joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100370a9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006607b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x6c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, dword [0x10610940]
and eax, 1
jne 0x100370ff
mov eax, dword [0x10610940]
or eax, 1
mov dword [0x10610940], eax
and dword [ebp - 4], 0
mov ecx, 0x106108d8
call fcn.10037f0b
push 0x100667e4
call fcn.1005011c
pop ecx
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x40]
push eax
mov ecx, 0x106108d8
call fcn.10037ed5
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x44]
push eax
mov ecx, 0x106108d8
call fcn.10037ee3
mov ecx, eax
call fcn.10037ef8
movzx eax, al
test eax, eax
je 0x1003714f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x106108d8
call fcn.10037f5f
mov al, byte [eax]
jmp 0x10037289
push dword [ebp + 8]
lea eax, [ebp - 0x64]
push eax
call fcn.10036f0d
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x34]
call fcn.10031260
mov al, byte [eax]
mov byte [ebp - 0x11], al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.10037d8b
lea eax, [ebp - 0x11]
push eax
lea eax, [ebp + 8]
push eax
push 0x106108d8
call fcn.10037072
add esp, 0xc
mov dword [ebp - 0x24], 0x4660
mov dword [ebp - 0x3c], 0x1000ab50
cmp dword [ebp - 0x24], 0x473c
jle 0x10037247
push 0xd7c
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
and dword [ebp - 0x18], 0
jmp 0x100371d0
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6a83
jge 0x10037247
and dword [ebp - 0x1c], 0
jmp 0x100371e6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x7d12
jge 0x10037245
and dword [ebp - 0x20], 0
jmp 0x100371fc
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2522
jge 0x10037243
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
and eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x7c]
call fcn.1000d910
pop ecx
pop ecx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
call fcn.10031260
push eax
call fcn.10050146
pop ecx
lea ecx, [ebp - 0x7c]
call fcn.10031256
jmp 0x100371f5
jmp 0x100371df
jmp 0x100371c9
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x42d6
jge 0x10037260
push dword [ebp - 0x3c]
call fcn.10050146
pop ecx
jmp 0x1003727c
or dword [ebp - 4], 0xffffffff
jmp 0x10037286
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10046f72
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006641e
call fcn.10065410
sub esp, 0x28
push ebx
push esi
mov dword [ebp - 0x18], 8
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], 0xdd2c
push edi
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], esi
jmp 0x10046fb5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x34], 0x3c5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10046fa7
mov dword [ebp - 0x1c], 0x3c7b
cmp dword [ebp - 0x1c], 0x3ec5
jle 0x10047013
push esi
push 0x685
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x24], esi
mov eax, ebx
mov ecx, 0x1060f818
cdq
idiv esi
xor edx, edi
mov eax, edx
cdq
push edx
push eax
call fcn.10031280
inc esi
cmp esi, 0x5045
jl 0x10046fdf
inc ebx
push 0
pop esi
cmp ebx, 0xaca
jl 0x10046fdc
inc edi
cmp edi, 0x4808
jl 0x10046fda
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setle dl
sub edx, 0x4a71b966
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], esi
cmp dword [ebp - 0x1c], 0x3a31
jge 0x1004706e
mov edx, 0x1000b974
mov ecx, 0x1060f818
call fcn.10032d2a
jmp 0x1004706e
mov dword [ebp - 0x14], esi
jmp 0x100470e3
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x34]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x34]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setl dl
mov dword [ebp - 0x18], edx
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
add edx, 0x636c1cd8
mov eax, dword [ebp + eax*4 - 0x34]
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
cmp ecx, 9
mov eax, dword [ebp + eax*4 - 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setg cl
imul ecx, dword [ebp + eax*4 - 0x34]
test ecx, ecx
jne 0x100470da
cmp dword [ebp - 0x20], esi
jne 0x100470da
mov eax, esi
jmp 0x100470dd
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x10047073
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, dword [eax]
mov dword [eax], esi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004768a
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
xor ebx, ebx
mov dword [esp + 0xc], 0xffffffff
push edi
mov dword [esp + 0x10], ebx
jmp 0x100476b6
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x18], 0xe2799ac7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x100476a6
mov dword [esp + 0x10], 1
cmp dword [esp + 0x10], ebx
jl 0x10047770
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x100476e4
push 0xab2
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esp + 0xf], bl
mov dword [esp + 0x14], 0x3da8
cmp dword [esp + 0x14], 0x4187
jle 0x1004773d
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [esp + 0x20]
or eax, esi
cdq
push edx
push eax
call fcn.1000d910
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10047718
mov eax, dword [eax]
push eax
call fcn.10050146
pop ecx
push ebx
push 1
lea ecx, [esp + 0x28]
call fcn.10031721
inc edi
cmp edi, 0x50b5
jl 0x100476fe
inc esi
cmp esi, 0x4431
jl 0x100476fc
cmp byte [esp + 0xf], bl
je 0x10047751
push 0x1ccd
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
cmp dword [esp + 0x14], 0x3afc
jge 0x10047766
push 0x1000ba00
call fcn.10050146
pop ecx
dec dword [esp + 0x10]
jns 0x100476cf
mov eax, dword [esp + 0x10]
push 0x1c57
push 0x58f
push 0x24d5
push 0x8f8
push ebx
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004d206
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006661b
call fcn.10065410
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 0x14], 0x89
cmp dword [ebp - 0x14], 0x3ae
push edi
mov dword [ebp - 0x10], esp
jle 0x1004d25b
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [edi + esi]
mov ecx, 0x1060f818
xor eax, ebx
cdq
push edx
push eax
call fcn.10031280
inc ebx
cmp ebx, 0x675a
jl 0x1004d22e
inc edi
cmp edi, 0x4326
jl 0x1004d22c
inc esi
cmp esi, 0x51ed
jl 0x1004d22a
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x1b
jge 0x1004d274
mov edx, 0x1000c128
mov ecx, 0x1060f818
call fcn.10032d2a
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1004d4f1
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10066639
call fcn.10065410
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x20], 0x703b
cmp dword [ebp - 0x20], 0x7178
push edi
mov dword [ebp - 0x10], esp
jle 0x1004d584
push 0
push 0x85b
call dword [sym.imp.GDI32.dll_SetTextColor]
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
mov ecx, edi
mov dword [ebp - 0x14], esi
xor ebx, ebx
sar esi, cl
xor edi, edi
mov dword [ebp - 0x14], 0x792f
mov eax, edi
mov ecx, 0x1060f818
xor eax, esi
cdq
push edx
push eax
call fcn.10031280
add edi, ebx
dec dword [ebp - 0x14]
jne 0x1004d53d
inc ebx
cmp ebx, 0x277a
jl 0x1004d534
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x2d78
jl 0x1004d52b
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x7c1e
jl 0x1004d526
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x6f7f
jge 0x1004d5a0
mov edx, 0x1000c310
mov ecx, 0x1060f818
call fcn.10032d2a
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1004d6cd
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10066643
call fcn.10065410
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 0x14], 0x7d44
cmp dword [ebp - 0x14], 0x7ea0
push edi
mov dword [ebp - 0x10], esp
jle 0x1004d72e
push 0x1879
call dword [sym.imp.USER32.dll_GetSysColor]
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1060f818
xor eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.10031280
inc ebx
cmp ebx, 0x6a32
jl 0x1004d700
inc edi
cmp edi, 0x57eb
jl 0x1004d6fe
inc esi
cmp esi, 0x3a44
jl 0x1004d6fc
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x7c3f
jge 0x1004d74a
mov edx, 0x1000c3e4
mov ecx, 0x1060f818
call fcn.10032d2a
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100618d5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006c750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10053a78
mov dword [ebp - 0x14], eax
cmp dword [0x1061087c], esi
jne 0x100619c8
push 0x800
push esi
push 0x10007510
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10061955
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10061aa8
push esi
push esi
push 0x10007510
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10061aa8
push 0x10007528
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10061aa8
push eax
call ebx
push 0x10007534
push edi
mov dword [0x1061087c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007544
push edi
mov dword [0x10610880], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007558
push edi
mov dword [0x10610884], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1061088c], eax
test eax, eax
je 0x100619c5
push 0x10007574
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10610888], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100619ed
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x100619e0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10061a02
push 4
pop eax
jmp 0x10061aaa
cmp dword [ebp - 0x14], esi
je 0x10061a02
push dword [0x1061087c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x100619e7
mov eax, dword [0x10610888]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10061a60
cmp dword [0x1061088c], edi
je 0x10061a60
push eax
call ebx
push dword [0x1061088c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10061a60
test eax, eax
je 0x10061a60
call ecx
test eax, eax
je 0x10061a55
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10061a55
test byte [ebp - 8], 1
jne 0x10061a60
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10061a90
mov eax, dword [0x10610880]
cmp eax, edi
je 0x10061a8d
push eax
call ebx
test eax, eax
je 0x10061a8d
call eax
mov esi, eax
test esi, esi
je 0x10061a8d
mov eax, dword [0x10610884]
cmp eax, edi
je 0x10061a8d
push eax
call ebx
test eax, eax
je 0x10061a8d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1061087c]
call ebx
test eax, eax
je 0x10061aa8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10061aaa
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10050f8c
mov esp, ebp
pop ebp
ret
Function at 0x1019a187
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101bb4b8]
jne 0x1019a191
repz ret
jmp fcn.1019bc7b

Function at 0x1019cf6f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1019a28c
and dword [ebp - 4], 0
cmp dword [0x101bd7d8], 0
mov ebx, eax
jne 0x1019d020
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1019d0d1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1019d0d1
push eax
call fcn.1019a21a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101bd7d8], eax
call esi
push eax
call fcn.1019a21a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101bd7dc], eax
call esi
push eax
call fcn.1019a21a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101bd7e0], eax
call esi
push eax
call fcn.1019a21a
pop ecx
mov dword [0x101bd7e8], eax
test eax, eax
je 0x1019d020
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1019a21a
pop ecx
mov dword [0x101bd7e4], eax
mov eax, dword [0x101bd7e4]
cmp eax, ebx
je 0x1019d078
cmp dword [0x101bd7e8], ebx
je 0x1019d078
push eax
call fcn.1019a295
push dword [0x101bd7e8]
mov esi, eax
call fcn.1019a295
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1019d078
test edi, edi
je 0x1019d078
call esi
test eax, eax
je 0x1019d06f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1019d06f
test byte [ebp - 0xc], 1
jne 0x1019d078
or dword [ebp + 0x10], 0x200000
jmp 0x1019d0b1
mov eax, dword [0x101bd7dc]
cmp eax, ebx
je 0x1019d0b1
push eax
call fcn.1019a295
pop ecx
test eax, eax
je 0x1019d0b1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1019d0b1
mov eax, dword [0x101bd7e0]
cmp eax, ebx
je 0x1019d0b1
push eax
call fcn.1019a295
pop ecx
test eax, eax
je 0x1019d0b1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101bd7d8]
call fcn.1019a295
pop ecx
test eax, eax
je 0x1019d0d1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1019d0d3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1019ead2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov dword [0x101baf40], 0x1dce
mov dword [ebp - 0x10], eax
call fcn.1019fa0c
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x1019eb18
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x101baf3c], 0x18ed
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
je 0x1019eb75
jmp 0x1019eb80
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [0x101baf40], 0x1dce
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], edx
jmp 0x1019eb94
mov eax, dword [ebp - 0x30]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], eax
jmp 0x1019eb4f
mov eax, dword [ebp - 0x48]
mov ecx, eax
mov edx, dword [ebp - 0x44]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x4d], bh
mov byte [ebp - 0x4e], cl
je 0x1019ebe6
mov al, byte [ebp - 0x4d]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x4c]
add edx, 1
mov ah, byte [ebp - 0x4e]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x48], edx
jne 0x1019eb94
mov al, byte [ebp - 0x4e]
test al, 1
jne 0x1019ec1c
jmp 0x1019ebef
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 2
mov edx, dword [ebp - 0x3c]
add edx, 1
mov esi, dword [ebp - 0x2c]
cmp edx, esi
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], eax
jb 0x1019eb4f
jmp 0x1019eb75
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
mov dword [0x101baf3c], 0x1941
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x101baf40], 0x92b
mov dword [ebp - 0x30], edi
jmp 0x1019eb75
Function at 0x1019ef62
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x1019efcf
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1019f05f
jmp 0x1019f072
mov eax, 1
mov ecx, 0x18d0
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
je 0x1019f081
jmp 0x1019f072
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
je 0x1019effc
mov eax, dword [ebp - 0x24]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], eax
jl 0x1019efcf
mov eax, dword [ebp - 0x28]
mov dword [0x101baf40], 0x258e
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
jne 0x1019f072
mov dword [0x101baf3c], 0x636
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x1019f072
mov dword [0x101baf3c], 0x3d46
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1019f072
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1019ef8f
jmp 0x1019f072
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x1019efa7
xor eax, eax
mov ecx, 0x1088
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jmp 0x1019f081
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [0x101baf3c], eax
mov eax, ecx
add esp, 0x24
pop esi
pop ebp
ret
Function at 0x1019f248
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101baf48], 0
mov byte [0x101baf4c], 0
mov edi, dword [0x101baf3c]
add edi, 0xfffff8e9
mov dword [0x101baf40], edi
mov dword [0x101baf44], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1019f35c
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x101baf50], 0
mov edi, dword [0x101baf48]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x101baf50], esi
mov dword [0x101baf3c], 0xa1b
mov eax, esi
cdq
idiv ecx
mov dword [0x101baf48], edx
mov dword [0x101baf40], 0xd32
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x101baf4c], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x101baf4c]
mov esi, dword [0x101baf48]
mov byte [ebx + esi], cl
mov esi, dword [0x101baf44]
add esi, 1
mov dword [0x101baf44], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x1019f2a2
jmp 0x1019f29a
xor eax, eax
mov dword [0x101baf44], 0
mov dword [ebp - 0x20], eax
jmp 0x1019f2a2
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov dword [0x101baf3c], 0x7c1
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x101baf40], 0x17ea
mov eax, dword [0x101baf44]
add eax, 1
mov dword [0x101baf44], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1019f35c
jmp 0x1019f348
Function at 0x1019f748
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x101baf40], 0x1e49
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
jmp 0x1019f774
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x101a0929]
mov dh, byte [eax + 0x101a08fa]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
jne 0x1019f774
lea eax, [ebp - 0x24]
mov dword [0x101baf40], 0x1a22
mov ecx, dword [0x101baf3c]
add ecx, 0xffffefe3
mov dword [0x101baf3c], ecx
mov dword [ebp - 0x34], eax
call fcn.1019ec4e
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.1019e866
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x1019f76c
mov dword [0x101baf3c], 0x2091
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.1019f09f
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x101baf3c], 0x1f7a
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x24], ecx
mov dword [0x101baf40], 0x8aa
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x18], ecx
add ecx, 0x2097
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x1019f87d
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret