joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406656
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push esi
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x4066a6
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x4066ab
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 1
push eax
push 0x20019
xor edi, edi
mov dword [ebp - 4], 0x104
push edi
push dword [ebp + 0xc]
mov esi, edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x406757
push 0x208
call fcn.00426679
pop ecx
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp ebx, 0xea
jne 0x40673c
push esi
call fcn.0042647d
mov eax, dword [ebp - 4]
add eax, eax
push eax
call fcn.00426679
pop ecx
pop ecx
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
jne 0x406757
test esi, esi
je 0x40674d
push esi
call fcn.00423bce
pop ecx
mov edi, eax
mov ecx, dword [ebp + 0x14]
push edi
push esi
call fcn.004033de
push esi
call fcn.0042647d
pop ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x40a653
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0xf003f
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a6b7
push esi
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
test esi, esi
pop esi
cmove edi, eax
mov eax, edi
pop edi
leave
ret

Function at 0x40ca0b
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4504c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0x10]
xor ecx, ecx
push 0xf0000040
inc ecx
mov dword [ebp - 0x24], eax
push ecx
push eax
push eax
mov bl, al
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x28], 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x40cac9
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0x8003
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40cac9
cmp dword [ebp - 0x20], 0
je 0x40cad8
push 0
push dword [ebp + 0xc]
push esi
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x40cac9
push 0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
push 2
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x40cac9
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
push esi
call fcn.0040c7dc
add esp, 0x10
test al, al
je 0x40cac9
lea eax, [ebp - 0xc]
push edi
push eax
call fcn.0040cb79
pop ecx
pop ecx
test al, al
movzx ebx, bl
push 1
pop eax
cmovne ebx, eax
cmp dword [ebp - 0x20], 0
je 0x40cad8
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x24], 0
je 0x40cae9
push 0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e994
leave
ret
Function at 0x40cb79
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x4504c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x20
pop ecx
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov ebx, dword [ebp + 0xc]
lea edi, [ebp - 0x88]
xor edx, edx
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsw word es:[edi], word [esi]
mov esi, dword [ebp + 8]
movzx eax, byte [ecx + esi]
inc ecx
mov dword [ebp - 0x8c], eax
cmp ecx, 8
jae 0x40cbc2
movzx edi, byte [ecx + esi]
inc ecx
jmp 0x40cbc4
xor edi, edi
cmp ecx, 8
jae 0x40cbdc
movzx eax, byte [ecx + esi]
inc ecx
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x8c]
jmp 0x40cbe3
and dword [ebp - 0x90], 0
shr eax, 2
mov ax, word [ebp + eax*2 - 0x88]
mov word [ebx + edx*2], ax
mov eax, dword [ebp - 0x8c]
and eax, 3
shl eax, 4
mov dword [ebp - 0x8c], eax
mov eax, edi
shr eax, 4
and edi, 0xf
or dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
shl edi, 2
mov ax, word [ebp + eax*2 - 0x88]
mov word [ebx + edx*2 + 2], ax
mov eax, dword [ebp - 0x90]
shr eax, 6
or edi, eax
mov ax, word [ebp + edi*2 - 0x88]
mov word [ebx + edx*2 + 4], ax
mov eax, dword [ebp - 0x90]
and eax, 0x3f
mov ax, word [ebp + eax*2 - 0x88]
mov word [ebx + edx*2 + 6], ax
add edx, 4
cmp ecx, 8
jb 0x40cbab
mov ecx, dword [ebp - 4]
push 0x3d
pop eax
mov word [ebx + edx*2 - 2], ax
xor ecx, ebp
xor eax, eax
pop edi
mov word [ebx + edx*2], ax
mov al, 1
pop esi
pop ebx
call fcn.0041e994
leave
ret

Function at 0x40efeb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push eax
push eax
push eax
push 0x40f0b0
push eax
push eax
mov dword [0x450004], ebx
mov dword [0x45000c], edi
mov dword [0x450008], esi
mov dword [0x45001c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [ebp + 0x14]
push edi
push esi
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x418f25
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0x10
mov eax, 0x43a2cc
call fcn.0041ea47
mov esi, ecx
mov dword [ebp - 0x14], esi
lea eax, [esi + 0x1c]
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [ebp + 8]
test ebx, ebx
jle 0x41902f
cmp ebx, dword [esi + 0xc]
jge 0x41902f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
test edi, edi
je 0x418f7c
cmp ebx, dword [edi + 8]
jl 0x41901d
cmp dword [ebp + 0xc], 0
je 0x41901d
xor ebx, ebx
jmp 0x418fb6
xor ebx, ebx
push 0x10
mov dword [ebp - 4], ebx
call fcn.00418bb2
mov edi, eax
test edi, edi
je 0x418f96
mov dword [edi], vtable.CThreadData.0
jmp 0x418f98
mov edi, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0x14]
push edi
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
call fcn.00418eb8
mov ecx, dword [esi + 0x14]
mov dword [eax], ecx
mov dword [esi + 0x14], edi
mov esi, dword [ebp - 0x14]
cmp dword [edi + 0xc], ebx
jne 0x418fd1
push 4
push dword [esi + 0xc]
call fcn.0040fc73
pop ecx
pop ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x418fe9
push 2
push 4
push dword [esi + 0xc]
call fcn.0040fc73
pop ecx
pop ecx
push eax
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov edx, eax
test edx, edx
je 0x419056
mov ecx, dword [edi + 8]
mov dword [edi + 0xc], edx
mov eax, dword [esi + 0xc]
sub eax, ecx
shl eax, 2
push eax
lea eax, [edx + ecx*4]
push ebx
push eax
call fcn.0041ff30
mov eax, dword [esi + 0xc]
add esp, 0xc
mov dword [edi + 8], eax
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, dword [ebp + 8]
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x41902f
cmp ebx, dword [edi + 8]
jge 0x41902f
mov eax, dword [ebp + 0xc]
mov dword [ecx + ebx*4], eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0041e9a5
ret 8
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0040f74e
int3
Function at 0x1026f72a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1029d438]
jne 0x1026f734
repz ret
jmp fcn.1027172d

Function at 0x102728ff
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1026f7ab
and dword [ebp - 4], 0
cmp dword [0x1029f618], 0
mov ebx, eax
jne 0x102729b0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10272a61
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10272a61
push eax
call fcn.1026f739
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1029f618], eax
call esi
push eax
call fcn.1026f739
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1029f61c], eax
call esi
push eax
call fcn.1026f739
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1029f620], eax
call esi
push eax
call fcn.1026f739
pop ecx
mov dword [0x1029f628], eax
test eax, eax
je 0x102729b0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1026f739
pop ecx
mov dword [0x1029f624], eax
mov eax, dword [0x1029f624]
cmp eax, ebx
je 0x10272a08
cmp dword [0x1029f628], ebx
je 0x10272a08
push eax
call fcn.1026f7b4
push dword [0x1029f628]
mov esi, eax
call fcn.1026f7b4
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10272a08
test edi, edi
je 0x10272a08
call esi
test eax, eax
je 0x102729ff
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x102729ff
test byte [ebp - 0xc], 1
jne 0x10272a08
or dword [ebp + 0x10], 0x200000
jmp 0x10272a41
mov eax, dword [0x1029f61c]
cmp eax, ebx
je 0x10272a41
push eax
call fcn.1026f7b4
pop ecx
test eax, eax
je 0x10272a41
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10272a41
mov eax, dword [0x1029f620]
cmp eax, ebx
je 0x10272a41
push eax
call fcn.1026f7b4
pop ecx
test eax, eax
je 0x10272a41
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1029f618]
call fcn.1026f7b4
pop ecx
test eax, eax
je 0x10272a61
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10272a63
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x102746e3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x1029cdbc], 0x2590
mov dword [0x1029cdc0], 0x20f1
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x10276564]
mov dh, byte [eax + 0x10276535]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
jne 0x1027470f
lea eax, [ebp - 0x24]
mov dword [0x1029cdbc], 0x17d7
mov dword [ebp - 0x34], eax
call fcn.10275b5c
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.10274c1d
cmp eax, 0
mov dword [ebp - 0x38], eax
jne 0x1027476f
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x38]
mov ecx, dword [0x1029cdbc]
add ecx, 0xffffff13
mov dword [0x1029cdbc], ecx
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x1029cdc0], 0x540
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.10274f61
mov eax, dword [ebp - 0x3c]
mov word [eax], 0x5a4d
xor eax, eax
mov ecx, dword [ebp - 0x3c]
add ecx, 0x1120
mov edx, dword [ebp - 0x3c]
mov dword [edx + 0x3c], 0xd0
mov dword [edx + 0xd0], 0x4550
add edx, 0xffc00000
mov dword [0x1029cdbc], 0x148f
mov esi, dword [ebp - 0x2c]
mov dword [esi + 0x2c], edx
mov edx, dword [0x1029cdbc]
add edx, 0xffffe6c4
mov dword [0x1029cdc0], edx
mov edx, dword [ebp - 0x3c]
mov dword [esi + 0x48], edx
mov dword [0x1029cdbc], 0x1eb3
cmp edx, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x10274835
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x102748a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, 0xfffff6eb
mov dword [0x1029cdc4], 0
mov dword [0x1029cdc8], 0
mov dword [0x1029cdd4], 0
mov dword [0x1029cdc0], 0x1814
mov dword [0x1029cdbc], 0xccf
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x10274a26
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x14]
mov edi, 0x100
add eax, 1
mov dword [0x1029cdc0], 0x23ff
mov ebx, esi
add ebx, 1
mov dword [0x1029cdbc], edx
cdq
idiv edi
mov dword [0x1029cdc4], edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x24]
movzx ecx, byte [ecx + edx]
mov dword [ebp - 0x34], edx
mov edx, dword [ebp - 0x30]
add ecx, edx
mov eax, ecx
cdq
idiv edi
mov dword [0x1029cdc8], edx
mov ecx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x34]
mov cl, byte [ecx + edi]
mov byte [0x1029cdcc], cl
mov dword [0x1029cdbc], 0x1881
mov ecx, dword [ebp - 0x24]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x24]
mov byte [edx + edi], cl
mov ecx, dword [0x1029cdbc]
add ecx, 0xffffe5a3
mov dword [0x1029cdbc], ecx
mov cl, byte [0x1029cdcc]
mov edx, dword [0x1029cdc8]
mov edi, dword [ebp - 0x24]
mov byte [edi + edx], cl
mov edx, dword [0x1029cdc4]
movzx edx, byte [edi + edx]
mov ecx, dword [0x1029cdc8]
movzx ecx, byte [edi + ecx]
add ecx, edx
mov edx, dword [0x1029cdc0]
mov edi, edx
add edi, 0xffffe0ab
mov dword [0x1029cdc0], edi
and ecx, 0xff
mov dword [0x1029cdd4], ecx
add edx, 0xffffef40
mov dword [0x1029cdbc], edx
mov edx, dword [ebp - 0x24]
mov cl, byte [edx + ecx]
mov edi, dword [ebp - 0x1c]
mov ch, byte [edi + esi]
mov dword [0x1029cdc0], 0x24e4
xor ch, cl
mov edx, dword [ebp - 0x20]
mov byte [edx + esi], ch
mov dword [0x1029cdbc], 0x3f1
mov esi, dword [ebp - 0x10]
cmp ebx, esi
mov dword [ebp - 0x38], ebx
jne 0x10274a2e
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x1029cdc4]
mov dword [ebp - 0x3c], eax
mov eax, 0xffffee0d
mov ecx, dword [0x1029cdc8]
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], esi
jmp 0x10274915
Function at 0x10275149
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov dword [0x1029cdbc], 0x1e9
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.10274416
lea ecx, [0x10274eef]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x48], edx
mov dword [esp + 0x8c], 0x136200
mov edx, dword [0x1029cda8]
mov dword [esp + 0x4c], edx
mov edx, dword [0x1029cdac]
mov dword [esp + 0x6c], edx
mov edx, dword [0x1029cdb0]
mov dword [esp + 0x60], edx
mov edx, dword [0x1029cdb4]
mov dword [esp + 0x5c], edx
mov edx, dword [0x1029cdb8]
mov dword [esp + 0x58], edx
mov dword [0x1029cdbc], 0x155e
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
jne 0x102751f3
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], ecx
je 0x10275211
mov dword [0x1029cdc0], 0x3430
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x102751d0
mov eax, dword [esp + 0x18]
mov dword [esp + 0x50], eax
mov dword [0x1029cdbc], 0x281
mov dword [0x1029cdc0], 0xfffff2c0
mov ecx, dword [esp + 0x14]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x54], edx
call fcn.102759e0
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
jne 0x10275284
lea eax, [esp + 0x28]
add eax, 8
mov dword [esp + 0xc], eax
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.102746e3
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x1027528c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x1029cdc8], 0
mov byte [0x1029cdcc], 0
mov dword [0x1029cdbc], 0xa7
mov dword [0x1029cdc4], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x102752e5
mov dword [0x1029cdc0], 0x2049
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1029cdbc]
add eax, 0xfffffa1a
mov dword [0x1029cdc0], eax
mov eax, dword [0x1029cdc4]
add eax, 1
mov dword [0x1029cdc4], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x102752e5
mov eax, 0x9af
xor ecx, ecx
mov dword [0x1029cdbc], 0x9af
mov dword [0x1029cdc4], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, 0x100
mov dword [0x1029cdd0], 0
mov dword [0x1029cdc0], 0x12e5
mov esi, dword [0x1029cdc8]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + eax]
add ebx, esi
mov dword [ebp - 0x28], eax
xor esi, esi
mov dword [ebp - 0x2c], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add ebx, edx
mov dword [0x1029cdd0], ebx
mov eax, ebx
cdq
mov ebx, dword [ebp - 0x2c]
idiv ebx
mov dword [0x1029cdc8], edx
add ecx, 0xfffffdd7
mov dword [0x1029cdc0], ecx
mov ecx, dword [ebp - 0x28]
mov cl, byte [edi + ecx]
mov byte [0x1029cdcc], cl
mov dword [0x1029cdbc], 0xb6f
mov cl, byte [edi + edx]
mov edx, dword [ebp - 0x28]
mov byte [edi + edx], cl
mov cl, byte [0x1029cdcc]
mov edx, dword [0x1029cdc8]
mov byte [edi + edx], cl
mov edx, dword [0x1029cdc4]
add edx, 1
mov dword [0x1029cdc4], edx
cmp edx, 0x100
mov dword [ebp - 0x30], edx
jge 0x102752d3
mov eax, dword [0x1029cdbc]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jmp 0x1027533b
Function at 0x102756d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [0x1029cdbc], 0x1a9c
mov dword [ebp - 0x10], eax
call fcn.10274ac2
mov ecx, eax
mov dword [0x1029cdbc], 0x281
mov edx, dword [eax + 0x3c]
mov edx, dword [eax + edx + 0x78]
mov dword [0x1029cdc0], 0xfffff3f2
mov esi, ecx
add esi, dword [eax + edx + 0x20]
mov eax, edx
add eax, 0x18
mov edi, ecx
add edi, eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
xor eax, eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx]
cmp edx, 0
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
jne 0x10275782
mov eax, dword [ebp - 0x28]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
mov al, byte [ebp - 0x29]
test al, 1
jne 0x1027583b
jmp 0x10275808
mov eax, dword [ebp - 0x30]
add eax, 1
mov cl, byte [ebp - 0x31]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x29]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x38], eax
jne 0x102757d6
jmp 0x10275748
mov eax, dword [ebp - 0x14]
add eax, 0x24
mov ecx, dword [ebp - 0x18]
add ecx, eax
mov dword [ebp - 0x3c], ecx
mov eax, 0x281
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x3c]
add edx, dword [esi]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x40]
xor esi, esi
mov edi, dword [ebp - 0x1c]
mov ebx, dword [edi + eax*4]
add edx, 0xfffffd5b
mov dword [0x1029cdbc], edx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x38], esi
mov eax, dword [ebp - 0x38]
mov ecx, eax
mov edx, dword [ebp - 0x54]
add ecx, edx
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x31], bh
mov byte [ebp - 0x29], cl
je 0x10275748
jmp 0x10275758
xor eax, eax
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov edx, dword [ebp - 0x50]
add edx, 2
mov esi, dword [ebp - 0x24]
cmp ecx, esi
mov edi, dword [ebp - 0x58]
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x48], ecx
jb 0x102757aa
jmp 0x1027573d
mov eax, dword [ebp - 0x50]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x18]
add edi, dword [edx + ecx*4]
mov dword [0x1029cdbc], 0x94
mov dword [ebp - 0x28], edi
jmp 0x1027573d
Function at 0x102759e0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x34
mov dword [0x1029cdbc], 0x128e
mov dword [ebp - 0xc], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x3c]
mov dword [0x1029cdbc], 0x278
mov esi, dword [0x1029cdc0]
mov edi, esi
add edi, 0xffffe6f4
add esi, 0xffffee35
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], eax
jmp 0x10275aa1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x10275af7
jmp 0x10275b52
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov dword [0x1029cdbc], ecx
mov ecx, dword [ebp - 0x1c]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x28], eax
je 0x10275abf
jmp 0x10275b52
mov eax, dword [ebp - 0x34]
add esp, 0x34
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x38]
add eax, 1
cmp eax, 0x104
mov ecx, dword [ebp - 0x18]
mov edx, eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], eax
jge 0x10275a5a
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
cmp word [ecx + eax*2], 0
mov edx, dword [ebp - 0x20]
mov esi, eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], esi
je 0x10275a5a
jmp 0x10275a84
mov dword [0x1029cdbc], 0x15d0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x10275b52
mov dword [0x1029cdbc], 0x19fd
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x10275a42
jmp 0x10275b52
mov dword [0x1029cdbc], 0x16f
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x10275b52
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x10275b52
mov dword [0x1029cdc0], 0x1349
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff9
shl eax, 1
mov ecx, dword [ebp - 0x1c]
add ecx, eax
mov dword [ebp - 0x3c], ecx
mov eax, 1
mov ecx, dword [ebp - 0x3c]
cmp word [ecx], 0x6c
mov dword [ebp - 0x34], eax
je 0x10275a7a
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10275a7a