joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c830
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 8]
test esi, esi
je 0x1000c8b0
mov eax, dword [esi + 4]
mov edx, dword [ebp + 0xc]
mov dword [esp + 8], 0x10045567
xor edi, edi
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._cmsOpenIOhandlerFromFile
mov ebx, eax
test eax, eax
je 0x1000c885
mov dword [esp + 4], eax
mov dword [esp], esi
call sym._cmsSaveProfileToIOhandler
mov dword [esp], ebx
test eax, eax
setne al
movzx eax, al
mov edi, eax
call dword [ebx + 0x118]
and edi, eax
je 0x1000c890
add esp, 0xc
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_remove]
add esp, 0xc
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x1000c843

Function at 0x1000d8c0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov ebx, dword [0x1005901c]
test ebx, ebx
je 0x1000d990
mov eax, dword [0x1005901c]
test eax, eax
je 0x1000d968
mov eax, dword [0x1005901c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
sub esp, 8
cmp eax, 0xffffffff
je 0x1000d968
mov eax, dword [0x10040100]
test eax, eax
je 0x1000d9e0
mov eax, dword [0x1005901c]
test eax, eax
je 0x1000d940
mov eax, dword [0x1005901c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_ReleaseMutex]
sub esp, 4
test eax, eax
je 0x1000d940
mov dword [0x10059020], 1
mov ebx, dword [ebp - 4]
mov eax, 1
leave
ret
mov dword [esp + 8], str.Mutex_unlock_failed
mov dword [esp + 4], 3
mov dword [esp], 0
call sym._cmsSignalError
mov ebx, dword [ebp - 4]
xor eax, eax
leave
ret
mov dword [esp + 8], str.Mutex_lock_failed
mov dword [esp + 4], 3
mov dword [esp], 0
call sym._cmsSignalError
mov ebx, dword [ebp - 4]
xor eax, eax
leave
ret
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateMutexA]
sub esp, 0xc
mov edx, eax
test eax, eax
je 0x1000d8d5
mov eax, ebx
lock cmpxchg dword [0x1005901c], edx
test eax, eax
je 0x1000d8d5
mov dword [esp], edx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
jmp 0x1000d8d5
mov dword [esp], 0x10040100
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
sub esp, 4
jmp 0x1000d90d
Function at 0x1001a210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xd4
movupd xmm0, xmmword [ebp + 0x10]
mov eax, dword [ebp + 0x30]
mov esi, dword [ebp + 0x34]
mov edi, dword [ebp + 8]
movups xmmword [esp + 0x74], xmm0
movupd xmm0, xmmword [ebp + 0x20]
movups xmmword [esp + 0x84], xmm0
cmp eax, esi
jne 0x1001a3d0
mov dword [esp + 0x94], 0
mov dword [esp], edi
call sym._cmsCreateProfilePlaceholder
mov ebx, eax
test eax, eax
je 0x1001a3c0
mov dword [esp], eax
mov dword [esp + 4], 0x61627374
call sym._cmsSetDeviceClass
mov dword [esp + 4], 0x4c616220
mov dword [esp], ebx
call sym._cmsSetColorSpace
mov dword [esp + 4], 0x4c616220
mov dword [esp], ebx
call sym._cmsSetPCS
mov dword [esp + 4], 0
mov dword [esp], ebx
call sym._cmsSetHeaderRenderingIntent
mov dword [esp + 8], 3
mov dword [esp + 4], 3
mov dword [esp], edi
call sym._cmsPipelineAlloc
mov esi, eax
test eax, eax
je 0x1001a3b8
lea eax, [esp + 0x34]
movd xmm1, dword [ebp + 0xc]
mov dword [esp], edi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 3
pshufd xmm0, xmm1, 0
mov dword [esp + 8], 3
mov dword [esp + 4], eax
movups xmmword [esp + 0x34], xmm0
movups xmmword [esp + 0x44], xmm0
movups xmmword [esp + 0x54], xmm0
movd dword [esp + 0x64], xmm1
movd dword [esp + 0x68], xmm1
movd dword [esp + 0x6c], xmm1
call sym._cmsStageAllocCLut16bitGranular
mov edi, eax
test eax, eax
je 0x1001a3b0
lea eax, [esp + 0x74]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], sym._bchswSampler
mov dword [esp], edi
call sym._cmsStageSampleCLut16bit
test eax, eax
je 0x1001a3b0
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp], esi
call sym._cmsPipelineInsertStage
test eax, eax
je 0x1001a3b0
mov edx, str.BCHS_built_in
mov eax, ebx
call sym._SetTextTags
test eax, eax
je 0x1001a3c0
call sym._cmsD50_XYZ
mov dword [esp], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x77747074
call sym._cmsWriteTag
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], 0x41324230
call sym._cmsWriteTag
mov dword [esp], esi
call sym._cmsPipelineFree
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call sym._cmsPipelineFree
mov dword [esp], ebx
call sym._cmsCloseProfile
lea esp, [ebp - 0xc]
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, 0x80000000
pxor xmm0, xmm0
lea ebx, [esp + 0x1c]
mov dword [esp + 0x94], 1
cvtsi2sd xmm0, eax
mov dword [esp], ebx
add esi, 0x80000000
addsd xmm0, qword [0x100466e0]
movsd qword [esp + 4], xmm0
call sym._cmsWhitePointFromTemp
lea eax, [esp + 0x9c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._cmsxyY2XYZ
pxor xmm0, xmm0
mov dword [esp], ebx
cvtsi2sd xmm0, esi
addsd xmm0, qword [0x100466e0]
movsd qword [esp + 4], xmm0
call sym._cmsWhitePointFromTemp
lea eax, [esp + 0xb4]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym._cmsxyY2XYZ
jmp 0x1001a252
Function at 0x1001cfa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
test eax, eax
je 0x1001cfc1
mov edx, dword [ebp + 0xc]
mov dword [eax + 0xc0], edx
mov edx, dword [ebp + 0x10]
mov dword [eax + 0xc4], edx
leave
ret
mov dword [esp + 8], 0x2ee
mov dword [esp + 4], str._home_runner_build_wine_wine_libs_lcms2_src_cmsxform.c
mov dword [esp], str._CMMcargo_____void_0__
call dword [sym.imp.ucrtbase.dll__assert]
nop
Function at 0x10022300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
test eax, eax
je 0x10022418
mov ebx, 0x1000
cmp ecx, 1
je 0x100223e0
mov dword [esp], eax
mov eax, dword [ebp + 8]
mov edx, ebx
mov dword [esp + 4], 0
call sym._AllocateToneCurveStruct
mov edi, eax
test eax, eax
je 0x100223d6
lea eax, [ebx - 1]
pxor xmm3, xmm3
xor esi, esi
cvtsi2sd xmm3, eax
movsd qword [esp + 0xc], xmm3
lea esi, [esi]
mov eax, edi
pxor xmm0, xmm0
cvtsi2sd xmm0, esi
divsd xmm0, qword [esp + 0xc]
call sym._EvalSegmentedFn
pxor xmm2, xmm2
xor edx, edx
mov eax, dword [edi + 0x18]
fstp qword [esp + 0x14]
movsd xmm0, qword [esp + 0x14]
mulsd xmm0, qword [0x100476b8]
addsd xmm0, qword [0x100476a0]
lea eax, [eax + esi*2]
comisd xmm2, xmm0
jae 0x100223cc
comisd xmm0, xmmword [0x100476b8]
mov edx, 0xffffffff
jae 0x100223cc
subsd xmm0, qword [0x100476c0]
addsd xmm0, qword [0x100476c8]
movd edx, xmm0
sar edx, 0x10
add dx, 0x7fff
add esi, 1
mov word [eax], dx
cmp ebx, esi
jne 0x10022360
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [eax + 8], 1
jne 0x10022328
movsd xmm0, qword [eax + 0x10]
mov edx, 2
subsd xmm0, qword [0x10047668]
movsd xmm4, qword [0x100476b0]
andpd xmm0, xmmword [0x10047670]
comisd xmm4, xmm0
cmova ebx, edx
jmp 0x10022328
mov dword [esp + 8], 0x31b
mov dword [esp + 4], str._home_runner_build_wine_wine_libs_lcms2_src_cmsgamma.c
mov dword [esp], str._Segments_____void_0__
call dword [sym.imp.ucrtbase.dll__assert]
lea esi, [esi]
lea edi, [edi]
Function at 0x10022af0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
test eax, eax
je 0x10022b0f
mov dword [esp + 4], eax
mov dword [esp], 0x1000
call sym._cmsReverseToneCurveEx
leave
ret
mov dword [esp + 8], 0x469
mov dword [esp + 4], str._home_runner_build_wine_wine_libs_lcms2_src_cmsgamma.c
mov dword [esp], str._InGamma_____void_0__
call dword [sym.imp.ucrtbase.dll__assert]
lea esi, [esi]

Function at 0x10022b30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff8
sub esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x10022ba5
mov eax, dword [edi + 0x14]
xor esi, esi
test eax, eax
jg 0x10022b5a
jmp 0x10022b98
mov eax, dword [edi + 0x14]
add esi, 1
cmp eax, esi
jle 0x10022b98
pxor xmm0, xmm0
mov edx, dword [edi + 0x18]
cvtsi2sd xmm0, esi
movzx ebx, word [edx + esi*2]
mov dword [esp + 8], eax
movsd qword [esp], xmm0
call sym.__cmsQuantizeVal
movzx eax, ax
sub ebx, eax
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xf
jle 0x10022b50
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], 0x52b
mov dword [esp + 4], str._home_runner_build_wine_wine_libs_lcms2_src_cmsgamma.c
mov dword [esp], str._Curve_____void_0__
call dword [sym.imp.ucrtbase.dll__assert]
lea esi, [esi]
lea edi, [edi]

Function at 0x1002ce30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, edx
and esp, 0xfffffff8
sub esp, 0x24
mov dword [esp], edx
mov dword [esp + 4], 0x7258595a
mov dword [esp + 0x20], eax
call sym._cmsReadTag
mov dword [esp], ebx
mov dword [esp + 4], 0x6758595a
mov esi, eax
call sym._cmsReadTag
mov dword [esp], ebx
mov dword [esp + 4], 0x6258595a
mov edi, eax
call sym._cmsReadTag
test esi, esi
sete cl
test edi, edi
mov ebx, eax
sete al
or cl, al
jne 0x1002cf30
test ebx, ebx
je 0x1002cf30
movsd xmm0, qword [ebx]
mov eax, dword [esp + 0x20]
movsd qword [esp + 0x14], xmm0
movsd xmm1, qword [edi]
movsd qword [esp + 0xc], xmm1
movsd xmm2, qword [esi]
mov dword [esp], eax
movsd qword [esp + 4], xmm2
call sym.__cmsVEC3init
movsd xmm3, qword [ebx + 8]
mov eax, dword [esp + 0x20]
movsd qword [esp + 0x14], xmm3
movsd xmm4, qword [edi + 8]
add eax, 0x18
movsd qword [esp + 0xc], xmm4
movsd xmm5, qword [esi + 8]
mov dword [esp], eax
movsd qword [esp + 4], xmm5
call sym.__cmsVEC3init
movsd xmm6, qword [ebx + 0x10]
mov eax, dword [esp + 0x20]
movsd qword [esp + 0x14], xmm6
movsd xmm7, qword [edi + 0x10]
lea edi, [eax + 0x30]
movsd qword [esp + 0xc], xmm7
movsd xmm0, qword [esi + 0x10]
mov dword [esp], edi
movsd qword [esp + 4], xmm0
call sym.__cmsVEC3init
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1002e7d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x41c
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov edi, dword [eax + 4]
test edi, edi
je 0x1002e8e0
lea eax, [edi - 1]
cmp eax, 6
jbe 0x1002e8e6
mov ecx, edi
movups xmm2, xmmword [0x1004a5b0]
xor eax, eax
lea esi, [esp + 0x1c]
shr ecx, 3
pxor xmm1, xmm1
shl ecx, 4
lea esi, [esi]
movdqu xmm0, xmmword [ebx + eax]
punpcklwd xmm0, xmm1
cvtdq2ps xmm0, xmm0
divps xmm0, xmm2
movups xmmword [esi + eax*2], xmm0
movdqu xmm0, xmmword [ebx + eax]
punpckhwd xmm0, xmm1
cvtdq2ps xmm0, xmm0
divps xmm0, xmm2
movups xmmword [esi + eax*2 + 0x10], xmm0
add eax, 0x10
cmp eax, ecx
jne 0x1002e818
mov ecx, edi
and ecx, 0xfffffff8
test edi, 7
je 0x1002e87c
movss xmm1, dword [0x1004a5c0]
nop
lea esi, [esi]
movzx eax, word [ebx + ecx*2]
pxor xmm0, xmm0
cvtsi2ss xmm0, eax
divss xmm0, xmm1
movss dword [esi + ecx*4], xmm0
add ecx, 1
cmp edi, ecx
ja 0x1002e860
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov edi, esi
mov ebx, dword [eax]
test ebx, ebx
je 0x1002e8be
lea esi, [esi]
mov eax, ecx
xor ecx, 1
mov dword [esp + 8], ebx
mov edi, ecx
shl eax, 9
mov dword [esp + 0x18], ecx
shl edi, 9
add eax, esi
add edi, esi
mov dword [esp], eax
mov dword [esp + 4], edi
call dword [ebx + 0x14]
mov ebx, dword [ebx + 0x24]
mov ecx, dword [esp + 0x18]
test ebx, ebx
jne 0x1002e890
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov ecx, dword [eax + 8]
mov eax, edi
call sym._FromFloatTo16
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esi, [esp + 0x1c]
jmp 0x1002e87c
xor ecx, ecx
lea esi, [esp + 0x1c]
jmp 0x1002e853

Function at 0x1002ede0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x410
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0x410], eax
shl eax, 2
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x40c]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp + 0x10]
mov esi, dword [eax]
test esi, esi
je 0x1002ee78
xor edi, edi
nop
mov eax, edi
xor edi, 1
lea edx, [ebp - 0x40c]
mov dword [esp + 8], esi
mov ebx, edi
shl eax, 9
shl ebx, 9
add eax, edx
add ebx, edx
mov dword [esp], eax
mov dword [esp + 4], ebx
call dword [esi + 0x14]
mov esi, dword [esi + 0x24]
test esi, esi
jne 0x1002ee20
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
mov dword [esp + 4], ebx
shl eax, 2
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._memcpy
add esp, 0x410
pop ebx
pop esi
pop edi
pop ebp
ret
lea ebx, [ebp - 0x40c]
jmp 0x1002ee4c
Function at 0x10036ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, eax
mov ecx, eax
shr edx, 3
shr ecx, 0xd
mov edi, edx
mov edx, eax
and ecx, 1
shr edx, 0xa
mov dword [ebp - 0x14], ecx
mov ecx, eax
and edi, 0xf
mov esi, edx
shr ecx, 0xe
and esi, 1
xor edx, ecx
mov dword [ebp - 0x10], esi
mov esi, eax
shr eax, 0x17
mov ebx, eax
shr esi, 7
and ebx, 1
and esi, 7
setne cl
and eax, ecx
and edx, 1
mov dword [ebp - 0x1c], edx
je 0x10036bc8
test al, al
jne 0x10036c10
imul esi, dword [ebp + 0x14]
add esi, dword [ebp + 0x10]
test edi, edi
je 0x10036bb5
mov eax, dword [ebp - 0x1c]
mov ecx, 1
test eax, eax
setne al
and eax, ebx
mov byte [ebp - 0x15], al
jmp 0x10036b62
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov eax, edi
lea ebx, [ecx - 1]
sub eax, ecx
test edx, edx
cmovne ebx, eax
movzx eax, byte [esi]
mov edx, eax
shl edx, 8
or edx, eax
cmp dword [ebp - 0x14], 0
mov eax, edx
not eax
cmovne edx, eax
cmp byte [ebp - 0x15], 0
movzx eax, dx
je 0x10036ba4
shl eax, 0x10
xor edx, edx
div dword [ebp - 0x1c]
mov edx, 0xffff
cmp eax, 0xffff
cmovbe edx, eax
mov eax, dword [ebp + 0xc]
add esi, dword [ebp + 0x14]
mov word [eax + ebx*2], dx
lea eax, [ecx + 1]
cmp ecx, edi
jne 0x10036b60
mov eax, dword [ebp + 0x10]
add esp, 0x10
pop ebx
pop esi
add eax, 1
pop edi
pop ebp
ret
test al, al
je 0x10036c00
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov edx, 0x80008001
imul eax, edi
movzx eax, byte [esi + eax]
mov ecx, eax
shl ecx, 8
or eax, ecx
movzx ecx, ax
lea eax, [ecx + 0x7fff]
mul edx
shr edx, 0xf
lea eax, [edx + ecx]
mov dword [ebp - 0x1c], eax
jmp 0x10036b47
mov dword [ebp - 0x1c], 1
mov esi, dword [ebp + 0x10]
jmp 0x10036b47
mov eax, dword [ebp + 0x10]
mov edx, 0x80008001
movzx eax, byte [eax]
mov ecx, eax
shl ecx, 8
or eax, ecx
movzx ecx, ax
lea eax, [ecx + 0x7fff]
mul edx
shr edx, 0xf
lea eax, [edx + ecx]
mov dword [ebp - 0x1c], eax
jmp 0x10036b40
Function at 0x10037140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov eax, dword [eax]
mov edi, eax
mov edx, eax
mov ecx, eax
shr edi, 0xb
shr edx, 3
mov esi, edi
mov edi, eax
and edx, 0xf
shr eax, 0xe
shr edi, 0xa
mov dword [ebp - 0x10], edx
and esi, 1
shr ecx, 0xd
mov edx, edi
mov dword [ebp - 0x14], esi
mov esi, edi
and ecx, 1
xor edx, eax
and esi, 1
mov dword [ebp - 0x1c], ecx
lea edi, [ebx + 2]
mov eax, edx
mov dword [ebp - 0x18], esi
and eax, 1
mov dword [ebp - 0x24], eax
je 0x10037258
movzx ecx, byte [ebx]
mov edx, 0x80008001
mov esi, ecx
shl esi, 8
or ecx, esi
movzx ecx, cx
lea esi, [ecx + 0x7fff]
mov eax, esi
mul edx
shr edx, 0xf
lea esi, [edx + ecx]
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x1003724b
mov eax, dword [ebp - 0x10]
xor ecx, ecx
sub eax, 1
mov dword [ebp - 0x20], eax
lea esi, [esi]
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x20]
sub ebx, ecx
test eax, eax
movzx eax, word [edi + ecx*2]
cmove ebx, ecx
cmp dword [ebp - 0x14], 0
mov edx, eax
je 0x100371fc
shl edx, 8
shr eax, 8
or eax, edx
movzx eax, ax
test esi, esi
je 0x10037214
shl eax, 0x10
xor edx, edx
div esi
mov edx, 0xffff
cmp eax, 0xffff
cmova eax, edx
mov edx, eax
cmp dword [ebp - 0x1c], 0
not edx
cmovne eax, edx
mov edx, dword [ebp + 0xc]
add ecx, 1
mov word [edx + ebx*2], ax
cmp dword [ebp - 0x10], ecx
ja 0x100371d8
mov esi, dword [ebp - 0x10]
mov edx, 2
test esi, esi
lea eax, [esi + esi]
cmove eax, edx
mov edx, dword [ebp - 0x24]
add edi, eax
test edx, edx
lea eax, [edi + 2]
cmove edi, eax
add esp, 0x18
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x80008001
movzx ecx, byte [ebx + eax - 1]
mov esi, ecx
shl esi, 8
or ecx, esi
movzx ecx, cx
lea esi, [ecx + 0x7fff]
mov eax, esi
mul edx
mov eax, dword [ebp - 0x10]
shr edx, 0xf
lea esi, [edx + ecx]
test eax, eax
je 0x1003724b
mov edi, ebx
jmp 0x100371c6
Function at 0x10037340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, eax
mov ecx, eax
shr edx, 3
shr ecx, 0xd
and ecx, 1
mov edi, edx
mov edx, eax
shr edx, 0xa
mov dword [ebp - 0x18], ecx
mov ecx, eax
shr eax, 0xe
mov esi, edx
shr ecx, 0xb
xor edx, eax
and edi, 0xf
and esi, 1
and ecx, 1
and edx, 1
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], ecx
je 0x10037430
mov eax, dword [ebp + 0x10]
mov edx, 0x80008001
mov esi, dword [ebp + 0x10]
add esi, dword [ebp + 0x14]
movzx ecx, byte [eax]
mov eax, ecx
shl eax, 8
or ecx, eax
movzx ecx, cx
lea eax, [ecx + 0x7fff]
mul edx
shr edx, 0xf
lea eax, [edx + ecx]
mov dword [ebp - 0x10], eax
mov ecx, 1
test edi, edi
jne 0x100373c2
jmp 0x1003741f
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, edi
lea ebx, [ecx - 1]
sub eax, ecx
test edx, edx
cmovne ebx, eax
movzx eax, word [esi]
cmp dword [ebp - 0x1c], 0
mov edx, eax
je 0x100373e7
shl edx, 8
shr eax, 8
or eax, edx
movzx eax, ax
mov edx, dword [ebp - 0x10]
test edx, edx
je 0x10037403
shl eax, 0x10
xor edx, edx
div dword [ebp - 0x10]
mov edx, 0xffff
cmp eax, 0xffff
cmova eax, edx
mov edx, eax
cmp dword [ebp - 0x18], 0
not edx
cmovne eax, edx
mov edx, dword [ebp + 0xc]
add esi, dword [ebp + 0x14]
mov word [edx + ebx*2], ax
lea eax, [ecx + 1]
cmp edi, ecx
jne 0x100373c0
mov eax, dword [ebp + 0x10]
add esp, 0x10
pop ebx
pop esi
add eax, 2
pop edi
pop ebp
ret
lea eax, [edi - 1]
mov esi, dword [ebp + 0x10]
mov edx, 0x80008001
imul eax, dword [ebp + 0x14]
movzx ecx, byte [esi + eax]
mov eax, ecx
shl eax, 8
or ecx, eax
movzx ecx, cx
lea eax, [ecx + 0x7fff]
mul edx
shr edx, 0xf
lea eax, [edx + ecx]
mov dword [ebp - 0x10], eax
jmp 0x100373b5
Function at 0x10037970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 4]
mov eax, ebx
mov edx, ebx
mov ecx, ebx
shr eax, 0xa
shr edx, 0xd
mov esi, eax
and edx, 1
shr ecx, 3
and esi, 1
mov dword [ebp - 0x14], edx
mov edx, ebx
and ecx, 0xf
mov dword [ebp - 0x10], esi
mov esi, ebx
shr edx, 0xe
shr ebx, 0x17
shr esi, 7
xor edx, eax
and ebx, 1
and esi, 7
setne al
and eax, ebx
and edx, 1
mov dword [ebp - 0x18], edx
je 0x10037a50
mov dword [ebp - 0x18], 0
mov edi, esi
test al, al
jne 0x10037a90
mov esi, dword [ebp + 0x14]
imul esi, edi
add esi, dword [ebp + 0x10]
mov edx, 1
test ecx, ecx
jne 0x100379f2
jmp 0x10037a3f
mov edx, eax
mov edi, ecx
lea eax, [edx - 1]
sub edi, edx
cmp dword [ebp - 0x10], 0
cmovne eax, edi
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 0x14], 0
movzx eax, word [edi + eax*2]
mov edi, eax
not edi
cmovne eax, edi
movzx eax, ax
test ebx, ebx
je 0x10037a25
imul eax, dword [ebp - 0x18]
add eax, 0x8000
shr eax, 0x10
imul eax, eax, 0xff01
add eax, 0x800000
shr eax, 0x18
mov byte [esi], al
add esi, dword [ebp + 0x14]
lea eax, [edx + 1]
cmp edx, ecx
jne 0x100379f0
mov eax, dword [ebp + 0x10]
add esp, 0xc
pop ebx
pop esi
add eax, 1
pop edi
pop ebp
ret
mov esi, dword [ebp + 0x10]
test al, al
je 0x100379df
mov eax, dword [ebp + 0x14]
mov edx, 0x80008001
imul eax, ecx
movzx eax, byte [esi + eax]
mov esi, eax
shl esi, 8
or eax, esi
movzx esi, ax
lea eax, [esi + 0x7fff]
mul edx
shr edx, 0xf
lea eax, [edx + esi]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
jmp 0x100379df
mov eax, dword [ebp + 0x10]
mov edx, 0x80008001
movzx eax, byte [eax]
mov esi, eax
shl esi, 8
or eax, esi
movzx esi, ax
lea eax, [esi + 0x7fff]
mul edx
shr edx, 0xf
lea eax, [edx + esi]
mov dword [ebp - 0x18], eax
jmp 0x100379d6
Function at 0x10037ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov edx, eax
mov ecx, eax
mov esi, eax
shr edx, 0xa
shr ecx, 3
mov ebx, edx
shr esi, 7
and ecx, 0xf
and ebx, 1
mov dword [ebp - 0x10], ebx
mov ebx, eax
shr ebx, 0xd
and ebx, 1
mov dword [ebp - 0x14], ebx
mov ebx, eax
shr ebx, 0xe
xor edx, ebx
mov ebx, eax
shr eax, 0xb
shr ebx, 0x17
and eax, 1
and ebx, 1
and esi, 7
mov dword [ebp - 0x18], eax
setne al
and eax, ebx
and edx, 1
mov dword [ebp - 0x1c], edx
je 0x10037ba8
mov dword [ebp - 0x1c], 0
mov edi, esi
test al, al
jne 0x10037bd8
mov esi, dword [ebp + 0x14]
imul esi, edi
add esi, dword [ebp + 0x10]
mov edx, 1
test ecx, ecx
jne 0x10037b4a
jmp 0x10037b97
mov edx, eax
mov edi, ecx
lea eax, [edx - 1]
sub edi, edx
cmp dword [ebp - 0x10], 0
cmovne eax, edi
mov edi, dword [ebp + 0xc]
movzx eax, word [edi + eax*2]
mov edi, eax
rol di, 8
cmp dword [ebp - 0x18], 0
cmovne eax, edi
cmp dword [ebp - 0x14], 0
mov edi, eax
not edi
cmovne eax, edi
test ebx, ebx
je 0x10037b8a
movzx eax, ax
imul eax, dword [ebp - 0x1c]
add eax, 0x8000
shr eax, 0x10
mov word [esi], ax
add esi, dword [ebp + 0x14]
lea eax, [edx + 1]
cmp edx, ecx
jne 0x10037b48
mov eax, dword [ebp + 0x10]
add esp, 0x10
pop ebx
pop esi
add eax, 2
pop edi
pop ebp
ret
mov esi, dword [ebp + 0x10]
test al, al
je 0x10037b3a
mov eax, dword [ebp + 0x14]
mov edx, 0x80008001
imul eax, ecx
movzx edi, word [esi + eax*2]
lea eax, [edi + 0x7fff]
mul edx
shr edx, 0xf
lea eax, [edx + edi]
mov dword [ebp - 0x1c], eax
jmp 0x10037b3a
mov eax, dword [ebp + 0x10]
mov edx, 0x80008001
movzx esi, word [eax]
lea eax, [esi + 0x7fff]
mul edx
shr edx, 0xf
lea eax, [edx + esi]
mov dword [ebp - 0x1c], eax
jmp 0x10037b31