joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x408ecc
nop
mov ecx, 0x7f31350c
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x2b33577
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4054ef
Capabilities:
Terminate process

Disassembly:
push dword [esp + 4]
pop dword [0xdeadc0de]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x4055d1
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor eax, eax
cmp ebx, eax
je 0x405626
lea eax, [ebp + 0x10]
push eax
push 0x40
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
test eax, eax
je 0x405626
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push 0
push ebx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_WriteProcessMemory]
mov edi, eax
lea eax, [ebp + 0x10]
push eax
push dword [eax]
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
test eax, eax
je 0x405626
test edi, edi
setne cl
movzx eax, cl
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x96c2cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
lea edi, reloc.WINMM.dll_waveOutUnprepareHeader
jmp 0x96c308
bsf ebp, ebp
call 0x96c2f2
xchg bl, ch
jmp 0x96c336
xchg dx, ax
dec edi
jmp 0x96c37a
dec bx
jmp 0x96c362
rdtsc
mov ebx, 0xde87993b
jmp 0x96c3c4
lea edi, [esp + 0x20]
btr cx, cx
jne 0x96c35a
dec bx
rdtsc
mov ebx, 0xde87993b
jmp 0x96c3c4
bts cx, bx
mov bx, word [esp]
mov ecx, ebp
mov edx, dword [esp]
jmp 0x96c3a7
jmp 0x96c38f
push bp
not bl
lea esp, [esp + 2]
mov bx, cx
setae al
mov dh, byte [esp]
jmp 0x96c4b2
sub esp, 0xa0
mov esi, esp
clc
jge 0x96c3a5
bts cx, bx
mov bx, word [esp]
jmp 0x96c397
push eax
pop ax
add esp, 1
clc
mov edx, 0x199ad8ca
not ax
jmp 0x96c430
rol ebp, 0
jns 0x96c3d9
push eax
jmp 0x96c411
mov edx, 0x199ad8ca
jmp 0x96c3e5
pop ax
add esp, 1
clc
jmp 0x96c3f7
lea eax, [esp + edx]
cmc
pop bx
lea ebx, [edx + 0xb2]
call fcn.0096c480
loopne 0x96c44f
pop edx
mov ch, 0xa4
xlatb
lea esp, [esp + 1]
not ebp
sub esp, 0xe
je 0x96c419
jne 0x96c45b
lea ebx, [edx + 0xb2]
jmp 0x96c496
bsf ebx, edx
jns 0x96ca31
sbb dh, 0xcf
fmulp st(7)
bt bx, si
jmp 0x96c941
lea eax, [esp + edx]
cmc
pop bx
jmp 0x96c43d
xchg dl, bl
mov dl, byte [esp]
jmp 0x96c3ef
lea esp, [esp + 0xc]
inc ebp
xchg edx, eax
xchg ah, dh
mov ax, si
jmp 0x96c445
bsf edx, edx
js 0x96c476
xchg dl, bl
mov dl, byte [esp]
jmp 0x96c3ef
add ebp, dword [edi]
bswap ebx
rdtsc
mov dx, 0xf72c
jmp fcn.0096c543
push dword [esp + 9]
stc
lea esp, [esp + 3]
jmp 0x96c522
add dx, 0x35c7
jmp 0x96c538
dec ebp
sub esp, 0xf
jb 0x96c566
add dx, 0x35c7
push dword [esp + 9]
stc
lea esp, [esp + 3]
jmp 0x96c522
xchg bx, dx
bts eax, esi
jmp 0x96c5bb
shl dl, cl
jbe 0x96c5f2
xchg bx, dx
bts eax, esi
jmp 0x96c5bb
xor ebp, 0x4bc4bb83
setbe al
xchg bh, al
setp bl
xchg dl, dh
jmp 0x96c6d6
sbb dh, 0xcf
bt bx, si
jmp 0x96c941

Function at 0x96c632
Capabilities:
Execute anti-debugging instructions

Disassembly:
setle al
ror edx, 0xe
mov edx, 0x458fe1f9
jmp 0x96c65a
bsf edx, ecx
bsf edx, edi
xchg dword [esp], esi
cmp ah, 0x18
sub esp, 0xb
pop dx
jmp 0x96c6aa
mov ax, word [esp]
mov dh, 0x4e
mov ax, word [esp + 5]
lea esp, [esp + 1]
lea esi, [esi + 0x71]
lea edx, [ebx + edi]
bt edx, ecx
jmp 0x96c694

Function at 0x96cae4
Capabilities:
Execute anti-debugging instructions

Disassembly:
shl eax, 2
xchg dh, dl
jmp 0x96caef
setl dh
jmp 0x96be81
Function at 0x96cbf4
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x96cd24
mov dx, 0xdec9
jmp 0x96cceb
mov dx, 0xdec9
rdtsc
lea esp, [esp + 3]
jmp 0x96ccf1
lea eax, [edi*4]
jmp 0x96cc53
neg ax
lea eax, [edi*4]
lea esp, [esp + 0x20]
neg bl
sub esp, 0x16
jmp 0x96ccbd
xchg dword [esp + 6], edx
xchg byte [esp + 0xf], al
mov edx, 0xb2ec9da7
bsr edx, ebx
mov dx, si
push word [esp + 7]
jmp 0x96cca6
mov edx, 0x1c5246fe
neg ax
jl 0x96cc49
neg ax
jmp 0x96cc33
mov edx, 0xb2ec9da7
bsr edx, ebx
mov dx, si
jmp 0x96cc75
bsf dx, cx
jg 0x96ccc9
jle 0x96ccc9
std
cli
popfd
insb byte es:[edi], dx
invalid
jno 0x96cc62
xchg dword [esp + 6], edx
xchg byte [esp + 0xf], al
jmp 0x96cc99
lea esp, [esp + 0x18]
xor bl, 0x6a
push bx
jmp 0x96cd0c
btc dx, si
clc
jmp 0x96ccf6
rdtsc
lea esp, [esp + 3]
rol bl, 0
jmp 0x96cc8a
lea esp, [esp + 2]
jmp 0x96cda5
neg dl
jb 0x96ccd4
btc dx, si
clc
lea esp, [esp + 2]
jmp 0x96cda5
rdtsc
mov word [esp], di
push ax
sub esp, 0x1d
jg 0x96cbf9
jle 0x96cc04
bsr dx, bp
jmp 0x96cd55
bsr dx, bp
and ebx, 0x3c
lea edx, [edi*4]
rdtsc
call fcn.0096cd77
ljmp 0x8df
add bl, 0xc9
bswap edx
ror edx, cl
jnp 0x96cd51
jp 0x96cd3b
pushfd
bt edx, ecx
xchg word [esp], dx
xchg dword [esp + 4], ecx
mov dx, word [esp]
mov ax, 0x4080
jmp 0x96cdf9
push dword [esp + 4]
ret 8

Function at 0x973bd5
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x95a697
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x95a6b1
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x95a6a0
pop esi
jmp 0x95a6bc
ret 4
jmp 0x95a68a

Function at 0x9a629e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x9a62f5
mov edx, 0x10b
cmc
jmp 0x9a62c7
lea esp, [esp + 4]
cmp word [eax + 0x18], dx
je 0x9a6066
lea eax, [ebx + ebp]
jmp 0x9a630b
pushal
mov ax, dx
xor eax, eax
lea esp, [esp + 0x20]
jmp 0x9a607c

Function at 0x9a7809
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
jne 0x9a620b
je 0x9a6171
lea ebp, [ebp + ebp]
jmp 0x9a7874
mov dword [ebp - 0xc], eax
jmp 0x9a620b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + eax*4]
add eax, dword [ebp + 8]
jmp 0x9a783a
lea ebp, [edi + ebp]
movzx eax, word [ebp]
pop ebp
sub esp, 0
jmp 0x9a7850

Function at 0x9a79b3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
jle 0x9a6243
jmp 0x9a620b
lea esp, [esp + 2]
jmp 0x9a791b

Function at 0xa49753
Capabilities:
Access peb ldr_data

Disassembly:
pop dword [esp + 0x15]
lea esp, [esp + 2]
mov dword [esp + 0x50], esi
pushal
jmp 0xa4970d
Function at 0x401b46
Capabilities:
Check if file exists
Check mutex on windows
Copy file
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa24
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov esi, 0x104
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x218]
push esi
push eax
push ebx
call edi
lea eax, [ebp - 0x520]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.004035ba
test eax, eax
je 0x401c00
lea eax, [ebp - 0x520]
push 0
push eax
call fcn.004029c0
test eax, eax
je 0x401c00
push 0x4012d4
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [ebp - 0x10], eax
je 0x401be4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401be4
push 0x10030
push ebx
push 2
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.004038cc
mov dword [ebp - 4], 0x800700b7
jmp 0x401e79
call fcn.00403a3b
test eax, eax
jne 0x401c0c
push 0x10030
push ebx
push 9
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.004038cc
mov dword [ebp - 4], 0x80004005
jmp 0x401e79
lea eax, [ebp - 0x218]
push eax
call fcn.00403560
lea eax, [ebp - 0x218]
push 0x4013f0
push eax
jmp 0x41f014
cmp dword [ebp - 0xc], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x401e8a
push dword [ebp - 0xc]
call esi
cmp dword [ebp - 0x10], 0
je 0x401e95
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x402608
Capabilities:
Copy file
Delete file
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
push ebx
and byte [ebp - 0x228], 0
push esi
push edi
lea eax, [ebp - 0x430]
push 0x104
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x430]
push eax
call fcn.00403560
lea eax, [ebp - 0x32c]
xor edi, edi
push eax
push edi
lea eax, [ebp - 0x430]
push 0x4014ec
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp - 0x32c]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x32c]
push edi
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push edi
push edi
call fcn.0040396e
test eax, eax
mov eax, 0x4014d4
jne 0x402690
mov eax, 0x4014c0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push eax
lea eax, [ebp - 0x534]
push eax
call esi
push edi
push dword [ebp + 0x10]
call fcn.00402c55
mov dword [ebp + 8], eax
lea eax, [ebp - 0x63c]
push eax
push dword [ebp + 0x10]
call fcn.004035ba
test eax, eax
je 0x402714
lea eax, [ebp - 0x63c]
push 0x4014ac
push eax
call fcn.00403529
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x63c]
push eax
call fcn.004029c0
test eax, eax
je 0x402714
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov edi, 0x4014a4
lea eax, [ebp - 0x20]
push edi
push eax
call ebx
test eax, eax
je 0x40270a
mov edi, 0x40149c
lea eax, [ebp - 0x20]
push edi
push eax
call ebx
test eax, eax
jne 0x402714
lea eax, [ebp - 0x228]
push edi
push eax
call esi
cmp byte [ebp - 0x228], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, 0x401498
je 0x402742
lea eax, [ebp - 0x534]
push ebx
push eax
call edi
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x534]
push eax
call edi
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 0x10]
call fcn.00402ae6
call fcn.00403bc3
push 0
push 0
mov dword [ebp + 0xc], eax
call fcn.0040396e
test eax, eax
je 0x4027b3
lea eax, [ebp - 0x124]
push 0x401480
push eax
call esi
cmp byte [ebp - 0x228], 0
je 0x402797
lea eax, [ebp - 0x124]
push ebx
push eax
call edi
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x124]
push eax
call edi
lea eax, [ebp - 0x430]
push 0
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x32c]
push eax
call fcn.00403e01
push dword [ebp + 0x10]
call fcn.004037e4
lea eax, [ebp - 0x124]
push 0x401470
push eax
call esi
cmp byte [ebp - 0x228], 0
je 0x4027ec
lea eax, [ebp - 0x124]
push ebx
push eax
call edi
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x124]
push eax
call edi
lea eax, [ebp - 0x430]
push 4
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x32c]
push eax
call fcn.00403e01
push dword [ebp + 0x10]
lea eax, [ebp - 0x124]
push eax
call esi
lea eax, [ebp - 0x124]
push 0x401460
push eax
jmp section..htext
Function at 0x4060a2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41bb18]
jne 0x4060ac
repz ret
jmp fcn.0040ec00

Function at 0x4140de
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004093e6
and dword [ebp - 4], 0
cmp dword [0x9c9818], 0
mov ebx, eax
jne 0x41418f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x414240
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x414240
push eax
call fcn.00409374
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x9c9818], eax
call esi
push eax
call fcn.00409374
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x9c981c], eax
call esi
push eax
call fcn.00409374
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x9c9820], eax
call esi
push eax
call fcn.00409374
pop ecx
mov dword [0x9c9828], eax
test eax, eax
je 0x41418f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00409374
pop ecx
mov dword [0x9c9824], eax
mov eax, dword [0x9c9824]
cmp eax, ebx
je 0x4141e7
cmp dword [0x9c9828], ebx
je 0x4141e7
push eax
call fcn.004093ef
push dword [0x9c9828]
mov esi, eax
call fcn.004093ef
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4141e7
test edi, edi
je 0x4141e7
call esi
test eax, eax
je 0x4141de
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4141de
test byte [ebp - 0xc], 1
jne 0x4141e7
or dword [ebp + 0x10], 0x200000
jmp 0x414220
mov eax, dword [0x9c981c]
cmp eax, ebx
je 0x414220
push eax
call fcn.004093ef
pop ecx
test eax, eax
je 0x414220
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x414220
mov eax, dword [0x9c9820]
cmp eax, ebx
je 0x414220
push eax
call fcn.004093ef
pop ecx
test eax, eax
je 0x414220
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x9c9818]
call fcn.004093ef
pop ecx
test eax, eax
je 0x414240
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x414242
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100839a7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10158c40]
jne 0x100839b1
repz ret
jmp fcn.100856bc

Function at 0x10086c83
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10082654
and dword [ebp - 4], 0
cmp dword [0x1015a75c], 0
mov ebx, eax
jne 0x10086d34
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10086de5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10086de5
push eax
call fcn.100825e2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1015a75c], eax
call esi
push eax
call fcn.100825e2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1015a760], eax
call esi
push eax
call fcn.100825e2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1015a764], eax
call esi
push eax
call fcn.100825e2
pop ecx
mov dword [0x1015a76c], eax
test eax, eax
je 0x10086d34
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100825e2
pop ecx
mov dword [0x1015a768], eax
mov eax, dword [0x1015a768]
cmp eax, ebx
je 0x10086d8c
cmp dword [0x1015a76c], ebx
je 0x10086d8c
push eax
call fcn.1008265d
push dword [0x1015a76c]
mov esi, eax
call fcn.1008265d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10086d8c
test edi, edi
je 0x10086d8c
call esi
test eax, eax
je 0x10086d83
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10086d83
test byte [ebp - 0xc], 1
jne 0x10086d8c
or dword [ebp + 0x10], 0x200000
jmp 0x10086dc5
mov eax, dword [0x1015a760]
cmp eax, ebx
je 0x10086dc5
push eax
call fcn.1008265d
pop ecx
test eax, eax
je 0x10086dc5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10086dc5
mov eax, dword [0x1015a764]
cmp eax, ebx
je 0x10086dc5
push eax
call fcn.1008265d
pop ecx
test eax, eax
je 0x10086dc5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1015a75c]
call fcn.1008265d
pop ecx
test eax, eax
je 0x10086de5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10086de7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10087e8e
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101581d0], 0
mov byte [0x101581d4], 0
mov edi, dword [0x101581c4]
add edi, 0xe84
mov dword [0x101581c8], edi
mov dword [0x101581cc], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x10087f88
xor eax, eax
mov dword [0x101581cc], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x101581d8], 0
mov edi, dword [0x101581d0]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x101581d8], esi
mov dword [0x101581c4], 0x233b
mov eax, esi
cdq
idiv ecx
mov dword [0x101581d0], edx
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x101581d4], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x101581d4]
mov esi, dword [0x101581d0]
mov byte [ebx + esi], cl
mov esi, dword [0x101581cc]
add esi, 1
mov dword [0x101581cc], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x10087eef
jmp 0x10087fbd
mov eax, dword [ebp - 0x1c]
mov dword [0x101581c8], 0x8b8
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101581cc]
add eax, 1
mov dword [0x101581cc], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x10087f88
jmp 0x10087ee0
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10088189
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x10152511]
mov esi, 0xe
lea edi, [ebp - 0x28]
mov dword [0x101581c4], 0x1540
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
call fcn.10087df3
mov dword [0x101581c4], 0x1b9e
call fcn.1008842a
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.10087ccf
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
je 0x100882b2
mov eax, dword [ebp - 0x3c]
mov dword [0x101581c4], 0x505
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x101581c4], 0x1847
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x44], eax
call fcn.1008805e
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x101581c4], 0x14d0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x30]
mov dword [edx + 8], ecx
mov ecx, dword [ebp - 0x44]
mov dword [edx + 0x10], ecx
mov dword [0x101581c8], 0xc82
cmp ecx, 0
mov dword [ebp - 0x40], eax
je 0x100882b2
mov eax, dword [0x101581c4]
mov ecx, dword [ebp - 0x44]
add ecx, 0x12ed
add eax, 0x2182
mov dword [0x101581c4], eax
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x40]
add esp, 0x4c
pop esi
pop edi
pop ebp
ret
Function at 0x10088ae3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
call fcn.10088de7
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, dword [0x101581c4]
add edi, 0x20f3
mov dword [0x101581c4], edi
mov esi, dword [eax + esi + 0x78]
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x101581c8], 0x1487
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x10088b9e
jmp 0x10088ba9
mov eax, dword [ebp - 0x28]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x101581c4], 0x954
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [ebp - 0x24], edx
jmp 0x10088b9e
mov al, byte [ebp - 0x29]
test al, 1
jne 0x10088b40
jmp 0x10088c07
mov al, byte [ebp - 0x2a]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x30]
add edx, 1
mov ah, byte [ebp - 0x29]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x34], edx
jne 0x10088bd5
jmp 0x10088b67
mov eax, dword [ebp - 0x24]
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + ecx*4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov ecx, eax
mov edx, dword [ebp - 0x44]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2a], bh
mov byte [ebp - 0x29], cl
je 0x10088b67
jmp 0x10088b73
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov edx, dword [ebp - 0x28]
add edx, 2
mov esi, dword [ebp - 0x18]
cmp ecx, esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], edx
jb 0x10088bbb
jmp 0x10088b9e