joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010d0b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x1010d240
cmp dword [esi + 0x20], 0
je 0x1010d240
cmp dword [esi + 0x24], 0
je 0x1010d240
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x1010d240
cmp dword [eax], esi
jne 0x1010d240
mov eax, dword [eax + 4]
cmp eax, 0x2a
je 0x1010d116
cmp eax, 0x39
je 0x1010d116
cmp eax, 0x45
je 0x1010d116
cmp eax, 0x49
je 0x1010d116
cmp eax, 0x5b
je 0x1010d116
cmp eax, 0x67
je 0x1010d116
cmp eax, 0x71
je 0x1010d116
cmp eax, 0x29a
jne 0x1010d240
push edi
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x2c], 2
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 8]
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], eax
test ecx, ecx
jns 0x1010d14f
neg ecx
mov dword [edi + 0x18], ecx
push 0
push 0
push 0
cmp ecx, 2
jne 0x1010d168
mov dword [edi + 4], 0x39
call fcn.1010a590
jmp 0x1010d17f
test ecx, ecx
mov edx, 0x2a
mov eax, 0x71
cmovne eax, edx
mov dword [edi + 4], eax
call fcn.1010a8a0
add esp, 0xc
mov dword [esi + 0x30], eax
mov dword [edi + 0x28], 0
push edi
call fcn.1010e160
mov esi, dword [esi + 0x1c]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call fcn.1026c8e0
mov eax, dword [esi + 0x84]
add esp, 0x10
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x102adb8a]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x102adb88]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x102adb8c]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x102adb8e]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
pop ebx
ret
pop esi
mov eax, 0xfffffffe
pop ebx
ret

Function at 0x10110aa0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x10110ac0
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x10110ac0
mov eax, dword [eax + 0x44]
test eax, eax
je 0x10110ac0
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10111190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.10110e24
push eax
push esi
push dword [ebp + 8]
call fcn.10110dd9
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.10110e24
push eax
push esi
push dword [ebp + 8]
call fcn.10110dd9
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10110e24
push eax
push esi
push dword [ebp + 8]
call fcn.10110dd9
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10110e14
mov byte [0x8810a219], al
popfd
jl 0x10111299
invalid
invalid
Function at 0x10111570
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x101114eb
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10111509
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10111567
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1011154e
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10111557
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x10111561
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10111543
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x101114cd
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x101115b4
dec eax
je 0x101115ab
sub eax, 3
je 0x101115a2
mov dword [ebp - 4], 0x40
jmp 0x101115d1
mov dword [ebp - 4], 4
jmp 0x101115b7
mov dword [ebp - 4], 0x20
jmp 0x101115b7
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10111603
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
invalid
invalid
je 0x101115de
invalid
Function at 0x10124890
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1029a090
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov eax, ecx
push esi
push edi
push 8
mov dword [ebp - 0x10], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10269f9d
mov esi, eax
add esp, 4
test esi, esi
je 0x101248df
push 1
mov dword [ebp - 4], 0
call fcn.102690df
add esp, 4
mov dword [esi + 4], eax
jmp 0x101248e1
xor esi, esi
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov ebx, dword [ebp - 0x10]
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax + 0x10], esi
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [eax + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword [edx + 0x4c], 0
mov eax, dword [0x105930e4]
mov ecx, dword [0x105930e8]
mov dword [edx + 0x44], ecx
mov ecx, dword [ebp - 0xc]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x38], 0
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10131160
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2074
call fcn.1026ac60
xorps xmm0, xmm0
mov dword [esp + 8], ecx
mov eax, 0x810
movlpd qword [esp], xmm0
movups xmmword [esp + 0x24], xmm0
cmp word [ecx + 0x16], ax
jbe 0x10131191
fldz
add esp, 0x2074
ret 0x10
push ebx
mov ebx, dword [esp + 4]
xor edx, edx
push ebp
mov ebp, dword [esp + 0x2084]
mov eax, 0x40
sub eax, dword [esp + 0x2080]
push esi
mov dword [esp + 0x24], eax
lea eax, [esp + 0x40]
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], eax
nop dword [eax]
nop word [eax + eax]
mov ecx, dword [ecx + 0x54800]
test edx, edx
mov eax, dword [esp + 0x2090]
cmovne eax, dword [esp + 0x2094]
push 0
mov esi, dword [ecx]
cdq
push edx
push eax
call dword [esi + 0xc]
mov ecx, dword [esp + 0x18]
xor edx, edx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x1c], edx
movzx eax, word [ecx + 0x16]
mov esi, eax
cmp dx, ax
jae 0x101312cf
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
nop word [eax + eax]
mov eax, dword [esp + 0x2088]
sub edx, eax
mov dword [esp + 0x20], edx
jns 0x10131289
nop
movq xmm1, qword [esp + 0x10]
xor esi, esi
movd xmm0, ebp
psllq xmm1, xmm0
movq qword [esp + 0x10], xmm1
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
test ebp, ebp
jle 0x1013127a
mov ecx, dword [ecx + 0x54800]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ecx, esi
add esi, 8
shl eax, cl
mov ecx, dword [esp + 0x18]
or ebx, eax
cmp esi, ebp
jl 0x10131252
mov edx, dword [esp + 0x20]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
add edx, ebp
mov dword [esp + 0x20], edx
js 0x10131230
mov eax, dword [esp + 0x2088]
mov ecx, 0x40
sub ecx, edx
mov edx, edi
sub ecx, eax
mov eax, ebx
call fcn.1026af80
mov ecx, dword [esp + 0x28]
call fcn.1026afa0
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x2c]
inc edx
mov dword [esp + 0x2c], edx
mov word [ecx], ax
add ecx, 2
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x18]
movzx esi, word [ecx + 0x16]
cmp edx, esi
mov edx, dword [esp + 0x20]
jl 0x10131220
mov edx, dword [esp + 0x30]
add dword [esp + 0x24], 0x1020
inc edx
mov dword [esp + 0x30], edx
cmp edx, 2
jl 0x101311d0
movzx ebx, si
xor edi, edi
dec ebx
test ebx, ebx
jle 0x10131374
nop word [eax + eax]
movzx eax, word [esp + edi*2 + 0x1066]
mov edx, edi
movzx esi, word [esp + edi*2 + 0x44]
and edx, 1
sub esi, eax
mov ecx, esi
sar ecx, 0x1f
mov eax, ecx
xor eax, esi
movzx esi, word [esp + edi*2 + 0x1064]
sub eax, ecx
movd xmm0, eax
movzx eax, word [esp + edi*2 + 0x46]
sub esi, eax
cvtdq2pd xmm0, xmm0
mov ecx, esi
sar ecx, 0x1f
mov eax, ecx
xor eax, esi
sub eax, ecx
addsd xmm0, qword [esp + edx*8 + 0x34]
movsd qword [esp + edx*8 + 0x34], xmm0
mov edx, edi
movd xmm0, eax
not edx
cvtdq2pd xmm0, xmm0
and edx, 1
inc edi
addsd xmm0, qword [esp + edx*8 + 0x34]
movsd qword [esp + edx*8 + 0x34], xmm0
cmp edi, ebx
jl 0x10131300
movups xmm0, xmmword [esp + 0x34]
jmp 0x10131377
xorps xmm0, xmm0
movaps xmm1, xmm0
unpckhpd xmm1, xmm0
divsd xmm0, xmm1
call fcn.10281130
mulsd xmm0, qword [0x103efbb8]
pop edi
pop esi
pop ebp
pop ebx
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x18], xmm0
fld dword [esp + 0x18]
add esp, 0x2074
ret 0x10
Function at 0x101324f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, ecx
lea edx, [esp + 8]
push ebp
mov ebp, 2
mov dword [esp + 8], ebx
push ebp
mov ecx, dword [ebx + 0x54800]
xorps xmm0, xmm0
push ebp
push edx
movsd qword [esp + 0x28], xmm0
mov eax, dword [ecx]
movsd qword [esp + 0x20], xmm0
call dword [eax + 8]
mov eax, dword [esp + 0x28]
sub eax, ebp
je 0x101325d1
push esi
push edi
nop
mov ecx, dword [ebx + 0x54800]
lea esi, [esp + 0x14]
dec eax
lea esi, [esi + ebp*2]
push 1
mov dword [esp + 0x34], eax
mov eax, dword [ecx]
push 2
push esi
call dword [eax + 8]
movzx esi, byte [esi]
mov ebx, ebp
movzx ecx, byte [esp + ebp*2 + 0x15]
xor ebx, 2
movzx edi, byte [esp + ebx*2 + 0x14]
movzx edx, byte [esp + ebx*2 + 0x15]
mov eax, edi
shl eax, 8
or edx, eax
mov eax, esi
shl eax, 8
or ecx, eax
movzx eax, byte [esp + ebp*2 + 0x15]
sub edx, ecx
shl eax, 8
movzx ecx, byte [esp + ebx*2 + 0x15]
or eax, esi
shl ecx, 8
inc ebp
mov ebx, dword [esp + 0x10]
or ecx, edi
movd xmm0, edx
sub ecx, eax
cvtdq2pd xmm0, xmm0
mov eax, dword [esp + 0x30]
and ebp, 3
mulsd xmm0, xmm0
addsd xmm0, qword [esp + 0x24]
movsd qword [esp + 0x24], xmm0
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm0
addsd xmm0, qword [esp + 0x1c]
movsd qword [esp + 0x1c], xmm0
test eax, eax
jne 0x10132530
pop edi
pop esi
jmp 0x101325d7
movsd xmm0, qword [esp + 0x14]
comisd xmm0, xmmword [esp + 0x1c]
mov eax, 0x4949
mov ecx, 0x4d4d
pop ebp
pop ebx
cmova eax, ecx
add esp, 0x1c
ret 4
Function at 0x10160e20
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0xc], 0
push ebp
push esi
push edi
mov edi, ecx
je 0x10160f47
mov eax, dword [edi + 0x547fc]
mov dword [eax + 0x220], 0
mov edx, dword [edi + 0x547fc]
cmp dword [edx + 0x220], 4
jae 0x10160e7f
mov ecx, dword [esp + 0x1c]
mov eax, dword [edx + 0x220]
imul ecx, ecx, 0x2e90edd
inc ecx
mov dword [edx + eax*4 + 0x20], ecx
mov eax, dword [edi + 0x547fc]
inc dword [eax + 0x220]
mov edx, dword [edi + 0x547fc]
cmp dword [edx + 0x220], 4
jb 0x10160e53
mov ecx, dword [edx + 0x28]
xor ecx, dword [edx + 0x20]
mov eax, dword [edx + 0x2c]
add eax, eax
shr ecx, 0x1f
or ecx, eax
mov dword [edx + 0x2c], ecx
mov eax, dword [edi + 0x547fc]
mov dword [eax + 0x220], 4
mov eax, dword [edi + 0x547fc]
cmp dword [eax + 0x220], 0x7f
jae 0x10160eed
mov esi, dword [eax + 0x220]
mov edx, dword [eax + esi*4 + 0x1c]
xor edx, dword [eax + esi*4 + 0x14]
mov ecx, dword [eax + esi*4 + 0x18]
xor ecx, dword [eax + esi*4 + 0x10]
shr edx, 0x1f
add ecx, ecx
or edx, ecx
mov dword [eax + esi*4 + 0x20], edx
mov eax, dword [edi + 0x547fc]
inc dword [eax + 0x220]
mov eax, dword [edi + 0x547fc]
cmp dword [eax + 0x220], 0x7f
jb 0x10160eb1
mov dword [eax + 0x220], 0
mov ecx, dword [edi + 0x547fc]
cmp dword [ecx + 0x220], 0x7f
jae 0x10160f47
mov esi, dword [sym.imp.WS2_32.dll_htonl]
nop dword [eax]
mov eax, dword [ecx + 0x220]
push dword [ecx + eax*4 + 0x20]
call esi
mov edx, dword [edi + 0x547fc]
mov ecx, dword [edx + 0x220]
mov dword [edx + ecx*4 + 0x20], eax
mov eax, dword [edi + 0x547fc]
inc dword [eax + 0x220]
mov ecx, dword [edi + 0x547fc]
cmp dword [ecx + 0x220], 0x7f
jb 0x10160f10
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x10160f9f
push ebx
mov ebx, dword [esp + 0x14]
nop dword [eax]
nop dword [eax + eax]
mov esi, dword [edi + 0x547fc]
lea ebx, [ebx + 4]
mov edx, dword [esi + 0x220]
lea ecx, [edx - 0x3f]
and ecx, 0x7f
lea eax, [edx + 1]
and eax, 0x7f
and edx, 0x7f
mov ecx, dword [esi + ecx*4 + 0x20]
xor ecx, dword [esi + eax*4 + 0x20]
mov dword [esi + edx*4 + 0x20], ecx
xor dword [ebx - 4], ecx
mov eax, dword [edi + 0x547fc]
inc dword [eax + 0x220]
sub ebp, 1
jne 0x10160f60
pop ebx
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x10173070
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x18]
mov ecx, dword [ebp + 4]
push 0
push 0
mov eax, dword [edi]
lea ebx, [edi + 0x1c]
mov edx, dword [ecx]
add eax, 0x1c
push eax
call dword [edx + 0xc]
cmp dword [ebx + 0x18], 0
lea esi, [ebx + 0x14]
mov dword [esp + 0x18], esi
jne 0x101730b0
push 0
push edi
push ebp
push esi
call fcn.101700c0
add esp, 0x10
mov dword [ebx + 0x18], eax
jmp 0x101730b4
mov dword [esp + 0x18], esi
mov eax, dword [ebx]
sub eax, 2
je 0x101731ce
sub eax, 2
je 0x10173151
sub eax, 1
jne 0x1017325d
mov esi, dword [esi]
xor edx, edx
xor ebp, ebp
cmp byte [esi], dl
je 0x1017310a
nop dword [eax + eax]
lea eax, [ebp*2 + 2]
push eax
push edx
call fcn.10276d37
movzx ecx, byte [esi]
lea esi, [esi + 2]
mov edx, eax
add esp, 8
mov byte [edx + ebp*2], cl
movzx ecx, byte [esi - 1]
mov byte [edx + ebp*2 + 1], cl
inc ebp
cmp byte [esi], 0
jne 0x101730e0
mov ecx, dword [esp + 0x18]
lea edi, [ebx + 0x1c]
mov dword [edi], ebp
lea esi, [ebx + 0x24]
mov dword [ebx + 0x20], edx
push 0x15000
mov ecx, dword [ecx]
push 1
mov eax, dword [ecx + 0x1c]
mov dword [ebx + 0x30], eax
lea eax, [ecx + 0x20]
mov dword [ebx + 0x2c], eax
mov dword [esi], 0
call fcn.1027d001
push edi
push esi
mov dword [esi + 4], eax
call fcn.1016f590
push ebx
call fcn.10166b20
add esp, 0x14
jmp 0x10173232
mov esi, dword [esi]
xor edx, edx
xor ebp, ebp
cmp byte [esi], dl
je 0x1017318a
nop dword [eax + eax]
lea eax, [ebp*2 + 2]
push eax
push edx
call fcn.10276d37
movzx ecx, byte [esi]
lea esi, [esi + 2]
mov edx, eax
add esp, 8
mov byte [edx + ebp*2], cl
movzx ecx, byte [esi - 1]
mov byte [edx + ebp*2 + 1], cl
inc ebp
cmp byte [esi], 0
jne 0x10173160
mov ecx, dword [esp + 0x18]
lea edi, [ebx + 0x1c]
mov dword [edi], ebp
lea esi, [ebx + 0x24]
mov dword [ebx + 0x20], edx
push 0x15000
mov ecx, dword [ecx]
push 1
mov eax, dword [ecx + 0x1c]
mov dword [ebx + 0x30], eax
lea eax, [ecx + 0x20]
mov dword [ebx + 0x2c], eax
mov dword [esi], 0
call fcn.1027d001
push edi
push esi
mov dword [esi + 4], eax
call fcn.1016f590
push ebx
call fcn.101669b0
add esp, 0x14
jmp 0x10173232
mov eax, dword [ebx + 0x18]
mov ebp, dword [ebx + 0x10]
push eax
mov dword [ebx + 0x38], eax
call fcn.102709ea
xor edi, edi
mov dword [ebx + 0x34], eax
add esp, 4
cmp dword [ebx + 0x18], edi
jbe 0x10173232
mov ecx, 0x3bcd0
nop
imul eax, ebp, 0x63d
xor edx, edx
add eax, 0xca25
div ecx
mov ecx, 0x11f9f253
mov ebp, edx
mov eax, ebp
mul ecx
mov ecx, ebp
shl ecx, 8
shrd eax, edx, 0x18
sub ecx, eax
shr ecx, 1
add ecx, eax
mov eax, dword [esi]
shr ecx, 0x11
xor cl, byte [edi + eax]
mov eax, dword [ebx + 0x34]
mov byte [edi + eax], cl
inc edi
mov ecx, 0x3bcd0
cmp edi, dword [ebx + 0x18]
jb 0x101731f0
cmp dword [ebx + 0x34], 0
je 0x10173246
push ebx
call fcn.10174f00
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
push 0x103fa020
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 5
push eax
call fcn.1026cad5
push 0x103fa020
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 5
push eax
call fcn.1026cad5
int3
Function at 0x1017b0a0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
push ebx
push esi
mov esi, ecx
mov edx, 2
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], edx
movzx ebx, word [esi + 0x16]
movzx ecx, bx
mov dword [esp + 0x20], ebx
lea eax, [ecx + ecx]
mov dword [esp + 0x24], eax
movzx eax, word [esi + 0x14]
sub eax, edx
cmp eax, edx
jle 0x1017b24f
movsd xmm2, qword [0x103efa18]
movsd xmm3, qword [0x103ef970]
push ebp
lea ebp, [ecx - 2]
movzx ebx, bx
push edi
mov dword [esp + 0x20], ebp
mov eax, dword [esi + 0x194]
mov ecx, edx
and ecx, 7
movzx edi, bx
shl ecx, 2
shr eax, cl
imul edi, edx
and eax, 1
add eax, 2
movzx ecx, bx
add edi, eax
cmp eax, ebp
jge 0x1017b236
mov ecx, dword [esp + 0x28]
lea ebp, [edi*8]
movzx ebx, cx
mov edx, edi
sub edx, ebx
shl edx, 3
mov dword [esp + 0x18], edx
lea ecx, [edi + ebx]
mov ebx, dword [esp + 0x2c]
shl ecx, 3
mov dword [esp + 0x10], ecx
lea ecx, [edi + ebx]
sub edi, ebx
mov ebx, dword [esp + 0x20]
sub ebx, eax
shl ecx, 3
mov eax, dword [esp + 0x10]
dec ebx
shr ebx, 1
shl edi, 3
inc ebx
mov dword [esp + 0x14], ecx
nop dword [eax]
mov esi, dword [esi + 8]
movzx eax, word [eax + esi + 6]
movzx ecx, word [esi + ebp + 6]
lea ecx, [eax + ecx*2]
movzx eax, word [edx + esi + 6]
add ecx, eax
movzx eax, word [esi + ebp + 0xe]
add ecx, eax
movzx eax, word [esi + ebp - 2]
add ecx, eax
movzx eax, word [edi + esi + 6]
add edi, 0x10
lea edx, [eax + ecx*2]
mov eax, dword [esp + 0x14]
movzx ecx, word [esi + ebp + 0xa]
add dword [esp + 0x14], 0x10
movzx eax, word [eax + esi + 6]
add edx, eax
movzx eax, word [esi + ebp + 0x16]
add edx, eax
movzx eax, word [esi + ebp - 0xa]
add edx, eax
movzx eax, word [esi + ebp - 6]
add ecx, eax
mov eax, 0x10
sub eax, edx
imul ecx, eax
mov eax, dword [esp + 0x18]
movzx eax, word [eax + esi + 2]
movd xmm1, ecx
mov ecx, dword [esp + 0x10]
cvtdq2pd xmm1, xmm1
movzx ecx, word [ecx + esi + 2]
add ecx, eax
imul ecx, edx
mov edx, dword [esp + 0x18]
mulsd xmm1, xmm2
add edx, 0x10
mov dword [esp + 0x18], edx
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm2
addsd xmm1, xmm0
mulsd xmm1, xmm3
cvttsd2si eax, xmm1
mov word [esi + ebp + 2], ax
add ebp, 0x10
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
add eax, 0x10
mov dword [esp + 0x10], eax
sub ebx, 1
jne 0x1017b160
movzx ecx, word [esi + 0x16]
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
movzx eax, word [esi + 0x14]
inc edx
sub eax, 2
mov dword [esp + 0x24], edx
movzx ebx, cx
cmp edx, eax
jl 0x1017b0f0
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x10180d50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
mov esi, ecx
push edi
push 0
push ebx
mov ecx, dword [esi + 0x58]
movzx ebp, word [ecx + 0x1e]
mov dword [esp + 0x38], ebp
call fcn.10176360
mov ecx, dword [esi + 0x58]
mov edi, eax
and edi, 1
push edi
push ebx
call fcn.10176360
mov ecx, dword [esi + 4]
xor edi, 1
mov dword [esp + 0x18], eax
cmp edi, ebp
jae 0x10180eae
lea edx, [eax*2 - 6]
mov ebp, eax
mov dword [esp + 0x10], edx
xor ebp, 2
lea edx, [eax*2 + 6]
add ebx, 4
mov dword [esp + 0x3c], edx
lea edx, [esi + 0x24]
lea edx, [edx + eax*2]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x14], edx
lea edx, [eax + eax]
mov dword [esp + 0x1c], edx
lea eax, [ecx + ecx*2]
mov edx, ebp
sub edx, eax
add eax, ebp
add eax, eax
add edx, edx
mov dword [esp + 0x28], eax
lea eax, [ecx + ecx*2]
add eax, eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x24], eax
imul ebx, ecx
mov ecx, dword [esp + 0x10]
add ebx, 4
add ebx, edi
lea eax, [ebx + ebx*2]
mov ebx, dword [esi + 8]
add eax, eax
add ebx, eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x3c]
movzx ecx, word [ecx + ebx]
movzx eax, word [eax + ebx]
add eax, ecx
movzx ecx, word [ebx + 8]
sub eax, ecx
movzx ecx, word [ebx - 4]
sub eax, ecx
movzx ecx, word [ebx + 2]
cdq
sub eax, edx
mov edx, eax
mov eax, dword [esp + 0x14]
sar edx, 1
add edx, ecx
movzx ecx, word [eax]
cmp edx, ecx
jg 0x10180e3e
mov eax, dword [esp + 0x18]
mov ecx, edx
movzx eax, word [esi + eax*2 + 0x2c]
cmp edx, eax
cmovl ecx, eax
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov word [eax + ebx], cx
mov ebx, dword [esi + 0xc]
add ebx, dword [esp + 0x20]
mov eax, ebx
sub eax, edx
movzx ecx, word [eax + 2]
mov eax, dword [esp + 0x28]
movzx eax, word [eax + ebx]
sub eax, ecx
movzx ecx, word [edx + ebx + 2]
sub eax, ecx
mov ecx, dword [esp + 0x2c]
movzx ecx, word [ecx + ebx]
add eax, ecx
movzx ecx, word [ebx + 2]
cdq
sub eax, edx
mov edx, eax
sar edx, 1
add edx, ecx
movzx ecx, word [esi + ebp*2 + 0x24]
cmp edx, ecx
jg 0x10180e96
movzx eax, word [esi + ebp*2 + 0x2c]
mov ecx, edx
cmp edx, eax
cmovl ecx, eax
add edi, 2
mov word [ebx + ebp*2], cx
mov ecx, dword [esi + 4]
mov ebx, dword [esp + 0x34]
cmp edi, dword [esp + 0x30]
jl 0x10180de2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4