joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4397b0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
cmp eax, 0
setne al
jmp 0x4397d1
jmp 0x4397d3
xor ebx, ebx
test al, 1
jne 0x4397de
jmp 0x43991b
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
jmp 0x43980c
cmp edi, 0
setne al
jmp 0x439814
xor ebx, ebx
test al, 1
jne 0x43981f
jmp 0x439915
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov esi, eax
mov dword [esp], esi
call fcn.0041a290
mov ebp, eax
cmp ebp, 0
setne al
jmp 0x43983f
xor ebx, ebx
test al, 1
jne 0x43984a
jmp 0x439909
mov al, byte [esp + 0x20]
mov byte [esp + 0x24], al
mov byte [esp + 0x10], 0x73
mov byte [esp + 0x11], 0xa5
mov byte [esp + 0x12], 0xab
mov byte [esp + 0x13], 0xa3
mov byte [esp + 0x14], 0x8e
mov byte [esp + 0x15], 0xba
mov byte [esp + 0x16], 0x8f
mov byte [esp + 0x17], 0xbd
mov byte [esp + 0x18], 0xb4
mov byte [esp + 0x19], 0x7f
mov byte [esp + 0x1a], 0xa6
mov byte [esp + 0x1b], 0xa3
mov byte [esp + 0x1c], 0xa8
mov byte [esp + 0x1d], 0x25
mov eax, 0xe
mov byte [esp + eax + 0x10], 0
add eax, 1
cmp eax, 0x10
jne 0x43989d
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x10
jae 0x4398e7
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x10]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0043d400
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x10], al
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
jmp 0x4398b2
jmp 0x4398e9
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x3c]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
call fcn.0040d3f0
sub esp, 0xc
mov bl, al
and bl, 1
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43fbc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
mov ebx, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx + 2], 0
lea ebx, [ebx + 2]
jne 0x43fbe0
mov dword [esp + 4], 0xf2f2f063
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x43fc36
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.00443d10
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x43fc10
test ebx, ebx
je 0x43fc9e
sar ebx, 1
mov eax, dword [esp + 4]
lea ecx, [ebx - 1]
mov edx, ebx
and edx, 3
je 0x43fc61
mov ebp, esi
nop
nop
nop
nop
dec ebx
movzx esi, word [edi]
add edi, 2
xor esi, ebp
imul esi, eax
mov ebp, esi
dec edx
jne 0x43fc50
cmp ecx, 3
jb 0x43fc9e
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, word [edi + ecx*2]
xor edx, esi
imul edx, eax
movzx esi, word [edi + ecx*2 + 2]
xor esi, edx
imul esi, eax
movzx edx, word [edi + ecx*2 + 4]
xor edx, esi
imul edx, eax
movzx esi, word [edi + ecx*2 + 6]
xor esi, edx
imul esi, eax
add ecx, 4
cmp ebx, ecx
jne 0x43fc70
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x44]
mov ebx, 0xffffffff
mov eax, 0xfffffffe
mov edx, 0xfffffffd
nop
nop
nop
nop
nop
nop
mov esi, ebx
add eax, 2
add edx, 3
cmp byte [edi + ebx + 1], 0
lea ebx, [ebx + 1]
jne 0x440ac0
shr edx, 2
mov ecx, ebx
xor ecx, 1
and eax, 0xfffffffc
sub eax, ecx
movzx eax, byte [edi + eax]
cmp eax, 0x3d
je 0x440aed
cmp eax, 0x2e
jne 0x440aee
dec edx
movzx eax, byte [edi + ebx - 2]
cmp eax, 0x3d
je 0x440afd
cmp eax, 0x2e
jne 0x440afe
dec edx
mov dword [esp + 4], edx
mov edx, 0
test ebx, ebx
je 0x440c01
xor ecx, ecx
mov ebp, 2
mov dword [esp + 8], ebx
jmp 0x440b36
mov edx, ebx
nop
nop
lea eax, [ebp + 4]
add ebp, 2
mov ecx, edx
mov ebx, dword [esp + 8]
cmp ebp, ebx
mov ebp, eax
jae 0x440c01
mov dword [esp + 0xc], ecx
mov esi, dword [esp + 0x44]
movzx eax, byte [esi + ebp - 2]
push eax
call fcn.004213e0
add esp, 4
mov edi, ebx
mov bh, al
movzx eax, byte [esi + ebp - 1]
mov esi, dword [esp + 0xc]
push eax
call fcn.004213e0
add esp, 4
mov bl, al
shl bh, 2
shr al, 4
and al, 3
or al, bh
lea edx, [esi + 1]
mov ecx, dword [esp + 0x48]
mov byte [ecx + esi], al
cmp ebp, edi
jae 0x440b20
mov eax, dword [esp + 0x44]
movzx eax, byte [eax + ebp]
push eax
mov dword [esp + 4], edx
call fcn.004213e0
mov edx, dword [esp + 4]
add esp, 4
cmp al, 0x40
je 0x440b20
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
lea ebx, [esi + 2]
mov edx, dword [esp + 0x48]
mov byte [edx + esi + 1], cl
lea ecx, [ebp + 1]
cmp ecx, dword [esp + 8]
jae 0x440b1c
mov ecx, dword [esp + 0x44]
movzx ecx, byte [ecx + ebp + 1]
push ecx
mov byte [esp + 4], al
call fcn.004213e0
add esp, 4
movzx ecx, byte [esp]
cmp al, 0x40
mov edx, ebx
je 0x440b20
shl cl, 6
mov edx, eax
and dl, cl
add dl, dl
xor cl, al
add cl, dl
mov eax, dword [esp + 0x48]
mov byte [eax + esi + 2], cl
add esi, 3
mov edx, esi
jmp 0x440b20
mov ebx, dword [esp + 4]
cmp edx, ebx
mov eax, 0
jne 0x440c95
mov esi, dword [esp + 0x48]
lea edx, [esi + 0x20]
lea edi, [esp + 0x10]
mov eax, esi
mov ecx, 8
xchg esi, eax
rep movsd dword es:[edi], dword [esi]
xchg esi, eax
lea edi, [esp + 0x30]
xor ebp, ebp
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
mov eax, ebx
add eax, 0xffffffe0
je 0x440c91
cmp ebx, 0x21
je 0x440c7b
mov ecx, eax
and ecx, 0xfffffffe
xor ebp, ebp
nop
nop
nop
nop
nop
nop
mov edx, ebp
and edx, 0x1e
movzx edx, byte [esp + edx + 0x10]
xor dl, byte [esi + ebp + 0x20]
mov byte [esi + ebp], dl
lea edx, [ebp + 1]
and edx, 0x1f
movzx edx, byte [esp + edx + 0x10]
xor dl, byte [esi + ebp + 0x21]
mov byte [esi + ebp + 1], dl
add ebp, 2
cmp ecx, ebp
jne 0x440c50
test bl, 1
je 0x440c91
mov ecx, ebp
and ecx, 0x1f
movzx ecx, byte [esp + ecx + 0x10]
xor cl, byte [esi + ebp + 0x20]
mov byte [esi + ebp], cl
mov byte [esi + eax], 0
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x447d90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x3c]
movzx esi, word [ebx]
mov dword [esp + 0xc], 0xc1c6bdb3
mov dword [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x447de6
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0xc]
push dword [esp]
push eax
call fcn.00448470
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x447dc0
xor ecx, ecx
cmp dword [esp + 0xc], esi
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x455650]
mov esi, dword [ebx + 0x3c]
mov edi, dword [ebx + esi]
mov dword [esp + 0xc], 0xe9ea2034
mov byte [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 4
ja 0x447e46
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 0xc]
push dword [esp]
push eax
call fcn.00448510
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 5
jb 0x447e20
xor ecx, ecx
cmp edi, dword [esp + 0xc]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x455658]
mov ebp, dword [ebx + esi + 0x78]
cmp dword [ebx + esi + 0x7c], 0
sete al
test ebp, ebp
sete cl
or cl, al
movzx ecx, cl
xor eax, eax
mov dword [esp + 4], ebp
jmp dword [ecx*4 + 0x455660]
mov eax, dword [ebx + ebp + 0x20]
add eax, ebx
mov dword [esp + 0x24], eax
mov eax, dword [ebx + ebp + 0x24]
add eax, ebx
mov dword [esp + 0x20], eax
mov eax, dword [ebx + ebp + 0x1c]
add eax, ebx
mov dword [esp + 0x1c], eax
mov edi, dword [0x457080]
xor eax, eax
test edi, edi
sete al
jmp dword [eax*4 + 0x455668]
jmp dword [0x455680]
mov eax, dword [ebx + ebp + 0x18]
mov ecx, 0xffffffff
cmp eax, 0x20000000
jae 0x447ecd
shl eax, 3
mov ecx, eax
push ecx
call fcn.0040c580
add esp, 4
mov dword [0x457080], eax
mov eax, dword [0x45567c]
jmp eax
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44a1d8
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x3c]
movzx esi, word [edi]
mov dword [esp + 4], 0x2322cbdd
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x44a106
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0044c210
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x44a0e0
xor eax, eax
cmp dword [esp + 4], esi
setne al
xor esi, esi
jmp dword [eax*4 + 0x455bdc]
jmp dword [0x455be8]
mov dword [esp + 4], 0x696aa0d4
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja case.0x44a111.3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0044c2a0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x44a150
jmp case.0x44a111.3
jmp dword [0x455bf0]
mov ebx, dword [edi + 0x3c]
mov ebp, dword [edi + ebx]
mov dword [esp + 4], 0x696aa0d4
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x44a180
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0044c2a0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x44a1b0
jmp 0x44a180
xor eax, eax
cmp ebp, dword [esp + 4]
setne al
jmp dword [eax*4 + 0x455bf4]
mov ebp, dword [edi + ebx + 0x78]
mov edx, dword [edi + ebx + 0x7c]
test edx, edx
sete al
test ebp, ebp
sete cl
or cl, al
movzx eax, cl
jmp dword [eax*4 + 0x455bfc]
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x102a4345
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1033fee0]
jne 0x102a434f
repz ret
jmp fcn.102a5a98

Function at 0x102a5551
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.102a3793
and dword [ebp - 4], 0
cmp dword [0x10340df0], 0
mov ebx, eax
jne 0x102a5602
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x102a56b3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x102a56b3
push eax
call fcn.102a3721
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10340df0], eax
call esi
push eax
call fcn.102a3721
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10340df4], eax
call esi
push eax
call fcn.102a3721
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10340df8], eax
call esi
push eax
call fcn.102a3721
pop ecx
mov dword [0x10340e00], eax
test eax, eax
je 0x102a5602
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.102a3721
pop ecx
mov dword [0x10340dfc], eax
mov eax, dword [0x10340dfc]
cmp eax, ebx
je 0x102a565a
cmp dword [0x10340e00], ebx
je 0x102a565a
push eax
call fcn.102a379c
push dword [0x10340e00]
mov esi, eax
call fcn.102a379c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x102a565a
test edi, edi
je 0x102a565a
call esi
test eax, eax
je 0x102a5651
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x102a5651
test byte [ebp - 0xc], 1
jne 0x102a565a
or dword [ebp + 0x10], 0x200000
jmp 0x102a5693
mov eax, dword [0x10340df4]
cmp eax, ebx
je 0x102a5693
push eax
call fcn.102a379c
pop ecx
test eax, eax
je 0x102a5693
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x102a5693
mov eax, dword [0x10340df8]
cmp eax, ebx
je 0x102a5693
push eax
call fcn.102a379c
pop ecx
test eax, eax
je 0x102a5693
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10340df0]
call fcn.102a379c
pop ecx
test eax, eax
je 0x102a56b3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x102a56b5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x102a7230
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x1033fb60], 0
mov byte [0x1033fb64], 0
mov esi, dword [0x1033fb58]
add esi, 0x18df
mov dword [0x1033fb54], esi
mov dword [0x1033fb5c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov eax, dword [0x1033fb5c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1033fb58]
add eax, 0x8e7
mov dword [0x1033fb54], eax
mov eax, dword [0x1033fb5c]
add eax, 1
mov dword [0x1033fb5c], eax
cmp eax, 0x100
jl 0x102a7278
mov dword [0x1033fb58], 0x17f2
mov dword [0x1033fb5c], 0
mov eax, 0x100
mov dword [0x1033fb68], 0
mov dword [0x1033fb54], 0x2036
mov ecx, dword [0x1033fb60]
mov edx, dword [0x1033fb5c]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + edx]
add edi, ecx
mov dword [ebp - 0x1c], eax
mov eax, edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
div ecx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add edi, edx
mov dword [0x1033fb68], edi
mov dword [0x1033fb54], 0x2fe
mov eax, edi
cdq
mov edi, dword [ebp - 0x1c]
idiv edi
mov dword [0x1033fb60], edx
mov ecx, dword [0x1033fb5c]
mov cl, byte [esi + ecx]
mov byte [0x1033fb64], cl
mov dword [0x1033fb54], 0xe52
mov cl, byte [esi + edx]
mov edx, dword [0x1033fb5c]
mov byte [esi + edx], cl
mov cl, byte [0x1033fb64]
mov edx, dword [0x1033fb60]
mov byte [esi + edx], cl
mov dword [0x1033fb54], 0x8c0
mov edx, dword [0x1033fb5c]
add edx, 1
mov dword [0x1033fb5c], edx
cmp edx, 0x100
jl 0x102a72c0
mov dword [0x1033fb54], 0x596
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x102a77c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x64
mov eax, dword [ebp + 8]
mov ecx, dword [0x1033fb58]
add ecx, 0xffffdb43
mov dword [0x1033fb54], ecx
mov dword [ebp - 0x30], eax
call fcn.102a79b0
xor ecx, ecx
mov edx, dword [0x1033fb58]
mov esi, edx
add esi, 0xffffda05
mov dword [0x1033fb58], esi
add edx, 0xffffe6b8
mov dword [0x1033fb54], edx
mov edx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
lea edx, section..data
imul esi, eax, 0x148
mov edi, edx
add edi, esi
add edi, 0x88
mov esi, dword [edi]
imul edi, eax, 0x148
add edx, edi
add edx, 0x44
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x728
mov ecx, edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
jne 0x102a7813
lea eax, [0x102aa9f3]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], ecx
call fcn.102a8520
mov dword [0x1033fb54], 0x5e1
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call fcn.102a73b0
mov ecx, eax
mov dword [0x1033fb74], eax
mov eax, esp
mov edx, dword [ebp - 0x40]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
lea edx, section..data
imul esi, eax, 0x148
mov edi, edx
add edi, esi
add edi, 0x88
mov esi, dword [edi]
imul edi, eax, 0x148
mov ebx, edx
add ebx, edi
mov edi, dword [ebx]
imul ebx, eax, 0x148
add edx, ebx
add edx, 0x44
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x4c]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], edx
call fcn.102a71b0
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
add eax, ecx
mov edx, dword [ebp - 0x58]
add edx, 1
cmp edx, 0x728
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], edx
jne 0x102a78cf
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x40]
mov dword [esp + 8], ecx
call fcn.102a8260
xor eax, eax
mov ecx, dword [ebp - 0x4c]
add ecx, 0x5984f
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov dword [0x1033fb54], 0x18b4
mov dword [edx + 4], 0x131000
mov ecx, dword [ebp - 0x4c]
add ecx, 0x9a8a
mov dword [edx + 8], ecx
mov dword [0x1033fb54], 0x10fa
mov dword [edx + 0xc], 0x1f20
mov dword [0x1033fb58], 0x222
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x102a79d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, 0x222c
lea ecx, [fcn.102a79d0]
mov edx, dword [0x1033fb54]
add edx, 0xfffff9fd
mov dword [0x1033fb58], edx
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
jne 0x102a7a2b
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x102a7a2b
mov eax, dword [ebp - 0x10]
mov dword [0x1033fb54], eax
mov eax, dword [ebp - 0xc]
add esp, 0x10
pop ebp
ret
mov eax, dword [ebp - 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffff15a
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
jmp 0x102a79f9

Function at 0x102a7dd0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1033fb5c], 0
mov dword [0x1033fb60], 0
mov dword [0x1033fb6c], 0
mov dword [0x1033fb54], 0x37e5
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
je 0x102a7f15
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov edx, dword [0x1033fb54]
mov esi, dword [0x1033fb5c]
add esi, 1
mov dword [ebp - 0x24], eax
mov eax, esi
mov dword [ebp - 0x28], edx
cdq
idiv ecx
mov dword [0x1033fb5c], edx
mov esi, dword [ebp - 0x28]
add esi, 0xfffff532
mov dword [0x1033fb54], esi
mov esi, dword [0x1033fb60]
mov edi, dword [ebp - 0x1c]
movzx edx, byte [edi + edx]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x1033fb60], edx
mov ecx, dword [0x1033fb5c]
mov bl, byte [edi + ecx]
mov byte [0x1033fb64], bl
mov dword [0x1033fb54], 0x2339
mov bl, byte [edi + edx]
mov ecx, dword [0x1033fb5c]
mov byte [edi + ecx], bl
mov ecx, dword [0x1033fb58]
add ecx, 0xffffe986
mov dword [0x1033fb54], ecx
mov bl, byte [0x1033fb64]
mov ecx, dword [0x1033fb60]
mov byte [edi + ecx], bl
mov ecx, dword [0x1033fb5c]
movzx ecx, byte [edi + ecx]
mov edx, dword [0x1033fb60]
movzx edx, byte [edi + edx]
add edx, ecx
and edx, 0xff
mov dword [0x1033fb6c], edx
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x24]
mov bl, byte [ecx + esi]
xor bl, byte [edi + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], bl
mov dword [0x1033fb54], 0x14
add esi, 1
mov ecx, dword [ebp - 0x10]
cmp esi, ecx
mov dword [ebp - 0x20], esi
jne 0x102a7e29
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x102a8030
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov eax, dword [0x1033fb58]
mov ecx, eax
add ecx, 0xffffe774
mov dword [0x1033fb54], ecx
mov dword [ebp - 8], 0
add eax, 0xfffff8cf
mov dword [0x1033fb58], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov dword [0x1033fb58], 0x1db6
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x102a8096
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [0x1033fb54], ecx
add esp, 0x24
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
je 0x102a80c3
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], eax
jl 0x102a8096
mov eax, dword [ebp - 0x24]
mov ecx, dword [0x1033fb54]
add ecx, 0xffffeba9
mov dword [0x1033fb58], ecx
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x28], eax
jne 0x102a8181
mov dword [0x1033fb58], 0x2678
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x102a8181
mov dword [0x1033fb54], 0x734
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x102a8181
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x102a8181
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x102a8181
mov dword [0x1033fb58], 0x224e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x102a8181
mov eax, 0x231f
mov ecx, 1
mov dword [0x1033fb58], 0x260f
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x28]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
je 0x102a8084
xor eax, eax
mov ecx, dword [0x1033fb54]
add ecx, 0xffffdeca
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
jmp 0x102a8084
Function at 0x2002cea
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edx + 0x6dfffffc], edi
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.02002484
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.02002439
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.02002484
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.02002439
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]