joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002fc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002184e
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1002d018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
test byte [0x10160d34], 1
jne 0x1000305b
or dword [0x10160d34], 1
mov edi, 0x102368e5
lea esi, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.1001ace0
mov esi, eax
mov ecx, 0x102368f9
lea eax, [ebp - 0x1c]
call fcn.1001ac60
push esi
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.1001eeb0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10160d30], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov word [ebp - 0x20], ax
mov byte [ebp - 0x1e], al
mov dword [ebp - 4], 0xffffffff
push 0
push 0xffffffffffffffff
call dword [0x10160d30]
test eax, eax
jne 0x10003070
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f345
mov esp, ebp
pop ebp
ret
Function at 0x1000a290
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10021538
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x1002d018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x20
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_]
xor esi, esi
add esp, 4
cmp eax, esi
je 0x1000a2df
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0x10], esi
mov dword [eax + 0x14], esi
mov dword [eax + 0x18], esi
jmp 0x1000a2e1
xor eax, eax
mov ecx, dword [0x10160c70]
mov dword [0x10160894], eax
add ecx, 0x86568
mov eax, 0xa
call fcn.1000a050
mov ecx, 0xeb
xor eax, eax
mov dl, byte [eax + 0x1002736c]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x2c], dl
jns 0x1000a320
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1b
jl 0x1000a303
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], esi
mov ecx, dword [0x10160498]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x2c]
push edx
call eax
mov ecx, eax
mov eax, 0x50
call fcn.1000a050
mov dword [ebp - 4], 0xffffffff
call fcn.1000a190
cmp eax, esi
je 0x1000a35f
mov eax, dword [eax + 0x34]
jmp 0x1000a361
xor eax, eax
mov dword [0x1015fde4], eax
call fcn.1000a190
cmp eax, esi
je 0x1000a374
mov eax, dword [eax + 0x30]
jmp 0x1000a376
xor eax, eax
mov dword [0x1015fbb4], eax
call fcn.1000a190
cmp eax, esi
jbe 0x1000a387
lea esi, [eax + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [ebp - 0x34]
push ecx
push 0x40
push 4
push esi
call edi
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x38]
push edx
push eax
push 4
push esi
mov dword [esi], 0x1000a230
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 4
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
call fcn.1000a190
test eax, eax
je 0x1000a3cb
mov esi, dword [eax + 0xc]
jmp 0x1000a3cd
xor esi, esi
lea ecx, [ebp - 0x30]
push ecx
push 0x40
push 1
push esi
call edi
push 1
push 0x1002765c
push esi
call dword [sym.imp.MSVCR100.dll_memmove]
mov eax, dword [ebp - 0x30]
add esp, 0xc
lea edx, [ebp - 0x3c]
push edx
push eax
push 1
push esi
call edi
push 1
push esi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f345
mov esp, ebp
pop ebp
ret
Function at 0x1000a440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10020528
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1002d018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov ecx, 0x49
xor eax, eax
mov bl, byte [eax + 0x100262a4]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], bl
jns 0x1000a48f
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1c
jl 0x1000a472
mov byte [ebp - 0x14], dl
mov dword [ebp - 4], edx
mov ecx, dword [0x10160498]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x30]
push edx
call eax
add eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax + ecx*4]
add eax, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f345
mov esp, ebp
pop ebp
ret 8

Function at 0x1000a6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100204f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1002d018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov ecx, 0x1f
xor eax, eax
mov bl, byte [eax + str.Vfira_nuINF_OY]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x2c], bl
jns 0x1000a70f
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x17
jl 0x1000a6f2
mov byte [ebp - 0x15], dl
mov dword [ebp - 4], edx
mov ecx, dword [0x10160498]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x2c]
push edx
call eax
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001f345
mov esp, ebp
pop ebp
ret 4

Function at 0x1000ab20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10020418
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1002d018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov ecx, 0x8d
xor eax, eax
mov bl, byte [eax + 0x10027738]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], bl
jns 0x1000ab6f
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x13
jl 0x1000ab52
mov byte [ebp - 0x11], dl
mov dword [ebp - 4], edx
mov ecx, dword [0x10160498]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x24]
push edx
call eax
fld dword [ebp + 8]
mov eax, dword [eax + esi + 0xc]
fstp dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f345
mov esp, ebp
pop ebp
ret 4
Function at 0x1000abc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100203e8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1002d018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x1c
xor eax, eax
nop
mov dl, byte [eax + 0x1002774c]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x24], dl
jns 0x1000ac0d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x1000abf0
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x10160498]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x24]
push edx
call eax
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx + 0xc]
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x14], cx
fld dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f345
mov esp, ebp
pop ebp
ret 4

Function at 0x1000ad80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10021500
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1002d018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, 0xa3
xor eax, eax
mov dl, byte [eax + 0x1002777c]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], dl
jns 0x1000add1
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1d
jl 0x1000adb4
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x10160498]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x30]
push edx
call eax
test eax, eax
setne al
mov dword [ebp - 4], 0xffffffff
test al, al
je 0x1000ae3d
mov edi, 0x101990b0
lea esi, [ebp - 0x30]
call fcn.1001b700
mov dword [ebp - 4], 1
mov ecx, dword [0x10160498]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
push 0
lea esi, [ebx + eax]
call fcn.1000a190
mov edi, eax
mov eax, esi
mov ebx, 0x44
call fcn.1000a110
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f345
mov esp, ebp
pop ebp
ret
Function at 0x1000ae60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10020388
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1002d018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0xeb
xor eax, eax
nop
mov dl, byte [eax + 0x10027058]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], dl
jns 0x1000aead
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1c
jl 0x1000ae90
mov byte [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x10160498]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x30]
push edx
call eax
add eax, dword [0x10160494]
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x14], cl
push edi
mov ecx, esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f345
mov esp, ebp
pop ebp
ret

Function at 0x1000b040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100214c8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1002d018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov ecx, 0x31
xor eax, eax
mov bl, byte [eax + 0x100277cc]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], bl
jns 0x1000b090
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1d
jl 0x1000b073
mov byte [ebp - 0x13], dl
mov dword [ebp - 4], edx
mov ecx, dword [0x10160498]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x30]
push edx
call eax
push 2
lea ebx, [esi + eax]
call fcn.1000a190
mov edi, eax
mov eax, ebx
mov ebx, 0xe
call fcn.1000a110
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f345
mov esp, ebp
pop ebp
ret
Function at 0x1000b0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100202f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1002d018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x31
xor eax, eax
nop
mov dl, byte [eax + 0x100277ec]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x2c], dl
jns 0x1000b12d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1b
jl 0x1000b110
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x10160498]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x2c]
push edx
call eax
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx + 0xc]
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f345
mov esp, ebp
pop ebp
ret 4
Function at 0x100156e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp + 8]
jne 0x10015719
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1001571d
cmp edx, esi
jne 0x10015702
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp + 8]
jne 0x1001573d
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10015741
cmp edx, esi
jne 0x10015726
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp + 8]
jne 0x10015761
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10015765
cmp edx, esi
jne 0x1001574a
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017960
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1002d018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [ebp + 0xc]
dec eax
jne 0x100179bc
mov byte [ebp - 6], al
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], 0x742e4d47
mov word [ebp - 8], 0x7478
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
push esi
mov dword [ebp - 0xc], eax
mov word [ebp - 8], ax
mov byte [ebp - 6], al
call fcn.100156e0
add esp, 4
call fcn.1001f0f0
mov ecx, eax
call fcn.1001f030
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.1001f345
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10019840
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10021918
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1002d018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [edi + 0x44], 0
je 0x10019998
cmp byte [edi + 0x49], 0
je 0x10019998
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x1001998c
lea esi, [ebp - 0x2c]
call fcn.10019530
mov dword [ebp - 4], 0
mov ebx, 0x10
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
cmp eax, ebx
jae 0x100198eb
lea ecx, [ebp - 0x2c]
mov eax, ecx
add ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
lea eax, [edi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x100198f0
dec eax
je 0x100198f4
sub eax, 2
lea esi, [ebp - 0x2c]
je 0x10019993
call fcn.100013c0
xor al, al
jmp 0x1001999a
mov eax, dword [ebp - 0x2c]
jmp 0x100198b5
mov byte [edi + 0x49], 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
mov eax, edx
cmp ecx, ebx
jae 0x10019903
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, eax
je 0x10019928
mov eax, edx
cmp ecx, ebx
jae 0x10019913
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x10019984
cmp byte [edi + 0x49], 0
je 0x10019990
test esi, esi
jne 0x100198a6
mov eax, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, eax
cmp edx, 8
jbe 0x100199b5
lea esi, [eax + 8]
lea eax, [ebp - 0x2c]
call fcn.10001640
test al, al
je 0x100198a6
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], ebx
jae 0x10019961
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x18], ebx
jae 0x1001997b
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x100198a6
lea esi, [ebp - 0x2c]
call fcn.100013c0
xor al, al
jmp 0x1001999a
lea esi, [ebp - 0x2c]
call fcn.100013c0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f345
mov esp, ebp
pop ebp
ret
push 0x10024a1c
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
int3

Function at 0x1001abe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0xf1
xor ecx, ecx
jmp 0x1001abf0
mov al, byte [edi + ecx - 0x210f19]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001ac0d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001abf0
mov byte [esi + 0xc], 0
mov eax, esi
ret
Function at 0x1001b2b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 2
xor ecx, ecx
jmp 0x1001b2c0
mov al, byte [edi + ecx - 0x321a2a]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001b2dd
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0x26
jl 0x1001b2c0
mov byte [esi + 0x26], 0
mov eax, esi
ret

Function at 0x1001b2f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 2
xor ecx, ecx
jmp 0x1001b300
mov al, byte [edi + ecx - 0x321a2a]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001b31d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0x20
jl 0x1001b300
mov byte [esi + 0x20], 0
mov eax, esi
ret

Function at 0x1001b930
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x29
xor ecx, ecx
jmp 0x1001b940
mov al, byte [edi + ecx + 0x1e7b41dd]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001b95d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001b940
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001b970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x6c
xor ecx, ecx
jmp 0x1001b980
mov al, byte [edi + ecx + 0x6fad512a]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001b99d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001b980
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001b9b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x49
xor ecx, ecx
jmp 0x1001b9c0
mov al, byte [edi + ecx + 0x16440e0f]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001b9dd
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001b9c0
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001c190
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0xfa
xor ecx, ecx
jmp 0x1001c1a0
mov al, byte [edi + ecx - 0x2b3158]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001c1bd
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001c1a0
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001c500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x1f
xor ecx, ecx
jmp 0x1001c510
mov al, byte [edi + ecx - 0x97d5a03]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001c52d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001c510
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001ca80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x87
xor ecx, ecx
jmp 0x1001ca90
mov al, byte [edi + ecx - 0x24993e0c]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001caad
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001ca90
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001cb00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x30
xor ecx, ecx
jmp 0x1001cb10
mov al, byte [edi + ecx + 0x5ec4cd49]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001cb2d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001cb10
mov byte [esi + 0xc], 0
mov eax, esi
ret
Function at 0x1001cd20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0xfe
xor ecx, ecx
jmp 0x1001cd30
mov al, byte [edi + ecx - 0x71ebf2be]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001cd4d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001cd30
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001ea10
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10021b48
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x1002d018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x10
mov byte [ebp - 0x7c], al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
jae 0x1001ea73
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0x18]
lea esi, [ebp - 0x7c]
call fcn.1001e7d0
mov ecx, esi
call fcn.1001e880
mov ecx, edi
mov ebx, esi
call fcn.1001e960
cmp dword [ebp + 0x1c], 0x10
jb 0x1001eaa2
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f345
mov esp, ebp
pop ebp
ret
Function at 0x1001eda0
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100213c8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1002d018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
xor edx, edx
mov ecx, 0x49
xor eax, eax
lea esp, [esp]
mov bl, byte [eax + 0x10028438]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x20], bl
jns 0x1001edfd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x1001ede0
mov byte [ebp - 0x14], dl
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], edx
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov ebx, dword [ebx]
mov ebx, dword [ebx]
mov ebx, dword [ebx + 0x10]
mov dword [ebp - 0x2c], ebx
mov edx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x20]
push ecx
push edx
call fcn.1001eb60
add esp, 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x30]
call dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x1001ee51
xor eax, eax
jmp 0x1001ee88
push esi
push eax
call fcn.1001eb60
add esp, 8
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1001ee4d
test edi, edi
jle 0x1001ee7f
lea eax, [ebp + 0xc]
mov ecx, edi
jmp 0x1001ee70
mov edx, dword [eax + 4]
add eax, 4
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
dec ecx
jne 0x1001ee70
call dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001f345
mov esp, ebp
pop ebp
ret

Function at 0x1001f345
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002d018]
jne 0x1001f34f
repz ret
jmp fcn.1001f80d