joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4230a0
Capabilities:
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x43c71b
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x44a5d0]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
push esi
mov eax, dword [0x44a5d0]
xor eax, esp
push eax
lea eax, [esp + 0x9c]
mov dword fs:[0], eax
mov eax, dword [esp + 0xac]
push 0x233
push 0x236
mov esi, edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], ecx
call fcn.0040ac10
mov dword [esp + 0xa4], 0
mov eax, dword [edi + 4]
push 0x231
push eax
mov dword [edi], vtable.LoginWindow.0
call dword [sym.imp.USER32.dll_LoadBitmapW]
push eax
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [edi + 0x10], eax
mov eax, dword [edi + 8]
push 0x13cc
push eax
call ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
mov ebp, eax
push 0x31
push ebp
call esi
lea edx, [esp + 0x38]
push edx
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
fild dword [esp + 0x38]
fmul qword [0x443498]
call fcn.004374a0
mov dword [esp + 0x38], eax
lea eax, [esp + 0x38]
push eax
mov dword [esp + 0x4c], 0x2bc
mov byte [esp + 0x50], 1
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 0
push eax
push 0x30
push ebp
call esi
mov eax, dword [edi + 8]
push 0x13db
push eax
call ebx
push 0
push 0
mov ebp, eax
push 0x31
push ebp
call esi
lea ecx, [esp + 0x38]
push ecx
push 0x5c
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
fild dword [esp + 0x38]
fmul qword [0x4434d8]
call fcn.004374a0
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x4c], 0x190
mov byte [esp + 0x50], 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 0
push eax
push 0x30
push ebp
call esi
mov eax, dword [esp + 0x10]
mov ebp, 8
cmp dword [eax + 0x18], ebp
mov dword [esp + 0x14], vtable.LabelTextSetter.0
jb 0x4231f9
mov esi, dword [eax + 4]
jmp 0x4231fc
lea esi, [eax + 4]
mov eax, dword [edi + 8]
push 0x13cc
push eax
call ebx
push eax
mov edx, esi
lea ecx, [esp + 0x18]
call fcn.004069c0
mov eax, dword [edi + 8]
push 0
push eax
mov byte [edi + 0x3d], 0
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00421b20
lea esi, [esp + 0x1c]
call fcn.00419460
cmp dword [eax + 0x14], 0
sete bl
cmp dword [esp + 0x34], ebp
jb 0x42324b
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004258ad
add esp, 4
push 0
test bl, bl
je 0x423261
mov edx, dword [edi + 8]
push 0x44bd40
push 0x18aa1
push edx
jmp 0x42326f
mov eax, dword [edi + 8]
push 0x44bd44
push 0x18aa1
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, edi
mov ecx, dword [esp + 0x9c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.00425821
add esp, 0x98
ret 4

Function at 0x425821
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44a5d0]
jne 0x42582b
repz ret
jmp fcn.0042b85a
Function at 0x436889
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042c5ba
and dword [ebp - 4], 0
cmp dword [0x44ccf0], 0
mov ebx, eax
jne 0x43693a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4369eb
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4369eb
push eax
call fcn.0042c548
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44ccf0], eax
call esi
push eax
call fcn.0042c548
mov dword [esp], 0x44078c
push edi
mov dword [0x44ccf4], eax
call esi
push eax
call fcn.0042c548
mov dword [esp], 0x440770
push edi
mov dword [0x44ccf8], eax
call esi
push eax
call fcn.0042c548
pop ecx
mov dword [0x44cd00], eax
test eax, eax
je 0x43693a
push 0x440758
push edi
call esi
push eax
call fcn.0042c548
pop ecx
mov dword [0x44ccfc], eax
mov eax, dword [0x44ccfc]
cmp eax, ebx
je 0x436992
cmp dword [0x44cd00], ebx
je 0x436992
push eax
call fcn.0042c5c3
push dword [0x44cd00]
mov esi, eax
call fcn.0042c5c3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x436992
test edi, edi
je 0x436992
call esi
test eax, eax
je 0x436989
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x436989
test byte [ebp - 0xc], 1
jne 0x436992
or dword [ebp + 0x10], 0x200000
jmp 0x4369cb
mov eax, dword [0x44ccf4]
cmp eax, ebx
je 0x4369cb
push eax
call fcn.0042c5c3
pop ecx
test eax, eax
je 0x4369cb
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4369cb
mov eax, dword [0x44ccf8]
cmp eax, ebx
je 0x4369cb
push eax
call fcn.0042c5c3
pop ecx
test eax, eax
je 0x4369cb
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44ccf0]
call fcn.0042c5c3
pop ecx
test eax, eax
je 0x4369eb
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4369ed
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10ee2
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
xor esi, esi
cmp dword [esi*4 + 0x115a0], 0
je 0x10ef6
inc esi
cmp esi, 0x1f
jb 0x10ee6
mov edi, dword [esp + 0xc]
push edi
push esi
push 0x10ece
call sub.ntoskrnl.exe_DbgPrint
and dword [esi*4 + 0x115a4], 0
add esp, 0xc
mov dword [esi*4 + 0x115a0], edi
pop edi
mov eax, esi
pop esi
ret 4

Function at 0x11104
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 4]
mov cl, byte [eax]
movzx ecx, cl
push esi
lea esi, [eax + 1]
mov eax, ecx
sub eax, 0
je 0x111d5
dec eax
je 0x111be
dec eax
je 0x111a3
dec eax
je 0x11188
dec eax
je 0x1116d
dec eax
je 0x11152
dec eax
je 0x1113d
push ecx
push 0x1107a
jmp 0x111db
push 0x11092
call sub.ntoskrnl.exe_DbgPrint
pop ecx
call fcn.00011022
jmp 0x111e2
push esi
push 0x1109e
call sub.ntoskrnl.exe_DbgPrint
pop ecx
pop ecx
push esi
call fcn.00011048
push eax
call fcn.000112c1
jmp 0x111e2
push esi
push 0x110ae
call sub.ntoskrnl.exe_DbgPrint
pop ecx
pop ecx
push esi
call fcn.00011048
push eax
call fcn.00010f76
jmp 0x111e2
push esi
push 0x110be
call sub.ntoskrnl.exe_DbgPrint
pop ecx
pop ecx
push esi
call fcn.00011048
push eax
call fcn.00010fcc
jmp 0x111e2
push esi
push 0x110ce
call sub.ntoskrnl.exe_DbgPrint
pop ecx
pop ecx
push esi
call fcn.00011048
push eax
call fcn.00010f20
jmp 0x111e2
mov esi, dword [esi]
push esi
push 0x110e2
call sub.ntoskrnl.exe_DbgPrint
pop ecx
pop ecx
push esi
jmp section..htext
push esi
push 0x110f2
call sub.ntoskrnl.exe_DbgPrint
pop ecx
pop ecx
mov al, 1
pop esi
ret 8

Function at 0x112c1
Capabilities:
Persist via run registry key
Print debug messages
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 0x111e8
lea eax, [ebp - 0xc]
push eax
call edi
mov esi, dword [ebp + 8]
push esi
call fcn.0001054c
lea eax, [esi + eax*2]
jmp 0x112f0
cmp word [eax], 0x5c
je 0x112fa
dec eax
dec eax
cmp eax, esi
jne 0x112e8
cmp word [eax], 0x5c
jne 0x112fc
inc eax
inc eax
push eax
lea eax, [ebp - 0x14]
push eax
call edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
xor edi, edi
push 0xf003f
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 0xc0
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
je 0x11340
push 0x11268
jmp 0x11363
push esi
call fcn.0001054c
shl eax, 1
push eax
push esi
push 1
push edi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
test eax, eax
je 0x1136c
push 0x1127c
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
jmp 0x11379
push 0x112a0
call sub.ntoskrnl.exe_DbgPrint
xor eax, eax
inc eax
pop ecx
pop edi
pop esi
leave
ret 4
Function at 0x10001a7a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xb8
mov eax, esp
mov dword [eax + 4], 0x20c
mov dword [eax], 0x8ba9e8
mov eax, dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
call eax
sub esp, 8
lea ecx, [esp + 0xa0]
mov edx, esp
mov dword [edx + 8], 0x509
mov dword [edx + 4], 0x1aa43e
mov dword [edx], 0x7f110c
mov edx, dword [sym.imp.USER32.dll_GetUpdateRgn]
mov dword [esp + 0x84], eax
mov dword [esp + 0x80], ecx
call edx
sub esp, 0xc
mov byte [esp + 0xae], 1
mov ecx, esp
lea edx, [esp + 0xae]
mov dword [ecx], edx
mov dword [ecx + 0x18], 0x84f
mov dword [ecx + 0x14], 0xd7d
mov dword [ecx + 0x10], 0x1e8
mov dword [ecx + 0xc], 0xcae
scasb al, byte es:[edi]
or al, 0
add bh, al
inc ecx
or ch, dh
add byte [eax], al
add bh, al
inc ecx
add al, 9
pop es
add byte [eax], al

Function at 0x1019a1dc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101a4cb8]
jne 0x1019a1e6
repz ret
jmp fcn.1019bc4b

Function at 0x1019cd9f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1019a25d
and dword [ebp - 4], 0
cmp dword [0x101a61f8], 0
mov ebx, eax
jne 0x1019ce50
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1019cf01
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1019cf01
push eax
call fcn.1019a1eb
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101a61f8], eax
call esi
push eax
call fcn.1019a1eb
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101a61fc], eax
call esi
push eax
call fcn.1019a1eb
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101a6200], eax
call esi
push eax
call fcn.1019a1eb
pop ecx
mov dword [0x101a6208], eax
test eax, eax
je 0x1019ce50
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1019a1eb
pop ecx
mov dword [0x101a6204], eax
mov eax, dword [0x101a6204]
cmp eax, ebx
je 0x1019cea8
cmp dword [0x101a6208], ebx
je 0x1019cea8
push eax
call fcn.1019a266
push dword [0x101a6208]
mov esi, eax
call fcn.1019a266
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1019cea8
test edi, edi
je 0x1019cea8
call esi
test eax, eax
je 0x1019ce9f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1019ce9f
test byte [ebp - 0xc], 1
jne 0x1019cea8
or dword [ebp + 0x10], 0x200000
jmp 0x1019cee1
mov eax, dword [0x101a61fc]
cmp eax, ebx
je 0x1019cee1
push eax
call fcn.1019a266
pop ecx
test eax, eax
je 0x1019cee1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1019cee1
mov eax, dword [0x101a6200]
cmp eax, ebx
je 0x1019cee1
push eax
call fcn.1019a266
pop ecx
test eax, eax
je 0x1019cee1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101a61f8]
call fcn.1019a266
pop ecx
test eax, eax
je 0x1019cf01
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1019cf03
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1019e8f1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x48
mov eax, dword [ebp + 8]
mov dword [0x101a4738], 0x1dce
mov dword [ebp - 0x10], eax
call fcn.1019f82d
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x1019e937
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x101a4734], 0x18ed
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
je 0x1019e992
jmp 0x1019e97e
mov al, byte [ebp - 0x31]
test al, 1
jne 0x1019ea44
jmp 0x1019ea17
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
jmp 0x1019e99d
mov eax, dword [ebp - 0x30]
add esp, 0x48
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [0x101a4738], 0x1dce
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
mov ecx, eax
mov edx, dword [ebp - 0x48]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x51], bh
mov byte [ebp - 0x31], cl
je 0x1019e96e
mov eax, dword [ebp - 0x50]
add eax, 1
mov cl, byte [ebp - 0x51]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x31]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x4c], eax
jne 0x1019e9c1
jmp 0x1019e96e
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov edx, dword [ebp - 0x44]
add edx, 2
mov esi, dword [ebp - 0x2c]
cmp ecx, esi
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x3c], ecx
jb 0x1019e99d
jmp 0x1019e992
mov eax, dword [ebp - 0x44]
movzx ecx, word [eax]
mov dword [0x101a4734], 0x1941
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x101a4738], 0x92b
mov dword [ebp - 0x30], edi
jmp 0x1019e992
Function at 0x1019ed90
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x1019ee2c
mov eax, dword [ebp - 0x18]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], eax
jl 0x1019ee2c
jmp 0x1019ee46
mov eax, 1
mov ecx, 0x18d0
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x20]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
je 0x1019eeae
jmp 0x1019ee9f
mov dword [0x101a4734], 0x3d46
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1019ee9f
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1019ee7d
jmp 0x1019ee9f
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
jne 0x1019edbd
mov eax, dword [ebp - 0x1c]
mov dword [0x101a4738], 0x258e
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x20], eax
jne 0x1019ee9f
mov dword [0x101a4734], 0x636
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1019edfe
jmp 0x1019ee9f
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x1019ee9f
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x1019edd6
xor eax, eax
mov ecx, 0x1088
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
jmp 0x1019eeae
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [0x101a4734], eax
mov eax, ecx
add esp, 0x24
pop esi
pop ebp
ret
Function at 0x1019f07c
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101a4740], 0
mov byte [0x101a4744], 0
mov edi, dword [0x101a4734]
add edi, 0xfffff8e9
mov dword [0x101a4738], edi
mov dword [0x101a473c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1019f180
xor eax, eax
mov dword [0x101a473c], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x101a4748], 0
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov edi, dword [0x101a4740]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x101a4748], esi
mov dword [0x101a4734], 0xa1b
mov eax, esi
cdq
idiv ecx
mov dword [0x101a4740], edx
mov dword [0x101a4738], 0xd32
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x101a4744], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x101a4744]
mov esi, dword [0x101a4740]
mov byte [ebx + esi], cl
mov esi, dword [0x101a473c]
add esi, 1
mov dword [0x101a473c], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x1019f0dd
jmp 0x1019f1bf
mov eax, dword [ebp - 0x1c]
mov dword [0x101a4734], 0x7c1
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x101a4738], 0x17ea
mov eax, dword [0x101a473c]
add eax, 1
mov dword [0x101a473c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1019f180
jmp 0x1019f0ce
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1019f567
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x101a4738], 0x1e49
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x101a02cc]
mov dh, byte [eax + str.apl]
sub dh, dl
mov byte [ebp + eax - 0x24], dh
cmp ecx, 0xe
mov dword [ebp - 0x30], ecx
jne 0x1019f589
lea eax, [ebp - 0x24]
mov dword [0x101a4738], 0x1a22
mov ecx, dword [0x101a4734]
add ecx, 0xffffefe3
mov dword [0x101a4734], ecx
mov dword [ebp - 0x34], eax
call fcn.1019ea76
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.1019e67e
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x1019f69f
mov eax, dword [ebp - 0x38]
mov dword [0x101a4734], 0x2091
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.1019eecc
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x101a4734], 0x1f7a
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x4c], ecx
mov dword [0x101a4738], 0x8aa
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x14], ecx
add ecx, 0x2073
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x1019f696
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x1019f9b5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, 0x1e25
xor ebx, ebx
mov dword [0x101a473c], 0
mov dword [0x101a4740], 0
mov dword [0x101a474c], 0
mov dword [0x101a4734], 0xfa3
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, ebx
mov dword [ebp - 0x14], eax
mov eax, ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ebx
jne 0x1019fa2c
mov eax, dword [ebp - 0x28]
mov dword [0x101a4734], eax
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov esi, 0x100
add eax, 1
mov edi, edx
add edi, 1
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x101a473c], edx
mov dword [0x101a4734], 0x3264
mov ebx, dword [ebp - 0x24]
movzx ebx, byte [ebx + edx]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x101a4740], edx
mov ecx, dword [0x101a4738]
add ecx, 0xfffff82b
mov dword [0x101a4738], ecx
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x101a4744], cl
mov dword [0x101a4734], 0x26b4
mov ebx, dword [ebp - 0x24]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov dword [0x101a4738], 0x112a
mov cl, byte [0x101a4744]
mov edx, dword [0x101a4740]
mov byte [ebx + edx], cl
mov edx, dword [0x101a473c]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x101a4740]
movzx ecx, byte [ebx + ecx]
add ecx, edx
mov dword [0x101a4738], 0x55d
and ecx, 0xff
mov dword [0x101a474c], ecx
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov dword [0x101a4734], 0x65f
mov dword [0x101a4738], 0xffffdf97
xor ch, cl
mov edx, dword [ebp - 0x20]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x38], edi
je 0x1019fb3b
mov eax, dword [0x101a473c]
mov ecx, dword [0x101a4740]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x2c], eax
jmp 0x1019fa2c
mov eax, dword [0x101a4734]
add eax, 0xe82
mov dword [ebp - 0x28], eax
jmp 0x1019fa1c
Function at 0x1019fb4d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x80]
lea ecx, [esp + 0x20]
mov edx, dword [0x101a4734]
mov esi, edx
add esi, 0xffffdde0
mov dword [0x101a4738], esi
add edx, 0xffffe928
mov dword [0x101a4734], edx
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.1019f291
lea ecx, [0x1019f015]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x30], edx
mov dword [esp + 0x70], 0x13cc00
mov edx, dword [0x101a4720]
mov dword [esp + 0x40], edx
mov edx, dword [0x101a4724]
mov dword [esp + 0x54], edx
mov edx, dword [0x101a4728]
mov dword [esp + 0x2c], edx
mov edx, dword [0x101a472c]
mov dword [esp + 0x5c], edx
mov dword [0x101a4734], 0x5bd
mov edx, dword [0x101a4730]
mov dword [esp + 0x58], edx
mov dword [0x101a4738], 0xfffff4b2
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x1019fc33
mov eax, dword [esp + 0x10]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1019f567
mov ecx, esp
lea edx, [esp + 0x20]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [esp + 0x10], eax
jmp 0x1019fbfa
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0xc], eax
jne 0x1019fc56
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 8], ecx
je 0x1019fc6a
mov eax, dword [esp + 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x1019fc33
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 8]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x48], edx
mov dword [0x101a4734], 0xe1c
call fcn.1019ed90
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
je 0x1019fc04
jmp 0x1019fbfa