joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100176c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10017870
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1001778d
mov edx, dword [ebp - 4]
cmp edx, dword [0x101499c8]
jb 0x1001770a
mov eax, dword [ebp - 4]
cmp eax, dword [0x101499cc]
ja 0x1001770a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x100176da
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1001d760
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10017730
jmp 0x1001778d
cmp dword [ebp - 0x14], 0x10000
jne 0x10017773
cmp dword [ebp - 0x18], 0x10000
jb 0x10017773
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10017766
mov eax, dword [ebp - 8]
jmp 0x1001778f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10017788
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10017870
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100176da
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100177a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.100178a0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10017865
mov edx, dword [ebp - 4]
cmp edx, dword [0x101499c8]
jb 0x100177e5
mov eax, dword [ebp - 4]
cmp eax, dword [0x101499cc]
ja 0x100177e5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x100177b5
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.1001d760
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1001780b
jmp 0x10017865
cmp dword [ebp - 0x14], 0x10000
jne 0x1001784e
cmp dword [ebp - 0x18], 0x10000
jb 0x1001784e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10017841
mov eax, dword [ebp - 8]
jmp 0x10017867
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10017860
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.100178a0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x100177b5
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100178d0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10017cc0
add esp, 0xc
mov dword [ebp - 4], 0
cmp dword [0x10a6cb78], 0
jne 0x1001790d
cmp dword [0x10a6cb74], 0
je 0x1001790d
mov eax, dword [0x10a6cb74]
mov dword [0x10a6cb78], eax
cmp dword [0x10a6cb78], 0
je 0x1001798a
mov ecx, dword [0x10a6cb78]
cmp dword [ecx + 8], 0
je 0x1001798a
mov edx, dword [0x10a6cb78]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0x10]
jb 0x1001798a
mov ecx, dword [0x10a6cb78]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x1001798a
mov eax, dword [0x10a6cb78]
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jb 0x10017959
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jbe 0x10017960
xor eax, eax
jmp 0x10017aa9
mov ecx, dword [0x10a6cb78]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 4]
push ecx
call fcn.1001d760
add esp, 0xc
mov eax, dword [ebp - 4]
jmp 0x10017aa9
mov edx, dword [0x10a6cb74]
mov dword [0x10a6cb78], edx
jmp 0x100179a6
mov eax, dword [0x10a6cb78]
mov ecx, dword [eax + 4]
mov dword [0x10a6cb78], ecx
cmp dword [0x10a6cb78], 0
je 0x100179e6
cmp dword [0x10a6cb78], 0
je 0x100179e4
mov edx, dword [0x10a6cb78]
cmp dword [edx + 8], 0
je 0x100179e4
mov eax, dword [0x10a6cb78]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 0x10]
jb 0x100179e4
mov edx, dword [0x10a6cb78]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x100179e4
jmp 0x1001793e
jmp 0x10017998
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10017ab0
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10017aa7
mov eax, dword [ebp - 0x18]
mov dword [0x10a6cb78], eax
mov ecx, dword [0x10a6cb78]
mov dword [ecx], 0x52727464
mov edx, dword [0x10a6cb78]
mov dword [edx + 8], 0
mov eax, dword [0x10a6cb78]
mov ecx, dword [0x10a6cb74]
mov dword [eax + 4], ecx
mov edx, dword [0x10a6cb78]
mov dword [0x10a6cb74], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x10a6cb78]
add eax, 0x48
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x38c
jmp 0x10017a77
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 1
jle 0x10017a97
imul edx, dword [ebp - 8], 0x48
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
imul edx, dword [ebp - 8], 0x48
add edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
jmp 0x10017a6e
mov eax, dword [0x10a6cb78]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x1001793e
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1002b9d0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002b84f

Function at 0x100303e5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100300a5
Function at 0x1015334c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x101cd9d8]
mov dword [0x101cd9e0], 0
mov dword [0x101cd9e4], 0
mov dword [0x101cd9f0], 0
add ebx, 0xffffc789
mov dword [0x101cd9d8], ebx
mov dword [0x101cd9dc], 0xbed
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x101534cf
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x14]
mov edi, 0x100
mov dword [0x101cd9dc], 0x77b
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv edi
mov dword [0x101cd9e0], edx
mov ecx, dword [ebp - 0x34]
add ecx, 0xffffea2b
mov dword [0x101cd9d8], ecx
mov ecx, dword [ebp - 0x24]
movzx ebx, byte [ecx + edx]
add ebx, esi
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv edi
mov dword [0x101cd9e4], edx
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x101cd9e8], cl
mov edi, dword [ebp - 0x24]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x101cd9e8]
mov edx, dword [0x101cd9e4]
mov byte [edi + edx], cl
mov dword [0x101cd9d8], 0x1fda
mov edx, dword [0x101cd9e0]
movzx edx, byte [edi + edx]
mov ebx, dword [0x101cd9e4]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x101cd9f0], ebx
mov dword [0x101cd9d8], 0x18c7
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x30]
xor cl, byte [edx + ebx]
mov edx, dword [ebp - 0x20]
mov byte [edx + ebx], cl
mov ecx, dword [0x101cd9d8]
add ecx, 0x17e7
mov dword [0x101cd9d8], ecx
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ecx
je 0x101534cf
mov eax, dword [0x101cd9e0]
mov ecx, dword [0x101cd9e4]
mov edx, dword [ebp - 0x40]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], esi
jmp 0x101533c4
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101536e4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x3c
mov eax, dword [0x101cd9dc]
add eax, 0x19e3
mov dword [0x101cd9dc], eax
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
mov eax, 0x30a4
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov esi, dword [edx + 0x3c]
mov dword [0x101cd9d8], 0x30a4
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
jmp 0x101537e1
mov dword [0x101cd9dc], 0x1c82
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x10153845
jmp 0x10153894
mov dword [0x101cd9d8], 0x1c3c
mov eax, 0x1c3c
mov ecx, dword [ebp - 0x24]
add ecx, 1
cmp ecx, 0x104
mov edx, eax
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x2c], ecx
jl 0x101537e1
jmp 0x10153801
mov dword [0x101cd9d8], 0x1cf9
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0xe], 0x6c
sete dl
mov byte [ebp - 0x2d], dl
mov eax, 0xffffec0f
mov ecx, 0x1cf9
mov dl, byte [ebp - 0x2d]
test dl, 1
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
jne 0x101537ca
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [0x101cd9d8], eax
mov cl, byte [ebp - 0x2d]
and cl, 1
movzx eax, cl
add esp, 0x3c
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp word [edx + eax*2], 0
mov esi, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
jne 0x1015375d
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
add ecx, 0xfffffcc0
mov dword [0x101cd9dc], ecx
mov ecx, dword [ebp - 0x14]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x20], eax
jne 0x10153894
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff4
shl eax, 1
mov ecx, dword [ebp - 0x14]
add ecx, eax
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
cmp word [eax], 0x6f
je 0x1015373b
jmp 0x10153894
mov dword [0x101cd9dc], 0xa55
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
mov dx, word [eax + ecx*2 - 0x14]
mov word [ebp - 0x3e], dx
mov ax, word [ebp - 0x3e]
cmp ax, 0x64
jne 0x10153894
mov dword [0x101cd9d8], 0x4c3
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x10153894
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x1015378f
xor eax, eax
add esp, 0x3c
pop esi
pop ebp
ret
Function at 0x101538db
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 8]
mov dword [0x101cd9dc], 0x19f3
mov dword [0x101cd9d8], 0x162b
mov dword [ebp - 0x10], eax
call fcn.101534d7
mov ecx, eax
mov edx, ecx
add edx, dword [eax + 0x3c]
mov eax, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
mov esi, dword [ebp - 0x14]
cmp edx, 0x4550
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esi
je 0x10153933
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x78]
mov ecx, dword [ebp - 0x18]
add ecx, dword [ecx + eax + 0x20]
mov edx, dword [ebp - 0x18]
mov esi, dword [edx + eax + 0x24]
mov dword [0x101cd9d8], 0x217d
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
je 0x10153a59
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x30]
add ecx, edx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
jmp 0x10153992
mov al, byte [ebp - 0x41]
test al, 1
jne 0x10153a36
jmp 0x10153a0c
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov esi, dword [ebp - 0x2c]
mov edi, dword [esi + ecx*4]
mov dword [0x101cd9dc], 0x19f3
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x54]
mov ecx, eax
mov edx, dword [ebp - 0x50]
add ecx, edx
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x58], eax
mov byte [ebp - 0x59], bh
mov byte [ebp - 0x41], cl
je 0x10153985
mov eax, dword [ebp - 0x58]
add eax, 1
mov cl, byte [ebp - 0x59]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x41]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x54], eax
jne 0x101539b6
jmp 0x10153985
xor eax, eax
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov edx, dword [ebp - 0x48]
add edx, 2
mov esi, dword [ebp - 0x34]
cmp ecx, esi
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], eax
jb 0x10153992
jmp 0x10153a59
mov eax, dword [ebp - 0x48]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x28]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x18]
add edi, dword [edx + ecx*4]
mov dword [0x101cd9d8], 0x1821
mov dword [ebp - 0x38], edi
mov eax, dword [ebp - 0x38]
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10153d47
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101cd9d8], 0x24e8
mov dword [0x101cd9e4], 0
mov byte [0x101cd9e8], 0
mov dword [0x101cd9dc], 0xb3a
mov dword [0x101cd9e0], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10153daa
mov dword [0x101cd9dc], 0x6d5
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101cd9d8]
add eax, 0x1b14
mov dword [0x101cd9d8], eax
mov eax, dword [0x101cd9e0]
add eax, 1
mov dword [0x101cd9e0], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10153daa
mov dword [0x101cd9d8], 0x17a9
mov dword [0x101cd9e0], 0
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10153dfa
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x101cd9ec], 0
mov edx, dword [0x101cd9e4]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x101cd9ec], edi
mov eax, edi
cdq
idiv ecx
mov dword [0x101cd9e4], edx
mov ecx, dword [0x101cd9dc]
add ecx, 0xffffef2c
mov dword [0x101cd9d8], ecx
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x101cd9e8], cl
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov dword [0x101cd9dc], 0x1d09
mov cl, byte [0x101cd9e8]
mov edx, dword [0x101cd9e4]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x101cd9e0]
add edx, 1
mov dword [0x101cd9e0], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x10153dfa
jmp 0x10153d98
Function at 0x101544a5
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x101cd9dc], 0x1324
mov dword [0x101cd9d8], 0x76a
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
jmp 0x101544da
mov eax, dword [ebp - 0x30]
add esp, 0x4c
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov cl, byte [eax + 0x101551ec]
mov dl, byte [eax + 0x101551bd]
sub dl, cl
mov byte [ebp + eax - 0x20], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x2c], eax
jne 0x101544da
lea eax, [ebp - 0x20]
mov dword [0x101cd9dc], 0x2a06
mov dword [0x101cd9d8], 0x151c
mov dword [ebp - 0x34], eax
call fcn.101541c2
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.1015430a
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [0x101cd9dc], 0x4ca
mov ecx, dword [ebp - 0x38]
cmp ecx, 0
mov dword [ebp - 0x30], eax
je 0x101544d2
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x101cd9d8], 0x142
mov dword [esp], eax
mov ecx, dword [ebp - 0x24]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.10153f7e
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
mov dword [0x101cd9dc], 0x1e0f
add ecx, 0xffc00000
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x54], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x40], ecx
mov dword [0x101cd9d8], 0x1881
cmp ecx, 0
mov dword [ebp - 0x30], eax
je 0x101544d2
mov eax, dword [ebp - 0x3c]
add eax, 0x1000
mov dword [0x101cd9d8], 0xd24
mov dword [ebp - 0x30], eax
jmp 0x101544d2
Function at 0x10154910
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x80]
lea ecx, [esp + 0x28]
mov dword [0x101cd9dc], 0x1011
mov dword [0x101cd9d8], 0x1579
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.10154611
lea ecx, [0x10153244]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x58], edx
mov dword [esp + 0x38], 0x167400
mov edx, dword [0x101cd9c4]
mov dword [esp + 0x34], edx
mov edx, dword [0x101cd9c8]
mov dword [esp + 0x6c], edx
mov edx, dword [0x101cd9cc]
mov dword [esp + 0x70], edx
mov edx, dword [0x101cd9d0]
mov dword [esp + 0x54], edx
mov dword [0x101cd9d8], 0x1dc9
mov edx, dword [0x101cd9d4]
mov dword [esp + 0x44], edx
mov dword [0x101cd9dc], 0xa28
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x10154a21
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x10154a21
lea eax, [esp + 0x28]
mov dword [0x101cd9d8], 0x1725
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.101544a5
mov dword [0x101cd9dc], 0x15b2
mov dword [esp + 0x14], eax
mov eax, esp
lea ecx, [esp + 0x28]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
call eax
sub esp, 4
mov eax, 2
mov ecx, dword [0x101cd9dc]
add ecx, 0xffffd94b
mov dword [0x101cd9d8], ecx
mov dword [esp + 0x10], eax
jmp 0x10154a8a
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
jne 0x101549b0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
jne 0x101549b0
mov eax, dword [esp + 0x18]
mov dword [esp + 0x64], eax
mov dword [0x101cd9d8], 0x242c
mov ecx, dword [esp + 0xc]
add ecx, 0x50
add eax, ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov dword [esp + 0x50], ecx
call fcn.101536e4
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
je 0x101549c4
mov eax, dword [esp + 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x10006c20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push esi
mov esi, 0x811c9dc5
xor edx, edx
movzx eax, byte [edx + ecx]
xor eax, esi
imul esi, eax, 0x1000193
inc edx
cmp edx, 4
jb 0x10006c28
mov eax, esi
pop esi
ret
Function at 0x10028803
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10028867
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
push 0x2cb8
push 0x5875
mov eax, dword [ebp - 0x10]
push dword [eax]
push 1
push 0xd50
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
push dword [eax]
push 0x55db
push 0x2b2
call fcn.10027ad3
add esp, 0x24
jmp 0x1002886d
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esp, ebp
pop ebp
ret

Function at 0x1002bb69
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002bb8d
xor eax, eax
jmp 0x1002bcb8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002bbab
xor eax, eax
jmp 0x1002bcb8
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 8]
push eax
call fcn.1002ba4d
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x1002bbca
xor eax, eax
jmp 0x1002bcb8
push dword [ebp - 8]
lea eax, [ebp - 0x24]
push eax
push 0x7fad
push dword [ebp - 0x10]
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1002b8e2
add esp, 0x1c
push 0x5f7c
push dword [ebp - 8]
push 0x1ba0
push dword [ebp + 8]
push dword [ebp - 4]
push 0
push 0x6e67
call fcn.10023cfa
add esp, 0x1c
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x1c], ecx
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x1dd3
push 0x2ba9
call fcn.1002ba93
add esp, 0x14
push dword [ebp - 4]
call fcn.1002b571
pop ecx
test eax, eax
jne 0x1002bc46
xor eax, eax
jmp 0x1002bcb8
push 1
push 0x50ea
lea eax, [ebp - 4]
push eax
push 0x3765
call fcn.1002bb07
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002bca0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
jne 0x1002bc7d
xor eax, eax
jmp 0x1002bcb8
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002bc96
xor eax, eax
jmp 0x1002bcb8
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002bcb1
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x1002bcb5
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x10042d22
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10042d57
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov dword [eax + 0xc], ecx
jmp 0x10042d64
push 0x1b1b
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esp, ebp
pop ebp
ret