joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57bbc1
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x57bbda
or eax, 0xffffffff
jmp 0x57bc3b
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x57bc37
push 0x3d
push esi
call fcn.0057c0ba
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x57bc37
cmp esi, eax
je 0x57bc37
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x89c858]
sete cl
cmp eax, dword [0x89c85c]
mov dword [ebp - 8], ecx
jne 0x57bc1d
mov edi, eax
call fcn.0057bb60
mov dword [0x89c858], eax
cmp eax, ebx
jne 0x57bc76
cmp dword [ebp + 0xc], ebx
je 0x57bc3f
cmp dword [0x89c860], ebx
je 0x57bc3f
call fcn.0057ab19
test eax, eax
je 0x57bc76
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x57bc48
xor eax, eax
jmp 0x57bc3a
push 4
call fcn.0056b06c
cmp eax, ebx
pop ecx
mov dword [0x89c858], eax
je 0x57bc37
mov dword [eax], ebx
cmp dword [0x89c860], ebx
jne 0x57bc76
push 4
call fcn.0056b06c
cmp eax, ebx
pop ecx
mov dword [0x89c860], eax
je 0x57bc37
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x89c858]
call fcn.0057bb13
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x57bcd7
cmp dword [esi], ebx
je 0x57bcd7
lea esi, [esi + edi*4]
push dword [esi]
call fcn.0056af54
cmp dword [ebp - 8], ebx
pop ecx
jne 0x57bcba
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x57bd18
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x57bcb1
mov eax, edi
shl eax, 2
push eax
push dword [0x89c858]
call fcn.0056d172
cmp eax, ebx
pop ecx
pop ecx
je 0x57bd18
jmp 0x57bd13
cmp dword [ebp - 8], ebx
jne 0x57bd83
cmp edi, ebx
jge 0x57bce6
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x89c858]
call fcn.0056d172
cmp eax, ebx
pop ecx
pop ecx
je 0x57bc37
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x89c858], eax
cmp dword [ebp + 0xc], ebx
je 0x57bd6d
push dword [ebp - 4]
call fcn.0056ef90
inc eax
inc eax
push eax
call fcn.0056b06c
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x57bd6d
push dword [ebp - 4]
push esi
call fcn.005711d0
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
jne 0x57bd66
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.0056af54
pop ecx
cmp dword [ebp - 8], ebx
je 0x57bd7b
push dword [ebp - 4]
call fcn.0056af54
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x57bc3a
push dword [ebp - 4]
call fcn.0056af54
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x57bc44
Function at 0x948e28
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xf8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x948e94
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x18]
jae 0x948edd
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call fcn.009619d0
add esp, 8
test eax, eax
jne 0x948edb
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx + eax*2]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x948edf
jmp 0x948e8b
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x9548fa
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x95490a
xor eax, eax
jmp 0x954ad3
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x954a8b
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x9779a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x9779a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x9779a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x9779a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x9779a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x9779a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x9779a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x9779a4]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0x954913
cmp dword [ebp + 0x10], 0
je 0x954acd
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0x9779a4]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0x954a91
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x4044c6
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1800
call fcn.0040f950
mov eax, dword [0x282d8c4]
mov ecx, dword [0x282d350]
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x40459b
push ebx
push edi
mov ebx, ecx
mov edi, eax
cmp dword [0x282d8c4], 0x959
jne 0x40458a
push esi
lea eax, [ebp - 0x1000]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x403f18
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push 0x403f64
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push 0x403f70
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push esi
lea eax, [ebp - 0x1800]
push eax
push esi
push 0x403fa8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00404374
add ebx, 8
dec edi
jne 0x4044f2
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4048b3
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1004
call fcn.0040f950
push ebx
push esi
xor esi, esi
cmp dword [0x282d8c4], 0x400
push edi
jne 0x4049c7
push esi
call dword [sym.imp.USER32.dll_GetDC]
push esi
lea eax, [esp + 0x414]
push eax
push esi
push 0x404134
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push esi
push esi
lea eax, [esp + 0x818]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
lea eax, [esp + 0x14]
push eax
push 0x40414c
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push 0x40415c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
call fcn.00405104
pop ecx
push esi
push esi
call fcn.0040523a
push esi
call fcn.004058e9
add esp, 0xc
push esi
call fcn.00405b3b
fldz
sub esp, 0xc
fst qword [esp + 8]
fstp qword [esp]
call fcn.00404aa0
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404cc0
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00405380
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404df0
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004055e0
fstp st(0)
push esi
push esi
call fcn.00405734
push esi
call fcn.00405baf
add esp, 0x14
push esi
push esi
call fcn.0040513e
push esi
push esi
call fcn.00405094
push esi
call fcn.0040594e
add esp, 0x14
mov ebx, dword [sym.imp.GDI32.dll_GetCharWidthI]
xor edi, edi
cmp edi, 0x9a1
jge 0x4049f3
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.USER32.dll_SetClipboardViewer]
push esi
push esi
push esi
push esi
push esi
call ebx
push esi
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp edi, 0x4f47a90
jg 0x404a15
inc edi
cmp edi, 0x32ffca9
jl 0x4049cf
xor edi, edi
cmp edi, 0x16d2a
jge 0x404a26
push esi
push esi
push esi
push esi
push esi
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0x12e82fe
jg 0x404a44
inc edi
cmp edi, 0x3011b
jl 0x404a17
mov eax, dword [0x435cac]
mov dword [0x282d8c4], eax
call fcn.0040459e
mov edi, 0x2ec37
cmp dword [0x282d8c4], 0x51f
jne 0x404a73
push esi
lea eax, [esp + 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec edi
jne 0x404a58
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4081d8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x432208]
jne 0x4081e2
repz ret
jmp fcn.0040d6b0
Function at 0x40f3ac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x432208]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040a54b
and dword [ebp - 0x14], 0
cmp dword [0x44a8a8], 0
mov dword [ebp - 0x18], eax
jne 0x40f45f
push 0x4036c0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40f507
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4036b4
push ebx
call edi
test eax, eax
je 0x40f507
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4036a4
push ebx
mov dword [0x44a8a8], eax
call edi
push eax
call esi
push 0x403690
push ebx
mov dword [0x44a8ac], eax
call edi
push eax
call esi
push 0x403674
push ebx
mov dword [0x44a8b0], eax
call edi
push eax
call esi
mov dword [0x44a8b8], eax
test eax, eax
je 0x40f45f
push 0x40365c
push ebx
call edi
push eax
call esi
mov dword [0x44a8b4], eax
mov eax, dword [0x44a8b4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40f4b8
cmp dword [0x44a8b8], ecx
je 0x40f4b8
push eax
call esi
push dword [0x44a8b8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40f4b8
test ebx, ebx
je 0x40f4b8
call edi
test eax, eax
je 0x40f4af
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40f4af
test byte [ebp - 8], 1
jne 0x40f4b8
or dword [ebp + 0x10], 0x200000
jmp 0x40f4eb
mov eax, dword [0x44a8ac]
cmp eax, dword [ebp - 0x18]
je 0x40f4eb
push eax
call esi
test eax, eax
je 0x40f4eb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40f4eb
mov eax, dword [0x44a8b0]
cmp eax, dword [ebp - 0x18]
je 0x40f4eb
push eax
call esi
test eax, eax
je 0x40f4eb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44a8a8]
call esi
test eax, eax
je 0x40f507
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40f509
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004081d8
leave
ret
Function at 0x100ec4d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0xffffffff
mov esi, dword [0x100f7990]
add esi, 0x2dd
mov dword [0x100f7994], esi
mov dword [0x100f7990], 0xc52
cmp ecx, 0
sete bl
cmp eax, 0
sete bh
and bl, bh
test bl, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jne 0x100ec700
jmp 0x100ec537
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff8
mov dword [ebp - 0x18], eax
jmp 0x100ec700
mov dword [0x100f7994], 0xffffdbfd
mov dword [0x100f7990], 0xffffdfef
mov ecx, dword fs:[0x18]
mov eax, 0xa0f
mov dword [0x100f7990], 0x2178
mov edx, dword [0x100f7994]
add edx, 0xffffdf4b
mov dword [0x100f7990], edx
mov ecx, dword [ecx + 0x30]
mov dword [0x100f7990], 0x147e
mov ecx, dword [ecx + 0xc]
add ecx, 0x14
mov edx, dword [ebp - 0x10]
cmp edx, 0
setne bl
mov esi, ecx
mov byte [ebp - 0x1d], bl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov dword [0x100f7994], ecx
mov eax, dword [eax]
mov ecx, dword [ebp - 0x24]
cmp eax, ecx
mov dword [ebp - 0x30], eax
je 0x100ec6f1
mov eax, dword [ebp - 0x30]
mov cx, word [eax + 0x24]
mov dword [0x100f7990], 0x2324
mov edx, dword [eax + 0x28]
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x1d]
and bh, bl
test bh, 1
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x32], cx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], esi
jne 0x100ec527
mov dword [0x100f7990], 0x511
mov ax, word [ebp - 0x32]
shr ax, 1
movzx ecx, ax
cmp ax, 0
sete dl
mov dword [ebp - 0x40], ecx
mov byte [ebp - 0x41], dl
mov al, byte [ebp - 0x41]
test al, 1
jne 0x100ec624
jmp 0x100ec637
mov eax, 0x12b
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
jmp 0x100ec5a3
xor eax, eax
mov dword [ebp - 0x48], eax
jmp 0x100ec63e
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x38]
mov dx, word [ecx + eax*2]
mov si, dx
add si, 0xffbf
mov di, dx
add di, 0x20
cmp si, 0x1a
mov dword [ebp - 0x4c], eax
mov word [ebp - 0x4e], dx
mov word [ebp - 0x50], di
jb 0x100ec672
mov ax, word [ebp - 0x4e]
mov word [ebp - 0x50], ax
mov ax, word [ebp - 0x50]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x4c]
cmp word [ecx + edx*2], ax
sete bl
cmp ax, 0
sete bh
mov al, bl
xor al, 1
or bh, al
test bh, 1
mov al, bl
mov byte [ebp - 0x51], bl
mov byte [ebp - 0x52], al
jne 0x100ec6c3
mov dword [0x100f7994], 0x12aa
mov eax, dword [ebp - 0x4c]
add eax, 1
mov ecx, dword [ebp - 0x40]
cmp eax, ecx
mov dl, byte [ebp - 0x51]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x52], dl
jb 0x100ec63e
mov al, byte [ebp - 0x52]
mov dword [0x100f7990], 0x1d6a
test al, 1
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x58], ecx
jne 0x100ec6df
jmp 0x100ec624
mov eax, dword [ebp - 0x58]
mov dword [0x100f7990], 0xc0f
mov dword [ebp - 0x18], eax
jmp 0x100ec700
xor eax, eax
mov dword [0x100f7990], 0x13a9
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100ecb20
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, dword [0x100f7990]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
xor eax, eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0xffffdec1
mov dword [0x100f7994], ecx
mov dword [0x100f799c], 0
mov byte [0x100f79a0], 0
mov dword [0x100f7990], 0x1a
mov dword [0x100f7998], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x100f7994]
add eax, 0xfffff269
mov dword [0x100f7990], eax
mov eax, dword [0x100f7998]
add eax, 1
mov dword [0x100f7998], eax
cmp eax, 0x100
mov dword [ebp - 0x20], eax
jl 0x100ecb7d
mov dword [0x100f7990], 0x1c79
mov dword [0x100f7998], 0
xor eax, eax
mov dword [ebp - 0x24], eax
jmp 0x100ecbcd
mov eax, dword [ebp - 0x24]
mov ecx, 0x100
mov dword [0x100f79a4], 0
mov dword [0x100f7990], 0x1497
mov edx, dword [0x100f799c]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x28], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x100f79a4], edi
mov eax, edi
cdq
idiv ecx
mov dword [0x100f799c], edx
mov dword [0x100f7990], 0x1e26
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
mov cl, byte [ecx + edi]
mov byte [0x100f79a0], cl
mov dword [0x100f7990], 0x9ab
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x100f79a0]
mov edx, dword [0x100f799c]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x100f7990]
add edx, 0x1871
mov dword [0x100f7994], edx
mov dword [0x100f7990], 0x1c53
mov edx, dword [0x100f7998]
add edx, 1
mov dword [0x100f7998], edx
cmp edx, 0x100
mov dword [ebp - 0x24], edx
jl 0x100ecbcd
mov dword [0x100f7994], 0x1ee0
mov dword [0x100f7990], 0x1809
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100ecd40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [0x100f7994]
mov dword [0x100f7998], 0
mov dword [0x100f799c], 0
mov dword [0x100f79a8], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
mov dword [0x100f7994], 0x20f1
mov eax, dword [ebp - 0x20]
add eax, 0xffffec51
mov dword [0x100f7990], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
mov dword [ebp - 0x24], eax
je 0x100ecf0e
jmp 0x100ecdc0
mov eax, 0x2441
mov dword [ebp - 0x24], eax
jmp 0x100ecf0e
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], eax
jmp 0x100ecdd1
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
mov esi, 0x100
mov dword [0x100f7990], 0x2192
add ecx, 1
mov dword [ebp - 0x34], eax
mov eax, ecx
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x100f7998], edx
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x38]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x3c], edx
cdq
idiv esi
mov dword [0x100f799c], edx
mov dword [0x100f7994], 0x1491
mov esi, dword [ebp - 0x3c]
mov cl, byte [ecx + esi]
mov byte [0x100f79a0], cl
mov dword [0x100f7990], 0x246a
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x100f7994], 0x211
mov cl, byte [0x100f79a0]
mov edx, dword [0x100f799c]
mov byte [edi + edx], cl
mov dword [0x100f7990], 0x38
mov edx, dword [0x100f7998]
movzx edx, byte [edi + edx]
mov ebx, dword [0x100f799c]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x100f79a8], ebx
mov dword [0x100f7994], 0xffffd934
mov dword [0x100f7990], 0xcc1
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x34]
mov ch, byte [edx + ebx]
mov dl, cl
add dl, byte [0x100f79ad]
mov byte [0x100f79ac], dl
mov byte [0x100f79ad], ch
mov dword [0x100f7994], 0x1552
mov byte [0x100f79ae], cl
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], ch
mov dword [0x100f7990], 0x2441
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x40], ebx
je 0x100ecdb3
mov eax, dword [0x100f7998]
mov ecx, dword [0x100f799c]
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], edx
jmp 0x100ecdd1
mov eax, dword [ebp - 0x24]
add eax, 0x4ac
mov dword [0x100f7990], eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret