joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012260
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x1005202c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100122c0
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x100122d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x10052050
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x100123e5
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x18]
push ecx
push 0
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10012339
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100123e5
cmp dword [ebp - 0x18], 0
jne 0x1001234e
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100123e5
mov dword [ebp - 0x10], 0
push 0x40000000
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.10011a70
add esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1001237b
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100123e5
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100123bf
lea edx, [ebp - 0x10]
push edx
call fcn.10011b30
add esp, 4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100123e5
cmp dword [ebp - 0xc], 4
jne 0x100123cf
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov dword [ecx], eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.10011b30
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x10012770
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x10063b60]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x400
mov eax, dword [ebp + 0x10]
push eax
push 0x10052098
call fcn.10012260
add esp, 0xc
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.10012440
add esp, 4
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
jge 0x100127bb
xor al, al
jmp 0x10012923
cmp dword [ebp - 0x40c], 0
jne 0x100127e2
push 0x104
mov edx, dword [ebp + 0x10]
push edx
call fcn.10006970
add esp, 8
test eax, eax
jne 0x100127e0
xor al, al
jmp 0x10012923
jmp 0x1001280f
push 0x100520a0
push 0x400
mov eax, dword [ebp + 0x10]
push eax
call fcn.100125b0
add esp, 0xc
test eax, eax
jne 0x10012803
xor al, al
jmp 0x10012923
push 0
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x100520b0
push 0x400
mov edx, dword [ebp + 0x10]
push edx
call fcn.100125b0
add esp, 0xc
test eax, eax
jne 0x10012830
xor al, al
jmp 0x10012923
push 0
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov cl, byte [0x10051ca2]
mov byte [ebp - 0x408], cl
push 0x3ff
push 0
lea edx, [ebp - 0x407]
push edx
call fcn.100237f0
add esp, 0xc
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 6]
push ecx
mov edx, dword [ebp + 8]
movzx eax, word [edx + 2]
push eax
mov ecx, dword [ebp + 8]
movzx edx, word [ecx]
push edx
push 0x100520b8
push 0x400
lea eax, [ebp - 0x408]
push eax
call fcn.10011ba0
add esp, 0x18
test eax, eax
jge 0x10012899
xor al, al
jmp 0x10012923
lea ecx, [ebp - 0x408]
push ecx
push 0x400
mov edx, dword [ebp + 0x10]
push edx
call fcn.100125b0
add esp, 0xc
test eax, eax
jne 0x100128b9
xor al, al
jmp 0x10012923
push 0
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 6]
push edx
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 2]
push ecx
mov edx, dword [ebp + 8]
movzx eax, word [edx]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push str._s__04d__02d__02d.log
push 0x400
lea edx, [ebp - 0x408]
push edx
call fcn.10011ba0
add esp, 0x1c
test eax, eax
jge 0x10012901
xor al, al
jmp 0x10012923
lea eax, [ebp - 0x408]
push eax
push 0x400
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.100125b0
add esp, 0xc
test eax, eax
jne 0x10012921
xor al, al
jmp 0x10012923
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10020358
mov esp, ebp
pop ebp
ret
Function at 0x10020358
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10063b60]
jne 0x10020362
repz ret
jmp fcn.100262bf

Function at 0x1002050a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x1002053b
call fcn.10023261
mov dword [eax], esi
call fcn.1002324e
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.10020895
add esp, 0x14
push 0x16
pop eax
jmp 0x10020590
test dword [ebp + 0xc], 0xfffffff9
jne 0x10020517
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10020568
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10023274
pop ecx
call fcn.1002324e
mov eax, dword [eax]
jmp 0x10020590
test al, 0x10
jne 0x1002058e
test al, 1
je 0x1002058e
test byte [ebp + 0xc], 2
je 0x1002058e
call fcn.10023261
mov dword [eax], 5
call fcn.1002324e
mov dword [eax], 0xd
jmp 0x1002055f
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10033682
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10026caf
and dword [ebp - 4], 0
cmp dword [0x10067b4c], 0
mov ebx, eax
jne 0x10033733
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100337e4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10051b7c
push edi
call esi
test eax, eax
je 0x100337e4
push eax
call fcn.10026c3d
mov dword [esp], 0x10051b6c
push edi
mov dword [0x10067b4c], eax
call esi
push eax
call fcn.10026c3d
mov dword [esp], 0x10051b58
push edi
mov dword [0x10067b50], eax
call esi
push eax
call fcn.10026c3d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10067b54], eax
call esi
push eax
call fcn.10026c3d
pop ecx
mov dword [0x10067b5c], eax
test eax, eax
je 0x10033733
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10026c3d
pop ecx
mov dword [0x10067b58], eax
mov eax, dword [0x10067b58]
cmp eax, ebx
je 0x1003378b
cmp dword [0x10067b5c], ebx
je 0x1003378b
push eax
call fcn.10026cb8
push dword [0x10067b5c]
mov esi, eax
call fcn.10026cb8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1003378b
test edi, edi
je 0x1003378b
call esi
test eax, eax
je 0x10033782
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10033782
test byte [ebp - 0xc], 1
jne 0x1003378b
or dword [ebp + 0x10], 0x200000
jmp 0x100337c4
mov eax, dword [0x10067b50]
cmp eax, ebx
je 0x100337c4
push eax
call fcn.10026cb8
pop ecx
test eax, eax
je 0x100337c4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100337c4
mov eax, dword [0x10067b54]
cmp eax, ebx
je 0x100337c4
push eax
call fcn.10026cb8
pop ecx
test eax, eax
je 0x100337c4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10067b4c]
call fcn.10026cb8
pop ecx
test eax, eax
je 0x100337e4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100337e6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10082a70
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10155720]
jne 0x10082a7a
repz ret
jmp fcn.10083d1c

Function at 0x10084eeb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100820b8
and dword [ebp - 4], 0
cmp dword [0x101573a4], 0
mov ebx, eax
jne 0x10084f9c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1008504d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1008504d
push eax
call fcn.10082046
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101573a4], eax
call esi
push eax
call fcn.10082046
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101573a8], eax
call esi
push eax
call fcn.10082046
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101573ac], eax
call esi
push eax
call fcn.10082046
pop ecx
mov dword [0x101573b4], eax
test eax, eax
je 0x10084f9c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10082046
pop ecx
mov dword [0x101573b0], eax
mov eax, dword [0x101573b0]
cmp eax, ebx
je 0x10084ff4
cmp dword [0x101573b4], ebx
je 0x10084ff4
push eax
call fcn.100820c1
push dword [0x101573b4]
mov esi, eax
call fcn.100820c1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10084ff4
test edi, edi
je 0x10084ff4
call esi
test eax, eax
je 0x10084feb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10084feb
test byte [ebp - 0xc], 1
jne 0x10084ff4
or dword [ebp + 0x10], 0x200000
jmp 0x1008502d
mov eax, dword [0x101573a8]
cmp eax, ebx
je 0x1008502d
push eax
call fcn.100820c1
pop ecx
test eax, eax
je 0x1008502d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1008502d
mov eax, dword [0x101573ac]
cmp eax, ebx
je 0x1008502d
push eax
call fcn.100820c1
pop ecx
test eax, eax
je 0x1008502d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101573a4]
call fcn.100820c1
pop ecx
test eax, eax
je 0x1008504d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1008504f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10086056
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101550e0], 0
mov byte [0x101550e4], 0
mov edi, dword [0x101550d4]
add edi, 0xe84
mov dword [0x101550d8], edi
mov dword [0x101550dc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov dword [0x101550d8], 0x8b8
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101550dc]
add eax, 1
mov dword [0x101550dc], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x100860a3
xor eax, eax
mov dword [0x101550dc], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x101550e8], 0
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [0x101550e0]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x101550e8], esi
mov dword [0x101550d4], 0x233b
mov eax, esi
cdq
idiv ecx
mov dword [0x101550e0], edx
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x101550e4], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x101550e4]
mov esi, dword [0x101550e0]
mov byte [ebx + esi], cl
mov esi, dword [0x101550dc]
add esi, 1
mov dword [0x101550dc], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x100860e2
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10086349
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x101504d3]
mov esi, 0xe
lea edi, [ebp - 0x28]
mov dword [0x101550d4], 0x1540
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
call fcn.10085fb9
mov dword [0x101550d4], 0x1b9e
call fcn.100865e6
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.10085e8f
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
je 0x10086472
mov dword [0x101550d4], 0x505
mov eax, dword [ebp - 0x3c]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x101550d4], 0x1847
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x44], eax
call fcn.1008621a
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x101550d4], 0x14d0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x4c], ecx
mov ecx, dword [ebp - 0x44]
mov dword [edx + 0x18], ecx
mov dword [0x101550d8], 0xc82
cmp ecx, 0
mov dword [ebp - 0x40], eax
je 0x10086472
mov eax, dword [0x101550d4]
mov ecx, dword [ebp - 0x44]
add ecx, 0x1000
add eax, 0x2182
mov dword [0x101550d4], eax
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
add esp, 0x4c
pop esi
pop edi
pop ebp
ret
Function at 0x10086c81
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.10086fa0
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, dword [0x101550d4]
add edi, 0x20f3
mov dword [0x101550d4], edi
mov esi, dword [eax + esi + 0x78]
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x101550d8], 0x1487
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x10086dc7
jmp 0x10086d43
mov eax, dword [ebp - 0x28]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x101550d4], 0x954
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [ebp - 0x24], edx
jmp 0x10086dc7
mov al, byte [ebp - 0x29]
test al, 1
jne 0x10086ce2
jmp 0x10086da3
mov eax, dword [ebp - 0x30]
mov ecx, eax
mov edx, dword [ebp - 0x34]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x39], bh
mov byte [ebp - 0x29], cl
je 0x10086d0c
jmp 0x10086d71
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + ecx*4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edx
jmp 0x10086d18
mov al, byte [ebp - 0x39]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x38]
add edx, 1
mov ah, byte [ebp - 0x29]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x30], edx
jne 0x10086d18
jmp 0x10086d0c
xor eax, eax
mov ecx, dword [ebp - 0x28]
add ecx, 2
mov edx, dword [ebp - 0x48]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x24], eax
jb 0x10086d55
mov eax, dword [ebp - 0x24]
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10086dd2
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x2c
mov dword [ebp - 0xc], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov edx, dword [0x101550d8]
add edx, 0xffffd94f
mov dword [0x101550d4], edx
mov esi, dword [ebp - 0xc]
mov esi, dword [esi + 0x10]
mov esi, dword [esi + 0x3c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], ecx
jmp 0x10086e7d
mov eax, 1
mov dword [0x101550d4], 0xb63
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x24], eax
je 0x10086f17
jmp 0x10086f10
mov dword [0x101550d8], 0x7a0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x10086ec3
jmp 0x10086f10
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov dword [0x101550d4], ecx
mov edx, dword [ebp - 0x18]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x20], eax
je 0x10086e3f
jmp 0x10086f10
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov edx, ecx
add edx, 0xffffe3e9
mov esi, dword [ebp - 0x18]
cmp word [esi + eax*2], 0
mov edi, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edi
je 0x10086e5d
mov eax, dword [ebp - 0x30]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x1c], eax
jl 0x10086e7d
jmp 0x10086e5d
mov eax, dword [ebp - 0x34]
add eax, 0xffffe7d7
mov dword [0x101550d4], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x10086f10
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x10086f10
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x10086f10
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x10086e15
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x10086f17
mov eax, dword [ebp - 0x24]
add esp, 0x2c
pop esi
pop edi
pop ebp
ret
Function at 0x10087149
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x101550dc], 0
mov dword [0x101550e0], 0
mov dword [0x101550ec], 0
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x100872a7
jmp 0x100871bb
mov eax, dword [0x101550e0]
mov ecx, dword [0x101550dc]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
add ecx, 1
mov edi, eax
add edi, 1
mov dword [0x101550d4], 0x581
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x101550dc], edx
mov dword [0x101550d8], 0x20ec
mov ecx, dword [ebp - 0x20]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x34]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x101550e0], edx
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x101550e4], cl
mov dword [0x101550d8], 0x1c17
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x101550e4]
mov edx, dword [0x101550e0]
mov byte [ebx + edx], cl
mov edx, dword [0x101550dc]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x101550e0]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x101550ec], ecx
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov dword [0x101550d8], 0x2239
mov edx, dword [0x101550d4]
add edx, 0x97e
mov dword [0x101550d4], edx
xor ch, cl
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x2c], edi
jne 0x100871a4
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100872af
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov dword [0x101550d4], 0x895
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1008673f
lea ecx, [0x1008647c]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x40], edx
mov dword [esp + 0x6c], 0x13d200
mov edx, dword [0x101550c0]
mov dword [esp + 0x4c], edx
mov edx, dword [0x101550c4]
mov dword [esp + 0x8c], edx
mov edx, dword [0x101550c8]
mov dword [esp + 0x88], edx
mov edx, dword [0x101550cc]
mov dword [esp + 0x50], edx
mov edx, dword [0x101550d0]
mov dword [esp + 0x34], edx
mov dword [0x101550d8], 0x1d3f
mov dword [0x101550d4], 0x2324
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x10087371
lea eax, [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10086349
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 0x10], eax
jmp 0x100873e9
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0xc], eax
jne 0x10087394
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 8], ecx
je 0x100873a8
mov eax, dword [esp + 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x10087371
mov eax, dword [esp + 0xc]
mov dword [esp + 0x84], eax
mov dword [0x101550d4], 0x4417
mov dword [0x101550d8], 0x94b
mov ecx, dword [esp + 8]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x70], edx
call fcn.10086dd2
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
je 0x10087345
mov eax, dword [esp + 0x10]
mov esp, ebp
pop ebp
ret