joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401662
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
push ebx
lea eax, [ebp - 4]
push esi
push edi
push eax
push dword [ebp + 8]
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x401776
mov ebx, 0x40
lea edi, [ebp - 0x50]
xor eax, eax
mov ecx, 0x10
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 1
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x90]
mov ecx, 0x10
rep stosd dword es:[edi], eax
xor esi, esi
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 8]
push esi
lea ecx, [ebp - 0x90]
push eax
push ecx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x40176d
push dword [ebp + 0xc]
lea ecx, [ebp - 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40171b
lea eax, [ebp - 0x50]
lea ecx, [ebp - 0x294]
push eax
push str.UnInstaller:____Removing_Port__s_in_MRU_n
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x90]
push ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x40171c
inc esi
lea edi, [ebp - 0x50]
xor eax, eax
mov ecx, 0x10
lea edx, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 1
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x90]
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x50]
push eax
push ecx
push edx
lea eax, [ebp - 8]
push 0
lea ecx, [ebp - 0x90]
push eax
push ecx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x4016df
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x401781
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x510
push ebx
lea eax, [ebp - 4]
push esi
push edi
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4018d8
xor esi, esi
push 0x100
lea eax, [ebp - 0x108]
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x4018cd
lea eax, [ebp - 8]
lea ecx, [ebp - 0x108]
push eax
push ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x401892
lea edi, [ebp - 0x30c]
xor eax, eax
mov ecx, 0x81
xor ebx, ebx
rep stosd dword es:[edi], eax
push 0x204
lea eax, [ebp - 0x30c]
push eax
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x4018ae
mov edi, dword [ebp + 0xc]
mov ecx, 0xffffffff
sub eax, eax
lea edx, [ebp - 0x30c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push dword [ebp + 0xc]
push edx
call fcn.00403c80
add esp, 0xc
test eax, eax
jne 0x401866
lea eax, [ebp - 0x30c]
lea ecx, [ebp - 0x510]
push eax
push str.UnInstaller:____Removing_Port__s_in_LPTENUM_n
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x30c]
push ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x401867
inc ebx
lea edi, [ebp - 0x30c]
xor eax, eax
mov ecx, 0x81
push 0x204
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x30c]
push eax
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x401812
jmp 0x4018ae
lea eax, [ebp - 0x108]
lea ecx, [ebp - 0x510]
push eax
push str.UnInstaller:____Could_not_open_subkey__s_n
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
inc esi
push 0x100
lea eax, [ebp - 0x108]
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x4017c7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4018f0
push dword [ebp + 8]
push str.UnInstaller:____Could_not_open_key__s_n
lea ecx, [ebp - 0x510]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4018fb
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x518
push esi
lea eax, [ebp - 4]
push edi
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4019db
xor esi, esi
push 0x100
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x4019d2
mov edi, 0x105
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0x518]
push eax
inc esi
push str.UnInstaller:____Found_USB_Port__s_n
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x314]
push edi
push ecx
push 0xa
push dword [0x407168]
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [ebp - 0x104]
lea edx, [ebp - 0x314]
push ecx
push edx
call fcn.00401662
push edi
lea ecx, [ebp - 0x20c]
push ecx
push 0xb
push dword [0x407168]
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [ebp - 0x104]
lea edx, [ebp - 0x20c]
push ecx
push edx
call fcn.00401781
push 0x100
lea ecx, [ebp - 0x104]
push ecx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x401945
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x401a8c
Capabilities:
Check os version
Delete registry key
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60c
push ebx
push esi
push edi
mov esi, 1
xor edi, edi
mov dword [ebp - 4], esi
call fcn.0040115f
cmp eax, 4
jne 0x401acb
call fcn.00401169
test eax, eax
jne 0x401aba
mov dword [ebp - 4], esi
jmp 0x401acb
call fcn.00401169
cmp eax, 0xa
jne 0x401acb
mov dword [ebp - 4], 2
push 0x400
lea eax, [ebp - 0x60c]
push eax
call fcn.00401016
push eax
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
push dword [0x407168]
call esi
push 0x100
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00401016
inc eax
push eax
push dword [0x407168]
call esi
push 0x40024
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x60c]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
je 0x401b2b
mov edi, 0x32
test edi, edi
jne 0x401d09
mov ebx, 0x105
lea eax, [ebp - 0x10c]
push ebx
push eax
push 1
push dword [0x407168]
call esi
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00401382
push ebx
lea ecx, [ebp - 0x10c]
push ecx
push 3
push dword [0x407168]
call esi
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00401382
push ebx
lea ecx, [ebp - 0x10c]
push ecx
push 4
push dword [0x407168]
call esi
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00401382
push ebx
lea ecx, [ebp - 0x10c]
push ecx
push 5
push dword [0x407168]
call esi
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00401382
push ebx
lea ecx, [ebp - 0x10c]
push ecx
mov edi, 0x80000002
push 0x32
push dword [0x407168]
call esi
lea ecx, [ebp - 0x10c]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push ebx
lea ecx, [ebp - 0x10c]
push ecx
mov eax, dword [0x407168]
push 0x34
push eax
call esi
lea ecx, [ebp - 0x10c]
push ecx
call fcn.004018fb
push ebx
lea ecx, [ebp - 0x10c]
push ecx
push 0x34
push dword [0x407168]
call esi
lea ecx, [ebp - 0x10c]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push ebx
lea ecx, [ebp - 0x10c]
push ecx
push 0x35
push dword [0x407168]
call esi
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00401532
lea ecx, [ebp - 0x10c]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push ebx
lea ecx, [ebp - 0x10c]
push ecx
push 0x36
push dword [0x407168]
call esi
lea ecx, [ebp - 0x10c]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 4]
call fcn.004019e5
push ebx
lea ecx, [ebp - 0x10c]
push ecx
push 6
push dword [0x407168]
call esi
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00401382
push ebx
lea ecx, [ebp - 0x10c]
push ecx
push 0x38
push dword [0x407168]
call esi
lea ecx, [ebp - 0x10c]
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x400
lea ecx, [ebp - 0x60c]
push ecx
call fcn.00401016
add eax, 2
push eax
push dword [0x407168]
call esi
push 0x100
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00401016
add eax, 3
push eax
push dword [0x407168]
call esi
push 0x40024
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x60c]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x401d09
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402180
Capabilities:
Terminate process

Disassembly:
cmp dword [0x40625c], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x40219e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x406258], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x406254], bl
jne 0x4021f8
cmp dword [0x407278], 0
je 0x4021e6
mov edi, dword [0x407274]
sub edi, 4
cmp edi, dword [0x407278]
jb 0x4021e6
mov eax, dword [edi]
test eax, eax
je 0x4021db
call eax
sub edi, 4
cmp edi, dword [0x407278]
jae 0x4021d3
push 0x406014
push 0x406010
call fcn.00402230
add esp, 8
push 0x40601c
push 0x406018
call fcn.00402230
add esp, 8
test ebx, ebx
jne 0x40221f
mov dword [0x40625c], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret
Function at 0x4028a0
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor ebx, ebx
push ebp
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [0x406300], ebx
jne 0x4028ef
call esi
cmp eax, ebx
mov edi, eax
je 0x4028cd
mov dword [0x406300], 1
jmp 0x4028ef
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x4028e5
mov dword [0x406300], 2
jmp 0x4028ef
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x406300], 1
jne 0x40299e
test edi, edi
jne 0x402912
call esi
mov edi, eax
test edi, edi
jne 0x402912
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x40292c
add esi, 2
cmp word [esi], 0
jne 0x40291a
add esi, 2
cmp word [esi], 0
jne 0x40291a
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x40298d
push ebp
call fcn.00403290
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x40298d
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x40297c
push ebx
call fcn.00403240
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x406300], 2
jne 0x402a22
test ebx, ebx
jne 0x4029c1
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x4029c1
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x4029d6
inc ebp
cmp byte [ebp], 0
jne 0x4029c8
inc ebp
cmp byte [ebp], 0
jne 0x4029c8
sub ebp, ebx
inc ebp
push ebp
call fcn.00403290
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x4029fb
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x403040
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor ecx, ecx
mov eax, 0x406530
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [eax], edx
je 0x403067
add eax, 8
inc ecx
cmp eax, 0x4065c0
jb 0x403058
cmp dword [ecx*8 + 0x406530], edx
lea ebx, [ecx*8]
jne 0x40322b
cmp dword [0x40620c], 1
je 0x4031e7
cmp dword [0x40620c], 0
jne 0x40309e
cmp dword [0x406210], 1
je 0x4031e7
cmp edx, 0xfc
je 0x40322b
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x4030db
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x40311f
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x4052e0
push ebp
call fcn.00403b40
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4052c0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x406534]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.00403aa0
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
cmp dword [0x407170], 0
je 0x4031fd
mov eax, dword [0x407170]
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x403207
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x406534]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x10001160
Capabilities:
Enumerate pe sections

Disassembly:
push 0xffffffffffffffff
push 0x100089a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov ebx, ecx
push esi
lea ecx, [esp + 8]
call fcn.10002950
mov eax, dword [ebx]
movzx edx, word [eax + 0x14]
xor ecx, ecx
cmp word [eax + 6], cx
mov dword [esp + 0x18], ecx
lea esi, [edx + eax + 0x18]
mov dword [esp + 0xc], ecx
jbe 0x10001249
push ebp
add esi, 0x10
push edi
mov eax, dword [esi]
test eax, eax
jne 0x100011ec
mov eax, dword [esp + 0x2c]
mov ebp, dword [eax + 0x38]
test ebp, ebp
jle 0x1000122d
mov ecx, dword [esi - 4]
mov edx, dword [ebx + 4]
push 4
push 0x1000
add ecx, edx
push ebp
push ecx
lea ecx, [esp + 0x20]
call fcn.10002ad0
mov ecx, ebp
mov edx, ecx
mov edi, eax
shr ecx, 2
xor eax, eax
mov dword [esi - 8], edi
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x1000122d
mov ecx, dword [ebx + 4]
push 4
push 0x1000
push eax
mov eax, dword [esi - 4]
add eax, ecx
push eax
lea ecx, [esp + 0x20]
call fcn.10002ad0
mov edi, dword [esp + 0x28]
mov ecx, dword [esi + 4]
mov edx, dword [esi]
add ecx, edi
add edx, ecx
cmp ecx, edx
mov ebp, eax
mov edi, ebp
je 0x1000122a
jmp 0x10001220
mov al, byte [ecx]
mov byte [edi], al
inc edi
inc ecx
cmp ecx, edx
jne 0x10001220
mov dword [esi - 8], ebp
mov ecx, dword [ebx]
mov eax, dword [esp + 0x14]
movzx edx, word [ecx + 6]
inc eax
add esi, 0x28
cmp eax, edx
mov dword [esp + 0x14], eax
jl 0x100011a8
pop edi
pop ebp
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.10002b90
mov ecx, dword [esp + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 8
Function at 0x10001270
Capabilities:
Enumerate pe sections
Inspect section memory permissions

Disassembly:
push 0xffffffffffffffff
push 0x100089c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], esi
call fcn.10002950
mov edi, dword [esi]
movzx eax, word [edi + 0x14]
xor ebp, ebp
cmp word [edi + 6], bp
mov dword [esp + 0x20], ebp
lea eax, [eax + edi + 0x18]
jbe 0x10001386
push ebx
lea ebx, [eax + 0x24]
jmp 0x100012c0
mov ecx, dword [ebx]
test ecx, 0x2000000
je 0x100012e5
mov ecx, dword [ebx - 0x14]
mov edx, dword [ebx - 0x1c]
push 0x4000
push ecx
push edx
lea ecx, [esp + 0x1c]
call fcn.10002b00
jmp 0x1000136f
mov eax, ecx
and eax, 0x80000000
test ecx, 0x20000000
je 0x10001314
test ecx, 0x40000000
je 0x10001308
neg eax
sbb eax, eax
and eax, 0x20
add eax, 0x20
jmp 0x10001330
neg eax
sbb eax, eax
and eax, 0x70
add eax, 0x10
jmp 0x10001330
test ecx, 0x40000000
je 0x10001328
neg eax
sbb eax, eax
and eax, 2
add eax, 2
jmp 0x10001330
neg eax
sbb eax, eax
and eax, 7
inc eax
test ecx, 0x4000000
je 0x1000133d
or eax, 0x200
mov esi, dword [ebx - 0x14]
mov edx, esi
test edx, edx
jne 0x10001359
test cl, 0x40
je 0x10001350
mov edx, dword [edi + 0x20]
jmp 0x10001357
test cl, cl
jns 0x1000136f
mov edx, dword [edi + 0x24]
test edx, edx
jbe 0x1000136f
mov edx, dword [ebx - 0x1c]
lea ecx, [esp + 0x18]
push ecx
push eax
push esi
push edx
lea ecx, [esp + 0x20]
call fcn.10002b30
mov eax, dword [esp + 0x14]
mov edi, dword [eax]
movzx ecx, word [edi + 6]
inc ebp
add ebx, 0x28
cmp ebp, ecx
jl 0x100012c0
