joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc5a340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [esp + 4], 0
shl ecx, 3
sub eax, ecx
xor ecx, ecx
mov dword [esp + 8], 0
jmp 0xc59d30

Function at 0xc5aa80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, eax
mov eax, edx
push edi
mov edi, edx
sar eax, 0x1f
push esi
xor edi, eax
push ebx
sub edi, eax
sub esp, 0x1c
cmp edi, 7
mov esi, ecx
movzx ecx, byte [ecx]
mov dword [esp + 8], edx
jg 0xc5ab30
xor edx, edx
mov eax, ebp
call fcn.00c5a800
movzx ecx, byte [esi + 2]
mov ebx, edi
sar ebx, 2
mov eax, ebp
mov edx, ebx
call fcn.00c5a800
movsx ebx, byte [ebx + 0x11509a0]
mov dword [esp + 0xc], ebx
movzx eax, byte [esp + 0xc]
mov ebx, edi
sar ebx, 1
and ebx, 1
mov edx, ebx
sar al, 1
movsx eax, al
movzx ecx, byte [esi + eax + 2]
mov eax, ebp
call fcn.00c5a800
mov eax, dword [esp + 0xc]
mov edx, edi
and edx, 1
movzx eax, byte [ebx + eax + 0x11509a0]
sar al, 1
movsx eax, al
movzx ecx, byte [esi + eax + 2]
mov eax, ebp
call fcn.00c5a800
test edi, edi
je 0xc5ac07
mov edx, dword [esp + 8]
mov eax, ebp
movzx ecx, byte [esi + 1]
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
shr edx, 0x1f
jmp fcn.00c5a800
mov edx, 1
mov eax, ebp
call fcn.00c5a800
movzx ecx, byte [esi + 9]
mov edx, edi
and edx, 1
mov eax, ebp
call fcn.00c5a800
movzx ecx, byte [esi + 0xa]
mov edx, edi
sar edx, 1
mov eax, ebp
and edx, 1
call fcn.00c5a800
movzx ecx, byte [esi + 0xb]
mov edx, edi
sar edx, 2
mov eax, ebp
and edx, 1
call fcn.00c5a800
movzx ecx, byte [esi + 0x12]
mov edx, edi
sar edx, 9
mov eax, ebp
and edx, 1
call fcn.00c5a800
movzx ecx, byte [esi + 0x11]
mov edx, edi
sar edx, 8
mov eax, ebp
and edx, 1
call fcn.00c5a800
movzx ecx, byte [esi + 0x10]
mov edx, edi
sar edx, 7
mov eax, ebp
and edx, 1
call fcn.00c5a800
movzx ecx, byte [esi + 0xf]
mov edx, edi
sar edx, 6
mov eax, ebp
and edx, 1
call fcn.00c5a800
movzx ecx, byte [esi + 0xe]
mov edx, edi
sar edx, 5
mov eax, ebp
and edx, 1
call fcn.00c5a800
movzx ecx, byte [esi + 0xd]
mov edx, edi
sar edx, 4
mov eax, ebp
and edx, 1
call fcn.00c5a800
test edi, 0xfff0
je 0xc5ab15
movzx ecx, byte [esi + 0xc]
mov edx, edi
mov eax, ebp
sar edx, 3
and edx, 1
call fcn.00c5a800
jmp 0xc5ab15
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
mov dword [esp], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 4], esi
mov esi, dword [esp + 0x18]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x10]
movzx edx, word [ebx]
mov ecx, esi
mov eax, edi
sar dx, 1
movsx edx, dx
call 0xc5aa80
movzx edx, word [ebx + 2]
lea ecx, [esi + 0x13]
mov eax, edi
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0xc
sar dx, 1
movsx edx, dx
jmp 0xc5aa80
Function at 0xc5b660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, eax
mov eax, edx
push edi
mov edi, edx
sar eax, 0x1f
push esi
xor edi, eax
push ebx
sub edi, eax
sub esp, 0x1c
cmp edi, 7
mov esi, ecx
movzx ecx, byte [ecx]
mov dword [esp + 8], edx
jg 0xc5ab30
xor edx, edx
mov eax, ebp
call fcn.00c5a800
movzx ecx, byte [esi + 2]
mov ebx, edi
sar ebx, 2
mov eax, ebp
mov edx, ebx
call fcn.00c5a800
movsx ebx, byte [ebx + 0x11509a0]
mov dword [esp + 0xc], ebx
movzx eax, byte [esp + 0xc]
mov ebx, edi
sar ebx, 1
and ebx, 1
mov edx, ebx
sar al, 1
movsx eax, al
movzx ecx, byte [esi + eax + 2]
mov eax, ebp
call fcn.00c5a800
mov eax, dword [esp + 0xc]
mov edx, edi
and edx, 1
movzx eax, byte [ebx + eax + 0x11509a0]
sar al, 1
movsx eax, al
movzx ecx, byte [esi + eax + 2]
mov eax, ebp
call fcn.00c5a800
test edi, edi
je 0xc5ac07
mov edx, dword [esp + 8]
mov eax, ebp
movzx ecx, byte [esi + 1]
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
shr edx, 0x1f
jmp fcn.00c5a800
mov edx, 1
mov eax, ebp
call fcn.00c5a800
movzx ecx, byte [esi + 9]
mov edx, edi
and edx, 1
mov eax, ebp
call fcn.00c5a800
movzx ecx, byte [esi + 0xa]
mov edx, edi
sar edx, 1
mov eax, ebp
and edx, 1
call fcn.00c5a800
movzx ecx, byte [esi + 0xb]
mov edx, edi
sar edx, 2
mov eax, ebp
and edx, 1
call fcn.00c5a800
movzx ecx, byte [esi + 0x12]
mov edx, edi
sar edx, 9
mov eax, ebp
and edx, 1
call fcn.00c5a800
movzx ecx, byte [esi + 0x11]
mov edx, edi
sar edx, 8
mov eax, ebp
and edx, 1
call fcn.00c5a800
movzx ecx, byte [esi + 0x10]
mov edx, edi
sar edx, 7
mov eax, ebp
and edx, 1
call fcn.00c5a800
movzx ecx, byte [esi + 0xf]
mov edx, edi
sar edx, 6
mov eax, ebp
and edx, 1
call fcn.00c5a800
movzx ecx, byte [esi + 0xe]
mov edx, edi
sar edx, 5
mov eax, ebp
and edx, 1
call fcn.00c5a800
movzx ecx, byte [esi + 0xd]
mov edx, edi
sar edx, 4
mov eax, ebp
and edx, 1
call fcn.00c5a800
test edi, 0xfff0
je 0xc5ab15
movzx ecx, byte [esi + 0xc]
mov edx, edi
mov eax, ebp
sar edx, 3
and edx, 1
call fcn.00c5a800
jmp 0xc5ab15
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
mov dword [esp], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 4], esi
mov esi, dword [esp + 0x18]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x10]
movzx edx, word [ebx]
mov ecx, esi
mov eax, edi
sar dx, 1
movsx edx, dx
call 0xc5aa80
movzx edx, word [ebx + 2]
lea ecx, [esi + 0x13]
mov eax, edi
mov ebx, dword [esp]
mov esi, dword [esp + 4]
mov edi, dword [esp + 8]
add esp, 0xc
sar dx, 1
movsx edx, dx
jmp 0xc5aa80
Function at 0xc8ad90
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x20]
mov dword [esp], str.VPX_SIMD_CAPS
call sub.msvcrt.dll_getenv
test eax, eax
je 0xc8adb3
cmp byte [eax], 0
jne 0xc8b092
mov dword [esp], str.VPX_SIMD_CAPS_MASK
mov esi, 0xffffffff
call sub.msvcrt.dll_getenv
test eax, eax
je 0xc8add1
cmp byte [eax], 0
jne 0xc8b073
xor eax, eax
mov edi, ebx
cpuid
xchg ebx, edi
test eax, eax
je 0xc8b06c
mov eax, 1
mov edi, ebx
cpuid
xchg ebx, edi
xor eax, eax
test edx, 0x800000
setne al
mov edi, eax
or edi, 2
test edx, 0x2000000
cmovne eax, edi
mov edi, eax
or edi, 4
and edx, 0x4000000
cmovne eax, edi
mov edx, eax
or edx, 8
test cl, 1
cmovne eax, edx
mov edx, eax
or edx, 0x10
test ch, 2
cmovne eax, edx
mov edx, eax
or edx, 0x20
and ecx, 0x80000
cmovne eax, edx
and eax, esi
test al, 1
je 0xc8af3b
mov dword [ebx + 0x4cb8], 0xc99560
mov dword [ebx + 0x4cbc], 0xc996e3
mov dword [ebx + 0x4cc4], 0xc99760
mov dword [ebx + 0x4ccc], 0xc998e0
mov dword [ebx + 0x4cd0], 0xc99941
mov dword [ebx + 0x4cc8], 0xc9997a
mov dword [ebx + 0x4ce8], 0xc99b90
mov dword [ebx + 0x4cec], 0xc99de0
mov dword [ebx + 0x4cf0], 0xc99f70
mov dword [ebx + 0x4cf4], 0xc99ad0
mov dword [ebx + 0x4cf8], 0xc9a100
mov dword [ebx + 0x4cfc], 0xc9aba4
mov dword [ebx + 0x4d00], 0xc9acb5
mov dword [ebx + 0x4d04], 0xc9adc6
mov dword [ebx + 0x4d08], 0xc9af60
mov dword [ebx + 0x4d0c], 0xc9b1e0
mov dword [ebx + 0x4d10], 0xc9ae80
mov dword [ebx + 0x4d14], 0xc9b040
mov dword [ebx + 0x4d18], 0xc9c522
mov dword [ebx + 0x4d1c], 0xc9b330
mov dword [ebx + 0x4d20], 0xc9c41c
mov dword [ebx + 0x4d24], 0xc9b170
mov dword [ebx + 0x4d28], 0xc9c8ca
mov dword [ebx + 0x4d30], 0xc9c6e0
mov dword [ebx + 0x4d34], 0xc9ca2c
test al, 4
je 0xc8b015
mov dword [ebx + 0x4cc8], 0xc9ca80
mov dword [ebx + 0x4ce0], 0xc9cf00
mov dword [ebx + 0x4cdc], 0xc9d100
mov dword [ebx + 0x4cc4], 0xc9d2c0
mov dword [ebx + 0x4ce8], 0xc9a1f0
mov dword [ebx + 0x4cec], 0xc9a340
mov dword [ebx + 0x4cf0], 0xc9a4b0
mov dword [ebx + 0x4cf8], 0xc9dafe
mov dword [ebx + 0x4cfc], 0xc9dd69
mov dword [ebx + 0x4d08], 0xc9b450
mov dword [ebx + 0x4d0c], 0xc9b6a0
mov dword [ebx + 0x4d10], 0xc9b3a0
mov dword [ebx + 0x4d14], 0xc9b500
mov dword [ebx + 0x4d18], 0xc9fe47
mov dword [ebx + 0x4d1c], 0xc9b7c0
mov dword [ebx + 0x4d20], 0xc9fd19
mov dword [ebx + 0x4d24], 0xc9b630
mov dword [ebx + 0x4d28], 0xca0358
mov dword [ebx + 0x4d2c], 0xca0508
mov dword [ebx + 0x4d30], 0xca0140
mov dword [ebx + 0x4d34], 0xca0683
and eax, 0x10
test eax, eax
je 0xc8b06c
mov dword [ebx + 0x4ce8], 0xc9a620
mov dword [ebx + 0x4cec], 0xc9a740
mov dword [ebx + 0x4cf0], 0xc9a860
mov dword [ebx + 0x4cf4], 0xc9a980
mov dword [ebx + 0x4cf8], 0xca0db1
mov dword [ebx + 0x4cfc], 0xca1048
mov dword [ebx + 0x4ce0], 0xc9d000
mov dword [ebx + 0x4cdc], 0xc9d1e0
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtol
mov esi, eax
jmp 0xc8add1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtol
jmp 0xc8ae39
Function at 0xc9b830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, esp
and esp, 0xfffffff0
lea esp, [esp - 0xc]
push eax
sub esp, 0x20
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x14]
movq mm7, qword [edx]
mov edi, esi
add edi, eax
movq mm2, qword [edi + eax*2]
movq mm1, qword [esi + eax*2]
movq mm6, mm1
psubusb mm1, mm2
psubusb mm2, mm6
por mm1, mm2
psubusb mm1, mm7
movq mm4, qword [esi + eax]
movq mm3, mm4
psubusb mm4, mm6
psubusb mm6, mm3
por mm4, mm6
psubusb mm4, mm7
por mm1, mm4
movq mm4, qword [esi]
movq mm0, mm4
psubusb mm4, mm3
psubusb mm3, mm0
por mm4, mm3
movq qword [esp], mm4
psubusb mm4, mm7
por mm1, mm4
neg eax
movq mm2, qword [esi + eax*4]
movq mm4, qword [edi + eax*4]
movq mm5, mm4
psubusb mm4, mm2
psubusb mm2, mm5
por mm4, mm2
psubusb mm4, mm7
por mm1, mm4
movq mm4, qword [esi + eax*2]
movq mm3, mm4
psubusb mm4, mm5
psubusb mm5, mm3
por mm4, mm5
psubusb mm4, mm7
por mm1, mm4
movq mm2, mm3
movq mm4, qword [esi + eax]
movq mm5, mm4
psubusb mm4, mm3
psubusb mm3, mm5
por mm4, mm3
movq qword [esp + 0x10], mm4
psubusb mm4, mm7
por mm1, mm4
movq mm3, qword [edi]
movq mm4, mm3
psubusb mm3, mm2
psubusb mm2, mm4
por mm2, mm3
pand mm2, qword [0x131a040]
psrlw mm2, 1
movq mm6, mm5
movq mm3, qword [esi]
psubusb mm5, mm3
psubusb mm3, mm6
por mm5, mm3
paddusb mm5, mm5
paddusb mm5, mm2
mov edx, dword [ebp + 0x10]
movq mm7, qword [edx]
psubusb mm5, mm7
por mm1, mm5
pxor mm5, mm5
pcmpeqb mm1, mm5
mov edx, dword [ebp + 0x18]
movq mm7, qword [edx]
movq mm4, qword [esp]
psubusb mm4, mm7
movq mm3, qword [esp + 0x10]
psubusb mm3, mm7
paddb mm4, mm3
pcmpeqb mm4, mm5
pcmpeqb mm5, mm5
pxor mm4, mm5
movq mm2, qword [esi + eax*2]
movq mm7, qword [edi]
pxor mm2, qword [0x131a050]
pxor mm7, qword [0x131a050]
psubsb mm2, mm7
pand mm2, mm4
pxor mm6, qword [0x131a050]
pxor mm0, qword [0x131a050]
movq mm3, mm0
psubsb mm0, mm6
paddsb mm2, mm0
paddsb mm2, mm0
paddsb mm2, mm0
pand mm1, mm2
movq mm2, mm1
paddsb mm1, qword [0x131a080]
paddsb mm2, qword [0x131a070]
pxor mm0, mm0
pxor mm5, mm5
punpcklbw mm0, mm2
punpckhbw mm5, mm2
psraw mm0, 0xb
psraw mm5, 0xb
packsswb mm0, mm5
movq mm2, mm0
pxor mm0, mm0
movq mm5, mm1
punpcklbw mm0, mm1
psraw mm0, 0xb
pxor mm1, mm1
punpckhbw mm1, mm5
psraw mm1, 0xb
movq mm5, mm0
packsswb mm0, mm1
paddsw mm5, qword [0x131a090]
paddsw mm1, qword [0x131a090]
psraw mm5, 1
psraw mm1, 1
packsswb mm5, mm1
pandn mm4, mm5
paddsb mm6, mm2
pxor mm6, qword [0x131a050]
movq qword [esi + eax], mm6
movq mm6, qword [esi + eax*2]
pxor mm6, qword [0x131a050]
paddsb mm6, mm4
pxor mm6, qword [0x131a050]
movq qword [esi + eax*2], mm6
psubsb mm3, mm0
pxor mm3, qword [0x131a050]
movq qword [esi], mm3
psubsb mm7, mm4
pxor mm7, qword [0x131a050]
movq qword [edi], mm7
add esi, 8
neg eax
dec ecx
jne 0xc9b84b
add esp, 0x20
pop esp
pop edi
pop esi
pop ebp
ret
Function at 0xc9c41c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, 2
mov edx, dword [ebp + 0x10]
movq mm3, qword [edx]
mov edi, esi
add edi, eax
neg eax
movq mm1, qword [esi + eax*2]
movq mm0, qword [edi]
movq mm2, mm1
movq mm7, mm0
movq mm4, mm0
psubusb mm0, mm1
psubusb mm1, mm4
por mm1, mm0
pand mm1, qword [0x131a040]
psrlw mm1, 1
movq mm5, qword [esi + eax]
movq mm4, qword [esi]
movq mm0, mm4
movq mm6, mm5
psubusb mm5, mm4
psubusb mm4, mm6
por mm5, mm4
paddusb mm5, mm5
paddusb mm5, mm1
psubusb mm5, mm3
pxor mm3, mm3
pcmpeqb mm5, mm3
pxor mm2, qword [0x131a050]
pxor mm7, qword [0x131a050]
psubsb mm2, mm7
pxor mm6, qword [0x131a050]
pxor mm0, qword [0x131a050]
movq mm3, mm0
psubsb mm0, mm6
paddsb mm2, mm0
paddsb mm2, mm0
paddsb mm2, mm0
pand mm5, mm2
paddsb mm5, qword [0x131a080]
movq mm0, mm5
psllw mm0, 8
psraw mm0, 3
psrlw mm0, 8
movq mm1, mm5
psraw mm1, 0xb
psllw mm1, 8
por mm0, mm1
psubsb mm3, mm0
pxor mm3, qword [0x131a050]
movq qword [esi], mm3
psubsb mm5, qword [0x131a060]
movq mm0, mm5
psllw mm0, 8
psraw mm0, 3
psrlw mm0, 8
psraw mm5, 0xb
psllw mm5, 8
por mm0, mm5
paddsb mm6, mm0
pxor mm6, qword [0x131a050]
movq qword [esi + eax], mm6
add esi, 8
neg eax
dec ecx
jne 0xc9c42c
pop edi
pop esi
pop ebp
ret
Function at 0xc9c522
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, esp
and esp, 0xfffffff0
lea esp, [esp - 0xc]
push eax
sub esp, 0x20
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea esi, [esi + eax*4 - 2]
mov ecx, 2
lea edi, [esi + eax]
movd mm0, dword [edi + eax*2]
movd mm6, dword [esi + eax*2]
punpcklbw mm6, mm0
movd mm0, dword [esi + eax]
movd mm4, dword [esi]
punpcklbw mm4, mm0
movq mm5, mm4
punpcklwd mm4, mm6
punpckhwd mm5, mm6
neg eax
movd mm7, dword [esi + eax]
movd mm6, dword [esi + eax*2]
punpcklbw mm6, mm7
movd mm1, dword [edi + eax*4]
movd mm0, dword [esi + eax*4]
punpcklbw mm0, mm1
movq mm2, mm0
punpcklwd mm0, mm6
punpckhwd mm2, mm6
movq mm1, mm0
punpckldq mm0, mm4
movq mm3, mm2
punpckhdq mm1, mm4
punpckldq mm2, mm5
punpckhdq mm3, mm5
movq mm6, mm0
movq mm7, mm3
psubusb mm7, mm6
psubusb mm6, mm3
por mm6, mm7
pand mm6, qword [0x131a040]
psrlw mm6, 1
movq mm5, mm1
movq mm4, mm2
psubusb mm5, mm2
psubusb mm4, mm1
por mm5, mm4
paddusb mm5, mm5
paddusb mm5, mm6
mov edx, dword [ebp + 0x10]
movq mm7, qword [edx]
psubusb mm5, mm7
pxor mm7, mm7
pcmpeqb mm5, mm7
movq qword [esp], mm0
movq qword [esp + 0x10], mm3
pxor mm0, qword [0x131a050]
pxor mm3, qword [0x131a050]
psubsb mm0, mm3
movq mm6, mm1
movq mm7, mm2
pxor mm6, qword [0x131a050]
pxor mm7, qword [0x131a050]
movq mm3, mm7
psubsb mm7, mm6
paddsb mm0, mm7
paddsb mm0, mm7
paddsb mm0, mm7
pand mm5, mm0
paddsb mm5, qword [0x131a080]
movq mm0, mm5
psllw mm0, 8
psraw mm0, 3
psrlw mm0, 8
movq mm7, mm5
psraw mm7, 0xb
psllw mm7, 8
por mm0, mm7
psubsb mm3, mm0
pxor mm3, qword [0x131a050]
psubsb mm5, qword [0x131a060]
movq mm0, mm5
psllw mm0, 8
psraw mm0, 3
psrlw mm0, 8
psraw mm5, 0xb
psllw mm5, 8
por mm0, mm5
paddsb mm6, mm0
pxor mm6, qword [0x131a050]
movq mm0, qword [esp]
movq mm4, qword [esp + 0x10]
movq mm1, mm0
punpcklbw mm0, mm6
punpckhbw mm1, mm6
movq mm2, mm3
punpcklbw mm2, mm4
movq mm5, mm1
punpckhbw mm3, mm4
movq mm6, mm0
punpcklwd mm0, mm2
punpckhwd mm6, mm2
movd dword [esi + eax*4], mm0
punpcklwd mm1, mm3
psrlq mm0, 0x20
punpckhwd mm5, mm3
movd dword [edi + eax*4], mm0
movd dword [esi + eax*2], mm6
psrlq mm6, 0x20
movd dword [esi], mm1
movd dword [esi + eax], mm6
neg eax
movd dword [esi + eax*2], mm5
psrlq mm1, 0x20
movd dword [edi], mm1
psrlq mm5, 0x20
movd dword [edi + eax*2], mm5
lea esi, [esi + eax*8]
dec ecx
jne 0xc9c543
add esp, 0x20
pop esp
pop edi
pop esi
pop ebp
ret
Function at 0xcfdaf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x20
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
movzx edi, word [edi + 4]
movzx eax, word [edx]
add edx, 2
mov dword [ebp - 0x2c], edx
movzx edx, word [ebx + 2]
add ebx, 4
mov dword [ebp - 0x28], ebx
mov ebx, dword [ebp + 0x10]
mov word [ebp - 0x16], di
mov edi, dword [ebp + 0x10]
add ebx, 6
movzx edi, word [edi + 6]
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp + 0x10]
mov word [ebp - 0x14], di
mov edi, dword [ebp + 0x10]
add ebx, 8
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp + 0x10]
movzx edi, word [edi + 8]
add ebx, 0xa
test cx, cx
mov dword [ebp - 0x1c], ebx
movzx ebx, word [ebp - 0x16]
mov word [ebp - 0x12], di
mov edi, dword [ebp + 0x10]
movzx edi, word [edi + 0xa]
mov word [ebp - 0x10], di
movzx edi, word [ebp - 0x14]
je 0xcfdc66
mov word [ebp - 0x18], cx
mov esi, dword [ebp + 8]
movzx ecx, word [ebp - 0x12]
mov word [ebp - 0xe], cx
jmp 0xcfdbbf
sar ecx, 0x1f
xor ecx, 0x7fffffff
mov eax, ecx
shr eax, 0x10
sub word [ebp - 0x18], 1
mov word [esi], ax
je 0xcfdc56
movzx eax, word [ebp - 0xe]
add esi, 2
movzx ecx, word [ebp - 0x12]
movzx edx, word [ebp - 0x14]
mov word [ebp - 0x14], di
mov word [ebp - 0x10], ax
movzx eax, word [ebp - 0x16]
mov word [ebp - 0xe], cx
mov word [ebp - 0x16], bx
movsx ebx, dx
movsx edx, word [ebp - 0x16]
cwde
movzx edi, word [esi]
imul eax, eax, 0xffffc156
movsx ecx, word [ebp - 0x14]
imul ebx, ebx, 0xffffe0ab
imul edx, edx, 0x7ea6
mov word [ebp - 0x12], di
imul ecx, ecx, 0x3f53
add edx, eax
movsx eax, di
imul eax, eax, 0x1faa
lea ecx, [ecx + ebx + 0x2000]
sar ecx, 0xe
add edx, eax
movsx eax, word [ebp - 0x10]
imul eax, eax, 0x1faa
add edx, eax
movsx eax, word [ebp - 0xe]
imul eax, eax, 0xffffc0ac
add edx, eax
add edx, ecx
lea ecx, [edx*4]
mov ebx, ecx
mov edi, ecx
shr ebx, 0x10
mov eax, ebx
shl eax, 0x10
shl edx, 3
sub edi, eax
sar edx, 1
shr edi, 1
cmp ecx, edx
jne 0xcfdb80
lea eax, [ecx + 0x4000]
shr eax, 0xf
sub word [ebp - 0x18], 1
mov word [esi], ax
jne 0xcfdb9c
movzx ecx, word [ebp - 0xe]
movzx eax, word [ebp - 0x16]
movzx edx, word [ebp - 0x14]
mov word [ebp - 0x10], cx
mov ecx, dword [ebp + 0x10]
mov word [ecx], ax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov word [eax], dx
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov word [edx], bx
mov ebx, dword [ebp - 0x20]
mov word [ecx], di
movzx edx, word [ebp - 0x10]
movzx edi, word [ebp - 0x12]
mov word [ebx], di
mov word [eax], dx
add esp, 0x20
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0xd02e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 4
movzx eax, word [ebp + 0x10]
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
movsx ebx, ax
mov word [ebp - 0xe], ax
lea eax, [ebx - 1]
test eax, eax
jle 0xd02e97
mov ecx, 1
movzx eax, word [edx + ecx*2 - 2]
mov word [esi + ecx*2 - 2], ax
add ecx, 1
cmp ecx, ebx
jne 0xd02e86
lea edi, [ebx + ebx]
movzx ebx, word [edi + edx - 2]
movsx edx, bx
lea ecx, [edx + edx]
movsx eax, cx
sar eax, 1
cmp edx, eax
je 0xd02eb9
mov ecx, ebx
sar cx, 0xf
xor cx, 0x7fff
cmp word [ebp - 0xe], 0
mov word [edi + esi - 2], cx
jle 0xd02f16
xor edi, edi
movzx edx, word [esi]
mov eax, edx
and edx, 0x7f
sar ax, 7
cwde
movsx ecx, word [eax + eax + 0x12e2920]
movzx eax, word [eax + eax + 0x12e2922]
sub ax, cx
cwde
imul eax, edx
sar eax, 7
add eax, ecx
mov edx, eax
mov ecx, eax
sar edx, 0x1f
sar ecx, 0xf
mov ebx, edx
xor ebx, 0x7fff
cmp ecx, edx
cmovne eax, ebx
add edi, 1
mov word [esi], ax
add esi, 2
cmp di, word [ebp - 0xe]
jne 0xd02ec7
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0xd16270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
movzx edi, word [ebp + 8]
movzx eax, word [ebp + 0xc]
mov ebx, dword [ebp + 0x18]
movzx esi, word [ebp + 0x10]
movsx edx, di
lea ecx, [edx + edx]
mov word [ebp - 0x28], ax
movsx eax, cx
sar eax, 1
cmp edx, eax
je 0xd162a6
mov ecx, edi
sar cx, 0xf
xor cx, 0x7fff
mov edx, esi
mov edi, dword [ebp + 0x14]
and edx, 0x40
sar dx, 3
lea edx, [ecx + edx]
mov ecx, esi
movsx eax, dx
add edx, 1
movsx edx, dx
and ecx, 7
sar si, 3
lea ecx, [ecx + ecx*4]
add cx, word [edi + eax*2]
mov eax, esi
movzx esi, word [edi + edx*2]
and eax, 7
lea eax, [eax + eax*4]
movzx edx, cx
mov word [ebx + 0x4e], 0
add esi, eax
mov eax, esi
shl eax, 0x10
or edx, eax
mov eax, 0xfffffffe
mov word [eax + ebx + 0x4e], 0
sub eax, 2
cmp eax, 0xffffffb0
jne 0xd162f1
movsx ecx, dx
movzx edx, word [ebp - 0x28]
sar word [ebp - 0x28], 1
and edx, 1
mov eax, edx
shl eax, 0xe
sub eax, edx
movzx edx, word [ebp - 0x28]
sub ax, 0x2000
mov word [ebx + ecx*2], ax
movsx ecx, si
and edx, 1
mov eax, edx
shl eax, 0xe
sub eax, edx
sub ax, 0x2000
mov word [ebx + ecx*2], ax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0xdc6a30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.msvcrt.dll__iob]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0xc], str.1.0.6__6_Sept_2010
mov dword [esp + 4], str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to_me_at:_jseward_bzip.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks.__Julian_Seward__10_December_2007._n_n
add esi, 0x40
mov dword [esp + 8], ebx
mov dword [esp], esi
call sub.msvcrt.dll_fprintf
cmp ebx, 0x3ef
je 0xdc6a78
mov dword [esp], 3
call sub.msvcrt.dll_exit
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x420
mov dword [esp + 4], 1
mov dword [esp], str._n_A_special_note_about_internal_error_number_1007__n_nExperience_suggests_that_a_common_cause_of_i.e._1007_nis_unreliable_memory_or_other_hardware.__The_1007_assertion_njust_happens_to_cross_check_the_results_of_huge_numbers_of_nmemory_reads_writes__and_so_acts__unintendedly__as_a_stress_ntest_of_your_memory_system._n_nI_suggest_the_following:_try_compressing_the_file_again__npossibly_monitoring_progress_in_detail_with_the__vv_flag._n_n_If_the_error_cannot_be_reproduced__and_or_happens_at_different_n__points_in_compression__you_may_have_a_flaky_memory_system._n__Try_a_memory_test_program.__I_have_used_Memtest86_n___www.memtest86.com_.__At_the_time_of_writing_it_is_free__GPLd_._n__Memtest86_tests_memory_much_more_thorougly_than_your_BIOSs_n__power_on_test__and_may_find_failures_that_the_BIOS_doesnt._n_n_If_the_error_can_be_repeatably_reproduced__this_is_a_bug_in_n__bzip2__and_I_would_very_much_like_to_hear_about_it.__Please_n__let_me_know__and__ideally__save_a_copy_of_the_file_causing_the_n__problem____without_which_I_will_be_unable_to_investigate_it._n_n
call sub.msvcrt.dll_fwrite
jmp 0xdc6a6c
Function at 0xdc7b20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
test edi, edi
je 0xdc7b3f
mov dword [edi], 0
test esi, esi
je 0xdc7b80
mov dword [esi + 0x13c4], 0
je 0xdc7b80
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0xdc7b80
mov ecx, dword [ebp + 0x14]
test ecx, ecx
js 0xdc7b80
cmp byte [esi + 0x1390], 0
jne 0xdc7ba7
test edi, edi
je 0xdc7b70
mov dword [edi], 0xffffffff
mov dword [esi + 0x13c4], 0xffffffff
jmp 0xdc7b98
test edi, edi
je 0xdc7b8a
mov dword [edi], 0xfffffffe
test esi, esi
je 0xdc7b98
mov dword [esi + 0x13c4], 0xfffffffe
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi]
test byte [eax + 0xc], 0x20
jne 0xdc7c60
mov edx, dword [ebp + 0x14]
test edx, edx
je 0xdc7c79
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x1398], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1394], eax
lea eax, [esi + 4]
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x1394]
mov dword [ebp - 0x14], eax
jmp 0xdc7bef
mov eax, dword [esi + 0x1398]
test eax, eax
je 0xdc7c79
mov eax, dword [ebp - 0x10]
mov dword [esi + 0x13a8], 0x1388
mov dword [esi + 0x13a4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00dc7980
sub esp, 8
cmp eax, 1
jne 0xdc7c92
mov eax, dword [esi + 0x13a8]
cmp eax, 0x1387
ja 0xdc7be1
mov ebx, 0x1388
sub ebx, eax
mov eax, dword [esi]
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp ebx, eax
jne 0xdc7c60
mov eax, dword [esi]
test byte [eax + 0xc], 0x20
je 0xdc7be1
lea esi, [esi]
test edi, edi
je 0xdc7c6a
mov dword [edi], 0xfffffffa
mov dword [esi + 0x13c4], 0xfffffffa
jmp 0xdc7b98
test edi, edi
je 0xdc7c83
mov dword [edi], 0
mov dword [esi + 0x13c4], 0
jmp 0xdc7b98
test edi, edi
je 0xdc7c98
mov dword [edi], eax
mov dword [esi + 0x13c4], eax
jmp 0xdc7b98