joyce8/EMBER2024-capa huggingface dataset:
Function at 0x708b14
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xaaa2a2
jmp 0xa96a9e
push ebx
push eax
mov eax, 0x2be28542
mov dword [esp + 4], eax
pop eax
mov dword [esp], edi
mov dword [esp], edx
pop dword [ebp - 0x10]
jmp 0xa96b61
jmp 0xaaac00
jmp 0xa9f3bf
push esi
push 0x27e61589
mov dword [esp], ebp
mov dword [esp], edi
mov edi, 0
mov dword [esp + 4], edi
pop edi
pop eax
jmp 0xa9f431
jmp 0xab2316
jmp 0xaa57ea
push ecx
push ebx
mov ebx, 0x380c0f2
mov dword [esp + 4], ebx
push dword [esp]
jmp 0xaa58a5
pop ebx
add esp, 4
mov dword [esp], edx
jmp 0xaa58b4
jmp 0xabd263
jmp 0xaa5c37
cpuid
jmp 0xaa5c3e
jmp 0xa9f301
cpuid
jmp 0xaa8727
jmp 0xaae374
jmp 0xaa9133
push edx
mov dword [esp], ecx
mov dword [esp], 0
push dword [esp]
jmp 0xaa91e0
pop eax
add esp, 4
jmp 0xaa91e9
jmp 0xaaae6c
push 0x67139532
mov dword [esp], esi
push edi
mov edi, 0x6a85fbf9
mov dword [esp + 4], edi
pop edi
mov dword [esp], ebp
mov dword [esp], ebx
jmp 0xaa946b
jmp 0xabf020
jmp 0xaa9c3c
jmp 0xaaa357
sub esp, 4
mov dword [esp], edi
mov dword [esp], 0x568aa1ea
mov dword [esp], esi
mov dword [esp], ebp
jmp 0xaaa3c7
jmp 0xaab5b4
jmp 0xaaacaf
push edx
push 0x467eeb15
mov dword [esp], esi
mov esi, 0
mov dword [esp + 4], esi
pop esi
mov eax, dword [esp]
add esp, 4
jmp 0xaaad2e
jmp 0xaa8620
jmp 0xaaaec6
cpuid
jmp 0xaaaf7b
jmp 0xaab2cc
jmp 0xaab384
rdtsc
jmp 0xaab3e8
jmp 0xab2205
jmp 0xaab65a
pop ebp
jmp 0xaab6d9
push edi
mov dword [esp], ecx
mov ecx, esp
add ecx, 4
sub ecx, 4
xchg dword [esp], ecx
pop esp
push esp
pop dword [esp]
add dword [esp], 4
jmp 0xaab654
jmp 0xabeeed
jmp 0xaad4dd
push 0x66bce44c
mov dword [esp], ebx
mov dword [esp], 0x72d46aa
mov dword [esp], eax
mov dword [esp], edx
pop dword [ebp - 8]
jmp 0xaad55a
jmp 0xab2427
jmp 0xaae41c
add esp, 4
jmp 0xaae489
push esi
push ebp
push eax
mov eax, 0
mov ebp, eax
pop eax
mov dword [esp + 4], ebp
pop ebp
mov eax, dword [esp]
jmp 0xaae3c7
jmp 0xaa5b25
push 0x1792e6eb
mov dword [esp], ebx
mov dword [esp], esi
mov dword [esp], 0x65a1adcb
mov dword [esp], eax
pop dword [ebp - 0xc]
jmp 0xab230c
jmp 0xaad438
cpuid
jmp 0xab2422
jmp 0xaa90dd
jmp 0xab2533
push dword [ebp - 0xc]
push dword [esp]
push dword [esp]
pop eax
add esp, 4
add esp, 4
jmp 0xab254b
jmp 0xaa9b3c
jmp 0xab66d0
push eax
push esp
pop eax
add eax, 4
sub eax, 4
xchg dword [esp], eax
pop esp
mov dword [esp], ebx
mov dword [esp], eax
pop dword [ebp - 0x14]
jmp 0xab6782
jmp 0xa96a3e
jmp 0xabd2bf
rdtsc
jmp 0xabd367
jmp 0xab667b
jmp 0xabefb2
add edx, 4
sub edx, 0x14
xchg dword [esp], edx
pop esp
jmp 0xabf01b
sub esp, 4
mov dword [esp], edx
sub esp, 4
mov dword [esp], esp
add dword [esp], 4
mov edx, dword [esp]
add esp, 4
jmp 0xabefa0
jmp 0xaa9347
push ebx
mov dword [esp], esi
mov esi, esp
add esi, 4
sub esi, 4
xchg dword [esp], esi
mov esp, dword [esp]
mov dword [esp], ebx
mov dword [esp], ecx
jmp 0xabf141
jmp 0xaa578d
Function at 0x994cdc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x994d03
call fcn.00937288
mov dword [eax], esi
call fcn.00937275
push 0x16
pop esi
mov dword [eax], esi
call fcn.00937eca
mov eax, esi
jmp 0x994d58
test dword [ebp + 0xc], 0xfffffff9
jne 0x994ce9
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x994d30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0093729b
pop ecx
call fcn.00937275
mov eax, dword [eax]
jmp 0x994d58
test al, 0x10
jne 0x994d56
test al, 1
je 0x994d56
test byte [ebp + 0xc], 2
je 0x994d56
call fcn.00937288
mov dword [eax], 5
call fcn.00937275
mov dword [eax], 0xd
jmp 0x994d27
xor eax, eax
pop esi
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x9176142
nop
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x6eb6555a
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x77fe199a
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..text_1
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x61cd449d
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6e411579
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3d4855d3
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x110108f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11189004
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x112194bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp + 8]
mov dword [edi], vtable.DuiLib::CUIAnimation.0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 4], eax
lea esi, [edi + 0x18]
mov dword [edi + 0x14], vtable.DuiLib::INotifyUI.0
lea ecx, [esi + 4]
mov dword [ebp - 4], 0
push 0x53
mov dword [ebp + 8], esi
mov dword [esi], vtable.DuiLib::CNotifyPump.0
call sym.DuiLib.dll_public:_void___thiscall_DuiLib::CStdStringPtrMap::constructor_int_
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x2c], eax
mov al, byte [ebp + 0x10]
mov dword [edi], vtable.DuiLib::CDUIDragAnimation.0
mov dword [edi + 0x14], vtable.DuiLib::CDUIDragAnimation.1.0
mov dword [esi], vtable.DuiLib::CDUIDragAnimation.2.0
mov byte [edi + 0x30], al
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
xorps xmm0, xmm0
mov byte [ebp - 4], 4
movups xmmword [edi + 0x60], xmm0
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x11010a51
mov eax, dword [ecx]
sub esp, 8
mov edx, dword [eax + 0x10]
mov eax, esp
mov dword [eax], str.Container
mov dword [eax + 4], 9
call edx
mov dword [edi + 0x34], eax
test eax, eax
je 0x11010a51
push edi
mov ecx, eax
call sym.DuiLib.dll_public:_void___thiscall_DuiLib::CControlUI::SetAnimationMgr_class_DuiLib::IUIAnimation__
mov ecx, dword [edi + 0x34]
xor esi, esi
add ecx, 0x288
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
test eax, eax
jle 0x11010a51
nop dword [eax + eax]
mov ecx, dword [edi + 0x34]
add ecx, 0x288
push esi
mov eax, dword [ecx]
mov eax, dword [eax]
call eax
test eax, eax
je 0x11010a3c
push edi
mov ecx, eax
call sym.DuiLib.dll_public:_void___thiscall_DuiLib::CControlUI::SetAnimationMgr_class_DuiLib::IUIAnimation__
mov ecx, dword [edi + 0x34]
inc esi
add ecx, 0x288
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
cmp esi, eax
jl 0x11010a20
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x11019400
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x112194bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
mov dword [ebp - 0x210], ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, dword [ebp + 0xc]
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
add esi, 0xffffffdf
mov edi, eax
cmp esi, 0xd
ja case.0x11019445.41
movzx eax, byte [esi + 0x110194b0]
jmp dword [eax*4 + 0x110194a8]
or edi, 0x100
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.111228c0
add esp, 0xc
shl edi, 0x10
lea eax, [ebp - 0x20c]
push 0x104
push eax
push edi
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push dword [section..data]
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.11010af0
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.110d0a88
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1101b9b0
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x112194bc]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x294]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1101ba4d
push 0xff
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.111228c0
add esp, 0xc
lea eax, [ebp - 0x104]
push 0xff
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1101ba4d
mov eax, dword [eax + 0xc]
push ebx
mov eax, dword [eax]
mov ebx, dword [eax]
mov eax, ebx
shr eax, 8
mov ecx, ebx
movzx edx, al
movzx eax, bl
shl eax, 8
add eax, edx
shr ecx, 0x10
shl eax, 8
movzx ecx, cl
add eax, ecx
shr ebx, 0x18
shl eax, 8
add eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.110d0a88
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.110d0a88
mov esp, ebp
pop ebp
ret
Function at 0x1101bbb0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x112194bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebx + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x10], eax
mov dword [eax + 0x310], 0
cmp dword [edi + 4], 0
jne 0x1101bc8b
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 8
push eax
mov dword [ebp - 0x2c], 0x800
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
test eax, eax
je 0x1101bc60
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
mov ecx, dword [edi + 0x10]
movups xmm0, xmmword [eax]
mov eax, dword [ecx]
movups xmmword [ebp - 0x20], xmm0
mov eax, dword [eax + 0x1c]
call eax
mov ecx, eax
call sym.DuiLib.dll_public:_struct_HWND______thiscall_DuiLib::CPaintManagerUI::GetPaintWindow_void_const
movups xmm0, xmmword [ebp - 0x20]
push 0
sub esp, 0x10
mov edx, eax
mov ecx, esp
push 0
push 0x40030000
sub esp, 8
mov eax, esp
movups xmmword [ecx], xmm0
mov ecx, edi
push edx
mov dword [eax], 0x111997f0
mov dword [eax + 4], 0
call sym.DuiLib.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::Create_struct_HWND_____class_std::basic_string_view_wchar_t__struct_std::char_traits_wchar_t____unsigned_long_int__unsigned_long_int__struct_tagRECT__struct_HMENU____
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c]
call eax
mov ecx, dword [edi + 0x10]
mov esi, eax
call sym.DuiLib.dll_public:_int___thiscall_DuiLib::CLabelUI::GetFont_void_const
push eax
mov ecx, esi
call sym.DuiLib.dll_public:_struct_DuiLib::tagTFontInfo____thiscall_DuiLib::CPaintManagerUI::GetFontInfo_int_
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x10]
lea edx, [ebp - 0x28]
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
call eax
lea ecx, [ebp - 0x28]
mov esi, dword [eax + 0x10]
call fcn.1100e280
test esi, esi
jne 0x1101bcb6
call fcn.1101b9b0
mov ecx, dword [edi + 0x10]
mov dword [ecx + 0x308], eax
mov eax, dword [edi + 0x10]
push dword [eax + 0x308]
push 0
push 0x465
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 5
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 4]
mov byte [edi + 0x18], 1
xor ecx, ebp
pop edi
pop esi
call fcn.110d0a88
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x1101bd40
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetFocus]
push esi
push edi
mov edi, ecx
call ebx
mov esi, eax
test esi, esi
je 0x1101bd6a
call ebx
cmp eax, dword [edi + 4]
je 0x1101bdca
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
test esi, esi
jne 0x1101bd56
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [edi + 0x10]
mov esi, eax
cmp dword [ecx + 0x310], 0
jne 0x1101bdb6
add ecx, 0x308
push ecx
push 0
push 0x466
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0x10]
mov dword [eax + 0x310], 1
mov ecx, dword [edi + 0x10]
call sym.DuiLib.dll_public:_void___thiscall_DuiLib::CIPAddressUI::UpdateText_void_
push 0
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x10
mov eax, dword [ebp + 0x14]
pop edi
pop esi
pop ebx
mov dword [eax], 1
xor eax, eax
pop ebp
ret 0x10

Function at 0x11023490
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.DuiLib.dll_public_virtual:_void___thiscall_DuiLib::CListUI::DoEvent_struct_DuiLib::tagTEventUI__

Function at 0x11023499
Capabilities:
Log keystrokes via polling

Disassembly:
sub ecx, 0x388
jmp sym.DuiLib.dll_public_virtual:_void___thiscall_DuiLib::CMenuUI::DoEvent_struct_DuiLib::tagTEventUI__
Function at 0x1102acf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
cmp dword [edi + 0x1c], 8
lea esi, [edi + 8]
mov ebx, dword [edi + 0x18]
jb 0x1102ad0c
mov esi, dword [edi + 8]
xor ecx, ecx
mov edx, 0x811c9dc5
add ebx, ebx
je 0x1102ad28
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, ebx
jb 0x1102ad17
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
lea edx, [eax*8]
mov eax, dword [ecx + edx]
add ecx, edx
cmp dword [ecx + 4], edi
jne 0x1102ad61
cmp eax, edi
jne 0x1102ad59
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x1102ad69
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1102ad69
cmp eax, edi
jne 0x1102ad69
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [edi + 4]
lea ecx, [edi + 8]
mov esi, dword [edi]
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ebx + 8]
call fcn.1102ae50
push 0x28
push edi
call fcn.110d0a5e
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1102be10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, ecx
mov esi, eax
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
jb 0x1102be31
mov esi, dword [eax]
lea edi, [ecx + ecx]
mov edx, 0x811c9dc5
xor ecx, ecx
test edi, edi
je 0x1102be51
nop
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x1102be40
mov eax, dword [ebx + 0x18]
mov ecx, dword [ebx + 0xc]
and eax, edx
mov edi, dword [ebx + 4]
mov dword [ebp - 4], edi
mov edx, dword [ecx + eax*8]
lea eax, [eax*8 + 4]
add eax, ecx
mov dword [ebp - 8], edx
mov esi, edx
mov dword [ebp - 0x10], eax
cmp edx, edi
jne 0x1102be7b
mov eax, edi
jmp 0x1102be7f
mov eax, dword [eax]
mov eax, dword [eax]
cmp esi, eax
je 0x1102bef4
mov ecx, dword [ebp + 0xc]
lea ebx, [esi + 8]
mov eax, ecx
cmp dword [ecx + 0x14], 8
jb 0x1102be93
mov eax, dword [ecx]
cmp dword [ebx + 0x14], 8
mov ecx, dword [ebx + 0x10]
jb 0x1102be9e
mov ebx, dword [ebx]
cmp ecx, dword [ebp - 0xc]
jne 0x1102bed5
test ecx, ecx
je 0x1102bedf
movzx edx, word [ebx]
movzx edi, word [eax]
cmp dx, di
jb 0x1102becf
sub ebx, eax
cmp dx, di
ja 0x1102becf
cmp ecx, 1
je 0x1102bedc
movzx edx, word [ebx + eax + 2]
add eax, 2
dec ecx
movzx edi, word [eax]
cmp dx, di
jae 0x1102beb7
mov edi, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov esi, dword [esi]
mov eax, dword [ebp - 0x10]
jmp 0x1102be73
mov edi, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
lea eax, [esi + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.1102af70
test al, al
cmove edi, esi
mov eax, dword [ebp + 8]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1102c020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0x28]
lea edx, [ebp + 0x28]
push ebx
test eax, eax
push esi
mov esi, dword [ebp + 0xc]
mov ecx, esi
cmove ecx, dword [ebp + 0x10]
dec ecx
test eax, eax
mov eax, dword [ebp + 0x10]
push edi
lea edi, [ebp - 4]
mov dword [ebp - 8], ecx
cmovne edx, edi
lea edi, [ebp - 0xc]
mov dword [ebp - 0x18], edx
lea edx, [ebp - 0x10]
cmovne edi, edx
xor ebx, ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp + 0x28], ebx
test eax, eax
jle 0x1102c1b0
xor edx, edx
mov dword [ebp - 4], edx
test esi, esi
jle 0x1102c1a4
mov eax, dword [ebp + 0x20]
mov esi, ebx
neg eax
imul esi, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], esi
mov eax, edx
mov dword [ebp - 0xc], ebx
imul eax, dword [ebp + 0x1c]
xorps xmm2, xmm2
mov ebx, dword [ebp - 0x14]
xorps xmm3, xmm3
xorps xmm4, xmm4
mov dword [ebp - 0x10], edx
xorps xmm5, xmm5
add esi, eax
mov dword [ebp - 0x20], esi
cmp ebx, dword [ebp + 0x20]
jg 0x1102c14e
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
add esi, ebx
mov eax, ebx
mov dword [edi], esi
cdq
xor eax, edx
sub eax, edx
test esi, esi
jns 0x1102c0c8
mov dword [edi], 0
jmp 0x1102c0ce
cmp esi, ecx
jle 0x1102c0ce
mov dword [edi], ecx
mov edx, dword [ebp - 0xc]
inc ebx
imul edx, dword [ebp + 0x18]
inc esi
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x24]
add edx, dword [ebp + 8]
movsd xmm1, qword [edi + eax*8]
mov edi, dword [ebp - 0x1c]
movzx eax, byte [ecx + edx]
movd xmm0, eax
movzx eax, byte [ecx + edx + 1]
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm1
addsd xmm2, xmm0
movd xmm0, eax
movzx eax, byte [ecx + edx + 2]
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm1
addsd xmm3, xmm0
movd xmm0, eax
movzx eax, byte [ecx + edx + 3]
cvtdq2pd xmm0, xmm0
mov ecx, dword [ebp - 8]
mulsd xmm0, xmm1
addsd xmm4, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm1
addsd xmm5, xmm0
cmp ebx, dword [ebp + 0x20]
jle 0x1102c0b3
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp + 0x14]
cvttsd2si eax, xmm2
mov byte [esi + ecx], al
cvttsd2si eax, xmm3
mov byte [esi + ecx + 1], al
cvttsd2si eax, xmm4
mov byte [esi + ecx + 2], al
mov eax, dword [ebp + 8]
cvttsd2si ecx, xmm5
mov bl, byte [esi + eax + 3]
movzx eax, bl
cmp cl, bl
movzx edx, cl
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp + 0x28]
cmovbe edx, eax
mov eax, dword [ebp + 0x14]
mov byte [esi + eax + 3], dl
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 0x24]
inc edx
mov dword [ebp - 4], edx
cmp edx, dword [ebp + 0xc]
jl 0x1102c083
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
inc ebx
mov dword [ebp + 0x28], ebx
cmp ebx, eax
jl 0x1102c065
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x110357a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1118c447
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x112194bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
mov dword [ebx], vtable.DuiLib::CResourceManager.0
mov eax, dword [edi + 4]
mov dword [ebx + 4], eax
mov dword [ebx + 8], vtable.DuiLib::CStdStringPtrMap.0
mov eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], vtable.DuiLib::CStdStringPtrMap.0
mov eax, dword [edi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [ebp - 4], 0
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], vtable.DuiLib::CStdStringPtrMap.0
mov eax, dword [edi + 0x30]
mov dword [ebx + 0x30], eax
mov eax, dword [edi + 0x34]
mov dword [ebx + 0x34], eax
mov eax, dword [edi + 0x38]
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], vtable.DuiLib::CStdStringPtrMap.0
mov eax, dword [edi + 0x40]
mov dword [ebx + 0x40], eax
mov eax, dword [edi + 0x44]
mov dword [ebx + 0x44], eax
mov eax, dword [edi + 0x48]
mov dword [ebx + 0x48], eax
lea eax, [edi + 0x4c]
mov byte [ebp - 4], 3
lea ecx, [ebx + 0x4c]
push eax
call sym.DuiLib.dll_public:_void___thiscall_DuiLib::CMarkup::constructor_class_DuiLib::CMarkup_const__
lea eax, [edi + 0xb4]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebx + 0xb4]
call fcn.1102f710
mov dword [ebx + 0xcc], 0
mov dword [ebx + 0xd0], vtable.DuiLib::CStdStringPtrMap.0
mov eax, dword [edi + 0xd4]
mov dword [ebx + 0xd4], eax
mov eax, dword [edi + 0xd8]
mov dword [ebx + 0xd8], eax
mov eax, dword [edi + 0xdc]
mov dword [ebx + 0xdc], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4