joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c0f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
xorps xmm0, xmm0
push esi
push edi
push dword [esp + 0x2c]
movlpd qword [esp + 0x14], xmm0
push dword [esp + 0x2c]
push ebp
push dword [esp + 0x2c]
call fcn.100a0210
mov edi, dword [esp + 0x30]
mov esi, eax
mov ebx, edx
cmp dword [edi + 0x1e2c], 0
je 0x1000c153
push dword [edi + 0x1e44]
mov eax, dword [edi + 0x1e38]
push ebx
push esi
push dword [esp + 0x28]
call eax
mov esi, dword [esp + 0x30]
add esp, 0x10
push ebp
push esi
push edx
push eax
call fcn.100a0160
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
test ebx, ebx
jg 0x1000c169
jl 0x1000c15d
test esi, esi
jne 0x1000c169
pop edi
pop esi
pop ebp
xor eax, eax
xor edx, edx
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x30], eax
test ebx, ebx
jne 0x1000c183
mov eax, esi
cmp esi, 0x40000000
jbe 0x1000c188
mov eax, 0x40000000
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esp + 0x28]
add eax, ebp
push eax
push dword [edi + 0x900]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1000c1cc
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
test eax, eax
je 0x1000c1e0
cdq
add ebp, eax
adc ecx, edx
sub esi, eax
mov dword [esp + 0x30], ecx
sbb ebx, edx
test ebx, ebx
jg 0x1000c183
jl 0x1000c1e0
test esi, esi
jne 0x1000c175
jmp 0x1000c1e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
call fcn.1000c6b0
mov ecx, dword [esp + 0x38]
add esp, 8
cmp dword [edi + 0x1cfc], 0
je 0x1000c1f5
add dword [edi + 0x1d00], ebp
adc dword [edi + 0x1d04], ecx
push dword [esp + 0x24]
mov esi, dword [esp + 0x24]
push esi
push ecx
push ebp
call fcn.100a0160
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x1000c370
Capabilities:
Clear file content

Disassembly:
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push esi
xor esi, esi
test ecx, ecx
jg 0x1000c38c
jl 0x1000c385
test eax, eax
jae 0x1000c38c
mov eax, 1
pop esi
ret
push edi
mov edi, dword [esp + 0xc]
push 0
push 0
push ecx
push eax
push dword [edi + 0x900]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1000c3c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1000c3c3
push eax
push edi
or esi, 0xffffffff
call fcn.1000c6b0
add esp, 8
mov eax, esi
pop edi
pop esi
ret
push dword [edi + 0x900]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1000c3e6
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
call fcn.1000c6b0
add esp, 8
pop edi
mov eax, esi
pop esi
ret
Function at 0x1000c3f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
xorps xmm0, xmm0
push esi
push edi
push dword [esp + 0x2c]
movlpd qword [esp + 0x14], xmm0
push dword [esp + 0x2c]
push ebp
push dword [esp + 0x2c]
call fcn.100a0210
mov edi, dword [esp + 0x30]
mov esi, eax
mov ebx, edx
cmp dword [edi + 0x1e2c], 0
je 0x1000c453
push dword [edi + 0x1e44]
mov eax, dword [edi + 0x1e3c]
push ebx
push esi
push dword [esp + 0x28]
call eax
mov esi, dword [esp + 0x30]
add esp, 0x10
push ebp
push esi
push edx
push eax
call fcn.100a0160
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
test ebx, ebx
jg 0x1000c469
jl 0x1000c45d
