joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000da60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push ecx
call fcn.1000cd00
add esp, 4
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
lea ecx, [ebp - 4]
push eax
call fcn.1000dad0
mov dword [ebp - 0x14], 4
mov esi, dword [eax]
lea eax, [ebp - 0x10]
push eax
push 0x40
push 4
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 0xc]
mov esi, dword [esi]
test eax, eax
je 0x1000dabd
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push ecx
push dword [ebp - 0x14]
mov dword [ebp - 4], ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000db50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
shl eax, 2
mov dword [ebp - 0x10], 0
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jne 0x1000db7b
mov byte [ebp - 4], al
mov dword [esi], edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 4]
mov dword [esi], edi
test eax, eax
je 0x1000dbb2
mov eax, dword [ebp - 8]
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp - 0xc]
mov dword [ebp + 0x10], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000dbc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
xor edx, edx
mov dword [ebp - 0x10], edx
push ebx
push esi
mov esi, dword [ebp + 8]
test eax, eax
jne 0x1000dbdc
xor al, al
jmp 0x1000dbf8
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0x10]
test eax, eax
setne al
mov byte [ebp - 4], al
mov bl, byte [esi]
test al, al
je 0x1000dc16
mov ecx, dword [ebp - 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push dword [ebp - 0xc]
mov dword [ebp + 0xc], ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000dc20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
mov dword [ebp - 0x10], 0
push ebx
mov bl, byte [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
test eax, eax
jne 0x1000dc48
mov byte [ebp - 4], al
mov byte [esi], bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], eax
push ecx
push 0x40
push eax
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne byte [ebp - 4]
mov byte [esi], bl
test eax, eax
je 0x1000dc7f
mov eax, dword [ebp - 8]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [ebp - 0xc]
mov dword [ebp + 0xc], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000e2a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 4]
mov al, byte [ebp + 0x10]
lea ecx, [edi + 4]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp + 0x10], ecx
xor ecx, ecx
test al, al
mov byte [edi + 0x14], 1
mov dword [edi + 0xc], esi
cmovne ecx, edx
mov dword [edi + 0x10], edx
mov byte [edi + 0x15], al
xor edi, edi
mov dword [ebp - 0x10], edi
test ecx, ecx
jne 0x1000e2e0
xor bl, bl
jmp 0x1000e2ff
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
push eax
push 0x40
push ecx
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [ebp - 0x10]
test eax, eax
mov edx, dword [ebp + 0xc]
setne bl
push edx
push esi
push dword [ebp + 0x10]
mov byte [ebp - 4], bl
call fcn.1005caa0
add esp, 0xc
test bl, bl
je 0x1000e328
mov eax, dword [ebp - 8]
lea ecx, [ebp + 0x10]
push ecx
push eax
push dword [ebp - 0xc]
mov dword [ebp + 0x10], eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000ea10
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x10014300
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.10014e90
cmp byte [0x1009a3b5], 0
jne 0x1000eb26
mov eax, dword [0x100972ac]
push 0x100144f0
push 0xfffffffffffffffc
mov eax, dword [eax + 0x14]
push dword [eax]
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
mov dword [0x1009a32c], eax
call fcn.1001ec00
mov eax, dword [0x100972ac]
mov eax, dword [eax + 0x14]
push dword [eax]
call fcn.100426e0
push dword [0xc97c28]
call fcn.10041c70
call fcn.10021fd0
push 1
mov dword [eax + 0x2c], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x80], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x78], 0
mov dword [eax + 0x88], 0
mov dword [eax + 0x10], 0
mov dword [eax + 0x20], 0x3f000000
call fcn.10059a20
add esp, 0x10
test eax, eax
jne 0x1000eafb
push 0x100144c0
push 0x1009a338
push 0x10
call fcn.100599d0
push 0x10014430
push 0x1009a334
push 0x11
call fcn.100599d0
push 0x100143f0
push 0x1009a330
push 0x2a
call fcn.100599d0
add esp, 0x24
mov eax, dword [0x1009645c]
test eax, eax
je 0x1000eb1f
mov ecx, dword [0x10096460]
cmp ecx, dword [0x10096464]
jae 0x1000eb1f
mov dword [eax + ecx*4], 0x1009a3a0
inc dword [0x10096460]
mov byte [0x1009a3b5], 1
push esi
push edi
call fcn.10015ab0
mov esi, dword [0x1009645c]
mov eax, dword [0x10096460]
lea edi, [esi + eax*4]
cmp esi, edi
je 0x1000eb4e
nop
mov ecx, dword [esi]
call fcn.10016ef0
add esi, 4
cmp esi, edi
jne 0x1000eb40
pop edi
pop esi
ret

Function at 0x1000eb80
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x100972a0]
cmp byte [eax + 0x5c], 0
jne 0x1000eb95
call fcn.10015130
jmp fcn.10016130
ret
Function at 0x10014e90
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x100969c0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1009a3cc], 0
jne 0x10014fec
mov eax, dword [0x1009645c]
mov dword [0x1009a36c], 0x10014db0
test eax, eax
je 0x10014edb
mov ecx, dword [0x10096460]
cmp ecx, dword [0x10096464]
jae 0x10014edb
mov dword [eax + ecx*4], 0x1009a364
inc dword [0x10096460]
push str.GTASAModMenu.ini
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], 0
call fcn.10015790
movsd xmm0, qword [0x1007f8e0]
lea eax, [ebp - 0x24]
sub esp, 8
movsd qword [esp], xmm0
push 0x1007f858
push eax
call fcn.10014d70
add esp, 0x10
lea eax, [ebp - 0x44]
push dword [ebp - 0x48]
push 0x20
push eax
lea eax, [ebp - 0x24]
push eax
push str.OnFootSpeed
push str.Airbreak
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x44]
push eax
call fcn.1006240c
movsd xmm0, qword [0x1007f8e8]
lea eax, [ebp - 0x44]
push ecx
movsd qword [esp], xmm0
push 0x1007f858
push eax
fstp dword [0x1009656c]
call fcn.10014d70
add esp, 0x10
lea eax, [ebp - 0x24]
push dword [ebp - 0x48]
push 0x20
push eax
lea eax, [ebp - 0x44]
push eax
push str.InVehicleSpeed
push str.Airbreak
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x24]
push eax
call fcn.1006240c
add esp, 4
lea ecx, [ebp - 0x48]
fstp dword [0x10096570]
push 1
push str.SlowDownTime
push str.Airbreak
call fcn.10015560
push 0
push str.IgnoreWhileActive
push str.Airbreak
lea ecx, [ebp - 0x48]
mov byte [0x10096574], al
call fcn.10015560
push 1
push str.Enabled
push str.Airbreak
lea ecx, [ebp - 0x48]
mov byte [0x1009a360], al
call fcn.10015560
mov byte [0x10096568], al
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x10014fe5
push eax
call fcn.10064a9e
add esp, 4
mov byte [0x1009a3cc], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b715
mov esp, ebp
pop ebp
ret
Function at 0x10015000
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x100969c0]
xor eax, ebp
mov dword [ebp - 4], eax
push str.GTASAModMenu.ini
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], 0
call fcn.10015790
movsd xmm0, qword [0x1007f8e0]
lea eax, [ebp - 0x24]
sub esp, 8
movsd qword [esp], xmm0
push 0x1007f858
push eax
call fcn.10014d70
add esp, 0x10
lea eax, [ebp - 0x44]
push dword [ebp - 0x48]
push 0x20
push eax
lea eax, [ebp - 0x24]
push eax
push str.OnFootSpeed
push str.Airbreak
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x44]
push eax
call fcn.1006240c
movsd xmm0, qword [0x1007f8e8]
lea eax, [ebp - 0x44]
push ecx
movsd qword [esp], xmm0
push 0x1007f858
push eax
fstp dword [0x1009656c]
call fcn.10014d70
add esp, 0x10
lea eax, [ebp - 0x24]
push dword [ebp - 0x48]
push 0x20
push eax
lea eax, [ebp - 0x44]
push eax
push str.InVehicleSpeed
push str.Airbreak
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x24]
push eax
call fcn.1006240c
add esp, 4
lea ecx, [ebp - 0x48]
fstp dword [0x10096570]
push 1
push str.SlowDownTime
push str.Airbreak
call fcn.10015560
push 0
push str.IgnoreWhileActive
push str.Airbreak
lea ecx, [ebp - 0x48]
mov byte [0x10096574], al
call fcn.10015560
push 1
push str.Enabled
push str.Airbreak
lea ecx, [ebp - 0x48]
mov byte [0x1009a360], al
call fcn.10015560
mov byte [0x10096568], al
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x1001511a
push eax
call fcn.10064a9e
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b715
mov esp, ebp
pop ebp
ret
Function at 0x10015560
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100969c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push ebx
mov bl, byte [ebp + 0x10]
push esi
push dword [ecx]
mov esi, dword [ebp + 8]
test bl, bl
push 8
push eax
mov ecx, str.false
mov eax, str.true
cmove eax, ecx
push eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea esi, [ebp - 0xc]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x100155a1
push edi
xor edi, edi
sub esi, ecx
je 0x100155cd
nop
mov al, byte [ebp + edi - 0xc]
test al, al
je 0x100155cd
movsx eax, al
push eax
call fcn.10064bc2
mov byte [ebp + edi - 0xc], al
add esp, 4
inc edi
cmp edi, esi
jb 0x100155b0
mov ecx, str.true
lea eax, [ebp - 0xc]
pop edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100155f6
test dl, dl
je 0x100155f2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100155f6
add eax, 2
add ecx, 2
test dl, dl
jne 0x100155d6
xor eax, eax
jmp 0x100155fb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10015613
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005b715
mov esp, ebp
pop ebp
ret 0xc
mov ecx, str.false
lea eax, [ebp - 0xc]
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10015640
test dl, dl
je 0x1001563c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10015640
add eax, 2
add ecx, 2
test dl, dl
jne 0x10015620
xor ecx, ecx
jmp 0x10015645
sbb ecx, ecx
or ecx, 1
xor edx, edx
movzx eax, bl
test ecx, ecx
mov ecx, dword [ebp - 4]
pop esi
cmove eax, edx
xor ecx, ebp
pop ebx
call fcn.1005b715
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10016ef0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b305
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x100969c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push str.GTASAModMenu.ini
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], 0
call fcn.10015790
mov edx, dword [edi + 0x10]
xorps xmm0, xmm0
mov ecx, edx
mov dword [ebp - 4], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10016f54
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.10016dc0
mov esi, dword [ebp - 0x44]
push esi
push dword [edi]
mov byte [ebp - 4], 1
push dword [edi + 0x10]
push str.Hotkey
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [edi], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x28]
push str..Type
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10016c80
add esp, 0xc
cmp dword [eax + 0x14], 0xf
jbe 0x10016fa4
mov eax, dword [eax]
push esi
push dword [ebp - 0x48]
push eax
push str.Hotkey
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 0x2c]
mov dword [edi + 4], eax
cmp ecx, 0xf
jbe 0x10016fe7
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10016fdd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001703f
push ecx
push edx
call fcn.1005b3ed
add esp, 8
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x10017017
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1001700d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10017044
push ecx
push edx
call fcn.1005b3ed
add esp, 8
test esi, esi
je 0x10017024
push esi
call fcn.10064a9e
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005b715
mov esp, ebp
pop ebp
ret
call fcn.1005ef7f
call fcn.1005ef7f
int3

Function at 0x10017480
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov ecx, 0x40
mov esi, 0x1009a3f0
mov edi, 0x1009a4f0
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor esi, esi
nop dword [eax + eax]
push esi
call edi
test ax, ax
setne al
mov byte [esi + 0x1009a3f0], al
inc esi
cmp esi, 0x100
jl 0x100174a0
pop edi
pop esi
ret
Function at 0x10017640
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b3de
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x100969c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
xorps xmm0, xmm0
mov edi, dword [ebp + 8]
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
push 0
push 0x40
mov ecx, edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
call fcn.100174d0
mov esi, dword [ebp + 0xc]
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
add esi, 0xffffffdf
mov ecx, eax
cmp esi, 0x84
ja case.0x100176cd.41
movzx eax, byte [esi + 0x1001770c]
jmp dword [eax*4 + 0x10017704]
or ecx, 0x100
cmp dword [edi + 0x14], 0xf
mov eax, edi
jbe 0x100176e4
mov eax, dword [edi]
push 0x40
push eax
shl ecx, 0x10
push ecx
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10021410
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
lea edx, [ebp + 8]
mov esi, 4
mov eax, dword [edi + 0xf4]
mov ebx, dword [edi + 0xfc]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1007fb00]
sub esi, 1
jne 0x10021432
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x4000], ebx
jne 0x10021467
push esi
push dword [ebp + 8]
push 4
push ebx
call fcn.1001efd0
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x100214d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
lea edx, [ebp + 8]
mov esi, 4
mov eax, dword [edi + 0xf4]
mov ebx, dword [edi + 0xfc]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1007fb00]
sub esi, 1
jne 0x100214f2
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x4000], ebx
jne 0x10021527
push esi
push dword [ebp + 8]
push 0xc
push ebx
call fcn.1001efd0
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x10021530
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
lea esi, [ebp - 0x10]
mov edi, 0x10
movss xmm1, dword [edx + 0x110]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0x114]
subss xmm0, xmm1
mov ecx, dword [edx + 0xf4]
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 8], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xfc]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 4], xmm0
not edx
nop
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1007fb00]
sub edi, 1
jne 0x100215a0
pop edi
not edx
pop esi
mov eax, edx
mov esp, ebp
pop ebp
ret 4
Function at 0x10022de0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
not ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
test edi, edi
je 0x10022e43
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10022e26
cmp edi, 2
jb 0x10022e26
cmp byte [esi], cl
jne 0x10022e26
cmp byte [esi + 1], cl
jne 0x10022e26
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1007fb00]
jmp 0x10022df7
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1007fb00]
test edi, edi
jne 0x10022df7
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10022e78
nop word [eax + eax]
cmp cl, 0x23
jne 0x10022e5f
cmp byte [esi], cl
jne 0x10022e5f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1007fb00]
test cl, cl
jne 0x10022e50
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x100230c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
xor ecx, ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x100230e0
cmp eax, esi
jae 0x10023237
mov bl, byte [eax]
test bl, bl
je 0x10023237
movzx ecx, bl
mov edx, esi
shr ecx, 3
movsx edi, byte [ecx + 0x1008052c]
xor ecx, ecx
test edi, edi
mov dword [ebp - 8], edi
sete cl
add ecx, edi
mov dword [ebp - 0xc], ecx
test esi, esi
jne 0x1002310f
lea edx, [ecx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, bl
mov byte [ebp - 4], cl
cmp esi, edx
jae 0x10023126
mov bl, byte [esi]
mov byte [ebp - 1], bl
jmp 0x1002312a
mov byte [ebp - 1], 0
lea esi, [eax + 2]
cmp esi, edx
jae 0x10023135
mov ch, byte [esi]
jmp 0x10023137
xor ch, ch
lea ebx, [eax + 3]
mov byte [ebp - 3], ch
cmp ebx, edx
jae 0x10023145
mov bl, byte [ebx]
jmp 0x10023147
xor bl, bl
mov edi, dword [edi*4 + 0x1008054c]
movzx esi, byte [ebp - 1]
movzx edx, ch
movzx ecx, cl
and edi, ecx
mov byte [ebp - 2], bl
shl edi, 6
mov ecx, esi
and ecx, 0x3f
movzx ebx, bl
or edi, ecx
and esi, 0xc0
shl edi, 6
mov ecx, edx
and ecx, 0x3f
and edx, 0xc0
or edi, ecx
mov ecx, ebx
and ecx, 0x3f
shr ebx, 2
or ebx, edx
shl edi, 6
or edi, ecx
shr ebx, 2
mov ecx, dword [ebp - 8]
or ebx, esi
mov esi, dword [ebp - 8]
shr ebx, 2
mov ecx, dword [ecx*4 + 0x10080574]
shr edi, cl
cmp edi, dword [esi*4 + 0x10080560]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or ebx, ecx
mov ecx, edi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or ebx, edx
cmp ecx, edi
sbb ecx, ecx
and ecx, 0x100
or ebx, ecx
mov ecx, dword [esi*4 + 0x10080588]
xor ebx, 0x2a
sar ebx, cl
test ebx, ebx
je 0x10023229
xor edx, edx
cmp byte [ebp - 2], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 1], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 4], cl
setne cl
add edx, ecx
cmp dword [ebp - 0xc], edx
cmovl edx, dword [ebp - 0xc]
mov ecx, edx
add eax, ecx
mov ecx, dword [ebp - 0x10]
inc ecx
jmp 0x100230ce
mov ecx, dword [ebp - 0xc]
add eax, ecx
mov ecx, dword [ebp - 0x10]
inc ecx
jmp 0x100230ce
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100232a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
dec eax
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 0x14], ecx
lea eax, [ebx + eax*2]
mov dword [ebp - 0x18], eax
cmp ebx, eax
mov eax, dword [ebp + 0x10]
jae 0x10023456
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
push edi
nop dword [eax]
test esi, esi
je 0x100232dc
cmp eax, esi
jae 0x10023451
mov bl, byte [eax]
mov byte [ebp + 0xf], bl
test bl, bl
je 0x10023451
movzx ecx, bl
mov edx, esi
shr ecx, 3
xor ebx, ebx
movsx ecx, byte [ecx + 0x1008052c]
test ecx, ecx
mov dword [ebp - 0xc], ecx
sete bl
add ebx, ecx
test esi, esi
jne 0x1002330b
lea edx, [ebx + eax]
cmp eax, edx
lea esi, [eax + 1]
sbb cl, cl
and cl, byte [ebp + 0xf]
mov byte [ebp - 3], cl
cmp esi, edx
jae 0x10023323
mov ch, byte [esi]
mov byte [ebp + 0xf], ch
jmp 0x10023327
mov byte [ebp + 0xf], 0
lea esi, [eax + 2]
cmp esi, edx
jae 0x10023332
mov ch, byte [esi]
jmp 0x10023334
xor ch, ch
lea esi, [eax + 3]
mov byte [ebp - 2], ch
cmp esi, edx
jae 0x10023342
mov al, byte [esi]
jmp 0x10023344
xor al, al
movzx esi, byte [ebp + 0xf]
movzx edx, ch
movzx ecx, cl
movzx edi, al
mov byte [ebp - 1], al
mov eax, dword [ebp - 0xc]
mov eax, dword [eax*4 + 0x1008054c]
and eax, ecx
mov ecx, esi
and ecx, 0x3f
mov dword [ebp - 8], eax
shl dword [ebp - 8], 6
and esi, 0xc0
or dword [ebp - 8], ecx
mov ecx, edx
shl dword [ebp - 8], 6
and ecx, 0x3f
or dword [ebp - 8], ecx
and edx, 0xc0
shl dword [ebp - 8], 6
mov ecx, edi
mov eax, dword [ebp - 8]
and ecx, 0x3f
or eax, ecx
shr edi, 2
mov ecx, dword [ebp - 0xc]
or edi, edx
shr edi, 2
or edi, esi
shr edi, 2
mov ecx, dword [ecx*4 + 0x10080574]
shr eax, cl
mov esi, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
cmp esi, dword [eax*4 + 0x10080560]
sbb ecx, ecx
xor edx, edx
and ecx, 0x40
or edi, ecx
mov ecx, esi
and ecx, 0xfffff800
cmp ecx, 0xd800
mov ecx, 0x80
cmove edx, ecx
mov ecx, 0xffff
or edi, edx
cmp ecx, esi
sbb ecx, ecx
and ecx, 0x100
or edi, ecx
mov ecx, dword [eax*4 + 0x10080588]
mov eax, dword [ebp - 0x10]
xor edi, 0x2a
sar edi, cl
test edi, edi
je 0x10023434
xor edx, edx
mov esi, 0xfffd
cmp byte [ebp - 1], dl
setne dl
xor ecx, ecx
cmp byte [ebp - 2], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp + 0xf], cl
setne cl
add edx, ecx
xor ecx, ecx
cmp byte [ebp - 3], cl
setne cl
add edx, ecx
cmp ebx, edx
cmovl edx, ebx
mov ebx, edx
mov ecx, dword [ebp - 0x14]
add eax, ebx
mov dword [ebp - 0x10], eax
mov word [ecx], si
add ecx, 2
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x14], ecx
cmp ecx, dword [ebp - 0x18]
jb 0x100232d0
mov ebx, dword [ebp + 8]
pop edi
pop esi
xor edx, edx
mov word [ecx], dx
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x10023464
mov dword [edx], eax
sub ecx, ebx
sar ecx, 1
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret