joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009adb0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esi + 0x12c]
sub eax, esi
sub eax, 0x28
add dword [esi + 0x130], eax
mov eax, dword [esi + 0x20]
push edi
lea edi, [esi + 0x28]
mov dword [esi + 0x12c], edi
mov dword [esi + 0x128], edi
test eax, eax
je 0x1009ae11
mov ecx, dword [esi + 0x24]
add ecx, dword [esi + 0x1c]
cmp dword [esi + 0x130], ecx
jb 0x1009adea
xor eax, eax
pop edi
ret
test eax, eax
je 0x1009ae11
mov ecx, dword [esi + 0x24]
mov eax, dword [esi + 0x1c]
mov edx, dword [esi + 0x130]
push ebx
push ebp
lea ebx, [eax + ecx]
lea ebp, [edx + 0x100]
cmp ebp, ebx
pop ebp
pop ebx
jbe 0x1009ae11
sub eax, edx
add eax, ecx
jmp 0x1009ae16
mov eax, 0x100
mov edx, dword [esi + 0x18]
push edx
push eax
push 1
push edi
call fcn.101088d1
lea eax, [eax + esi + 0x28]
add esp, 0x10
cmp dword [esi + 0x128], eax
mov dword [esi + 0x12c], eax
sbb eax, eax
neg eax
pop edi
ret

Function at 0x1009b5e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101bd2a8
mov eax, dword fs:[0]
push eax
mov eax, dword [0x102832a0]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov edx, dword [esp + 0x14]
push edx
call fcn.1009a3e0
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [edx], vtable.ASCII85Stream.0
mov dword [edx + 0x34], eax
mov dword [edx + 0x30], eax
mov dword [edx + 0x38], eax
mov dword [esp + 0xc], 0xffffffff
mov eax, edx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret 4
Function at 0x1009c280
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101bd338
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x102832a0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
push esi
call fcn.1009a3e0
xor edi, edi
mov dword [esp + 0x14], edi
cmp edx, 1
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esi], vtable.CCITTFaxStream.0
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], edx
jge 0x1009c2de
mov dword [esi + 0x18], 1
jmp 0x1009c2ed
cmp edx, 0x7ffffffd
jle 0x1009c2ed
mov dword [esi + 0x18], SysReAllocString
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov dword [esi + 0x1c], ecx
mov ecx, dword [esi + 0x18]
add ecx, 1
mov dword [esi + 0x20], edx
mov dword [esi + 0x24], eax
je 0x1009c33a
lea eax, [ecx*4]
cmp ecx, 0x1ffffffe
ja 0x1009c324
cmp eax, edi
jbe 0x1009c33a
call fcn.100550f0
jmp 0x1009c33c
push str.Bogus_memory_allocation_size_n
call fcn.10107014
add eax, 0x40
push eax
call fcn.10106bd7
add esp, 8
xor eax, eax
mov ecx, dword [esi + 0x18]
add ecx, 2
mov dword [esi + 0x3c], eax
je 0x1009c377
lea eax, [ecx*4]
cmp ecx, 0x1ffffffe
ja 0x1009c361
cmp eax, edi
jbe 0x1009c377
call fcn.100550f0
jmp 0x1009c379
push str.Bogus_memory_allocation_size_n
call fcn.10107014
add eax, 0x40
push eax
call fcn.10106bd7
add esp, 8
xor eax, eax
mov ecx, dword [esi + 0x3c]
mov dword [esi + 0x40], eax
cmp ecx, edi
je 0x1009c391
cmp eax, edi
je 0x1009c391
mov edx, dword [esi + 0x18]
mov dword [esi + 0x28], edi
mov dword [ecx], edx
jmp 0x1009c398
mov dword [esi + 0x28], 1
xor eax, eax
cmp dword [esi + 0xc], edi
mov dword [esi + 0x30], edi
setl al
mov dword [esi + 0x38], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x2c], eax
mov eax, 0xffffffff
mov dword [esi + 0x50], eax
mov dword [esp + 0x14], eax
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 0x1c
Function at 0x100b5d90
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x101be43c
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x102832a0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x1c]
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov dword [esi + 4], ecx
mov edx, dword [edi + 8]
mov dword [esi + 8], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x10], ecx
mov edx, dword [edi + 0x14]
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov ecx, dword [edi + 0x1c]
mov dword [esi + 0x1c], ecx
mov edx, dword [edi + 0x20]
mov dword [esi + 0x20], edx
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov ecx, dword [edi + 0x28]
mov dword [esi + 0x28], ecx
mov edx, dword [edi + 0x2c]
mov dword [esi + 0x2c], edx
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x38]
mov dword [esi + 0x38], edx
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov ecx, dword [edi + 0x40]
mov dword [esi + 0x40], ecx
mov edx, dword [edi + 0x44]
lea eax, [edi + 0x48]
push eax
lea ecx, [esi + 0x48]
mov dword [esi + 0x44], edx
call fcn.10007250
mov dword [esp + 0x14], 0
lea ecx, [edi + 0x4c]
push ecx
lea ecx, [esi + 0x4c]
call fcn.10007250
mov byte [esp + 0x14], 1
lea edx, [edi + 0x50]
push edx
lea ecx, [esi + 0x50]
call fcn.10007250
mov byte [esp + 0x14], 2
add edi, 0x54
push edi
lea ecx, [esi + 0x54]
call fcn.10007250
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x100bae00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101bf7e2
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x102832a0]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
lea eax, [esi + 0xc]
push eax
call fcn.100c0800
mov dword [esp + 0x10], 0
lea ecx, [esi + 0x20]
call fcn.100073a0
mov byte [esp + 0x10], 1
lea ecx, [esi + 0x30]
push ecx
call fcn.100c0ca0
mov byte [esp + 0x10], 2
lea edx, [esi + 0x44]
push edx
call fcn.100c0e50
mov dword [esp + 0x10], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4

Function at 0x100bae80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101bf37a
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x102832a0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
mov eax, 2
mov dword [esp + 0x18], eax
lea esi, [edi + 0x44]
mov dword [esp + 0xc], esi
mov byte [esp + 0x18], al
call fcn.100c0d00
mov al, 1
mov byte [esp + 0x18], al
lea esi, [edi + 0x30]
mov dword [esp + 0xc], esi
mov byte [esp + 0x18], al
call fcn.100c0b30
mov byte [esp + 0x18], 0
lea ecx, [edi + 0x20]
call fcn.100072b0
or eax, 0xffffffff
mov dword [esp + 0x18], eax
lea esi, [edi + 0xc]
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], eax
call fcn.100c06f0
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x100bafe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x101c1092
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x102832a0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, dword [ebx]
mov dword [esi], eax
mov ecx, dword [ebx + 4]
mov dword [esi + 4], ecx
mov edx, dword [ebx + 8]
lea eax, [esi + 0xc]
lea edi, [ebx + 0xc]
push eax
mov dword [esi + 8], edx
call fcn.100c0780
mov dword [esp + 0x14], 0
lea ecx, [ebx + 0x20]
push ecx
lea ecx, [esi + 0x20]
call fcn.10007250
mov byte [esp + 0x14], 1
mov edx, dword [ebx + 0x24]
mov dword [esi + 0x24], edx
mov eax, dword [ebx + 0x28]
mov dword [esi + 0x28], eax
mov ecx, dword [ebx + 0x2c]
lea edx, [esi + 0x30]
lea edi, [ebx + 0x30]
push edx
mov dword [esi + 0x2c], ecx
call fcn.100c0c20
mov byte [esp + 0x14], 2
lea eax, [esi + 0x44]
lea edi, [ebx + 0x44]
push eax
call fcn.100c0dd0
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x100c34e0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c0c50
mov eax, dword fs:[0]
push eax
sub esp, 0x510
mov eax, dword [0x102832a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
xor eax, eax
mov dword [ebx + 4], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea esi, [ebp - 0x118]
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
lea esp, [esp]
cmp byte [esi], 0
je 0x100c3564
push esi
call edi
cmp eax, 3
jne 0x100c3587
push 0
push 0
push 0
push 0
add ebx, 4
push ebx
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1010583a
mov esp, ebp
pop ebp
ret
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100c3590
sub eax, edx
lea esi, [esi + eax + 1]
jmp 0x100c3540
Function at 0x100d0d70
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x20c]
mov dword [esi], vtable.GImageMNG.0
test eax, eax
je 0x100d0db0
push eax
mov byte [esi + 0x223], 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esi + 0x20c]
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esi + 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi + 0x204]
test eax, eax
je 0x100d0dc3
push eax
call fcn.10109eb5
add esp, 4
mov eax, dword [esi + 0x208]
test eax, eax
je 0x100d0dd6
push eax
call fcn.10109eb5
add esp, 4
cmp dword [esi + 0x1fc], 0
lea eax, [esi + 0x1fc]
je 0x100d0dee
push eax
call fcn.1018c860
add esp, 4
mov ecx, esi
mov dword [esi], vtable.GImage.0
call fcn.100c4a90
mov ecx, esi
pop esi
jmp fcn.100c49e0
Function at 0x100d3800
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x324
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push esi
push edi
call edx
mov esi, dword [ebp + 0xc]
mov ecx, 0xc1
lea edi, [esp + 0x28]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 0
rep movsd dword es:[edi], dword [esi]
mov byte [esp + 0xe], 1
lea ebx, [ebx]
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov edx, dword [eax + 8]
push 1
push 1
lea ecx, [esp + 0x17]
push ecx
mov ecx, esi
call edx
cmp eax, 1
jne 0x100d3a04
cmp byte [esp + 0xe], 0
mov al, byte [esp + 0xf]
jne 0x100d386d
test al, al
jne 0x100d3840
cmp al, 0x21
je 0x100d39f7
cmp al, 0x2c
je 0x100d388a
cmp al, 0x3b
je 0x100d3a04
test al, al
sete byte [esp + 0xe]
jmp 0x100d3840
mov eax, dword [esi]
mov edx, dword [eax + 8]
push 1
push 9
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call edx