pop ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.10002b90
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x10001730
Capabilities:
Parse pe header

Disassembly:
push 0xffffffffffffffff
push 0x10008a33
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [edi + 4], esi
push 0x40
mov dword [esp + 0x10], edi
mov dword [edi + 0xc], 0x10
call fcn.1000308e
add esp, 4
mov dword [edi + 8], eax
mov dword [edi + 0x10], esi
lea ecx, [esp + 8]
mov dword [esp + 0x18], esi
mov byte [edi + 0x14], 0
call fcn.10002950
mov esi, dword [esp + 0x20]
cmp word [esi], 0x5a4d
mov byte [esp + 0x18], 1
je 0x10001799
push 0x10009100
mov ecx, edi
call fcn.100015c0
push ebx
mov ebx, dword [esi + 0x3c]
mov eax, dword [ebx + esi]
add ebx, esi
cmp eax, 0x4550
je 0x100017b5
push 0x10009100
mov ecx, edi
call fcn.100015c0
mov eax, dword [ebx + 0x50]
mov ecx, dword [ebx + 0x34]
push ebp
push 4
push 0x2000
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.10002ad0
mov ebp, eax
test ebp, ebp
jne 0x100017fb
mov edx, dword [ebx + 0x50]
push 4
push 0x2000
push edx
push eax
lea ecx, [esp + 0x20]
call fcn.10002ad0
mov ebp, eax
test ebp, ebp
jne 0x100017fb
push 0x10009100
mov ecx, edi
call fcn.100015c0
push 4
mov dword [edi + 4], ebp
mov eax, dword [ebx + 0x50]
push 0x1000
push eax
push ebp
lea ecx, [esp + 0x20]
call fcn.10002ad0
mov ecx, dword [ebx + 0x54]
push 4
push 0x1000
push ecx
push ebp
lea ecx, [esp + 0x20]
call fcn.10002ad0
mov edi, dword [esi + 0x3c]
mov ecx, dword [ebx + 0x54]
add ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x28]
mov edx, dword [ecx + 0x3c]
mov esi, dword [esp + 0x14]
add eax, edx
push ebx
push ecx
mov dword [esi], eax
mov ecx, esi
mov dword [eax + 0x34], ebp
call fcn.10001160
mov ecx, dword [ebx + 0x34]
mov eax, ebp
sub eax, ecx
je 0x1000186c
push eax
mov ecx, esi
call fcn.100013b0
mov ecx, esi
call fcn.100015e0
mov ecx, esi
call fcn.10001270
mov eax, dword [esi]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x100018ae
add eax, ebp
jne 0x10001893
push 0x10009100
mov ecx, esi
call fcn.100015c0
push 0
push 1
push ebp
call eax
test eax, eax
jne 0x100018aa
push 0x10009100
mov ecx, esi
call fcn.100015c0
mov byte [esi + 0x14], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.10002b90
mov ecx, dword [esp + 0x18]
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x100019b0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
push 0x100
mov ebx, eax
call fcn.1000308e
add esp, 4
mov esi, eax
xor edi, edi
xor eax, eax
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x100019d0
mov eax, 1
sub eax, esi
mov dword [esp + 0x14], eax
mov eax, 2
sub eax, esi
mov dword [esp + 0x18], eax
mov eax, 3
sub eax, esi
mov dword [esp + 0x10], edi
mov ecx, esi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
cdq
idiv ebp
xor eax, eax
mov al, byte [edx + ebx]
xor edx, edx
mov dl, byte [ecx]
add edx, edi
add eax, edx
and eax, 0xff
mov edi, eax
mov dl, byte [edi + esi]
mov al, byte [ecx]
mov byte [edi + esi], al
mov eax, dword [esp + 0x14]
add eax, ecx
mov byte [ecx], dl
cdq
idiv ebp
xor eax, eax
mov al, byte [ecx + 1]
add eax, edi
movzx edx, byte [edx + ebx]
add edx, eax
mov al, byte [ecx + 1]
and edx, 0xff
mov edi, edx
mov dl, byte [edi + esi]
mov byte [edi + esi], al
mov byte [ecx + 1], dl
mov edx, dword [esp + 0x18]
lea eax, [edx + ecx]
cdq
idiv ebp
xor eax, eax
mov al, byte [edx + ebx]
xor edx, edx
mov dl, byte [ecx + 2]
add edx, edi
add eax, edx
and eax, 0xff
mov edi, eax
mov dl, byte [edi + esi]
mov al, byte [ecx + 2]
mov byte [edi + esi], al
mov eax, dword [esp + 0x1c]
add eax, ecx
mov byte [ecx + 2], dl
cdq
idiv ebp
xor eax, eax
mov al, byte [ecx + 3]
add ecx, 4
add eax, edi
movzx edx, byte [edx + ebx]
add edx, eax
mov al, byte [ecx - 1]
and edx, 0xff
mov edi, edx
mov dl, byte [edi + esi]
mov byte [edi + esi], al
mov eax, dword [esp + 0x10]
add eax, 4
cmp eax, 0x100
mov byte [ecx - 1], dl
mov dword [esp + 0x10], eax
jl 0x10001a02
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
lea edx, [ecx + ebp]
xor eax, eax
xor edi, edi
cmp ebp, edx
je 0x10001b0d
xor ecx, ecx
inc eax
and eax, 0xff
mov cl, byte [eax + esi]
mov bl, byte [eax + esi]
add ecx, edi
and ecx, 0xff
mov edi, ecx
xor ecx, ecx
mov cl, byte [edi + esi]
mov byte [edi + esi], bl
xor ebx, ebx
mov byte [eax + esi], cl
mov bl, byte [edi + esi]
add ebx, ecx
and ebx, 0xff
mov cl, byte [ebx + esi]
xor byte [ebp], cl
inc ebp
cmp ebp, edx
jne 0x10001ad2
push esi
call fcn.1000309c
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret