joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d133c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409edc
xor eax, eax
push ebp
push 0x4d13ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x104
call fcn.00406f20
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0x104
xor eax, eax
push ebp
push 0x4d13c6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_GetUserNameA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov ecx, 0
call fcn.0040a4c4
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.0040a72c
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d13cd
mov eax, dword [ebp - 0xc]
call fcn.00406f54
pop eax
jmp eax

Function at 0x4d1460
Capabilities:
Reference the vmware io port

Disassembly:
xor eax, eax
push 0x4d1488
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x564d5868
mov ebx, 0x3c6cf712
mov ecx, 0xa
mov dx, 0x5658
in eax, dx
mov eax, 1
jmp 0x4d149b
xor ebx, ebx
pop dword fs:[ebx]
add esp, 4
ret

Function at 0x4d14a4
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ecx, 0x4d14ee
mov ebp, esp
push ebx
push ecx
push dword fs:[0]
mov dword fs:[0], esp
mov ebx, 0
mov eax, 1
invalid
Function at 0x4d1ac8
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409edc
xor eax, eax
push ebp
push 0x4d1c05
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 4]
call fcn.0040ac4c
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00420488
mov eax, dword [ebp - 0x28]
mov ecx, 1
mov edx, eax
mov eax, 0x4d1c24
call fcn.0040aff4
test eax, eax
jne 0x4d1b36
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4d1c40
call fcn.0040a5e0
mov byte [ebp - 5], 0
push 0
push 0
push 0
push 0
push 0x4d1c48
call sub.wininet.dll_InternetOpenW
mov ebx, eax
test ebx, ebx
je 0x4d1be0
push 0
push 0x80000000
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a7ac
push eax
push ebx
call sub.wininet.dll_InternetOpenUrlA
mov esi, eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0xa
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x13
push esi
call sub.wininet.dll_HttpQueryInfoW
lea edi, [ebp - 0x24]
lea eax, [ebp - 0x30]
mov edx, edi
call fcn.0040abc4
mov eax, dword [ebp - 0x30]
mov edx, 0x4d1c70
call fcn.0040af18
je 0x4d1bcb
lea eax, [ebp - 0x34]
mov edx, edi
call fcn.0040abc4
mov eax, dword [ebp - 0x34]
mov edx, 0x4d1c84
call fcn.0040af18
je 0x4d1bcb
xor eax, eax
jmp 0x4d1bcd
mov al, 1
mov byte [ebp - 5], al
test esi, esi
je 0x4d1bda
push esi
call sub.wininet.dll_InternetCloseHandle
push ebx
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d1c0c
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.00409e38
lea eax, [ebp - 4]
call fcn.00409dfc
pop eax
jmp eax

Function at 0x4d1da8
Capabilities:
Query service status

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
xor esi, esi
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jbe 0x4d1e07
mov esi, 1
push 4
mov eax, dword [0x4e597c]
call fcn.0040ab94
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov edi, eax
test edi, edi
jbe 0x4d1e01
mov esi, 2
push esp
push edi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4d1dfb
cmp dword [esp + 4], 4
jne 0x4d1dfb
mov esi, 3
push edi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
mov eax, esi
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x4d1e10
Capabilities:
Query service status
Start service

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe0
xor ebx, ebx
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov edi, eax
test edi, edi
je 0x4d1e78
push 0x14
mov eax, dword [0x4e597c]
call fcn.0040ab94
push eax
push edi
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
je 0x4d1e72
lea eax, [esp + 4]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4d1e58
cmp dword [esp + 8], 4
je 0x4d1e6c
xor eax, eax
mov dword [esp], eax
push esp
push 0
push esi
call sub.advapi32.dll_StartServiceW
test eax, eax
je 0x4d1e6c
mov bl, 1
push esi
call sub.advapi32.dll_CloseServiceHandle
push edi
call sub.advapi32.dll_CloseServiceHandle
mov eax, ebx
add esp, 0x20
pop edi
pop esi
pop ebx
ret

