joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401870
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x1c
mov eax, dword [eax + 4]
cmp eax, dword [section..bss]
je 0x401928
mov dword [esp + 8], eax
mov eax, dword [sym.imp.kernelbase.dll_OpenProcess]
mov esi, edx
mov dword [esp + 4], 0
mov dword [esp], 0x100000
mov dword [ebp - 0x14], eax
call eax
sub esp, 0xc
mov edi, eax
test eax, eax
je 0x401928
mov dword [esp + 4], 0
mov ecx, eax
mov edx, esi
mov eax, ebx
mov dword [esp], 0x11
call sym._send_messages_with_timeout_dialog.constprop.0
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x401938
mov eax, dword [ebp - 0x10]
mov dword [esp], 0x16
mov edx, esi
mov ecx, edi
mov dword [esp + 4], eax
mov eax, ebx
call sym._send_messages_with_timeout_dialog.constprop.0
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x401950
cmp eax, 0xffffffff
je 0x401938
mov dword [esp], edi
mov dword [esp + 4], 0
call dword [sym.imp.kernelbase.dll_WaitForSingleObject]
sub esp, 8
mov esi, eax
mov dword [esp], edi
mov edi, dword [sym.imp.kernelbase.dll_CloseHandle]
call edi
sub esp, 4
cmp esi, 0x102
je 0x401960
lea esi, [esi]
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call dword [sym.imp.kernelbase.dll_CloseHandle]
sub esp, 4
jmp 0x401928
mov dword [esp], edi
call dword [sym.imp.kernelbase.dll_CloseHandle]
xor eax, eax
sub esp, 4
jmp 0x40192d
mov eax, dword [ebx + 4]
mov dword [esp + 4], 0
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x14]
call eax
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x401928
test byte [section..data], 8
jne 0x4019b0
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.kernelbase.dll_TerminateProcess]
sub esp, 8
mov dword [esp], esi
call edi
sub esp, 4
jmp 0x401928
mov eax, dword [ebx + 4]
mov dword [esp + 0xc], str.terminating_process__04lx_n
mov dword [esp + 8], str.send_end_session_messages
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x409000
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x40198d
Function at 0x401d10
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x248
call dword [0x41959c]
mov dword [esp + 4], 0x418000
mov dword [esp], eax
call dword [0x4195a8]
sub esp, 8
lea esi, cs:[esi]
nop
mov dword [esp + 4], 0
mov dword [esp], 2
call sym._CreateToolhelp32Snapshot_8
sub esp, 8
mov edi, eax
test eax, eax
je 0x401e80
mov dword [ebp - 0x238], 0x22c
lea ebx, [ebp - 0x238]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._Process32FirstW_8
sub esp, 8
test eax, eax
je 0x401ea0
xor esi, esi
jmp 0x401df5
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [sym.imp.kernelbase.dll_OpenProcess]
sub esp, 0xc
test eax, eax
je 0x401de2
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [ebp - 0x23c], eax
call dword [sym.imp.kernelbase.dll_TerminateProcess]
mov edx, dword [ebp - 0x23c]
sub esp, 8
cmp eax, 1
sbb esi, 0xffffffff
mov dword [esp], edx
call dword [sym.imp.kernelbase.dll_CloseHandle]
sub esp, 4
mov dword [esp + 4], ebx
mov dword [esp], edi
call sym._Process32NextW_8
sub esp, 8
test eax, eax
je 0x401e68
mov eax, dword [ebp - 0x230]
mov edx, dword fs:[0x18]
cmp dword [edx + 0x20], eax
je 0x401de2
cmp eax, dword [section..bss]
je 0x401de2
test byte [section..data], 8
je 0x401d90
lea eax, [ebp - 0x214]
call sym._wine_dbgstr_wn.constprop.0
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x230]
mov dword [esp + 0xc], str.killing_process__04lx__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.kill_processes
mov dword [esp + 4], 0x409000
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
mov eax, dword [ebp - 0x230]
jmp 0x401d90
mov dword [esp], edi
call dword [sym.imp.kernelbase.dll_CloseHandle]
sub esp, 4
test esi, esi
jne 0x401d40
lea esi, [esi]
mov eax, dword [section..bss]
test eax, eax
je 0x401e90
mov edx, dword [ebp + 8]
test edx, edx
jne 0x401eae
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call dword [sym.imp.kernelbase.dll_CloseHandle]
sub esp, 4
jmp 0x401e80
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [sym.imp.kernelbase.dll_OpenProcess]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x401e90
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_TerminateProcess]
sub esp, 8
mov dword [esp], ebx
call dword [sym.imp.kernelbase.dll_CloseHandle]
sub esp, 4
jmp 0x401e90

Function at 0x4028e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
leave
ret
Function at 0x402920
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x18
cmp word [ecx], 0
je 0x402978
mov eax, ecx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x402938
sub eax, ecx
add eax, 2
mov dword [esp], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], edx
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov ebx, dword [ebp - 4]
sub esp, 0x18
leave
ret
mov eax, 2
jmp 0x402946

Function at 0x402a50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 4
mov dword [esp], str.Usage:_wineboot__options__n
call sym._wine_dbg_printf
mov dword [esp], str.Options__n
call sym._wine_dbg_printf
mov dword [esp], str._____h___help_________Display_this_help_message_n
call sym._wine_dbg_printf
mov dword [esp], str._____e___end_session__End_the_current_session_cleanly_n
call sym._wine_dbg_printf
mov dword [esp], str._____f___force________Force_exit_for_processes_that_dont_exit_cleanly_n
call sym._wine_dbg_printf
mov dword [esp], str._____i___init_________Perform_initialization_for_first_Wine_instance_n
call sym._wine_dbg_printf
mov dword [esp], str._____k___kill_________Kill_running_processes_without_any_cleanup_n
call sym._wine_dbg_printf
mov dword [esp], str._____r___restart______Restart_only__dont_do_normal_startup_operations_n
call sym._wine_dbg_printf
mov dword [esp], str._____s___shutdown_____Shutdown_only__dont_reboot_n
call sym._wine_dbg_printf
mov dword [esp], str._____u___update_______Update_the_wineprefix_directory_n
call sym._wine_dbg_printf
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_exit]
lea esi, [esi]
Function at 0x402b30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x7c
mov dword [ebp - 0x74], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcslen]
lea eax, [eax + eax + 0x26]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
je 0x402cff
mov esi, eax
xor eax, eax
movzx ecx, word [ebx + eax]
mov word [esi + eax], cx
add eax, 2
test cx, cx
jne 0x402b60
mov dword [esp + 4], str..update_timestamp
mov dword [esp], esi
call sym._lstrcatW_8
mov edi, dword [sym.imp.ucrtbase.dll__wopen]
sub esp, 8
mov dword [esp + 4], 2
mov dword [esp], esi
call edi
mov ebx, eax
cmp eax, 0xffffffff
je 0x402c8e
lea edi, [ebp - 0x70]
mov dword [esp + 8], 0x63
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__read]
test eax, eax
js 0x402c00
mov byte [ebp + eax - 0x70], 0
mov dword [esp + 8], 7
mov dword [esp + 4], str.disable
mov dword [esp], edi
call sym._strncmp
test eax, eax
je 0x402c70
xor edx, edx
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_strtoul]
mov edx, dword [ebp - 0x74]
cmp eax, edx
je 0x402c70
xor ecx, ecx
mov dword [esp], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
call dword [sym.imp.ucrtbase.dll__lseek]
xor eax, eax
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll__chsize]
mov eax, dword [ebp - 0x74]
mov dword [esp + 4], str._lu_n
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf.constprop.0
mov dword [esp + 8], eax
mov dword [ebp - 0x74], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll__write]
mov edx, dword [ebp - 0x74]
cmp edx, eax
je 0x402cf5
test byte [0x40939c], 4
jne 0x402cc1
xor eax, eax
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll__chsize]
xor edi, edi
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll__close]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.ucrtbase.dll__errno]
cmp dword [eax], 2
je 0x402c9d
xor edi, edi
jmp 0x402c7b
mov dword [esp + 8], 0x1b6
mov dword [esp + 4], 0x301
mov dword [esp], esi
call edi
mov ebx, eax
cmp eax, 0xffffffff
je 0x402c99
lea edi, [ebp - 0x70]
jmp 0x402c22
mov eax, esi
call sym._wine_dbgstr_wn.constprop.0_1
mov dword [esp + 0xc], str.failed_to_update_timestamp_in__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.update_timestamp
mov dword [esp + 4], 0x40939c
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_1
jmp 0x402c61
mov edi, 1
jmp 0x402c72
xor edi, edi
jmp 0x402c84
Function at 0x4036c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
xor eax, eax
push ebx
lea ebx, [ebp - 0x270]
mov edi, ebx
lea ebx, [ebp - 0x230]
sub esp, 0x2a8
mov dword [ebp - 0x288], edx
mov edx, ecx
mov ecx, 0x10
rep stosd dword es:[edi], eax
movzx edi, dx
mov dword [ebp - 0x274], 0x44
mov dword [esp + 8], edi
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.kernelbase.dll_GetSystemWow64Directory2W]
sub esp, 0xc
test eax, eax
je 0x4038e0
cmp word [ebp - 0x230], 0
mov edx, ebx
je 0x403739
lea esi, cs:[esi]
nop
add edx, 2
cmp word [edx], 0
jne 0x403730
xor eax, eax
lea esi, cs:[esi]
movzx ecx, word [eax + str._rundll32.exe]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x403740
test byte [0x40939c], 8
jne 0x403878
cmp word [ebp - 0x230], 0
je 0x403908
mov edi, ebx
add edi, 2
cmp word [edi], 0
jne 0x403770
sub edi, ebx
sar edi, 1
lea edx, [edi + 0x31]
cmp word [esi], 0
je 0x40379f
mov eax, esi
lea esi, cs:[esi]
add eax, 2
cmp word [eax], 0
jne 0x403790
sub eax, esi
sar eax, 1
add edx, eax
lea eax, [edx + edx]
mov dword [ebp - 0x28c], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x4038e0
mov dword [esp + 0x14], esi
mov eax, dword [ebp - 0x288]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 8], str._s_setupapi_InstallHinfSection__s_128__s
mov edx, dword [ebp - 0x28c]
mov dword [esp], edi
mov dword [esp + 4], edx
call sym._swprintf
lea eax, [ebp - 0x284]
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x274]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edi
call dword [sym.imp.kernelbase.dll_CreateProcessW]
sub esp, 0x28
test eax, eax
jne 0x403858
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x280]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_CloseHandle]
mov ebx, dword [ebp - 0x284]
sub esp, 4
jmp 0x403841
mov eax, ebx
shr eax, 0x10
je 0x4038f0
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
mov edx, eax
sub esp, 8
mov eax, str._invalid_
test edx, edx
jne 0x4038a5
mov eax, ebx
call sym._wine_dbgstr_wn.part.0.constprop.0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], str.machine__x_starting__s_n
mov dword [esp + 8], str.start_rundll32
mov dword [esp + 4], 0x40939c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_1
jmp 0x403760
lea esp, [ebp - 0xc]
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebx
mov dword [esp], 0x40b228
call sym._wine_dbg_sprintf.constprop.0_1
jmp 0x4038a5
mov edx, 0x31
jmp 0x403780
Function at 0x404150
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x4041a8
cmp byte [esi + ebx - 1], 0xa
je 0x40417c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x4184e4], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x404750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x4184f4]
mov esi, dword [ebp + 8]
test edi, edi
je 0x404910
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x4184f4]
movzx eax, al
bt eax, esi
jae 0x404970
mov ecx, dword [0x4184e4]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x404815
test byte [0x4094c4], 8
jne 0x4048b0
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x4094d4], 8
jne 0x404860
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x4047e4
cmp esi, 3
jbe 0x404820
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4137e0]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x4047e4
mov ecx, dword [0x4184f4]
test ecx, ecx
je 0x404950
mov dword [esp], 0x4094d4
call dword [0x4184f4]
test al, 8
je 0x4047bb
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x4047bb
mov ebx, dword [0x4184f4]
test ebx, ebx
je 0x404930
mov dword [esp], 0x4094c4
call dword [0x4184f4]
test al, 8
je 0x4047a6
call dword [sym.imp.kernelbase.dll_GetTickCount]
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x4047ae
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4184f4
call sym._load_func.part.0
jmp 0x40476d
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4184f4
call sym._load_func.part.0
jmp 0x4048ba
mov ecx, sym._fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x4184f4
call sym._load_func.part.0
jmp 0x40486e
mov eax, 0xffffffff
jmp 0x404815
Function at 0x404b50
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_narrow_argv
call sym.__initialize_narrow_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___argv
mov edi, dword [eax]
call sym.__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._main
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x100fafe0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101f6ae0]
jne 0x100fafea
repz ret
jmp fcn.100fc0bc

Function at 0x100fd2bb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100fa4b3
and dword [ebp - 4], 0
cmp dword [0x101f880c], 0
mov ebx, eax
jne 0x100fd36c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100fd41d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100fd41d
push eax
call fcn.100fa441
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101f880c], eax
call esi
push eax
call fcn.100fa441
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101f8810], eax
call esi
push eax
call fcn.100fa441
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101f8814], eax
call esi
push eax
call fcn.100fa441
pop ecx
mov dword [0x101f881c], eax
test eax, eax
je 0x100fd36c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100fa441
pop ecx
mov dword [0x101f8818], eax
mov eax, dword [0x101f8818]
cmp eax, ebx
je 0x100fd3c4
cmp dword [0x101f881c], ebx
je 0x100fd3c4
push eax
call fcn.100fa4bc
push dword [0x101f881c]
mov esi, eax
call fcn.100fa4bc
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100fd3c4
test edi, edi
je 0x100fd3c4
call esi
test eax, eax
je 0x100fd3bb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100fd3bb
test byte [ebp - 0xc], 1
jne 0x100fd3c4
or dword [ebp + 0x10], 0x200000
jmp 0x100fd3fd
mov eax, dword [0x101f8810]
cmp eax, ebx
je 0x100fd3fd
push eax
call fcn.100fa4bc
pop ecx
test eax, eax
je 0x100fd3fd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100fd3fd
mov eax, dword [0x101f8814]
cmp eax, ebx
je 0x100fd3fd
push eax
call fcn.100fa4bc
pop ecx
test eax, eax
je 0x100fd3fd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101f880c]
call fcn.100fa4bc
pop ecx
test eax, eax
je 0x100fd41d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100fd41f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100fe289
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x30
mov dword [ebp - 0xc], 0
mov dword [0x101f6324], 0x1367
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov esi, dword [0x101f6324]
mov edi, esi
add edi, 0xffffec0a
mov dword [0x101f6324], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
jmp 0x100fe327
mov dword [0x101f6324], 0x2505
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov dx, word [eax + ecx*2 - 0x16]
mov word [ebp - 0x22], dx
xor eax, eax
mov cx, word [ebp - 0x22]
cmp cx, 0x61
mov dword [ebp - 0x28], eax
je 0x100fe3ad
jmp 0x100fe42b
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x28], eax
je 0x100fe417
jmp 0x100fe42b
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], edx
je 0x100fe354
mov eax, dword [ebp - 0x2c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x30], eax
jl 0x100fe327
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov edx, dword [ebp - 0x14]
add edx, 0xfffff5a8
mov dword [0x101f6324], edx
mov edx, dword [ebp - 0x18]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], ecx
jne 0x100fe42b
mov dword [0x101f6324], 0x28f
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov dx, word [eax + ecx*2 - 0x18]
mov word [ebp - 0x32], dx
xor eax, eax
mov cx, word [ebp - 0x32]
cmp cx, 0x6f
mov dword [ebp - 0x28], eax
je 0x100fe2d8
jmp 0x100fe42b
xor eax, eax
mov dword [0x101f6328], 0x870
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x28], eax
jne 0x100fe42b
xor eax, eax
mov dword [0x101f6324], 0x264f
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x28], eax
jne 0x100fe42b
mov dword [0x101f6324], 0x1f9e
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff8
mov dword [ebp - 0x38], eax
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x38]
cmp word [ecx + edx*2], 0x6c
mov dword [ebp - 0x28], eax
je 0x100fe30a
jmp 0x100fe42b
mov dword [0x101f6324], 0x536
mov eax, 1
mov dword [ebp - 0x28], eax
jmp 0x100fe42b
mov eax, dword [ebp - 0x28]
add esp, 0x30
pop esi
pop edi
pop ebp
ret
Function at 0x100fe6a4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101f6330], 0
mov byte [0x101f6334], 0
mov dword [0x101f6328], 0x247e
mov dword [0x101f632c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x100fe7de
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x101f6338], 0
mov edx, dword [0x101f6324]
mov esi, edx
add esi, 0xffffd965
mov dword [0x101f6328], esi
mov esi, dword [0x101f6330]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + eax]
add ebx, esi
mov dword [ebp - 0x24], eax
xor esi, esi
mov dword [ebp - 0x28], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add ebx, edx
mov dword [0x101f6338], ebx
mov dword [0x101f6328], 0x162a
mov eax, ebx
cdq
idiv ecx
mov dword [0x101f6330], edx
mov ecx, dword [ebp - 0x28]
add ecx, 0x26f4
mov dword [0x101f6324], ecx
mov ecx, dword [ebp - 0x24]
mov cl, byte [edi + ecx]
mov byte [0x101f6334], cl
mov dword [0x101f6324], 0x8fc
mov cl, byte [edi + edx]
mov edx, dword [ebp - 0x24]
mov byte [edi + edx], cl
mov dword [0x101f6324], 0x721
mov cl, byte [0x101f6334]
mov ebx, dword [0x101f6330]
mov byte [edi + ebx], cl
mov dword [0x101f6328], 0x15d4
mov ebx, dword [0x101f632c]
add ebx, 1
mov dword [0x101f632c], ebx
cmp ebx, 0x100
mov dword [ebp - 0x20], ebx
jl 0x100fe6ee
jmp 0x100fe806
mov dword [0x101f632c], 0
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x100fe6ee
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101f632c]
add eax, 1
mov dword [0x101f632c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x100fe7de
jmp 0x100fe7ca
mov dword [0x101f6324], 0x71f
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret