joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10255740
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov eax, edx
mov dword [esp + 0xc], ecx
push esi
mov dword [esp + 0x14], eax
test eax, eax
mov eax, dword [esp + 0x1c]
push edi
jne 0x102557ed
test eax, eax
jle 0x1025588d
mov ebp, dword [esp + 0x24]
dec eax
mov esi, dword [esp + 0x2c]
mov edi, ebp
mov ebx, dword [esp + 0x28]
sub edi, esi
shr eax, 4
inc eax
mov dword [esp + 0x10], eax
mov edi, edi
mov ecx, dword [esp + 0x14]
xor edx, edx
movdqu xmm2, xmmword [ebx]
push esi
push ebx
call fcn.10254c20
lea eax, [ebp + 0xf]
add esp, 8
cmp esi, eax
ja 0x102557c0
lea eax, [esi + 0xf]
cmp eax, ebp
jb 0x102557c0
mov ecx, esi
mov edx, 0x10
lea esp, [esp]
mov al, byte [edi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
dec edx
jne 0x102557b0
jmp 0x102557d1
movdqu xmm1, xmmword [ebp]
movdqu xmm0, xmmword [esi]
pxor xmm1, xmm0
movdqu xmmword [esi], xmm1
add esi, 0x10
add ebx, 0x10
sub edi, 0x10
dec dword [esp + 0x10]
movdqu xmmword [ebp], xmm2
jne 0x10255780
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
test eax, eax
jle 0x1025588d
mov ecx, dword [esp + 0x24]
lea edx, [eax - 1]
mov edi, dword [esp + 0x28]
mov ebp, ecx
mov esi, dword [esp + 0x2c]
sub ebp, edi
shr edx, 4
inc edx
mov dword [esp + 0x10], edx
lea eax, [edi + 0xf]
cmp esi, eax
ja 0x1025581e
lea eax, [esi + 0xf]
cmp eax, edi
jae 0x1025582c
lea eax, [ecx + 0xf]
cmp esi, eax
ja 0x10255850
lea eax, [esi + 0xf]
cmp eax, ecx
jb 0x10255850
mov ebx, esi
mov eax, edi
sub ebx, edi
mov edx, 0x10
mov cl, byte [eax + ebp]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [ebx + eax - 1], cl
dec edx
jne 0x10255837
jmp 0x10255860
movdqu xmm1, xmmword [ecx]
movdqu xmm0, xmmword [edi]
pxor xmm1, xmm0
movdqu xmmword [esi], xmm1
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push esi
call fcn.10254c20
movdqu xmm0, xmmword [esi]
mov ecx, dword [esp + 0x2c]
add esp, 8
add edi, 0x10
sub ebp, 0x10
add esi, 0x10
dec dword [esp + 0x10]
movdqu xmmword [ecx], xmm0
jne 0x10255810
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x10256ac0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov ebx, ecx
push edi
mov edi, edx
test ebp, ebp
je 0x10256b1c
sub dword [esp + 0x10], edi
push esi
mov esi, dword [ebx]
lea edi, [edi + 1]
mov ecx, dword [ebx + 4]
inc esi
and esi, 0xff
movzx edx, byte [esi + ebx + 8]
add ecx, edx
and ecx, 0xff
movzx eax, byte [ecx + ebx + 8]
mov dword [ebx + 4], ecx
mov dword [ebx], esi
mov byte [ecx + ebx + 8], dl
mov ecx, dword [esp + 0x14]
mov byte [esi + ebx + 8], al
add eax, edx
and eax, 0xff
mov al, byte [eax + ebx + 8]
xor al, byte [ecx + edi - 1]
mov byte [edi - 1], al
dec ebp
jne 0x10256ad4
pop esi
pop edi
pop ebp
pop ebx
ret
Function at 0x10260100
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [eax]
mov ebp, edx
movzx eax, byte [eax + 3]
mov esi, ecx
mov ebx, eax
mov dword [esp + 0x10], ecx
shr ebx, 7
add ebx, eax
je 0x102601bd
or edi, 0xff000000
cmp ebx, 0x100
jne 0x10260148
test ebp, ebp
je 0x102601bd
mov eax, edi
mov ecx, ebp
mov edi, esi
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov edx, edi
shr edi, 8
and edx, 0xff00ff
and edi, 0xff00ff
mov dword [esp + 0x18], edx
test ebp, ebp
je 0x102601bd
mov esi, dword [esi]
mov ecx, esi
and ecx, 0xffff00ff
and esi, 0xff00ff00
shl ecx, 8
mov eax, ecx
shr eax, 8
sub edx, eax
mov eax, esi
imul edx, ebx
shr eax, 8
add edx, ecx
mov ecx, edi
sub ecx, eax
shr edx, 8
imul ecx, ebx
mov eax, esi
shr eax, 8
add ecx, esi
xor edx, ecx
mov ecx, edi
sub ecx, eax
and edx, 0xff00ff
imul ecx, ebx
add ecx, esi
mov esi, dword [esp + 0x10]
xor edx, ecx
mov dword [esi], edx
add esi, 4
mov edx, dword [esp + 0x18]
mov dword [esp + 0x10], esi
dec ebp
jne 0x10260161
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x102642e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, edx
push edi
mov edx, dword [esi + 0x54]
movss xmm0, dword [esi + 0x58]
mov dword [esi + 0x64], 1
mov dword [esi + 0x6c], 0
movss dword [esi + 0x70], xmm0
comiss xmm0, dword [edx]
jb 0x10264340
mov ebx, dword [esi + 0x5c]
mov edi, 1
xor ecx, ecx
movss xmm0, dword [esi + 0x70]
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [esi + 0x64], edi
subss xmm0, dword [edx + ecx*4]
inc ecx
mov dword [esi + 0x6c], ecx
movss dword [esi + 0x70], xmm0
cmp ecx, ebx
jne 0x1026433a
xor ecx, ecx
mov dword [esi + 0x6c], ecx
comiss xmm0, dword [edx + ecx*4]
jae 0x10264312
cmp dword [esi + 0x64], 0
mov eax, dword [esp + 0x18]
mov dword [esi + 0x74], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x78], eax
je 0x10264391
push dword [esp + 0x14]
mov edx, dword [esi + 0x68]
mov ecx, esi
call fcn.10263b80
mov ecx, dword [esp + 0x1c]
add esp, 4
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x68], ebp
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x38], 1
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1026e810
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, edx
mov edx, ecx
movzx eax, byte [ebp + 1]
lea ecx, [ebp + 1]
push esi
push edi
movzx ebx, byte [ebp]
shl ebx, 8
or ebx, eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebx
mov ebx, 0
mov dword [esp + 0x14], edx
jle 0x1026e579
mov edi, edi
movzx edi, byte [ecx + 1]
add ecx, 2
shl edi, 8
mov dword [esp + 0x20], ecx
movzx eax, byte [ecx]
mov ecx, dword [edx + 0x10]
or edi, eax
add edi, ebp
test ecx, ecx
je 0x1026e56e
movzx ebp, byte [ecx]
lea eax, [ecx + 1]
movzx ecx, byte [eax]
mov esi, 0
shl ebp, 8
or ebp, ecx
jle 0x1026e56a
movzx edx, byte [eax + 1]
lea eax, [eax + 2]
movzx ecx, byte [eax]
shl edx, 8
or edx, ecx
cmp ebx, edx
je 0x1026e55b
inc esi
cmp esi, ebp
jl 0x1026e541
jmp 0x1026e566
mov ecx, dword [esp + 0x14]
mov edx, edi
call fcn.1026e3f0
mov edx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
inc ebx
cmp ebx, dword [esp + 0x1c]
jl 0x1026e510
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
sub esp, 0xc
push ebx
mov ebx, edx
push ebp
push esi
push edi
movzx eax, byte [ebx + 1]
mov edi, ecx
movzx ecx, byte [ebx]
movzx edx, byte [ebx + 4]
movzx ebp, byte [ebx + 6]
shl ecx, 8
or ecx, eax
shl edx, 8
movzx eax, byte [ebx + 2]
shl ecx, 8
or ecx, eax
shl ebp, 8
movzx eax, byte [ebx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebx + 5]
or edx, eax
movzx eax, byte [ebx + 7]
or ebp, eax
mov dword [esp + 0x14], edx
movzx eax, byte [ebx + 9]
mov dword [esp + 0x18], ebp
movzx ebp, byte [ebx + 8]
shl ebp, 8
or ebp, eax
cmp ecx, 0x10000
je 0x1026e8a6
movd xmm0, ecx
sub esp, 8
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x10588910]
movsd qword [esp], xmm0
push str.GSUB_Version___.1f__is_not_1.0
push 0x118
push str...mupdf_sourcepdfpdf_ft_tools.c
push dword [edi + 0x18]
call fcn.101df520
mov edx, dword [esp + 0x2c]
add esp, 0x18
add edx, ebx
mov ecx, edi
call fcn.1026e6c0
mov edx, dword [esp + 0x18]
mov ecx, edi
lea edx, [edx + ebx]
call fcn.1026e590
mov eax, dword [edi + 0x14]
test eax, eax
je 0x1026e8c7
mov dword [edi + 0x10], eax
lea edx, [ebx + ebp]
mov ecx, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
jmp 0x1026e4e0
Function at 0x10284510
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0xca
jne 0x10284561
mov eax, dword [esi + 4]
push 0x1c
push 1
push esi
mov eax, dword [eax]
call eax
add esp, 0xc
mov dword [esi + 0x190], eax
mov ecx, esi
mov dword [eax], 0x102bbe30
mov dword [eax + 4], 0x102bbf90
mov byte [eax + 8], 0
call fcn.102bbc50
cmp byte [esi + 0x40], 0
je 0x1028455a
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
push edi
cmp eax, 0xcb
jne 0x102845e1
mov eax, dword [esi + 0x1a0]
cmp byte [eax + 0x10], 0
je 0x102845cf
mov eax, dword [esi + 8]
test eax, eax
je 0x10284587
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a0]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x102845ca
cmp eax, 2
je 0x102845cf
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10284578
cmp eax, 3
je 0x102845af
cmp eax, 1
jne 0x10284578
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x10284578
mov eax, dword [esi + 0x120]
add eax, edi
mov dword [edx + 8], eax
jmp 0x10284578
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov ecx, esi
pop edi
mov dword [esi + 0x84], eax
pop esi
jmp 0x10284610
cmp eax, 0xcc
je 0x10284603
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
pop edi
mov ecx, esi
pop esi
jmp 0x10284610
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x14], 0xcc
je 0x1028463a
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x190]
cmp byte [eax + 8], 0
je 0x102846c2
lea ebx, [esi + 0x78]
lea esp, [esp]
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x10284696
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10284675
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x194]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x102846d8
cmp eax, dword [esi + 0x60]
jb 0x10284657
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x190]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x190]
cmp byte [eax + 8], 0
jne 0x10284650
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x1028c460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x38
mov eax, dword [0x105be7d0]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
mov ebx, ecx
mov dword [esp + 0xc], edx
push ebp
push esi
push edi
mov eax, dword [ebx + 0x4c]
mov edi, dword [ebx]
mov esi, dword [eax + 0xb9c]
test esi, esi
jne 0x1028c51f
mov dword [eax + 0xba0], fcn.100caf80
xor ebp, ebp
mov eax, dword [edi + 4]
push 0x1f8
push edi
call eax
mov esi, eax
add esp, 8
test esi, esi
jne 0x1028c4b0
lea ebp, [eax + 0x40]
jmp 0x1028c4c0
push 0x1f8
push 0
push esi
call sub.MSVCR120.dll_memset
add esp, 0xc
mov eax, dword [ebx + 0x4c]
mov dword [eax + 0xb9c], esi
test ebp, ebp
je 0x1028c4e5
mov eax, 0x40
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.1033d458
add esp, 0x38
ret
mov eax, dword [ebx + 0x4c]
xorps xmm0, xmm0
mov edx, dword [esp + 0x18]
mov esi, dword [eax + 0xb9c]
mov dword [esi], edi
lea eax, [esi + 4]
movdqu xmmword [esi + 0x64], xmm0
movdqu xmmword [esi + 0x74], xmm0
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], eax
mov dword [esi + 0x64], 0x1028c1d0
mov dword [esi + 0x68], 0x1028c1f0
mov dword [esi + 0x70], 0x1028c270
mov dword [esi + 0x84], ebx
xorps xmm0, xmm0
mov dword [esi + 0x80], ebx
mov ecx, ebx
mov eax, dword [ebx + 4]
movdqu xmmword [esp + 0x1c], xmm0
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], edx
mov edi, dword [eax + 0x60]
mov eax, dword [esp + 0x4c]
add eax, edx
movq qword [esp + 0x3c], xmm0
mov dword [esp + 0x24], eax
lea edx, [esp + 0x2c]
lea eax, [esp + 0x17]
push eax
lea eax, [esp + 0x1a]
push eax
lea eax, [esp + 0x40]
push eax
movdqu xmmword [esp + 0x38], xmm0
call fcn.1028c3f0
xor eax, eax
add esp, 0xc
cmp byte [esp + 0x16], al
mov ecx, 1
cmovne eax, ecx
mov cl, byte [esp + 0x17]
mov dword [esi + 8], eax
test cl, cl
je 0x1028c598
cmp byte [edi + 0x20], 0
jne 0x1028c598
or dword [esi + 8], 2
mov eax, dword [edi + 0x24]
mov dword [esi + 0x90], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x94], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x98], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x9c], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0xa0], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0xa4], eax
mov eax, dword [edi + 0x3c]
mov dword [esi + 0xa8], eax
mov eax, dword [edi + 0x40]
mov dword [esi + 0xac], eax
mov eax, dword [ebx + 4]
movzx edx, word [eax + 0x44]
mov dword [esi + 0x58], edx
test cl, cl
je 0x1028c5fb
lea ecx, [esp + 0x2c]
call fcn.1028c140
test eax, eax
jne 0x1028c64c
lea eax, [esp + 0x18]
mov ecx, esi
push eax
lea eax, [esp + 0x30]
push eax
lea edx, [esp + 0x24]
call fcn.1028c000
add esp, 8
test eax, eax
je 0x1028c62f
mov eax, 3
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.1033d458
add esp, 0x38
ret
mov eax, dword [esp + 0x18]
add eax, 0x8000
shr eax, 0x10
movsx ecx, ax
mov eax, dword [esi + 0x80]
mov dword [eax + 0x2e8], ecx
xor eax, eax
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1033d458
add esp, 0x38
ret
Function at 0x10295f10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, edx
mov dword [esp + 8], ecx
mov edx, dword [esp + 0x18]
push ebx
mov ebx, dword [ecx]
mov dword [esp + 4], ebx
push esi
movzx esi, word [edx]
cmp ebx, eax
jb 0x10295f34
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 0x1c]
sub eax, ebx
cmp edx, eax
push edi
cmova edx, eax
xor edi, edi
test edx, edx
je 0x10295f81
mov edi, dword [esp + 0x1c]
push ebp
mov ebp, ebx
mov ebx, edx
sub ebp, edi
movzx eax, byte [edi + ebp]
lea edi, [edi + 1]
mov ecx, esi
shr ecx, 8
xor ecx, eax
add eax, esi
imul eax, eax, 0x3193
mov esi, 0x58bf
mov byte [edi - 1], cl
sub esi, eax
and esi, 0xffff
dec ebx
jne 0x10295f51
mov ebx, dword [esp + 0x10]
mov edi, edx
pop ebp
mov eax, dword [esp + 0x24]
lea ecx, [ebx + edx]
mov edx, dword [esp + 0x14]
mov dword [edx], ecx
mov word [eax], si
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x1029e1b0
Capabilities:
Enumerate pe sections

Disassembly:
mov edx, dword [esp + 4]
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
mov ecx, dword [eax + 0x44]
lea eax, [edx + 0xc]
cmp eax, ecx
jbe 0x1029e1da
mov eax, dword [esi]
push 1
push eax
mov dword [eax + 0x4c], 8
call dword [sym.imp.MSVCR120.dll_longjmp]
movzx eax, byte [edx + 2]
shl ax, 8
movzx ecx, ax
movzx eax, byte [edx + 3]
or ecx, eax
movzx eax, byte [edx + 4]
shl ax, 8
push ebx
push ebp
movzx ebp, ax
movzx eax, byte [edx + 5]
or ebp, eax
add ecx, dword [esp + 0x18]
movzx eax, byte [edx + 6]
shl ax, 8
movzx ebx, ax
movzx eax, byte [edx + 7]
or ebx, eax
movzx eax, byte [edx + 8]
shl ax, 8
push edi
movzx edi, ax
movzx eax, byte [edx + 9]
add edx, 0xc
or edi, eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
dec edx
mov dword [esp + 0x10], edx
push 0xffffffffffffffff
movzx eax, byte [eax - 2]
shl ax, 8
movzx eax, ax
mov dword [esp + 0x24], eax
movzx eax, byte [edx]
mov edx, esi
or dword [esp + 0x24], eax
call fcn.1029d180
mov ecx, dword [esp + 0x20]
add esp, 4
mov edx, esi
lea ecx, [ecx + ebp]
call fcn.1029d420
mov ebp, dword [esp + 0x1c]
mov edx, esi
lea ecx, [ebx + ebp]
call fcn.1029d420
lea ecx, [edi + ebp]
mov edx, esi
call fcn.1029d420
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
lea ecx, [eax + ebx*2]
mov eax, dword [esi]
cmp ecx, dword [eax + 0x44]
jbe 0x1029e2a1
mov eax, dword [esi]
push 1
push eax
mov dword [eax + 0x4c], 8
call dword [sym.imp.MSVCR120.dll_longjmp]
inc dword [esi + 0x14]
mov eax, dword [esi + 0x14]
mov edi, dword [esi + eax*4 + 0x18]
mov eax, dword [esi + 0xc]
mov dword [esi + 0x24], eax
test ebx, ebx
je 0x1029e2ea
mov edx, dword [esp + 0x10]
lea esp, [esp]
movzx eax, byte [edx + 1]
add edx, 2
shl ax, 8
movzx ecx, ax
mov dword [esp + 0x10], edx
movzx eax, byte [edx]
or ecx, eax
je 0x1029e2e7
lea eax, [ecx + ebp]
push esi
push eax
call edi
mov edx, dword [esp + 0x18]
add esp, 8
dec ebx
jne 0x1029e2c0
dec dword [esi + 0x14]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
Function at 0x1029e9f0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax + 0x44]
lea eax, [edi + 0xc]
cmp eax, ecx
jbe 0x1029ea18
mov eax, dword [edx]
push 1
push eax
mov dword [eax + 0x4c], 8
call dword [sym.imp.MSVCR120.dll_longjmp]
movzx eax, byte [edi + 2]
shl ax, 8
movzx ecx, ax
movzx eax, byte [edi + 3]
or ecx, eax
movzx eax, byte [edi + 4]
shl ax, 8
push ebx
movzx ebx, ax
movzx eax, byte [edi + 5]
or ebx, eax
add ecx, dword [esp + 0x10]
movzx eax, byte [edi + 6]
shl ax, 8
push ebp
movzx ebp, ax
movzx eax, byte [edi + 7]
or ebp, eax
movzx eax, byte [edi + 8]
shl ax, 8
push esi
movzx esi, ax
movzx eax, byte [edi + 9]
add edi, 0xc
or esi, eax
mov dword [esp + 0x10], edi
push 0xffffffffffffffff
movzx eax, byte [edi - 2]
shl ax, 8
movzx edi, ax
mov eax, dword [esp + 0x14]
movzx eax, byte [eax - 1]
or edi, eax
call fcn.1029d180
mov ecx, dword [esp + 0x1c]
push 0xffffffffffffffff
lea ecx, [ebx + ecx]
mov ebx, dword [esp + 0x24]
mov edx, ebx
call fcn.1029d180
mov ecx, dword [esp + 0x20]
mov edx, ebx
lea ecx, [esi + ecx]
call fcn.1029ed20
inc dword [ebx + 0x14]
mov eax, dword [ebx + 0x14]
push ebx
mov ecx, dword [ebx + eax*4 + 0x18]
mov eax, dword [esp + 0x24]
add eax, edi
mov dword [ebx + 0x24], ebp
push eax
call ecx
add esp, 0x10
dec dword [ebx + 0x14]
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
Function at 0x102b9690
Capabilities:
Query environment variable

Disassembly:
sub esp, 8
push esi
push edi
mov edi, ecx
mov dword [esp + 0xc], 0
push 0x54
mov dword [edi + 4], 0
call dword [sym.imp.MSVCR120.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
jne 0x102b96cf
mov ecx, dword [edi]
push edi
mov dword [ecx + 0x14], 0x38
mov ecx, dword [edi]
mov dword [ecx + 0x18], eax
mov eax, dword [edi]
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi], fcn.102b8ad0
mov dword [esi + 4], fcn.102b8c20
mov dword [esi + 8], fcn.102b8cf0
mov dword [esi + 0xc], fcn.102b8da0
mov dword [esi + 0x10], 0x102b8e50
mov dword [esi + 0x14], 0x102b8ec0
mov dword [esi + 0x18], 0x102b8f30
mov dword [esi + 0x1c], 0x102b91d0
mov dword [esi + 0x20], 0x102b9320
mov dword [esi + 0x24], 0x102b9470
mov dword [esi + 0x28], 0x102b9570
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [esp + 0xc]
mov dword [esi + 0x2c], eax
mov dword [esi + 0x38], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x54
push str.JPEGMEM
mov dword [edi + 4], esi
call dword [sym.imp.MSVCR120.dll_getenv]
add esp, 4
test eax, eax
je 0x102b97b2
lea ecx, [esp + 0xb]
mov byte [esp + 0xb], 0x78
push ecx
lea ecx, [esp + 0x10]
push ecx
push str._ld_c
push eax
call dword [sym.imp.MSVCR120.dll_sscanf]
add esp, 0x10
test eax, eax
jle 0x102b97b2
mov al, byte [esp + 0xb]
cmp al, 0x6d
je 0x102b97a1
cmp al, 0x4d
mov eax, dword [esp + 0xc]
jne 0x102b97a9
imul eax, dword [esp + 0xc], 0x3e8
imul eax, eax, 0x3e8
mov dword [esi + 0x2c], eax
pop edi
pop esi
add esp, 8
ret
Function at 0x102cfd90
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x18
push ebx
push ebp
mov ebp, ecx
push esi
mov dword [esp + 0x1c], ebp
cmp dword [ebp + 0x4c], 1
mov ebx, dword [ebp + 0x1b8]
mov dword [esp + 0x20], ebx
jne 0x102cfdb7
mov esi, 0x1fe
mov byte [ebx + 0x1c], 1
jmp 0x102cfdbd
xor esi, esi
mov byte [ebx + 0x1c], 0
push dword [ebp + 0x64]
mov ecx, dword [ebp + 4]
lea eax, [esi + 0x100]
push eax
push 1
push ebp
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], esi
call eax
xor ecx, ecx
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x14]
add esp, 0x10
mov dword [esp + 0x14], ecx
cmp dword [ebp + 0x64], ecx
jle 0x102cfed0
push edi
nop
mov edi, dword [ebx + ecx*4 + 0x20]
cdq
idiv edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], eax
test esi, esi
je 0x102cfe0d
mov eax, dword [ebx + 0x18]
add dword [eax + ecx*4], 0xff
mov eax, dword [ebx + 0x18]
xor ebx, ebx
mov ebp, dword [eax + ecx*4]
lea eax, [edi + 0xfe]
lea ecx, [edi*2 - 2]
cdq
idiv ecx
xor esi, esi
mov edx, eax
lea esp, [esp]
cmp esi, edx
jle 0x102cfe66
mov ecx, dword [esp + 0x10]
lea edi, [edi*2 - 2]
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
lea ecx, [ecx]
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x102cfe50
mov edi, dword [esp + 0x10]
mov al, byte [esp + 0x1c]
imul bl
mov byte [esi + ebp], al
inc esi
cmp esi, 0xff
jle 0x102cfe30
mov esi, dword [esp + 0x14]
test esi, esi
je 0x102cfeb1
mov ecx, 1
lea edx, [ebp - 1]
jmp 0x102cfe90
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x102cfe90
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x24]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, dword [eax + 0x64]
mov eax, dword [esp + 0x1c]
jl 0x102cfdf0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x102e4180
Capabilities:
Query environment variable

Disassembly:
cmp dword [0x105da138], 0xffffffff
jne 0x102e42b0
push esi
call fcn.100c80a0
mov esi, dword [sym.imp.MSVCR120.dll_getenv]
push str.JSIMD_FORCEMMX
mov dword [0x105da138], eax
call esi
add esp, 4
test eax, eax
je 0x102e41e1
mov ecx, 0x1058462c
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x102e41d1
test dl, dl
je 0x102e41cd
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x102e41d1
add eax, 2
add ecx, 2
test dl, dl
jne 0x102e41b1
xor eax, eax
jmp 0x102e41d6
sbb eax, eax
or eax, 1
test eax, eax
jne 0x102e41e1
and dword [0x105da138], 1
push str.JSIMD_FORCE3DNOW
call esi
add esp, 4
test eax, eax
je 0x102e4224
mov ecx, 0x1058462c
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x102e4214
test dl, dl
je 0x102e4210
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x102e4214
add eax, 2
add ecx, 2
test dl, dl
jne 0x102e41f4
xor eax, eax
jmp 0x102e4219
sbb eax, eax
or eax, 1
test eax, eax
jne 0x102e4224
and dword [0x105da138], 3
push str.JSIMD_FORCESSE
call esi
add esp, 4
test eax, eax
je 0x102e4267
mov ecx, 0x1058462c
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x102e4257
test dl, dl
je 0x102e4253
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x102e4257
add eax, 2
add ecx, 2
test dl, dl
jne 0x102e4237
xor eax, eax
jmp 0x102e425c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x102e4267
and dword [0x105da138], 5
push str.JSIMD_FORCESSE2
call esi
add esp, 4
pop esi
test eax, eax
je 0x102e42b0
mov ecx, 0x1058462c
jmp 0x102e4280
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x102e42a0
test dl, dl
je 0x102e429c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x102e42a0
add eax, 2
add ecx, 2
test dl, dl
jne 0x102e4280
xor eax, eax
jmp 0x102e42a5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x102e42b0
and dword [0x105da138], 8
ret