joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100087cf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1006e0a0], 0x1e81
mov dword [0x1006e0a4], 0
mov dword [0x1006e0a8], 0
mov dword [0x1006e0b0], 0
mov dword [0x1006e09c], 0x26dd
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
jne 0x10008857
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x1006e0a4]
mov ecx, dword [0x1006e0a8]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1006e0a4], edx
mov dword [0x1006e09c], 0x4eb
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x1006e0a8], edx
mov dword [0x1006e0a0], 0xa9a
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x1006e0ac], cl
mov dword [0x1006e09c], 0xffffe7ca
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov edx, dword [0x1006e0a0]
add edx, 0xffffe4a8
mov dword [0x1006e09c], edx
mov cl, byte [0x1006e0ac]
mov edx, dword [0x1006e0a8]
mov byte [edi + edx], cl
mov dword [0x1006e0a0], 0x1f7a
mov edx, dword [0x1006e0a4]
movzx edx, byte [edi + edx]
mov ebx, dword [0x1006e0a8]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x1006e0b0], ebx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x30]
mov byte [ebx + edx], cl
mov dword [0x1006e09c], 0x1826
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x2c], edx
je 0x10008838
jmp 0x10008840
Function at 0x10008a86
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov dword [0x1006e09c], 0x12db
mov dword [ebp - 0x10], eax
call fcn.1000894e
mov ecx, eax
mov dword [0x1006e0a0], 0x983
mov edx, dword [eax + 0x3c]
mov dword [0x1006e09c], 0x297
mov edx, dword [eax + edx + 0x78]
mov dword [0x1006e0a0], 0x1bf3
mov esi, ecx
add esi, dword [eax + edx + 0x20]
mov dword [0x1006e09c], 0xfffffbb5
mov eax, dword [eax + edx + 0x18]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], eax
xor eax, eax
mov ecx, dword [ebp - 0x20]
cmp ecx, 0
mov dword [ebp - 0x24], eax
je 0x10008be6
jmp 0x10008b1d
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], edx
jmp 0x10008b31
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
jmp 0x10008b01
mov eax, dword [ebp - 0x3c]
mov ecx, eax
mov edx, dword [ebp - 0x38]
add ecx, edx
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x41], bh
mov byte [ebp - 0x42], cl
je 0x10008b90
mov al, byte [ebp - 0x41]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x40]
add edx, 1
mov ah, byte [ebp - 0x42]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
mov byte [ebp - 0x43], ah
mov dword [ebp - 0x48], edx
mov al, byte [ebp - 0x43]
test al, 1
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x3c], ecx
jne 0x10008b31
jmp 0x10008b90
mov al, byte [ebp - 0x42]
test al, 1
jne 0x10008bc3
jmp 0x10008b99
xor eax, eax
mov ecx, dword [ebp - 0x34]
add ecx, 2
mov edx, dword [ebp - 0x30]
add edx, 1
mov esi, dword [ebp - 0x20]
cmp edx, esi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], eax
jb 0x10008b01
jmp 0x10008be6
mov eax, dword [ebp - 0x34]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
add edx, dword [edx + esi + 0x1c]
mov dword [0x1006e09c], 0xd83
mov edi, dword [ebp - 0x18]
add edi, dword [edx + ecx*4]
mov dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x24]
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10008fce
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [0x1006e0a0], 0x1a92
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
xor eax, eax
mov dword [0x1006e09c], 0x2534
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov cl, byte [eax + 0x1000aa7a]
mov dl, byte [eax + 0x1000aa4b]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x30], eax
jne 0x10008ffa
lea eax, [ebp - 0x24]
mov dword [0x1006e09c], 0x18b3
mov dword [ebp - 0x34], eax
call fcn.10008d1e
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.10008e3c
mov ecx, dword [0x1006e0a0]
add ecx, 0x65b
mov dword [0x1006e0a0], ecx
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x1000910c
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x1006e09c], 0x1b3e
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.10008313
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x1006e09c], 0x105c
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x50], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x48], ecx
mov dword [0x1006e0a0], 0x1a71
add ecx, 0x2425
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x10009103
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x1000b2a0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10276760]
jne 0x1000b2aa
repz ret
jmp fcn.1000c61c

Function at 0x1000d79d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1000a6e3
and dword [ebp - 4], 0
cmp dword [0x10277eb4], 0
mov ebx, eax
jne 0x1000d84e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000d8ff
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1000d8ff
push eax
call fcn.1000a671
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10277eb4], eax
call esi
push eax
call fcn.1000a671
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10277eb8], eax
call esi
push eax
call fcn.1000a671
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10277ebc], eax
call esi
push eax
call fcn.1000a671
pop ecx
mov dword [0x10277ec4], eax
test eax, eax
je 0x1000d84e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1000a671
pop ecx
mov dword [0x10277ec0], eax
mov eax, dword [0x10277ec0]
cmp eax, ebx
je 0x1000d8a6
cmp dword [0x10277ec4], ebx
je 0x1000d8a6
push eax
call fcn.1000a6ec
push dword [0x10277ec4]
mov esi, eax
call fcn.1000a6ec
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1000d8a6
test edi, edi
je 0x1000d8a6
call esi
test eax, eax
je 0x1000d89d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000d89d
test byte [ebp - 0xc], 1
jne 0x1000d8a6
or dword [ebp + 0x10], 0x200000
jmp 0x1000d8df
mov eax, dword [0x10277eb8]
cmp eax, ebx
je 0x1000d8df
push eax
call fcn.1000a6ec
pop ecx
test eax, eax
je 0x1000d8df
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000d8df
mov eax, dword [0x10277ebc]
cmp eax, ebx
je 0x1000d8df
push eax
call fcn.1000a6ec
pop ecx
test eax, eax
je 0x1000d8df
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10277eb4]
call fcn.1000a6ec
pop ecx
test eax, eax
je 0x1000d8ff
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000d901
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000e6b2
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.1000e214
lea ecx, [0x1000ee53]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x74], edx
mov dword [esp + 0x84], 0x14b800
mov edx, dword [0x10276108]
mov dword [esp + 0x3c], edx
mov edx, dword [0x1027610c]
mov dword [esp + 0x7c], edx
mov dword [0x1027611c], 0x5bf
mov edx, dword [0x10276110]
mov dword [esp + 0x58], edx
mov edx, dword [0x10276114]
mov dword [esp + 0x78], edx
mov edx, dword [0x10276118]
mov dword [esp + 0x68], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
je 0x1000e797
jmp 0x1000e77b
mov eax, dword [esp + 0x18]
mov dword [esp + 0x4c], eax
mov ecx, dword [esp + 0x14]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x44], edx
mov dword [0x1027611c], 0x1307
call fcn.1000f5ec
mov dword [esp + 0x10], eax
xor eax, eax
mov ecx, dword [esp + 0x10]
cmp ecx, 0
mov dword [esp + 0xc], eax
je 0x1000e7ad
jmp 0x1000e7eb
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x1c], eax
jmp 0x1000e72f
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], ecx
je 0x1000e740
jmp 0x1000e77b
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1000e938
mov dword [0x10276120], 0x1f85
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x1027611c], 0x1c7
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1000e938
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x10276120], 0x1b1
mov dword [0x1027611c], 0x132c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
jmp 0x1000ea09
mov eax, dword [ebp - 0x30]
add eax, 0x17ad
mov dword [0x1027611c], 0x16db
mov dword [ebp - 0x34], eax
jmp 0x1000ea66
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x24]
mov dword [esp + 4], ecx
mov dword [ebp - 0x30], eax
call fcn.1000ecd3
xor eax, eax
mov ecx, dword [ebp - 0x30]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
mov dword [0x10276120], 0x32b
add ecx, 0xffc00000
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x18], ecx
mov ecx, dword [ebp - 0x30]
mov dword [edx], ecx
mov dword [0x1027611c], 0xc1f
cmp ecx, 0
mov dword [ebp - 0x34], eax
je 0x1000ea66
jmp 0x1000e968
mov eax, dword [ebp - 0x2c]
mov cl, byte [eax + 0x100101bd]
mov dl, byte [eax + 0x1001018e]
sub dl, cl
mov byte [ebp + eax - 0x20], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x2c], eax
jne 0x1000ea09
lea eax, [ebp - 0x20]
mov dword [0x1027611c], 0xfffefc67
mov dword [ebp - 0x3c], eax
call fcn.1000f97d
mov dword [esp], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], eax
call fcn.1000eb2d
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
jne 0x1000e982
mov eax, dword [ebp - 0x34]
add esp, 0x4c
pop ebp
ret
Function at 0x1000ef0e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0xffffffff
mov esi, dword [0x1027611c]
cmp eax, 0
sete bl
cmp ecx, 0
sete bh
add esi, 0x446
mov dword [0x1027611c], esi
and bh, bl
test bh, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jne 0x1000f13d
mov eax, dword [0x10276120]
add eax, 0xffffd93b
mov dword [0x10276120], eax
mov dword [0x1027611c], 0x268e
mov ecx, dword fs:[0x18]
mov eax, 0x25c3
mov dword [0x1027611c], 0xbfb
mov ecx, dword [ecx + 0x30]
mov dword [0x10276120], 0x19f0
mov ecx, dword [ecx + 0xc]
mov edx, ecx
add edx, 0x14
mov dword [0x1027611c], 0x25c3
mov ecx, dword [ecx + 0x14]
cmp ecx, edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], eax
je 0x1000eff9
jmp 0x1000f010
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff8
mov dword [ebp - 0x18], eax
jmp 0x1000f13d
mov dword [0x1027611c], 0xef1
mov dword [0x10276120], 0x1b45
mov eax, 0xef1
mov cl, byte [ebp - 0x29]
test cl, 1
mov dword [ebp - 0x30], eax
jne 0x1000f0ff
jmp 0x1000f111
mov eax, dword [ebp - 0x24]
xor ecx, ecx
add eax, 0xffffe5ec
mov dword [0x10276120], eax
mov dword [ebp - 0x18], ecx
jmp 0x1000f13d
mov eax, dword [ebp - 0x10]
cmp eax, 0
setne cl
mov byte [ebp - 0x31], cl
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
jmp 0x1000f026
mov eax, dword [ebp - 0x38]
mov cx, word [eax + 0x24]
mov edx, dword [eax + 0x28]
mov dword [0x1027611c], 0x1e46
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x31]
and bh, bl
test bh, 1
mov dword [ebp - 0x28], eax
mov word [ebp - 0x3a], cx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], esi
jne 0x1000efbc
mov eax, 0x240
xor ecx, ecx
mov dword [0x1027611c], 0x240
mov dx, word [ebp - 0x3a]
shr dx, 1
movzx esi, dx
cmp dx, 0
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x30], eax
je 0x1000f111
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x40]
mov dx, word [ecx + eax*2]
mov si, dx
add si, 0xffbf
mov di, dx
add di, 0x20
cmp si, 0x1a
mov dword [ebp - 0x50], eax
mov word [ebp - 0x52], dx
mov word [ebp - 0x54], di
jb 0x1000f0c4
mov ax, word [ebp - 0x52]
mov word [ebp - 0x54], ax
mov ax, word [ebp - 0x54]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x50]
cmp word [ecx + edx*2], ax
sete bl
add edx, 1
cmp ax, 0
setne bh
mov al, bl
and al, bh
mov esi, dword [ebp - 0x4c]
cmp edx, esi
setb bh
and al, bh
test al, 1
mov byte [ebp - 0x29], bl
mov dword [ebp - 0x48], edx
jne 0x1000f090
jmp 0x1000efcc
mov dword [0x1027611c], 0x1542
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x18], eax
jmp 0x1000f13d
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 0xfffffed7
mov dword [0x10276120], ecx
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
mov esi, dword [ebp - 0x20]
cmp edx, esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x38], edx
je 0x1000eff9
jmp 0x1000f026
mov eax, dword [ebp - 0x18]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000f222
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x10276128], 0
mov byte [0x1027612c], 0
mov dword [0x1027611c], 0xffffeadc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [0x10276124], 0
mov dword [ebp - 0x1c], eax
jmp 0x1000f282
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov dword [0x10276124], 0
mov dword [ebp - 0x20], eax
jmp 0x1000f2be
mov eax, dword [ebp - 0x1c]
mov dword [0x10276120], 0x668
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x1027611c], 0x19bf
mov eax, dword [0x10276124]
add eax, 1
mov dword [0x10276124], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1000f282
jmp 0x1000f271
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x10276130], 0
mov dword [0x1027611c], 0xf1e
mov edi, dword [0x10276128]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x10276130], esi
mov dword [0x1027611c], 0x1e0c
mov eax, esi
cdq
idiv ecx
mov dword [0x10276128], edx
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x1027612c], cl
mov dword [0x1027611c], 0x104f
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x1027612c]
mov esi, dword [0x10276128]
mov byte [ebx + esi], cl
mov esi, dword [0x1027611c]
add esi, 0xfffff4c8
mov dword [0x1027611c], esi
mov esi, dword [0x10276124]
add esi, 1
mov dword [0x10276124], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x1000f2be
jmp 0x1000f269
Function at 0x1000f5ec
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x34
mov dword [ebp - 0xc], 0
mov dword [0x10276120], 0x840
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov esi, dword [0x1027611c]
mov edi, esi
add edi, 0x1f19
mov dword [0x10276120], edi
mov edi, esi
add edi, 0x12e0
add esi, 0x883
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ecx
jmp 0x1000f69b
mov eax, dword [ebp - 0x24]
add eax, 1
cmp eax, 0x104
mov ecx, dword [ebp - 0x14]
mov edx, eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x20], eax
jl 0x1000f69b
jmp 0x1000f675
mov eax, dword [ebp - 0x30]
add esp, 0x34
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
add ecx, 0xfffff257
mov dword [0x1027611c], ecx
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x34], eax
je 0x1000f6b9
jmp 0x1000f765
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2], 0
mov edx, dword [ebp - 0x1c]
mov esi, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], esi
je 0x1000f675
jmp 0x1000f64c
mov dword [0x10276120], 0x342
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x34]
cmp word [eax + ecx*2 - 0x18], 0x6f
sete dl
mov byte [ebp - 0x35], dl
mov al, byte [ebp - 0x35]
test al, 1
jne 0x1000f6e2
jmp 0x1000f765
mov dword [0x1027611c], 0x5f4
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x34]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1000f765
mov dword [0x10276120], 0x100a
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x34]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x1000f765
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x34]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x1000f765
mov dword [0x1027611c], 0x1fa3
mov eax, dword [ebp - 0x34]
add eax, 0xfffffff8
shl eax, 1
mov ecx, dword [ebp - 0x18]
add ecx, eax
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
cmp word [eax], 0x6c
jne 0x1000f765
mov eax, 1
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x34]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x30], eax
je 0x1000f66b
xor eax, eax
mov dword [0x1027611c], 0x23d9
mov dword [ebp - 0x30], eax
jmp 0x1000f66b
Function at 0x1000f779
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x10276120], 0x2149
mov dword [0x10276124], 0
mov dword [0x10276128], 0
mov dword [0x10276134], 0
mov dword [0x1027611c], 0x202b
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x1000f8e8
jmp 0x1000f7ff
mov eax, dword [0x10276124]
mov ecx, dword [0x10276128]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x1027611c], 0x204a
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x10276124], edx
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x10276128], edx
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x1027612c], cl
mov dword [0x1027611c], 0x42b7
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x1027612c]
mov edx, dword [0x10276128]
mov byte [edi + edx], cl
mov dword [0x10276120], 0x1159
mov edx, dword [0x10276124]
movzx edx, byte [edi + edx]
mov ebx, dword [0x10276128]
movzx ebx, byte [edi + ebx]
add ebx, edx
mov dword [0x1027611c], 0x1178
and ebx, 0xff
mov dword [0x10276134], ebx
mov dword [0x10276120], 0x63f
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x30]
mov ch, byte [edx + ebx]
mov dword [0x10276120], 0x1eeb
xor ch, cl
mov edx, dword [ebp - 0x1c]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x2c], ebx
jne 0x1000f7e8
mov dword [0x1027611c], 0x900
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x431004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x55991527
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x4cfe57e7
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x100075db
Capabilities:
Get disk size

Disassembly:
push 0xb4
mov eax, 0x1022967e
call fcn.101e5a91
mov eax, ecx
mov dword [ebp - 0x44], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [eax + 0xbc], ebx
je 0x10007713
cmp dword [ebp + 0x18], 3
jb 0x10007713
xor eax, eax
lea edi, [ebp - 0x30]
push 8
pop esi
cmp dword [ebp + 0x1c], esi
mov ecx, esi
rep stosd dword es:[edi], eax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push 0x5c
pop esi
movzx eax, word [eax]
mov edx, eax
mov word [ebp - 0x30], ax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
movzx eax, word [eax + 2]
mov ecx, eax
mov word [ebp - 0x2e], ax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
movzx eax, word [eax + 4]
mov word [ebp - 0x2c], ax
cmp eax, 0x2f
jne 0x10007658
mov ax, si
mov word [ebp - 0x2c], ax
cmp dx, si
je 0x10007713
cmp ecx, 0x3a
jne 0x10007713
cmp ax, si
jne 0x10007713
lea eax, [ebp - 0x40]
mov dword [ebp - 0x34], ebx
push eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], ebx
push eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x38], ebx
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x40], ebx
push eax
lea eax, [ebp - 0x30]
mov bl, 1
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x10007715
mov eax, dword [ebp - 0x38]
mul dword [ebp - 0x3c]
mov ecx, eax
mov eax, edx
mul dword [ebp - 0x34]
mov esi, eax
mov eax, ecx
mul dword [ebp - 0x34]
mov ecx, dword [ebp - 0x44]
add esi, edx
imul ecx, dword [ecx + 0xbc], 3
test esi, esi
ja 0x10007715
jb 0x100076c9
cmp eax, ecx
jae 0x10007715
push 0xcd
lea ecx, [ebp - 0xc0]
call fcn.100b98c0
mov dword [ebp - 0xc0], vtable.RC::RCWidgetMessageBox.1.0
mov dword [ebp - 0xa0], vtable.RC::RCWidgetMessageBox.0
push ecx
mov byte [ebp - 4], 1
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0xc0]
call fcn.100b9a50
lea ecx, [ebp - 0xc0]
call fcn.10008739
xor bl, bl
jmp 0x10007715
mov bl, 1
lea ecx, [ebp + 8]
call fcn.10005e33
mov al, bl
call fcn.101e5a4c
ret 0x18