joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001ec0
Capabilities:
Hash data using crc32b

Disassembly:
push ebx
push esi
xor ebx, ebx
push edi
add edx, 4
xor eax, eax
test bl, 1
je 0x10001ed4
mov eax, 0x80
mov ecx, ebx
shr ecx, 1
test cl, 1
je 0x10001ee0
or eax, 0x40
shr ecx, 1
test cl, 1
je 0x10001eea
or eax, 0x20
shr ecx, 1
test cl, 1
je 0x10001ef4
or eax, 0x10
shr ecx, 1
test cl, 1
je 0x10001efe
or eax, 8
shr ecx, 1
test cl, 1
je 0x10001f08
or eax, 4
shr ecx, 1
test cl, 1
je 0x10001f12
or eax, 2
test cl, 2
je 0x10001f1a
or eax, 1
shl eax, 0x18
mov ecx, eax
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
mov ecx, eax
and ecx, 0x80000000
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
add eax, eax
xor ecx, eax
xor esi, esi
mov dword [edx], ecx
mov eax, ecx
lea ecx, [esi + 0x1f]
mov edi, edi
test al, 1
je 0x10001fdd
mov edi, 1
shl edi, cl
or esi, edi
dec ecx
shr eax, 1
cmp ecx, 0xffffffff
jg 0x10001fd0
mov dword [edx], esi
inc ebx
add edx, 4
cmp ebx, 0xff
jle 0x10001ec8
pop edi
pop esi
pop ebx
ret

Function at 0x10002000
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x10029390
push eax
lea ecx, [ebp - 4]
push ecx
mov dword [esi], 0xffffffff
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR100.dll_fopen_s]
add esp, 0xc
test eax, eax
je 0x10002032
xor al, al
mov esp, ebp
pop ebp
ret 4
push edi
push 0x400
call dword [sym.imp.MSVCR100.dll_malloc]
mov edi, eax
add esp, 4
mov dword [ebp - 8], edi
test edi, edi
jne 0x10002060
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
xor al, al
pop edi
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 4]
push eax
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
je 0x100020c4
push ebx
lea ebx, [ebx]
mov ecx, eax
mov edx, edi
test eax, eax
je 0x100020aa
mov eax, dword [esi]
movzx ebx, byte [edx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
shr eax, 8
xor eax, dword [ebx + edi*4 + 4]
inc edx
dec ecx
mov dword [esi], eax
jne 0x10002088
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
push 0x400
push 1
push edi
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
test eax, eax
jne 0x10002080
pop ebx
push edi
call dword [sym.imp.MSVCR100.dll_free]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.MSVCR100.dll_fclose]
mov eax, dword [esi]
not eax
add esp, 8
mov dword [esi], eax
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x10002360
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x102f6e4c], 0
mov eax, dword [0x102f6e90]
push esi
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x102f6e54], eax
jne 0x100023a1
call edi
mov ecx, dword [0x102f6e54]
push eax
push ecx
push 0x10002420
push 7
call esi
mov dword [0x102f6e4c], eax
test eax, eax
je 0x10002416
cmp dword [0x102f6e50], 0
jne 0x100023c6
call edi
mov edx, dword [0x102f6e54]
push eax
push edx
push 0x10002540
push 2
call esi
mov dword [0x102f6e50], eax
test eax, eax
je 0x10002416
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x552398
mov word [0x102f6e48], 0
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x552398], 0x10002780
mov edx, dword [ebp - 4]
push edx
push 4
push 0x552398
call esi
push 0x100027a0
push 0x5259dd
push 0xe8
call fcn.10026600
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10006250
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x1002f018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [0x102f76ec]
cmp eax, 0x12c
jae 0x10006287
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026fb8
mov esp, ebp
pop ebp
ret
fld dword [0x102f7724]
push esi
mov esi, dword [0x83a427c]
fld qword [0x1002c158]
push edi
mov edi, dword [0x102f7718]
cmp esi, edi
jl 0x100062f2
fld st(1)
fsub st(1)
call fcn.10027970
add eax, edi
cmp esi, eax
jg 0x100062f2
mov eax, dword [0x83a4278]
mov ecx, dword [0x102f771c]
cmp eax, ecx
jl 0x100062f2
add ecx, 0xa
cmp eax, ecx
jg 0x100062f2
xor eax, eax
fstp st(1)
fstp st(0)
cmp byte [0x83a42c4], al
je 0x10006494
cmp byte [0x83a4124], al
je 0x10006494
push str._doingoc_2
jmp 0x10006461
mov edi, dword [0x102f7710]
cmp esi, edi
jl 0x10006349
fld st(1)
fsub st(1)
call fcn.10027970
add eax, edi
cmp esi, eax
jg 0x10006349
mov eax, dword [0x83a4278]
mov ecx, dword [0x102f7714]
cmp eax, ecx
jl 0x10006349
add ecx, 0xa
cmp eax, ecx
jg 0x10006349
xor eax, eax
fstp st(1)
fstp st(0)
cmp byte [0x83a42c4], al
je 0x10006494
cmp byte [0x83a4124], al
je 0x10006494
push str._doingoc_1
jmp 0x10006461
mov edi, dword [0x102f7708]
cmp esi, edi
jl 0x100063a0
fld st(1)
fsub st(1)
call fcn.10027970
add eax, edi
cmp esi, eax
jg 0x100063a0
mov eax, dword [0x83a4278]
mov ecx, dword [0x102f770c]
cmp eax, ecx
jl 0x100063a0
add ecx, 0xa
cmp eax, ecx
jg 0x100063a0
xor eax, eax
fstp st(1)
fstp st(0)
cmp byte [0x83a42c4], al
je 0x10006494
cmp byte [0x83a4124], al
je 0x10006494
push str._doibox_4
jmp 0x10006461
mov edi, dword [0x102f7700]
cmp esi, edi
jl 0x100063f4
fld st(1)
fsub st(1)
call fcn.10027970
add eax, edi
cmp esi, eax
jg 0x100063f4
mov eax, dword [0x83a4278]
mov ecx, dword [0x102f7704]
cmp eax, ecx
jl 0x100063f4
add ecx, 0xa
cmp eax, ecx
jg 0x100063f4
xor eax, eax
fstp st(1)
fstp st(0)
cmp byte [0x83a42c4], al
je 0x10006494
cmp byte [0x83a4124], al
je 0x10006494
push str._doibox_3
jmp 0x10006461
fsubp st(1)
call fcn.10027970
mov edx, dword [0x102f76fc]
mov ecx, dword [0x102f76f8]
mov esi, eax
push 0xa
call fcn.10026750
add esp, 4
test al, al
je 0x10006430
xor eax, eax
cmp byte [0x83a42c4], al
je 0x10006494
cmp byte [0x83a4124], al
je 0x10006494
push str._doibox_2
jmp 0x10006461
mov edx, dword [0x102f76f4]
mov ecx, dword [0x102f76f0]
push 0xa
call fcn.10026750
add esp, 4
test al, al
je 0x100064a7
xor eax, eax
cmp byte [0x83a42c4], al
je 0x10006494
cmp byte [0x83a4124], al
je 0x10006494
push str._doibox_1
mov byte [0x83a4124], al
mov dword [0x7e11d28], eax
lea eax, [ebp - 0x68]
push eax
mov dword [0x559bec], 6
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [ebp - 0x68]
push ecx
mov edx, 0x4c1b90
call edx
add esp, 0xc
call ebx
mov dword [0x102f76ec], eax
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026fb8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.10026fb8
mov esp, ebp
pop ebp
ret
Function at 0x100066e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
push eax
call fcn.100065f0
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
add esp, 4
test al, al
je 0x10006720
xor ecx, ecx
test edi, edi
jle 0x10006720
mov dl, byte [0x102f6e59]
mov al, dl
imul byte [0x102f6e58]
push ebx
mov bl, byte [ecx + esi]
add bl, al
xor bl, dl
mov byte [ecx + esi], bl
inc ecx
cmp ecx, edi
jl 0x10006710
pop ebx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
push ecx
push edi
push esi
push edx
call dword [0x102f6e5c]
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x10006740
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor ecx, ecx
mov edi, 2
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 3
mov dword [ebp - 0x14], edi
lea esi, [ecx + 1]
mov eax, 0xf0f0f0f1
mul ecx
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100dd6c8]
mov byte [ebp - 1], al
mov eax, 0xf0f0f0f1
mul esi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100dd6c9]
movzx edx, byte [edi + 0x100dd67d]
mov byte [ebp - 3], al
mov byte [ebp - 2], dl
mov eax, 0xf0f0f0f1
mul edi
mov edi, dword [ebp - 0xc]
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100dd6ca]
movzx edx, byte [edi + 0x100dd67d]
mov byte [ebp - 5], al
mov byte [ebp - 4], dl
mov bl, byte [esi + 0x100dd67d]
mov eax, 0xf0f0f0f1
mul edi
shr edx, 4
mov eax, edx
shl eax, 4
add eax, edx
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x100dd6cb]
movzx edx, byte [ecx + 0x100dd681]
mov byte [ebp - 6], al
mov al, byte [ebp - 1]
mov byte [ebp - 7], dl
mov dl, bl
sub bl, al
xor dl, al
movzx eax, bl
movzx edi, dl
add di, word [ebp - 0x10]
mov dl, byte [ebp - 3]
xor di, ax
mov al, byte [ebp - 2]
mov bl, al
xor bl, dl
sub al, dl
movzx ebx, bl
add di, bx
movzx edx, al
mov al, byte [ebp - 4]
xor di, dx
mov dl, byte [ebp - 5]
mov bl, al
xor bl, dl
movzx ebx, bl
sub al, dl
mov dl, byte [ebp - 6]
add di, bx
movzx eax, al
xor di, ax
mov al, byte [ebp - 7]
mov bl, dl
xor bl, al
movzx ebx, bl
add di, bx
sub al, dl
add dword [ebp - 0xc], 4
movzx edx, al
xor di, dx
movzx eax, di
mov edi, dword [ebp - 0x14]
add esi, 4
add edi, 4
add ecx, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edi
cmp esi, 0x21
jb 0x10006760
mov edx, dword [0x552430]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [eax - 0x50]
mov byte [0x102f6e59], cl
lea ecx, [ebp - 0x14]
push ecx
shr eax, 8
sub al, 8
push 0x40
mov byte [0x102f6e58], al
mov eax, dword [0x552440]
push 4
push 0x552430
mov dword [0x102f6e60], edx
mov dword [0x102f6e5c], eax
call esi
lea edx, [ebp - 0x14]
push edx
mov dword [0x552430], 0x10006680
mov eax, dword [ebp - 0x14]
push eax
push 4
push 0x552430
call esi
lea ecx, [ebp - 0x14]
push ecx
push 0x40
push 4
push 0x552440
call esi
lea edx, [ebp - 0x14]
push edx
mov dword [0x552440], 0x100066e0
mov eax, dword [ebp - 0x14]
push eax
push 4
push 0x552440
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006990
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
test byte [0x100dd788], 1
je 0x100069b4
push 0x10006a10
push 0x4bc0ae
push 0xe8
call fcn.10026600
add esp, 0xc
test byte [0x100dd788], 2
je 0x10006a03
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x4cb739
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x4cb739], 0x4f
mov edx, dword [ebp - 4]
push edx
push 1
push 0x4cb739
call esi
push 0x10006d00
push 0x4cb7ad
push 0xe9
call fcn.10026600
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10007820
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x1002f018]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [0x102f775c]
cmp eax, 0x1f4
jae 0x10007857
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026fb8
mov esp, ebp
pop ebp
ret
fld dword [0x102f7774]
push esi
call fcn.10027970
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fadd qword [0x1002c178]
call fcn.10027970
fld dword [0x102f7770]
mov esi, eax
call fcn.10027970
mov ecx, dword [0x83a427c]
add eax, 5
cmp ecx, eax
jl 0x10007901
add eax, 0x28
cmp ecx, eax
jg 0x10007901
mov eax, dword [0x83a4278]
cmp eax, esi
jl 0x10007901
add esi, 0x14
cmp eax, esi
jg 0x10007901
xor eax, eax
cmp byte [0x83a42c4], al
je 0x100078ef
cmp byte [0x83a4124], al
je 0x100078ef
mov byte [0x83a4124], al
mov dword [0x7e11d28], eax
lea eax, [ebp - 0x68]
push str._attack
push eax
mov dword [0x559bec], 6
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [ebp - 0x68]
push ecx
mov edx, 0x4c1b90
call edx
add esp, 0xc
call edi
mov dword [0x102f775c], eax
pop esi
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026fb8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
xor al, al
pop edi
call fcn.10026fb8
mov esp, ebp
pop ebp
ret
Function at 0x10007920
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x1002f018]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [0x102f775c]
cmp eax, 0x1f4
jae 0x10007957
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026fb8
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x55c9fec]
push ebx
push esi
lea eax, [ebp - 0x74]
push eax
push 0xe
push str.___Pick_OFF
push ecx
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
fld dword [0x102f7774]
call fcn.10027970
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fadd qword [0x1002c178]
call fcn.10027970
fld dword [0x102f7778]
mov esi, eax
mov eax, dword [ebp - 0x74]
lea eax, [eax + eax*4]
shl eax, 7
cdq
idiv dword [0x56156c]
mov ebx, eax
call fcn.10027970
mov ecx, dword [0x83a427c]
sub eax, ebx
cmp ecx, eax
jl 0x10007a2c
add eax, 0x28
cmp ecx, eax
jg 0x10007a2c
mov eax, dword [0x83a4278]
cmp eax, esi
jl 0x10007a2c
add esi, 0x14
cmp eax, esi
jg 0x10007a2c
xor eax, eax
cmp byte [0x83a42c4], al
je 0x10007a19
cmp byte [0x83a4124], al
je 0x10007a19
mov byte [0x83a4124], al
lea edx, [ebp - 0x68]
push str._pick_all
mov dword [0x7e11d28], eax
push edx
mov dword [0x559bec], 6
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x68]
push eax
mov ecx, 0x4c1b90
call ecx
add esp, 0xc
call edi
mov dword [0x102f775c], eax
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026fb8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop esi
pop ebx
xor ecx, ebp
xor al, al
pop edi
call fcn.10026fb8
mov esp, ebp
pop ebp
ret
Function at 0x10007b40
Capabilities:
Encode data using xor
Get disk information
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x1002f018]
xor eax, ebp
mov dword [ebp - 4], eax
push pe_nt_image_headers32
push 0
push 0x102f8828
call sub.MSVCR100.dll_memset
mov eax, dword [0x1002f1f8]
mov dl, byte [0x1002f1fa]
add esp, 0xc
push 0
push 0
push 0
push 0
xor al, 0xb0
lea ecx, [ebp - 0x1c]
push ecx
mov byte [0x102f8828], al
mov al, byte [0x1002f1fb]
push 0
push 0
xor ah, 0xb0
xor dl, 0xb0
xor al, 0xb0
push 0x102f8828
mov byte [0x102f8829], ah
mov byte [0x102f882a], dl
mov byte [0x102f882b], al
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x10007bc3
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026fb8
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
lea edx, [ebp - 0x14]
push edx
call dword [sym.imp.RPCRT4.dll_UuidCreateSequential]
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx esi, word [ebp - 0x40]
movzx edi, word [ebp - 0x1e]
movzx ecx, word [ebp - 6]
movzx edx, word [ebp - 0x20]
mov eax, dword [ebp - 0xa]
mov ebx, dword [ebp - 0x1c]
push pe_nt_image_headers32
shl esi, 0x10
shl edi, 0x10
xor eax, 0x5d78a569
or esi, ecx
or edi, edx
push 0
push 0x102f8828
xor ebx, 0x12b586fe
mov dword [ebp - 0x18], eax
xor esi, 0xf45bc123
xor edi, 0xb542d8e1
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0x1002f1fc]
xor cl, 0xb0
mov byte [eax + 0x102f8828], cl
inc eax
cmp eax, 0x14
jl 0x10007c30
mov edx, dword [ebp - 0x18]
push edi
push esi
push edx
push ebx
push 0x102f8828
push 0x102f778c
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [ebp - 4]
add esp, 0x18
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.10026fb8
mov esp, ebp
pop ebp
ret
Function at 0x10007f00
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x55a4dd
call esi
mov bl, 0x75
lea ecx, [ebp - 4]
push ecx
mov byte [0x55a4dd], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x55a4dd
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x55a4d5
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x55a4d5], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x55a4d5
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x55a4da
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x55a4da], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x55a4da
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x55a4c5
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x55a4c5], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x55a4c5
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x55a4ca
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x55a4ca], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x55a4ca
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x55a4cf
call esi
mov byte [0x55a4cf], bl
mov edx, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
push edx
push 1
push 0x55a4cf
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x55a4b1
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x55a4b1], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x55a4b1
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x55a4b6
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x55a4b6], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x55a4b6
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x55a4bb
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x55a4bb], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x55a4bb
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 1
push 0x55a4c0
call esi
lea ecx, [ebp - 4]
push ecx
mov byte [0x55a4c0], bl
mov edx, dword [ebp - 4]
push edx
push 1
push 0x55a4c0
call esi
push 0x100080f0
push 0x47b910
push 0xe9
call fcn.10026600
push fcn.10008a10
push 0x4c45c0
push 0xe9
call fcn.10026600
push 0x10008ac0
push 0x47c690
push 0xe9
call fcn.10026600
push 0x10009150
push 0x4c3ef0
push 0xe9
call fcn.10026600
add esp, 0x30
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100092a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x1002f018]
xor eax, esp
mov dword [esp + 0x120], eax
fld qword [ebp + 0xc]
push ebx
fnstcw word [esp + 6]
mov ebx, dword [ebp + 8]
movzx eax, word [esp + 6]
or eax, 0xc00
mov dword [esp + 0x10], eax
push esi
push edi
fldcw word [esp + 0x18]
mov eax, 0x10624dd3
xor esi, esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], esi
fistp qword [esp + 0x10]
mov edi, dword [esp + 0x10]
mov ecx, edi
fldcw word [esp + 0xe]
mul ecx
shr edx, 6
test edx, edx
je 0x10009317
nop
mov ecx, edx
mov eax, 0x10624dd3
mul ecx
shr edx, 6
add esi, 3
test edx, edx
jne 0x10009300
mov dword [esp + 0x20], esi
push ecx
push 0x1002939c
push ebx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
test esi, esi
jle 0x100093ee
fld qword [0x1002c158]
add esi, 0xfffffffd
fild dword [esp + 0x20]
mov dword [esp + 0x10], esi
call sub.MSVCR100.dll__CIpow
fstp dword [esp + 0x18]
fld dword [esp + 0x18]
xor edx, edx
fnstcw word [esp + 0xe]
movzx eax, word [esp + 0xe]
or eax, 0xc00
mov dword [esp + 0x18], eax
mov eax, edi
fldcw word [esp + 0x18]
fistp qword [esp + 0x18]
mov ecx, dword [esp + 0x18]
div ecx
fldcw word [esp + 0xe]
fld qword [0x1002c158]
fild dword [esp + 0x10]
mov ebx, edx
call sub.MSVCR100.dll__CIpow
fnstcw word [esp + 0xe]
movzx eax, word [esp + 0xe]
fstp dword [esp + 0x10]
fld dword [esp + 0x10]
or eax, 0xc00
mov dword [esp + 0x10], eax
xor edx, edx
mov eax, ebx
fldcw word [esp + 0x10]
fistp qword [esp + 0x10]
mov ecx, dword [esp + 0x10]
div ecx
fldcw word [esp + 0xe]
lea edx, [esp + 0x28]
push eax
push str.__03d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esp + 0x30]
add esp, 0xc
lea eax, [esp + 0x28]
push eax
push pe_nt_image_headers32
push ecx
call dword [sym.imp.MSVCR100.dll_strcat_s]
add esp, 0xc
mov dword [esp + 0x20], esi
test esi, esi
jg 0x1000932f
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10026fb8
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000bc90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.MSVCR100.dll__stricmp]
push 0x10029b08
push 0x10038bd8
call esi
add esp, 8
test eax, eax
je 0x1000bd34
push 0x10029b40
push 0x10038bd8
call esi
add esp, 8
test eax, eax
jne 0x1000bcf3
mov esi, dword [sym.imp.MSVCR100.dll_strcpy_s]
push str.DataLocalText_Spn.bmd
push 0x64
push 0x10038bdc
call esi
push str.DataLocalDialog_Spn.bmd
push 0x64
push 0x10038c40
call esi
mov dword [0x10038bd4], 1
jmp 0x1000bd60
push 0x10029b78
push 0x10038bd8
call esi
add esp, 8
test eax, eax
jne 0x1000bd34
mov esi, dword [sym.imp.MSVCR100.dll_strcpy_s]
push str.DataLocalText_Por.bmd
push 0x64
push 0x10038bdc
call esi
push str.DataLocalDialog_Por.bmd
push 0x64
push 0x10038c40
call esi
mov dword [0x10038bd4], 2
jmp 0x1000bd60
mov esi, dword [sym.imp.MSVCR100.dll_strcpy_s]
push str.DataLocalText_Eng.bmd
push 0x64
push 0x10038bdc
call esi
push str.DataLocalDialog_Eng.bmd
push 0x64
push 0x10038c40
call esi
mov dword [0x10038bd4], 0
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esp, 0x18
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x511039
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x511039], 0x10038bdc
mov edx, dword [ebp - 4]
push edx
push 4
push 0x511039
call esi
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push 0x510f26
call esi
lea ecx, [ebp - 4]
push ecx
mov dword [0x510f26], 0x10038c40
mov edx, dword [ebp - 4]
push edx
push 4
push 0x510f26
call esi
pop esi
mov esp, ebp
pop ebp
ret