joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100030c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ffce
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1002c018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
test byte [0x1015fef8], 1
jne 0x1000315b
or dword [0x1015fef8], 1
mov edi, 0x1023595d
lea esi, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.1001a500
mov esi, eax
mov ecx, 0x10235971
lea eax, [ebp - 0x1c]
call fcn.1001a480
push esi
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.1001d710
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1015fef4], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov word [ebp - 0x20], ax
mov byte [ebp - 0x1e], al
mov dword [ebp - 4], 0xffffffff
push 0
push 0xffffffffffffffff
call dword [0x1015fef4]
test eax, eax
jne 0x10003170
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001dae2
mov esp, ebp
pop ebp
ret
Function at 0x1000ab10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ec18
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1002c018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov ecx, 0x49
xor eax, eax
mov bl, byte [eax + 0x1002531c]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], bl
jns 0x1000ab5f
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1c
jl 0x1000ab42
mov byte [ebp - 0x14], dl
mov dword [ebp - 4], edx
mov ecx, dword [0x1015f53c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x30]
push edx
call eax
add eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax + ecx*4]
add eax, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001dae2
mov esp, ebp
pop ebp
ret 8

Function at 0x1000ad90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001eba8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1002c018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov ecx, 0x1f
xor eax, eax
mov bl, byte [eax + str.Vfira_nuINF_OY]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x2c], bl
jns 0x1000addf
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x17
jl 0x1000adc2
mov byte [ebp - 0x15], dl
mov dword [ebp - 4], edx
mov ecx, dword [0x1015f53c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x2c]
push edx
call eax
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001dae2
mov esp, ebp
pop ebp
ret 4

Function at 0x1000b1f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001eaf8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1002c018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov ecx, 0x8d
xor eax, eax
mov bl, byte [eax + 0x10026970]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], bl
jns 0x1000b23f
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x13
jl 0x1000b222
mov byte [ebp - 0x11], dl
mov dword [ebp - 4], edx
mov ecx, dword [0x1015f53c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x24]
push edx
call eax
fld dword [ebp + 8]
mov eax, dword [eax + esi + 0xc]
fstp dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001dae2
mov esp, ebp
pop ebp
ret 4
Function at 0x1000b290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001eac8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1002c018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x1c
xor eax, eax
nop
mov dl, byte [eax + 0x10026984]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], dl
jns 0x1000b2dd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x1000b2c0
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x1015f53c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x24]
push edx
call eax
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx + 0xc]
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x14], cx
fld dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001dae2
mov esp, ebp
pop ebp
ret 4

Function at 0x1000b450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001fd30
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1002c018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, 0xa3
xor eax, eax
mov dl, byte [eax + 0x100269b4]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], dl
jns 0x1000b4a1
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1d
jl 0x1000b484
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x1015f53c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x30]
push edx
call eax
test eax, eax
setne al
mov dword [ebp - 4], 0xffffffff
test al, al
je 0x1000b50d
mov edi, 0x101982e8
lea esi, [ebp - 0x30]
call fcn.1001ae30
mov dword [ebp - 4], 1
mov ecx, dword [0x1015f53c]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
push 0
lea esi, [ebx + eax]
call fcn.1000a550
mov edi, eax
mov eax, esi
mov ebx, 0x44
call fcn.1000a4d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001dae2
mov esp, ebp
pop ebp
ret
Function at 0x1000b530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001ea68
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1002c018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0xeb
xor eax, eax
nop
mov dl, byte [eax + 0x100260d0]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], dl
jns 0x1000b57d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1c
jl 0x1000b560
mov byte [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x1015f53c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x30]
push edx
call eax
add eax, dword [0x1015f538]
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x14], cl
push edi
mov ecx, esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001dae2
mov esp, ebp
pop ebp
ret

Function at 0x1000b710
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001fcf8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1002c018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov ecx, 0x31
xor eax, eax
mov bl, byte [eax + 0x10026a04]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], bl
jns 0x1000b760
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1d
jl 0x1000b743
mov byte [ebp - 0x13], dl
mov dword [ebp - 4], edx
mov ecx, dword [0x1015f53c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x30]
push edx
call eax
push 2
lea ebx, [esi + eax]
call fcn.1000a550
mov edi, eax
mov eax, ebx
mov ebx, 0xe
call fcn.1000a4d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001dae2
mov esp, ebp
pop ebp
ret
Function at 0x1000b7b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001e9d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1002c018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x31
xor eax, eax
nop
mov dl, byte [eax + 0x10026a24]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x2c], dl
jns 0x1000b7fd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1b
jl 0x1000b7e0
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x1015f53c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x2c]
push edx
call eax
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx + 0xc]
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001dae2
mov esp, ebp
pop ebp
ret 4
Function at 0x10016ea0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x1002c018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_sprintf]
push edi
push esi
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x108]
push ecx
mov dword [ebp - 0x110], 0x2a5c7325
mov word [ebp - 0x10c], 0x2a2e
mov byte [ebp - 0x10a], 0
call ebx
add esp, 0xc
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
nop
lea ecx, [ebp - 0x224]
push ecx
push esi
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x110], 0x255c7325
mov word [ebp - 0x10c], 0x73
call ebx
add esp, 0x10
xor eax, eax
lea ecx, [ebp - 0x108]
push ecx
mov dword [ebp - 0x110], eax
mov word [ebp - 0x10c], ax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x250]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10016f00
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1001dae2
mov esp, ebp
pop ebp
ret

Function at 0x10016f90
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x1002c018]
xor eax, esp
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [ebp + 0xc]
dec eax
jne 0x1001702a
push 0x1015efa0
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, 0x1015efa0
call fcn.10016ea0
mov esi, str.C:Windowsprefetch
call fcn.10016ea0
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x742e4d47
mov word [esp + 0x14], 0x7478
mov byte [esp + 0x16], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
mov dword [esp + 0xc], eax
mov word [esp + 0x10], ax
mov byte [esp + 0x12], al
call fcn.1001d960
mov edi, 0x1000f5c0
mov ecx, eax
call fcn.1001d890
call fcn.1001d960
mov edi, 0x10016a40
mov ecx, eax
call fcn.1001d890
mov ecx, dword [esp + 0x14]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.1001dae2
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100191f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10020098
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1002c018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [edi + 0x44], 0
je 0x10019348
cmp byte [edi + 0x49], 0
je 0x10019348
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x1001933c
lea esi, [ebp - 0x2c]
call fcn.10018ee0
mov dword [ebp - 4], 0
mov ebx, 0x10
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
cmp eax, ebx
jae 0x1001929b
lea ecx, [ebp - 0x2c]
mov eax, ecx
add ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
lea eax, [edi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x100192a0
dec eax
je 0x100192a4
sub eax, 2
lea esi, [ebp - 0x2c]
je 0x10019343
call fcn.100013c0
xor al, al
jmp 0x1001934a
mov eax, dword [ebp - 0x2c]
jmp 0x10019265
mov byte [edi + 0x49], 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
mov eax, edx
cmp ecx, ebx
jae 0x100192b3
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, eax
je 0x100192d8
mov eax, edx
cmp ecx, ebx
jae 0x100192c3
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x10019334
cmp byte [edi + 0x49], 0
je 0x10019340
test esi, esi
jne 0x10019256
mov eax, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, eax
cmp edx, 8
jbe 0x10019365
lea esi, [eax + 8]
lea eax, [ebp - 0x2c]
call fcn.10001640
test al, al
je 0x10019256
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], ebx
jae 0x10019311
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x18], ebx
jae 0x1001932b
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x10019256
lea esi, [ebp - 0x2c]
call fcn.100013c0
xor al, al
jmp 0x1001934a
lea esi, [ebp - 0x2c]
call fcn.100013c0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001dae2
mov esp, ebp
pop ebp
ret
push 0x10023a8c
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
int3

Function at 0x1001a400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0xf1
xor ecx, ecx
jmp 0x1001a410
mov al, byte [edi + ecx - 0x210f19]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001a42d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001a410
mov byte [esi + 0xc], 0
mov eax, esi
ret
Function at 0x1001aad0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 2
xor ecx, ecx
jmp 0x1001aae0
mov al, byte [edi + ecx - 0x321a2a]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001aafd
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0x26
jl 0x1001aae0
mov byte [esi + 0x26], 0
mov eax, esi
ret

Function at 0x1001ab10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 2
xor ecx, ecx
jmp 0x1001ab20
mov al, byte [edi + ecx - 0x321a2a]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001ab3d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0x20
jl 0x1001ab20
mov byte [esi + 0x20], 0
mov eax, esi
ret

Function at 0x1001b290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x29
xor ecx, ecx
jmp 0x1001b2a0
mov al, byte [edi + ecx + 0x1e7b41dd]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001b2bd
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001b2a0
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001b2d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x6c
xor ecx, ecx
jmp 0x1001b2e0
mov al, byte [edi + ecx + 0x6fad512a]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001b2fd
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001b2e0
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001b310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x49
xor ecx, ecx
jmp 0x1001b320
mov al, byte [edi + ecx + 0x16440e0f]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001b33d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001b320
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001b8d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0xfa
xor ecx, ecx
jmp 0x1001b8e0
mov al, byte [edi + ecx - 0x2b3158]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001b8fd
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001b8e0
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001bb30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x1f
xor ecx, ecx
jmp 0x1001bb40
mov al, byte [edi + ecx - 0x97d5a03]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001bb5d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001bb40
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001bef0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x1d
xor ecx, ecx
jmp 0x1001bf00
mov al, byte [edi + ecx - 0x1a1d45]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001bf1d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001bf00
mov byte [esi + 0xc], 0
mov eax, esi
ret
Function at 0x1001d270
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10020328
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x1002c018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x10
mov byte [ebp - 0x7c], al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
jae 0x1001d2d3
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0x18]
lea esi, [ebp - 0x7c]
call fcn.1001d030
mov ecx, esi
call fcn.1001d0e0
mov ecx, edi
mov ebx, esi
call fcn.1001d1c0
cmp dword [ebp + 0x1c], 0x10
jb 0x1001d302
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001dae2
mov esp, ebp
pop ebp
ret
Function at 0x1001d600
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001fbb8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1002c018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
xor edx, edx
mov ecx, 0x49
xor eax, eax
lea esp, [esp]
mov bl, byte [eax + 0x100275bc]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x20], bl
jns 0x1001d65d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x1001d640
mov byte [ebp - 0x14], dl
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], edx
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov ebx, dword [ebx]
mov ebx, dword [ebx]
mov ebx, dword [ebx + 0x10]
mov dword [ebp - 0x2c], ebx
mov edx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x20]
push ecx
push edx
call fcn.1001d3c0
add esp, 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x30]
call dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x1001d6b1
xor eax, eax
jmp 0x1001d6e8
push esi
push eax
call fcn.1001d3c0
add esp, 8
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1001d6ad
test edi, edi
jle 0x1001d6df
lea eax, [ebp + 0xc]
mov ecx, edi
jmp 0x1001d6d0
mov edx, dword [eax + 4]
add eax, 4
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
dec ecx
jne 0x1001d6d0
call dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001dae2
mov esp, ebp
pop ebp
ret

Function at 0x1001dae2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002c018]
jne 0x1001daec
repz ret
jmp fcn.1001dfac
Function at 0x100d965
Capabilities:
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebx]
imul ecx, ecx, 0x14
push esi
push ecx
xor esi, esi
push esi
push dword [eax + 0x18]
mov dword [ebp - 0xc], esi
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ecx, eax
mov dword [ebp - 8], ecx
cmp ecx, esi
jne 0x100d9a5
mov dword [ebp - 0xc], 0xc000009a
jmp 0x100da99
cmp byte [ebp + 0x18], 0
push edi
mov dword [ebp + 0xc], esi
je 0x100d9ef
mov dword [ebp + 0x18], esi
cmp dword [ebx], esi
jbe 0x100d9ef
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ecx
push 4
pop ecx
mov edi, 0x1001d64
mov esi, eax
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x100d9e0
mov edi, dword [ebp - 4]
inc dword [ebp + 0xc]
add dword [ebp - 4], 0x14
push 5
pop ecx
mov esi, eax
rep movsd dword es:[edi], dword [esi]
and dword [eax + 0x10], edx
inc dword [ebp + 0x18]
mov ecx, dword [ebp + 0x18]
add eax, 0x14
cmp ecx, dword [ebx]
jb 0x100d9bc
xor esi, esi
mov eax, dword [ebp + 0x14]
cmp eax, esi
jbe 0x100da5a
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 0x10], ecx
mov dword [ebp - 4], eax
mov dword [ebp + 0x18], esi
cmp dword [ebx], esi
jbe 0x100da51
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
imul eax, eax, 0x14
add eax, dword [ebp - 8]
mov dword [ebp + 0x14], edi
cmp dword [edi + 0x10], esi
je 0x100da3e
mov esi, dword [ebp + 0x10]
push 4
pop ecx
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x100da3c
mov edx, dword [ebp + 0x14]
inc dword [ebp + 0xc]
push 5
mov edi, eax
pop ecx
mov esi, edx
rep movsd dword es:[edi], dword [esi]
add eax, 0x14
and dword [edx + 0x10], 0
xor esi, esi
inc dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
add edi, 0x14
mov dword [ebp + 0x14], edi
cmp ecx, dword [ebx]
jb 0x100da15
add dword [ebp + 0x10], 0x10
dec dword [ebp - 4]
jne 0x100d9ff
mov eax, dword [ebx]
imul eax, eax, 0x14
push eax
push esi
push dword [ebp + 8]
call fcn.01012644
mov edi, dword [ebp + 0xc]
mov eax, edi
imul eax, eax, 0x14
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.01012650
mov eax, dword fs:[0x18]
add esp, 0x18
push dword [ebp - 8]
mov dword [ebx], edi
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
leave
ret 0x14