joyce8/EMBER2024-capa huggingface dataset:
Function at 0x907080
Capabilities:
Get common file path

Disassembly:
sub esp, 0x43c
push esi
mov esi, dword [esp + 0x444]
cmp word [esi + 2], 0x3a
je 0x9070c4
lea eax, [esp + 0x30]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [esp + 0x30]
push 0x92c458
push ecx
call fcn.009171e1
lea edx, [esp + 0x38]
push esi
push edx
call fcn.009171e1
add esp, 0x10
jmp 0x9070d2
lea eax, [esp + 0x30]
push esi
push eax
call fcn.0091720b
add esp, 8
lea ecx, [esp + 0x30]
lea edx, [esp + 0x238]
push ecx
push str.___s
push edx
call fcn.00916dff
lea eax, [esp + 0x244]
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.00907050
mov eax, dword [0x931728]
xor esi, esi
add esp, 0x14
lea edx, [esp + 0x20]
cmp eax, esi
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x40
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
jne 0x90713b
push esi
call fcn.00906fb0
add esp, 4
mov dword [0x931728], eax
mov ecx, dword [esp + 0x454]
cmp ecx, 3
jne 0x90714c
mov ecx, 1
mov edx, dword [esp + 0x458]
push esi
push esi
push 0x20
push ecx
mov ecx, dword [esp + 0x45c]
push ecx
push edx
lea ecx, [esp + 0x40]
push esi
push ecx
mov ecx, dword [esp + 0x468]
lea edx, [esp + 0x28]
or ecx, 0x100000
push edx
lea edx, [esp + 0x28]
push ecx
push edx
push eax
call fcn.00906ff0
mov ecx, dword [esp + 0x34]
add esp, 0x30
neg eax
sbb eax, eax
pop esi
not eax
and eax, ecx
add esp, 0x43c
ret

Function at 0x90a440
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [ecx + 0x88]
test ebx, ebx
je 0x90a4b7
push esi
xor eax, eax
mov ax, word [ecx + 0x14]
xor esi, esi
mov si, word [ecx + 6]
push edi
xor edi, edi
lea eax, [eax + ecx + 0x18]
test esi, esi
jbe 0x90a48e
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x90a471
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x90a47e
add edx, ecx
cmp ebx, edx
jb 0x90a48a
inc edi
add eax, 0x28
cmp edi, esi
jb 0x90a467
xor ecx, ecx
jmp 0x90a4a2
test eax, eax
jne 0x90a492
xor ecx, ecx
jmp 0x90a4a2
mov ecx, dword [eax + 0x14]
mov esi, dword [eax + 0xc]
mov eax, dword [esp + 0x10]
sub ecx, esi
add ecx, ebx
add ecx, eax
mov edx, dword [esp + 0x18]
push edx
push 0
push 0
push ecx
push ecx
call fcn.0090a3c0
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x90a8f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x90a921
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 2
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebp, eax
test ebp, ebp
jne 0x90a946
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push 0
push 0
push 4
push ebp
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x90a96e
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x18]
mov dword [ecx], esi
mov dword [ecx + 4], eax
cmp word [esi], 0x5a4d
jne 0x90a993
push ecx
push esi
call fcn.0090a4c0
add esp, 8
mov bl, al
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push edi
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
ret
Function at 0x911e00
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x9278f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov ecx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x24]
lea eax, [esp + 4]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push esi
push ecx
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x911ed2
lea edx, [esp + 0x24]
push eax
push edx
call fcn.0090e7a0
add esp, 8
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0x911e61
mov edx, dword [eax]
jmp 0x911e63
xor edx, edx
xor ecx, ecx
push edi
xor eax, eax
push edx
push ecx
mov ecx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov edx, dword [ecx + 4]
push eax
push esi
push 2
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call fcn.00910050
mov eax, dword [esp + 0x44]
add esp, 0x20
cmp eax, edi
mov dword [esp + 0x1c], 0xffffffff
je 0x911ebf
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x911ebf
cmp esi, edi
je 0x911ebf
mov ecx, esi
call fcn.00909a00
push esi
call fcn.009171c8
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
push edi
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.0090e990
add esp, 0xc
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 1
cmp eax, edi
je 0x911ef5
mov eax, dword [eax]
jmp 0x911ef7
xor eax, eax
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x2c]
push ebx
push esi
push eax
push ecx
push edx
call fcn.0090d640
add esp, 0x10
mov bl, al
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
cmp eax, edi
je 0x911f25
mov eax, dword [eax]
jmp 0x911f27
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
cmp esi, edi
je 0x911f76
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x911f76
cmp esi, edi
je 0x911f76
mov eax, dword [esi]
cmp eax, edi
je 0x911f5d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, edi
je 0x911f6d
push eax
call fcn.009171c8
add esp, 4
push esi
call fcn.009171c8
add esp, 4
mov ecx, dword [esp + 0x18]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x912f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x9279fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x913002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00916dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x913002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.0090e6e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.0091720b
push 0x10
call fcn.009171d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x912fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.009031c0
jmp 0x912fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00912b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x912ff0
mov ecx, edi
call fcn.009032c0
push edi
call fcn.009171c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x913021
inc ebx
cmp ebx, 0x20
jb 0x912f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x915000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x915131
push esi
call fcn.00918145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00907080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x915131
push 0
push ebp
call fcn.009073a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00907260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x91508b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.009072f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x915121
push 0x92d918
push edi
call fcn.009163f0
push eax
push ebx
push esi
call fcn.00914f60
push 0x92d8f8
push edi
call fcn.009163f0
push eax
push ebx
push esi
call fcn.00914f60
push 0x92d8d8
push edi
call fcn.009163f0
push eax
push ebx
push esi
call fcn.00914f60
push 0x92d8c0
push edi
call fcn.009163f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00914f60
push 0x92d8a0
push edi
call fcn.009163f0
push eax
push ebx
push esi
call fcn.00914f60
push 0x92d888
push edi
call fcn.009163f0
push eax
push ebx
push esi
call fcn.00914f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x196c247c
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x4e2d5012
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x100022ea
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
imul eax, dword [0x10028344], 0xe7bbeb39
push ebx
push esi
push edi
mov esi, eax
mov dword [ebp - 4], eax
or esi, 0xcf0b9b0f
push 0x73
mov edx, str.sync_0x__model_type_READING_LIST
mov ecx, 0x1fbf
pop edi
mov eax, edx
mov ebx, edi
add ecx, ebx
lea eax, [eax + 2]
cmp ecx, 0x934
ja 0x1000232d
movzx ebx, word [eax]
test ebx, ebx
jne 0x10002317
jmp 0x10002333
and esi, 0x10c91470
mov ebx, dword [ebp - 4]
mov ecx, 0x1458
imul eax, ebx, 0x634ed739
add ecx, edi
lea edx, [edx + 2]
cmp ecx, 0x8f8
ja 0x10002357
movzx edi, word [edx]
test edi, edi
jne 0x10002341
jmp 0x1000235e
mov eax, ebx
or eax, 0x1db58b02
or eax, 0x3ef075dc
mov dword [0x10028178], eax
movzx edx, byte [str.._AVFilterWithInputQueue_CryptoPP__]
mov ecx, eax
and ecx, 0x3979ea5d
mov edi, 0x1086
mov ebx, str.._AVFilterWithInputQueue_CryptoPP__
jmp 0x10002391
add edi, edx
inc ebx
cmp edi, 0x84e
ja 0x10002397
movzx edx, byte [ebx]
test edx, edx
jne 0x10002383
jmp 0x1000239f
mov ecx, esi
or ecx, 0x5a08db80
xor edx, edx
inc edx
cmp edx, 0xf64
jl 0x100023b5
cmp byte [edx + str.arrow_nw_hollow], 0
jne 0x100023a1
jmp 0x100023c0
lea eax, [ecx - 0x6e220149]
mov dword [0x10028178], eax
imul eax, eax, 0xb8980182
mov dword [0x10028230], eax
xor ecx, 0xf54d1a32
lea esi, [eax - 0x71bfdddf]
mov dword [0x10028174], ecx
mov edx, str.arrow_nw_hollow
imul ecx, eax, 0x93aa6140
mov al, 0x61
mov dword [0x10028344], esi
mov dword [0x10028190], ecx
sub al, 0x30
cmp al, 9
ja 0x10002405
inc edx
mov al, byte [edx]
test al, al
jne 0x100023f6
jmp 0x10002410
imul eax, esi, 0xbfb00b3d
mov dword [0x10028178], eax
pop edi
xor ecx, 0xbfd3fabf
and ecx, 0xd2fe9d42
pop esi
mov dword [0x1002829c], ecx
pop ebx
leave
ret
Function at 0x100057d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov edx, dword [0x1002814c]
push esi
xor esi, esi
mov dword [ebp - 0x14], 0x5f
mov dword [ebp - 0x10], 0x2e
mov eax, esi
mov dword [ebp - 0xc], 0x55
mov dword [ebp - 8], 0x3a
mov dword [ebp - 4], 0xfffffee4
sub esi, dword [ebp + eax*4 - 0x14]
xor edx, 0xc4dce063
inc eax
cmp eax, 5
jl 0x10005808
mov dword [0x1002814c], edx
jmp 0x10005835
movzx edx, word [ecx + esi*2]
lea eax, [edx - 0x41]
cmp ax, 0x19
ja 0x10005834
lea eax, [edx + 0x20]
mov word [ecx + esi*2], ax
inc esi
call fcn.1001484c
cmp esi, eax
jb 0x10005820
pop esi
leave
ret
Function at 0x10007389
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov al, byte [str.chevron_up_hollow]
push ebx
push esi
push edi
movzx edi, al
imul ecx, dword [0x10028604], 0xfcbf305e
mov esi, str.chevron_up_hollow
mov edx, 0x504
mov ebx, esi
test al, al
je 0x100073cb
