joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e1ec
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x42e250]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41e22c
cmp byte [ebx], 0xa
jne 0x41e22c
or byte [edi + eax + 0x28], 4
jmp 0x41e231
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x41e330
mov dl, byte [eax]
cmp dl, 0x1a
je 0x41e313
inc eax
cmp dl, 0xd
je 0x41e25d
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x41e283
cmp eax, ecx
jae 0x41e291
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x41e245
jmp 0x41e330
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41e30e
cmp dword [ebp - 0x10], 0
je 0x41e30e
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x42e250]
test byte [eax + edi + 0x28], 0x48
je 0x41e2e8
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x41e2d3
mov byte [esi], dl
jmp 0x41e2e4
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x42e250]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x41e330
cmp byte [ebp - 1], 0xa
jne 0x41e2f7
cmp esi, ebx
jne 0x41e2f7
mov byte [esi], 0xa
jmp 0x41e32f
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0041ed54
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x41e330
mov byte [esi], 0xd
jmp 0x41e32f
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x42e250]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x41e32d
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x41e330
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x41e339
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x42e250]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x41e37f
cmp word [ebx], dx
jne 0x41e37f
or byte [eax + edi + 0x28], 4
jmp 0x41e384
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x41e4e7
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x41e4c7
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x41e3c5
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x41e3fb
cmp eax, edx
jae 0x41e409
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x41e3a0
jmp 0x41e4e7
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41e4c2
cmp dword [ebp - 0x18], 0
je 0x41e4c2
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x42e250]
test byte [eax + edi + 0x28], 0x48
je 0x41e498
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x41e45c
mov word [esi], cx
jmp 0x41e493
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x42e250]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x42e250]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x42e250]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x41e4e7
pop eax
cmp word [ebp - 4], ax
jne 0x41e4a8
cmp esi, ebx
jne 0x41e4a8
mov word [esi], ax
jmp 0x41e4e4
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0041ed54
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x41e4e7
push 0xd
pop eax
jmp 0x41e4a3
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x42e250]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x41e4e1
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x41e4e7
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x420c70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x420c9d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420c9d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4121d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section._____1
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x4121f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4121f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4121e8
mov eax, 1
add ebx, ebx
jne 0x41220b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x412200
jne 0x41221c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412200
xor ecx, ecx
sub eax, 3
jb 0x412230
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4122a2
mov ebp, eax
add ebx, ebx
jne 0x41223b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x412248
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41226c
inc ecx
add ebx, ebx
jne 0x412258
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41224d
jne 0x412269
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41224d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41228c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41227d
jmp 0x4121ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41228c
add edi, ecx
jmp 0x4121ee
pop esi
mov edi, esi
mov ecx, 0x411
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4122aa
cmp byte [edi], 0
jne 0x4122aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4122af
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x41231e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12454]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x124e0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4122dc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x124e4]
or eax, eax
je 0x412318
mov dword [ebx], eax
add ebx, 4
jmp 0x4122f9
call dword [esi + 0x124e8]
popal
jmp 0x409cc0
Function at 0x40a8f7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40a917
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040d13a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x40a938
test byte [esp + 8], 2
je 0x40a938
mov dword [0x41ae18], 0xd
mov dword [0x41ae1c], 5
jmp 0x40a913
xor eax, eax
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x408ed0
nop
nop
mov ecx, 0x5ff066dd
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x62c0086e
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x1001227c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0xffffffff
mov dword [0x1002ca54], 0x122e
cmp ecx, 0
sete bl
cmp eax, 0
sete bh
and bl, bh
test bl, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jne 0x10012496
jmp 0x10012364
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov si, word [edx + eax*2]
mov di, si
add di, 0xffbf
mov bx, si
add bx, 0x20
cmp di, 0x1a
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov word [ebp - 0x2e], si
mov word [ebp - 0x30], bx
jb 0x100122fe
mov ax, word [ebp - 0x2e]
mov word [ebp - 0x30], ax
mov ax, word [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
add ecx, 0x264a
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x28]
cmp word [edx + esi*2], ax
sete bl
add esi, 1
cmp ax, 0
setne bh
mov al, bl
and al, bh
mov edi, dword [ebp - 0x34]
cmp esi, edi
setb bh
and al, bh
test al, 1
mov eax, ecx
mov byte [ebp - 0x35], bl
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
jne 0x100122c4
jmp 0x1001243c
mov eax, dword [ebp - 0x10]
cmp eax, 0
setne cl
mov edx, dword [ebp - 0x40]
mov byte [ebp - 0x41], cl
mov dword [ebp - 0x48], edx
jmp 0x100123b9
mov dword [0x1002ca54], 0xc01
mov ecx, dword fs:[0x18]
xor eax, eax
mov dword [0x1002ca54], 0x1973
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0xc]
mov edx, ecx
add edx, 0x14
mov dword [0x1002ca58], 0x177a
mov ecx, dword [ecx + 0x14]
mov dword [0x1002ca54], 0x1eb7
cmp ecx, edx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x18], eax
je 0x10012496
jmp 0x1001234e
mov eax, dword [ebp - 0x48]
mov ecx, eax
add ecx, 0x24
mov edx, dword [eax + 0x28]
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x41]
and bh, bl
test bh, 1
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x58], esi
jne 0x100123ea
jmp 0x1001240e
mov dword [0x1002ca54], 0xdfa
mov dword [0x1002ca58], 0xa7
mov eax, dword [ebp - 0x50]
add eax, 0xfffffff8
mov dword [ebp - 0x18], eax
jmp 0x10012496
mov eax, 0xdfa
xor ecx, ecx
mov edx, dword [ebp - 0x54]
mov si, word [edx]
shr si, 1
movzx edi, si
cmp si, 0
mov ebx, eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x5c], eax
je 0x10012465
jmp 0x100122c4
mov al, byte [ebp - 0x35]
test al, 1
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x5c], ecx
jne 0x1001244b
jmp 0x10012465
mov eax, dword [ebp - 0x3c]
mov dword [0x1002ca54], eax
mov dword [0x1002ca58], 0x671
mov ecx, dword [ebp - 0x58]
mov dword [ebp - 0x18], ecx
jmp 0x10012496
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx]
mov esi, dword [ebp - 0x4c]
cmp edx, esi
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x48], edx
jne 0x100123b9
xor eax, eax
mov ecx, dword [ebp - 0x60]
mov dword [0x1002ca54], ecx
mov dword [0x1002ca58], 0x671
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100125e5
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov eax, dword [0x1002ca54]
add eax, 0xffffda07
mov dword [0x1002ca54], eax
call fcn.10001070
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
jne 0x10012753
lea eax, [esp + 0x38]
mov dword [0x1002ca54], 0xbdc
mov dword [esp + 0x20], eax
call fcn.100138b7
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x1c], ecx
jne 0x1001274b
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.10012802
lea ecx, [0x10013b34]
mov dword [0x1002ca58], 0xb1d
mov edx, dword [esp + 0x28]
mov dword [esp + 0x7c], edx
mov dword [esp + 0x54], 0x15a800
mov edx, dword [0x1002ca40]
mov dword [esp + 0x70], edx
mov edx, dword [0x1002ca44]
mov dword [esp + 0x44], edx
mov edx, dword [0x1002ca48]
mov dword [esp + 0x38], edx
mov edx, dword [0x1002ca4c]
mov dword [esp + 0x74], edx
mov dword [0x1002ca54], 0x135a
mov edx, dword [0x1002ca50]
mov dword [esp + 0x50], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x100126d2
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x100126ee
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x100126af
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x80], ecx
mov edx, dword [esp + 0xc]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x78], esi
mov dword [0x1002ca54], 0x111c
mov esi, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.10012ac6
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov ecx, dword [0x1002ca54]
add ecx, 0xfffff0fe
mov dword [0x1002ca54], ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x10012ac6
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [0x100154cf]
mov esi, 0xe
lea edi, [ebp - 0x28]
mov dword [0x1002ca54], 0x90d
mov dword [0x1002ca58], 0xb59
mov dword [esp], edi
mov dword [esp + 4], edx
mov dword [esp + 8], 0xe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
call fcn.100131f5
mov eax, dword [0x1002ca54]
add eax, 0x1da2
mov dword [0x1002ca58], eax
call fcn.10012d7b
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.10012fdf
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
je 0x10012c13
mov eax, dword [ebp - 0x3c]
mov dword [0x1002ca58], 0xc01
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x1002ca54], 0x1a95
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
call fcn.10012e28
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
mov dword [0x1002ca58], 0x539
add ecx, 0xffc00000
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x34], ecx
mov ecx, dword [0x1002ca58]
add ecx, 0xffffeed3
mov dword [0x1002ca58], ecx
mov ecx, dword [ebp - 0x44]
mov dword [edx + 0x4c], ecx
mov dword [0x1002ca54], 0x147
cmp ecx, 0
mov dword [ebp - 0x40], eax
je 0x10012c13
mov eax, dword [ebp - 0x44]
add eax, 0x1699
mov dword [ebp - 0x48], eax
mov dword [0x1002ca58], 0x1479
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
add esp, 0x50
pop esi
pop edi
pop ebp
ret
Function at 0x1001335d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x1002ca5c], 0
mov dword [0x1002ca60], 0
mov dword [0x1002ca6c], 0
mov edi, dword [0x1002ca54]
add edi, 0x5f1
mov dword [0x1002ca54], edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
xor eax, eax
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
mov edx, eax
mov esi, eax
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], eax
je 0x100134e6
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
mov edi, 0x100
add ecx, 0x214e
mov dword [0x1002ca54], ecx
add edx, 1
mov dword [ebp - 0x34], eax
mov eax, edx
cdq
idiv edi
mov dword [0x1002ca5c], edx
mov dword [0x1002ca58], 0xe94
mov ecx, dword [ebp - 0x1c]
movzx ebx, byte [ecx + edx]
add ebx, esi
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv edi
mov dword [0x1002ca60], edx
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x1002ca64], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x1002ca54], 0x20fe
mov cl, byte [0x1002ca64]
mov edx, dword [0x1002ca60]
mov byte [edi + edx], cl
mov edx, dword [0x1002ca5c]
movzx edx, byte [edi + edx]
mov ebx, dword [0x1002ca60]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x1002ca6c], ebx
mov dword [0x1002ca54], 0x211
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x34]
mov ch, byte [edx + ebx]
mov byte [0x1002ca71], ch
mov byte [0x1002ca72], cl
mov dword [0x1002ca54], 0x1106
xor ch, cl
mov byte [0x1002ca70], ch
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x3c], ebx
je 0x100134e6
mov eax, dword [0x1002ca54]
mov ecx, dword [0x1002ca60]
mov edx, dword [0x1002ca5c]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], esi
jmp 0x100133d5
mov eax, dword [0x1002ca58]
add eax, 0x221
mov dword [0x1002ca58], eax
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100135a4
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x1002ca60], 0
mov byte [0x1002ca64], 0
mov dword [0x1002ca54], 0x9b7
mov dword [0x1002ca5c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100135fc
xor eax, eax
mov dword [0x1002ca5c], 0
mov dword [ebp - 0x20], eax
jmp 0x1001362e
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x1002ca54], 0x1a34
mov eax, dword [0x1002ca5c]
add eax, 1
mov dword [0x1002ca5c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x100135fc
jmp 0x100135eb
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x1002ca68], 0
mov dword [0x1002ca58], 0xa70
mov edx, dword [0x1002ca60]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x1002ca68], edi
mov dword [0x1002ca54], 0x2605
mov eax, edi
cdq
idiv ecx
mov dword [0x1002ca60], edx
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x1002ca64], cl
mov dword [0x1002ca58], 0x1d7f
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov dword [0x1002ca54], 0x14bd
mov cl, byte [0x1002ca64]
mov edx, dword [0x1002ca60]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x1002ca5c]
add edx, 1
mov dword [0x1002ca5c], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x1001362e
mov dword [0x1002ca54], 0x20f6
mov dword [0x1002ca58], 0xbda
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10013705
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x50
mov eax, dword [ebp + 8]
mov ecx, dword [0x1002ca54]
add ecx, 0x89f
mov dword [0x1002ca54], ecx
mov dword [0x1002ca58], 0x1fa4
mov dword [ebp - 0x10], eax
call fcn.100124a1
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x1001375d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x1002ca54], 0xfffff354
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x24]
mov dword [0x1002ca58], 0x1e93
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
je 0x100138ac
jmp 0x100137d4
mov eax, dword [ebp - 0x38]
mov ecx, eax
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x41], bh
mov byte [ebp - 0x42], cl
je 0x10013846
jmp 0x1001381a
mov eax, 0xfffff354
xor ecx, ecx
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x2c]
add edx, esi
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x4c]
xor esi, esi
add edx, 0x89f
mov edi, dword [ebp - 0x28]
mov ebx, dword [edi + ecx*4]
mov dword [0x1002ca54], edx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x38], esi
jmp 0x100137a9
mov eax, dword [ebp - 0x40]
add eax, 1
mov cl, byte [ebp - 0x41]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x42]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x38], eax
jne 0x100137a9
mov al, byte [ebp - 0x42]
test al, 1
jne 0x1001387f
jmp 0x1001384f
xor eax, eax
mov ecx, dword [ebp - 0x54]
add ecx, 2
mov edx, dword [ebp - 0x58]
add edx, 1
mov esi, dword [ebp - 0x30]
cmp edx, esi
mov edi, dword [ebp - 0x5c]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x34], eax
jb 0x100137ec
jmp 0x100138ac
mov eax, dword [ebp - 0x54]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov dword [0x1002ca54], 0x5ea
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x1002ca58], 0x19e
mov dword [ebp - 0x34], edi
mov eax, dword [ebp - 0x34]
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret