joyce8/EMBER2024-capa huggingface dataset:
Function at 0x568936
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x5b0100]
je 0x568951
inc edi
cmp edi, 0x17
jb 0x568942
cmp edi, 0x17
jae 0x568ad1
push ebp
push 3
call fcn.0056e01c
cmp eax, 1
pop ecx
je 0x568a9d
push 3
call fcn.0056e01c
test eax, eax
pop ecx
jne 0x568985
cmp dword [0x5b00c0], 1
je 0x568a9d
cmp ebx, 0xfc
je 0x568ad0
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x5f0d78
push ebp
call fcn.00567353
add esp, 0xc
test eax, eax
je 0x5689bb
push esi
push esi
push esi
push esi
push esi
call fcn.0056ab47
add esp, 0x14
push 0x104
mov esi, 0x5f0d91
push esi
push 0
mov byte [0x5f0e95], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x5689ff
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00567353
add esp, 0xc
test eax, eax
je 0x5689ff
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0056ab47
add esp, 0x14
push esi
call fcn.0056bf00
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x568a44
push esi
call fcn.0056bf00
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x5f108c
push 0x57e918
sub ecx, eax
push ecx
push eax
call fcn.0056df69
add esp, 0x14
test eax, eax
je 0x568a44
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0056ab47
add esp, 0x14
jmp 0x568a46
xor esi, esi
push 0x57cc18
push ebx
push ebp
call fcn.0056def8
add esp, 0xc
test eax, eax
je 0x568a66
push esi
push esi
push esi
push esi
push esi
call fcn.0056ab47
add esp, 0x14
push dword [edi*8 + 0x5b0104]
push ebx
push ebp
call fcn.0056def8
add esp, 0xc
test eax, eax
je 0x568a88
push esi
push esi
push esi
push esi
push esi
call fcn.0056ab47
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0056dd3b
add esp, 0xc
jmp 0x568ad0
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x568ad0
cmp ebp, 0xffffffff
je 0x568ad0
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x5b0104]
push dword [esi]
call fcn.0056bf00
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x56dd3b
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00567e81
xor ebx, ebx
cmp dword [0x5f1374], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x56de11
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x56def1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x57cef0
push edi
call esi
cmp eax, ebx
je 0x56def1
push eax
call fcn.00567e13
mov dword [esp], 0x57cee0
push edi
mov dword [0x5f1374], eax
call esi
push eax
call fcn.00567e13
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x5f1378], eax
call esi
push eax
call fcn.00567e13
mov dword [0x5f137c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00566ca9
test eax, eax
pop ecx
pop ecx
je 0x56dddf
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0056ab47
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x56de11
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00567e13
cmp eax, ebx
pop ecx
mov dword [0x5f1384], eax
je 0x56de11
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00567e13
pop ecx
mov dword [0x5f1380], eax
mov eax, dword [0x5f1380]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x56de96
cmp dword [0x5f1384], ecx
je 0x56de96
push eax
call fcn.00567e8a
push dword [0x5f1384]
mov esi, eax
call fcn.00567e8a
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x56de96
cmp edi, ebx
je 0x56de96
call esi
cmp eax, ebx
je 0x56de63
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x56de63
test byte [ebp - 0x18], 1
jne 0x56de96
lea eax, [ebp - 0x10]
push eax
call fcn.00566ce0
test eax, eax
pop ecx
je 0x56de7e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0056ab47
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x56de8d
or dword [ebp + 0x10], 0x200000
jmp 0x56ded1
or dword [ebp + 0x10], 0x40000
jmp 0x56ded1
mov eax, dword [0x5f1378]
cmp eax, dword [ebp - 8]
je 0x56ded1
push eax
call fcn.00567e8a
cmp eax, ebx
pop ecx
je 0x56ded1
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x56ded1
mov eax, dword [0x5f137c]
cmp eax, dword [ebp - 8]
je 0x56ded1
push eax
call fcn.00567e8a
cmp eax, ebx
pop ecx
je 0x56ded1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x5f1374]
call fcn.00567e8a
cmp eax, ebx
pop ecx
je 0x56def1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x56def3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10013610
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10298eff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.10268efc
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
je 0x1001369b
push eax
push esi
call fcn.102691df
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push str.bad_locale_name
call fcn.10268eaf
int3

Function at 0x100174e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10299150
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10269f9d
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.102690df
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
pop edi
pop esi
mov dword [edx], 0
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10019460
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push dword [esp + 0x20]
lea eax, [esp + 4]
mov dword [esp + 0xc], 0x38464947
push 6
push 1
push eax
mov eax, dword [esp + 0x2c]
mov word [esp + 0x1c], 0x6139
mov dword [esp + 0x20], 0x38464947
mov word [esp + 0x24], 0x6137
mov eax, dword [eax]
mov dword [esp + 0x10], 0
mov word [esp + 0x14], 0
call eax
lea ecx, [esp + 8]
mov eax, dword [ecx]
lea edx, [esp]
cmp eax, dword [edx]
jne 0x100194c7
movzx eax, word [ecx + 4]
cmp ax, word [edx + 4]
jne 0x100194c7
mov eax, 1
add esp, 0x18
ret 8
lea ecx, [esp + 0x10]
mov eax, dword [ecx]
lea edx, [esp]
cmp eax, dword [edx]
jne 0x100194de
movzx eax, word [ecx + 4]
cmp ax, word [edx + 4]
je 0x100194bc
xor eax, eax
add esp, 0x18
ret 8
Function at 0x100310c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
push ebx
push esi
push edi
mov edi, ecx
mov word [esp + 0x30], 0
mov esi, edx
mov dword [esp + 0xc], 0x45555254
xorps xmm0, xmm0
mov dword [esp + 0x10], 0x49534956
push esi
mov eax, dword [edi + 0xc]
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x18], 0x582d4e4f
mov dword [esp + 0x1c], 0x454c4946
mov word [esp + 0x20], 0x2e
call eax
mov ecx, dword [edi + 8]
mov ebx, eax
push 2
push 0
push esi
call ecx
mov ecx, dword [edi + 0xc]
push esi
call ecx
add eax, 0xffffffee
add eax, ebx
test eax, eax
jle 0x10031138
push 0
push eax
mov eax, dword [edi + 8]
push esi
call eax
push esi
push 0x12
push 1
lea eax, [esp + 0x2c]
push eax
mov eax, dword [edi]
call eax
mov eax, dword [edi + 8]
push 0
push ebx
push esi
call eax
lea edx, [esp + 0xc]
mov esi, 0xe
lea eax, [esp + 0x20]
nop
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x10031175
add edx, 4
add eax, 4
sub esi, 4
jae 0x10031150
mov cx, word [edx]
cmp cx, word [eax]
jne 0x10031175
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x28
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x28
ret
Function at 0x10042970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
xor ebx, ebx
push edi
xor edi, edi
test ebp, ebp
jle 0x100429dd
push esi
mov esi, dword [esp + 0x18]
mov al, byte [esi]
movzx eax, al
test edi, edi
je 0x10042993
inc esi
and eax, 0xf
jmp 0x10042996
shr eax, 4
mov ecx, dword [esp + 0x20]
xor edi, 1
movzx edx, byte [ecx + eax*4 + 2]
lea ecx, [ecx + eax*4]
mov eax, 0xfff8
and dx, ax
movzx eax, byte [ecx + 1]
shl dx, 5
or dx, ax
mov eax, 0xfff8
and dx, ax
mov al, byte [ecx]
shr al, 3
shl dx, 2
movzx eax, al
or dx, ax
mov eax, dword [esp + 0x14]
mov word [eax + ebx*2], dx
inc ebx
cmp ebx, ebp
jl 0x10042984
pop esi
pop edi
pop ebp
pop ebx
ret 0x10

Function at 0x10044350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
xor esi, esi
test ebx, ebx
jle 0x100443c9
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
inc eax
push edi
mov edi, dword [esp + 0x1c]
nop word [eax + eax]
mov cl, byte [edx]
movzx ecx, cl
test esi, esi
je 0x10044399
and ecx, 0xf
movzx ecx, byte [edi + ecx*4]
mov byte [eax - 1], cl
movzx ecx, byte [edx]
and ecx, 0xf
movzx ecx, byte [edi + ecx*4 + 1]
mov byte [eax], cl
movzx ecx, byte [edx]
inc edx
and ecx, 0xf
jmp 0x100443b6
shr ecx, 4
movzx ecx, byte [edi + ecx*4]
mov byte [eax - 1], cl
movzx ecx, byte [edx]
shr ecx, 4
movzx ecx, byte [edi + ecx*4 + 1]
mov byte [eax], cl
movzx ecx, byte [edx]
shr ecx, 4
mov cl, byte [edi + ecx*4 + 2]
xor esi, 1
mov byte [eax + 1], cl
add eax, 3
sub ebx, 1
jne 0x10044370
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x100450f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
xor esi, esi
test ebx, ebx
jle 0x1004516d
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
inc eax
push edi
mov edi, dword [esp + 0x1c]
nop word [eax + eax]
mov cl, byte [edx]
movzx ecx, cl
test esi, esi
je 0x10045139
and ecx, 0xf
movzx ecx, byte [edi + ecx*4]
mov byte [eax - 1], cl
movzx ecx, byte [edx]
and ecx, 0xf
movzx ecx, byte [edi + ecx*4 + 1]
mov byte [eax], cl
movzx ecx, byte [edx]
inc edx
and ecx, 0xf
jmp 0x10045156
shr ecx, 4
movzx ecx, byte [edi + ecx*4]
mov byte [eax - 1], cl
movzx ecx, byte [edx]
shr ecx, 4
movzx ecx, byte [edi + ecx*4 + 1]
mov byte [eax], cl
movzx ecx, byte [edx]
shr ecx, 4
mov cl, byte [edi + ecx*4 + 2]
xor esi, 1
mov byte [eax + 1], cl
mov byte [eax + 2], 0xff
add eax, 4
sub ebx, 1
jne 0x10045110
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x10045410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
test edi, edi
jle 0x100454c9
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
add edx, 2
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
mov cl, byte [eax]
movzx ecx, cl
test esi, esi
je 0x1004547b
and ecx, 0xf
movzx ecx, byte [ebx + ecx*4]
mov byte [edx - 2], cl
movzx ecx, byte [eax]
and ecx, 0xf
movzx ecx, byte [ebx + ecx*4 + 1]
mov byte [edx - 1], cl
movzx ecx, byte [eax]
and ecx, 0xf
movzx ecx, byte [ebx + ecx*4 + 2]
mov byte [edx], cl
movzx ecx, byte [eax]
and ecx, 0xf
cmp ecx, dword [esp + 0x28]
jge 0x10045475
mov cl, byte [ecx + ebp]
inc eax
jmp 0x100454b5
or cl, 0xff
inc eax
jmp 0x100454b5
shr ecx, 4
movzx ecx, byte [ebx + ecx*4]
mov byte [edx - 2], cl
movzx ecx, byte [eax]
shr ecx, 4
movzx ecx, byte [ebx + ecx*4 + 1]
mov byte [edx - 1], cl
movzx ecx, byte [eax]
shr ecx, 4
cmp dword [esp + 0x28], 0
movzx ecx, byte [ebx + ecx*4 + 2]
mov byte [edx], cl
jle 0x100454b2
movzx ecx, byte [eax]
shr ecx, 4
mov cl, byte [ecx + ebp]
jmp 0x100454b5
or cl, 0xff
mov byte [edx + 1], cl
xor esi, 1
add edx, 4
sub edi, 1
jne 0x10045435
pop ebp
pop ebx
pop edi
pop esi
ret 0x18

Function at 0x10046280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
xor edx, edx
push edi
mov edi, 1
test ebx, ebx
jle 0x10046327
movss xmm2, dword [0x103ef8c4]
movss xmm3, dword [0x103ef8f8]
movss xmm4, dword [0x103ef8a0]
movss xmm5, dword [0x103ef8f0]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x14]
nop
mov eax, dword [esp + 0x18]
movzx ecx, byte [edx + eax]
movzx eax, byte [ebp + ecx*4 + 2]
movd xmm1, eax
movzx eax, byte [ebp + ecx*4 + 1]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movzx eax, byte [ebp + ecx*4]
mov ecx, edx
cvtdq2ps xmm0, xmm0
shr ecx, 1
mulss xmm1, xmm2
mulss xmm0, xmm3
addss xmm1, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm4
addss xmm1, xmm0
addss xmm1, xmm5
cvttss2si eax, xmm1
test edi, edi
je 0x10046317
and al, 0xf0
mov byte [ecx + esi], al
jmp 0x1004631d
shr al, 4
or byte [ecx + esi], al
inc edx
xor edi, 1
cmp edx, ebx
jl 0x100462c0
pop esi
pop ebp
pop edi
pop ebx
ret 0x10
Function at 0x1005b580
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x102999dd
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x40], 0
jne 0x1005b6ed
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebx + 0x34]
call fcn.1005c210
mov ecx, dword [ebp - 0x18]
cmp byte [ecx + 0xd], 0
jne 0x1005b6ed
mov eax, dword [ebp + 8]
cmp eax, dword [ecx + 0x10]
jl 0x1005b6ed
cmp ecx, dword [ebx + 0x34]
je 0x1005b6ed
mov eax, dword [ecx + 0x14]
mov eax, dword [eax + 8]
mov dword [ebx + 0x40], eax
cmp dword [eax + 8], 0
jne 0x1005b6d0
push 0xfff8
call fcn.1026a066
mov ecx, dword [ebx + 0x40]
add esp, 4
mov dword [ecx + 8], eax
mov eax, dword [ebx + 0x40]
push 0
imul eax, dword [eax], 0xfff8
push eax
push dword [ebx]
call fcn.10277057
mov eax, dword [ebx + 0x40]
add esp, 0xc
push dword [ebx]
push 1
push 0xfff8
push dword [eax + 8]
call fcn.10277579
mov ecx, dword [ebp - 0x18]
add esp, 0x10
mov eax, dword [ebx + 0x24]
push dword [ecx + 0x14]
lea ecx, [ebx + 0x2c]
push ecx
push dword [eax]
lea ecx, [ebx + 0x24]
call fcn.1005bab0
mov esi, dword [ebx + 0x24]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x20]
push eax
mov esi, dword [esi]
lea ecx, [ebx + 0x34]
call fcn.1005c210
mov ecx, dword [ebp - 0x18]
cmp byte [ecx + 0xd], 0
jne 0x1005b66c
mov eax, dword [ebp + 8]
cmp eax, dword [ecx + 0x10]
jge 0x1005b6cd
cmp dword [ebx + 0x38], 0xaaaaaaa
je 0x1005b702
mov edi, dword [ebx + 0x34]
lea eax, [ebx + 0x34]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
push 0x18
mov dword [ebp - 0x10], 0
call fcn.10269f9d
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [eax + 0x10], ecx
lea ecx, [ebx + 0x34]
push eax
push dword [ebp - 0x1c]
mov dword [eax + 0x14], 0
push dword [ebp - 0x20]
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov word [eax + 0xc], 0
call fcn.1005bfc0
mov ecx, eax
mov dword [ecx + 0x14], esi
mov ecx, ebx
call fcn.1005b3e0
mov eax, dword [ebx + 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.10001a80
int3
Function at 0x1005c260
Capabilities:
Access peb ldr_data
Get number of processors
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10299a77
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push esi
push edi
lea edi, [ebx + 0x1c]
mov dword [ebx], 0
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 0x18], 0
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0xf
mov byte [edi + 4], 0
mov dword [ebp - 4], 0
push 0xc
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
call fcn.10269f9d
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 0x1c], eax
mov byte [ebp - 4], 1
push 0xc
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
call fcn.10269f9d
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 0x24], eax
mov byte [ebp - 4], 2
push 0xc
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.10269f9d
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [edi + 0x2c], eax
lea esi, [edi + 0x34]
mov byte [ebp - 4], 3
push 0x18
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10269f9d
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 1
lea esi, [ebx + 0x64]
mov dword [ebp - 4], 4
push 0x18
mov dword [ebp - 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10269f9d
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov byte [ebp - 4], 5
mov dword [ebx + 0x6c], 0
mov dword [ebx + 0x70], 0
push 0x14
mov dword [ebx + 0x74], 0
mov dword [ebx + 0x78], 0
call fcn.10269f9d
add esp, 0x18
mov dword [eax], eax
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], eax
mov dword [ebx + 0x74], eax
mov dword [ebx + 0x7c], 0
mov dword [ebx + 0x8c], 0
mov dword [ebx + 0x90], 0xf
mov byte [ebx + 0x7c], 0
mov eax, dword [ebx + 4]
mov dword [ebx + 0x98], eax
mov eax, ebx
mov dword [ebx + 0x94], 1
mov dword [ebx + 0x9c], 0
pop edi
mov dword [ebx + 8], 0x10007440
mov dword [ebx + 0x10], 0x10007480
mov dword [ebx + 0x14], 0x100074a0
mov dword [ebx + 0xc], 0x10007460
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100860a0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi + 0x14]
cmp eax, 0xca
jne 0x100860d4
push esi
call fcn.1008e380
add esp, 4
cmp byte [esi + 0x40], 0
je 0x100860cb
pop edi
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
jmp 0x100860db
cmp eax, 0xcb
jne 0x10086153
mov eax, dword [esi + 0x1a8]
cmp byte [eax + 0x10], 0
je 0x1008613e
mov eax, dword [esi + 8]
test eax, eax
je 0x100860f6
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a8]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x10086139
cmp eax, 2
je 0x1008613e
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100860e7
cmp eax, 3
je 0x1008611e
cmp eax, 1
jne 0x100860e7
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x100860e7
mov eax, dword [esi + 0x128]
add eax, edi
mov dword [edx + 8], eax
jmp 0x100860e7
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.10086190
add esp, 4
pop edi
pop esi
ret
cmp eax, 0xcc
je 0x10086175
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.10086190
add esp, 4
pop edi
pop esi
ret

Function at 0x10086190
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
cmp dword [esi + 0x14], 0xcc
lea ebx, [esi + 0x78]
je 0x100861bf
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [ebx], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
je 0x10086242
nop dword [eax + eax]
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x10086216
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100861f5
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x19c]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x10086259
cmp eax, dword [esi + 0x60]
jb 0x100861d7
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
jne 0x100861d0
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
Function at 0x1009a700
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
mov edx, 0x100
mov ebp, dword [edi + 0x4c]
cmp ebp, 1
mov esi, dword [edi + 0x1c0]
sete al
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], ebp
mov byte [esi + 0x1c], al
mov eax, 0x2fe
push dword [edi + 0x64]
mov ecx, dword [edi + 4]
cmovne eax, edx
push eax
push 1
push edi
mov eax, dword [ecx + 8]
call eax
xor ebx, ebx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
mov dword [esp + 0x10], ebx
cmp dword [edi + 0x64], ebx
jle 0x1009a833
nop dword [eax]
mov ecx, dword [esi + ebx*4 + 0x20]
cdq
idiv ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
cmp ebp, 1
jne 0x1009a77e
mov eax, dword [esi + 0x18]
add dword [eax + ebx*4], 0xff
mov eax, dword [esi + 0x18]
lea edi, [ecx*2 - 2]
mov ebp, dword [eax + ebx*4]
lea eax, [ecx + 0xfe]
cdq
xor ebx, ebx
idiv edi
xor esi, esi
mov edx, eax
nop word [eax + eax]
cmp esi, edx
jle 0x1009a7c4
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x1009a7b2
mov ecx, dword [esp + 0x14]
movzx ecx, cl
movzx eax, bl
imul ecx, eax
mov byte [esi + ebp], cl
inc esi
mov ecx, dword [esp + 0x1c]
cmp esi, 0xff
jle 0x1009a7a0
cmp dword [esp + 0x18], 1
jne 0x1009a811
mov ecx, 1
lea edx, [ebp - 1]
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x1009a7f0
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
inc ebx
mov esi, dword [esp + 0x20]
cmp ebx, dword [eax + 0x64]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], ebx
jl 0x1009a760
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret