joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100af4f0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 1], 0
call fcn.100aef70
cmp dword [ebp + 8], eax
jne 0x100af5d4
cmp dword [ebp + 0x10], 0
jbe 0x100af5cf
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x100af5cf
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
shl eax, 1
push eax
lea ecx, [ebp - 0x10]
call fcn.100af310
lea ecx, [ebp - 0x10]
call fcn.1000fb00
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [ebp - 0x10]
call fcn.1000fb00
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp - 0x10]
call fcn.1000fb00
push eax
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x100af5ab
mov byte [ebp - 2], 1
jmp 0x100af5af
mov byte [ebp - 2], 0
mov dl, byte [ebp - 2]
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100af5c6
lea ecx, [ebp - 0x10]
call fcn.100af360
nop
lea ecx, [ebp - 0x10]
call fcn.100af340
nop
jmp 0x100af677
mov ecx, dword [ebp + 0x10]
add ecx, 4
push ecx
lea ecx, [ebp - 8]
call fcn.100af310
nop
lea ecx, [ebp - 8]
call fcn.1000fb00
test eax, eax
je 0x100af66e
lea ecx, [ebp - 8]
call fcn.1000fb00
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100af66e
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x10]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
add eax, 4
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.1000fb00
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp - 8]
call fcn.1000fb00
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x100af653
mov byte [ebp - 3], 1
jmp 0x100af657
mov byte [ebp - 3], 0
mov dl, byte [ebp - 3]
mov byte [ebp - 1], dl
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100af66e
lea ecx, [ebp - 8]
call fcn.100af360
nop
lea ecx, [ebp - 8]
call fcn.100af340
nop
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100af690
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
cmp dword [ebp + 0xc], 0
je 0x100af6b2
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x28]
call fcn.100af450
movzx ecx, al
test ecx, ecx
jne 0x100af6b9
xor al, al
jmp 0x100af813
mov byte [ebp - 1], 0
call fcn.100aef70
cmp dword [ebp + 8], eax
jne 0x100af7a6
push 0xd
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x100af751
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x100af74f
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100af74f
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp + 0x10]
ja 0x100af744
push 0
push 0
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [ebp - 1], 1
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop
jmp 0x100af7a4
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x100af7a4
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100af7a4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x100af7a4
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp + 0xc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [ebp - 1], 1
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop
jmp 0x100af810
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x100af810
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x100af810
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100af810
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp + 0x10]
ja 0x100af805
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x14]
add eax, 4
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [ebp - 1], 1
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100af820
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0xc], 0
call fcn.100aef70
cmp dword [ebp + 8], eax
jne 0x100af909
push 0xd
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x100af899
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x100af897
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x100af897
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop
jmp 0x100af907
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x100af907
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x100af907
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x100af907
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 1], cl
add dword [ebp - 8], 1
cmp byte [ebp - 1], 0
jne 0x100af8d8
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop
jmp 0x100af95a
call fcn.100773f0
cmp dword [ebp + 8], eax
je 0x100af95a
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x100af95a
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x100af95a
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x100af95a
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
nop
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x100b9290
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x105db2a8]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.1000a7a0
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
nop
mov dword [ebp - 8], 0
jmp 0x100b92d7
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x100b931c
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 8]
mov al, byte [edx + 0x38]
mov byte [ecx + 0x141], al
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x100b930a
mov byte [ebp - 1], 1
jmp 0x100b930e
mov byte [ebp - 1], 0
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 8]
mov al, byte [ebp - 1]
mov byte [edx + 0x38], al
jmp 0x100b92ce
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x244]
mov eax, dword [ecx + 0x248]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x24c], edx
mov dword [ecx + 0x250], eax
cvtsi2ss xmm0, dword [ebp - 0x14]
cvtsi2ss xmm1, dword [ebp - 0x10]
push ecx
movss dword [esp], xmm1
push ecx
movss dword [esp], xmm0
lea ecx, [ebp - 0x1c]
call fcn.10028310
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x244], edx
mov dword [ecx + 0x248], eax
mov esp, ebp
pop ebp
ret
Function at 0x100ee250
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x100ee283
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
xor eax, dword [ebp + 0xc]
mov ecx, 0x1000193
mul ecx
push eax
mov edx, dword [ebp + 8]
add edx, 1
push edx
call fcn.100ee250
add esp, 8
mov dword [ebp - 4], eax
jmp 0x100ee289
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x100ee290
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x811c9dc5
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x100ee2ce
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
xor edx, dword [ebp - 8]
mov dword [ebp - 4], edx
imul eax, dword [ebp - 4], 0x1000193
mov dword [ebp - 4], eax
jmp 0x100ee29d
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x100f5fd0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
mov edx, dword [esi + 0x10]
mov ebx, dword [esi + 0x28]
sub edx, 8
test ebx, ebx
je case.default.0x100f600a
mov eax, ebx
and eax, 0xfffffffc
mov eax, dword [eax + 0x38]
test eax, eax
jns 0x100f5ffd
mov ecx, dword [esi + 0x1c]
sub ecx, eax
cmp edx, ecx
jb 0x100f604d
cmp edx, dword [esi + 0x1c]
jbe case.default.0x100f600a
mov ecx, dword [edx + 4]
mov eax, ecx
and eax, 7
jmp dword [eax*4 + 0x100f6130]
movzx ecx, byte [ecx - 3]
mov eax, 0xfffffff8
shl ecx, 3
sub eax, ecx
add edx, eax
jmp 0x100f603c
cmp dword [edx - 8], 1
jne case.0x100f600a.3
mov ebx, dword [ebx + 0x34]
jmp case.0x100f600a.3
and ecx, 0xfffffff8
sub edx, ecx
test ebx, ebx
jne 0x100f5fe8
test edi, edi
jne 0x100f60fb
jmp 0x100f60f5
test edi, edi
je 0x100f60ef
mov eax, dword [ebx + 0x34]
mov dword [esi + 0x28], eax
lea eax, [edx + 8]
push ecx
push esi
mov dword [esi + 0x10], eax
call fcn.100f67b0
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
mov eax, ebx
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebx
ret
mov dword [esi + 0x28], 0
mov eax, dword [esi + 0x1c]
add eax, 8
push eax
push esi
mov dword [esi + 0x10], eax
call fcn.100f67b0
add esp, 8
mov eax, dword [esi + 8]
mov eax, dword [eax + 0xc8]
test eax, eax
je 0x100f6128
push esi
call eax
add esp, 4
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
adc dword [eax + 0xf], esp
adc byte [ecx], ch
pushal
movups xmm4, xmmword [ebx]
pushal
movups xmm6, xmmword [edi]
pushal
movups xmm2, xmmword [ecx]
pushal
movups xmm4, xmmword [eax + 0x602e100f]
movups xmm5, xmmword [esi]
pushal
invalid
invalid
Function at 0x100f8c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x14]
mov eax, esi
sub eax, ebx
push edi
mov edi, dword [esp + 0x1c]
sub eax, 0x40
push edi
sar eax, 2
push eax
push ebx
call fcn.100f8360
mov ecx, eax
add esp, 0xc
test ecx, ecx
jne 0x100f8ce7
lea ebp, [ebx + 0x40]
sub esi, 4
cmp esi, ebp
jbe case.0x100f8cb8.17
mov eax, dword [esi]
mov ecx, eax
shr ecx, 8
movzx edx, al
movzx ebx, cl
mov cx, word [edx*2 + 0x101447e0]
and cx, 7
cmp cx, 2
jne 0x100f8c9f
cmp edi, ebx
jb 0x100f8c62
cmp edx, 0x2a
jne case.0x100f8cb8.17
shr eax, 0x10
cmp edi, eax
ja 0x100f8c62
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp cx, 1
jne 0x100f8c62
cmp ebx, edi
jne 0x100f8c62
add edx, 0xfffffff0
cmp edx, 0x27
ja case.0x100f8cb8.17
movzx ecx, byte [edx + 0x100f8dc4]
jmp dword [ecx*4 + 0x100f8db0]
mov ecx, dword [esp + 0x14]
mov edi, eax
mov eax, esi
shr edi, 0x10
sub eax, ecx
sub eax, 0x40
push edi
sar eax, 2
push eax
push ecx
call fcn.100f8360
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x100f8c62
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov eax, 0x10143474
pop ebx
ret
mov ecx, dword [esp + 0x14]
shr eax, 0x10
not eax
pop edi
mov ecx, dword [ecx + 0x10]
pop esi
pop ebp
pop ebx
mov ecx, dword [ecx + eax*4]
mov eax, dword [esp + 0x10]
add ecx, 0x10
mov dword [eax], ecx
mov eax, str.global
ret
mov ecx, eax
shr ecx, 0x10
movzx edx, cl
mov ecx, dword [esp + 0x14]
not edx
mov ecx, dword [ecx + 0x10]
mov edx, dword [ecx + edx*4]
mov ecx, dword [esp + 0x20]
add edx, 0x10
mov dword [ecx], edx
mov ecx, dword [esi - 4]
cmp cl, 0x10
jne 0x100f8d62
shr ecx, 8
movzx edx, cl
lea ecx, [ebx + 1]
cmp edx, ecx
jne 0x100f8d62
shr eax, 8
xor eax, dword [esi - 4]
test eax, 0xffff0000
jne 0x100f8d62
pop edi
pop esi
pop ebp
mov eax, str.method
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, str.field
pop ebx
ret
mov ecx, dword [esp + 0x14]
shr eax, 0x10
mov edx, dword [ecx + 0x38]
test edx, edx
jne 0x100f8d8f
mov eax, dword [esp + 0x20]
mov edx, 0x101469b9
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov eax, str.upvalue
pop ebx
ret
test eax, eax
je 0x100f8d9f
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x100f8d93
sub eax, 1
jne 0x100f8d93
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov eax, str.upvalue
pop ebx
ret
Function at 0x10100b60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov ecx, dword [ebp + 0x10]
mov edx, 1
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x3c], esi
lea edi, [eax + ecx*8]
cmp edi, dword [ebx + 0x14]
jae 0x10100bc6
nop dword [eax]
mov eax, dword [edi + 4]
cmp eax, 0xfffffffb
jne 0x10100bd9
mov eax, dword [edi]
test edx, edx
je 0x10100bb8
push dword [esp + 0x3c]
mov esi, dword [eax + 0xc]
add eax, 0x10
push esi
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp eax, esi
je 0x10100c00
xor edx, edx
mov esi, dword [esp + 0x3c]
add edi, 8
cmp edi, dword [ebx + 0x14]
jb 0x10100b90
push 0
push edx
push ebx
call fcn.100f39d0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0xfffffff2
jae 0x10100c07
test edx, edx
je 0x10100bb8
movsd xmm0, qword [edi]
sub esp, 8
movsd qword [esp], xmm0
push str._.14g
push esi
call sym.gs.dll_fprintf
add esp, 0x10
test eax, eax
jle 0x10100bb8
mov edx, 1
jmp 0x10100bba
sub edi, dword [ebx + 0x10]
sar edi, 3
push 4
inc edi
push edi
push ebx
call fcn.100f6170
int3
Function at 0x10101330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov cl, byte [ebp + 0x81]
mov eax, dword [ebp + 0x210]
mov dl, cl
mov bl, byte [ebp + 0x82]
and dl, 0xc
neg dl
mov byte [esp + 0xb], bl
sbb dl, dl
and dl, 4
neg eax
sbb al, al
and cl, 3
and al, 0xe
shl cl, 3
or dl, al
mov al, byte [ebp + 0x1e0]
or dl, cl
and al, 1
or dl, al
cmp bl, dl
je 0x10101595
mov al, dl
mov byte [ebp + 0x82], dl
and al, 3
lea ebx, [ebp + 0xb10]
push esi
push edi
cmp al, 1
jne 0x101013ca
movzx ecx, word [0x101449ae]
movzx esi, word [0x101449b4]
add ecx, 0x10001c50
movzx edi, word [0x101449ba]
add esi, 0x10001c50
movzx eax, word [0x101449c2]
add edi, 0x10001c50
movzx ebp, word [0x101449c8]
jmp 0x101013ea
mov ecx, dword [ebx + 0x39c]
mov esi, dword [ebx + 0x3a8]
mov edi, dword [ebx + 0x3b4]
movzx eax, word [0x101449c4]
movzx ebp, word [0x101449ca]
lea eax, [eax + 0x10001c50]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x14], eax
lea ebp, [ebp + 0x10001c50]
mov dh, dl
mov dword [esp + 0x18], ebp
xor dh, byte [esp + 0x13]
mov al, dl
and al, 6
mov dword [ebx + 0x398], ecx
mov dword [ebx + 0x3a4], esi
mov dword [ebx + 0x3b0], edi
test dh, 6
je 0x10101485
mov edi, ebx
test al, al
jne 0x1010146c
lea esi, [ebx + 0x26c]
mov ecx, 0x55
rep movsd dword es:[edi], dword [esi]
test dl, 0x10
je 0x101014fa
mov dword [ebx + 0x114], 0x10004aea
mov dword [ebx + 0x118], 0x10004aea
mov dword [ebx + 0x11c], 0x10004aea
mov dword [ebx + 0x120], 0x10004aea
jmp 0x101014fa
test dl, 2
mov ecx, 0x10004acf
mov eax, 0x10004af7
cmovne eax, ecx
mov ecx, 0x55
rep stosd dword es:[edi], eax
jmp 0x101014fa
test al, al
jne 0x101014fa
mov dword [ebx + 0x12c], ecx
mov dword [ebx + 0x138], esi
mov dword [ebx + 0x144], edi
test dl, 0x10
je 0x101014ca
mov dword [ebx + 0x114], 0x10004aea
mov dword [ebx + 0x118], 0x10004aea
mov dword [ebx + 0x11c], 0x10004aea
mov dword [ebx + 0x120], 0x10004aea
jmp 0x101014fa
mov eax, dword [ebx + 0x380]
mov dword [ebx + 0x114], eax
mov eax, dword [ebx + 0x384]
mov dword [ebx + 0x118], eax
mov eax, dword [ebx + 0x388]
mov dword [ebx + 0x11c], eax
mov eax, dword [ebx + 0x38c]
mov dword [ebx + 0x120], eax
mov ebp, dword [esp + 0x20]
test dh, 8
je 0x1010154b
lea edi, [ebx + 0x154]
test dl, 8
jne 0x1010153f
mov ecx, 0xaa
nop dword [eax]
nop word [eax + eax]
movzx eax, word [ecx + 0x10144918]
lea edi, [edi + 4]
add eax, 0x10001c50
add ecx, 2
mov dword [edi - 4], eax
cmp ecx, 0x136
jb 0x10101520
jmp 0x1010154b
mov ecx, 0x46
mov eax, 0x10004b74
rep stosd dword es:[edi], eax
test dl, 8
jne 0x10101564
mov eax, dword [esp + 0x14]
mov dword [ebx + 0x154], eax
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x160], eax
test dl, 1
je 0x10101593
test byte [esp + 0x13], 1
jne 0x10101593
mov ax, word [ebp + 0x758]
lea edi, [ebp + 0xa90]
add ax, ax
mov ecx, 0x20
dec ax
movzx eax, ax
mov edx, eax
shl edx, 0x10
or eax, edx
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x10107d10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
movzx eax, byte [ebp + 0x24]
lea edx, [eax*4 + 0x14]
call fcn.101044b0
mov esi, eax
lea ecx, [ebp + 0x40]
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 8], ecx
mov word [esi + 5], 8
mov byte [esi + 7], 0
movzx ecx, byte [ebp + 0x25]
add ecx, 0x20
mov eax, ecx
shr eax, 3
and al, 0x20
sub cl, al
mov al, byte [ebp + 0x24]
mov byte [ebp + 0x25], cl
mov byte [esp + 0x18], al
movzx ecx, al
test al, al
je 0x10107dc1
push ebx
lea ebx, [esi + 0x14]
mov esi, ecx
mov ecx, dword [esp + 0x18]
mov edx, 0x18
call fcn.101044b0
lea ebx, [ebx + 4]
lea ecx, [eax + 8]
mov word [eax + 5], 0x105
mov dword [eax + 0x10], ecx
mov dword [eax + 0xc], 0xffffffff
mov ecx, dword [ebp + 0x14]
movzx edx, word [ecx + edi*2]
inc edi
mov ecx, edx
shl edx, 0x18
shr ecx, 0xe
xor edx, ebp
and cl, 1
mov dword [eax + 0x14], edx
mov byte [eax + 7], cl
mov dword [ebx - 4], eax
cmp edi, esi
jb 0x10107d72
mov esi, dword [esp + 0x10]
mov al, byte [esp + 0x1c]
pop ebx
mov byte [esi + 7], al
mov eax, esi
pop edi
pop esi
pop ebp
pop ecx
ret
Function at 0x101143b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov eax, dword [ebx + 0x10]
mov esi, dword [esp + 0x24]
push edi
cmp dword [eax + 4], 0xfffffff5
jne 0x10114427
mov eax, dword [eax]
mov edx, dword [ebp]
movzx edi, word [eax + 6]
mov eax, edi
add eax, eax
mov ecx, dword [edx + eax*8]
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x80000000
jne 0x10114406
nop word [eax + eax]
movzx eax, cx
add eax, eax
mov ecx, dword [edx + eax*8]
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x80000000
je 0x101143f0
mov eax, ecx
movzx ecx, cx
and eax, 0xf0000000
cmp eax, 0x20000000
push esi
cmovne ecx, edi
push ecx
push ebp
call fcn.1010d860
add esp, 0xc
test eax, eax
jne 0x1011448d
mov eax, dword [ebx + 0x10]
lea ecx, [eax + 8]
cmp ecx, dword [ebx + 0x14]
jae 0x1011449f
cmp dword [eax + 0xc], 0xfffffff5
jne 0x1011449f
mov eax, dword [ecx]
mov edx, dword [ebp]
movzx edi, word [eax + 6]
mov eax, edi
add eax, eax
mov ecx, dword [edx + eax*8]
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x80000000
jne 0x1011446c
movzx eax, cx
add eax, eax
mov ecx, dword [edx + eax*8]
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x80000000
je 0x10114456
mov eax, ecx
movzx ecx, cx
and eax, 0xf0000000
cmp eax, 0x20000000
push esi
cmovne ecx, edi
push ecx
push ebp
call fcn.1010d860
add esp, 0xc
test eax, eax
je 0x1011449f
push eax
push ebx
call fcn.10108960
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
or edx, 0xffffffff
or ebp, edx
cmp esi, 4
jne 0x101144d4
mov ecx, dword [esp + 0x24]
xor edx, edx
pop edi
mov eax, dword [ecx]
cmp eax, dword [ecx + 4]
mov eax, dword [ebx + 0x14]
setne dl
add edx, 0xfffffffd
mov dword [eax - 4], edx
mov eax, dword [ebx + 8]
mov dword [eax + 0x9c], edx
lea eax, [esi - 3]
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
xor edi, edi
nop word [eax + eax]
mov ecx, dword [eax + edi*4 + 8]
mov dword [esp + 0x1c], edx
test ecx, ecx
je 0x10114525
mov eax, dword [ebx + 0x10]
cmp dword [eax + edi*8 + 4], 0xfffffff5
jne 0x10114525
mov eax, dword [esp + 0x20]
mov esi, dword [ecx]
push 0
sub ecx, dword [eax]
sar ecx, 4
push ecx
push ebx
call fcn.1010d9b0
and esi, 0xf0000000
add esp, 0xc
add eax, 0x10
mov edx, edi
cmp esi, 0x50000000
cmovne edx, dword [esp + 0x1c]
jmp 0x1011454b
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax + edi*8 + 4]
cmp ecx, 0xfffffffb
mov eax, edi
cmovne eax, ebp
mov ebp, eax
cmp ecx, 0xfffffff2
ja 0x10114542
mov ecx, 0xd
jmp 0x10114544
not ecx
mov eax, dword [ecx*4 + 0x101443a0]
mov dword [esp + edi*4 + 0x10], eax
inc edi
mov eax, dword [esp + 0x24]
cmp edi, 2
jl 0x101144e0
mov eax, ebp
xor eax, edx
cmp eax, 1
je 0x1011459d
mov ecx, dword [esp + 0x28]
cmp ecx, 5
jne 0x10114572
mov eax, 0xd5a
jmp 0x1011458e
cmp ecx, 8
jne 0x1011457e
mov eax, 0xd78
jmp 0x1011458e
cmp ecx, 0xa
mov eax, 0xd9d
mov edx, 0xdcc
cmovl eax, edx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
push ebx
call fcn.100f6310
push dword [esp + edx*4 + 0x10]
push dword [esp + ebp*4 + 0x14]
push 0xd3e
push ebx
call fcn.100f6310
int3