joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4202d8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0xf0f8f3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x420313
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x42032c
lea eax, [ebp - 0x10]
mov edx, dword [0xf2c54c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x42033f
lea eax, [ebp - 0x10]
mov edx, dword [0xf2c54c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x42034b
adc edx, 0
mov edx, dword [edx*4 + 0xf2b378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x4204c5
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x4204b8
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
cmp dword [eax], 0x4550
jne 0x4204b8
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420456
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420456
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420456
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420456
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x4204b8
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x4204b8
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x4204b8
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x4204b8
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x4204dd
inc ebx
cmp ebx, 0x19
jne 0x420305
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf0f8fa
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x49703d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, esi
inc ebp
wait
xor eax, 0x349c45c6
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00496c77
push eax
push esi
push dword [ebp + 8]
call fcn.00496c2c
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00496c77
push eax
push esi
push dword [ebp + 8]
jne 0x4970da
call fcn.00496c2c
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00496c67
invalid

Function at 0x4970d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, esi
inc ebp
wait
xor eax, 0x349c45c6
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00496c77
push eax
push esi
push dword [ebp + 8]
call fcn.00496c2c
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00496c77
push eax
push esi
push dword [ebp + 8]
jne 0x4970da
call fcn.00496c2c
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00496c67
invalid

Function at 0x49711a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.00496c67
adc dword [edi - 0x7a72f8b5], ebp
jl 0x497152
invalid
invalid
Function at 0x497f01
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00496c2c
add esp, 0xc
mov dword [ebp - 0x3c8], eax
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x334]
push eax
call dword [ebp - 0x3c8]
mov dword [ebp - 0x66c], eax
cmp dword [ebp - 0x66c], 0xffffffff
je 0x498dfa
push 0
push dword [ebp - 0x66c]
call dword [ebp - 0x33c]
mov dword [ebp - 0x378], eax
push dword [ebp - 0x378]
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 4], eax
call fcn.00496c67
sbb dword [eax], ebp
sub dword [eax + eax*4 - 0x6db5b], ebp
inc dword [eax]
and byte [ebp - 0x6db], 0
mov byte [ebp - 0x6da], 0x2c
and byte [ebp - 0x6d9], 0
mov byte [ebp - 0x6d8], 0x81
mov byte [ebp - 0x6d7], 0xb6
mov byte [ebp - 0x6d6], 0xb2
mov byte [ebp - 0x6d5], 0xb7
mov byte [ebp - 0x6d4], 0x95
mov byte [ebp - 0x6d3], 0xba
mov byte [ebp - 0x6d2], 0xbf
mov byte [ebp - 0x6d1], 0xb6
mov byte [ebp - 0x6d0], 0xd3
call fcn.00496c67
and al, 0xb6
aam 0xe4
lea eax, [ebp - 0x6dc]
push eax
call fcn.00496c77
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00496c2c
add esp, 0xc
mov dword [ebp - 0x6c8], eax
push 0
lea eax, [ebp - 0x6e0]
push eax
push dword [ebp - 0x378]
push dword [ebp - 4]
push dword [ebp - 0x66c]
call dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], eax
push dword [ebp - 0x66c]
call dword [ebp - 0x680]
cmp dword [ebp - 0x6cc], 0
je 0x498dfa
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.00496bd8
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x498074
