joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10052950
Capabilities:
Resolve dns

Disassembly:
mov eax, 0x820
call fcn.101fe2f0
mov eax, dword [0x102c5980]
xor eax, esp
mov dword [esp + 0x81c], eax
push ebx
mov ebx, dword [esp + 0x83c]
lea eax, [esp + 0x19]
push ebp
push esi
mov esi, dword [esp + 0x830]
push edi
push 0x400
push 0
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], 0
mov byte [esp + 0x30], 0
call fcn.101ff800
push 0x400
lea eax, [esp + 0x439]
mov byte [esp + 0x438], 0
push 0
push eax
call fcn.101ff800
push 0x400
push esi
lea eax, [esp + 0x44]
push 0x401
push eax
mov dword [esp + 0x3c], eax
lea ebp, [esp + 0x450]
call fcn.10203d48
add esp, 0x28
nop
push esi
mov edi, ebx
mov dword [ebx], 0
mov byte [ebp], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
je 0x10052b2f
cmp word [ebx + 8], 2
jne 0x10052a52
cmp word [ebx + 0xa], 4
jne 0x10052a52
mov esi, dword [ebx + 0xc]
mov eax, dword [esi]
test eax, eax
je 0x10052a52
nop dword [eax]
nop dword [eax + eax]
push dword [eax]
push dword [esp + 0x844]
push dword [esp + 0x844]
push dword [esp + 0x844]
call fcn.10052b80
mov dword [edi], eax
test eax, eax
je 0x10052b28
add esi, 4
lea edi, [eax + 0x1c]
mov eax, dword [esi]
test eax, eax
jne 0x10052a20
push 0x400
push dword [ebx]
push 0x401
push ebp
call fcn.10203d48
mov ebx, dword [esp + 0x28]
xor esi, esi
add esp, 0x10
cmp dword [ebx], esi
jne 0x10052adf
mov ecx, ebp
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10052a76
sub ecx, edx
je case.0x10052b3f.11003
mov edi, dword [esp + 0x14]
mov ecx, ebp
mov eax, edi
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10052ab0
test dl, dl
je 0x10052aac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10052ab0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10052a90
xor eax, eax
jmp 0x10052ab5
sbb eax, eax
or eax, 1
test eax, eax
je case.0x10052b3f.11003
mov esi, dword [esp + 0x10]
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x10
je case.0x10052b3f.11003
mov esi, dword [esp + 0x1c]
mov eax, edi
mov dword [esp + 0x14], ebp
mov ebp, eax
jmp 0x100529e0
mov esi, 0x2afb
jmp 0x10052b52
cmp dword [esp + 0x844], esi
je 0x10052b52
mov ecx, ebp
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10052af0
sub ecx, edx
lea ebx, [ecx + 1]
push ebx
push 1
call fcn.10203d53
mov edi, eax
add esp, 8
test edi, edi
je 0x10052b18
push ebp
push ebx
push edi
call fcn.10203bd4
add esp, 0xc
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
mov dword [eax + 0x14], edi
mov eax, dword [ecx]
cmp dword [eax + 0x14], esi
jne 0x10052b52
mov esi, 8
jmp 0x10052b52
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
add eax, 0xffffd507
cmp eax, 3
ja case.0x10052b3f.11001
jmp dword [eax*4 + 0x10052b70]
mov esi, 0x2afa
jmp 0x10052b52
mov esi, 0x2af9
mov ecx, dword [esp + 0x82c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101fdd0b
add esp, 0x820
ret 0x18
Function at 0x10053da0
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
push dword [esp + 0x14]
call fcn.10059c90
push 0x62
push edi
mov ebx, eax
call fcn.101ffee0
add esp, 0x10
neg eax
sbb esi, esi
and esi, 0xfffffff0
add esi, 0x11
test ebx, ebx
jne 0x10053e52
call fcn.10050630
push str.BIO_new_file
push 0x43
push str.crypto_bio_bss_file.c
call fcn.10050730
add esp, 0xc
push edi
push dword [esp + 0x14]
push str.calling_fopen__s___s_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
call fcn.10050840
add esp, 0x14
call fcn.1020addc
cmp dword [eax], 2
je 0x10053e22
call fcn.1020addc
cmp dword [eax], 6
je 0x10053e22
mov esi, 0x80002
lea edi, [ebx + 0x4d]
jmp 0x10053e2a
mov esi, 0x80
lea edi, [esi - 0x35]
call fcn.10050630
push str.BIO_new_file
push edi
push str.crypto_bio_bss_file.c
call fcn.10050730
push 0
push esi
push 0x20
call fcn.10050840
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x1022ec70
call fcn.1004df80
mov edi, eax
add esp, 4
test edi, edi
jne 0x10053e74
push ebx
call fcn.102095c8
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x8000
push edi
call fcn.1004d7b0
push ebx
push esi
push 0x6a
push edi
call fcn.1004d7e0
add esp, 0x18
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x100565c0
Capabilities:
Create thread

Disassembly:
push esi
push edi
push 0x27
push str.crypto_thread_arch_thread_win.c
push 4
call fcn.10050320
mov edi, dword [esp + 0x18]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10056604
push 0
push 0
push edi
push 0x10056620
push 0
push 0
call fcn.1020ba63
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x10056604
mov dword [edi + 0x10], esi
mov eax, 1
pop edi
pop esi
ret
push 0x34
push str.crypto_thread_arch_thread_win.c
push esi
mov dword [edi + 0x10], 0
call fcn.10050120
add esp, 0xc
xor eax, eax
pop edi
pop esi
ret

Function at 0x100580e0
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov eax, 4
call fcn.101fe2f0
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 1
cmp edi, 0xffffffff
jne 0x10058128
call fcn.10050630
push str.BIO_connect
push 0x56
push str.crypto_bio_bio_sock2.c
call fcn.10050730
push 0
push 0x87
push 0x20
call fcn.10050840
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
mov eax, ebx
shr eax, 3
push esi
and eax, 1
push eax
push edi
call fcn.100504c0
add esp, 8
test eax, eax
je 0x100581b7
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
test bl, 4
je 0x100581be
push 4
lea eax, [esp + 0x10]
push eax
push 8
push 0xffff
push edi
call esi
test eax, eax
je 0x100581be
call fcn.10050630
push str.BIO_connect
push 0x60
push str.crypto_bio_bio_sock2.c
call fcn.10050730
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.10050840
call fcn.10050630
push str.BIO_connect
push 0x62
push str.crypto_bio_bio_sock2.c
call fcn.10050730
push 0
push 0x89
push 0x20
call fcn.10050840
add esp, 0x24
pop esi
pop ebx
xor eax, eax
pop edi
pop ecx
ret
test bl, 0x10
je 0x1005822f
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push edi
call esi
test eax, eax
je 0x1005822f
call fcn.10050630
push str.BIO_connect
push 0x6a
push str.crypto_bio_bio_sock2.c
call fcn.10050730
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.10050840
call fcn.10050630
push str.BIO_connect
push 0x6c
push str.crypto_bio_bio_sock2.c
call fcn.10050730
push 0
push 0x8a
push 0x20
call fcn.10050840
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
mov esi, dword [esp + 0x18]
push esi
call fcn.10051e00
add esp, 4
push eax
push esi
call fcn.10051df0
add esp, 4
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x100582c1
push eax
call fcn.10057ff0
add esp, 4
test eax, eax
jne 0x100581b7
call fcn.10050630
push str.BIO_connect
push 0xb2
push str.crypto_bio_bio_sock2.c
call fcn.10050730
add esp, 0xc
push str.calling_connect__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.10050840
call fcn.10050630
push str.BIO_connect
push 0xb4
push str.crypto_bio_bio_sock2.c
call fcn.10050730
push 0
push 0x67
push 0x20
call fcn.10050840
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
pop esi
pop ebx
mov eax, 1
pop edi
pop ecx
ret
Function at 0x100590f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.101fe2f0
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x10059170
mov cl, byte [edi]
test cl, cl
je 0x10059170
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x10059120
pop esi
mov ecx, eax
pop ebx
shr ecx, 0x10
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x10059220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.101fe2f0
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x100592a3
mov cl, byte [edi]
test cl, cl
je 0x100592a3
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
and esi, 0xffffffdf
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x10059250
pop esi
mov ecx, eax
pop ebx
shr ecx, 0x10
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret
Function at 0x10077700
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.101fe2f0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
call fcn.100773c0
mov ebx, eax
push ebx
push esi
call fcn.100772d0
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x1007777f
push 0xf0000040
push 1
xor edi, edi
lea eax, [esp + 0x18]
push edi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x10077763
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.10077360
push esi
call fcn.100774b0
add esp, 0x10
test eax, eax
jne 0x100777f9
push 1
push esi
call fcn.100773c0
mov ebx, eax
push ebx
push esi
call fcn.100772d0
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x100777f0
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
lea eax, [esp + 0x1c]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x100777d4
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.10077360
push esi
call fcn.100774b0
add esp, 0x10
test eax, eax
jne 0x100777f9
push esi
call fcn.100774b0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10081020
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.101fe2f0
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [eax + 0x64]
push esi
mov esi, dword [esp + 0x28]
push edi
mov ecx, dword [ebp + 0x70]
mov edi, dword [esp + 0x28]
mov dword [esp + 0x10], ebp
test ecx, ecx
je 0x10081089
test ebx, ebx
je 0x10081069
lea edx, [ebp + 0x30]
add edx, ecx
cmp ecx, 0x40
jae 0x10081069
mov al, byte [edx]
inc ecx
xor al, byte [esi]
inc edx
mov byte [edi], al
inc esi
inc edi
sub ebx, 1
jne 0x10081055
mov dword [ebp + 0x70], ecx
test ebx, ebx
je 0x10081144
cmp ecx, 0x40
jne 0x10081089
mov dword [ebp + 0x70], 0
add dword [ebp + 0x20], 1
jne 0x10081089
inc dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
mov eax, ebx
and eax, 0x3f
sub ebx, eax
mov dword [esp + 0x1c], eax
lea eax, [ebp + 0x20]
mov dword [esp + 0x24], eax
cmp ebx, 0x40
jb 0x100810f7
push dword [esp + 0x24]
mov ecx, ebx
xor ebp, ebp
shr ecx, 6
lea eax, [ecx + edx]
cmp eax, ecx
cmovae ebp, eax
neg edx
cmp eax, ecx
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x14]
cmovae edx, ecx
shl edx, 6
push ebp
push edx
push esi
push edi
mov dword [esp + 0x28], edx
call fcn.1000de40
mov eax, dword [esp + 0x28]
add esp, 0x14
sub ebx, eax
add esi, eax
add edi, eax
mov eax, dword [esp + 0x18]
mov dword [ebp + 0x20], eax
test eax, eax
jne 0x100810f0
inc dword [ebp + 0x24]
mov edx, eax
cmp ebx, 0x40
jae 0x100810a3
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x10081144
push 0x40
lea eax, [ebp + 0x30]
push 0
push eax
call fcn.101ff800
lea eax, [ebp + 0x20]
push eax
push ebp
lea eax, [ebp + 0x30]
push 0x40
push eax
push eax
call fcn.1000de40
add esp, 0x20
xor edx, edx
test ebx, ebx
je 0x10081141
sub esi, edi
nop dword [eax + eax]
mov al, byte [edx + ebp + 0x30]
lea ecx, [edx + edi]
xor al, byte [esi + ecx]
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x10081130
mov dword [ebp + 0x70], ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
Function at 0x10089a70
Capabilities:
Hash data using sha1

Disassembly:
mov eax, 0x40
call fcn.101fe2f0
mov eax, dword [0x102c5980]
xor eax, esp
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x48], 0x1d
push esi
mov esi, dword [esp + 0x48]
push edi
mov edi, dword [esp + 0x58]
je 0x10089aac
pop edi
mov eax, 0xfffffffe
pop esi
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.101fdd0b
add esp, 0x40
ret
test esi, esi
je 0x10089bbb
cmp dword [esp + 0x54], 0x30
jne 0x10089bbb
push 0x30
push edi
push esi
call fcn.10089970
add esp, 0xc
test eax, eax
jle 0x10089bbb
movaps xmm0, xmmword [str.6666666666666666jjjjjjjjjjjjjjjj_]
lea eax, [esp + 8]
push 0x28
push eax
push esi
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
movq qword [esp + 0x34], xmm0
call fcn.10089970
add esp, 0xc
test eax, eax
je 0x10089bbb
lea eax, [esp + 0x30]
push esi
push eax
call fcn.100897d0
add esp, 8
test eax, eax
je 0x10089bbb
push 0x4c
lea eax, [esi + 0x14]
push 0
push eax
call fcn.101ff800
push 0x30
push edi
push esi
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
call fcn.10089970
add esp, 0x18
test eax, eax
jle 0x10089bbb
movaps xmm0, xmmword [str.pem_read_bio_key_decoder]
lea eax, [esp + 8]
push 0x28
push eax
push esi
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
movq qword [esp + 0x34], xmm0
call fcn.10089970
add esp, 0xc
test eax, eax
je 0x10089bbb
push 0x14
lea eax, [esp + 0x34]
push eax
push esi
call fcn.10089970
add esp, 0xc
test eax, eax
je 0x10089bbb
lea eax, [esp + 0x30]
push 0x14
push eax
call fcn.10001320
add esp, 8
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.101fdd0b
add esp, 0x40
ret
mov ecx, dword [esp + 0x44]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.101fdd0b
add esp, 0x40
ret
Function at 0x1008ad80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
lea edx, [eax - 1]
not eax
shr edx, 0x1f
shr eax, 0x1f
and edx, eax
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 4]
dec edx
xor eax, ecx
mov dword [esp + 0x10], edx
and eax, edx
xor ecx, eax
mov dword [ebp + 4], ecx
xor dword [ebx + 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebx + 0xc]
xor eax, ecx
movd xmm0, edx
and eax, edx
pshufd xmm4, xmm0, 0
xor ecx, eax
mov dword [ebp + 0xc], ecx
xor dword [ebx + 0xc], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebx + 0x10]
xor eax, ecx
and eax, edx
and eax, 4
xor ecx, eax
mov dword [ebp + 0x10], ecx
xor dword [ebx + 0x10], eax
xor eax, eax
mov esi, dword [esp + 0x1c]
test esi, esi
jle 0x1008ae96
push edi
cmp esi, 4
jb 0x1008ae71
mov ecx, dword [ebp]
lea edi, [esi - 1]
mov edx, dword [ebx]
lea ebp, [esi - 1]
lea ebp, [ecx + ebp*4]
cmp edx, ebp
lea edi, [edx + edi*4]
mov ebp, dword [esp + 0x18]
ja 0x1008ae14
cmp edi, ecx
jae 0x1008ae71
cmp edx, ebx
ja 0x1008ae1c
cmp edi, ebx
jae 0x1008ae71
cmp edx, ebp
ja 0x1008ae24
cmp edi, ebp
jae 0x1008ae71
lea edi, [esi - 1]
lea edi, [ecx + edi*4]
cmp ecx, ebx
ja 0x1008ae32
cmp edi, ebx
jae 0x1008ae71
cmp ecx, ebp
ja 0x1008ae3a
cmp edi, ebp
jae 0x1008ae71
mov edi, esi
and edi, 0xfffffffc
nop
movups xmm3, xmmword [edx + eax*4]
movups xmm2, xmmword [ecx + eax*4]
movaps xmm1, xmm3
xorps xmm1, xmm2
andps xmm1, xmm4
movaps xmm0, xmm1
xorps xmm1, xmm3
xorps xmm0, xmm2
movups xmmword [ecx + eax*4], xmm0
movups xmmword [edx + eax*4], xmm1
add eax, 4
cmp eax, edi
jl 0x1008ae40
mov dword [esp + 0x18], eax
cmp eax, esi
jge 0x1008ae95
mov ecx, dword [ebp]
mov edx, dword [ecx + eax*4]
lea esi, [ecx + eax*4]
mov ecx, dword [ebx]
mov edi, dword [ecx + eax*4]
xor edi, edx
and edi, dword [esp + 0x14]
xor edx, edi
mov dword [esi], edx
mov ecx, dword [ebx]
xor dword [ecx + eax*4], edi
inc eax
cmp eax, dword [esp + 0x20]
jl 0x1008ae71
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1008b530
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.101fe2f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [eax]
add eax, 4
test byte [ecx + 0x10], 4
lea edx, [ecx + 4]
mov ebx, dword [ecx]
push esi
mov dword [esp + 0x10], eax
je 0x1008b5f4
mov ecx, dword [eax]
cmp dword [edx], ecx
jne 0x1008b5f4
push edi
xor edi, edi
mov dword [esp + 0x1c], edi
test ecx, ecx
jle 0x1008b5ea
sub ebx, ebp
mov edx, dword [ebx + ebp]
lea ebp, [ebp + 4]
mov ecx, dword [ebp - 4]
mov esi, edx
sub esi, ecx
mov eax, edx
xor esi, ecx
xor eax, ecx
or esi, eax
xor esi, edx
shr esi, 0x1f
neg esi
mov dword [esp + 0x10], esi
not esi
mov dword [esp + 0x20], esi
mov eax, dword [esp + 0x20]
and eax, edi
mov edi, dword [esp + 0x10]
mov edx, dword [ebp - 4]
or edi, eax
mov ecx, dword [ebx + ebp - 4]
mov esi, edx
sub esi, ecx
mov eax, edx
xor esi, ecx
xor eax, ecx
or esi, eax
mov eax, dword [esp + 0x14]
xor esi, edx
shr esi, 0x1f
neg esi
mov dword [esp + 0x10], esi
not esi
mov dword [esp + 0x20], esi
mov ecx, dword [esp + 0x20]
and ecx, edi
mov edi, dword [esp + 0x10]
and edi, 1
or edi, ecx
mov ecx, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x1c], ecx
cmp ecx, dword [eax]
jl 0x1008b574
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, dword [edx]
mov ecx, edx
sub ecx, dword [eax]
je 0x1008b605
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 8
ret
lea ecx, [edx - 1]
test ecx, ecx
js 0x1008b628
lea eax, [ecx*4]
add eax, ebp
sub ebx, ebp
mov edx, dword [eax + ebx]
mov esi, dword [eax]
cmp esi, edx
jne 0x1008b631
sub eax, 4
sub ecx, 1
jns 0x1008b617
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
sbb eax, eax
pop esi
and eax, 2
pop ebp
dec eax
pop ebx
add esp, 8
ret
Function at 0x1008b920
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x24
call fcn.101fe2f0
push ebx
push esi
push edi
mov edi, dword [esp + 0x34]
xor ecx, ecx
push edi
mov dword [esp + 0x14], 0
xor ebx, ebx
mov dword [esp + 0x10], ecx
call fcn.1008b1d0
mov esi, eax
add esp, 4
lea eax, [esi + 7]
cdq
and edx, 7
lea ecx, [edx + eax]
sar ecx, 3
cmp dword [esp + 0x44], ebx
jne 0x1008b991
mov ebx, dword [edi + 0xc]
mov eax, ebx
neg eax
sbb eax, eax
and eax, 0xff
mov dword [esp + 0x10], eax
lea eax, [ecx*8]
cmp eax, esi
jne 0x1008b989
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 0xc], eax
jmp 0x1008b993
mov eax, ebx
mov dword [esp + 0xc], eax
jmp 0x1008b993
xor eax, eax
mov esi, dword [esp + 0x3c]
add eax, ecx
cmp esi, 0xffffffff
jne 0x1008b9d1
mov esi, eax
mov dword [esp + 0x3c], esi
mov ecx, dword [edi + 8]
shl ecx, 2
test ecx, ecx
jne 0x1008ba50
test esi, esi
je 0x1008bae4
push esi
push ecx
push dword [esp + 0x40]
call fcn.101ff800
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x24
ret
cmp esi, eax
jge 0x1008b9a4
movups xmm0, xmmword [edi]
mov eax, dword [edi + 0x10]
mov dword [esp + 0x2c], eax
movups xmmword [esp + 0x1c], xmm0
psrldq xmm0, 4
movd ecx, xmm0
test ecx, ecx
jle 0x1008ba12
mov eax, dword [esp + 0x1c]
lea eax, [eax + ecx*4]
nop dword [eax + eax]
cmp dword [eax - 4], 0
lea eax, [eax - 4]
jne 0x1008ba0e
dec ecx
test ecx, ecx
jg 0x1008ba00
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x28]
xor edx, edx
test ecx, ecx
cmove eax, edx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
call fcn.1008b1d0
add eax, 7
add esp, 4
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, dword [esp + 0xc]
cmp esi, eax
jge 0x1008b9a4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x24
ret
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
cmp edx, 1
je 0x1008ba60
dec eax
add eax, esi
mov edi, dword [edi + 4]
mov dword [esp + 0x44], eax
xor eax, eax
cmp edx, 1
push ebp
sete al
shl edi, 2
xor ebp, ebp
lea eax, [eax*2 - 1]
mov dword [esp + 0x18], eax
lea eax, [ecx - 1]
mov dword [esp + 0x1c], eax
test esi, esi
je 0x1008bae3
mov dword [esp + 0x10], esi
neg edi
mov esi, dword [esp + 0x38]
mov eax, dword [esi]
mov edx, ebp
shr edx, 2
mov ecx, ebp
and ecx, 3
shl ecx, 3
mov edx, dword [eax + edx*4]
mov eax, edi
shr edx, cl
mov ecx, ebp
shr eax, 0x1f
neg al
and dl, al
mov eax, dword [esp + 0x48]
xor dl, byte [esp + 0x14]
add bl, dl
cmp bl, dl
mov byte [eax], bl
sbb ebx, ebx
sub ecx, dword [esp + 0x1c]
add eax, dword [esp + 0x18]
neg ebx
shr ecx, 0x1f
inc edi
add ebp, ecx
mov dword [esp + 0x48], eax
sub dword [esp + 0x10], 1
jne 0x1008ba95
mov esi, dword [esp + 0x40]
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x100a98a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x30
call fcn.101fe2f0
mov eax, dword [0x102c5980]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push ebp
push esi
push edi
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x50]
movzx ecx, byte [edx]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x1c], eax
mov bl, byte [edx + 3]
mov esi, dword [eax]
movzx eax, byte [edx + 1]
shl eax, 8
or ecx, eax
mov ebp, dword [esp + 0x4c]
movzx eax, byte [edx + 2]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x20], edx
movzx eax, bl
shl eax, 0x18
or ecx, eax
mov byte [esp + 0x37], bl
movzx eax, byte [edx + 5]
shl eax, 8
movzx edi, byte [edx + 4]
mov dl, byte [edx + 7]
or edi, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], ecx
movzx ecx, dl
shl ecx, 8
movzx eax, byte [eax + 6]
or ecx, eax
mov dword [esp + 0x14], 0
mov eax, ecx
mov byte [esp + 0x3a], cl
shl eax, 0x10
or edi, eax
mov byte [esp + 0x3b], dl
mov eax, dword [esp + 0x10]
mov ebx, edi
mov dword [esp + 0x24], eax
mov byte [esp + 0x34], al
shr eax, 8
mov byte [esp + 0x35], al
mov eax, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x36], al
mov eax, ebx
shr eax, 8
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], al
test ebp, ebp
je 0x100a9a4b
mov edi, dword [esp + 0x44]
sub dword [esp + 0x18], edi
dec ebp
test esi, esi
jne 0x100a99f0
push 1
push dword [esp + 0x34]
lea eax, [esp + 0x2c]
push eax
call fcn.10002900
mov ecx, dword [esp + 0x30]
add esp, 0xc
mov ebx, dword [esp + 0x28]
mov eax, ecx
shr eax, 8
mov edx, dword [esp + 0x14]
mov byte [esp + 0x35], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x36], al
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x37], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x39], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x3a], al
mov eax, ebx
shr eax, 0x18
inc edx
mov dword [esp + 0x10], ecx
mov byte [esp + 0x34], cl
mov byte [esp + 0x38], bl
mov byte [esp + 0x3b], al
mov dword [esp + 0x14], edx
jmp 0x100a99f4
mov edx, dword [esp + 0x14]
mov al, byte [esp + esi + 0x34]
inc esi
mov ecx, dword [esp + 0x18]
and esi, 7
xor al, byte [edi]
mov byte [ecx + edi], al
inc edi
mov ecx, dword [esp + 0x10]
test ebp, ebp
jne 0x100a9983
test edx, edx
je 0x100a9a4b
mov edx, dword [esp + 0x20]
mov eax, ecx
shr eax, 8
mov byte [edx + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 2], al
mov eax, ebx
shr eax, 8
mov byte [edx + 5], al
mov eax, ebx
mov byte [edx], cl
shr ecx, 0x18
shr eax, 0x10
mov byte [edx + 4], bl
shr ebx, 0x18
mov byte [edx + 3], cl
mov byte [edx + 6], al
mov byte [edx + 7], bl
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x3c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101fdd0b
add esp, 0x30
ret