joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e4e0
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov dword [ebp - 0x1500], ecx
push edx
and edx, 0x8f9
add edx, 0x15f67
add edx, 0xe183
and edx, 0x1686b
pop edx
push ebx
push eax
add esp, 4
or ebx, 0x2c38
and ebx, 0xdafd
add byte [ecx + 0x9f82f3], al
add byte [ebx - 0x7d], bl
mov ebp, 0xffffeb00
add byte [ebp + 0xf], dh
mov dword [ebp - 0x2a0], 0
jmp 0x1000e7ec
mov edx, dword [ebp - 0x1500]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0xc1c], ecx
push edx
add edx, 0x13770
pop edx
push eax
push eax
add esp, 4
sub eax, 0x16fd
or eax, 0xf957
pop eax
push edi
push ebx
add esp, 4
sub edi, 0x1112a
sub edi, 0x277c
sub edi, 0x10105
pop edi
cmp dword [ebp - 0xc1c], 0
jne 0x1000e58c
invalid
invalid
pushal

Function at 0x1000e5c6
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
add esp, 4
jmp 0x1000e5a6
xor ebx, 0xac54
pop ebx
push edx
or edx, 0x11d1e
xor edx, 0x17fa4
call 0x1000e5c6
add byte [edx], bh
dec esp
inc eax
cmp dword [eax - 0x7d], edx
les eax, [edx + ebx*2]
lea eax, [ebp - 0x15cc]
mov dword [ebp - 0xc18], eax
mov ecx, dword [ebp - 0x4bc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc14], edx
xor eax, eax
mov word [ebp - 0x1ac], ax
xor ecx, ecx
inc dword [eax]
jne 0x1000e784
push edi
push eax
add esp, 4
jmp 0x1000e74e
add edi, 0x16968
jmp 0x1000e75b
xor edi, 0x104e7
pop edi
push ecx
sub ecx, 0xa190
and ecx, 0x17d66
sub ecx, 0x140a8
pop ecx
mov edx, dword [ebp - 0x4bc]
mov dword [ebp - 0x2a0], edx
jmp 0x1000e7ec
push eax
push ecx
add esp, 4
add eax, 0xd143
call 0x1000e79c
add byte [ebp + 0x36], cl
inc ebx
inc edx
cmp al, 0x49
xor al, 0x83
les eax, [eax + ebx*2]
push eax
add eax, 0x2441
sub eax, 0x136cf
jmp 0x1000e7b5
pop eax
mov eax, dword [ebp - 0x4bc]
mov ecx, dword [eax]
mov dword [ebp - 0x4bc], ecx
mov edx, dword [ebp - 0x4bc]
cmp edx, dword [ebp - 0xc1c]
je 0x1000e7e2
mov eax, dword [ebp - 0x4bc]
cmp dword [eax + 0x30], 0
jne 0x1000e598
mov dword [ebp - 0x2a0], 0
push esi
sub esi, 0xe54f
and esi, 0x8775
add esi, 0x2d36
pop esi
push eax
push edx
add esp, 4
xor eax, 0xeb6d
sub eax, 0x11b4e
add eax, 0xb85f
add eax, 0x131c
pop eax
cmp dword [ebp - 0x2a0], 0
pushal
std
invalid
inc dword [eax]
jne 0x1000f123
mov ecx, 0x6b
mov word [ebp - 0x1638], cx
mov edx, 0x65
mov word [ebp - 0x1636], dx
mov eax, 0x72
mov word [ebp - 0x1634], ax
mov ecx, 0x6e
mov word [ebp - 0x1632], cx
mov edx, 0x65
mov word [ebp - 0x1630], dx
mov eax, 0x6c
mov word [ebp - 0x162e], ax
mov ecx, 0x33
mov word [ebp - 0x162c], cx
mov edx, 0x32
mov word [ebp - 0x162a], dx
mov eax, 0x2e
push eax
push eax
add esp, 4
call 0x1000f137
add byte [eax + 0x36], al
cmp al, 0x33
inc edx
dec eax
inc edi
inc edx
cmp eax, 0x8104c483
invalid
Function at 0x1000e660
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
add eax, 0x168cc
sub eax, 0x13830
xor eax, 0xa60c
pop eax
push ecx
push ebx
add esp, 4
add ecx, 0x84da
xor ecx, 0x8dd3
and ecx, 0x33ab
xor ecx, 0x1ed4
pop ecx
mov edx, dword [ebp - 0xc14]
mov ax, word [edx]
mov word [ebp - 0xfb6], ax
mov ecx, dword [ebp - 0xc14]
add ecx, 2
mov dword [ebp - 0xc14], ecx
mov dx, word [ebp - 0xfb6]
mov word [ebp - 0x1ac], dx
mov eax, dword [ebp - 0xc18]
mov cx, word [eax]
mov word [ebp - 0xfb8], cx
mov dword [ebp - 0xfb8], ecx
mov dword [ebp - 0xfb8], ecx
mov edx, dword [ebp - 0xc18]
add edx, 2
mov dword [ebp - 0xc18], edx
mov ax, word [ebp - 0xfb8]
mov word [ebp - 0x100], ax
push ecx
push esi
add esp, 4
jmp 0x1000e68d
xor ecx, 0x6169
jmp 0x1000e69a
pop ecx
push edx
add edx, 0x16704
pop edx
push eax
push ebx
add esp, 4
xor eax, 0xf836
or eax, 0x13b28
pop eax
movzx ecx, word [ebp - 0x100]
test ecx, ecx
jne 0x1000e6d8
movzx edx, word [ebp - 0x1ac]
movzx eax, word [ebp - 0x100]
sub edx, eax
movzx ecx, word [ebp - 0x1ac]
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x1000e5f7
movzx eax, word [ebp - 0x1ac]
xor eax, 0x20
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
je 0x1000e5f7
movzx edx, word [ebp - 0x1ac]
movzx eax, word [ebp - 0x100]
cmp edx, eax
jge 0x1000e725
mov dword [ebp - 0x1504], 0xffffffff
jmp 0x1000e72f
mov dword [ebp - 0x1504], 1
mov ecx, dword [ebp - 0x1504]
mov dword [ebp - 0x150c], ecx
cmp dword [ebp - 0x150c], 0
Function at 0x1000e79c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
add esp, 4
jmp 0x1000e5a6
xor ebx, 0xac54
pop ebx
push edx
or edx, 0x11d1e
xor edx, 0x17fa4
call 0x1000e5c6
add byte [edx], bh
dec esp
inc eax
cmp dword [eax - 0x7d], edx
les eax, [edx + ebx*2]
lea eax, [ebp - 0x15cc]
mov dword [ebp - 0xc18], eax
mov ecx, dword [ebp - 0x4bc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc14], edx
xor eax, eax
mov word [ebp - 0x1ac], ax
xor ecx, ecx
inc dword [eax]
jne 0x1000e784
push edi
push eax
add esp, 4
jmp 0x1000e74e
add edi, 0x16968
jmp 0x1000e75b
xor edi, 0x104e7
pop edi
push ecx
sub ecx, 0xa190
and ecx, 0x17d66
sub ecx, 0x140a8
pop ecx
mov edx, dword [ebp - 0x4bc]
mov dword [ebp - 0x2a0], edx
jmp 0x1000e7ec
push eax
push ecx
add esp, 4
add eax, 0xd143
call 0x1000e79c
add byte [ebp + 0x36], cl
inc ebx
inc edx
cmp al, 0x49
xor al, 0x83
les eax, [eax + ebx*2]
push eax
add eax, 0x2441
sub eax, 0x136cf
jmp 0x1000e7b5
pop eax
mov eax, dword [ebp - 0x4bc]
mov ecx, dword [eax]
mov dword [ebp - 0x4bc], ecx
mov edx, dword [ebp - 0x4bc]
cmp edx, dword [ebp - 0xc1c]
je 0x1000e7e2
mov eax, dword [ebp - 0x4bc]
cmp dword [eax + 0x30], 0
jne 0x1000e598
mov dword [ebp - 0x2a0], 0
push esi
sub esi, 0xe54f
and esi, 0x8775
add esi, 0x2d36
pop esi
push eax
push edx
add esp, 4
xor eax, 0xeb6d
sub eax, 0x11b4e
add eax, 0xb85f
add eax, 0x131c
pop eax
cmp dword [ebp - 0x2a0], 0
pushal
std
