joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d1e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102639da
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
push 0
mov dword [ebp - 0x10], esi
call fcn.101dc585
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
test eax, eax
jne 0x1001d28f
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.101f7351
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x103fa258
push eax
call fcn.101f94fb
push eax
push esi
call fcn.101dc8cd
mov ecx, dword [ebp - 0xc]
add esp, 8
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10021730
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10263e36
push eax
mov dword fs:[0], esp
push esi
push edi
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.101f594f
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.101dc7ca
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov ecx, dword [ebp - 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100359f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
push ebx
push esi
mov ebx, ecx
mov dword [esp + 8], 0x45555254
push edi
mov edi, edx
mov dword [esp + 0x10], 0x49534956
push edi
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x18], 0x582d4e4f
mov dword [esp + 0x1c], 0x454c4946
mov word [esp + 0x20], 0x2e
call eax
mov ecx, dword [ebx + 8]
mov esi, eax
push 2
push 0
push edi
call ecx
mov ecx, dword [ebx + 0xc]
push edi
call ecx
add eax, 0xffffffee
push 0
add eax, esi
push eax
mov eax, dword [ebx + 8]
push edi
call eax
push edi
push 0x12
push 1
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ebx]
call eax
mov eax, dword [ebx + 8]
push 0
push esi
push edi
call eax
lea edx, [esp + 0xc]
mov esi, 0xe
lea eax, [esp + 0x20]
nop dword [eax + eax]
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x10035a95
add edx, 4
add eax, 4
sub esi, 4
jae 0x10035a70
mov cx, word [edx]
cmp cx, word [eax]
jne 0x10035a95
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x28
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x28
ret
Function at 0x10037ef0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov bx, dx
push edi
push esi
mov ebp, ecx
call sym.FreeImage.dll__FreeImage_GetPalette_4
mov edi, eax
movzx eax, bx
cmp eax, 1
jbe 0x10038059
cmp eax, 3
jne 0x10038115
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
push 0x140
push ebp
call fcn.101448b0
mov cl, byte [esp + 0x3c]
mov eax, 1
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x30]
mov edx, ebp
shl eax, cl
push ebx
push esi
mov ecx, eax
mov dword [esp + 0x2c], eax
call fcn.10037c70
add esp, 0x1c
cmp ax, 0x10
jne 0x10038006
mov eax, dword [esp + 0x10]
add eax, 0xffffffff
mov dword [esp + 0x10], eax
js 0x10038115
lea edi, [edi + eax*4]
sub ebp, esi
lea ecx, [esi + eax*2]
inc edi
sub ebx, esi
mov esi, ecx
nop dword [eax + eax]
movzx eax, word [esi + ebp]
lea esi, [esi - 2]
imul ecx, eax, 0xff
lea edi, [edi - 4]
mov eax, 0x80008001
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [edi + 5], al
movzx eax, word [esi + 2]
imul ecx, eax, 0xff
mov eax, 0x80008001
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [edi + 4], al
movzx eax, word [ebx + esi + 2]
imul ecx, eax, 0xff
mov eax, 0x80008001
imul ecx
add edx, ecx
sar edx, 0xf
mov eax, edx
shr eax, 0x1f
add eax, edx
sub dword [esp + 0x10], 1
mov byte [edi + 3], al
jns 0x10037f90
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov esi, dword [esp + 0x10]
sub esi, 1
js 0x10038115
mov eax, dword [esp + 0x14]
lea edx, [esi*4 + 1]
add edx, edi
sub ebp, eax
sub ebx, eax
lea ecx, [eax + esi*2]
nop word [eax + eax]
sub esi, 1
movzx eax, byte [ecx + ebp]
mov byte [edx + 1], al
lea ecx, [ecx - 2]
movzx eax, byte [ecx + 2]
lea edx, [edx - 4]
mov byte [edx + 4], al
movzx eax, byte [ecx + ebx + 2]
mov byte [edx + 3], al
jns 0x10038030
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, dword [esp + 0x28]
cmp ax, 1
jne 0x1003809b
test bx, bx
jne 0x10038080
mov word [edi + 4], bx
mov byte [edi + 6], bl
mov word [edi], 0xffff
mov byte [edi + 2], 0xff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov word [edi], 0
mov byte [edi + 2], 0
mov word [edi + 4], 0xffff
mov byte [edi + 6], 0xff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
cmp ax, 4
je 0x100380a7
cmp ax, 8
jne 0x10038115
push esi
call sym.FreeImage.dll__FreeImage_GetColorsUsed_4
mov esi, eax
cmp bx, 1
jne 0x100380eb
test esi, esi
jle 0x10038115
mov eax, 0xff
lea ecx, [esi - 1]
cdq
xor ebx, ebx
idiv ecx
lea ecx, [edi + 2]
nop dword [eax]
mov byte [ecx - 2], bl
lea ecx, [ecx + 4]
mov byte [ecx - 5], bl
mov byte [ecx - 4], bl
add ebx, eax
sub esi, 1
jne 0x100380d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
test esi, esi
jle 0x10038115
mov eax, 0xffffff01
lea ecx, [esi - 1]
cdq
idiv ecx
lea edx, [edi + 2]
mov ecx, 0xff
mov byte [edx - 2], cl
lea edx, [edx + 4]
mov byte [edx - 5], cl
mov byte [edx - 4], cl
add ecx, eax
sub esi, 1
jne 0x10038102
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x10040910
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push esi
push dword [esp + 0x28]
mov esi, ecx
push 1
push 0x1a
push eax
mov eax, dword [esp + 0x34]
mov eax, dword [eax]
call eax
test eax, eax
je 0x10040a06
movzx ecx, byte [esp + 4]
movzx eax, byte [esp + 5]
mov edx, dword [esp + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 6]
shl ecx, 8
or ecx, eax
movzx eax, dl
shl ecx, 8
or ecx, eax
cmp ecx, 0x38425053
jne 0x10040a06
movzx eax, byte [esp + 9]
movzx ecx, dh
shl ecx, 8
or ecx, eax
cmp ecx, 1
jne 0x10040a06
movzx ecx, byte [esp + 0x10]
movzx eax, byte [esp + 0x11]
movzx edx, byte [esp + 0x12]
shl edx, 8
shl ecx, 8
or ecx, eax
movzx eax, byte [esp + 0x13]
or edx, eax
mov word [esi], cx
movzx eax, byte [esp + 0x14]
mov ecx, dword [esp + 0x15]
shl edx, 8
or edx, eax
movzx eax, cl
shl edx, 8
or edx, eax
movzx eax, byte [esp + 0x17]
mov dword [esi + 4], edx
movzx edx, ch
mov ecx, dword [esp + 0x19]
shl edx, 8
or edx, eax
movzx eax, byte [esp + 0x18]
shl edx, 8
or edx, eax
movzx eax, cl
movzx ecx, ch
shl edx, 8
or edx, eax
shl ecx, 8
movzx eax, byte [esp + 0x1b]
or ecx, eax
mov dword [esi + 8], edx
movzx eax, byte [esp + 0x1d]
mov word [esi + 0xc], cx
movzx ecx, byte [esp + 0x1c]
shl ecx, 8
or ecx, eax
mov al, 1
mov word [esi + 0xe], cx
pop esi
add esp, 0x1c
ret 8
xor al, al
pop esi
add esp, 0x1c
ret 8

Function at 0x10043860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
xor ebx, ebx
push edi
xor edi, edi
test ebp, ebp
jle 0x100438cb
push esi
mov esi, dword [esp + 0x18]
movzx eax, byte [esi]
test edi, edi
je 0x10043881
and eax, 0xf
inc esi
jmp 0x10043884
shr eax, 4
mov ecx, dword [esp + 0x20]
xor edi, 1
movzx edx, byte [ecx + eax*4 + 2]
lea ecx, [ecx + eax*4]
mov eax, 0xfff8
and dx, ax
movzx eax, byte [ecx + 1]
shl dx, 5
or dx, ax
mov eax, 0xfff8
and dx, ax
mov al, byte [ecx]
shr al, 3
shl dx, 2
movzx eax, al
or dx, ax
mov eax, dword [esp + 0x14]
mov word [eax + ebx*2], dx
inc ebx
cmp ebx, ebp
jl 0x10043874
pop esi
pop edi
pop ebp
pop ebx
ret 0x10

Function at 0x10044410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
xor esi, esi
test ebx, ebx
jle 0x10044489
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
add eax, 2
push edi
mov edi, dword [esp + 0x1c]
nop dword [eax]
movzx ecx, byte [edx]
test esi, esi
je 0x10044458
and ecx, 0xf
movzx ecx, byte [edi + ecx*4]
mov byte [eax - 2], cl
movzx ecx, byte [edx]
and ecx, 0xf
movzx ecx, byte [edi + ecx*4 + 1]
mov byte [eax - 1], cl
movzx ecx, byte [edx]
and ecx, 0xf
inc edx
jmp 0x10044476
shr ecx, 4
movzx ecx, byte [edi + ecx*4]
mov byte [eax - 2], cl
movzx ecx, byte [edx]
shr ecx, 4
movzx ecx, byte [edi + ecx*4 + 1]
mov byte [eax - 1], cl
movzx ecx, byte [edx]
shr ecx, 4
movzx ecx, byte [edi + ecx*4 + 2]
xor esi, 1
mov byte [eax], cl
add eax, 3
sub ebx, 1
jne 0x10044430
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x10044b70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
xor esi, esi
test ebx, ebx
jle 0x10044bed
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
add eax, 2
push edi
mov edi, dword [esp + 0x1c]
nop dword [eax]
movzx ecx, byte [edx]
test esi, esi
je 0x10044bb8
and ecx, 0xf
movzx ecx, byte [edi + ecx*4]
mov byte [eax - 2], cl
movzx ecx, byte [edx]
and ecx, 0xf
movzx ecx, byte [edi + ecx*4 + 1]
mov byte [eax - 1], cl
movzx ecx, byte [edx]
and ecx, 0xf
inc edx
jmp 0x10044bd6
shr ecx, 4
movzx ecx, byte [edi + ecx*4]
mov byte [eax - 2], cl
movzx ecx, byte [edx]
shr ecx, 4
movzx ecx, byte [edi + ecx*4 + 1]
mov byte [eax - 1], cl
movzx ecx, byte [edx]
shr ecx, 4
movzx ecx, byte [edi + ecx*4 + 2]
xor esi, 1
mov byte [eax], cl
mov byte [eax + 1], 0xff
add eax, 4
sub ebx, 1
jne 0x10044b90
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x10044e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
xor esi, esi
test ebx, ebx
jle 0x10044f38
push ebp
mov ebp, dword [esp + 0x18]
lea eax, [ecx + 2]
push edi
mov edi, dword [esp + 0x18]
nop dword [eax]
movzx ecx, byte [edx]
test esi, esi
je 0x10044ee7
and ecx, 0xf
movzx ecx, byte [edi + ecx*4]
mov byte [eax - 2], cl
movzx ecx, byte [edx]
and ecx, 0xf
movzx ecx, byte [edi + ecx*4 + 1]
mov byte [eax - 1], cl
movzx ecx, byte [edx]
and ecx, 0xf
movzx ecx, byte [edi + ecx*4 + 2]
mov byte [eax], cl
movzx ecx, byte [edx]
and ecx, 0xf
cmp ecx, dword [esp + 0x20]
jge 0x10044edf
movzx ecx, byte [ecx + ebp]
inc edx
jmp 0x10044f24
mov ecx, 0xff
inc edx
jmp 0x10044f24
shr ecx, 4
movzx ecx, byte [edi + ecx*4]
mov byte [eax - 2], cl
movzx ecx, byte [edx]
shr ecx, 4
movzx ecx, byte [edi + ecx*4 + 1]
mov byte [eax - 1], cl
movzx ecx, byte [edx]
shr ecx, 4
cmp dword [esp + 0x20], 0
movzx ecx, byte [edi + ecx*4 + 2]
mov byte [eax], cl
jle 0x10044f1f
movzx ecx, byte [edx]
shr ecx, 4
movzx ecx, byte [ecx + ebp]
jmp 0x10044f24
mov ecx, 0xff
mov byte [eax + 1], cl
xor esi, 1
add eax, 4
sub ebx, 1
jne 0x10044ea0
pop edi
pop ebp
pop esi
pop ebx
ret

Function at 0x100455c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
xor edx, edx
push esi
mov esi, 1
test ebx, ebx
jle 0x1004566a
movss xmm2, dword [0x103d7a64]
movss xmm3, dword [0x103d7abc]
movss xmm4, dword [0x103d7a34]
movss xmm5, dword [0x103d7aa8]
push ebp
mov ebp, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x14]
nop
mov eax, dword [esp + 0x18]
movzx ecx, byte [edx + eax]
movzx eax, byte [ebp + ecx*4 + 2]
movd xmm1, eax
movzx eax, byte [ebp + ecx*4 + 1]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movzx eax, byte [ebp + ecx*4]
mulss xmm1, xmm2
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm3
addss xmm1, xmm0
movd xmm0, eax
mov eax, edx
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm4
addss xmm1, xmm0
addss xmm1, xmm5
cvttss2si ecx, xmm1
test esi, esi
je 0x10045658
and cl, 0xf0
sar eax, 1
mov byte [eax + edi], cl
jmp 0x10045660
sar eax, 1
shr cl, 4
or byte [eax + edi], cl
inc edx
xor esi, 1
cmp edx, ebx
jl 0x10045600
pop edi
pop ebp
pop esi
pop ebx
ret 0x10
Function at 0x1004a680
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
xor eax, eax
push edi
mov edi, ecx
test esi, esi
jle 0x1004a6ad
nop
mov ecx, edi
add eax, eax
xor ecx, edx
sar edi, 1
and ecx, 1
dec esi
or ecx, eax
mov eax, edx
add ecx, ecx
sar edx, 1
and eax, 1
or eax, ecx
test esi, esi
jg 0x1004a690
pop edi
pop esi
ret

Function at 0x10052be0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push edi
mov edi, ecx
cmp dword [edi + 0x44], 0
jne 0x10052c8e
cmp dword [edi + 0x28], 0x20
jbe 0x10052c8e
mov eax, dword [edi + 0x24]
push ebx
lea ebx, [edi + 0x24]
push ebp
mov eax, dword [eax + 4]
push esi
push 0
mov ebp, dword [eax + 8]
imul eax, dword [ebp], 0xfff8
push eax
push dword [edi]
call fcn.10201185
push dword [edi]
push 1
push 0xfff8
push dword [ebp + 8]
call fcn.102013d8
push dword [ebp + 8]
call fcn.101f5a18
mov dword [ebp + 8], 0
lea esi, [edi + 0x2c]
mov eax, dword [ebx]
add esp, 0x20
mov ecx, dword [esi]
mov eax, dword [eax + 4]
mov ecx, dword [ecx]
cmp eax, dword [ebx]
je 0x10052c67
mov edx, dword [eax]
cmp esi, ebx
jne 0x10052c5b
cmp ecx, eax
je 0x10052c67
cmp ecx, edx
je 0x10052c67
push ecx
push edx
push eax
push ebx
push ecx
mov ecx, esi
call fcn.10053540
mov eax, dword [ebp]
lea ecx, [edi + 0x34]
mov esi, dword [esi]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
mov esi, dword [esi]
push eax
call fcn.10053830
mov eax, dword [esp + 0x14]
mov dword [eax + 0x14], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 0xc
ret

Function at 0x10052d80
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x40], 0
jne 0x10052e5d
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [edi + 0x34]
call fcn.10053110
mov esi, dword [esp + 0xc]
cmp esi, dword [edi + 0x34]
je 0x10052e5d
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 8]
mov dword [edi + 0x40], eax
cmp dword [eax + 8], 0
jne 0x10052e4a
push ebp
push 0xfff8
call fcn.101f5a1d
mov ecx, dword [edi + 0x40]
push 0
mov dword [ecx + 8], eax
mov eax, dword [edi + 0x40]
imul eax, dword [eax], 0xfff8
push eax
push dword [edi]
call fcn.10201185
push dword [edi]
mov eax, dword [edi + 0x40]
push 1
push 0xfff8
push dword [eax + 8]
call fcn.102015fc
mov ecx, dword [edi + 0x24]
lea ebp, [edi + 0x24]
mov eax, dword [esi + 0x14]
add esp, 0x20
lea esi, [edi + 0x2c]
mov ecx, dword [ecx]
cmp eax, dword [esi]
je 0x10052e2b
mov edx, dword [eax]
cmp ebp, esi
jne 0x10052e1f
cmp ecx, eax
je 0x10052e2b
cmp ecx, edx
je 0x10052e2b
push ecx
push edx
push eax
push esi
push ecx
mov ecx, ebp
call fcn.10053540
mov esi, dword [ebp]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x14]
push eax
mov esi, dword [esi]
lea ecx, [edi + 0x34]
call fcn.10053830
mov eax, dword [esp + 0x10]
pop ebp
mov dword [eax + 0x14], esi
mov ecx, edi
call fcn.10052be0
mov eax, dword [edi + 0x40]
pop edi
pop esi
pop ebx
add esp, 8
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 4
Function at 0x1006c630
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x34
mov eax, dword [esp + 0x3c]
movss xmm2, dword [0x103d7af4]
dec eax
movaps xmm1, xmm2
mov dword [esp + 0x14], ecx
push esi
push edi
movd xmm0, eax
mov esi, edx
cvtdq2ps xmm0, xmm0
push ecx
mov dword [esp + 0x24], esi
mov dword [esp + 0x34], eax
divss xmm1, xmm0
mulss xmm1, xmm1
divss xmm2, xmm1
movss dword [esp + 0x30], xmm2
call sym.FreeImage.dll__FreeImage_GetPitch_4
mov edi, eax
push esi
shr edi, 2
call sym.FreeImage.dll__FreeImage_GetPitch_4
push dword [esp + 0x40]
mov esi, eax
shr esi, 2
call sym.FreeImage.dll__FreeImage_GetPitch_4
push dword [esp + 0x1c]
shr eax, 2
mov dword [esp + 0x28], eax
call sym.FreeImage.dll__FreeImage_GetBits_4
push dword [esp + 0x20]
lea ecx, [edi*4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x1c], ecx
lea edi, [ecx + eax]
lea eax, [esi*4]
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], eax
call sym.FreeImage.dll__FreeImage_GetBits_4
push dword [esp + 0x40]
mov esi, eax
mov eax, dword [esp + 0x28]
add esi, dword [esp + 0x3c]
shl eax, 2
mov dword [esp + 0x2c], eax
call sym.FreeImage.dll__FreeImage_GetBits_4
add eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x24], eax
cmp ecx, 1
jle 0x1006c7b5
movss xmm2, dword [0x103d8790]
dec ecx
movss xmm3, dword [0x103d7ee8]
movss xmm4, dword [esp + 0x2c]
mov dword [esp + 0x20], ecx
nop
mov edx, dword [esp + 0x38]
lea ecx, [edi + 4]
sub eax, dword [esp + 0x34]
add edx, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x30]
lea edi, [edx + 4]
mov dword [esp + 0x14], ecx
mov edx, esi
sub edx, dword [esp + 0x38]
add edx, 4
dec eax
mov dword [esp + 0x2c], eax
nop
movss xmm1, dword [edx]
lea eax, [esi + 4]
addss xmm1, dword [edi]
movss xmm0, dword [eax]
add edx, 4
mulss xmm0, xmm3
add edi, 4
addss xmm1, dword [esi + 8]
addss xmm1, dword [esi]
mov esi, dword [esp + 0x10]
subss xmm1, xmm0
mulss xmm1, xmm4
xorps xmm1, xmm2
movss dword [ecx], xmm1
movss xmm0, dword [esi + ecx]
mov esi, eax
addss xmm0, xmm1
movss dword [ecx], xmm0
add ecx, 4
sub dword [esp + 0x2c], 1
jne 0x1006c740
mov edi, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
add edi, dword [esp + 0x18]
add eax, dword [esp + 0x28]
sub dword [esp + 0x20], 1
mov esi, dword [esp + 0xc]
mov dword [esp + 0x34], edi
mov dword [esp + 0x24], eax
jne 0x1006c710
mov esi, dword [esp + 0x1c]
push esi
call sym.FreeImage.dll__FreeImage_GetPitch_4
push eax
push 0
push 0
push esi
call sym.FreeImage.dll__FreeImage_GetScanLine_8
push eax
call fcn.101f9320
add esp, 0xc
push esi
call sym.FreeImage.dll__FreeImage_GetPitch_4
push eax
push 0
push dword [esp + 0x38]
push esi
call sym.FreeImage.dll__FreeImage_GetScanLine_8
push eax
call fcn.101f9320
mov ecx, dword [esp + 0x50]
add esp, 0xc
mov eax, dword [esp + 8]
lea edx, [ecx - 1]
lea edx, [eax + edx*4]
test ecx, ecx
jle 0x1006c824
mov esi, dword [esp + 0x18]
sub edx, eax
nop word [eax + eax]
mov dword [eax], 0
mov dword [edx + eax], 0
add eax, esi
sub ecx, 1
jne 0x1006c810
pop edi
pop esi
add esp, 0x34
ret
Function at 0x1006e7b0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x1006e7e2
push esi
call fcn.10075490
add esp, 4
cmp byte [esi + 0x40], 0
je 0x1006e7db
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
pop ebp
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
push edi
cmp eax, 0xcb
jne 0x1006e86e
mov eax, dword [esi + 0x1a0]
cmp byte [eax + 0x10], 0
je 0x1006e858
nop dword [eax]
mov eax, dword [esi + 8]
test eax, eax
je 0x1006e80f
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a0]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x1006e852
cmp eax, 2
je 0x1006e858
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1006e800
cmp eax, 3
je 0x1006e837
cmp eax, 1
jne 0x1006e800
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x1006e800
mov eax, dword [esi + 0x120]
add eax, edi
mov dword [edx + 8], eax
jmp 0x1006e800
pop edi
xor al, al
pop esi
pop ebp
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.1006e8a0
add esp, 4
pop edi
pop esi
pop ebp
ret
cmp eax, 0xcc
je 0x1006e890
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.1006e8a0
add esp, 4
pop edi
pop esi
pop ebp
ret

Function at 0x1006e8a0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x14], 0xcc
je 0x1006e8ce
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x190]
cmp byte [eax + 8], 0
je 0x1006e952
lea ebx, [esi + 0x78]
nop dword [eax]
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x1006e926
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1006e905
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x194]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x1006e969
cmp eax, dword [esi + 0x60]
jb 0x1006e8e7
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x190]
cmp byte [eax + 8], 0
jne 0x1006e8e0
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret
Function at 0x10088a10
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x4c], 1
mov esi, dword [edi + 0x1b8]
mov dword [ebp - 0x18], esi
jne 0x10088a36
mov eax, 0x1fe
mov byte [esi + 0x1c], 1
jmp 0x10088a3b
xor eax, eax
mov byte [esi + 0x1c], al
push dword [edi + 0x64]
mov ecx, dword [edi + 4]
mov dword [ebp - 4], eax
add eax, 0x100
push eax
push 1
mov eax, dword [ecx + 8]
push edi
call eax
xor ebx, ebx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
mov dword [ebp - 8], ebx
cmp dword [edi + 0x64], ebx
jle 0x10088b49
nop dword [eax]
mov ecx, dword [esi + ebx*4 + 0x20]
cdq
idiv ecx
cmp dword [ebp - 4], 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
je 0x10088a8d
mov eax, dword [esi + 0x18]
add dword [eax + ebx*4], 0xff
mov eax, dword [esi + 0x18]
mov edi, dword [eax + ebx*4]
lea eax, [ecx + 0xfe]
lea ecx, [ecx*2 - 2]
cdq
idiv ecx
xor ebx, ebx
mov dword [ebp - 0x14], edi
mov edx, eax
xor esi, esi
nop dword [eax]
cmp esi, edx
jle 0x10088ae5
mov ecx, dword [ebp - 0x10]
imul eax, ebx, 0x1fe
lea edi, [ecx*2 - 2]
add ecx, 0xfe
add ecx, eax
nop dword [eax]
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x10088ad0
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
movzx eax, bl
movzx ecx, cl
imul ecx, eax
mov byte [esi + edi], cl
inc esi
cmp esi, 0xff
jle 0x10088ab0
cmp dword [ebp - 4], 0
je 0x10088b30
mov ecx, 1
lea edx, [edi - 1]
nop dword [eax + eax]
movzx eax, byte [edi]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [edi + 0xff]
mov byte [edi + ecx + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x10088b10
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 8], ebx
cmp ebx, dword [eax + 0x64]
mov eax, dword [ebp - 0xc]
jl 0x10088a70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret