joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10279740
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x103aad05
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x10
push esi
push edi
mov eax, dword [0x1049b0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], 0x1054b024
mov dword [ebp - 4], 0
push 0x24
mov dword [ebp - 0x14], 0
call fcn.102fe3a6
mov ecx, dword [ebx + 0xc]
xorps xmm0, xmm0
add esp, 4
mov dword [ebp - 0x14], eax
lea esi, [eax + 8]
mov edx, dword [ecx]
mov ecx, edx
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x102797c0
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.10037550
mov eax, dword [ebx + 0x10]
mov eax, dword [eax]
mov dword [esi + 0x18], eax
mov dword [ebp - 4], 1
mov edx, esi
cmp dword [esi + 0x14], 0xf
jbe 0x102797eb
mov edx, dword [esi]
xor ecx, ecx
mov edi, 0x811c9dc5
cmp dword [esi + 0x10], ecx
jbe 0x10279809
movzx eax, byte [edx + ecx]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, dword [esi + 0x10]
jb 0x102797f7
push edi
push esi
lea eax, [ebp - 0x20]
mov ecx, 0x1054b020
push eax
call fcn.1015b6d0
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x1027986c
mov eax, dword [ebx + 8]
mov edi, dword [ebp - 0x14]
mov dword [eax], ecx
mov byte [eax + 4], 0
test edi, edi
je 0x10279906
mov eax, dword [esi + 0x14]
cmp eax, 0xf
jbe 0x10279848
push eax
push dword [esi]
push esi
call fcn.10034640
add esp, 0xc
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
push 0x24
push edi
call fcn.102fe83e
mov eax, dword [ebx + 8]
add esp, 8
jmp 0x10279906
mov eax, dword [0x1054b028]
cmp eax, 0x71c71c7
je 0x1027991c
inc eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1046f8a0]
mov eax, dword [0x1054b03c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1046f8a0]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [0x1054b020]
seta al
test al, al
je 0x102798e8
mov ecx, 0x1054b020
call fcn.1015b260
mov esi, dword [ebp - 0x14]
mov ecx, 0x1054b020
push edi
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1015b6d0
mov ecx, dword [eax]
jmp 0x102798ee
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x14]
push esi
push ecx
push edi
mov ecx, 0x1054b020
call fcn.1015b2e0
mov ecx, dword [ebx + 8]
mov dword [ecx], eax
mov eax, ecx
mov byte [ecx + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
push str.unordered_map_set_too_long
call fcn.102fca7f
int3
Function at 0x1027b110
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x103aae03
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1049b0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx + 4]
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp + 8]
push eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
call fcn.1007eb10
mov eax, dword [0x105446e0]
test al, 1
jne 0x1027b28e
or eax, 1
mov dword [0x105446e0], eax
mov dword [ebp - 4], 0
mov ebx, dword [0x1053ebb8]
cmp ebx, dword [0x1053ebbc]
je 0x1027b1c4
nop dword [eax]
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1027b1b9
mov esi, dword [eax + 0xc]
mov edi, 0x811c9dc5
xor ecx, ecx
inc ecx
cmp byte [esi + ecx], 0
jne 0x1027b193
xor edx, edx
test ecx, ecx
je 0x1027b1b9
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1027b1a0
cmp edi, 0x54aff69
je 0x1027b1d0
add ebx, 4
cmp ebx, dword [0x1053ebbc]
jne 0x1027b180
xor eax, eax
mov dword [0x10544900], eax
jmp 0x1027b293
mov eax, dword [ebp - 0x10]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
cmp dword [eax + 4], ebx
jle 0x1027b278
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
nop dword [eax]
mov edi, dword [eax]
add edi, ecx
mov ecx, dword [edi + 0x28]
test ecx, ecx
je 0x1027b221
cmp dword [ecx + 4], 0
jle 0x1027b221
push 0
mov edx, 0xa3316f9
call fcn.10238b60
add esp, 4
test eax, eax
je 0x1027b21e
mov ecx, dword [edi + 0x2c]
add ecx, eax
add ebx, ecx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x10]
mov esi, dword [edi]
mov ebx, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [esi + ecx], 0
jne 0x1027b230
xor edx, edx
test ecx, ecx
je 0x1027b25c
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x1027b240
cmp ebx, 0xa3316f9
je 0x1027b281
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc edx
mov ebx, dword [ebp - 0x14]
add ecx, 0x3c
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
cmp edx, dword [eax + 4]
jl 0x1027b1f0
mov eax, ebx
mov dword [0x10544900], eax
jmp 0x1027b293
mov eax, dword [edi + 0x2c]
add eax, dword [ebp - 0x14]
mov dword [0x10544900], eax
jmp 0x1027b293
mov eax, dword [0x10544900]
mov ecx, dword [ebp - 0x24]
movss xmm0, dword [ebp - 0x20]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp + 8]
movss dword [eax + ecx], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1029a570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x78]
test eax, eax
je 0x1029a595
push dword [edi + 0x74]
call eax
add esp, 4
push ebx
push esi
mov esi, dword [edi + 0x54]
test esi, esi
je 0x1029a5fb
nop
mov ebx, dword [esi + 4]
xor edx, edx
mov eax, dword [ebx + 0x60]
mov eax, dword [eax + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x1029a5f4
mov ecx, dword [eax + 8]
cmp eax, esi
je 0x1029a5c7
mov edx, eax
mov eax, ecx
test eax, eax
jne 0x1029a5b6
jmp 0x1029a5f4
test edx, edx
jne 0x1029a5d0
mov dword [ebx + 0x54], ecx
jmp 0x1029a5d3
mov dword [edx + 8], ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1029a5e0
push esi
call eax
add esp, 4
push esi
call fcn.1029aaf0
mov eax, dword [esp + 0x20]
push esi
push eax
mov eax, dword [eax + 8]
call eax
add esp, 0xc
mov esi, dword [edi + 0x54]
test esi, esi
jne 0x1029a5a0
lea eax, [edi + 0x6c]
test eax, eax
je 0x1029a67e
test ebp, ebp
je 0x1029a67e
mov ebx, dword [eax]
test ebx, ebx
je 0x1029a671
nop dword [eax]
mov esi, dword [ebx + 8]
mov eax, dword [ebx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 8]
test eax, eax
je 0x1029a627
push esi
call eax
add esp, 4
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x1029a63b
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x28]
test eax, eax
je 0x1029a64c
push eax
mov eax, dword [ebp + 8]
push ebp
call eax
add esp, 8
mov dword [esi + 0x28], 0
mov eax, dword [ebp + 8]
push esi
push ebp
call eax
mov eax, dword [ebp + 8]
push ebx
push ebp
call eax
mov eax, dword [esp + 0x2c]
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x1029a610
lea eax, [edi + 0x6c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [edi + 0x30]
mov dword [edi + 0x58], 0
test eax, eax
je 0x1029a692
push edi
call eax
add esp, 4
push ebp
push edi
call fcn.1029a4f0
mov eax, dword [esp + 0x18]
add esp, 8
mov eax, dword [eax + 0x34]
test eax, eax
je 0x1029a6ad
push edi
call eax
add esp, 4
mov esi, dword [edi + 0x68]
mov eax, dword [edi + 8]
mov dword [esp + 0x20], eax
test esi, esi
je 0x1029a6df
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0x1c]
test eax, eax
je 0x1029a6cb
push esi
call eax
add esp, 4
test dword [esp + 0x20], 0x400
jne 0x1029a6df
mov eax, dword [ebx + 8]
push esi
push ebx
call eax
add esp, 8
mov eax, dword [edi + 0x80]
mov dword [edi + 0x68], 0
pop esi
pop ebx
test eax, eax
je 0x1029a706
push eax
mov eax, dword [ebp + 8]
push ebp
call eax
add esp, 8
mov dword [edi + 0x80], 0
mov eax, dword [ebp + 8]
push edi
push ebp
call eax
add esp, 8
pop edi
pop ebp
pop ecx
ret
Function at 0x102ed340
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x103ab9b6
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1049b0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ebx, dword [ebp + 8]
lea edi, [esi + 0x2c]
mov dword [ebp + 8], edi
mov eax, dword [ebx]
mov dword [esi], eax
movzx eax, byte [ebx + 4]
mov byte [esi + 4], al
movzx eax, byte [ebx + 5]
mov byte [esi + 5], al
movzx eax, byte [ebx + 6]
mov byte [esi + 6], al
movzx eax, byte [ebx + 7]
mov byte [esi + 7], al
movzx eax, byte [ebx + 8]
mov byte [esi + 8], al
movzx eax, byte [ebx + 9]
mov byte [esi + 9], al
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x14]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x24]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
movzx eax, byte [ebx + 0x28]
mov byte [esi + 0x28], al
movzx eax, byte [ebx + 0x29]
mov byte [esi + 0x29], al
movzx eax, byte [ebx + 0x2a]
mov byte [esi + 0x2a], al
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov eax, dword [ebx + 0x30]
sub eax, dword [ebx + 0x2c]
je 0x102ed42b
cmp eax, 0x7fffffff
ja 0x102ed4e1
push eax
mov ecx, edi
call fcn.102edc90
mov esi, dword [ebx + 0x30]
mov eax, dword [ebx + 0x2c]
sub esi, eax
mov edi, dword [edi]
push esi
push eax
push edi
call fcn.1034c3a0
mov ecx, dword [ebp + 8]
lea eax, [esi + edi]
mov esi, dword [ebp - 0x10]
add esp, 0xc
mov dword [ecx + 4], eax
lea eax, [esi + 0x38]
mov dword [ebp - 4], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x38]
sar edi, 2
mov dword [ebp + 8], eax
test edi, edi
je 0x102ed49f
cmp edi, 0x3fffffff
ja 0x102ed4e6
push edi
mov ecx, eax
call fcn.102ede60
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov dword [ecx + 4], eax
lea eax, [eax + edi*4]
mov dword [ecx + 8], eax
mov esi, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x38]
sub esi, eax
mov edi, dword [ecx]
push esi
push eax
push edi
call fcn.1034c3a0
mov ecx, dword [ebp + 8]
add esp, 0xc
sar esi, 2
lea eax, [edi + esi*4]
mov esi, dword [ebp - 0x10]
mov dword [ecx + 4], eax
lea eax, [ebx + 0x44]
mov byte [ebp - 4], 1
lea ecx, [esi + 0x44]
push eax
call fcn.10050c50
lea eax, [ebx + 0x5c]
mov byte [ebp - 4], 2
push eax
lea ecx, [esi + 0x5c]
call fcn.10050c50
mov eax, dword [ebx + 0x74]
mov dword [esi + 0x74], eax
mov eax, dword [ebx + 0x78]
mov dword [esi + 0x78], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.10033d60
call fcn.10033d60
int3
Function at 0x102ed9b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [esi], eax
movzx eax, byte [edi + 4]
mov byte [esi + 4], al
movzx eax, byte [edi + 5]
mov byte [esi + 5], al
movzx eax, byte [edi + 6]
mov byte [esi + 6], al
movzx eax, byte [edi + 7]
mov byte [esi + 7], al
movzx eax, byte [edi + 8]
mov byte [esi + 8], al
movzx eax, byte [edi + 9]
mov byte [esi + 9], al
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ecx
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ecx
mov eax, dword [edi + 0x20]
mov ecx, dword [edi + 0x24]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
lea ecx, [esi + 0x2c]
movzx eax, byte [edi + 0x28]
mov byte [esi + 0x28], al
movzx eax, byte [edi + 0x29]
mov byte [esi + 0x29], al
movzx eax, byte [edi + 0x2a]
mov byte [esi + 0x2a], al
lea eax, [edi + 0x2c]
push eax
call fcn.102ed850
lea eax, [edi + 0x38]
lea ecx, [esi + 0x38]
cmp ecx, eax
je 0x102eda48
mov edx, dword [eax]
mov eax, dword [eax + 4]
sub eax, edx
sar eax, 2
push eax
push edx
call fcn.102ec3d0
lea eax, [edi + 0x44]
lea ecx, [esi + 0x44]
cmp ecx, eax
je 0x102eda64
cmp dword [eax + 0x14], 0x10
mov edx, dword [eax + 0x10]
jb 0x102eda5d
mov eax, dword [eax]
push edx
push eax
call fcn.100523a0
lea eax, [edi + 0x5c]
lea ecx, [esi + 0x5c]
cmp ecx, eax
je 0x102eda80
cmp dword [eax + 0x14], 0x10
mov edx, dword [eax + 0x10]
jb 0x102eda79
mov eax, dword [eax]
push edx
push eax
call fcn.100523a0
mov eax, dword [edi + 0x74]
mov dword [esi + 0x74], eax
mov eax, dword [edi + 0x78]
mov dword [esi + 0x78], eax
mov eax, esi
pop edi
pop esi
pop ebp
ret 4
Function at 0x102f1810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
push edi
mov edi, ecx
mov eax, dword [esi]
mov dword [edi], eax
movzx eax, byte [esi + 4]
mov byte [edi + 4], al
movzx eax, byte [esi + 5]
mov byte [edi + 5], al
movzx eax, byte [esi + 6]
mov byte [edi + 6], al
movzx eax, byte [esi + 7]
mov byte [edi + 7], al
movzx eax, byte [esi + 8]
mov byte [edi + 8], al
movzx eax, byte [esi + 9]
mov byte [edi + 9], al
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ecx
movzx eax, byte [esi + 0x28]
mov byte [edi + 0x28], al
movzx eax, byte [esi + 0x29]
mov byte [edi + 0x29], al
movzx eax, byte [esi + 0x2a]
mov byte [edi + 0x2a], al
mov edx, dword [esi + 0x34]
mov ecx, dword [esi + 0x30]
mov eax, dword [esi + 0x2c]
mov dword [esi + 0x34], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0
mov dword [edi + 0x2c], eax
mov dword [edi + 0x30], ecx
mov dword [edi + 0x34], edx
mov eax, dword [esi + 0x38]
mov edx, dword [esi + 0x40]
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], 0
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], ecx
mov dword [edi + 0x40], edx
movups xmmword [edi + 0x44], xmm0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
movups xmm0, xmmword [esi + 0x44]
movups xmmword [edi + 0x44], xmm0
movq xmm0, qword [esi + 0x54]
movq qword [edi + 0x54], xmm0
xorps xmm0, xmm0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0xf
mov byte [esi + 0x44], 0
movups xmmword [edi + 0x5c], xmm0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
movups xmm0, xmmword [esi + 0x5c]
movups xmmword [edi + 0x5c], xmm0
movq xmm0, qword [esi + 0x6c]
movq qword [edi + 0x6c], xmm0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0xf
mov byte [esi + 0x5c], 0
mov eax, dword [esi + 0x74]
mov dword [edi + 0x74], eax
mov eax, dword [esi + 0x78]
mov dword [edi + 0x78], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x102f6a20
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov al, byte [esi + 0xc]
lea edx, [edi + 0x430]
mov dword [ebp - 0xc], edx
test al, 3
je 0x102f6a5a
movzx eax, al
and eax, 3
mov ecx, dword [eax*8 + 0x103da258]
or dword [edx], ecx
mov eax, dword [eax*8 + 0x103da25c]
or dword [edx + 4], eax
jmp 0x102f6a5d
mov dword [ebp - 0xc], edx
mov al, byte [esi + 0xc]
test al, 0xc
je 0x102f6a80
movzx ecx, al
shr ecx, 2
and ecx, 3
mov eax, dword [ecx*8 + 0x103da278]
or dword [edx], eax
mov eax, dword [ecx*8 + 0x103da27c]
or dword [edx + 4], eax
mov al, byte [esi + 0xc]
test al, 0x30
je 0x102f6aa3
movzx ecx, al
shr ecx, 4
and ecx, 3
mov eax, dword [ecx*8 + 0x103da298]
or dword [edx], eax
mov eax, dword [ecx*8 + 0x103da29c]
or dword [edx + 4], eax
mov eax, dword [edi + 0xc]
jmp dword [eax*4 + 0x102f6e24]

Function at 0x102fdf5e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x102fdf85
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x102fdf88
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.102fdf3a
pop esi
leave
ret 8
Function at 0x103060e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x14]
mov eax, esi
sub eax, ebx
push edi
mov edi, dword [esp + 0x1c]
sub eax, 0x40
push edi
sar eax, 2
push eax
push ebx
call fcn.10305810
mov ecx, eax
add esp, 0xc
test ecx, ecx
jne 0x10306197
lea ebp, [ebx + 0x40]
sub esi, 4
cmp esi, ebp
jbe case.0x10306168.17
mov eax, dword [esi]
mov ecx, eax
shr ecx, 8
movzx edx, al
movzx ebx, cl
mov cx, word [edx*2 + 0x1044c8d0]
and cx, 7
cmp cx, 2
jne 0x1030614f
cmp edi, ebx
jb 0x10306112
cmp edx, 0x2a
jne case.0x10306168.17
shr eax, 0x10
cmp edi, eax
ja 0x10306112
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp cx, 1
jne 0x10306112
cmp ebx, edi
jne 0x10306112
add edx, 0xfffffff0
cmp edx, 0x27
ja case.0x10306168.17
movzx ecx, byte [edx + 0x10306274]
jmp dword [ecx*4 + 0x10306260]
mov ecx, dword [esp + 0x14]
mov edi, eax
mov eax, esi
shr edi, 0x10
sub eax, ecx
sub eax, 0x40
push edi
sar eax, 2
push eax
push ecx
call fcn.10305810
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x10306112
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov eax, str.local
pop ebx
ret
mov ecx, dword [esp + 0x14]
shr eax, 0x10
not eax
pop edi
mov ecx, dword [ecx + 0x10]
pop esi
pop ebp
pop ebx
mov ecx, dword [ecx + eax*4]
mov eax, dword [esp + 0x10]
add ecx, 0x10
mov dword [eax], ecx
mov eax, str.global
ret
mov ecx, eax
shr ecx, 0x10
movzx edx, cl
mov ecx, dword [esp + 0x14]
not edx
mov ecx, dword [ecx + 0x10]
mov edx, dword [ecx + edx*4]
mov ecx, dword [esp + 0x20]
add edx, 0x10
mov dword [ecx], edx
mov ecx, dword [esi - 4]
cmp cl, 0x10
jne 0x10306212
shr ecx, 8
movzx edx, cl
lea ecx, [ebx + 1]
cmp edx, ecx
jne 0x10306212
shr eax, 8
xor eax, dword [esi - 4]
test eax, 0xffff0000
jne 0x10306212
pop edi
pop esi
pop ebp
mov eax, str.method
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, str.field
pop ebx
ret
mov ecx, dword [esp + 0x14]
shr eax, 0x10
mov edx, dword [ecx + 0x38]
test edx, edx
jne 0x1030623f
mov eax, dword [esp + 0x20]
mov edx, 0x10459698
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov eax, str.upvalue
pop ebx
ret
test eax, eax
je 0x1030624f
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x10306243
sub eax, 1
jne 0x10306243
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov eax, str.upvalue
pop ebx
ret
Function at 0x1030f7b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov cl, byte [ebp + 0x81]
mov eax, dword [ebp + 0x210]
mov dl, cl
mov bl, byte [ebp + 0x82]
and dl, 0xc
neg dl
mov byte [esp + 0xb], bl
sbb dl, dl
and dl, 4
neg eax
sbb al, al
and cl, 3
and al, 0xe
shl cl, 3
or dl, al
mov al, byte [ebp + 0x1e0]
or dl, cl
and al, 1
or dl, al
cmp bl, dl
je 0x1030fa15
mov al, dl
mov byte [ebp + 0x82], dl
and al, 3
lea ebx, [ebp + 0xb10]
push esi
push edi
cmp al, 1
jne 0x1030f84a
movzx ecx, word [0x1044ca9e]
movzx esi, word [0x1044caa4]
add ecx, section..text
movzx edi, word [0x1044caaa]
add esi, section..text
movzx eax, word [0x1044cab2]
add edi, section..text
movzx ebp, word [0x1044cab8]
jmp 0x1030f86a
mov ecx, dword [ebx + 0x39c]
mov esi, dword [ebx + 0x3a8]
mov edi, dword [ebx + 0x3b4]
movzx eax, word [0x1044cab4]
movzx ebp, word [0x1044caba]
lea eax, [eax + section..text]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x14], eax
lea ebp, [ebp + section..text]
mov dh, dl
mov dword [esp + 0x18], ebp
xor dh, byte [esp + 0x13]
mov al, dl
and al, 6
mov dword [ebx + 0x398], ecx
mov dword [ebx + 0x3a4], esi
mov dword [ebx + 0x3b0], edi
test dh, 6
je 0x1030f905
mov edi, ebx
test al, al
jne 0x1030f8ec
lea esi, [ebx + 0x26c]
mov ecx, 0x55
rep movsd dword es:[edi], dword [esi]
test dl, 0x10
je 0x1030f97a
mov dword [ebx + 0x114], 0x10003e9a
mov dword [ebx + 0x118], 0x10003e9a
mov dword [ebx + 0x11c], 0x10003e9a
mov dword [ebx + 0x120], 0x10003e9a
jmp 0x1030f97a
test dl, 2
mov ecx, 0x10003e7f
mov eax, 0x10003ea7
cmovne eax, ecx
mov ecx, 0x55
rep stosd dword es:[edi], eax
jmp 0x1030f97a
test al, al
jne 0x1030f97a
mov dword [ebx + 0x12c], ecx
mov dword [ebx + 0x138], esi
mov dword [ebx + 0x144], edi
test dl, 0x10
je 0x1030f94a
mov dword [ebx + 0x114], 0x10003e9a
mov dword [ebx + 0x118], 0x10003e9a
mov dword [ebx + 0x11c], 0x10003e9a
mov dword [ebx + 0x120], 0x10003e9a
jmp 0x1030f97a
mov eax, dword [ebx + 0x380]
mov dword [ebx + 0x114], eax
mov eax, dword [ebx + 0x384]
mov dword [ebx + 0x118], eax
mov eax, dword [ebx + 0x388]
mov dword [ebx + 0x11c], eax
mov eax, dword [ebx + 0x38c]
mov dword [ebx + 0x120], eax
mov ebp, dword [esp + 0x20]
test dh, 8
je 0x1030f9cb
lea edi, [ebx + 0x154]
test dl, 8
jne 0x1030f9bf
mov ecx, 0xaa
nop dword [eax]
nop word [eax + eax]
movzx eax, word [ecx + 0x1044ca08]
lea edi, [edi + 4]
add eax, section..text
add ecx, 2
mov dword [edi - 4], eax
cmp ecx, 0x136
jb 0x1030f9a0
jmp 0x1030f9cb
mov ecx, 0x46
mov eax, 0x10003f24
rep stosd dword es:[edi], eax
test dl, 8
jne 0x1030f9e4
mov eax, dword [esp + 0x14]
mov dword [ebx + 0x154], eax
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x160], eax
test dl, 1
je 0x1030fa13
test byte [esp + 0x13], 1
jne 0x1030fa13
mov ax, word [ebp + 0x758]
lea edi, [ebp + 0xa90]
add ax, ax
mov ecx, 0x20
dec ax
movzx eax, ax
mov edx, eax
shl edx, 0x10
or eax, edx
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x103161c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
movzx eax, byte [ebp + 0x24]
lea edx, [eax*4 + 0x14]
call fcn.10312960
mov esi, eax
lea ecx, [ebp + 0x40]
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 8], ecx
mov word [esi + 5], 8
mov byte [esi + 7], 0
movzx ecx, byte [ebp + 0x25]
add ecx, 0x20
mov eax, ecx
shr eax, 3
and al, 0x20
sub cl, al
mov al, byte [ebp + 0x24]
mov byte [ebp + 0x25], cl
mov byte [esp + 0x18], al
movzx ecx, al
test al, al
je 0x10316271
push ebx
lea ebx, [esi + 0x14]
mov esi, ecx
mov ecx, dword [esp + 0x18]
mov edx, 0x18
call fcn.10312960
lea ebx, [ebx + 4]
lea ecx, [eax + 8]
mov word [eax + 5], 0x105
mov dword [eax + 0x10], ecx
mov dword [eax + 0xc], 0xffffffff
mov ecx, dword [ebp + 0x14]
movzx edx, word [ecx + edi*2]
inc edi
mov ecx, edx
shl edx, 0x18
shr ecx, 0xe
xor edx, ebp
and cl, 1
mov dword [eax + 0x14], edx
mov byte [eax + 7], cl
mov dword [ebx - 4], eax
cmp edi, esi
jb 0x10316222
mov esi, dword [esp + 0x10]
mov al, byte [esp + 0x1c]
pop ebx
mov byte [esi + 7], al
mov eax, esi
pop edi
pop esi
pop ebp
pop ecx
ret