invalid
inc dword [eax]
jne 0x1000f123
mov ecx, 0x6b
mov word [ebp - 0x1638], cx
mov edx, 0x65
mov word [ebp - 0x1636], dx
mov eax, 0x72
mov word [ebp - 0x1634], ax
mov ecx, 0x6e
mov word [ebp - 0x1632], cx
mov edx, 0x65
mov word [ebp - 0x1630], dx
mov eax, 0x6c
mov word [ebp - 0x162e], ax
mov ecx, 0x33
mov word [ebp - 0x162c], cx
mov edx, 0x32
mov word [ebp - 0x162a], dx
mov eax, 0x2e
push eax
push eax
add esp, 4
call 0x1000f137
add byte [eax + 0x36], al
cmp al, 0x33
inc edx
dec eax
inc edi
inc edx
cmp eax, 0x8104c483
invalid

Function at 0x1000e890
Capabilities:
Contain obfuscated stackstrings
Get number of processors
Resolve function by parsing pe exports

Disassembly:
mov word [ebp - 0x1628], ax
mov ecx, 0x64
mov word [ebp - 0x1626], cx
mov edx, 0x6c
mov word [ebp - 0x1624], dx
mov eax, 0x6c
mov word [ebp - 0x1622], ax
xor ecx, ecx
mov word [ebp - 0x1620], cx
push eax
push ebx
add esp, 4
or eax, 0x16ac8
xor eax, 0x7dda
pop eax
push edx
push edx
add esp, 4
xor edx, 0x6b9e
add edx, 0xc90a
pop edx
push eax
xor eax, 0x10ef1
add eax, 0x17959
pop eax
mov byte [ebp - 0x84c], 0x4c
invalid
invalid
invalid
Function at 0x1000e9a7
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
cmp dword [ebp - 0x1510], 0
jne 0x1000e9c3
mov dword [ebp - 0x728], 0
jmp 0x1000ec6a
add al, byte [eax]
invalid
mov eax, dword [ebp - 0x1510]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc28], edx
push edx
add edx, 0x446e
sub edx, 0x877a
jmp 0x1000e9e9
and edx, 0x648e
pop edx
push edi
push esi
add esp, 4
call 0x1000ea03
add byte [edi + edi + 0x3f], al
dec ebx
cmp ecx, dword [esp + eax*2 + 0x4a]
add esp, 4
pop edi
cmp dword [ebp - 0xc28], 0
jne 0x1000ea1f
mov dword [ebp - 0x728], 0
jmp 0x1000ec6a
mov eax, dword [ebp - 0xc28]
mov dword [ebp - 0x4c0], eax

Function at 0x1000ea03
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
cmp dword [ebp - 0x1510], 0
jne 0x1000e9c3
mov dword [ebp - 0x728], 0
jmp 0x1000ec6a
add al, byte [eax]
invalid
mov eax, dword [ebp - 0x1510]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0xc28], edx
push edx
add edx, 0x446e
sub edx, 0x877a
jmp 0x1000e9e9
and edx, 0x648e
pop edx
push edi
push esi
add esp, 4
call 0x1000ea03
add byte [edi + edi + 0x3f], al
dec ebx
cmp ecx, dword [esp + eax*2 + 0x4a]
add esp, 4
pop edi
cmp dword [ebp - 0xc28], 0
jne 0x1000ea1f
mov dword [ebp - 0x728], 0
jmp 0x1000ec6a
mov eax, dword [ebp - 0xc28]
mov dword [ebp - 0x4c0], eax
Function at 0x1000f137
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
add esp, 4
jmp 0x1000e5a6
xor ebx, 0xac54
pop ebx
push edx
or edx, 0x11d1e
xor edx, 0x17fa4
call 0x1000e5c6
add byte [edx], bh
dec esp
inc eax
cmp dword [eax - 0x7d], edx
les eax, [edx + ebx*2]
lea eax, [ebp - 0x15cc]
mov dword [ebp - 0xc18], eax
mov ecx, dword [ebp - 0x4bc]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0xc14], edx
xor eax, eax
mov word [ebp - 0x1ac], ax
xor ecx, ecx
inc dword [eax]
jne 0x1000e784
push edi
push eax
add esp, 4
jmp 0x1000e74e
add edi, 0x16968
jmp 0x1000e75b
xor edi, 0x104e7
pop edi
push ecx
sub ecx, 0xa190
and ecx, 0x17d66
sub ecx, 0x140a8
pop ecx
mov edx, dword [ebp - 0x4bc]
mov dword [ebp - 0x2a0], edx
jmp 0x1000e7ec
push eax
push ecx
add esp, 4
add eax, 0xd143
call 0x1000e79c
add byte [ebp + 0x36], cl
inc ebx
inc edx
cmp al, 0x49
xor al, 0x83
les eax, [eax + ebx*2]
push eax
add eax, 0x2441
sub eax, 0x136cf
jmp 0x1000e7b5
pop eax
mov eax, dword [ebp - 0x4bc]
mov ecx, dword [eax]
mov dword [ebp - 0x4bc], ecx
mov edx, dword [ebp - 0x4bc]
cmp edx, dword [ebp - 0xc1c]
je 0x1000e7e2
mov eax, dword [ebp - 0x4bc]
cmp dword [eax + 0x30], 0
jne 0x1000e598
mov dword [ebp - 0x2a0], 0
push esi
sub esi, 0xe54f
and esi, 0x8775
add esi, 0x2d36
pop esi
push eax
push edx
add esp, 4
xor eax, 0xeb6d
sub eax, 0x11b4e
add eax, 0xb85f
add eax, 0x131c
pop eax
cmp dword [ebp - 0x2a0], 0
pushal
std
invalid
inc dword [eax]
jne 0x1000f123
mov ecx, 0x6b
mov word [ebp - 0x1638], cx
mov edx, 0x65
mov word [ebp - 0x1636], dx
mov eax, 0x72
mov word [ebp - 0x1634], ax
mov ecx, 0x6e
mov word [ebp - 0x1632], cx
mov edx, 0x65
mov word [ebp - 0x1630], dx
mov eax, 0x6c
mov word [ebp - 0x162e], ax
mov ecx, 0x33
mov word [ebp - 0x162c], cx
mov edx, 0x32
mov word [ebp - 0x162a], dx
mov eax, 0x2e
push eax
push eax
add esp, 4
call 0x1000f137
add byte [eax + 0x36], al
cmp al, 0x33
inc edx
dec eax
inc edi
inc edx
cmp eax, 0x8104c483
invalid
Function at 0x1002f290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x28
push ebx
push esi
push edi
mov edi, ecx
mov byte [esp + 0x20], 0
mov esi, edx
mov byte [esp + 0x31], 0
xorps xmm0, xmm0
mov dword [esp + 0xc], 0x45555254
push esi
mov eax, dword [edi + 0xc]
movups xmmword [esp + 0x25], xmm0
mov dword [esp + 0x14], 0x49534956
mov dword [esp + 0x18], 0x582d4e4f
mov dword [esp + 0x1c], 0x454c4946
mov word [esp + 0x20], 0x2e
call eax
mov ecx, dword [edi + 8]
mov ebx, eax
push 2
push 0
push esi
call ecx
mov ecx, dword [edi + 0xc]
push esi
call ecx
add eax, 0xffffffee
add eax, ebx
test eax, eax
jle 0x1002f30b
push 0
push eax
mov eax, dword [edi + 8]
push esi
call eax
push esi
push 0x12
push 1
lea eax, [esp + 0x2c]
push eax
mov eax, dword [edi]
call eax
mov eax, dword [edi + 8]
push 0
push ebx
push esi
call eax
lea edx, [esp + 0xc]
mov esi, 0xe
lea eax, [esp + 0x20]
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x1002f346
add edx, 4
add eax, 4
sub esi, 4
jae 0x1002f321
mov cx, word [edx]
cmp cx, word [eax]
jne 0x1002f346
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x28
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x28
ret
Function at 0x1003e550
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
test esi, esi
je 0x1003e627
mov ebx, dword [esi]
cmp dword [ebx], 1
jne 0x1003e627
lea ecx, [ebx + 0x130]
mov edx, 0x10
and ecx, 0xf
mov eax, edx
sub eax, ecx
neg ecx
push ebp
sbb ecx, ecx
and ecx, eax
push edi
movzx edi, word [ecx + ebx + 0x146]
shr edi, 3
lea eax, [edi - 3]
cmp eax, 1
ja 0x1003e61f
lea eax, [ebx + 0x130]
and eax, 0xf
sub edx, eax
neg eax
sbb eax, eax
and eax, edx
cmp dword [ebx + 0x128], 0
mov ebp, dword [eax + ebx + 0x140]
je 0x1003e5c2
mov ebx, dword [ebx + 0x12c]
jmp 0x1003e5ce
push esi
call sym.FreeImage.dll__FreeImage_GetLine_4
lea ebx, [eax + 3]
and ebx, 0xfffffffc
push esi
call sym.FreeImage.dll__FreeImage_GetLine_4
push esi
mov dword [esp + 0x14], eax
call sym.FreeImage.dll__FreeImage_GetBits_4
mov edx, eax
test ebp, ebp
je 0x1003e614
mov eax, dword [esp + 0x10]
lea esi, [edx + eax]
mov ecx, edx
cmp edx, esi
jae 0x1003e60d
movzx eax, byte [ecx + 2]
xor byte [ecx], al
movzx eax, byte [ecx]
xor byte [ecx + 2], al
movzx eax, byte [ecx + 2]
xor byte [ecx], al
add ecx, edi
cmp ecx, esi
jb 0x1003e5f1
mov eax, dword [esp + 0x10]
add edx, ebx
sub ebp, 1
jne 0x1003e5e8
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
pop ecx
ret
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret
pop esi
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x1003fa40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x14]
xor ebx, ebx
push edi
xor edi, edi
test ebp, ebp
jle 0x1003faab
push esi
mov esi, dword [esp + 0x18]
movzx eax, byte [esi]
test edi, edi
je 0x1003fa61
and eax, 0xf
inc esi
jmp 0x1003fa64
shr eax, 4
mov ecx, dword [esp + 0x20]
xor edi, 1
movzx edx, byte [ecx + eax*4 + 2]
lea ecx, [ecx + eax*4]
mov eax, 0xfff8
and dx, ax
movzx eax, byte [ecx + 1]
shl dx, 5
or dx, ax
mov eax, 0xfff8
and dx, ax
mov al, byte [ecx]
shr al, 3
shl dx, 2
movzx eax, al
or dx, ax
mov eax, dword [esp + 0x14]
mov word [eax + ebx*2], dx
inc ebx
cmp ebx, ebp
jl 0x1003fa54
pop esi
pop edi
pop ebp
pop ebx
ret 0x10

Function at 0x100409b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
xor esi, esi
test ebx, ebx
jle 0x10040a29
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
add eax, 2
push edi
mov edi, dword [esp + 0x1c]
nop dword [eax]
movzx ecx, byte [edx]
test esi, esi
je 0x100409f8
and ecx, 0xf
movzx ecx, byte [edi + ecx*4]
mov byte [eax - 2], cl
movzx ecx, byte [edx]
and ecx, 0xf
movzx ecx, byte [edi + ecx*4 + 1]
mov byte [eax - 1], cl
movzx ecx, byte [edx]
and ecx, 0xf
inc edx
jmp 0x10040a16
shr ecx, 4
movzx ecx, byte [edi + ecx*4]
mov byte [eax - 2], cl
movzx ecx, byte [edx]
shr ecx, 4
movzx ecx, byte [edi + ecx*4 + 1]
mov byte [eax - 1], cl
movzx ecx, byte [edx]
shr ecx, 4
movzx ecx, byte [edi + ecx*4 + 2]
xor esi, 1
mov byte [eax], cl
add eax, 3
sub ebx, 1
jne 0x100409d0
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x100415b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
xor esi, esi
test ebx, ebx
jle 0x1004162d
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
add eax, 2
push edi
mov edi, dword [esp + 0x1c]
nop dword [eax]
movzx ecx, byte [edx]
test esi, esi
je 0x100415f8
and ecx, 0xf
movzx ecx, byte [edi + ecx*4]
mov byte [eax - 2], cl
movzx ecx, byte [edx]
and ecx, 0xf
movzx ecx, byte [edi + ecx*4 + 1]
mov byte [eax - 1], cl
movzx ecx, byte [edx]
and ecx, 0xf
inc edx
jmp 0x10041616
shr ecx, 4
movzx ecx, byte [edi + ecx*4]
mov byte [eax - 2], cl
movzx ecx, byte [edx]
shr ecx, 4
movzx ecx, byte [edi + ecx*4 + 1]
mov byte [eax - 1], cl
movzx ecx, byte [edx]
shr ecx, 4
movzx ecx, byte [edi + ecx*4 + 2]
xor esi, 1
mov byte [eax], cl
mov byte [eax + 1], 0xff
add eax, 4
sub ebx, 1
jne 0x100415d0
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x100418d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
xor esi, esi
test ebx, ebx
jle 0x1004198d
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
add eax, 2
push ebp
mov ebp, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x20]
movzx ecx, byte [edx]
test esi, esi
je 0x1004193c
and ecx, 0xf
movzx ecx, byte [edi + ecx*4]
mov byte [eax - 2], cl
movzx ecx, byte [edx]
and ecx, 0xf
movzx ecx, byte [edi + ecx*4 + 1]
mov byte [eax - 1], cl
movzx ecx, byte [edx]
and ecx, 0xf
movzx ecx, byte [edi + ecx*4 + 2]
mov byte [eax], cl
movzx ecx, byte [edx]
and ecx, 0xf
cmp ecx, dword [esp + 0x28]
jge 0x10041934
movzx ecx, byte [ecx + ebp]
inc edx
jmp 0x10041979
mov ecx, 0xff
inc edx
jmp 0x10041979
shr ecx, 4
movzx ecx, byte [edi + ecx*4]
mov byte [eax - 2], cl
movzx ecx, byte [edx]
shr ecx, 4
movzx ecx, byte [edi + ecx*4 + 1]
mov byte [eax - 1], cl
movzx ecx, byte [edx]
shr ecx, 4
cmp dword [esp + 0x28], 0
movzx ecx, byte [edi + ecx*4 + 2]
mov byte [eax], cl
jle 0x10041974
movzx ecx, byte [edx]
shr ecx, 4
movzx ecx, byte [ecx + ebp]
jmp 0x10041979
mov ecx, 0xff
mov byte [eax + 1], cl
xor esi, 1
add eax, 4
sub ebx, 1
jne 0x100418f5
pop edi
pop ebp
pop esi
pop ebx
ret 0x18

Function at 0x100424a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
xor edx, edx
push esi
mov esi, 1
test ebx, ebx
jle 0x1004254a
movss xmm2, dword [0x103f932c]
movss xmm3, dword [0x103f9360]
movss xmm4, dword [0x103f9308]
movss xmm5, dword [0x103f9358]
push ebp
mov ebp, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x14]
nop
mov eax, dword [esp + 0x18]
movzx ecx, byte [edx + eax]
movzx eax, byte [ebp + ecx*4 + 2]
movd xmm1, eax
movzx eax, byte [ebp + ecx*4 + 1]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movzx eax, byte [ebp + ecx*4]
mulss xmm1, xmm2
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm3
addss xmm1, xmm0
movd xmm0, eax
mov eax, edx
cvtdq2ps xmm0, xmm0
mulss xmm0, xmm4
addss xmm1, xmm0
addss xmm1, xmm5
cvttss2si ecx, xmm1
test esi, esi
je 0x10042538
and cl, 0xf0
sar eax, 1
mov byte [eax + edi], cl
jmp 0x10042540
sar eax, 1
shr cl, 4
or byte [eax + edi], cl
inc edx
xor esi, 1
cmp edx, ebx
jl 0x100424e0
pop edi
pop ebp
pop esi
pop ebx
ret 0x10
Function at 0x10054970
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push edi
mov edi, ecx
cmp dword [edi + 0x44], 0
jne 0x10054a1e
cmp dword [edi + 0x28], 0x20
jbe 0x10054a1e
mov eax, dword [edi + 0x24]
push ebx
lea ebx, [edi + 0x24]
push ebp
mov eax, dword [eax + 4]
push esi
push 0
mov ebp, dword [eax + 8]
imul eax, dword [ebp], 0xfff8
push eax
push dword [edi]
call fcn.10276a12
push dword [edi]
push 1
push 0xfff8
push dword [ebp + 8]
call fcn.10276c65
push dword [ebp + 8]
call fcn.10269476
mov dword [ebp + 8], 0
lea esi, [edi + 0x2c]
mov eax, dword [ebx]
add esp, 0x20
mov ecx, dword [esi]
mov eax, dword [eax + 4]
mov ecx, dword [ecx]
cmp eax, dword [ebx]
je 0x100549f7
mov edx, dword [eax]
cmp esi, ebx
jne 0x100549eb
cmp ecx, eax
je 0x100549f7
cmp ecx, edx
je 0x100549f7
push ecx
push edx
push eax
push ebx
push ecx
mov ecx, esi
call fcn.10055300
mov eax, dword [ebp]
lea ecx, [edi + 0x34]
mov esi, dword [esi]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
mov esi, dword [esi]
push eax
call fcn.100555f0
mov eax, dword [esp + 0x14]
mov dword [eax + 0x14], esi
pop esi
pop ebp
pop ebx
pop edi
add esp, 0xc
ret

Function at 0x10054b10
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebp
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x40], 0
jne 0x10054c06
mov eax, dword [edi + 0x34]
mov esi, eax
mov ecx, dword [esp + 0x18]
mov edx, dword [eax + 4]
cmp byte [edx + 0xd], 0
jne 0x10054b48
cmp dword [edx + 0x10], ecx
jge 0x10054b3e
mov edx, dword [edx + 8]
jmp 0x10054b42
mov esi, edx
mov edx, dword [edx]
cmp byte [edx + 0xd], 0
je 0x10054b34
cmp esi, eax
je 0x10054b51
cmp ecx, dword [esi + 0x10]
jge 0x10054b53
mov esi, eax
cmp esi, eax
je 0x10054c06
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 8]
mov dword [edi + 0x40], eax
cmp dword [eax + 8], 0
jne 0x10054bf3
push ebx
push 0xfff8
call fcn.1026947b
mov ecx, dword [edi + 0x40]
push 0
mov dword [ecx + 8], eax
mov eax, dword [edi + 0x40]
imul eax, dword [eax], 0xfff8
push eax
push dword [edi]
call fcn.10276a12
push dword [edi]
mov eax, dword [edi + 0x40]
push 1
push 0xfff8
push dword [eax + 8]
call fcn.10276e89
mov ecx, dword [edi + 0x24]
lea ebx, [edi + 0x24]
mov eax, dword [esi + 0x14]
add esp, 0x20
lea esi, [edi + 0x2c]
mov ecx, dword [ecx]
cmp eax, dword [esi]
je 0x10054bd5
mov edx, dword [eax]
cmp ebx, esi
jne 0x10054bc9
cmp ecx, eax
je 0x10054bd5
cmp ecx, edx
je 0x10054bd5
push ecx
push edx
push eax
push esi
push ecx
mov ecx, ebx
call fcn.10055300
mov esi, dword [ebx]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x14]
push eax
mov esi, dword [esi]
lea ecx, [edi + 0x34]
call fcn.100555f0
mov eax, dword [esp + 0x10]
pop ebx
mov dword [eax + 0x14], esi
mov ecx, edi
call fcn.10054970
mov eax, dword [edi + 0x40]
pop edi
pop esi
pop ebp
add esp, 8
ret 4
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 8
ret 4
Function at 0x10079ce0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x10079d0f
push esi
call fcn.10082320
add esp, 4
cmp byte [esi + 0x40], 0
je 0x10079d08
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
push edi
cmp eax, 0xcb
jne 0x10079d92
mov eax, dword [esi + 0x1a8]
cmp byte [eax + 0x10], 0
je 0x10079d7d
mov eax, dword [esi + 8]
test eax, eax
je 0x10079d35
mov eax, dword [eax]
push esi
call eax
add esp, 4
mov eax, dword [esi + 0x1a8]
push esi
mov eax, dword [eax]
call eax
add esp, 4
test eax, eax
je 0x10079d78
cmp eax, 2
je 0x10079d7d
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10079d26
cmp eax, 3
je 0x10079d5d
cmp eax, 1
jne 0x10079d26
inc dword [ecx + 4]
mov edx, dword [esi + 8]
mov edi, dword [edx + 8]
cmp dword [ecx + 4], edi
jl 0x10079d26
mov eax, dword [esi + 0x128]
add eax, edi
mov dword [edx + 8], eax
jmp 0x10079d26
pop edi
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.1007a030
add esp, 4
pop edi
pop esi
ret
cmp eax, 0xcc
je 0x10079db4
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x15
mov ecx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x18], eax
mov eax, dword [esi]
mov eax, dword [eax]
call eax
add esp, 4
push esi
call fcn.1007a030
add esp, 4
pop edi
pop esi
ret

Function at 0x1007a030
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
cmp dword [esi + 0x14], 0xcc
je 0x1007a05c
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
add esp, 4
mov dword [esi + 0x78], 0
mov dword [esi + 0x14], 0xcc
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
je 0x1007a0e2
lea ebx, [esi + 0x78]
nop dword [eax + eax]
mov eax, dword [ebx]
cmp eax, dword [esi + 0x60]
jae 0x1007a0b6
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1007a095
mov dword [ecx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x60]
push esi
mov dword [ecx + 8], eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
call eax
add esp, 4
mov eax, dword [esi + 0x19c]
mov edi, dword [ebx]
push 0
push ebx
mov eax, dword [eax + 4]
push 0
push esi
call eax
mov eax, dword [ebx]
add esp, 0x10
cmp eax, edi
je 0x1007a0f8
cmp eax, dword [esi + 0x60]
jb 0x1007a077
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax + 4]
call eax
mov eax, dword [esi + 0x198]
push esi
mov eax, dword [eax]
call eax
mov dword [ebx], 0
add esp, 8
mov eax, dword [esi + 0x198]
cmp byte [eax + 8], 0
jne 0x1007a070
xor eax, eax
cmp byte [esi + 0x41], al
pop edi
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov al, 1
pop esi
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret