joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f63ec
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push dword [0x5cbb00]
call sub.user32.dll_OpenClipboard
push dword [0x5cb020]
call sub.user32.dll_GetClipboardData
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4f65a8
push edi
push 0
push 0
call fcn.004f5169
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalWire
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
push edi
call sub.user32.dll_GetClientRect
mov byte [ebp - 5], 0
mov dword [ebp - 0xc], 0
push 0x508
lea eax, [ebp - 4]
push eax
call sub.mclib32.dll__ALLOCATE_8
imul eax, dword [ebp - 0xc], 0x508
add eax, dword [ebp - 0x14]
push eax
mov eax, 0x508
push dword [ebp - 4]
call fcn.0056cfd2
mov ecx, dword [ebp - 4]
lea eax, [ecx + 0x64]
push eax
call sub.combase.dll_CoCreateGuid
xor edx, edx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x28], edi
mov dword [ecx + 0x2c], edx
mov dword [ecx + 0x20], edx
mov eax, dword [esi + reloc.gdi32.dll_AbortDoc]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + reloc.gdi32.dll_AbortDoc]
mov dword [ebp - 0x3c], eax
mov dword [esi + reloc.gdi32.dll_AbortDoc], edx
mov dword [esi + reloc.gdi32.dll_AbortDoc], edx
push esi
push dword [ebx + 0x50]
push dword [ebx + 0x58]
push dword [ebx + 0x5c]
push dword [ebx + 0x54]
lea eax, [ebp - 0x28]
push eax
sub eax, 4
push eax
push dword [ecx + 4]
push dword [ecx]
push dword [ecx + 0xc]
push dword [ecx + 8]
call fcn.004f5873
mov ecx, dword [ebp - 4]
push esi
push dword [ebx + 0x50]
push dword [ebx + 0x58]
push dword [ebx + 0x5c]
push dword [ebx + 0x54]
lea eax, [ebp - 0x30]
push eax
sub eax, 4
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push dword [ecx + 0x1c]
push dword [ecx + 0x18]
call fcn.004f5873
mov eax, dword [ebp - 0x38]
mov dword [esi + reloc.gdi32.dll_AbortDoc], eax
mov eax, dword [ebp - 0x3c]
mov dword [esi + reloc.gdi32.dll_AbortDoc], eax
mov ecx, dword [ebp - 4]
push esi
push ebx
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push ecx
lea eax, [ecx + 8]
push eax
call fcn.004f57a1
mov ecx, dword [ebp - 4]
push esi
push ebx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
lea eax, [ecx + 0x10]
push eax
add eax, 8
push eax
call fcn.004f57a1
mov edx, dword [0x5e8c40]
test edx, edx
jne 0x4f654b
mov eax, dword [ebp - 4]
mov dword [0x5e8c40], eax
jmp 0x4f6557
mov edx, dword [edx + 0x20]
cmp dword [edx + 0x20], 0
jne 0x4f6548
mov eax, dword [ebp - 4]
mov dword [edx + 0x20], eax
cmp byte [eax + 0x505], 0
mov ecx, eax
je 0x4f6566
mov byte [ebp - 5], 1
cmp byte [ecx + 0x504], 0
jne 0x4f657e
mov byte [ecx + 0x504], 1
inc dword [ebp - 0xc]
jmp 0x4f6449
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalUnlock
call sub.user32.dll_CloseClipboard
cmp byte [ebp - 5], 0
je 0x4f65a0
push 0
push 1
push 0x802a
push edi
call sub.user32.dll_SendMessageW
push edi
call sub.mclib32.dll__ForceRedraw_4
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x5567d6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push edi
push 2
call fcn.00446768
push 0x104
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.0041155f
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call sub.gdi32.dll_CreateMetaFileW
mov edi, eax
push dword [ebp + 0x1c]
push eax
push 1
push 2
push esi
push ebx
push 0
push 0
push 0
push dword [ebp + 0x18]
push 0
push 0x5c6ef0
push 0
lea eax, [ebp - 0x28]
push eax
call fcn.005555c3
push edi
call sub.gdi32.dll_CloseMetaFile
push 0x104
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push 0
push 0
call fcn.00410cad
mov dword [ebp - 0x24], eax
test eax, eax
je 0x556916
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
call fcn.00410c93
mov dword [ebp - 0x20], eax
mov edi, eax
test eax, eax
jne 0x55687d
lea eax, [ebp - 0x24]
push eax
call fcn.00410d4e
jmp 0x556916
push 2
call fcn.00446768
xor ecx, ecx
cmp byte [0x5cd663], cl
je 0x5568da
mov edx, ecx
mov dword [ebp - 0x1c], 0x9ac6cdd7
mov dword [ebp - 0x18], ecx
mov word [ebp - 0x14], cx
lea eax, [esi - 1]
mov word [ebp - 0x12], ax
lea eax, [ebx - 1]
mov word [ebp - 0x10], ax
mov word [ebp - 0xe], 0x80
mov dword [ebp - 0xc], ecx
mov word [ebp - 8], cx
lea ecx, [ebp - 0x1c]
mov ax, word [ecx + edx]
xor word [ebp - 8], ax
add edx, 2
cmp edx, 0x12
jbe 0x5568bc
push edi
push 0x17
lea eax, [ebp - 0x1c]
push eax
push 0x18
call fcn.00410dcc
push dword [ebp - 0x24]
push edi
call fcn.00411630
mov byte [ebp - 1], al
lea eax, [ebp - 0x24]
push eax
call fcn.00410d4e
lea eax, [ebp - 0x20]
push eax
call fcn.00410d4e
push 0x104
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.00410e61
push 0
call fcn.00446768
cmp byte [ebp - 1], 0
jne 0x556926
push dword [0x5cbb00]
push 0x101
call fcn.00418038
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x56dd69
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x414
push dword [ebp + 0x10]
lea eax, reloc.gdi32.dll_AbortDoc
push eax
mov eax, 0x20a
mov edx, dword [ebp + 0x14]
lea edx, [edx + edx + 2]
call fcn.0056d024
mov word [ebp - 2], 0
push ecx
lea eax, reloc.gdi32.dll_AbortDoc
push eax
mov eax, 0x20a
mov edx, dword [ebp + 0xc]
lea edx, [edx + edx + 2]
call fcn.0056d024
mov word [ebp - 0x20c], 0
push 0
lea eax, reloc.gdi32.dll_AbortDoc
push eax
add eax, 0x20a
push eax
call sub.kernel32.dll_CopyFileW
leave
ret 0x10

Function at 0x56e181
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
push 0x5ea094
push dword [0x5ea090]
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x56e1b9
mov ebx, dword [ebp - 4]
push dword [ebp + 8]
push ebx
call sub.advapi32.dll_RegDeleteValueW
push ebx
call sub.advapi32.dll_RegCloseKey
pop ebx
leave
ret 8

Function at 0x56f9cc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push dword [ebp + 0xc]
lea eax, reloc.gdi32.dll_AbortDoc
push eax
mov eax, 0x20a
mov edx, dword [ebp + 0x10]
lea edx, [edx + edx + 2]
call fcn.0056d024
mov word [ebp - 2], 0
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, reloc.gdi32.dll_AbortDoc
je 0x56fa17
push eax
call fcn.0057123c
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov al, 1
jmp 0x56fa19
inc al
pop ebx
leave
ret 0xc

Function at 0x56fd26
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push dword [ebp + 8]
lea eax, reloc.gdi32.dll_AbortDoc
push eax
mov eax, 0x20a
mov edx, dword [ebp + 0xc]
lea edx, [edx + edx + 2]
call fcn.0056d024
mov word [ebp - 2], 0
push 0x104
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.0056d667
lea edx, [eax + eax]
mov ax, word [ebp + edx - 0x20c]
cmp ax, 0x5c
je 0x56fd78
cmp ax, 0x2f
jne 0x56fd82
mov word [ebp + edx - 0x20c], 0
push 0
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
je 0x56fd96
mov al, 1
leave
ret 8
Function at 0x640791
Capabilities:
Parse pe header

Disassembly:
push 0
in eax, 0x83
in al, dx
sub byte [eax - 0x18], ah
add byte [ebx + 5], dl
add byte fs:[ecx - 0x55e8bc16], al
or cl, byte [ecx - 0x3ba382d]
add byte [eax], al
add byte [eax], al
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x80
je 0x640786
mov eax, dword [ebp + 8]
mov dword [ebx + reloc.gdi32.dll_AbortDoc], eax
inc dword [ebp + 8]
inc ebx
jmp 0x640767
mov dword [ebp - 8], eax
popal
mov eax, dword [ebp - 0x47]
mov eax, dword [reloc.gdi32.dll_AbortDoc]
push ebp
mov ebp, esp
sub esp, 0x84
pushal
call 0x6407a0
pop edx
sub edx, 0xaaa178c
lea eax, [ebp - 0x84]
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
rol ebx, 1
mov byte [eax], bl
inc ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x80
jne 0x6407b7
mov dword [ebp - 4], reloc.gdi32.dll_AbortDoc
mov dl, byte [edi + 0x76]
push ss
stosb byte es:[edi], al
or cl, byte [ebp - 0x834b]
dec dword [edx + reloc.gdi32.dll_AbortDoc]
add byte [eax], al
mov eax, 0x785437ab
shl dword [ecx], cl
mov byte [ebx], ch
rol byte [eax], 1
pop ebp
jmp 0x64086a
and esi, dword [edx - reloc.gdi32.dll_AbortDoc]
fninit
Function at 0x1013fd00
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1019a350]
jne 0x1013fd0a
repz ret
jmp fcn.10140dfc

Function at 0x10141fcb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1013f274
and dword [ebp - 4], 0
cmp dword [0x1019be14], 0
mov ebx, eax
jne 0x1014207c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1014212d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1014212d
push eax
call fcn.1013f202
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1019be14], eax
call esi
push eax
call fcn.1013f202
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1019be18], eax
call esi
push eax
call fcn.1013f202
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1019be1c], eax
call esi
push eax
call fcn.1013f202
pop ecx
mov dword [0x1019be24], eax
test eax, eax
je 0x1014207c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1013f202
pop ecx
mov dword [0x1019be20], eax
mov eax, dword [0x1019be20]
cmp eax, ebx
je 0x101420d4
cmp dword [0x1019be24], ebx
je 0x101420d4
push eax
call fcn.1013f27d
push dword [0x1019be24]
mov esi, eax
call fcn.1013f27d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x101420d4
test edi, edi
je 0x101420d4
call esi
test eax, eax
je 0x101420cb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x101420cb
test byte [ebp - 0xc], 1
jne 0x101420d4
or dword [ebp + 0x10], 0x200000
jmp 0x1014210d
mov eax, dword [0x1019be18]
cmp eax, ebx
je 0x1014210d
push eax
call fcn.1013f27d
pop ecx
test eax, eax
je 0x1014210d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1014210d
mov eax, dword [0x1019be1c]
cmp eax, ebx
je 0x1014210d
push eax
call fcn.1013f27d
pop ecx
test eax, eax
je 0x1014210d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1019be14]
call fcn.1013f27d
pop ecx
test eax, eax
je 0x1014212d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1014212f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1014331e
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10199d1c], 0
mov byte [0x10199d20], 0
mov dword [0x10199d18], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10143374
mov eax, 0x25fd
xor ecx, ecx
mov dword [0x10199d18], 0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jmp 0x101433a6
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x10199d10], 0x25fd
mov eax, dword [0x10199d18]
add eax, 1
mov dword [0x10199d18], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10143374
jmp 0x1014335b
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, 0x100
mov dword [0x10199d24], 0
mov dword [ebp - 0x28], eax
xor esi, esi
mov dword [ebp - 0x2c], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
add ecx, 0xfffff560
mov edi, dword [0x10199d1c]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x28]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x10199d24], esi
mov eax, esi
cdq
mov esi, dword [ebp - 0x2c]
idiv esi
mov dword [0x10199d1c], edx
mov dword [0x10199d10], ecx
mov ecx, dword [ebp - 0x28]
mov cl, byte [ebx + ecx]
mov byte [0x10199d20], cl
mov dword [0x10199d14], 0x21ee
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x28]
mov byte [ebx + edx], cl
mov cl, byte [0x10199d20]
mov edx, dword [0x10199d1c]
mov byte [ebx + edx], cl
mov edx, dword [0x10199d10]
add edx, 0xfffff153
mov dword [0x10199d10], edx
mov ecx, dword [0x10199d18]
add ecx, 1
mov dword [0x10199d18], ecx
cmp ecx, 0x100
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
jl 0x101433a6
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10143471
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov esi, dword [0x10199d10]
add esi, 0xffffeeb0
mov dword [0x10199d10], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x10188698]
mov dh, byte [eax + 0x10188669]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
jne 0x1014349b
lea eax, [ebp - 0x24]
mov dword [0x10199d14], 0x19f0
mov dword [ebp - 0x34], eax
call fcn.10143271
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.10142ee4
xor ecx, ecx
mov dword [0x10199d14], 0x22ca
cmp eax, 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
je 0x101435a8
mov eax, dword [ebp - 0x38]
mov dword [0x10199d10], 0x16e2
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x40], eax
call fcn.101439f5
xor eax, eax
mov ecx, dword [ebp - 0x40]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x10199d14], 0x190b
mov dword [ecx + 0xd0], 0x4550
mov dword [0x10199d10], 0xfffff83d
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x1c], ecx
mov ecx, dword [ebp - 0x40]
mov dword [edx + 0x3c], ecx
cmp ecx, 0
mov dword [ebp - 0x3c], eax
je 0x101435a8
mov dword [0x10199d14], 0x20b8
mov eax, dword [ebp - 0x40]
add eax, 0x16ac
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
add esp, 0x4c
pop esi
pop ebp
ret
Function at 0x101438ce
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov dword [0x10199d14], 0x126c
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x10199d10], 0x12da
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x10143936
mov eax, dword [ebp - 0x14]
add esp, 0x20
pop ebp
ret
mov dword [0x10199d14], 0xd8e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x10143977
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1014390e
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x10143963
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
jl 0x10143936
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
je 0x10143916
jmp 0x1014392f
mov dword [0x10199d10], 0xfffff6b2
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1014392f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x1014392f
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x1014392f
mov dword [0x10199d14], 0x1430
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1014392f
mov eax, 1
mov dword [0x10199d10], 0xcb8
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x14], eax
je 0x1014390e
jmp 0x1014392f
Function at 0x10143e01
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.10144064
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x10143e3d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x10199d10], 0xc6c
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov dword [0x10199d14], 0x241c
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
je 0x10143ed4
jmp 0x10143edf
mov al, byte [ebp - 0x31]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x38]
add edx, 1
mov ah, byte [ebp - 0x39]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x40], edx
jne 0x10143ea9
jmp 0x10143f0d
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov edx, dword [ebp - 0x44]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x31], bh
mov byte [ebp - 0x39], cl
je 0x10143f0d
jmp 0x10143e7e
mov eax, dword [ebp - 0x30]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + ecx*4]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edx
jmp 0x10143ea9
mov al, byte [ebp - 0x39]
test al, 1
jne 0x10143f3c
jmp 0x10143f16
xor eax, eax
mov ecx, dword [ebp - 0x50]
add ecx, 2
mov edx, dword [ebp - 0x54]
add edx, 1
mov esi, dword [ebp - 0x2c]
cmp edx, esi
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x4c], ecx
jb 0x10143ef1
jmp 0x10143ed4
mov eax, dword [ebp - 0x50]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov dword [0x10199d14], 0x22be
mov ecx, dword [edx + ecx*4]
mov dword [0x10199d10], 0x4c8
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [ebp - 0x30], edx
jmp 0x10143ed4
Function at 0x101441dc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x10199d18], 0
mov dword [0x10199d1c], 0
mov dword [0x10199d28], 0
mov ebx, dword [0x10199d10]
add ebx, 0xffffec41
mov dword [0x10199d14], ebx
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
jne 0x10144255
mov dword [0x10199d14], 0x22fd
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov edi, ecx
add edi, 1
add eax, 1
mov dword [ebp - 0x2c], edx
cdq
idiv esi
mov dword [0x10199d18], edx
mov ebx, dword [ebp - 0x20]
movzx ebx, byte [ebx + edx]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x2c]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x10199d1c], edx
mov dword [0x10199d14], 0x63e
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x10199d20], cl
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x10199d20]
mov edx, dword [0x10199d1c]
mov byte [ebx + edx], cl
mov edx, dword [0x10199d18]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x10199d1c]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x10199d28], ecx
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov dword [0x10199d14], 0xff5
mov dword [0x10199d10], 0xc9e
xor ch, cl
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x38], edi
je 0x10144243
mov eax, dword [0x10199d1c]
mov ecx, dword [0x10199d18]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x10144255
Function at 0x1014433e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov edx, dword [0x10199d10]
mov esi, edx
add esi, 0xffffddef
mov dword [0x10199d14], esi
add edx, 0xfffff1ae
mov dword [0x10199d10], edx
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.10143b12
lea ecx, [0x1014304e]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x70], edx
mov dword [esp + 0x5c], 0x12d400
mov edx, dword [0x10199cfc]
mov dword [esp + 0x38], edx
mov edx, dword [0x10199d00]
mov dword [esp + 0x34], edx
mov dword [0x10199d10], 0x1a6c
mov edx, dword [0x10199d04]
mov dword [esp + 0x48], edx
mov edx, dword [0x10199d08]
mov dword [esp + 0x7c], edx
mov edx, dword [0x10199d0c]
mov dword [esp + 0x84], edx
mov edx, dword [0x10199d14]
add edx, 0xc86
mov dword [0x10199d14], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x1014446a
mov eax, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [0x10199d14], 0x8e8
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x64], edx
mov dword [0x10199d10], 0x1277
call fcn.101438ce
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
je 0x10144434
mov eax, dword [esp + 8]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10143471
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x10199d14], 0xd4a
mov dword [esp + 8], eax
jmp 0x1014442a
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x10144491
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x101443f0
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x1014446a
Function at 0x4010ca
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], edx
mov dword [eax - 4], esp
or dword [eax + 8], 0xffffffff
mov dword [eax + 4], 0x502f20
mov ecx, dword fs:[0]
mov dword [eax], ecx
mov dword fs:[0], eax
and dword [eax + 8], 0
lea ecx, [ebp - 0x34]
mov edi, dword [edx + 4]
mov esi, dword [edx + 8]
mov dword [ebp - 0x28], edi
mov edx, edi
push esi
call fcn.004d0240
pop eax
mov ecx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
cmp ecx, 0x80000000
je 0x40114a
lea edx, [ebp - 0x34]
mov dword [edx], ecx
mov dword [edx + 4], esi
mov dword [edx + 8], eax
lea ecx, [ebp - 0x40]
push 1
call fcn.004d65e0
pop eax
mov edi, dword [ebp - 0x40]
mov esi, dword [ebp - 0x3c]
cmp edi, 0x80000000
jne 0x401172
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x24]
mov dword [ecx + 4], eax
mov dword [ecx], esi
mov ecx, dword [edi]
mov edx, ebx
call fcn.004caa30
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.kernel32.dll_DeleteFileW]
mov ebx, dword [ebp - 0x28]
test eax, eax
je 0x401188
mov eax, dword [ebp - 0x20]
mov byte [eax], 4
jmp 0x401197
call dword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0
mov dword [ecx + 4], eax
test edi, edi
mov edi, dword [ebp - 0x24]
je 0x401158
push 2
pop edx
mov ecx, esi
call fcn.00421070
jmp 0x401158

Function at 0x404044
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xcc
mov edi, dword [esp + 0xe0]
mov ebp, dword [esp + 0xe4]
mov eax, edx
mov edx, ecx
call fcn.00404065