joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405838
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x4060d0
call fcn.00405e04
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x407364
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x40587d
cmp eax, esi
jne 0x405870
xor esi, esi
inc esi
mov edi, esi
jmp 0x405880
push 0x3e8
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x405854
xor esi, esi
inc esi
cmp dword [0x407368], esi
jne 0x405892
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x4058cc
cmp dword [0x407368], ebx
jne 0x4058c6
mov dword [0x407368], esi
push 0x401018
push 0x40100c
call fcn.004059ac
pop ecx
pop ecx
test eax, eax
je 0x4058cc
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4059a1
mov dword [0x407014], esi
cmp dword [0x407368], esi
jne 0x4058ef
push 0x401008
push section..text
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x407368], 2
test edi, edi
jne 0x4058fc
xor eax, eax
mov ecx, 0x407364
xchg dword [ecx], eax
cmp dword [0x407374], 0
je 0x405928
push 0x407374
call fcn.00405c30
pop ecx
test eax, eax
je 0x405928
push ebx
push 2
push ebx
mov esi, dword [0x407374]
mov ecx, esi
call dword [0x408144]
call esi
push dword [0x407020]
push dword [0x40701c]
push dword [0x407018]
call fcn.00401a93
add esp, 0xc
mov dword [0x407010], eax
cmp dword [0x407028], 0
jne 0x405986
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x407014], 0
jne 0x40599a
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x407010]
mov dword [ebp - 4], 0xfffffffe
call fcn.00405e4c
ret
call fcn.00521000
jmp 0x405838

Function at 0x405b1f
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x406148
call fcn.0040603c
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x405b7f
cmp eax, 0xffffffff
je 0x405b7f
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x405b78
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x405b78
cmp edx, 0x10000000
jae 0x405b78
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x405b75
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.00406081
ret 4

Function at 0x405be0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x405c1e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x405c16
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x405c20
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x405c06
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40447a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x410050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040270d
mov dword [ebp - 0x14], eax
cmp dword [0x411e08], esi
jne 0x40456d
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4044fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40464d
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40464d
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40464d
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x411e08], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x411e0c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x411e10], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x411e18], eax
test eax, eax
je 0x40456a
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x411e14], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x404592
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x404585
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4045a7
push 4
pop eax
jmp 0x40464f
cmp dword [ebp - 0x14], esi
je 0x4045a7
push dword [0x411e08]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40458c
mov eax, dword [0x411e14]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x404605
cmp dword [0x411e18], edi
je 0x404605
push eax
call ebx
push dword [0x411e18]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x404605
test eax, eax
je 0x404605
call ecx
test eax, eax
je 0x4045fa
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4045fa
test byte [ebp - 8], 1
jne 0x404605
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x404635
mov eax, dword [0x411e0c]
cmp eax, edi
je 0x404632
push eax
call ebx
test eax, eax
je 0x404632
call eax
mov esi, eax
test esi, esi
je 0x404632
mov eax, dword [0x411e10]
cmp eax, edi
je 0x404632
push eax
call ebx
test eax, eax
je 0x404632
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x411e08]
call ebx
test eax, eax
je 0x40464d
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40464f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401188
mov esp, ebp
pop ebp
ret
Function at 0x10001520
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x1004b6a8], 0
je 0x10001539
mov eax, dword [0x1004b6a8]
jmp 0x100016d6
mov dword [0x1004b6a8], 0x1004b680
push 0x28
push 0
push 0x1004b680
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x1004b680], eax
push str.imagehlp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x1004b684], eax
cmp dword [0x1004b684], 0
jne 0x1000157f
xor eax, eax
jmp 0x100016d6
push str.ImagehlpApiVersionEx
mov eax, dword [0x1004b684]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1004b688], eax
push str.SymInitialize
mov ecx, dword [0x1004b684]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1004b68c], eax
push str.SymSetOptions
mov edx, dword [0x1004b684]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1004b690], eax
push str.SymGetOptions
mov eax, dword [0x1004b684]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1004b694], eax
push str.SymLoadModule
mov ecx, dword [0x1004b684]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1004b698], eax
push str.SymGetModuleInfo
mov edx, dword [0x1004b684]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1004b69c], eax
push str.SymGetSymFromName
mov eax, dword [0x1004b684]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1004b6a0], eax
push str.BindImage
mov ecx, dword [0x1004b684]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1004b6a4], eax
push 8
push 0
lea edx, [ebp - 8]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov word [ebp - 8], 9
cmp dword [0x1004b688], 0
je 0x1000165d
lea eax, [ebp - 8]
push eax
call dword [0x1004b688]
cmp dword [0x1004b688], 0
je 0x1000166f
movzx ecx, word [ebp - 8]
cmp ecx, 9
jge 0x1000168a
mov edx, dword [0x1004b684]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x1004b684], 0
xor eax, eax
jmp 0x100016d6
cmp dword [0x1004b68c], 0
je 0x100016a3
push 0
push 0
mov eax, dword [0x1004b680]
push eax
call dword [0x1004b68c]
cmp dword [0x1004b694], 0
je 0x100016d1
cmp dword [0x1004b690], 0
je 0x100016d1
call dword [0x1004b694]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
and ecx, 7
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [0x1004b690]
mov eax, dword [0x1004b6a8]
mov esp, ebp
pop ebp
ret
Function at 0x10006fc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
push esi
push edi
mov edi, ecx
mov ecx, dword [0x1004b8d8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov ecx, dword [0x1004b8e4]
push eax
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
mov esi, eax
lea ecx, [esp + 0x14]
movss xmm0, dword [esi + 0xe0]
movss dword [esp + 0x14], xmm0
movss xmm0, dword [esi + 0xe4]
movss dword [esp + 0x18], xmm0
movss xmm0, dword [esi + 0xe8]
movss dword [esp + 0x1c], xmm0
call fcn.10002a40
comiss xmm0, dword [0x100462ec]
jbe 0x100071c9
push 0x56
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x100071c9
cmp byte [0x10f6c791], 0
je 0x100071c9
movss xmm0, dword [esi + 0xe4]
divss xmm0, dword [esi + 0xe0]
call sub.api_ms_win_crt_math_l1_1_0.dll___libm_sse2_atanf
movss xmm2, dword [esi + 0xe0]
xorps xmm1, xmm1
cvtss2sd xmm0, xmm0
mulsd xmm0, qword [0x10046298]
cvtsd2ss xmm1, xmm0
movss xmm0, dword [0x100463bc]
comiss xmm0, xmm2
movss dword [esp + 0xc], xmm1
jb 0x10007099
addss xmm1, dword [0x10046344]
movss dword [esp + 0xc], xmm1
cmp byte [0x11db96c0], 0
je 0x100070ac
movss xmm3, dword [0x100463d4]
jmp 0x100070b4
movss xmm3, dword [0x10046208]
movss xmm0, dword [esi + 0xe4]
fld dword [0x100462c4]
movss xmm4, dword [0x100462e4]
mulss xmm0, xmm0
mulss xmm2, xmm2
addss xmm0, xmm2
call fcn.10002a30
movss dword [esp + 0x10], xmm0
xorps xmm1, xmm1
fld dword [esp + 0x10]
fpatan
fstp dword [esp + 0x10]
movss xmm0, dword [esp + 0x10]
mulss xmm0, dword [0x100462f4]
comiss xmm0, xmm1
jb 0x10007106
comiss xmm4, xmm0
jae 0x10007115
comiss xmm1, xmm0
ja 0x10007111
movss xmm0, xmm4
jmp 0x10007115
movss xmm0, xmm1
mov eax, dword [0x1004b8e0]
mulss xmm0, dword [eax + 0x1c]
mulss xmm0, xmm3
call fcn.10006360
comiss xmm0, dword [0x10046110]
mov dword [edi + 0x18], 0
movss dword [esp + 0x10], xmm0
jbe 0x10007148
movss xmm1, dword [0x10046400]
jmp 0x10007150
movss xmm1, dword [0x10046380]
mov ecx, dword [0x1004b8d8]
lea edx, [esp + 0x14]
movss dword [edi + 0x1c], xmm1
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x4c]
call eax
movss xmm0, dword [esp + 0xc]
addss xmm0, dword [esp + 0x10]
movss xmm1, dword [esp + 0x18]
subss xmm1, xmm0
mulss xmm1, dword [0x10046140]
movaps xmm0, xmm1
call fcn.1003bf60
movss xmm3, dword [edi + 0x18]
movaps xmm4, xmm0
movss xmm2, dword [edi + 0x1c]
movaps xmm5, xmm4
movaps xmm1, xmm3
shufps xmm5, xmm4, 1
movaps xmm0, xmm2
mulss xmm1, xmm5
mulss xmm0, xmm4
mulss xmm3, xmm4
mulss xmm2, xmm5
subss xmm1, xmm0
addss xmm3, xmm2
movss dword [edi + 0x18], xmm1
movss dword [edi + 0x1c], xmm3
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10007630
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x44
mov eax, dword [0x1004b040]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
mov ebx, dword [esp + 0x4c]
movaps xmm1, xmm2
push esi
mov esi, ecx
lea ecx, [esp + 0x10]
push edi
mov edi, edx
call fcn.10007480
cmp dword [eax + 0x14], 0xf
jbe 0x1000765d
mov eax, dword [eax]
push ebx
push 0x20
lea ecx, [esp + 0x34]
push ecx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x28]
cmp ecx, 0xf
jbe 0x100076a6
mov edx, dword [esp + 0x14]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000769c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1000769c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1003b0e6
add esp, 8
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
mov ecx, dword [esp + 0x50]
add esp, 4
fstp dword [esp + 0x10]
movss xmm0, dword [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003adbe
add esp, 0x44
ret

Function at 0x10007760
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x48
mov eax, dword [0x1004b040]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
mov esi, dword [esp + 0x58]
mov ebx, edx
push edi
mov edi, ecx
xor edx, edx
lea ecx, [esp + 0x14]
call fcn.100111c0
cmp dword [esp + 0x28], 0xf
lea ecx, [esp + 0x2c]
push esi
push 0x20
push ecx
lea eax, [esp + 0x20]
cmova eax, dword [esp + 0x20]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x28]
cmp ecx, 0xf
jbe 0x100077db
mov edx, dword [esp + 0x14]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100077d1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100077d1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1003b0e6
add esp, 8
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, dword [esp + 0x50]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003adbe
add esp, 0x48
ret
Function at 0x10011430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x12
xor eax, eax
nop
mov dl, byte [edi + eax - 0xc09c6f]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001145d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10011440
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10011470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x42
xor eax, eax
nop
mov dl, byte [edi + eax - 0x10a5f68]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001149d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x10011480
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x100114b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x2d
xor eax, eax
nop
mov dl, byte [edi + eax - 0x1013618]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100114dd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x100114c0
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x100115e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x23
xor eax, eax
nop
mov dl, byte [edi + eax - 0x14d61d0]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001160d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x100115f0
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x100117b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 3
xor eax, eax
nop
mov dl, byte [edi + eax - 0x9fbca]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100117dd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x100117c0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x100117f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xb
xor eax, eax
nop
mov dl, byte [edi + eax - 0x41dd9f2]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001181d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10011800
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x100119b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x73
xor eax, eax
nop
mov dl, byte [edi + eax - 0x92a3c9]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100119dd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x100119c0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4
Function at 0x10011bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x19
xor eax, eax
nop
mov dl, byte [edi + eax - 0x92318a]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10011bed
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x13
jl 0x10011bd0
pop edi
mov byte [esi + 0x13], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x62
xor eax, eax
nop
mov dl, byte [edi + eax - 0x47c8500]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100121ad
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x10012190
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x100121c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x54
xor eax, eax
nop
mov dl, byte [edi + eax - 0x23aaae]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100121ed
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x100121d0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x66
xor eax, eax
nop
mov dl, byte [edi + eax - 0x1139d0]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001229d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x10012280
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x100125c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x73
xor eax, eax
nop
mov dl, byte [edi + eax - 0x44f64f]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100125ed
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x100125d0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x19
xor eax, eax
nop
mov dl, byte [edi + eax - 0x267159c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001262d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x10012610
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x100126c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x58
xor eax, eax
nop
mov dl, byte [edi + eax - 0x10ea140]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100126ed
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x100126d0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4
Function at 0x10012790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x2c
xor eax, eax
nop
mov dl, byte [edi + eax - 0x2035a70]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100127bd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x100127a0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x100129d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x2d
xor eax, eax
nop
mov dl, byte [edi + eax - 0x157e395]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100129fd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x10
jl 0x100129e0
pop edi
mov byte [esi + 0x10], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x44
xor eax, eax
nop
mov dl, byte [edi + eax - 0x118d64b]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10012c6d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10012c50
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012d10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x58
xor eax, eax
nop
mov dl, byte [edi + eax - 0x1c03f0]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10012d3d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10012d20
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x68
xor eax, eax
nop
mov dl, byte [edi + eax - 0x2efdb8]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10012ecd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xf
jl 0x10012eb0
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
ret 4

Function at 0x10012fb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x2c
xor eax, eax
nop
mov dl, byte [edi + eax - 0x9a6c08]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10012fdd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x10012fc0
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x10013100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x22
xor eax, eax
nop
mov dl, byte [edi + eax - 0x153e223]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001312d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10013110
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4