imul edx, edx, 0x4001
inc ebx
add edx, edi
cmp edx, 0xe
ja 0x100073c5
movzx edi, byte [ebx]
test edi, edi
jne 0x100073ae
jmp 0x100073cb
imul ecx, ecx, 0x35b209d9
imul edx, ecx, 0x39532d0e
or ecx, 0x7f6cb60b
jmp 0x100073e2
sub al, 0x30
cmp al, 9
ja 0x100073e8
inc esi
mov al, byte [esi]
test al, al
jne 0x100073d9
jmp 0x100073f0
mov edx, ecx
xor edx, 0xe5a9a076
add edx, 0xb13bd845
movzx eax, byte [str.SSL___Hardware_acceleration_function_returned_with_error]
mov ecx, 0x23e4
mov esi, str.SSL___Hardware_acceleration_function_returned_with_error
jmp 0x10007417
add ecx, eax
inc esi
cmp ecx, 0x26c2
ja 0x1000741d
movzx eax, byte [esi]
test eax, eax
jne 0x10007409
jmp 0x10007423
imul edx, edx, 0x78f7414a
mov eax, edx
sub edx, 0x3ee0b0c5
or eax, 0xccc15a6f
mov dword [0x10028518], edx
imul ecx, eax, 0x65b66141
pop edi
lea eax, [edx + 0x1bfeaba2]
pop esi
mov dword [0x10028604], eax
mov dword [0x100285f8], ecx
or ecx, 0xfcf9350b
mov dword [0x10028608], ecx
pop ebx
ret
Function at 0x10008dc1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
movzx eax, byte [str.FileKey6_AppData_RealRealPlayerRealPlayer_log.txt]
mov edx, 0xcb3
mov esi, str.FileKey6_AppData_RealRealPlayerRealPlayer_log.txt
jmp 0x10008de3
add edx, eax
inc esi
cmp edx, 0x1fe3
ja 0x10008de9
movzx eax, byte [esi]
test eax, eax
jne 0x10008dd5
jmp 0x10008df5
mov eax, ecx
and eax, 0x3d572a0a
mov dword [0x10028690], eax
movzx eax, byte [str.6i_SNF1dFr2KiMJrdw1VzYoqDvoByLTt_w]
mov edx, 0x25a5
mov esi, str.6i_SNF1dFr2KiMJrdw1VzYoqDvoByLTt_w
jmp 0x10008e16
add edx, eax
inc esi
cmp edx, 0xa36
ja 0x10008e1c
movzx eax, byte [esi]
test eax, eax
jne 0x10008e08
jmp 0x10008e27
lea eax, [ecx - 0x216808c9]
mov dword [0x10028690], eax
mov eax, ecx
xor eax, 0xb816bcab
mov dword [0x100289c8], eax
push 0x2e
mov edx, str.._AV__CDoubleBufferImpl_VCPerformanceOptimizerCtrl___WTL__
pop esi
lea eax, [esi - 0x30]
cmp ax, 9
ja 0x10008e53
add edx, 2
movzx eax, word [edx]
mov esi, eax
test ax, ax
jne 0x10008e3b
jmp 0x10008e5e
lea eax, [ecx + 0x7491e1d2]
mov dword [0x10028690], eax
mov eax, ecx
and ecx, 0x8af92704
or eax, 0x2a72a2cf
mov dword [0x10028a1c], ecx
mov dword [0x1002874c], eax
pop esi
ret
Function at 0x10014998
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 7
xor eax, eax
mov dword [ebp - 0x10], 0x50
mov ebx, ecx
mov dword [ebp - 0xc], 0x46
mov ecx, dword [0x10029ac8]
mov esi, eax
pop edi
mov dword [ebp - 8], 0x58
mov dword [ebp - 4], 0xffffff18
sub edi, dword [ebp + esi*4 - 0x10]
xor ecx, 0xe9467096
inc esi
cmp esi, 4
jl 0x100149cc
push 0x42
mov dword [0x10029ac8], ecx
pop ecx
mov dword [ebp - 0xc], 0x29
mov dword [ebp - 8], 0x25
mov dword [ebp - 4], 0xffffff71
add ecx, dword [ebp + eax*4 - 0xc]
inc eax
cmp eax, 3
jl 0x100149fa
sub ebx, edx
movzx esi, word [edx]
movzx eax, word [ebx + edx]
lea edx, [edx + 2]
test si, si
je 0x10014a24
cmp ax, si
je 0x10014a06
neg edi
cmp ax, si
cmovb ecx, edi
mov eax, ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100159fd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [0x10029e00]
or edi, 0x7922e5c4
mov cl, byte [edx]
mov esi, edx
mov eax, dword [0x10029edc]
mov byte [ebp - 1], cl
jmp 0x10015a2a
sub cl, 0x30
cmp cl, 9
ja 0x10015a30
inc esi
mov cl, byte [esi]
test cl, cl
jne 0x10015a1f
jmp 0x10015a36
lea edi, [eax - 0x3357b67e]
mov cl, byte [str.Out_of_file_descriptors]
mov esi, str.Out_of_file_descriptors
mov dword [ebp - 0xc], esi
jmp 0x10015a57
sub cl, 0x30
cmp cl, 9
ja 0x10015a5d
mov ecx, dword [ebp - 0xc]
inc ecx
mov dword [ebp - 0xc], ecx
mov cl, byte [ecx]
test cl, cl
jne 0x10015a46
jmp 0x10015a62
or eax, 0x9ca4322
movzx ecx, byte [str.PCHealthProblems]
mov dword [ebp - 8], 0x15e
mov dword [ebp - 0xc], str.PCHealthProblems
jmp 0x10015a8e
add dword [ebp - 8], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 8], 0x223
ja 0x10015a94
mov ecx, dword [ebp - 0xc]
movzx ecx, byte [ecx]
test ecx, ecx
jne 0x10015a79
jmp 0x10015a99
and eax, 0x4c94cdd4
imul ecx, edi, 0x788d2175
mov dword [ebp - 0xc], ecx
movsx ecx, byte [ebp - 1]
and eax, 0x4040a01
mov edi, 0x1124
jmp 0x10015ac0
add edi, ecx
inc edx
cmp edi, 0x2096
ja 0x10015aff
movsx ecx, byte [edx]
test ecx, ecx
jne 0x10015ab2
mov eax, dword [ebp - 0xc]
or eax, 0x738d36ac
imul eax, eax, 0xa96e26e8
imul edx, eax, 0xc7f9f770
mov ecx, 0x1a55
mov eax, edx
mov dword [0x10029f2c], edx
xor eax, 0xeb7db62e
imul edi, eax, 0xe5b7bd79
movzx eax, byte [str.Out_of_file_descriptors]
mov dword [0x10029cd8], edi
jmp 0x10015b14
add eax, 0x8f1e45ff
jmp 0x10015ac7
add ecx, eax
inc esi
cmp ecx, 0x2600
ja 0x10015b1a
movzx eax, byte [esi]
test eax, eax
jne 0x10015b06
jmp 0x10015b26
imul ecx, edi, 0x166f83f2
mov dword [0x10029cd8], ecx
lea ecx, [edx + 0x58d3b65f]
mov dword [0x10029edc], ecx
xor ecx, 0xad7219a
mov eax, edx
pop edi
mov dword [0x10029e00], ecx
pop esi
leave
ret
Function at 0x10018b11
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], edx
mov edx, dword [ebp + 8]
mov ebx, esi
mov dword [ebp - 8], ecx
mov ecx, esi
push edi
mov eax, ecx
mov byte [ebp + ecx - 0x108], cl
and eax, 0x1f
mov al, byte [eax + edx]
mov byte [ebp + ecx - 0x208], al
inc ecx
cmp ecx, 0x100
jl 0x10018b2c
mov edi, esi
mov dl, byte [ebp + edi - 0x108]
movzx eax, byte [ebp + edi - 0x208]
add ebx, eax
movzx ecx, dl
add ebx, ecx
and ebx, 0x800000ff
jns 0x10018b73
dec ebx
or ebx, 0xffffff00
inc ebx
mov al, byte [ebp + ebx - 0x108]
mov byte [ebp + ebx - 0x108], dl
mov byte [ebp + edi - 0x108], al
inc edi
cmp edi, 0x100
jl 0x10018b4d
mov edi, esi
cmp dword [ebp - 4], esi
jle 0x10018c05
mov ebx, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
sub ebx, edx
inc esi
and esi, 0x800000ff
jns 0x10018bb1
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [ebp + esi - 0x108]
movzx eax, cl
add edi, eax
and edi, 0x800000ff
jns 0x10018bcd
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x108]
mov byte [ebp + edi - 0x108], cl
mov byte [ebp + esi - 0x108], al
movzx ecx, byte [ebp + edi - 0x108]
movzx eax, al
add ecx, eax
movzx eax, cl
mov al, byte [ebp + eax - 0x108]
xor al, byte [ebx + edx]
mov byte [edx], al
inc edx
sub dword [ebp - 4], 1
jne 0x10018ba0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10018efc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov edx, dword [str.._n_tsendRouter]
mov ecx, 0xdfa
movzx eax, byte [str.FileKey6_AppData_NeroNero_15Nero3DDirect3D.log]
and edx, 0x539ed7b4
mov esi, str.FileKey6_AppData_NeroNero_15Nero3DDirect3D.log
jmp 0x10018f2c
add ecx, eax
inc esi
cmp ecx, 0xcca
ja 0x10018f73
movzx eax, byte [esi]
test eax, eax
jne 0x10018f1e
mov eax, dword [0x1002b2bc]
sub edx, 0x50a7e1a5
mov dword [0x10029f5c], edx
imul ecx, eax, 0xd0eb559
mov esi, edx
and esi, 0x6b549b6a
mov dword [0x1002b2bc], ecx
and esi, 0x83285d20
mov edi, str.PEM_write_bio
mov eax, esi
or eax, 0xcfbcf374
mov dword [str.._n_tsendRouter], eax
mov al, byte [str.PEM_write_bio]
jmp 0x10018f88
mov eax, dword [0x1002b2bc]
or eax, 0x5435cdc
jmp 0x10018f35
sub al, 0x30
cmp al, 9
ja 0x10018f8e
inc edi
mov al, byte [edi]
test al, al
jne 0x10018f7f
jmp 0x10018f9a
xor edx, 0xa8023fc9
mov dword [str.._n_tsendRouter], edx
movzx eax, byte [str.SUVWAUAV]
mov edx, 0x1e52
imul ebx, esi, 0x2826a2dc
mov edi, str.SUVWAUAV
mov dword [0x1002b340], ebx
jmp 0x10018fc7
add edx, eax
inc edi
cmp edx, 0x17e9
ja 0x10018fcd
movzx eax, byte [edi]
test eax, eax
jne 0x10018fb9
jmp 0x10018fdb
mov ecx, esi
or ecx, 0xabf224d9
mov dword [0x1002b2bc], ecx
mov al, byte [str.7z7z7z7z8]
mov edx, str.7z7z7z7z8
jmp 0x10018ff0
sub al, 0x30
cmp al, 9
ja 0x10018ff6
inc edx
mov al, byte [edx]
test al, al
jne 0x10018fe7
jmp 0x10019004
mov ecx, ebx
and ecx, 0xe8885296
mov dword [0x1002b2bc], ecx
pop edi
xor ecx, 0x16541d03
pop esi
mov dword [0x1002b358], ecx
pop ebx
ret
Function at 0x1001b3f2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
imul eax, dword [0x1002b480], 0x8c7be696
mov edx, str.SmartSanDisk
push ebx
mov ebx, dword [0x1002b698]
mov ecx, edx
push esi
push edi
push 0x53
lea edi, [ebx - 0x64b7338f]
mov dword [ebp - 0x10], eax
or ebx, 0x4a4db04a
mov dword [ebp - 4], 9
pop esi
mov dword [ebp - 8], ebx
mov eax, esi
add eax, 0xffffffd0
cmp ax, word [ebp - 4]
ja 0x1001b44c
mov ebx, dword [ebp - 8]
add ecx, 2
movzx eax, word [ecx]
mov dword [ebp - 0xc], eax
test ax, ax
jne 0x1001b430
jmp 0x1001b458
mov edi, dword [0x1002b4a0]
or edi, 0xd60b0d4a
lea eax, [ebx - 0x58157840]
mov ecx, 0x1d0
mov dword [ebp - 0xc], eax
mov ebx, esi
mov eax, edx
add ecx, ebx
lea eax, [eax + 2]
cmp ecx, 0x2597
ja 0x1001b483
movzx ebx, word [eax]
test ebx, ebx
jne 0x1001b46a
mov ebx, dword [ebp - 0x10]
jmp 0x1001b48c
mov ebx, dword [ebp - 0xc]
add ebx, 0xb95eef3c
lea eax, [edi + 0x75a4b72c]
mov dword [0x1002b69c], eax
lea ecx, [ebx + 0x2f2b3885]
or eax, 0x8ccdffae
mov dword [0x1002b484], ecx
add eax, 0x52f78bed
mov dword [0x1002b698], eax
mov eax, 0xb33
add eax, esi
lea edx, [edx + 2]
cmp eax, 0xd0b
ja 0x1001b4cc
movzx esi, word [edx]
test esi, esi
jne 0x1001b4b7
jmp 0x1001b4da
mov ecx, ebx
xor ecx, 0xb73eeab8
mov dword [0x1002b484], ecx
mov eax, dword [0x1002b4a0]
add eax, 0x3b43f6dd
mov dword [0x1002b54c], eax
imul edx, ebx, 0x9ad50cee
mov dword [0x1002b480], edx
mov ebx, dword [ebp - 4]
imul edi, ecx, 0xd3618910
mov ecx, str.format:indent
push 0x66
pop esi
mov dword [0x1002b4a0], edi
lea eax, [esi - 0x30]
cmp ax, bx
ja 0x1001b523
add ecx, 2
movzx eax, word [ecx]
mov esi, eax
test ax, ax
jne 0x1001b50c
jmp 0x1001b52f
lea ecx, [edx - 0x6deecec]
mov dword [0x1002b69c], ecx
mov eax, edi
and edx, 0x8948c662
pop edi
pop esi
mov dword [0x1002b4ac], edx
pop ebx
leave
ret
Function at 0x1001bf86
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
ret