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x4980bd
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x498067
call fcn.00496c67
cld
lea edi, [esi + 0x7c]
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00496c67
cmp byte [esp + ebp*8 - 0x2b7a72d7], dh
clc
invalid
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4984db
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ds
and byte [ebp - 0x744], 0
and byte [ebp - 0x743], 0
mov byte [ebp - 0x742], 2
and byte [ebp - 0x741], 0
mov byte [ebp - 0x740], 0xb1
mov byte [ebp - 0x73f], 0x92
mov byte [ebp - 0x73e], 0x9c
mov byte [ebp - 0x73d], 0x99
mov byte [ebp - 0x73c], 0xb1
mov byte [ebp - 0x73b], 0x94
mov byte [ebp - 0x73a], 0x9f
mov byte [ebp - 0x739], 0x8f
mov byte [ebp - 0x738], 0x9c
mov byte [ebp - 0x737], 0x8f
mov byte [ebp - 0x736], 0x84
mov byte [ebp - 0x735], 0xbc
mov byte [ebp - 0x734], 0xfd
lea eax, [ebp - 0x744]
push eax
call fcn.00496c77
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00496c2c
add esp, 0xc
mov dword [ebp - 0x704], eax
and byte [ebp - 0x6f4], 0
and byte [ebp - 0x6f3], 0
mov byte [ebp - 0x6f2], 0x43
and byte [ebp - 0x6f1], 0
mov byte [ebp - 0x6f0], 0xeb
mov byte [ebp - 0x6ef], 0xce
mov byte [ebp - 0x6ee], 0xd5
mov byte [ebp - 0x6ed], 0xc8
mov byte [ebp - 0x6ec], 0xd9
mov byte [ebp - 0x6eb], 0xfa
mov byte [ebp - 0x6ea], 0xd5
mov byte [ebp - 0x6e9], 0xd0
mov byte [ebp - 0x6e8], 0xd9
mov byte [ebp - 0x6e7], 0xbc
call fcn.00496c67
invalid

Function at 0x4cbf70
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00420f9f
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x4cbfac
call fcn.004cc18f
mov dword [esi + 0xc], 1
jmp 0x4cbfb1
call fcn.004cc18f
cmp dword [esi], 0
je 0x4cbffa
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x4cbfd4
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.0041c8f6
jmp 0x4cbfe5
push 0xff
mov ecx, esi
call fcn.0040fe36
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00418f7e
jmp 0x4cc01e
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x4cc01e
push dword [esi]
push dword [ebp - 4]
call fcn.0042433b
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4cc0e4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.004cc18f
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x4cc12c
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041c8f6
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00418f7e
jmp 0x4cc137
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.0042433b
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x49c300
Capabilities:
Get common file path
Parse pe header
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x240
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx], 0
je 0x49c315
call fcn.0049c4c0
push ebp
lea eax, [esp + 0x14c]
push 0x104
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
mov edi, 0x4fcc64
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x14c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x254]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 4]
push esi
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
push esi
push 0
push 0x4fdcb4
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
push 0
lea eax, [esp + 0x150]
push esi
push eax
call fcn.005d9624
in al, dx
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push esi
call dword [sym.imp.kernel32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x49c473
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x1c]
push 0x40
push edx
push edi
call dword [sym.imp.kernel32.dll_ReadFile]
cmp word [esp + 0x14], 0x5a4d
jne 0x49c46c
mov eax, dword [esp + 0x50]
mov ebp, dword [sym.imp.kernel32.dll_SetFilePointer]
push 0
push 0
push eax
push edi
call ebp
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x5c]
push 0xf8
push edx
push edi
call dword [sym.imp.kernel32.dll_ReadFile]
cmp dword [esp + 0x54], 0x4550
jne 0x49c46c
cmp dword [esp + 0x88], 0x80000000
jbe 0x49c46c
mov eax, dword [esp + 0x50]
push 0
push 0
push eax
push edi
mov dword [esp + 0x98], 0x10000000
call ebp
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x5c]
push 0xf8
push edx
push edi
call dword [sym.imp.kernel32.dll_WriteFile]
push edi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov edi, dword [sym.imp.kernel32.dll_LoadLibraryExA]
push 8
push 0
push esi
call edi
test eax, eax
mov dword [ebx], eax
pop ebp
je 0x49c498
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x240
ret 4
mov eax, dword [esp + 0x250]
push 8
push 0
push eax
mov byte [esi], 0
call edi
xor ecx, ecx
pop edi
test eax, eax
setne cl
mov dword [ebx], eax
pop esi
mov eax, ecx
pop ebx
add esp, 0x240
ret 4
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x40de38
nop
mov ecx, 0x4787188d
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..rdata
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x2a004a04
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x100fafb0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101f6630]
jne 0x100fafba
repz ret
jmp fcn.100fc08c

Function at 0x100fd28b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100fa489
and dword [ebp - 4], 0
cmp dword [0x101f835c], 0
mov ebx, eax
jne 0x100fd33c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100fd3ed
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100fd3ed
push eax
call fcn.100fa417
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101f835c], eax
call esi
push eax
call fcn.100fa417
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101f8360], eax
call esi
push eax
call fcn.100fa417
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101f8364], eax
call esi
push eax
call fcn.100fa417
pop ecx
mov dword [0x101f836c], eax
test eax, eax
je 0x100fd33c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100fa417
pop ecx
mov dword [0x101f8368], eax
mov eax, dword [0x101f8368]
cmp eax, ebx
je 0x100fd394
cmp dword [0x101f836c], ebx
je 0x100fd394
push eax
call fcn.100fa492
push dword [0x101f836c]
mov esi, eax
call fcn.100fa492
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100fd394
test edi, edi
je 0x100fd394
call esi
test eax, eax
je 0x100fd38b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100fd38b
test byte [ebp - 0xc], 1
jne 0x100fd394
or dword [ebp + 0x10], 0x200000
jmp 0x100fd3cd
mov eax, dword [0x101f8360]
cmp eax, ebx
je 0x100fd3cd
push eax
call fcn.100fa492
pop ecx
test eax, eax
je 0x100fd3cd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100fd3cd
mov eax, dword [0x101f8364]
cmp eax, ebx
je 0x100fd3cd
push eax
call fcn.100fa492
pop ecx
test eax, eax
je 0x100fd3cd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101f835c]
call fcn.100fa492
pop ecx
test eax, eax
je 0x100fd3ed
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100fd3ef
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100fe25f
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x2c
mov dword [ebp - 0xc], 0
mov dword [0x101f5e74], 0x1367
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov esi, dword [0x101f5e74]
mov edi, esi
add edi, 0xffffec0a
mov dword [0x101f5e74], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
jmp 0x100fe2c5
mov eax, 1
mov dword [0x101f5e74], 0x536
mov dword [ebp - 0x20], eax
jmp 0x100fe3eb
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
je 0x100fe2f2
mov eax, dword [ebp - 0x24]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x28], eax
jl 0x100fe2c5
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov edx, dword [ebp - 0x14]
add edx, 0xfffff5a8
mov dword [0x101f5e74], edx
mov edx, dword [ebp - 0x18]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], ecx
jne 0x100fe3eb
xor eax, eax
mov dword [0x101f5e74], 0x28f
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x20], eax
jne 0x100fe3eb
xor eax, eax
mov dword [0x101f5e74], 0x2505
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x20], eax
jne 0x100fe3eb
mov dword [0x101f5e78], 0x870
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
mov dx, word [eax + ecx*2 - 0x14]
mov word [ebp - 0x2e], dx
xor eax, eax
mov cx, word [ebp - 0x2e]
cmp cx, 0x64
mov dword [ebp - 0x20], eax
jne 0x100fe3eb
mov dword [0x101f5e74], 0x264f
mov eax, dword [ebp - 0x2c]
add eax, 0xfffffff7
shl eax, 1
mov ecx, dword [ebp - 0x18]
add ecx, eax
mov dword [ebp - 0x34], ecx
xor eax, eax
mov ecx, dword [ebp - 0x34]
cmp word [ecx], 0x64
mov dword [ebp - 0x20], eax
jne 0x100fe3eb
xor eax, eax
mov dword [0x101f5e74], 0x1f9e
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x20], eax
jne 0x100fe3eb
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
je 0x100fe2ae
mov eax, dword [ebp - 0x20]
add esp, 0x2c
pop esi
pop edi
pop ebp
ret
Function at 0x100fe68d
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x101f5e80], 0
mov byte [0x101f5e84], 0
mov dword [0x101f5e78], 0x247e
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [0x101f5e7c], 0
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101f5e7c]
add eax, 1
mov dword [0x101f5e7c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x100fe6d2
jmp 0x100fe70c
mov dword [0x101f5e74], 0x71f
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov dword [0x101f5e7c], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x101f5e88], 0
mov edx, dword [0x101f5e74]
mov esi, edx
add esi, 0xffffd965
mov dword [0x101f5e78], esi
mov esi, dword [0x101f5e80]
mov edi, dword [ebp - 0x18]
movzx ebx, byte [edi + eax]
add ebx, esi
mov dword [ebp - 0x24], eax
xor esi, esi
mov dword [ebp - 0x28], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add ebx, edx
mov dword [0x101f5e88], ebx
mov dword [0x101f5e78], 0x162a
mov eax, ebx
cdq
idiv ecx
mov dword [0x101f5e80], edx
mov ecx, dword [ebp - 0x28]
add ecx, 0x26f4
mov dword [0x101f5e74], ecx
mov ecx, dword [ebp - 0x24]
mov cl, byte [edi + ecx]
mov byte [0x101f5e84], cl
mov dword [0x101f5e74], 0x8fc
mov cl, byte [edi + edx]
mov edx, dword [ebp - 0x24]
mov byte [edi + edx], cl
mov dword [0x101f5e74], 0x721
mov cl, byte [0x101f5e84]
mov ebx, dword [0x101f5e80]
mov byte [edi + ebx], cl
mov dword [0x101f5e78], 0x15d4
mov ebx, dword [0x101f5e7c]
add ebx, 1
mov dword [0x101f5e7c], ebx
cmp ebx, 0x100
mov dword [ebp - 0x20], ebx
jl 0x100fe71b
jmp 0x100fe6fa
Function at 0x100fe7fa
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x10100867]
mov esi, 0xe
lea edi, [ebp - 0x2c]
mov ebx, dword [0x101f5e74]
add ebx, 0x1e99
mov dword [0x101f5e74], ebx
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], esi
call fcn.100fe5e0
mov eax, dword [0x101f5e74]
add eax, 0xfffffc44
mov dword [0x101f5e78], eax
mov dword [0x101f5e74], 0x6c2
call fcn.100fedf1
mov dword [esp], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 4], eax
call fcn.100fe434
xor ecx, ecx
mov dword [0x101f5e74], 0x236d
cmp eax, 0
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
je 0x100fe95c
jmp 0x100fe8b9
mov eax, dword [ebp - 0x48]
add eax, 0x1157
mov dword [0x101f5e78], 0x1ddf
mov dword [0x101f5e74], 0xffffefc9
mov dword [ebp - 0x44], eax
jmp 0x100fe95c
mov eax, dword [ebp - 0x40]
mov dword [0x101f5e74], 0x1258
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x101f5e74]
add ecx, 0x194b
mov dword [0x101f5e78], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x30]
mov dword [esp + 4], ecx
mov dword [ebp - 0x48], eax
call fcn.100fece8
mov eax, dword [ebp - 0x48]
mov word [eax], 0x5a4d
mov dword [eax + 0x3c], 0xd0
add eax, 0xd0
mov dword [ebp - 0x4c], eax
xor eax, eax
mov ecx, dword [ebp - 0x4c]
mov dword [ecx], 0x4550
mov edx, dword [ebp - 0x48]
add edx, 0xffc00000
mov esi, dword [ebp - 0x34]
mov dword [esi + 4], edx
mov dword [0x101f5e74], 0x341
mov edx, dword [ebp - 0x48]
mov dword [esi + 0x50], edx
cmp edx, 0
mov dword [ebp - 0x44], eax
jne 0x100fe895
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret