joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10102ab0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1024afb8
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x10102bfc
cmp byte [ebx + 0x3d], 0
je 0x10102bfc
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x10102b04
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
push esi
mov dword [ebp - 4], 0
push edi
mov ecx, dword [ebp - 0x14]
nop dword [eax]
cmp ecx, 0x10
lea eax, [ebp - 0x10]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10102b7e
sub eax, 1
je 0x10102b82
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x10102bd5
xor bl, bl
jmp 0x10102bd7
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x10]
cmovae eax, edx
sub esi, eax
je 0x10102bb7
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.101e817b
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x10102b7a
cmp byte [ebx + 0x3d], 0
je 0x10102bd5
test esi, esi
jne 0x10102b40
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.100189f0
jmp 0x10102b36
mov bl, 1
pop edi
pop esi
cmp ecx, 0x10
jb 0x10102beb
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.10004b10
mov al, bl
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov al, 1
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1010e2b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x24
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x4f5bc]
test eax, eax
je 0x1010e2d9
push 2
push 0
push 0x20
push dword [ebx + 0x4f5c0]
call eax
add esp, 0x10
test eax, eax
jne 0x1010e4ac
push esi
xor esi, esi
xor eax, eax
mov dword [esp + 8], esi
cmp ax, word [ebx + 0x14]
jae 0x1010e487
push ebp
push edi
nop
xor edi, edi
xor eax, eax
mov dword [esp + 0x20], edi
cmp ax, word [ebx + 0x16]
jae 0x1010e474
mov eax, esi
and eax, 7
lea edx, [eax + eax]
mov dword [esp + 0x30], edx
nop
movzx ecx, word [ebx + 0x492bc]
mov eax, edi
and eax, 1
or eax, edx
mov edx, esi
shr edx, cl
lea ebp, [eax + eax]
movzx eax, word [ebx + 0x1e]
imul edx, eax
mov eax, edi
shr eax, cl
mov ecx, ebp
mov dword [esp + 0x28], ebp
add edx, eax
mov eax, dword [ebx + 0x188]
shr eax, cl
and eax, 3
lea ecx, [eax + edx*4]
mov eax, dword [ebx + 8]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
mov dword [esp + 0x2c], eax
jne 0x1010e45f
mov eax, dword [esp + 0x10]
xor esi, esi
add eax, 2
mov dword [esp + 0x1c], esi
xor edx, edx
mov dword [esp + 0x18], edx
lea ebp, [eax - 4]
cmp ebp, eax
ja 0x1010e45b
nop dword [eax]
lea ecx, [edi + 2]
lea eax, [ecx - 4]
mov dword [esp + 0x14], ecx
cmp eax, ecx
ja 0x1010e43a
movzx edi, word [ebx + 0x14]
mov ecx, ebp
and ecx, 7
add ecx, ecx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x14]
cmp ebp, edi
jae 0x1010e42d
movzx ecx, word [ebx + 0x16]
cmp eax, ecx
jae 0x1010e429
mov edx, dword [ebx + 0x188]
mov ecx, eax
and ecx, 1
mov edi, edx
or ecx, dword [esp + 0x24]
add ecx, ecx
shr edi, cl
mov ecx, dword [esp + 0x28]
shr edx, cl
xor edx, edi
test dl, 3
jne 0x1010e421
movzx ecx, word [ebx + 0x492bc]
mov esi, ebp
shr esi, cl
mov edx, eax
movzx ecx, word [ebx + 0x1e]
and edi, 3
imul esi, ecx
movzx ecx, word [ebx + 0x492bc]
shr edx, cl
mov ecx, dword [ebx + 8]
add esi, edx
lea edx, [edi + esi*4]
mov esi, dword [esp + 0x1c]
movzx ecx, word [ecx + edx*2]
mov edx, dword [esp + 0x18]
movzx edi, word [ebx + 0x14]
test cx, cx
je 0x1010e429
inc esi
add edx, ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], edx
jmp 0x1010e429
mov edx, dword [esp + 0x18]
movzx edi, word [ebx + 0x14]
mov ecx, dword [esp + 0x14]
inc eax
cmp eax, ecx
jbe 0x1010e3a5
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebp
add eax, 2
cmp ebp, eax
jbe 0x1010e380
test esi, esi
je 0x1010e45b
mov eax, edx
mov ecx, dword [esp + 0x2c]
xor edx, edx
div esi
mov word [ecx], ax
mov esi, dword [esp + 0x10]
movzx eax, word [ebx + 0x16]
inc edi
mov edx, dword [esp + 0x30]
mov dword [esp + 0x20], edi
cmp edi, eax
jb 0x1010e310
movzx eax, word [ebx + 0x14]
inc esi
mov dword [esp + 0x10], esi
cmp esi, eax
jb 0x1010e2f0
pop edi
pop ebp
mov eax, dword [ebx + 0x4f5bc]
pop esi
test eax, eax
je 0x1010e4a7
push 2
push 1
push 0x20
push dword [ebx + 0x4f5c0]
call eax
add esp, 0x10
test eax, eax
jne 0x1010e4c3
pop ebx
add esp, 0x24
ret
push 0x103aec5c
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 6
push eax
call fcn.101e00bb
push 0x103aec5c
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 6
push eax
call fcn.101e00bb
int3
Function at 0x10114a90
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x56c
push ebx
push esi
mov esi, dword [esp + 0x578]
mov ebx, ecx
push edi
push esi
push 0xff
call fcn.101f1dd5
push esi
push 0xd8
call fcn.101f1dd5
mov edi, dword [esp + 0x590]
add esp, 0x10
mov ecx, str.Exif
lea eax, [edi + 6]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10114af0
test dl, dl
je 0x10114aec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10114af0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10114ad0
xor eax, eax
jmp 0x10114af5
sbb eax, eax
or eax, 1
test eax, eax
je 0x10114b57
movq xmm0, qword [0x10273bbc]
mov ax, word [0x10273bc4]
push 0x568
movq qword [esp + 0x10], xmm0
mov word [esp + 0x18], ax
call dword [sym.imp.WS2_32.dll_htons]
push esi
push 0xa
mov word [esp + 0x16], ax
lea eax, [esp + 0x14]
push 1
push eax
call fcn.101e817b
add esp, 0x10
lea eax, [esp + 0x18]
mov ecx, ebx
push 0
push eax
call fcn.1012e1f0
push esi
push 0x560
lea eax, [esp + 0x20]
push 1
push eax
call fcn.101e817b
add esp, 0x10
mov eax, dword [esp + 0x584]
push esi
add eax, 0xfffffffe
push eax
lea eax, [edi + 2]
push 1
push eax
call fcn.101e817b
add esp, 0x10
pop edi
pop esi
pop ebx
add esp, 0x56c
ret 0xc
Function at 0x10117b0a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
sub esp, 0x14
add eax, 0xfffffffd
push ebx
push esi
push edi
mov edi, ecx
cmp eax, 9
ja case.0x101179ad.6
jmp dword [eax*4 + 0x10117b8c]
call fcn.101178d0
movzx eax, ax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fstp qword [esp + 0x18]
fld qword [esp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.10114f90
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1039cc50]
movsd qword [esp + 0x18], xmm0
fld qword [esp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.10114f90
mov ecx, edi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1039cc50]
movsd qword [esp + 0x10], xmm0
call fcn.10114f90
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1039cc50]
ucomisd xmm0, qword [0x1039bf08]
lahf
test ah, 0x44
jp 0x10117a51
movsd xmm0, qword [0x1039c208]
fld qword [esp + 0x10]
movsd qword [esp + 0x18], xmm0
fdiv qword [esp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.101178d0
cwde
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fstp qword [esp + 0x18]
fld qword [esp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.10114f90
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fstp qword [esp + 0x18]
fld qword [esp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.10114f90
mov ecx, edi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
call fcn.10114f90
movd xmm0, eax
cvtdq2pd xmm0, xmm0
ucomisd xmm0, qword [0x1039bf08]
lahf
test ah, 0x44
jp 0x10117add
movsd xmm0, qword [0x1039c208]
fld qword [esp + 0x10]
movsd qword [esp + 0x18], xmm0
fdiv qword [esp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.10114f90
push eax
mov ecx, edi
call fcn.10117980
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x1234
call dword [sym.imp.WS2_32.dll_ntohs]
xor ecx, ecx
mov edx, 0x1234
cmp ax, dx
mov edx, 0x4949
sete cl
xor eax, eax
cmp word [edi + 0x492d8], dx
mov edx, 7
sete al
xor ebx, ebx
cmp eax, ecx
cmove ebx, edx
xor esi, esi
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ecx, esi
inc esi
xor ecx, ebx
mov byte [esp + ecx + 0x10], al
cmp esi, 8
jl 0x10117b41
fld qword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
pop edi
pop esi
pop ebx
fstp qword [esp + 0xc]
fld qword [esp + 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1011b730
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
mov edi, ecx
cdq
push 0
push edx
push eax
mov ecx, dword [edi + 0x49280]
mov esi, dword [ecx]
call dword [esi + 0xc]
mov ecx, edi
call fcn.10114f90
mov ebp, eax
cmp ebp, 0xff
ja 0x1011b920
test ebp, ebp
je 0x1011b90e
push ebx
mov ebx, 0x10bf
nop dword [eax]
mov ecx, edi
dec ebp
call fcn.101178d0
mov ecx, edi
movzx esi, ax
call fcn.101178d0
mov ecx, dword [edi + 0x49280]
movzx eax, ax
mov dword [esp + 0x18], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov dword [esp + 0x10], eax
cmp esi, 0x100
jne 0x1011b7bd
mov ecx, edi
call fcn.101178d0
mov ecx, edi
mov word [edi + 0x10], ax
call fcn.101178d0
mov word [edi + 0x12], ax
jmp 0x1011b8ed
cmp esi, 0x121
jne 0x1011b7f2
mov ecx, edi
call fcn.101178d0
mov ecx, edi
mov word [edi + 0x14], ax
call fcn.101178d0
mov ecx, 0x10bc
mov word [edi + 0x16], ax
cmp ax, cx
jne 0x1011b8ed
mov word [edi + 0x16], bx
jmp 0x1011b8ed
cmp esi, 0x130
jne 0x1011b82d
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ecx, dword [edi + 0x49280]
sar eax, 7
mov dword [edi + 0x49314], eax
mov eax, dword [ecx]
call dword [eax + 0x18]
shr eax, 3
not eax
and eax, 1
mov word [edi + 0x492be], ax
jmp 0x1011b8ed
cmp esi, 0x131
jne 0x1011b86f
mov dword [edi + 0x188], 9
lea esi, [edi + 0x1d3]
mov ebx, 0x24
nop word [eax + eax]
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
call dword [eax + 0x18]
and al, 3
lea esi, [esi - 1]
mov byte [esi + 1], al
sub ebx, 1
jne 0x1011b850
mov ebx, 0x10bf
jmp 0x1011b8ed
cmp esi, 0x2ff0
jne 0x1011b8a7
xor esi, esi
nop dword [eax]
mov ecx, edi
call fcn.101178d0
movzx eax, ax
movd xmm0, eax
mov eax, esi
cvtdq2ps xmm0, xmm0
xor eax, 1
inc esi
movss dword [edi + eax*4 + 0x2480c], xmm0
cmp esi, 4
jb 0x1011b880
jmp 0x1011b8ed
cmp esi, 0xc000
jne 0x1011b8ed
movsx esi, word [edi + 0x492d8]
mov eax, 0x4949
mov ecx, edi
mov word [edi + 0x492d8], ax
call fcn.10114f90
cmp eax, 0x2710
jbe 0x1011b8d7
mov ecx, edi
call fcn.10114f90
mov ecx, edi
mov word [edi + 0x16], ax
call fcn.10114f90
mov word [edi + 0x14], ax
mov word [edi + 0x492d8], si
mov ecx, dword [edi + 0x49280]
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x10]
push 0
mov edx, dword [ecx]
push 0
push eax
call dword [edx + 0xc]
test ebp, ebp
jne 0x1011b770
pop ebx
movzx eax, word [edi + 0x49314]
mov cx, ax
shl word [edi + 0x14], cl
shr word [edi + 0x16], cl
pop edi
pop esi
pop ebp
pop ecx
ret 4
Function at 0x1011d430
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2074
call fcn.101dd2b0
mov eax, ecx
xor edx, edx
push ebx
push ebp
mov ebp, dword [esp + 0x2084]
mov ecx, 0x40
sub ecx, dword [esp + 0x2080]
xorps xmm0, xmm0
push esi
movlpd qword [esp + 0x10], xmm0
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x40]
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], eax
movups xmmword [esp + 0x34], xmm0
mov dword [esp + 0x30], edx
mov dword [esp + 0x20], ecx
nop
mov ecx, dword [eax + 0x49280]
test edx, edx
mov eax, dword [esp + 0x2090]
cmovne eax, dword [esp + 0x2094]
push 0
mov esi, dword [ecx]
cdq
push edx
push eax
call dword [esi + 0xc]
mov eax, dword [esp + 0x10]
xor esi, esi
xor ecx, ecx
mov dword [esp + 0x28], esi
xor edx, edx
cmp cx, word [eax + 0x16]
jae 0x1011d571
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x2c], ecx
sub edx, dword [esp + 0x2088]
mov dword [esp + 0x1c], edx
jns 0x1011d526
nop
movq xmm1, qword [esp + 0x14]
xor esi, esi
movd xmm0, ebp
psllq xmm1, xmm0
movq qword [esp + 0x14], xmm1
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test ebp, ebp
jle 0x1011d51a
mov ecx, dword [eax + 0x49280]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ecx, esi
add esi, 8
shl eax, cl
or ebx, eax
mov eax, dword [esp + 0x10]
cmp esi, ebp
jl 0x1011d4f2
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
add edx, ebp
mov dword [esp + 0x1c], edx
js 0x1011d4d0
mov esi, dword [esp + 0x28]
mov ecx, 0x40
mov eax, ebx
sub ecx, edx
mov edx, edi
sub ecx, dword [esp + 0x2088]
call fcn.101dd800
mov ecx, dword [esp + 0x24]
call fcn.101dd820
mov ecx, dword [esp + 0x2c]
inc esi
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x28], esi
mov word [ecx], ax
add ecx, 2
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], ecx
movzx eax, word [eax + 0x16]
cmp esi, eax
mov eax, dword [esp + 0x10]
jl 0x1011d4c1
mov edx, dword [esp + 0x30]
add dword [esp + 0x20], 0x1020
inc edx
mov dword [esp + 0x30], edx
cmp edx, 2
jl 0x1011d480
movzx ebx, word [eax + 0x16]
xor edi, edi
dec ebx
test ebx, ebx
jle 0x1011d614
nop word [eax + eax]
movzx eax, word [esp + edi*2 + 0x1066]
mov edx, edi
movzx esi, word [esp + edi*2 + 0x44]
and edx, 1
sub esi, eax
mov ecx, esi
sar ecx, 0x1f
mov eax, ecx
xor eax, esi
movzx esi, word [esp + edi*2 + 0x1064]
sub eax, ecx
movd xmm0, eax
movzx eax, word [esp + edi*2 + 0x46]
sub esi, eax
cvtdq2pd xmm0, xmm0
mov ecx, esi
sar ecx, 0x1f
mov eax, ecx
xor eax, esi
sub eax, ecx
addsd xmm0, qword [esp + edx*8 + 0x34]
movsd qword [esp + edx*8 + 0x34], xmm0
mov edx, edi
movd xmm0, eax
not edx
cvtdq2pd xmm0, xmm0
and edx, 1
inc edi
addsd xmm0, qword [esp + edx*8 + 0x34]
movsd qword [esp + edx*8 + 0x34], xmm0
cmp edi, ebx
jl 0x1011d5a0
movups xmm0, xmmword [esp + 0x34]
jmp 0x1011d617
xorps xmm0, xmm0
movaps xmm1, xmm0
unpckhpd xmm1, xmm0
divsd xmm0, xmm1
call fcn.101f3720
mulsd xmm0, qword [0x1039c3e8]
pop edi
pop esi
pop ebp
pop ebx
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x14], xmm0
fld dword [esp + 0x14]
add esp, 0x2074
ret 0x10
Function at 0x10121930
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0xc], 0
push ebx
push ebp
push esi
push edi
mov esi, ecx
je 0x10121a73
mov eax, dword [esi + 0x4927c]
mov dword [eax + 0x220], 0
mov eax, dword [esi + 0x4927c]
mov edx, dword [eax + 0x220]
cmp edx, 4
jae 0x10121998
mov ecx, dword [esp + 0x20]
nop word [eax + eax]
imul ecx, ecx, 0x2e90edd
inc ecx
mov dword [eax + edx*4 + 0x20], ecx
mov eax, dword [esi + 0x4927c]
inc dword [eax + 0x220]
mov eax, dword [esi + 0x4927c]
mov edx, dword [eax + 0x220]
cmp edx, 4
jb 0x10121970
mov edx, dword [esi + 0x4927c]
mov ecx, dword [edx + 0x28]
xor ecx, dword [edx + 0x20]
mov eax, dword [edx + 0x2c]
add eax, eax
shr ecx, 0x1f
or ecx, eax
mov dword [edx + 0x2c], ecx
mov eax, dword [esi + 0x4927c]
mov dword [eax + 0x220], 4
mov eax, dword [esi + 0x4927c]
cmp dword [eax + 0x220], 0x7f
jae 0x10121a12
mov edi, dword [esi + 0x4927c]
mov edx, dword [edi + 0x220]
mov ecx, dword [edi + edx*4 + 0x1c]
xor ecx, dword [edi + edx*4 + 0x14]
mov eax, dword [edi + edx*4 + 0x18]
xor eax, dword [edi + edx*4 + 0x10]
add eax, eax
shr ecx, 0x1f
or ecx, eax
mov dword [edi + edx*4 + 0x20], ecx
mov eax, dword [esi + 0x4927c]
inc dword [eax + 0x220]
mov eax, dword [esi + 0x4927c]
cmp dword [eax + 0x220], 0x7f
jb 0x101219d0
mov eax, dword [esi + 0x4927c]
mov dword [eax + 0x220], 0
mov eax, dword [esi + 0x4927c]
mov eax, dword [eax + 0x220]
cmp eax, 0x7f
jae 0x10121a73
mov ebx, dword [sym.imp.WS2_32.dll_htonl]
nop dword [eax]
mov edi, dword [esi + 0x4927c]
push dword [edi + eax*4 + 0x20]
call ebx
mov ecx, dword [edi + 0x220]
mov dword [edi + ecx*4 + 0x20], eax
mov eax, dword [esi + 0x4927c]
inc dword [eax + 0x220]
mov eax, dword [esi + 0x4927c]
mov eax, dword [eax + 0x220]
cmp eax, 0x7f
jb 0x10121a40
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x10121abe
mov ebx, dword [esp + 0x14]
nop
mov edi, dword [esi + 0x4927c]
lea ebx, [ebx + 4]
mov edx, dword [edi + 0x220]
lea ecx, [edx - 0x3f]
and ecx, 0x7f
lea eax, [edx + 1]
and eax, 0x7f
and edx, 0x7f
mov ecx, dword [edi + ecx*4 + 0x20]
xor ecx, dword [edi + eax*4 + 0x20]
mov dword [edi + edx*4 + 0x20], ecx
xor dword [ebx - 4], ecx
mov eax, dword [esi + 0x4927c]
inc dword [eax + 0x220]
sub ebp, 1
jne 0x10121a80
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x10122890
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
push ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
movzx eax, word [edi + 0x492d8]
mov ecx, dword [edi + 0x49280]
mov dword [esp + 0x20], eax
mov eax, ebx
cdq
push edx
mov esi, dword [ecx]
push eax
call dword [esi + 0xc]
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
call dword [eax + 0x18]
test eax, eax
jne 0x10122a96
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
call dword [eax + 0x18]
sub eax, 0x4d
jne 0x10122a96
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
call dword [eax + 0x18]
sub eax, 0x52
jne 0x10122a96
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
call dword [eax + 0x18]
imul eax, eax, 0x101
mov ecx, edi
mov word [edi + 0x492d8], ax
call fcn.10114f90
mov ecx, dword [edi + 0x49280]
add ebx, 8
add ebx, eax
mov dword [esp + 0x10], ebx
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov dword [esp + 0x24], eax
cmp eax, ebx
jge 0x10122a7f
nop
xor esi, esi
lea ebx, [esi + 4]
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
call dword [eax + 0x18]
shl esi, 8
or esi, eax
sub ebx, 1
jne 0x10122945
mov ecx, edi
call fcn.10114f90
mov ebp, eax
cmp esi, 0x505244
je 0x10122a1a
cmp esi, 0x545457
je 0x101229f2
cmp esi, 0x574247
jne 0x10122a47
mov ecx, edi
call fcn.10114f90
mov ecx, str.DiMAGE_A200
lea eax, [edi + 0xf8]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x101229b5
test dl, dl
je 0x101229b1
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x101229b5
add eax, 2
add ecx, 2
test dl, dl
jne 0x10122995
xor eax, eax
jmp 0x101229ba
sbb eax, eax
or eax, 1
xor ecx, ecx
mov ebx, 3
test eax, eax
cmovne ebx, ecx
xor esi, esi
mov ecx, edi
call fcn.101178d0
movzx eax, ax
movd xmm0, eax
mov eax, esi
sar eax, 1
xor eax, esi
inc esi
cvtdq2ps xmm0, xmm0
xor eax, ebx
movss dword [edi + eax*4 + 0x2480c], xmm0
cmp esi, 4
jl 0x101229c8
jmp 0x10122a47
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
push eax
mov ecx, edi
call fcn.1012c7a0
mov eax, dword [esp + 0x10]
cdq
mov dword [edi + 0x492f8], eax
mov dword [edi + 0x492fc], edx
jmp 0x10122a47
mov ecx, dword [edi + 0x49280]
push 1
push 0
push 8
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, edi
call fcn.101178d0
movzx eax, ax
mov ecx, edi
mov dword [esp + 0x14], eax
call fcn.101178d0
movzx eax, ax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [edi + 0x49280]
add eax, 8
add eax, ebp
push 0
cdq
mov esi, dword [ecx]
push edx
push eax
call dword [esi + 0xc]
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov dword [esp + 0x24], eax
cmp eax, dword [esp + 0x10]
jl 0x10122940
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov word [edi + 0x12], ax
mov eax, dword [esp + 0x1c]
mov word [edi + 0x10], bp
mov word [edi + 0x492d8], ax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x1012e040
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x24
push ebx
mov ebx, ecx
lea edx, [esp + 8]
push ebp
mov ebp, 2
mov dword [esp + 8], ebx
push ebp
mov ecx, dword [ebx + 0x49280]
xorps xmm0, xmm0
push ebp
push edx
movups xmmword [esp + 0x20], xmm0
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [esp + 0x30]
movsd xmm0, qword [esp + 0x1c]
sub eax, ebp
je 0x1012e134
movsd qword [esp + 0x24], xmm0
movsd xmm0, qword [esp + 0x14]
push esi
movsd qword [esp + 0x18], xmm0
push edi
mov ecx, dword [ebx + 0x49280]
lea esi, [esp + 0x14]
dec eax
lea esi, [esi + ebp*2]
push 1
mov dword [esp + 0x3c], eax
mov eax, dword [ecx]
push 2
push esi
call dword [eax + 8]
movzx esi, byte [esi]
mov ebx, ebp
movzx ecx, byte [esp + ebp*2 + 0x15]
xor ebx, 2
movzx edi, byte [esp + ebx*2 + 0x14]
movzx edx, byte [esp + ebx*2 + 0x15]
mov eax, edi
shl eax, 8
or edx, eax
mov eax, esi
shl eax, 8
or ecx, eax
movzx eax, byte [esp + ebp*2 + 0x15]
sub edx, ecx
shl eax, 8
movzx ecx, byte [esp + ebx*2 + 0x15]
or eax, esi
shl ecx, 8
inc ebp
mov ebx, dword [esp + 0x10]
or ecx, edi
movd xmm0, edx
sub ecx, eax
cvtdq2pd xmm0, xmm0
mov eax, dword [esp + 0x38]
and ebp, 3
mulsd xmm0, xmm0
addsd xmm0, qword [esp + 0x1c]
movaps xmm1, xmm0
movd xmm0, ecx
movsd qword [esp + 0x1c], xmm1
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm0
addsd xmm0, qword [esp + 0x2c]
movsd qword [esp + 0x2c], xmm0
test eax, eax
jne 0x1012e090
pop edi
pop esi
jmp 0x1012e13a
movsd xmm1, qword [esp + 0x14]
comisd xmm0, xmm1
mov eax, 0x4949
mov ecx, 0x4d4d
pop ebp
pop ebx
cmova eax, ecx
add esp, 0x24
ret 4
Function at 0x10138b80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0x10]
push eax
mov dword [esi + 0x34], eax
call fcn.101e30cd
xor edi, edi
mov dword [esi + 0x30], eax
add esp, 4
cmp dword [esi + 0x18], edi
jbe 0x10138bf2
push ebp
mov ebp, 0x3bcd0
mov ecx, 0x11f9f253
nop
imul eax, ebx, 0x63d
xor edx, edx
add eax, 0xca25
div ebp
mov ebx, edx
mov eax, ebx
mul ecx
mov ecx, ebx
shrd eax, edx, 0x18
shl ecx, 8
sub ecx, eax
sar edx, 0x18
shr ecx, 1
add ecx, eax
mov eax, dword [esi + 0x14]
shr ecx, 0x11
xor cl, byte [edi + eax]
mov eax, dword [esi + 0x30]
mov byte [edi + eax], cl
inc edi
mov ecx, 0x11f9f253
cmp edi, dword [esi + 0x18]
jb 0x10138bb0
pop ebp
pop edi
pop esi
pop ebx
ret