mov eax, dword [esp + 0x10]
push eax
mov ecx, ebx
call fcn.100c5ba0
mov ecx, dword [esp + 0x12]
push ecx
mov ecx, ebx
mov word [esp + 0x14], ax
call fcn.100c5ba0
mov edx, dword [esp + 0x14]
push edx
mov ecx, ebx
mov word [esp + 0x16], ax
call fcn.100c5ba0
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x16]
push eax
mov ecx, ebx
call fcn.100c5ba0
mov ecx, dword [ebp + 0x10]
cmp word [ecx + 6], 0
mov dx, word [esp + 0x14]
mov word [esp + 0x16], ax
jne 0x100d38fe
cmp word [ecx + 8], 0
jne 0x100d38fe
mov word [ecx + 6], dx
mov word [ecx + 8], ax
movzx edi, word [esp + 0x10]
movzx ecx, word [ecx + 6]
movzx edx, dx
add edx, edi
cmp edx, ecx
jg 0x100d3840
movzx ecx, word [esp + 0x12]
movzx edx, ax
add edx, ecx
mov ecx, dword [ebp + 0x10]
movzx ecx, word [ecx + 8]
cmp edx, ecx
jg 0x100d3840
mov cl, byte [esp + 0x18]
inc dword [esp + 0x1c]
test cl, cl
jns 0x100d396a
mov edx, dword [esi]
mov edx, dword [edx + 8]
movzx ecx, cl
and ecx, 7
inc ecx
mov eax, 1
shl eax, cl
push 1
lea ecx, [esp + 0x30]
mov word [esp + 0x2e], ax
cwde
lea eax, [eax + eax*2]
push eax
push ecx
mov ecx, esi
call edx
mov cl, byte [esp + 0x18]
mov ax, word [esp + 0x16]
movzx ecx, cl
xor edx, edx
movzx eax, ax
and ecx, 0x40
mov dword [ebx + 0x214], ecx
mov dword [ebx + 0x220], eax
mov dword [esp + 0x20], edx
mov dword [ebx + 0x228], 0x4000
mov dword [ebx + 0x21c], 8
mov dword [ebx + 0x218], edx
mov dword [ebx + 0x224], edx
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push edx
push 0
push esi
mov ecx, ebx
mov edi, eax
call fcn.100d3030
cmp dword [esp + 0x20], 0
je 0x100d39d9
push edi
push esi
mov ecx, ebx
call fcn.100d3360
jmp 0x100d3840
mov ecx, dword [ebx + 0x228]
sub ecx, dword [ebx + 0x22c]
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
inc ecx
push 1
push ecx
mov ecx, esi
call edx
jmp 0x100d3840
push esi
mov ecx, ebx
call fcn.100d26e0
jmp 0x100d3840
mov ecx, dword [esp + 0x24]
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push 0
push ecx
mov ecx, esi
call edx
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100d4990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
push ebp
push esi
mov esi, ecx
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xf89c], eax
mov dword [esi + 0xf898], ecx
mov dword [esi + 0xf88c], ecx
mov edx, 1
shl edx, cl
dec ecx
mov eax, 1
shl eax, cl
push edi
xor edi, edi
dec edx
mov dword [esi + 0xf8a0], eax
inc eax
mov dword [esi + 0xf8a4], eax
mov ax, word [esi + 0xf8a0]
add ax, 2
mov ecx, esi
mov dword [esi + 0xf894], edi
mov dword [esi + 0x210], edi
mov dword [esi + 0x20c], edi
mov word [esi + 0xf890], dx
mov word [esi + 0xf892], ax
mov dword [esi + 0xf8a8], edi
call fcn.100d2c90
mov dword [esp + 0x10], eax
xor ecx, ecx
mov eax, 0x138b
add eax, eax
inc ecx
cmp eax, 0x10000
jl 0x100d4a11
mov eax, 8
sub eax, ecx
push 0x138b
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.100d2d20
movzx ecx, word [esi + 0xf8a0]
push ecx
mov ecx, esi
call fcn.100d44d0
mov ecx, esi
call fcn.100d2c90
mov ebp, eax
cmp ebp, 0xffffffff
je 0x100d4b56
push ebx
mov ecx, dword [esp + 0x18]
movsx edi, bp
shl edi, cl
mov ebx, ebp
shl ebx, 0xc
add ebx, dword [esp + 0x14]
xor edi, dword [esp + 0x14]
mov ecx, dword [esi + edi*4 + 0x8348]
lea eax, [esi + edi*4 + 0x8348]
cmp ecx, ebx
jne 0x100d4a8d
movzx edx, word [esi + edi*2 + 0xd174]
mov dword [esp + 0x14], edx
jmp 0x100d4b43
test ecx, ecx
jl 0x100d4ac5
mov ecx, 0x138b
sub ecx, edi
test edi, edi
jne 0x100d4aa1
mov ecx, 1
lea edx, [ecx*4]
sub edi, ecx
sub eax, edx
test edi, edi
jge 0x100d4abb
add edi, 0x138b
add eax, 0x4e2c
mov edx, dword [eax]
cmp edx, ebx
je 0x100d4afe
test edx, edx
jg 0x100d4aa1
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, esi
call fcn.100d44d0
movzx eax, word [esi + 0xf892]
mov edx, 0x1000
cmp ax, dx
mov dword [esp + 0x14], ebp
jge 0x100d4b0c
mov word [esi + edi*2 + 0xd174], ax
inc word [esi + 0xf892]
mov dword [esi + edi*4 + 0x8348], ebx
jmp 0x100d4b43
movzx eax, word [esi + edi*2 + 0xd174]
mov dword [esp + 0x14], eax
jmp 0x100d4b43
push 0x138b
mov ecx, esi
call fcn.100d2d20
movzx ecx, word [esi + 0xf8a0]
mov ax, word [esi + 0xf8a0]
add ax, 2
push ecx
mov ecx, esi
mov word [esi + 0xf892], ax
mov dword [esi + 0xf894], 1
call fcn.100d44d0
mov ecx, esi
call fcn.100d2c90
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x100d4a54
pop ebx
mov edx, dword [esp + 0x10]
push edx
mov ecx, esi
call fcn.100d44d0
movzx eax, word [esi + 0xf8a4]
push eax
mov ecx, esi
call fcn.100d44d0
pop edi
pop esi
pop ebp
ret 8
Function at 0x100d91d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x20
push ebp
push edi
mov edi, dword [esp + 0x2c]
xor ebp, ebp
xor eax, eax
mov dword [esp + 8], ebp
cmp ax, word [edi + 0x6600]
jae 0x100d93f6
push ebx
push esi
movzx eax, word [edi + 0x6602]
mov dword [esp + 0x34], 0
test eax, eax
jbe 0x100d93e0
mov esi, ebp
and esi, 7
add esi, esi
mov dword [esp + 0x1c], esi
jmp 0x100d9224
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x34]
movzx eax, word [edi + 0x6608]
mov ebx, dword [edi + 0x6580]
movzx edx, word [edi + 0x660c]
and ecx, 1
add ecx, esi
add ecx, ecx
mov esi, dword [edi + 0x6630]
shr ebx, cl
mov dword [esp + 0x24], ecx
mov ecx, eax
shr ebp, cl
and ebx, 3
mov dword [esp + 0x2c], ebx
imul ebp, edx
mov edx, dword [esp + 0x34]
mov ecx, edx
mov dword [esp + 0x18], ecx
mov ecx, eax
mov eax, edx
shr eax, cl
add ebp, eax
lea ecx, [ebx + ebp*4]
xor eax, eax
cmp word [esi + ecx*2], ax
jne 0x100d93c4
mov esi, dword [esp + 0x10]
lea ecx, [esi + 2]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [ecx - 4]
cmp eax, ecx
ja 0x100d93c4
lea ecx, [edx + 2]
lea edx, [ecx - 4]
mov dword [esp + 0x20], edx
mov ebp, dword [esp + 0x20]
cmp ebp, ecx
ja 0x100d9380
mov edi, edi
movzx ecx, word [edi + 0x6600]
cmp eax, ecx
jae 0x100d9368
movzx ecx, word [edi + 0x6602]
cmp ebp, ecx
jae 0x100d9368
mov ecx, eax
and ecx, 7
mov edx, ebp
and edx, 1
lea esi, [edx + ecx*2]
mov edx, dword [edi + 0x6580]
add esi, esi
mov ebx, edx
mov ecx, esi
shr ebx, cl
mov ecx, dword [esp + 0x24]
shr edx, cl
xor ebx, edx
test bl, 3
jne 0x100d9368
movzx ebx, word [edi + 0x6608]
mov edx, dword [edi + 0x6580]
mov ecx, esi
shr edx, cl
mov ecx, ebx
mov esi, eax
shr esi, cl
movzx ecx, word [edi + 0x660c]
imul esi, ecx
mov ecx, ebp
mov dword [esp + 0x28], ecx
mov ecx, ebx
mov ebx, ebp
shr ebx, cl
mov ecx, dword [edi + 0x6630]
and edx, 3
add esi, ebx
lea esi, [edx + esi*4]
cmp word [ecx + esi*2], 0
je 0x100d9368
movzx ecx, word [edi + 0x6608]
movzx esi, word [edi + 0x660c]
inc dword [esp + 0x14]
mov ebx, eax
shr ebx, cl
imul ebx, esi
mov esi, ebp
shr esi, cl
mov ecx, dword [edi + 0x6630]
add ebx, esi
lea edx, [edx + ebx*4]
movzx ecx, word [ecx + edx*2]
add dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
inc ebp
add ecx, 2
cmp ebp, ecx
jbe 0x100d92b0
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 0x10]
inc eax
lea edx, [esi + 2]
cmp eax, edx
jbe 0x100d92a2
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x100d93c4
mov eax, dword [esp + 0x18]
movzx ecx, word [edi + 0x6608]
xor edx, edx
div ebp
movzx edx, word [edi + 0x660c]
shr esi, cl
imul esi, edx
mov edx, dword [esp + 0x34]
shr edx, cl
mov ecx, dword [edi + 0x6630]
add esi, edx
lea edx, [ebx + esi*4]
mov word [ecx + edx*2], ax
mov ecx, dword [esp + 0x34]
movzx eax, word [edi + 0x6602]
mov ebp, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x34], ecx
cmp ecx, eax
jb 0x100d9220
movzx eax, word [edi + 0x6600]
inc ebp
mov dword [esp + 0x10], ebp
cmp ebp, eax
jb 0x100d91f0
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x20
ret
Function at 0x100e0a10
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0xc], 0
push esi
push edi
je 0x100e0ab5
mov ecx, dword [esp + 0x18]
xor eax, eax
imul ecx, ecx, 0x2e90edd
inc ecx
mov dword [eax + 0x102aca40], ecx
add eax, 4
cmp eax, 0x10
jb 0x100e0a23
mov eax, dword [0x102aca48]
xor eax, dword [0x102aca40]
mov ecx, dword [0x102aca4c]
shr eax, 0x1f
lea edx, [ecx + ecx]
or eax, edx
mov dword [0x102aca4c], eax
mov eax, 0x102aca44
mov ecx, 0x7b
mov edx, dword [eax + 8]
xor edx, dword [eax]
mov esi, dword [eax - 4]
xor esi, dword [eax + 4]
shr edx, 0x1f
add esi, esi
or edx, esi
mov dword [eax + 0xc], edx
add eax, 4
sub ecx, 1
jne 0x100e0a60
mov esi, dword [sym.imp.WS2_32.dll_htonl]
mov dword [0x102aca28], ecx
lea esp, [esp]
mov eax, dword [ecx*4 + 0x102aca40]
push eax
call esi
mov ecx, dword [0x102aca28]
mov dword [ecx*4 + 0x102aca40], eax
inc ecx
mov dword [0x102aca28], ecx
cmp ecx, 0x7f
jb 0x100e0a90
jmp 0x100e0abb
mov ecx, dword [0x102aca28]
mov edi, dword [esp + 0x10]
test edi, edi
je 0x100e0b08
mov esi, dword [esp + 0xc]
lea edx, [ecx + 1]
push ebx
jmp 0x100e0ad0
lea eax, [edx - 0x40]
and eax, 0x7f
mov eax, dword [eax*4 + 0x102aca40]
mov ebx, edx
and ebx, 0x7f
xor eax, dword [ebx*4 + 0x102aca40]
mov ebx, ecx
and ebx, 0x7f
mov dword [ebx*4 + 0x102aca40], eax
xor dword [esi], eax
dec edi
inc ecx
inc edx
add esi, 4
test edi, edi
jne 0x100e0ad0
mov dword [0x102aca28], ecx
pop ebx
pop edi
pop esi
ret
Function at 0x100ea7f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov eax, dword [eax + 8]
push 0
push ecx
push edx
call eax
push esi
call fcn.100d8280
mov ebx, eax
add esp, 0x10
cmp ebx, 0xff
ja 0x100ea946
test ebx, ebx
je 0x100ea92e
push ebp
push edi
lea ebx, [ebx]
push esi
dec ebx
call fcn.100d81e0
push esi
movzx edi, ax
call fcn.100d81e0
mov ecx, dword [esi]
mov edx, dword [esi + 4]
movzx ebp, ax
mov eax, dword [ecx + 0x18]
push edx
call eax
add esp, 0xc
mov dword [esp + 0x10], eax
cmp edi, 0x100
jne 0x100ea87f
push esi
call fcn.100d81e0
push esi
mov word [esi + 0x65fc], ax
call fcn.100d81e0
add esp, 8
mov word [esi + 0x65fe], ax
jmp 0x100ea90d
cmp edi, 0x121
jne 0x100ea8bc
push esi
call fcn.100d81e0
push esi
mov word [esi + 0x6600], ax
call fcn.100d81e0
mov ecx, 0x10bc
add esp, 8
mov word [esi + 0x6602], ax
cmp ax, cx
jne 0x100ea90d
mov edx, 0x10bf
mov word [esi + 0x6602], dx
jmp 0x100ea90d
cmp edi, 0x130
jne 0x100ea8dd
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov edx, dword [eax + 0x1c]
push ecx
call edx
add esp, 4
sar eax, 7
mov dword [esi + 0x65b4], eax
jmp 0x100ea90d
cmp edi, 0x2ff0
jne 0x100ea90d
xor edi, edi
push esi
call fcn.100d81e0
movzx eax, ax
mov dword [esp + 0x1c], eax
mov ecx, edi
xor ecx, 1
fild dword [esp + 0x1c]
inc edi
add esp, 4
fstp dword [esi + ecx*4 + 0xe6c4]
cmp edi, 4
jb 0x100ea8e7
mov eax, dword [esp + 0x10]
mov edx, dword [esi]
mov ecx, dword [esi + 4]
mov edx, dword [edx + 8]
push 0
add eax, ebp
push eax
push ecx
call edx
add esp, 0xc
test ebx, ebx
jne 0x100ea830
pop edi
pop ebp
movzx eax, word [esi + 0x65b4]
mov cx, ax
shl word [esi + 0x6600], cl
shr word [esi + 0x6602], cl
pop esi
pop ebx
pop ecx
ret
Function at 0x100eb160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x102832a0]
xor eax, esp
mov dword [esp + 0x28], eax
fldz
push ebx
mov ebx, dword [ebp + 8]
fst qword [esp + 0x10]
mov eax, dword [ebx]
fstp qword [esp + 0x18]
mov edx, dword [ebx + 4]
mov eax, dword [eax]
push esi
push edi
mov esi, 2
push esi
push esi
lea ecx, [esp + 0x34]
push ecx
push edx
mov dword [esp + 0x20], ebx
call eax
add esp, 0x10
sub dword [ebp + 0xc], esi
je 0x100eb254
jmp 0x100eb1b8
mov ebx, dword [esp + 0x10]
fstp st(0)
fstp st(0)
mov ecx, dword [ebx]
mov edx, dword [ebx + 4]
mov eax, dword [ecx]
dec dword [ebp + 0xc]
push 1
push 2
lea edi, [esp + esi*2 + 0x34]
push edi
push edx
call eax
movzx edx, byte [edi]
movzx edi, byte [esp + esi*2 + 0x3d]
mov eax, esi
xor eax, 2
add eax, eax
movzx ecx, byte [esp + eax + 0x3c]
mov dword [esp + 0x1c], edx
shl edx, 8
or edi, edx
movzx edx, byte [esp + eax + 0x3d]
movzx eax, byte [esp + eax + 0x3d]
mov ebx, ecx
shl ebx, 8
or edx, ebx
sub edx, edi
mov dword [esp + 0x24], edx
movzx edx, byte [esp + esi*2 + 0x3d]
fild dword [esp + 0x24]
shl edx, 8
or edx, dword [esp + 0x1c]
fmul st(0), st(0)
shl eax, 8
or eax, ecx
sub eax, edx
fadd qword [esp + 0x28]
mov dword [esp + 0x1c], eax
inc esi
add esp, 0x10
fst qword [esp + 0x18]
and esi, 3
cmp dword [ebp + 0xc], 0
fild dword [esp + 0xc]
fmul st(0), st(0)
fadd qword [esp + 0x20]
fst qword [esp + 0x20]
jne 0x100eb1b0
fcompp
fnstsw ax
test ah, 0x41
mov eax, 0x4d4d
je 0x100eb259
mov eax, 0x4949
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1010583a
mov esp, ebp
pop ebp
ret