Function at 0x4d1e84
Capabilities:
Query service status
Stop service

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
xor ebx, ebx
push 1
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov edi, eax
test edi, edi
je 0x4d1ee3
push 0x24
mov eax, dword [0x4e597c]
call fcn.0040ab94
push eax
push edi
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
je 0x4d1edd
push esp
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x4d1ec8
cmp dword [esp + 4], 1
je 0x4d1ed7
push esp
push 1
push esi
call sub.advapi32.dll_ControlService
test eax, eax
je 0x4d1ed7
mov bl, 1
push esi
call sub.advapi32.dll_CloseServiceHandle
push edi
call sub.advapi32.dll_CloseServiceHandle
mov eax, ebx
add esp, 0x1c
pop edi
pop esi
pop ebx
ret
Function at 0x4d4164
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x420], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4d418d
xor edx, edx
mov dword [eax], edx
xor eax, eax
push ebp
push 0x4d42f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00409dd8
xor ebx, ebx
lea eax, [ebp - 0x417]
xor ecx, ecx
mov edx, 0x412
call fcn.004077fc
movzx eax, si
cmp eax, 0x23
jg 0x4d41dd
je 0x4d420a
sub eax, 5
je 0x4d4240
sub eax, 0x15
je 0x4d425b
sub eax, 2
je 0x4d4276
jmp 0x4d42d1
sub eax, 0x26
je 0x4d41ec
sub eax, 8
je 0x4d4225
jmp 0x4d42d1
lea eax, [ebp - 0x417]
push eax
push 0
push 0
push 0x26
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
sete bl
jmp 0x4d428f
lea eax, [ebp - 0x417]
push eax
push 0
push 0
push 0x23
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
sete bl
jmp 0x4d428f
lea eax, [ebp - 0x417]
push eax
push 0
push 0
push 0x2e
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
sete bl
jmp 0x4d428f
lea eax, [ebp - 0x417]
push eax
push 0
push 0
push 5
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
sete bl
jmp 0x4d428f
lea eax, [ebp - 0x417]
push eax
push 0
push 0
push 0x1a
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
sete bl
jmp 0x4d428f
lea eax, [ebp - 0x417]
push eax
push 0
push 0
push 0x1c
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
sete bl
test bl, bl
je 0x4d42d1
lea eax, [ebp - 0x420]
lea edx, [ebp - 0x417]
call fcn.0040abf4
mov eax, dword [ebp - 0x420]
lea edx, [ebp - 0x41c]
call fcn.00428f60
mov edx, dword [ebp - 0x41c]
mov eax, dword [ebp - 4]
call fcn.0040a1c8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dl, 1
call fcn.00421844
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d42f8
lea eax, [ebp - 0x420]
mov edx, 2
call fcn.00409e38
pop eax
jmp eax
Function at 0x4d4520
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7c4
push ebx
xor ecx, ecx
mov dword [ebp - 0x838], ecx
mov dword [ebp - 0x83c], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00409ecc
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4d4554
xor edx, edx
mov dword [eax], edx
xor eax, eax
push ebp
push 0x4d463c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00409dd8
mov ebx, 0x825
lea eax, [ebp - 0x831]
xor ecx, ecx
mov edx, ebx
call fcn.004077fc
push 0x4d4658
push dword [ebp - 4]
push 0x4d4658
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040ae68
sar ebx, 1
jns 0x4d459f
adc ebx, 0
dec ebx
push ebx
lea eax, [ebp - 0x831]
push eax
mov eax, dword [ebp - 8]
call fcn.0040ab94
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
setne al
mov ebx, eax
test bl, bl
je 0x4d460f
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x831]
call fcn.0040abf4
lea edx, [ebp - 0x838]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00420438
mov eax, dword [ebp - 0x838]
push eax
lea edx, [ebp - 0x83c]
mov eax, dword [ebp - 8]
call fcn.00420438
mov edx, dword [ebp - 0x83c]
pop eax
call fcn.0040af18
setne bl
test bl, bl
jne 0x4d460f
mov eax, dword [ebp - 0xc]
call fcn.00409dd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4643
lea eax, [ebp - 0x83c]
mov edx, 2
call fcn.00409e38
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409e38
pop eax
jmp eax

Function at 0x4d47dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00409ecc
mov eax, dword [ebp + 8]
test eax, eax
je 0x4d480a
xor edx, edx
mov dword [eax], edx
xor eax, eax
push ebp
push 0x4d48e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00409dd8
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0x413
lea eax, [ebp - 0x423]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.004077fc
mov esi, 0x4d48f8
cmp dword [ebp - 4], 0
je 0x4d4853
mov eax, dword [ebp - 4]
call fcn.0040ab94
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x428]
mov edx, edi
call fcn.0040ac4c
mov eax, dword [ebp - 0x428]
call fcn.0040ab94
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
sete bl
test bl, bl
je 0x4d48c1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x423]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete bl
test bl, bl
je 0x4d48b8
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x423]
call fcn.0040abf4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d48eb
lea eax, [ebp - 0x428]
call fcn.00409dd8
lea eax, [ebp - 4]
call fcn.00409dd8
pop eax
jmp eax
Function at 0x4d48fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00409ecc
mov eax, dword [ebp + 8]
test eax, eax
je 0x4d492a
xor edx, edx
mov dword [eax], edx
xor eax, eax
push ebp
push 0x4d4a04
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00409dd8
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0x413
lea eax, [ebp - 0x423]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.004077fc
mov esi, 0x4d4a18
cmp dword [ebp - 4], 0
je 0x4d4973
mov eax, dword [ebp - 4]
call fcn.0040ab94
mov esi, eax
lea eax, [ebp - 8]
push eax
push 0x20119
push 0
lea eax, [ebp - 0x428]
mov edx, edi
call fcn.0040ac4c
mov eax, dword [ebp - 0x428]
call fcn.0040ab94
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
sete bl
test bl, bl
je 0x4d49e1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x423]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete bl
test bl, bl
je 0x4d49d8
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x423]
call fcn.0040abf4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4a0b
lea eax, [ebp - 0x428]
call fcn.00409dd8
lea eax, [ebp - 4]
call fcn.00409dd8
pop eax
jmp eax
Function at 0x4d9888
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov eax, dword [ebp + 8]
call fcn.00409edc
xor eax, eax
push ebp
push 0x4d98e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 4]
mov edx, dword [ebp + 8]
call fcn.0040ac4c
mov eax, dword [ebp - 4]
call fcn.0040ab94
push eax
call sub.kernel32.dll_SetFileAttributesW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d98ee
lea eax, [ebp - 4]
call fcn.00409dd8
lea eax, [ebp + 8]
call fcn.00409dfc
pop eax
jmp eax
Function at 0x1010f2c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0xffffffff
mov esi, dword [0x10119928]
add esi, 0x2dd
mov dword [0x1011992c], esi
mov dword [0x10119928], 0xc52
cmp ecx, 0
sete bl
cmp eax, 0
sete bh
and bl, bh
test bl, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jne 0x1010f4f4
jmp 0x1010f37d
mov eax, 0x12b
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jmp 0x1010f3e9
mov eax, dword [ebp - 0x1c]
mov cx, word [eax + 0x24]
mov dword [0x10119928], 0x2324
mov edx, dword [eax + 0x28]
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x25]
and bh, bl
test bh, 1
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x2e], cx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], esi
jne 0x1010f40a
jmp 0x1010f41a
mov dword [0x10119928], 0x13a9
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x1010f4f4
mov dword [0x1011992c], 0xffffdbfd
mov dword [0x10119928], 0xffffdfef
mov ecx, dword fs:[0x18]
mov eax, 0xa0f
mov dword [0x10119928], 0x2178
mov edx, dword [0x1011992c]
add edx, 0xffffdf4b
mov dword [0x10119928], edx
mov ecx, dword [ecx + 0x30]
mov dword [0x10119928], 0x147e
mov ecx, dword [ecx + 0xc]
add ecx, 0x14
mov edx, dword [ebp - 0x10]
cmp edx, 0
setne bl
mov esi, ecx
mov byte [ebp - 0x25], bl
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov dword [0x1011992c], ecx
mov eax, dword [eax]
mov ecx, dword [ebp - 0x3c]
cmp eax, ecx
mov dword [ebp - 0x1c], eax
je 0x1010f369
jmp 0x1010f32a
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff8
mov dword [ebp - 0x18], eax
jmp 0x1010f4f4
mov dword [0x10119928], 0x511
mov ax, word [ebp - 0x2e]
shr ax, 1
movzx ecx, ax
cmp ax, 0
mov dword [ebp - 0x40], ecx
je 0x1010f317
xor eax, eax
mov dword [ebp - 0x44], eax
jmp 0x1010f443
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x34]
mov dx, word [ecx + eax*2]
mov si, dx
add si, 0xffbf
mov di, dx
add di, 0x20
cmp si, 0x1a
mov dword [ebp - 0x48], eax
mov word [ebp - 0x4a], dx
mov word [ebp - 0x4c], di
jb 0x1010f477
mov ax, word [ebp - 0x4a]
mov word [ebp - 0x4c], ax
mov ax, word [ebp - 0x4c]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x48]
cmp word [ecx + edx*2], ax
sete bl
cmp ax, 0
sete bh
mov al, bl
xor al, 1
or bh, al
test bh, 1
mov al, bl
mov byte [ebp - 0x4d], bl
mov byte [ebp - 0x4e], al
jne 0x1010f4c8
mov dword [0x1011992c], 0x12aa
mov eax, dword [ebp - 0x48]
add eax, 1
mov ecx, dword [ebp - 0x40]
cmp eax, ecx
mov dl, byte [ebp - 0x4d]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x4e], dl
jb 0x1010f443
mov al, byte [ebp - 0x4e]
mov dword [0x10119928], 0x1d6a
test al, 1
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x54], ecx
jne 0x1010f4e4
jmp 0x1010f317
mov eax, dword [ebp - 0x54]
mov dword [0x10119928], 0xc0f
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1010f920
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [0x10119928]
add esi, 0xffffdec1
mov dword [0x1011992c], esi
mov dword [0x10119934], 0
mov byte [0x10119938], 0
mov dword [0x10119928], 0x1a
mov dword [0x10119930], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x1010f979
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1011992c]
add eax, 0xfffff269
mov dword [0x10119928], eax
mov eax, dword [0x10119930]
add eax, 1
mov dword [0x10119930], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1010f979
xor eax, eax
mov dword [0x10119928], 0x1c79
mov dword [0x10119930], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x1011993c], 0
mov dword [0x10119928], 0x1497
mov edx, dword [0x10119934]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x1011993c], edi
mov eax, edi
cdq
idiv ecx
mov dword [0x10119934], edx
mov dword [0x10119928], 0x1e26
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x10119938], cl
mov dword [0x10119928], 0x9ab
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x10119938]
mov edx, dword [0x10119934]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x10119928]
add edx, 0x1871
mov dword [0x1011992c], edx
mov dword [0x10119928], 0x1c53
mov edx, dword [0x10119930]
add edx, 1
mov dword [0x10119930], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x1010f9c7
mov dword [0x1011992c], 0x1ee0
mov dword [0x10119928], 0x1809
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1010fb30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [0x1011992c]
mov dword [0x10119930], 0
mov dword [0x10119934], 0
mov dword [0x10119940], 0
mov dword [0x1011992c], 0x20f1
add edi, 0xffffec51
mov dword [0x10119928], edi
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
je 0x1010fcee
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
jmp 0x1010fbaa
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
mov edi, edx
add edi, 1
add eax, 1
mov dword [0x10119928], 0x2192
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x10119930], edx
mov ebx, dword [ebp - 0x1c]
movzx ebx, byte [ebx + edx]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x10119934], edx
mov dword [0x1011992c], 0x1491
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x10119938], cl
mov dword [0x10119928], 0x246a
mov ebx, dword [ebp - 0x1c]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov dword [0x1011992c], 0x211
mov cl, byte [0x10119938]
mov edx, dword [0x10119934]
mov byte [ebx + edx], cl
mov dword [0x10119928], 0x38
mov edx, dword [0x10119930]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x10119934]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x10119940], ecx
mov dword [0x1011992c], 0xffffd934
mov dword [0x10119928], 0xcc1
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov dl, cl
add dl, byte [0x10119945]
mov byte [0x10119944], dl
mov byte [0x10119945], ch
mov dword [0x1011992c], 0x1552
mov byte [0x10119946], cl
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], ch
mov dword [0x10119928], 0x2441
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x38], edi
je 0x1010fce4
mov eax, dword [0x10119930]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x10119934]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], edx
jmp 0x1010fbaa
mov eax, 0x2441
mov dword [ebp - 0x20], eax
jmp 0x1010fcee
mov eax, dword [ebp - 0x20]
add eax, 0x4ac
mov dword [0x10119928], eax
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10110680
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x28
mov dword [ebp - 8], 0
mov eax, dword [0x10119928]
add eax, 0x1d8a
mov dword [0x10119928], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov edx, dword [edx + 0x3c]
mov dword [0x1011992c], 0xf1d
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, 0xf7d
mov edx, dword [ebp - 0x14]
cmp word [edx + eax*2], 0
mov esi, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], esi
je 0x1011070e
mov eax, 0x1762
mov ecx, dword [ebp - 0x1c]
add ecx, 1
cmp ecx, 0x104
mov edx, ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jl 0x101106cf
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov dword [0x10119928], ecx
mov dword [0x1011992c], 0x24b0
mov ecx, dword [ebp - 0x14]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x28], eax
jne 0x101107d9
mov dword [0x1011992c], 0x804
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x101107d9
mov dword [0x10119928], 0x264e
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x101107d9
mov dword [0x10119928], 0x15d7
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x101107d9
mov dword [0x10119928], 0x18ec
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x101107d9
mov dword [0x1011992c], 0x11d9
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x101107d9
mov eax, 1
mov dword [0x10119928], 0xde9
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x2c], eax
je 0x101107ea
mov dword [0x10119928], 0x9ef
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x101107ea
mov eax, dword [ebp - 0x2c]
add esp, 0x28
pop esi
pop ebp
ret