joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10213970
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102c9b25
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0xd], 0
call fcn.10213320
cmp dword [ebp + 8], eax
jne 0x10213a75
cmp dword [ebp + 0x10], 0
jbe 0x10213a70
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jle 0x10213a70
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
shl eax, 1
push eax
lea ecx, [ebp - 0x1c]
call fcn.102137b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.1000f510
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [ebp - 0x1c]
call fcn.1000f510
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp - 0x1c]
call fcn.1000f510
push eax
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x10213a47
mov byte [ebp - 0xe], 1
jmp 0x10213a4b
mov byte [ebp - 0xe], 0
mov dl, byte [ebp - 0xe]
mov byte [ebp - 0xd], dl
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x10213a61
lea ecx, [ebp - 0x1c]
call fcn.100aa310
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.102137e0
jmp 0x10213b23
mov ecx, dword [ebp + 0x10]
add ecx, 4
push ecx
lea ecx, [ebp - 0x14]
call fcn.102137b0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.1000f510
test eax, eax
je 0x10213b14
lea ecx, [ebp - 0x14]
call fcn.1000f510
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x10213b14
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 0x10]
mov dword [edx], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x20]
add eax, 4
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.1000f510
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea ecx, [ebp - 0x14]
call fcn.1000f510
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x10213afa
mov byte [ebp - 0xf], 1
jmp 0x10213afe
mov byte [ebp - 0xf], 0
mov dl, byte [ebp - 0xf]
mov byte [ebp - 0xd], dl
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x10213b14
lea ecx, [ebp - 0x14]
call fcn.100aa310
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.102137e0
movzx eax, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10213b40
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
cmp dword [ebp + 0xc], 0
je 0x10213b62
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x28]
call fcn.102138d0
movzx ecx, al
test ecx, ecx
jne 0x10213b69
xor al, al
jmp 0x10213cc0
mov byte [ebp - 1], 0
call fcn.10213320
cmp dword [ebp + 8], eax
jne 0x10213c54
push 0xd
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x10213c00
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10213bfe
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10213bfe
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp + 0x10]
ja 0x10213bf4
push 0
push 0
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [ebp - 1], 1
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x10213c52
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x10213c52
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10213c52
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x10213c52
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp + 0xc]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [ebp - 1], 1
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x10213cbd
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x10213cbd
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10213cbd
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10213cbd
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp + 0x10]
ja 0x10213cb3
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x14]
add eax, 4
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov byte [ebp - 1], 1
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10213cd0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0xc], 0
call fcn.10213320
cmp dword [ebp + 8], eax
jne 0x10213db7
push 0xd
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x10213d48
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10213d46
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10213d46
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x1c]
push ecx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x10213db5
push 1
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x10213db5
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10213db5
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x10213db5
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 1], cl
add dword [ebp - 8], 1
cmp byte [ebp - 1], 0
jne 0x10213d87
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x10213e07
call fcn.100340c0
cmp dword [ebp + 8], eax
je 0x10213e07
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x10213e07
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x10213e07
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x10213e07
mov edx, dword [ebp - 0x24]
mov eax, dword [edx]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10226880
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1043f49c]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x14]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp + 8]
call fcn.10013020
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov dword [ebp - 8], 0
jmp 0x102268c6
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x1022690b
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 8]
mov al, byte [edx + 0x38]
mov byte [ecx + 0x141], al
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x102268f9
mov byte [ebp - 1], 1
jmp 0x102268fd
mov byte [ebp - 1], 0
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 8]
mov al, byte [ebp - 1]
mov byte [edx + 0x38], al
jmp 0x102268bd
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x244]
mov eax, dword [ecx + 0x248]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x24c], edx
mov dword [ecx + 0x250], eax
cvtsi2ss xmm0, dword [ebp - 0x14]
cvtsi2ss xmm1, dword [ebp - 0x10]
push ecx
movss dword [esp], xmm1
push ecx
movss dword [esp], xmm0
lea ecx, [ebp - 0x1c]
call fcn.10027ec0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x244], edx
mov dword [ecx + 0x248], eax
mov esp, ebp
pop ebp
ret
Function at 0x10259a60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102ba830
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
push esi
mov ecx, 0x1043f540
call fcn.10261930
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x34], edx
mov ecx, 0x1043f540
call fcn.102618b0
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x14]
mov eax, dword [edx + 0x30]
call eax
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
push ecx
mov ecx, dword [ebp - 0x18]
call dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x10259acb
xor al, al
jmp 0x10259b96
mov ecx, 0x1043f540
call fcn.10261930
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
mov eax, dword [edx]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x38], ecx
push ecx
mov esi, esp
mov dword [ebp - 0x4c], esp
mov ecx, dword [ebp - 0x1c]
call fcn.100988f0
push eax
mov ecx, esi
call fcn.1000aa70
mov ecx, dword [ebp - 0x20]
call dword [ebp - 0x38]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10259b0f
xor al, al
jmp 0x10259b96
mov ecx, dword [ebp - 0x10]
call fcn.102593a0
mov edx, dword [eax]
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0
jne 0x10259b26
xor al, al
jmp 0x10259b96
mov ecx, 0x1043f540
call fcn.10261930
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x3c], edx
push ecx
mov ecx, esp
mov dword [ebp - 0x50], esp
mov eax, dword [ebp - 0x24]
push eax
call fcn.10017490
mov ecx, dword [ebp - 0x28]
call dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
cmp ecx, dword [ebp + 8]
je 0x10259b62
xor al, al
jmp 0x10259b96
mov ecx, 0x1043f540
call fcn.10261bf0
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x2c]
call dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x10]
call fcn.10259190
mov ecx, dword [ebp - 0x48]
mov dword [eax], ecx
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10269910
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x10269943
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
xor eax, dword [ebp + 0xc]
mov ecx, 0x1000193
mul ecx
push eax
mov edx, dword [ebp + 8]
add edx, 1
push edx
call fcn.10269910
add esp, 8
mov dword [ebp - 4], eax
jmp 0x10269949
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10269950
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0x811c9dc5
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x1026998e
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
add ecx, 1
mov dword [ebp + 8], ecx
mov edx, dword [ebp - 4]
xor edx, dword [ebp - 8]
mov dword [ebp - 4], edx
imul eax, dword [ebp - 4], 0x1000193
mov dword [ebp - 4], eax
jmp 0x1026995d
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10270610
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x18]
mov edx, dword [esi + 0x10]
mov ebx, dword [esi + 0x28]
sub edx, 8
test ebx, ebx
je case.default.0x1027064a
mov eax, ebx
and eax, 0xfffffffc
mov eax, dword [eax + 0x38]
test eax, eax
jns 0x1027063d
mov ecx, dword [esi + 0x1c]
sub ecx, eax
cmp edx, ecx
jb 0x1027068d
cmp edx, dword [esi + 0x1c]
jbe case.default.0x1027064a
mov ecx, dword [edx + 4]
mov eax, ecx
and eax, 7
jmp dword [eax*4 + 0x10270770]
movzx ecx, byte [ecx - 3]
mov eax, 0xfffffff8
shl ecx, 3
sub eax, ecx
add edx, eax
jmp 0x1027067c
cmp dword [edx - 8], 1
jne case.0x1027064a.3
mov ebx, dword [ebx + 0x34]
jmp case.0x1027064a.3
and ecx, 0xfffffff8
sub edx, ecx
test ebx, ebx
jne 0x10270628
test edi, edi
jne 0x1027073b
jmp 0x10270735
test edi, edi
je 0x1027072f
mov eax, dword [ebx + 0x34]
mov dword [esi + 0x28], eax
lea eax, [edx + 8]
push ecx
push esi
mov dword [esi + 0x10], eax
call fcn.10270df0
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
mov eax, ebx
pop ebx
ret
pop edi
mov eax, esi
pop esi
pop ebx
ret
mov dword [esi + 0x28], 0
mov eax, dword [esi + 0x1c]
add eax, 8
push eax
push esi
mov dword [esi + 0x10], eax
call fcn.10270df0
add esp, 8
mov eax, dword [esi + 8]
mov eax, dword [eax + 0xc8]
test eax, eax
je 0x10270768
push esi
call eax
add esp, 4
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
push ecx
push es
daa
adc byte [ecx + 6], ch
daa
adc byte [ebx + 6], ah
daa
adc byte [edi + 6], dh
daa
adc byte [ecx + 6], dl
daa
adc ah, ah
push es
daa
adc byte [esi + 6], ch
daa
adc byte [esi + 6], ch
daa
invalid
Function at 0x10273480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x14]
mov eax, esi
sub eax, ebx
push edi
mov edi, dword [esp + 0x1c]
sub eax, 0x40
push edi
sar eax, 2
push eax
push ebx
call fcn.10272bb0
mov ecx, eax
add esp, 0xc
test ecx, ecx
jne 0x10273537
lea ebp, [ebx + 0x40]
sub esi, 4
cmp esi, ebp
jbe case.0x10273508.17
mov eax, dword [esi]
mov ecx, eax
shr ecx, 8
movzx edx, al
movzx ebx, cl
mov cx, word [edx*2 + 0x102d2b10]
and cx, 7
cmp cx, 2
jne 0x102734ef
cmp edi, ebx
jb 0x102734b2
cmp edx, 0x2a
jne case.0x10273508.17
shr eax, 0x10
cmp edi, eax
ja 0x102734b2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
cmp cx, 1
jne 0x102734b2
cmp ebx, edi
jne 0x102734b2
add edx, 0xfffffff0
cmp edx, 0x27
ja case.0x10273508.17
movzx ecx, byte [edx + 0x10273614]
jmp dword [ecx*4 + 0x10273600]
mov ecx, dword [esp + 0x14]
mov edi, eax
mov eax, esi
shr edi, 0x10
sub eax, ecx
sub eax, 0x40
push edi
sar eax, 2
push eax
push ecx
call fcn.10272bb0
mov ecx, eax
add esp, 0xc
test ecx, ecx
je 0x102734b2
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov eax, 0x102d16a4
pop ebx
ret
mov ecx, dword [esp + 0x14]
shr eax, 0x10
not eax
pop edi
mov ecx, dword [ecx + 0x10]
pop esi
pop ebp
pop ebx
mov ecx, dword [ecx + eax*4]
mov eax, dword [esp + 0x10]
add ecx, 0x10
mov dword [eax], ecx
mov eax, str.global
ret
mov ecx, eax
shr ecx, 0x10
movzx edx, cl
mov ecx, dword [esp + 0x14]
not edx
mov ecx, dword [ecx + 0x10]
mov edx, dword [ecx + edx*4]
mov ecx, dword [esp + 0x20]
add edx, 0x10
mov dword [ecx], edx
mov ecx, dword [esi - 4]
cmp cl, 0x10
jne 0x102735b2
shr ecx, 8
movzx edx, cl
lea ecx, [ebx + 1]
cmp edx, ecx
jne 0x102735b2
shr eax, 8
xor eax, dword [esi - 4]
test eax, 0xffff0000
jne 0x102735b2
pop edi
pop esi
pop ebp
mov eax, str.method
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, str.field
pop ebx
ret
mov ecx, dword [esp + 0x14]
shr eax, 0x10
mov edx, dword [ecx + 0x38]
test edx, edx
jne 0x102735df
mov eax, dword [esp + 0x20]
mov edx, 0x102d4cc5
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov eax, str.upvalue
pop ebx
ret
test eax, eax
je 0x102735ef
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x102735e3
sub eax, 1
jne 0x102735e3
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [eax], edx
mov eax, str.upvalue
pop ebx
ret
Function at 0x10277460
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x10c
mov eax, dword [0x10357248]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x118]
push ebx
mov ebx, dword [esp + 0x118]
push esi
mov esi, dword [esp + 0x118]
push edi
mov edi, dword [esp + 0x128]
push eax
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x102774d5
cmp dword [esp + 0x12c], 0
jne 0x102774d5
push 0x102d1f34
push 0x102d1f38
push eax
push esi
call fcn.1026fa10
push edi
push 0x102d1f3c
push eax
push esi
call fcn.1026fa10
push 0xfffffffffffffffe
push esi
call fcn.1026d710
add esp, 0x28
jmp 0x102774df
push edi
push esi
call fcn.1026d480
add esp, 8
push 0x105
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1027753d
cmp eax, 0x105
je 0x1027753d
lea eax, [esp + 0xc]
push 0x5c
push eax
call sub.VCRUNTIME140.dll_strrchr
add esp, 8
test eax, eax
je 0x1027753d
mov byte [eax], 0
lea eax, [esp + 0xc]
push eax
push 0x102d1d34
push 0
push 0xffffffffffffffff
push esi
call fcn.1026dca0
add esp, 0xc
push eax
push esi
call fcn.1026fa10
push 0xfffffffffffffffe
push esi
call fcn.1026d710
add esp, 0x18
jmp 0x1027754b
push str.unable_to_get_ModuleFileName
push esi
call fcn.10270d50
add esp, 8
push ebx
push 0xfffffffffffffffe
push esi
call fcn.1026d8e0
mov ecx, dword [esp + 0x120]
add esp, 0xc
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.102b9520
add esp, 0x10c
ret
Function at 0x1027b8e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov ecx, dword [ebp + 0x10]
mov edx, 1
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x3c], esi
lea edi, [eax + ecx*8]
cmp edi, dword [ebx + 0x14]
jae 0x1027b946
nop dword [eax]
mov eax, dword [edi + 4]
cmp eax, 0xfffffffb
jne 0x1027b959
mov eax, dword [edi]
test edx, edx
je 0x1027b938
push dword [esp + 0x3c]
mov esi, dword [eax + 0xc]
add eax, 0x10
push esi
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp eax, esi
je 0x1027b980
xor edx, edx
mov esi, dword [esp + 0x3c]
add edi, 8
cmp edi, dword [ebx + 0x14]
jb 0x1027b910
push 0
push edx
push ebx
call fcn.1026f890
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0xfffffff2
jae 0x1027b987
test edx, edx
je 0x1027b938
movsd xmm0, qword [edi]
sub esp, 8
movsd qword [esp], xmm0
push str._.14g
push esi
call sym.cheat.dll_fprintf
add esp, 0x10
test eax, eax
jle 0x1027b938
mov edx, 1
jmp 0x1027b93a
sub edi, dword [ebx + 0x10]
sar edi, 3
push 4
inc edi
push edi
push ebx
call fcn.102707b0
int3
Function at 0x1027c200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov cl, byte [ebp + 0x81]
mov eax, dword [ebp + 0x210]
mov dl, cl
mov bl, byte [ebp + 0x82]
and dl, 0xc
neg dl
mov byte [esp + 0xb], bl
sbb dl, dl
and dl, 4
neg eax
sbb al, al
and cl, 3
and al, 0xe
shl cl, 3
or dl, al
mov al, byte [ebp + 0x1e0]
or dl, cl
and al, 1
or dl, al
cmp bl, dl
je 0x1027c465
mov al, dl
mov byte [ebp + 0x82], dl
and al, 3
lea ebx, [ebp + 0xb10]
push esi
push edi
cmp al, 1
jne 0x1027c29a
movzx ecx, word [0x102d2cde]
movzx esi, word [0x102d2ce4]
add ecx, 0x10001c30
movzx edi, word [0x102d2cea]
add esi, 0x10001c30
movzx eax, word [0x102d2cf2]
add edi, 0x10001c30
movzx ebp, word [0x102d2cf8]
jmp 0x1027c2ba
mov ecx, dword [ebx + 0x39c]
mov esi, dword [ebx + 0x3a8]
mov edi, dword [ebx + 0x3b4]
movzx eax, word [0x102d2cf4]
movzx ebp, word [0x102d2cfa]
lea eax, [eax + 0x10001c30]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x14], eax
lea ebp, [ebp + 0x10001c30]
mov dh, dl
mov dword [esp + 0x18], ebp
xor dh, byte [esp + 0x13]
mov al, dl
and al, 6
mov dword [ebx + 0x398], ecx
mov dword [ebx + 0x3a4], esi
mov dword [ebx + 0x3b0], edi
test dh, 6
je 0x1027c355
mov edi, ebx
test al, al
jne 0x1027c33c
lea esi, [ebx + 0x26c]
mov ecx, 0x55
rep movsd dword es:[edi], dword [esi]
test dl, 0x10
je 0x1027c3ca
mov dword [ebx + 0x114], 0x10004aca
mov dword [ebx + 0x118], 0x10004aca
mov dword [ebx + 0x11c], 0x10004aca
mov dword [ebx + 0x120], 0x10004aca
jmp 0x1027c3ca
test dl, 2
mov ecx, 0x10004aaf
mov eax, 0x10004ad7
cmovne eax, ecx
mov ecx, 0x55
rep stosd dword es:[edi], eax
jmp 0x1027c3ca
test al, al
jne 0x1027c3ca
mov dword [ebx + 0x12c], ecx
mov dword [ebx + 0x138], esi
mov dword [ebx + 0x144], edi
test dl, 0x10
je 0x1027c39a
mov dword [ebx + 0x114], 0x10004aca
mov dword [ebx + 0x118], 0x10004aca
mov dword [ebx + 0x11c], 0x10004aca
mov dword [ebx + 0x120], 0x10004aca
jmp 0x1027c3ca
mov eax, dword [ebx + 0x380]
mov dword [ebx + 0x114], eax
mov eax, dword [ebx + 0x384]
mov dword [ebx + 0x118], eax
mov eax, dword [ebx + 0x388]
mov dword [ebx + 0x11c], eax
mov eax, dword [ebx + 0x38c]
mov dword [ebx + 0x120], eax
mov ebp, dword [esp + 0x20]
test dh, 8
je 0x1027c41b
lea edi, [ebx + 0x154]
test dl, 8
jne 0x1027c40f
mov ecx, 0xaa
nop dword [eax]
nop word [eax + eax]
movzx eax, word [ecx + 0x102d2c48]
lea edi, [edi + 4]
add eax, 0x10001c30
add ecx, 2
mov dword [edi - 4], eax
cmp ecx, 0x136
jb 0x1027c3f0
jmp 0x1027c41b
mov ecx, 0x46
mov eax, 0x10004b54
rep stosd dword es:[edi], eax
test dl, 8
jne 0x1027c434
mov eax, dword [esp + 0x14]
mov dword [ebx + 0x154], eax
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x160], eax
test dl, 1
je 0x1027c463
test byte [esp + 0x13], 1
jne 0x1027c463
mov ax, word [ebp + 0x758]
lea edi, [ebp + 0xa90]
add ax, ax
mov ecx, 0x20
dec ax
movzx eax, ax
mov edx, eax
shl edx, 0x10
or eax, edx
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x102811c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
movzx eax, byte [ebp + 0x24]
lea edx, [eax*4 + 0x14]
call fcn.1027d960
mov esi, eax
lea ecx, [ebp + 0x40]
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 8], ecx
mov word [esi + 5], 8
mov byte [esi + 7], 0
movzx ecx, byte [ebp + 0x25]
add ecx, 0x20
mov eax, ecx
shr eax, 3
and al, 0x20
sub cl, al
mov al, byte [ebp + 0x24]
mov byte [ebp + 0x25], cl
mov byte [esp + 0x18], al
movzx ecx, al
test al, al
je 0x10281271
push ebx
lea ebx, [esi + 0x14]
mov esi, ecx
mov ecx, dword [esp + 0x18]
mov edx, 0x18
call fcn.1027d960
lea ebx, [ebx + 4]
lea ecx, [eax + 8]
mov word [eax + 5], 0x105
mov dword [eax + 0x10], ecx
mov dword [eax + 0xc], 0xffffffff
mov ecx, dword [ebp + 0x14]
movzx edx, word [ecx + edi*2]
inc edi
mov ecx, edx
shl edx, 0x18
shr ecx, 0xe
xor edx, ebp
and cl, 1
mov dword [eax + 0x14], edx
mov byte [eax + 7], cl
mov dword [ebx - 4], eax
cmp edi, esi
jb 0x10281222
mov esi, dword [esp + 0x10]
mov al, byte [esp + 0x1c]
pop ebx
mov byte [esi + 7], al
mov eax, esi
pop edi
pop esi
pop ebp
pop ecx
ret