joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a8de8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x200
lea eax, [ebp - 0x200]
push eax
push 0x1001
mov edx, dword [ebx + 4]
push edx
call sub.KERNEL32.DLL_GetLocaleInfoA
push str._._n
lea ecx, [ebp - 0x200]
push ecx
call fcn.004a3644
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.004a36d4
pop ecx
mov edx, 0x200
sub edx, eax
push edx
lea ecx, [ebp - 0x200]
push ecx
call fcn.004a36d4
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
push 0x1002
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
push 0x4cc0d9
lea ecx, [ebp - 0x200]
push ecx
call fcn.004a3644
add esp, 8
push 0xa
lea eax, [ebp - 0x200]
push eax
call fcn.004a36d4
pop ecx
lea edx, [ebp - 0x200]
add eax, edx
push eax
mov ecx, dword [ebx]
push ecx
call fcn.004a9fe4
add esp, 0xc
cmp dword [ebx + 0x24], 0
jne 0x4a8ef9
push esi
call fcn.004a36d4
pop ecx
mov edi, eax
lea eax, [ebp - 0x200]
push eax
call fcn.004a36d4
pop ecx
add edi, eax
add edi, 3
push edi
call fcn.004a27b4
pop ecx
mov edi, eax
mov dword [ebx + 0x24], edi
test edi, edi
jne 0x4a8ed0
xor eax, eax
jmp 0x4a8f80
push esi
call fcn.004a36d4
pop ecx
push eax
lea edx, [ebp - 0x200]
push edx
call fcn.004a36d4
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push 0
push edi
call fcn.004a35a0
add esp, 0xc
jmp 0x4a8f39
mov edi, dword [ebx + 0x24]
push edi
call fcn.004a36d4
pop ecx
push eax
push esi
call fcn.004a36d4
pop ecx
pop edx
add edx, eax
push edx
lea eax, [ebp - 0x200]
push eax
call fcn.004a36d4
pop ecx
pop ecx
add ecx, eax
add ecx, 3
push ecx
push edi
call fcn.004a27d4
add esp, 8
mov dword [ebx + 0x24], eax
cmp dword [ebx + 0x24], 0
jne 0x4a8f39
xor eax, eax
jmp 0x4a8f80
push esi
mov edx, dword [ebx + 0x24]
push edx
call fcn.004a3644
add esp, 8
push 0x4cc0db
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004a3644
add esp, 8
lea eax, [ebp - 0x200]
push eax
mov edx, dword [ebx + 0x24]
push edx
call fcn.004a3644
add esp, 8
push 0x4cc0dd
mov ecx, dword [ebx + 0x24]
push ecx
call fcn.004a3644
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ac058
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x4ac0ba
call fcn.004ac008
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004a36d4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004a36d4
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4ac118
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4cc6ec], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4ac1f2
cmp dword [0x4cc6e8], 0
jne 0x4ac1f2
cmp dword [0x4cc8dc], 0
je 0x4ac1ac
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004abf08
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4ac192
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004abf08
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4ac192
lea ebx, [ebp - 0x84]
jmp 0x4ac193
inc ebx
call fcn.004ac0d4
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4ac22d
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4cc6f0
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004a36d4
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4cc6f3
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4ac22d
cmp dword [0x4cc6e8], 0
je 0x4ac20c
cmp dword [0x4cc6e8], 0xffffffff
je 0x4ac22d
push esi
call dword [0x4cc6e8]
pop ecx
mov eax, dword [0x4cc6ec]
test eax, eax
je 0x4ac22d
cmp dword [0x4cc6ec], 0xffffffff
je 0x4ac22d
cmp byte [eax], 0
je 0x4ac22d
push esi
push eax
call fcn.004ac058
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4017e7
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
cmp dword [ebp - 0x48], 0
je 0x4018bd
mov eax, dword [ebp - 0x48]
movsx eax, byte [eax]
cmp eax, 0x22
jne 0x401849
mov dword [ebp - 0x4c], 1
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
inc dword [ebp - 0x4c]
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x48]
movsx eax, byte [eax + ecx]
cmp eax, 0x22
je 0x401844
jmp 0x401823
jmp 0x401882
mov dword [ebp - 0x4c], 0
jmp 0x401858
inc dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
movsx eax, byte [eax + ecx]
cmp eax, 0x20
je 0x401882
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
movsx eax, byte [eax + ecx]
test eax, eax
je 0x401882
jmp 0x401855
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
movsx eax, byte [eax + ecx]
test eax, eax
je 0x4018a7
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
movsx eax, byte [eax + ecx + 1]
test eax, eax
jne 0x4018b3
mov dword [ebp - 0x48], 0
jmp 0x4018bd
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x14]
and eax, 0xffff
push eax
mov eax, dword [ebp - 0x48]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
jmp 0x4018df
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x630517ae
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0xbef6110
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x432084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10001340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x10005340
mov esi, ecx
lea eax, [ebp - 0x18]
mov ecx, dword fs:[0]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [esi + 0x20]
test eax, eax
mov dword [ebp - 0x24], eax
je 0x100013b3
mov eax, dword [esi + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [eax]
test eax, eax
je 0x10001397
mov dword [ebp - 0x10], 5
push dword [ebp - 0x24]
call eax
add esp, 4
mov ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x20]
mov eax, dword [ecx + 4]
test eax, eax
je 0x100013b3
push dword [ecx + 8]
push eax
push dword [ebp - 0x24]
call fcn.10013780
add esp, 0xc
mov eax, dword [esi + 0x10]
mov ecx, eax
neg ecx
jo 0x100013cc
jae 0x100013cc
push 1
push eax
push dword [esi + 0x14]
call fcn.10013780
add esp, 0xc
mov ecx, dword [esi + 0x3c]
mov eax, dword [esi + 0x40]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ecx
nop
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x30], eax
je 0x10001406
inc eax
lea edx, [ecx + 0x260]
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
call fcn.1000bb90
mov ecx, dword [ebp - 0x28]
jmp 0x100013e0
mov esi, dword [ebp - 0x20]
mov eax, dword [esi + 0x38]
test eax, eax
je 0x1000142b
imul eax, eax, 0x260
push 4
push eax
push dword [ebp - 0x2c]
call fcn.10013780
add esp, 0xc
mov dword [ebp - 0x10], 1
lea eax, [esi + 0x44]
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x24], eax
push eax
call fcn.1000c200
add esp, 4
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10001461
shl eax, 4
lea eax, [eax + eax*2]
push 8
push eax
push dword [edi + 0x48]
call fcn.10013780
add esp, 0xc
mov esi, dword [edi + 0x54]
mov edi, dword [edi + 0x58]
test edi, edi
je 0x1000148c
lea ebx, [esi + 0x5c]
jmp 0x10001476
add ebx, 0x78
dec edi
je 0x1000148c
mov eax, dword [ebx - 4]
test eax, eax
je 0x10001470
push 1
push eax
push dword [ebx]
call fcn.10013780
add esp, 0xc
jmp 0x10001470
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x50]
test eax, eax
je 0x100014a5
imul eax, eax, 0x78
push 8
push eax
push esi
call fcn.10013780
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10006860
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x10007940
lea eax, [ebp - 0x18]
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
mov dword [ebp - 0x10], 5
mov eax, dword [ecx]
mov dword [ebp - 0x20], eax
add eax, 0x30
mov dword [ebp - 0x24], eax
push eax
call fcn.1000f770
add esp, 4
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov eax, dword [eax]
test eax, eax
je 0x100068c5
shl eax, 3
push 4
push eax
push dword [esi + 0x34]
call fcn.10013780
add esp, 0xc
mov eax, dword [esi + 0x64]
test eax, eax
je 0x100068e3
lock dec dword [eax]
jne 0x100068e3
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 4
lea ecx, [eax + 0x64]
call fcn.10007280
mov eax, dword [ebp - 0x20]
mov esi, dword [eax + 0x68]
test esi, esi
je 0x1000692a
mov edi, dword [ebp - 0x20]
push dword [edi + 0x70]
call dword [sym.imp.kernel32.dll_CloseHandle]
lock dec dword [esi]
mov esi, edi
jne 0x1000690c
lea eax, [esi + 0x68]
push eax
call fcn.10006c40
add esp, 4
mov eax, dword [esi + 0x6c]
lock dec dword [eax]
jne 0x1000692a
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 3
add eax, 0x6c
push eax
call fcn.10006d60
add esp, 4
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 2
add eax, 0x40
push eax
call fcn.10005780
add esp, 4
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x20]
lock dec dword [eax]
jne 0x10006960
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov dword [ebp - 0x10], 1
call fcn.10007080
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x80]
test eax, eax
je 0x1000698d
lock dec dword [eax]
jne 0x1000698d
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x80]
mov edx, dword [eax + 0x84]
mov dword [ebp - 0x10], 0
call fcn.10007080
mov esi, dword [ebp - 0x20]
mov eax, dword [esi + 0x88]
test eax, eax
je 0x100069b7
lock dec dword [eax]
jne 0x100069b7
mov ecx, dword [esi + 0x88]
mov edx, dword [esi + 0x8c]
mov dword [ebp - 0x10], 0xffffffff
call fcn.10007080
cmp esi, 0xffffffff
je 0x100069d2
lock dec dword [esi + 4]
jne 0x100069d2
push 8
push 0xa8
push esi
call fcn.10013780
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000e9d0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aeskeygenassist xmm0, xmmword [edx], 2
movdqa xmmword [ecx], xmm0
ret
Function at 0x1001bd10
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x40]
mov esi, dword [esp + 0x48]
mov cl, 4
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, ebx
or eax, edi
je 0x1001bd8a
xor eax, eax
cmp esi, ebx
sbb eax, edi
mov eax, ebx
cmovb eax, esi
cmp eax, esi
ja 0x1001be63
mov ecx, dword [ebp + 4]
lea edx, [esp + 0x10]
push eax
push dword [esp + 0x48]
push dword [ebp]
push edx
call dword [ecx + 0xc]
add esp, 0x10
movzx eax, byte [esp + 0x10]
cmp al, 4
jne 0x1001bd99
mov edx, dword [esp + 0x14]
mov eax, edi
mov cl, 4
cmp ebx, edx
sbb eax, 0
jb 0x1001be6f
sub ebx, edx
sbb edi, 0
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], edi
mov eax, dword [esp + 0x3c]
test esi, esi
jne 0x1001bdba
jmp 0x1001be4e
xor edx, edx
mov eax, dword [esp + 0x3c]
test esi, esi
jne 0x1001bdba
jmp 0x1001be4e
movzx ecx, byte [esp + 0x13]
movzx edi, word [esp + 0x11]
mov edx, dword [esp + 0x14]
shl ecx, 0x10
or edi, ecx
mov ecx, eax
mov eax, dword [esp + 0x3c]
test esi, esi
je 0x1001be4e
mov dword [esp + 4], edi
mov byte [esp + 3], cl
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov ebp, dword [esp + 0x44]
mov dword [esp + 8], edx
nop word cs:[eax + eax]
nop dword [eax]
mov edx, ecx
mov dword [esp + 0xc], esi
movzx esi, cl
shr ecx, 8
or edx, 3
mov eax, edx
and eax, 0xfffffffe
imul eax, edx
mov edx, ebx
shr ebx, 8
xor ah, byte [ebp]
xor dl, ah
mov byte [ebp], ah
inc ebp
movzx edx, dl
xor ebx, dword [edx*4 + 0x101cea94]
movzx edx, bl
add edx, edi
imul edi, edx, 0x8088405
inc edi
mov edx, edi
shr edx, 0x18
xor esi, edx
xor ecx, dword [esi*4 + 0x101cea94]
mov esi, dword [esp + 0xc]
dec esi
jne 0x1001bde0
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 8]
mov dword [eax + 0x18], ecx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], edi
movzx ecx, byte [esp + 3]
mov edi, dword [esp + 4]
mov eax, dword [esp + 0x3c]
shl edi, 8
movzx ecx, cl
mov dword [eax + 4], edx
or ecx, edi
mov dword [eax], ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x101ce9e8
push esi
push eax
call fcn.101ccc90
mov dword [esp + 0x10], str.number_of_read_bytes_exceeds_limit
mov dword [esp + 0x14], 1
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 4
mov dword [esp + 0x1c], 0
push 0x101cea24
lea eax, [esp + 0x14]
push eax
call fcn.101cc880
int3
Function at 0x10024b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
test byte [edx], 1
je 0x10024b6e
mov esi, dword [edx + 0x30]
cmp dword [edx + 0x24], 0xffffffff
mov edi, dword [edx + 0x34]
mov ebx, dword [edx + 0x38]
mov ebp, dword [edx + 0x3c]
lea eax, [edx + 8]
mov edx, eax
je 0x10024c67
push 0
jmp 0x10024c69
xor eax, eax
cmp byte [edx + 0xe], 0
jne 0x10024c9f
mov esi, dword [edx + 0x34]
mov ebx, dword [edx + 4]
mov edi, dword [edx + 0x30]
movzx eax, byte [edx + 0xc]
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 8], esi
jmp 0x10024ba5
add ebx, ecx
mov dword [edx + 4], ebx
mov ah, al
xor al, 1
test ebx, ebx
je 0x10024bc6
cmp ebx, esi
jae 0x10024bc0
cmp byte [edi + ebx], 0xbf
jg 0x10024bc6
jmp 0x10024ca9
jne 0x10024ca9
cmp ebx, esi
je 0x10024c77
movzx ecx, byte [edi + ebx]
movzx ebp, cl
test cl, cl
jns 0x10024c2d
mov edx, edi
movzx edi, byte [edi + ebx + 1]
and ebp, 0x1f
and edi, 0x3f
cmp cl, 0xdf
jbe 0x10024c18
movzx esi, byte [edx + ebx + 2]
shl edi, 6
and esi, 0x3f
or esi, edi
cmp cl, 0xf0
jb 0x10024c1f
movzx ecx, byte [edx + ebx + 3]
shl esi, 6
and ebp, 7
shl ebp, 0x12
and ecx, 0x3f
or ecx, esi
mov esi, dword [esp + 8]
or ebp, ecx
jmp 0x10024c28
shl ebp, 6
or ebp, edi
jmp 0x10024c28
shl ebp, 0xc
or ebp, esi
mov esi, dword [esp + 8]
mov edi, edx
mov edx, dword [esp]
test ah, 1
jne 0x10024c8b
mov ecx, 1
cmp ebp, 0x80
jb 0x10024ba0
mov ecx, 2
cmp ebp, 0x800
jb 0x10024ba0
cmp ebp, 0x10000
mov ecx, 4
sbb ecx, 0
jmp 0x10024ba0
push 1
push ebp
push ebx
push edi
push esi
call fcn.10024420
add esp, 0x20
jmp 0x10024ca4
test ah, 1
mov byte [edx + 0xc], al
jne 0x10024c90
mov ecx, dword [esp + 4]
mov byte [edx + 0xe], 1
xor eax, eax
jmp 0x10024c9f
mov esi, ebx
mov byte [edx + 0xc], al
mov ecx, dword [esp + 4]
mov eax, 1
mov dword [ecx + 4], esi
mov dword [ecx + 8], esi
mov dword [ecx], eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
mov byte [edx + 0xc], al
push 0x101d4e04
push esi
push ebx
push esi
push edi
call fcn.101cce60
int3
Function at 0x10025b10
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x80
mov esi, esp
mov dword [esi + 0x68], ebp
mov dword [esi + 0x6c], esp
mov dword [esi + 0x78], 0xffffffff
mov dword [esi + 0x74], 0x10028ca0
mov edi, dword [ebp + 0xc]
mov eax, dword fs:[0]
mov dword [esi + 0x70], eax
lea eax, [esi + 0x70]
mov dword fs:[0], eax
movsd xmm2, qword [edi + 0x60]
movsd xmm1, qword [edi + 0x58]
movsd xmm0, qword [edi + 0x68]
movsd qword [esi + 0x28], xmm2
movsd qword [esi + 0x20], xmm1
movsd xmm2, qword [edi + 0x48]
movsd xmm1, qword [edi + 0x50]
movsd qword [esi + 0x30], xmm0
movsd qword [esi + 0x18], xmm1
movsd qword [esi + 0x10], xmm2
movzx eax, byte [0x10284b49]
push 8
push 0x28
call fcn.10013770
add esp, 8
test eax, eax
mov dword [esi + 0xc], eax
je 0x10025cbc
lea ecx, [edi + 0x48]
movsd xmm2, qword [ecx + 0x18]
movsd xmm1, qword [ecx + 0x10]
movsd xmm0, qword [ecx + 0x20]
movsd qword [eax + 0x18], xmm2
movsd qword [eax + 0x10], xmm1
movsd xmm2, qword [ecx]
movsd xmm1, qword [ecx + 8]
movsd qword [eax + 0x20], xmm0
lea ecx, [esi + 0x10]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm2
push 0x48
push edi
push ecx
mov ebx, eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], ebx
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov dword [esi + 0x60], 0x101d96bc
mov dword [esi + 0x64], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 4], eax
mov eax, dword [ebx + 0x14]
mov dword [esi + 8], eax
movzx eax, byte [0x10284b49]
push 4
push 0x48
call fcn.10013770
add esp, 8
test eax, eax
je 0x10025cd1
movsd xmm0, qword [ebx]
movsd xmm1, qword [ebx + 8]
mov ecx, edi
mov edi, eax
movsd xmm2, qword [ebx + 0x28]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov eax, dword [esi + 4]
movsd xmm1, qword [ebx + 0x20]
movsd xmm0, qword [ebx + 0x18]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 8]
mov dword [edi + 0x14], eax
movsd qword [edi + 0x20], xmm1
movsd xmm1, qword [ebx + 0x30]
movsd qword [edi + 0x28], xmm2
movsd xmm2, qword [ebx + 0x38]
movsd qword [edi + 0x18], xmm0
movsd qword [edi + 0x30], xmm1
movsd xmm1, qword [ebx + 0x40]
mov ebx, dword [ebp + 8]
movsd qword [edi + 0x38], xmm2
movsd qword [edi + 0x40], xmm1
push 0x48
push ecx
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, dword [esi + 0xc]
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x50], 0x101d96bc
mov dword [ebx + 0x54], eax
mov eax, dword [esi + 0x70]
mov dword [ebx + 0x58], edi
mov dword fs:[0], eax
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esi + 0x78], 2
push 0x28
push 8
call fcn.101cc679
add esp, 8
jmp 0x10025ce4
mov dword [esi + 0x78], 3
push 0x48
push 4
call fcn.101cc679
add esp, 8
ud2
Function at 0x10052200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 0x10057ab0
lea esi, [ebp - 0x18]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], edx
mov edi, dword fs:[0]
mov dword [ebp - 0x18], edi
mov dword fs:[0], esi
mov esi, dword [ecx + 0x28]
cmp esi, 0x7fff
mov dword [ebp - 0x24], esi
jbe 0x1005229e
mov ecx, dword [eax]
mov esi, dword [eax + 8]
mov edx, dword [eax + 4]
add eax, 0xc
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 0x10], 0
push esi
push edx
push eax
call ecx
add esp, 0xc
mov edi, dword [ebp - 0x28]
mov esi, 1
mov eax, dword [edi]
test eax, eax
je 0x10052288
lea ecx, [edi + 0xc]
mov edx, dword [edi + 4]
mov edi, dword [edi + 8]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x10], 0xffffffff
push edi
push edx
push ecx
call eax
add esp, 0xc
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, esi
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
movsd xmm1, qword [edx + 8]
movzx edi, word [ebp + 0xc]
movsd xmm0, qword [edx]
cmp esi, dword [ecx + 0x20]
movsd xmm2, qword [eax]
mov dword [ebp - 0x2c], ecx
movsd qword [ebp - 0x38], xmm1
movsd xmm1, qword [eax + 8]
mov eax, dword [eax + 0x10]
movsd qword [ebp - 0x40], xmm0
movsd qword [ebp - 0x54], xmm2
mov word [ebp - 0x1e], di
movsd qword [ebp - 0x4c], xmm1
mov dword [ebp - 0x44], eax
mov word [ebp - 0x30], di
mov dword [ebp - 0x60], 0
jne 0x100522fb
lea eax, [ecx + 0x20]
mov dword [ebp - 0x10], 1
push eax
call fcn.1007a200
mov ecx, dword [ebp - 0x2c]
add esp, 4
mov ebx, dword [ebp - 0x24]
mov eax, dword [ecx + 0x24]
movsd xmm0, qword [ebp - 0x60]
movsd xmm1, qword [ebp - 0x58]
movsd xmm2, qword [ebp - 0x50]
movsd xmm3, qword [ebp - 0x48]
movsd xmm4, qword [ebp - 0x40]
movsd xmm5, qword [ebp - 0x38]
mov esi, dword [ebp - 0x30]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x28], 0
imul edx, ebx, 0x34
mov dword [eax + edx + 0x30], esi
movsd qword [eax + edx + 0x28], xmm5
movsd qword [eax + edx + 0x20], xmm4
movsd qword [eax + edx + 0x18], xmm3
movsd qword [eax + edx + 0x10], xmm2
movsd qword [eax + edx + 8], xmm1
movsd qword [eax + edx], xmm0
lea edx, [ebx + 1]
mov dword [ecx + 0x28], edx
mov edx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x1c]
nop word cs:[eax + eax]
nop dword [eax]
cmp edi, ecx
mov eax, 0
cmovae edi, eax
test ecx, ecx
je 0x100523b0
movzx eax, word [edx + edi*4]
cmp ax, 0xffff
je 0x100523b2
movzx esi, word [edx + edi*4 + 2]
mov word [edx + edi*4], bx
movzx ebx, word [ebp - 0x1e]
inc dword [ebp - 0x28]
mov word [edx + edi*4 + 2], bx
inc edi
mov word [ebp - 0x1e], si
mov ebx, eax
jmp 0x10052370
jmp 0x100523b0
movzx eax, word [ebp - 0x1e]
cmp dword [ebp - 0x28], 0x80
movzx ecx, byte [ebp + 0x14]
mov word [edx + edi*4], bx
mov word [edx + edi*4 + 2], ax
setb dl
xor cl, 1
xor esi, esi
test dl, cl
jne 0x10052288
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x24]
mov eax, dword [ecx + 4]
or eax, dword [ecx]
jne 0x1005228b
mov dword [ecx + 4], 0
mov dword [ecx], 1
jmp 0x1005228b
Function at 0x1005afb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x5c0
mov esi, esp
mov dword [esi + 0x5a8], ebp
call fcn.1005afcc