joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fa64
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
push esi
push eax
push 1
push eax
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x40fa99
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
leave
ret
push str.unable_to_create_tls_index
lea ecx, [ebp - 0x1c]
call fcn.00404590
push 0x4161c4
lea eax, [ebp - 0x1c]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x4100c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call fcn.00410281
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x4100dc
mov dword [eax], ecx
jmp 0x4100de
mov eax, ecx
push ecx
push ecx
push esi
push 0x410150
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret

Function at 0x4109b0
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x416118
call fcn.00411160
push 1
call fcn.00410576
pop ecx
test al, al
je 0x410998
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00410544
mov byte [ebp - 0x24], al
mov eax, dword [0x418378]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x410998
test eax, eax
jne 0x4108bc
mov dword [0x418378], ecx
push 0x413270
push 0x413260
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x41089f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x410988
push 0x41325c
push 0x41324c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x418378], 2
jmp 0x4108c1
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004106ca
pop ecx
call fcn.004112e6
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4108f2
push esi
call fcn.00410636
pop ecx
test al, al
je 0x4108f2
mov esi, dword [esi]
push edi
push 2
push edi
mov ecx, esi
call dword [0x413248]
call esi
call fcn.004112ec
mov esi, eax
cmp dword [esi], edi
je 0x410910
push esi
call fcn.00410636
pop ecx
test al, al
je 0x410910
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.00410e8a
movzx esi, ax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push esi
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.00410ec3
test al, al
je 0x41099f
test bl, bl
jne 0x41093e
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.004106e7
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x410988
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push 7
call fcn.00410d70
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push dword [ebp - 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__exit
int3
call fcn.004a8000
jmp 0x410832
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5363249a
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x19de35dd
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x1020bae2
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp ecx, 0
sete dl
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0x15], dl
mov eax, 0xffffffff
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
sete dl
mov dh, byte [ebp - 0x15]
and dh, dl
test dh, 1
mov dword [ebp - 0x1c], eax
jne 0x1020bcca
jmp 0x1020bb65
mov al, byte [ebp - 0x1d]
test al, 1
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x28], ecx
jne 0x1020bb36
jmp 0x1020bb4b
mov dword [0x10224030], 0xffffc994
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
jmp 0x1020bcca
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [eax]
mov edx, dword [ebp - 0x30]
cmp eax, edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], ecx
je 0x1020bcca
jmp 0x1020bbb8
mov dword [0x10224030], 0x25ed
mov dword [0x1022402c], 0x14fc
mov ecx, dword fs:[0x18]
mov dword [0x1022402c], 0xffffeafc
mov eax, dword [ecx + 0x30]
mov dword [0x10224030], 0xffffd3cf
mov eax, dword [eax + 0xc]
add eax, 0x14
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
setne dl
mov esi, eax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x31], dl
mov dword [ebp - 0x28], esi
jmp 0x1020bb4b
mov dword [0x1022402c], 0xe77
mov eax, dword [ebp - 0x24]
add eax, 0x24
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x28]
mov esi, dword [ecx + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x31]
and bh, bl
test bh, 1
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x2c], esi
jne 0x1020bbf0
jmp 0x1020bc06
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff8
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c], eax
jmp 0x1020bcca
xor eax, eax
mov ecx, dword [ebp - 0x38]
mov dx, word [ecx]
mov dword [0x1022402c], 0x26b6
shr dx, 1
movzx esi, dx
cmp dx, 0
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x48], eax
je 0x1020bb4b
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x3c]
mov dx, word [ecx + eax*2]
mov si, dx
add si, 0xffbf
mov di, dx
add di, 0x20
cmp si, 0x1a
mov dword [ebp - 0x4c], eax
mov word [ebp - 0x4e], dx
mov word [ebp - 0x50], di
jb 0x1020bc6a
mov ax, word [ebp - 0x4e]
mov word [ebp - 0x50], ax
mov ax, word [ebp - 0x50]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x4c]
cmp word [ecx + edx*2], ax
sete bl
cmp ax, 0
sete bh
mov al, bl
xor al, 1
or bh, al
test bh, 1
mov byte [ebp - 0x1d], bl
jne 0x1020bb27
mov dword [0x1022402c], 0x667
mov eax, dword [ebp - 0x4c]
add eax, 1
mov ecx, dword [ebp - 0x44]
cmp eax, ecx
setb dl
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x55], dl
mov al, byte [ebp - 0x55]
test al, 1
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x48], ecx
jne 0x1020bc36
jmp 0x1020bb27
mov eax, dword [ebp - 0x1c]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1020c0df
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10224038], 0
mov byte [0x1022403c], 0
mov dword [0x1022402c], 0x1f87
mov dword [0x10224034], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1020c22d
xor eax, eax
mov dword [0x1022402c], 0xd51
mov dword [0x10224034], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x10224040], 0
mov dword [0x1022402c], 0x17de
mov edx, dword [0x10224038]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x10224040], edi
mov dword [0x10224030], 0x51e
mov dword [0x1022402c], 0xffffe312
mov eax, edi
cdq
idiv ecx
mov dword [0x10224038], edx
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x1022403c], cl
mov dword [0x1022402c], 0x1980
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov ecx, dword [0x1022402c]
add ecx, 0x1ff7
mov dword [0x10224030], ecx
mov cl, byte [0x1022403c]
mov edx, dword [0x10224038]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov dword [0x1022402c], 0x5e6
mov edx, dword [0x10224030]
add edx, 0xfffffd1a
mov dword [0x10224030], edx
mov edx, dword [0x10224034]
add edx, 1
mov dword [0x10224034], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x1020c142
jmp 0x1020c258
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x10224034]
add eax, 1
mov dword [0x10224034], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1020c22d
jmp 0x1020c129
mov dword [0x1022402c], 0x1e31
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1020c6df
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [0x10224030], 0x26de
mov dword [ebp - 0x10], eax
call fcn.1020bcd5
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov dword [0x10224030], 0xe73
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x1020c72f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x1022402c], 0x16bd
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
je 0x1020c856
jmp 0x1020c7b9
mov eax, dword [ebp - 0x34]
add eax, 1
mov cl, byte [ebp - 0x35]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x36]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x3c], eax
jne 0x1020c7db
jmp 0x1020c7b0
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x3c], edx
jmp 0x1020c7db
mov al, byte [ebp - 0x36]
test al, 1
jne 0x1020c833
jmp 0x1020c809
mov eax, dword [ebp - 0x24]
add eax, 0x24
mov ecx, dword [ebp - 0x1c]
add ecx, eax
mov dword [ebp - 0x54], ecx
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x54]
add ecx, dword [edx]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], eax
jmp 0x1020c794
mov eax, dword [ebp - 0x3c]
mov ecx, eax
mov edx, dword [ebp - 0x50]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x35], bh
mov byte [ebp - 0x36], cl
je 0x1020c7b0
jmp 0x1020c76a
xor eax, eax
mov ecx, dword [ebp - 0x4c]
add ecx, 2
mov edx, dword [ebp - 0x48]
add edx, 1
mov esi, dword [ebp - 0x2c]
cmp edx, esi
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x30], eax
jb 0x1020c794
jmp 0x1020c856
mov eax, dword [ebp - 0x4c]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x1022402c], 0x22a3
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x30]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1020c8bf
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x1022402c], 0x1927
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x1020c943
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff4
mov dword [0x1022402c], 0x21a9
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2], 0x6f
jne 0x1020c9d5
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1020c9d5
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1020c992
jmp 0x1020c9d5
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x1020c97a
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [0x1022402c], 0x9f6
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
jl 0x1020c943
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
je 0x1020c8f5
jmp 0x1020c9d5
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff7
shl eax, 1
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp word [eax], 0x64
jne 0x1020c9d5
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1020c9d5
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x28], eax
je 0x1020c9dc
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x1020c9dc
mov eax, dword [ebp - 0x28]
add esp, 0x28
pop ebp
ret
Function at 0x1020c9e4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
xor eax, eax
mov dword [ebp - 0x2c], eax
jmp 0x1020ca31
lea eax, [ebp - 0x20]
mov dword [0x1022402c], 0x1372
mov dword [ebp - 0x30], eax
call fcn.1020d0ec
mov dword [esp], eax
mov eax, dword [ebp - 0x30]
mov dword [esp + 4], eax
call fcn.1020be43
cmp eax, 0
mov dword [ebp - 0x34], eax
je 0x1020cb10
jmp 0x1020ca59
mov eax, dword [ebp - 0x2c]
mov cl, byte [eax + 0x1020e528]
mov dl, byte [eax + 0x1020e4f9]
sub dl, cl
mov byte [ebp + eax - 0x20], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x2c], eax
je 0x1020c9fd
jmp 0x1020ca31
mov eax, dword [ebp - 0x34]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [ebp - 0x38], eax
mov eax, dword [0x1022402c]
mov ecx, dword [ebp - 0x38]
add ecx, 0x1a49
add eax, 0xffffdbc9
mov dword [0x1022402c], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
mov edx, dword [ebp - 0x24]
mov dword [esp + 4], edx
mov dword [ebp - 0x3c], ecx
call fcn.1020bfd6
xor eax, eax
mov ecx, dword [0x1022402c]
add ecx, 0xffffe005
mov dword [0x10224030], ecx
mov ecx, dword [ebp - 0x38]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x28]
mov dword [edx + 4], ecx
mov dword [0x1022402c], 0x19c4
mov ecx, dword [ebp - 0x38]
mov dword [edx + 0x20], ecx
cmp ecx, 0
mov dword [ebp - 0x40], eax
je 0x1020cb08
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add esp, 0x50
pop ebp
ret
xor eax, eax
add esp, 0x50
pop ebp
ret
Function at 0x1020cc31
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x10224034], 0
mov dword [0x10224038], 0
mov dword [0x10224044], 0
mov edi, dword [0x10224030]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
xor eax, eax
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffff338
mov dword [0x1022402c], ecx
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
mov edx, eax
mov esi, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], eax
jne 0x1020ccaa
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
mov dword [0x1022402c], 0x20d1
mov dword [0x10224030], 0x7e7
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x10224034], edx
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x34]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x10224038], edx
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x1022403c], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x1022403c]
mov edx, dword [0x10224038]
mov byte [edi + edx], cl
mov dword [0x10224030], 0x2664
mov edx, dword [0x10224034]
movzx edx, byte [edi + edx]
mov ebx, dword [0x10224038]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x10224044], ebx
mov dword [0x1022402c], 0x1fb1
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x30]
mov ch, byte [edx + ebx]
mov byte [0x10224049], ch
mov byte [0x1022404a], cl
xor ch, cl
mov byte [0x10224048], ch
mov dword [0x1022402c], 0x251f
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], ch
mov dword [0x10224030], 0x13d3
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x3c], ebx
je 0x1020cca2
mov eax, dword [0x10224034]
mov dword [ebp - 0x40], eax
mov eax, dword [0x10224038]
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], edx
jmp 0x1020ccaa
Function at 0x1020cefa
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x88
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov dword [0x1022402c], 0x1f19
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1020c275
lea ecx, [0x1020c861]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x30], edx
mov dword [esp + 0x84], 0x140400
mov edx, dword [0x10224018]
mov dword [esp + 0x78], edx
mov edx, dword [0x1022401c]
mov dword [esp + 0x70], edx
mov edx, dword [0x10224020]
mov dword [esp + 0x5c], edx
mov edx, dword [0x10224024]
mov dword [esp + 0x44], edx
mov edx, dword [0x10224028]
mov dword [esp + 0x40], edx
mov dword [0x10224030], 0x4bf
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x1020cfc7
mov eax, dword [esp + 0x10]
mov dword [esp + 0x54], eax
mov dword [0x10224030], 0xe73
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x74], edx
call fcn.1020c8bf
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
je 0x1020cfec
jmp 0x1020d020
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x1020cfb5
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x1020cf83
jmp 0x1020cfb5
lea eax, [esp + 0x30]
mov dword [0x10224030], 0x341
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1020c9e4
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x404a60
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
add byte [ebp + 0xc], 0x53
push esi
push edi
lea edx, [eax + 7]
and edx, 0xfffffff8
leave
rcl byte [edx + 0x45]

Function at 0x404ce0
Capabilities:
Get number of processors

Disassembly:
push ebp
jns 0x404cd9
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [edi + 0x38]
push esi
push ebp
cmp bl, 0
add byte [ebx - 0x24ccfbb9], cl
add esp, 4
ficom word [ecx]
mov dword [esi], ebx
lea ecx, [esp + edi + 0x74]
or eax, 0xf4e8a4
add byte [eax], al
je 0x404d13
movsb byte es:[edi], byte [esi]
call 0x404e00
mov ebx, dword [esi + 4]
cmp eax, ebx
jne 0x404d82
lea esi, [edi + 0x10]
push esi
call 0xc5405637
add eax, 0x1e421c47
push eax
mov dword [edi + 0x14], ebx
call 0x5a405730
mov eax, dword [edi + 0x30]
mov edx, 0x5f89344f
sbb al, 0x96
pop edi
mov dword fs:[edi + 0x2c], eax
mov dword [eax + 0x10], ecx
mov ecx, dword [eax]
js 0x404d04
loop 0x404d7d
enter 0x4589, 0xfffffffffffffff4
mov ch, 0x84
test eax, 0x4000053
test byte [ecx + 0x4000053], ch
sbb byte [eax], al
sbb cl, byte [ebx + 0x308bed7f]
mov ebp, dword [esi + 0x74c0850c]
push es
ja 0x404d47
insd dword es:[edi], dx
add byte [eax], al
jle 0x404d6c
mov esi, dword [ecx + 0x8578b04]
mov edx, edx
or byte [ecx + 0x68bfc4d], cl
ror byte [eax], cl
mov dword [ebp - 4], ecx
mov eax, dword [esi]
mov ecx, dword [ebp - 0x57]
mov dword [ebp - 0x3a], eax
mov edi, 0xc9850801
leave
je 0x404ddb
cmp eax, edx
jbe 0x404d8a
mov ebx, edx
mov ebx, esi
jmp 0x404db9
cmp eax, 0x14
stc
sbb byte [ebx - 0x7a1a78b4], cl
leave
mov dword [esi], ecx
jne 0x404da1
cmp eax, dword [ebp + 0x20]
jbe 0x404da1
mov dword [ebp + 8], eax
mov dword [edi + eax*4 + 0x14], esi
jmp 0x404daf
in al, 0x65
jb 0x404db7
sub edx, eax
mov dh, 0xba
sahf
ror byte [ebx - 0x97a078b], cl
mov esi, dword [ebp - 8]
test esi, esi
jne 0x404d71
mov edx, dword [edx + 0x8578908]
mov dword [edx - 0x75], edi
std
or al, 0xd0
push dword [esi + eax + 0x57]
call 0x136e69c
or ebx, ebx
je 0x404ded
mov ecx, ecx
xor cl, al
mov al, byte [eax]
dec esi
ret
mov ebp, dword [edx - 0x76ff760c]
inc eax
add al, 0x5f
pop esi
pop ebx
mov esp, ebp
xchg dl, al
add al, 0
nop
nop
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea esi, [ebx + 0x64]
push esi
call 0x6b4056f0
push ds
inc ebx
add al, 0x83
xor eax, dword [eax*4 + 0x6c7c0]
jl 0x404e22
add bh, al
inc ebx
aam 0
fld dword [eax]
add byte [ebp + ecx - 0x51], dh
scasd eax, dword es:[edi]
call 0x404e00
mov eax, dword [ebx + 4]
test eax, eax
jne 0x404e2c
clc
jp 0x404e4c
fsubr st(0)
scasb al, byte es:[edi]
xor byte [eax], al
add byte [ebx + 0x32511c4b], cl
in eax, 8
add byte [edi - 0x75], dl
add esp, dword [edi]
les ecx, [eax]
test eax, eax
je 0x404e89
mov edx, dword [eax + 0x44]
push edx
les ebp, [ecx - 0x61]
std
dec dword [ebx + 0x741985f0]
push es
push esi
call 0xc740a2d0
mov eax, dword [ebx + 0xc]
pop ebp
dec ebx
test dword [eax + 8], 0x830c438b
cmp byte [eax], al
sbb esp, eax
mov eax, dword [edi]
or byte [ecx - 0x97af3e2], cl
lodsb al, byte [esi]
dec eax
push esi
call fcn.0040a327