test esi, esi
jne 0x1000c469
pop edi
pop esi
pop ebp
xor eax, eax
xor edx, edx
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x30], eax
test ebx, ebx
jne 0x1000c483
mov eax, esi
cmp esi, 0x40000000
jbe 0x1000c488
mov eax, 0x40000000
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
mov eax, dword [esp + 0x28]
add eax, ebp
push eax
push dword [edi + 0x900]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000c4cc
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
test eax, eax
je 0x1000c4e0
cdq
add ebp, eax
adc ecx, edx
sub esi, eax
mov dword [esp + 0x30], ecx
sbb ebx, edx
test ebx, ebx
jg 0x1000c483
jl 0x1000c4e0
test esi, esi
jne 0x1000c475
jmp 0x1000c4e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
call fcn.1000c6b0
mov ecx, dword [esp + 0x38]
add esp, 8
cmp dword [edi + 0x1cfc], 0
je 0x1000c4f5
add dword [edi + 0x1d00], ebp
adc dword [edi + 0x1d04], ecx
push dword [esp + 0x24]
mov esi, dword [esp + 0x24]
push esi
push ecx
push ebp
call fcn.100a0160
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x1000c510
Capabilities:
Get file size

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
cmp dword [esi + 0x1e2c], 0
je 0x1000c537
push dword [esi + 0x1e44]
mov eax, dword [esi + 0x1e30]
call eax
add esp, 4
pop esi
add esp, 8
ret
lea eax, [esp + 4]
push eax
push dword [esi + 0x900]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1000c556
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1000c567
mov ecx, dword [esp + 4]
mov eax, ecx
mov edx, dword [esp + 8]
and eax, edx
cmp eax, 0xffffffff
jne 0x1000c581
call fcn.100a967e
push dword [eax]
push esi
call fcn.1000c6b0
add esp, 8
or eax, 0xffffffff
or edx, eax
pop esi
add esp, 8
ret
cmp ecx, 0xfffffff1
jne 0x1000c59e
cmp edx, 0xffffffff
jne 0x1000c59e
mov dword [esi + 0x1ce4], 0xf
or eax, edx
or edx, edx
pop esi
add esp, 8
ret
mov eax, dword [esi + 0x90c]
cmp eax, 0x10
je 0x1000c5d2
cmp eax, 0x20
je 0x1000c5bf
cmp eax, 0x30
je 0x1000c600
or ecx, 0xffffffff
or edx, ecx
mov eax, ecx
pop esi
add esp, 8
ret
sub ecx, dword [esi + 0x1d58]
mov eax, ecx
sbb edx, dword [esi + 0x1d5c]
pop esi
add esp, 8
ret
cmp dword [esi + 0x1d5c], 0
jl 0x1000c600
jg 0x1000c5e6
cmp dword [esi + 0x1d58], 0
jbe 0x1000c600
mov eax, dword [esi + 0x1d50]
mov esi, dword [esi + 0x1d54]
test esi, esi
jl 0x1000c600
jg 0x1000c5fc
test eax, eax
je 0x1000c600
mov ecx, eax
mov edx, esi
mov eax, ecx
pop esi
add esp, 8
ret
Function at 0x1000c610
Capabilities:
Get file size

Disassembly:
sub esp, 8
lea eax, [esp]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1000c638
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1000c638
or eax, 0xffffffff
or edx, eax
add esp, 8
ret
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 8
ret

Function at 0x1000c7d0
Capabilities:
Get file size

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
cmp dword [esi + 0x1210], 0xffffffff
je 0x1000c7e8
xor eax, eax
pop esi
add esp, 8
ret
push edi
push esi
push str._s_rsrc
lea edi, [esi + 0x910]
push 0x400
push edi
call fcn.10008bb0
push edi
mov dword [esi + 0x1ce4], 0
call fcn.1000c710
add esp, 0x14
mov dword [esi + 0x1210], eax
cmp eax, 0xffffffff
je 0x1000c86d
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1000c851
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x1000c851
or eax, 0xffffffff
or ecx, eax
mov dword [esi + 0x1d60], eax
pop edi
mov dword [esi + 0x1d64], ecx
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x1d60], eax
xor eax, eax
pop edi
mov dword [esi + 0x1d64], ecx
pop esi
add esp, 8
ret
push ebx
push ebp
lea ebx, [esi + 0x800]
push ebx
lea ebp, [esi + 0x400]
push ebp
push str._s.__s
push 0x400
push edi
call fcn.10008bb0
push edi
mov dword [esi + 0x1ce4], 0
call fcn.1000c710
add esp, 0x18
mov dword [esi + 0x1210], eax
cmp eax, 0xffffffff
jne 0x1000c8db
push ebx
push ebp
push str._s.AppleDouble__s
push 0x400
push edi
call fcn.10008bb0
push edi
mov dword [esi + 0x1ce4], 0
call fcn.1000c710
add esp, 0x18
mov dword [esi + 0x1210], eax
cmp eax, 0xffffffff
je 0x1000c8fa
push eax
call fcn.1000c610
add esp, 4
mov dword [esi + 0x1d60], eax
mov dword [esi + 0x1d64], edx
xor eax, eax
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
call fcn.1000c6b0
mov eax, dword [esi + 0x1ce4]
add esp, 8
pop ebp
pop ebx
pop edi
pop esi
add esp, 8
ret
Function at 0x10016fd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov ecx, dword [esi]
lea eax, [ecx - 8]
cmp eax, 0x14
ja 0x100171e3
cmp ecx, 0xe
jge 0x10016ffb
mov dword [esi + 8], 0x3c
mov eax, 0x10016930
mov ecx, 0x10016810
jmp 0x10017024
cmp ecx, 0x15
jge 0x10017013
mov dword [esi + 8], 0x28
mov eax, 0x10016b80
mov ecx, 0x10016a40
jmp 0x10017024
mov dword [esi + 8], 0x1e
mov eax, 0x10016de0
mov ecx, 0x10016ca0
push edi
mov edi, dword [esp + 0xc]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x90c]
cmp eax, 0x10
je 0x10017043
cmp eax, 0x30
jne 0x100171a6
mov dword [edi + 0x1df0], 0x10017ce0
mov dword [edi + 0x1df4], 0x10017cb0
mov dword [edi + 0x1df8], 0x10017660
mov dword [edi + 0x1dfc], 0x100173b0
mov eax, dword [esi + 0x10]
cmp eax, 0x10016ca0
jne 0x1001719f
mov ecx, dword [esi + 8]
mov eax, ecx
inc dword [esi + 0x18]
imul eax, dword [esi + 0x18]
mov dword [esi + 0x1c], 0
cmp eax, dword [esi + 4]
jle 0x100170af
lea eax, [ecx*4]
push eax
lea eax, [esi + 0xa0]
push 0
push eax
call fcn.100a2020
add esp, 0xc
jmp 0x100171a6
push ebx
push edi
push 0
push 0x7f
push 0
lea ebx, [esi + 0x20]
push 1
push ebx
call fcn.1000c0f0
add esp, 0x18
cmp eax, 0x7f
je 0x100170db
push 0x7f
push eax
push str._Warning_:_short_read___d____d_._n
push edi
call fcn.1000ac80
add esp, 0x10
mov al, byte [ebx]
cmp al, 0xf0
je 0x100170f2
movzx eax, al
push eax
push str.Error_A_:__02X_n
call fcn.10007100
add esp, 8
mov bl, byte [esi + 0x21]
cmp bl, 0x7e
je 0x1001710b
movzx eax, bl
push eax
push str.Error_1_:__02X_n
call fcn.10007100
add esp, 8
lea ecx, [esi + 0x23]
mov edx, 0x29
mov al, byte [ecx - 1]
lea ecx, [ecx + 3]
xor al, byte [ecx - 2]
xor bl, al
xor bl, byte [ecx - 3]
sub edx, 1
jne 0x10017113
mov al, byte [esi + 0x9d]
and bl, 0x7f
cmp bl, al
je 0x1001714e
movzx eax, al
push eax
movzx eax, bl
push eax
movzx eax, byte [esi + 0x24]
push eax
push str.Block__d_:_checksum_is__02X_should_be__02X_n
push edi
call fcn.1000ac80
add esp, 0x14
mov ebx, 0xffffffd9
lea edx, [esi + 0x27]
sub ebx, esi
nop dword [eax + eax]
movzx ecx, byte [edx - 2]
movzx eax, byte [edx - 1]
sub ecx, 0x40
shl ecx, 7
add ecx, eax
movzx eax, byte [edx]
shl ecx, 7
add ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 7
add ecx, eax
lea eax, [edx + ebx]
shr eax, 2
lea edx, [edx + 4]
shl ecx, 4
mov dword [esi + eax*4 + 0xa0], ecx
lea eax, [edx + ebx]
cmp eax, 0x78
jl 0x10017160
pop ebx
jmp 0x100171a6
push esi
push edi
call eax
add esp, 8
mov eax, dword [edi + 0x90c]
cmp eax, 0x20
je 0x100171b6
cmp eax, 0x30
jne 0x100171de
mov dword [edi + 0x1e00], 0x10018740
mov dword [edi + 0x1e04], 0x10018710
mov dword [edi + 0x1e08], 0x10018310
mov dword [edi + 0x1e0c], 0x10018120
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [esp + 8]
pop esi
mov dword [eax + 0x1ce4], 0x93
mov eax, 0x93
ret
Function at 0x100281d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
jle 0x100282e2
movsd xmm1, qword [0x10178b48]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
add edi, 2
movzx ecx, byte [edi]
movzx edx, byte [edi + 1]
mov eax, ecx
movzx esi, byte [edi - 1]
mov ebp, edx
and edx, 0x7f
shr eax, 7
and ecx, 0x7f
add edx, edx
shl ecx, 8
or edx, eax
movzx eax, byte [edi - 2]
or esi, ecx
shl esi, 8
and ebp, 0x80
or esi, eax
test edx, edx
jne 0x10028232
test esi, esi
jne 0x10028232
xorps xmm0, xmm0
jmp 0x100282ce
lea eax, [edx - 0x7f]
neg edx
sbb edx, edx
or esi, 0x800000
and edx, eax
movd xmm0, esi
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [0x10178b38]
cvtps2pd xmm0, xmm0
cvtpd2ps xmm0, xmm0
movss dword [esp + 0x20], xmm0
test ebp, ebp
je 0x1002826f
mulss xmm0, dword [0x10178b58]
movss dword [esp + 0x20], xmm0
test edx, edx
jle 0x10028296
movaps xmm0, xmm1
movd xmm1, edx
cvtdq2pd xmm1, xmm1
call fcn.100af1b0
movss xmm1, dword [esp + 0x20]
cvtps2pd xmm1, xmm1
mulsd xmm0, xmm1
cvtsd2ss xmm0, xmm0
jmp 0x100282c6
jns 0x100282ce
mov eax, edx
cvtps2pd xmm0, xmm0
cdq
xor eax, edx
sub eax, edx
movsd qword [esp + 0x10], xmm0
movaps xmm0, xmm1
movd xmm1, eax
cvtdq2pd xmm1, xmm1
call fcn.100af1b0
movsd xmm1, qword [esp + 0x10]
divsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movsd xmm1, qword [0x10178b48]
movss dword [edi - 2], xmm0
add edi, 4
sub ebx, 1
jne 0x100281f2
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x1002b6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
test ebx, ebx
jle 0x1002b7cc
movsd xmm2, qword [0x10178b48]
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
add esi, 6
movzx ecx, byte [esi]
movzx ebp, byte [esi + 1]
mov eax, ecx
movzx edi, byte [esi - 1]
and ecx, 0xf
shl ecx, 8
mov edx, ebp
or edi, ecx
shr eax, 4
movzx ecx, byte [esi - 4]
and edx, 0x7f
shl edx, 4
or edx, eax
shl edi, 8
movzx eax, byte [esi - 2]
or edi, eax
shl ecx, 8
movzx eax, byte [esi - 3]
shl edi, 8
or edi, eax
movzx eax, byte [esi - 5]
or ecx, eax
movzx eax, byte [esi - 6]
shl ecx, 8
or ecx, eax
test edx, edx
jne 0x1002b720
test edi, edi
jne 0x1002b720
test ecx, ecx
jne 0x1002b720
xorps xmm1, xmm1
jmp 0x1002b7b8
movd xmm1, ecx
sub edx, 0x3ff
movd xmm0, edi
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm0, xmm0
mulsd xmm1, qword [0x10178be8]
addsd xmm1, xmm0
addsd xmm1, qword [0x10178c00]
mulsd xmm1, qword [0x10178be0]
movsd qword [esp + 0x10], xmm1
cmp ebp, 0x80
jb 0x1002b76e
mulsd xmm1, qword [0x10178b60]
movsd qword [esp + 0x10], xmm1
test edx, edx
jle 0x1002b78d
movd xmm1, edx
movaps xmm0, xmm2
cvtdq2pd xmm1, xmm1
call fcn.100af1b0
mulsd xmm0, qword [esp + 0x10]
movaps xmm1, xmm0
jmp 0x1002b7b0
jns 0x1002b7b8
mov eax, edx
movaps xmm0, xmm2
cdq
xor eax, edx
sub eax, edx
movd xmm1, eax
cvtdq2pd xmm1, xmm1
call fcn.100af1b0
movsd xmm1, qword [esp + 0x10]
divsd xmm1, xmm0
movsd xmm2, qword [0x10178b48]
movsd qword [esi - 6], xmm1
add esi, 8
sub ebx, 1
jne 0x1002b6c2
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1003d530
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x24]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x2c]
push edi
xor edi, edi
movzx ecx, word [esi + edi*2]
movsx eax, cx
imul eax, eax
push ecx
push ebp
sar eax, 2
add ebx, eax
call fcn.1003d790
movzx eax, al
add esp, 8
mov word [esi + edi*2], ax
inc edi
cmp edi, 0xa0
jl 0x1003d543
mov ecx, dword [ebp + 0x6c]
mov eax, ecx
shl ebx, 0xc
mov dword [esp + 0x20], ebx
sub eax, 0
je 0x1003d71c
sub eax, 1
je 0x1003d5f4
sub eax, 1
je 0x1003d5a7
push ecx
push str._Error_:_Unhandled_NMS_ADPCM_type__d._n
push dword [esp + 0x30]
call fcn.1000ac80
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov edi, dword [esp + 0x34]
xor edx, edx
nop dword [eax]
lea eax, [edx + edx]
add edx, 4
mov cx, word [eax + esi]
lea edi, [edi + 2]
shl cx, 4
or cx, word [eax + esi + 2]
shl cx, 4
or cx, word [eax + esi + 4]
shl cx, 4
or cx, word [eax + esi + 6]
mov word [edi - 2], cx
cmp edx, 0xa0
jl 0x1003d5b0
mov word [edi], bx
mov eax, 0xa0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0x34]
xor ecx, ecx
mov dword [esp + 0x10], eax
nop
lea eax, [esi + ecx*2]
mov dword [esp + 0x14], eax
lea ebx, [esi + ecx*2]
lea edx, [esi + ecx*2]
lea edi, [esi + ecx*2]
lea ebp, [esi + ecx*2]
lea eax, [esi + 4]
lea eax, [eax + ecx*2]
mov dword [esp + 0x18], eax
lea eax, [ecx*2 + 0x18]
add ecx, 0x10
mov dword [esp + 0x1c], ecx
movzx ecx, word [eax + esi]
and cx, 0xf
shl cx, 4
or cx, word [eax + esi + 2]
shl cx, 4
or cx, word [eax + esi + 4]
movzx eax, word [eax + esi + 6]
shr ax, 1
shl cx, 3
or cx, ax
movzx eax, word [edx + 0x10]
shl ax, 4
or ax, word [edx + 0x12]
shl ax, 4
or ax, word [edi + 0x14]
movzx ecx, cx
shl ax, 4
or ax, word [edi + 0x16]
mov dword [esp + 0x2c], ecx
and ecx, 0x1111
shr word [esp + 0x2c], 1
or ax, cx
movzx ecx, word [ebx + 8]
mov edx, dword [esp + 0x2c]
shl cx, 4
or cx, word [ebx + 0xa]
mov ebx, dword [esp + 0x14]
movzx edi, ax
mov eax, edx
shl cx, 4
and eax, 0x1111
or cx, word [ebp + 0xc]
shl cx, 4
or cx, word [ebp + 0xe]
or cx, ax
shr edx, 1
movzx eax, word [ebx]
and edx, 0x1111
shl ax, 4
or ax, word [ebx + 2]
mov ebx, dword [esp + 0x18]
shl ax, 4
movzx ecx, cx
or ax, word [ebx]
shl ax, 4
or ax, dx
mov edx, dword [esp + 0x10]
or ax, word [ebx + 2]
mov word [edx], ax
mov word [edx + 2], cx
mov ecx, dword [esp + 0x1c]
mov word [edx + 4], di
add edx, 6
mov dword [esp + 0x10], edx
cmp ecx, 0xa0
jl 0x1003d600
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov word [edx], ax
mov eax, 0xa0
pop ebx
add esp, 0x14
ret
mov ebp, dword [esp + 0x34]
xor edi, edi
lea eax, [edi + edi]
add edi, 8
mov cx, word [eax + esi]
lea edx, [eax + esi]
shl cx, 2
lea ebp, [ebp + 2]
or cx, word [eax + esi + 8]
shl cx, 2
or cx, word [eax + esi + 2]
shl cx, 2
or cx, word [eax + esi + 0xa]
shl cx, 2
or cx, word [edx + 4]
shl cx, 2
or cx, word [eax + esi + 0xc]
mov ax, word [eax + esi + 0xe]
shl cx, 2
sar ax, 2
or cx, ax
or cx, word [edx + 6]
mov word [ebp - 2], cx
cmp edi, 0xa0
jl 0x1003d722
pop edi
pop esi
mov word [ebp], bx
mov eax, 0xa0
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x10050da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
movsx eax, word [esi + 0x20]
push eax
movsx eax, word [esi + 0x10]
sar eax, 2
push eax
call fcn.10050930
add esp, 8
mov dword [esp + 0x1c], eax
lea ebp, [esi + 0x12]
mov dword [esp + 0x10], 5
nop
movsx edi, word [ebp]
movsx ebx, word [ebp + 0x10]
sar edi, 2
movzx ecx, di
mov eax, ecx
test edi, edi
jle 0x10050de6
jmp 0x10050ded
neg eax
and eax, 0x1fff
mov esi, 0x10258c68
xor edx, edx
mov cx, word [esi]
lea esi, [esi + 2]
cmp ax, cx
jl 0x10050e05
inc edx
cmp edx, 0xf
jl 0x10050df4
lea ecx, [edx - 6]
movzx edx, cx
test ax, ax
jne 0x10050e17
mov ecx, 0x20
jmp 0x10050e2e
test dx, dx
js 0x10050e24
mov cx, dx
sar ax, cl
jmp 0x10050e2b
mov ecx, edx
neg ecx
shl ax, cl
movzx ecx, ax
movsx esi, word [ebp + 0x10]
add edx, 0xfffffff3
mov eax, ebx
sar eax, 6
and eax, 0xf
add eax, edx
movzx edx, ax
mov dword [esp + 0x14], edx
mov edx, esi
movzx ebx, ax
and edx, 0x3f
movsx eax, cx
imul edx, eax
sar edx, 4
movzx eax, dx
test bx, bx
js 0x10050e6e
mov cl, bl
shl ax, cl
mov ecx, 0x7fff
and ax, cx
jmp 0x10050e77
mov cl, byte [esp + 0x14]
neg cl
sar ax, cl
mov edx, dword [esp + 0x1c]
movzx eax, ax
movsx ecx, ax
mov eax, ecx
neg eax
xor edi, esi
cmovns eax, ecx
add ebp, 2
add edx, eax
sub dword [esp + 0x10], 1
mov dword [esp + 0x1c], edx
jne 0x10050dd0
pop edi
pop esi
pop ebp
pop ebx
mov eax, edx
add esp, 8
ret
Function at 0x10054c10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1b4
mov eax, dword [0x10259b00]
xor eax, esp
mov dword [esp + 0x1b0], eax
mov ecx, dword [esp + 0x1bc]
mov eax, dword [esp + 0x1b8]
mov edx, dword [esp + 0x1c0]
push ebx
push ebp
mov dword [esp + 0x24], ecx
lea ebp, [eax + 0xf0]
mov ecx, dword [esp + 0x1cc]
lea ebx, [esp + 0x78]
push esi
mov esi, dword [esp + 0x1e0]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x1d8]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x1dc]
push edi
mov edi, dword [esp + 0x1d8]
sub dword [esp + 0x10], edi
sub dword [esp + 0x14], edi
sub edx, edi
mov dword [esp + 0x28], esi
mov esi, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], 4
nop word [eax + eax]
lea eax, [esp + 0x30]
push eax
movzx eax, word [edi]
push ecx
push eax
mov eax, dword [esp + 0x1c]
movzx eax, word [eax + edi]
push eax
call fcn.1005eee0
push ebp
lea eax, [esp + 0x44]
push eax
mov eax, dword [esp + 0x2c]
movzx eax, word [eax + edi]
push eax
mov eax, dword [esp + 0x40]
movzx eax, word [eax + edi]
push eax
push esi
call fcn.1005be90
movups xmm0, xmmword [ebp]
mov ecx, dword [esp + 0x3c]
lea ebx, [ebx + 0x50]
add ecx, 0x1a
lea edi, [edi + 2]
movups xmmword [ebx - 0x50], xmm0
add esp, 0x24
sub dword [esp + 0x1c], 1
movups xmm0, xmmword [ebp + 0x10]
mov dword [esp + 0x18], ecx
movups xmmword [ebx - 0x40], xmm0
movups xmm0, xmmword [ebp + 0x20]
movups xmmword [ebx - 0x30], xmm0
movups xmm0, xmmword [ebp + 0x30]
movups xmmword [ebx - 0x20], xmm0
movups xmm0, xmmword [ebp + 0x40]
movups xmmword [ebx - 0x10], xmm0
jne 0x10054ca0
mov esi, dword [esp + 0x28]
lea eax, [esp + 0x80]
mov ebx, dword [esp + 0x20]
push esi
push eax
push dword [esp + 0x34]
push ebx
call fcn.1005e490
movzx eax, word [ebx + 0x284]
add esp, 0x10
mov edx, 0xa0
movsx ecx, ax
mov ebp, 0xffff8000
nop dword [eax + eax]
imul eax, ecx, 0x6e14
dec edx
movsx ecx, word [esi]
add eax, 0x4000
sar eax, 0xf
cwde
add eax, ecx
cmp eax, 0x7fff
jl 0x10054d73
mov eax, 0x7fff
jmp 0x10054d7b
cmp eax, 0xffff8000
cmovle eax, ebp
movzx edi, ax
movsx ecx, di
lea eax, [ecx + ecx]
cmp eax, 0x7fff
jl 0x10054d92
mov eax, 0x7fff
jmp 0x10054d9a
cmp eax, 0xffff8000
cmovle eax, ebp
and eax, 0xfffffff8
mov word [esi], ax
add esi, 2
test edx, edx
jne 0x10054d50
mov ecx, dword [esp + 0x1c0]
mov word [ebx + 0x284], di
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1009fd88
add esp, 0x1b4
ret
Function at 0x1005ef50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
mov eax, dword [0x10259b00]
xor eax, esp
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x84]
push ebx
mov ebx, dword [esp + 0x8c]
push ebp
mov ebp, dword [esp + 0x94]
push edi
mov edi, dword [esp + 0x8c]
mov dword [esp + 0xc], eax
mov eax, 0x14
mov dword [esp + 0x10], ebp
mov ebp, 0x7fff
push esi
movsx ecx, word [eax + edi - 0x10]
movsx edx, word [eax + edi - 0x18]
add edx, ecx
movsx ecx, word [eax + edi - 0x1e]
imul esi, edx, 0x806
movsx edx, word [eax + edi - 0xa]
add edx, ecx
imul ecx, edx, 0x86
movsx edx, word [eax + edi - 0xc]
sub esi, ecx
movsx ecx, word [eax + edi - 0x1c]
add edx, ecx
imul ecx, edx, 0x176
movsx edx, word [eax + edi - 0x16]
sub esi, ecx
movsx ecx, word [eax + edi - 0x12]
add edx, ecx
imul ecx, edx, 0x166d
add esi, ecx
movsx ecx, word [eax + edi - 0x14]
shl ecx, 0xd
add ecx, 0x1000
add ecx, esi
sar ecx, 0xd
cmp ecx, 0xffff8000
jge 0x1005f000
mov ecx, 0xffff8000
jmp 0x1005f005
cmp ecx, ebp
cmovg ecx, ebp
mov word [esp + eax + 0x24], cx
add eax, 2
cmp eax, 0x62
jle 0x1005ef90
pop esi
push ebx
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.1005f120
push dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push ebp
push eax
call fcn.1005ea10
lea eax, [esp + 0x38]
push eax
push dword [esp + 0x30]
push dword [esp + 0x3c]
push ebp
call fcn.1005e950
push edi
lea eax, [esp + 0x4c]
push eax
movzx eax, word [ebx]
push eax
call fcn.1005f080
mov ecx, dword [esp + 0xc0]
add esp, 0x3c
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.1009fd88
add esp, 0x7c
ret