fd4c]
add eax, 1
mov dword [0x1033fd4c], eax
cmp eax, 0x100
jl 0x101c93fe
jmp 0x101c9335
Function at 0x101c9440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x1033fd48], 0x143b
mov dword [0x1033fd44], 0x139d
mov edx, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], ecx
jmp 0x101c94f2
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
lea edx, section..data
imul esi, eax, 0x190
mov edi, edx
add edi, esi
add edi, 0x16c
mov esi, dword [edi]
imul edi, eax, 0x190
mov ebx, edx
add ebx, edi
mov edi, dword [ebx]
imul ebx, eax, 0x190
add edx, ebx
add edx, 0x68
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x44]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], edx
call fcn.101c9da0
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
add eax, ecx
mov edx, dword [ebp - 0x48]
add edx, 1
cmp edx, 0x6cb
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
je 0x101c95b3
jmp 0x101c9472
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
lea edx, section..data
imul esi, eax, 0x190
mov edi, edx
add edi, esi
add edi, 0x16c
mov esi, dword [edi]
imul edi, eax, 0x190
add edx, edi
add edx, 0x68
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x6cb
mov ecx, edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
jne 0x101c94f2
lea eax, [0x101cb961]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [0x1033fd44], 0x52
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x5c], ecx
call fcn.101c9ca0
mov eax, dword [ebp - 0x58]
mov dword [esp], eax
call fcn.101c90c0
mov ecx, eax
mov dword [0x1033fd60], eax
mov eax, esp
mov edx, dword [ebp - 0x54]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], ecx
jmp 0x101c9472
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x54]
mov dword [esp + 8], ecx
call fcn.101c9bb0
xor eax, eax
mov ecx, dword [ebp - 0x44]
add ecx, 0xfdf9d
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov dword [0x1033fd44], 0x512
mov dword [edx + 4], 0x163800
mov ecx, dword [ebp - 0x44]
add ecx, 0xee84e
mov dword [edx + 8], ecx
mov dword [edx + 0xc], 0x2000
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x101c9e00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [fcn.101c9e00]
mov dword [ebp - 4], eax
jmp 0x101c9e19
mov eax, dword [ebp - 8]
add esp, 0xc
pop ebp
ret
mov eax, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 8], eax
jne 0x101c9e42
mov eax, dword [ebp - 8]
add eax, 0x3c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
cmp dword [edx + ecx], 0x4550
je 0x101c9e11
mov eax, dword [ebp - 8]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [ebp - 4], eax
jmp 0x101c9e19
Function at 0x101c9e60
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov dword [ebp - 8], 0
mov eax, dword [0x1033fd48]
add eax, 0xfffffc4a
mov dword [0x1033fd44], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [0x1033fd48]
mov esi, dword [ebp - 8]
mov esi, dword [esi + 0x10]
mov esi, dword [esi + 0x3c]
add edx, 0xffffe172
mov dword [0x1033fd44], edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], ecx
jmp 0x101c9f42
xor eax, eax
mov dword [0x1033fd48], 0x19ef
mov dword [ebp - 0x18], eax
jmp 0x101c9fb5
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x101c9eb1
mov eax, dword [0x1033fd44]
add eax, 0x609
mov dword [0x1033fd48], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x101c9f9d
jmp 0x101c9eb1
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff8
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2], 0x6c
jne 0x101c9eb1
mov dword [0x1033fd48], 0x1644
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov dx, word [eax + ecx*2 - 0xe]
mov word [ebp - 0x22], dx
mov eax, 1
mov cx, word [ebp - 0x22]
cmp cx, 0x6c
mov dword [ebp - 0x18], eax
je 0x101c9fb5
jmp 0x101c9eb1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edx
je 0x101c9f6f
mov eax, dword [ebp - 0x28]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x2c], eax
jl 0x101c9f42
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
jne 0x101c9eb1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x101c9ec5
jmp 0x101c9eb1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x101c9ef8
jmp 0x101c9eb1
mov eax, dword [ebp - 0x18]
add esp, 0x28
pop esi
pop ebp
ret