joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007e110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x34
push ebx
mov ebx, dword [esp + 0x3c]
xor edx, edx
push ebp
mov ebp, dword [esp + 0x44]
push edi
mov eax, dword [ebx + 0x5c]
mov dword [esp + 0x24], 0
mov ecx, dword [ebp + 0x108]
imul ecx, dword [ebp + 0x100]
div ecx
cmp dword [ebp + 0x4c], 0
mov edi, eax
mov dword [esp + 0x3c], edi
jle 0x1007e2e3
mov edx, dword [esp + 0x54]
xor ecx, ecx
sub dword [esp + 0x58], edx
mov dword [esp + 0x28], ecx
push esi
nop dword [eax]
mov esi, dword [ebp + 0x54]
add esi, ecx
mov dword [esp + 0x34], esi
mov eax, dword [esi + 8]
mov ebp, eax
imul eax, dword [esp + 0x50]
mov ecx, dword [esi + 0xc]
imul ebp, edi
xor edi, edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x14], eax
mov eax, ecx
imul eax, dword [esp + 0x54]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x30], eax
cmp dword [esi + 0x20], edi
jbe 0x1007e2b6
add edx, dword [esp + 0x5c]
mov dword [esp + 0x3c], edx
mov eax, dword [ebx + 4]
push 1
push ecx
push edi
push dword [edx]
mov eax, dword [eax + 0x20]
push ebx
call eax
mov ecx, dword [esp + 0x44]
mov ebx, eax
mov edx, dword [esp + 0x5c]
add ecx, edi
push 0
push dword [esi + 0xc]
mov eax, dword [edx + 4]
push ecx
mov ecx, dword [esp + 0x78]
mov eax, dword [eax + 0x20]
push dword [ecx]
push edx
call eax
xor ecx, ecx
mov dword [esp + 0x48], eax
add esp, 0x28
mov dword [esp + 0x1c], ecx
cmp dword [esi + 0xc], ecx
jle 0x1007e298
sub ebx, eax
mov dword [esp + 0x38], ebx
nop
mov edi, dword [ebx + eax]
xor ebx, ebx
mov eax, dword [eax]
cmp dword [esi + 0x1c], ebx
jbe 0x1007e277
mov edx, dword [esp + 0x14]
sub ebp, edx
mov ecx, edx
dec ebp
shl ecx, 7
add ecx, eax
shl ebp, 7
mov dword [esp + 0x10], ecx
add ebp, eax
lea eax, [ebx + edx]
cmp eax, dword [esp + 0x18]
jae 0x1007e248
mov edx, edi
mov eax, ebp
mov esi, 0x20
movzx ecx, word [eax]
lea edx, [edx + 4]
mov word [edx - 4], cx
lea eax, [eax + 4]
movzx ecx, word [eax - 2]
neg cx
mov word [edx - 2], cx
sub esi, 1
jne 0x1007e225
mov esi, dword [esp + 0x34]
jmp 0x1007e254
push 1
push edi
push ecx
call fcn.10083e30
add esp, 0xc
mov ecx, dword [esp + 0x10]
inc ebx
mov edx, dword [esp + 0x14]
sub ecx, 0xffffff80
add ebp, 0xffffff80
mov dword [esp + 0x10], ecx
sub edi, 0xffffff80
cmp ebx, dword [esi + 0x1c]
jb 0x1007e213
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
inc ecx
mov ebx, dword [esp + 0x38]
add eax, 4
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
cmp ecx, dword [esi + 0xc]
jl 0x1007e1f0
mov edi, dword [esp + 0x24]
mov ecx, dword [esi + 0xc]
add edi, ecx
mov ebx, dword [esp + 0x48]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x24], edi
cmp edi, dword [esi + 0x20]
jb 0x1007e1a3
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x28]
add edx, 4
mov ebp, dword [esp + 0x4c]
inc eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x40]
add ecx, 0x58
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x58], edx
cmp eax, dword [ebp + 0x4c]
jl 0x1007e160
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x34
ret
Function at 0x1008e8f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
cmp dword [ebp + 0x4c], 1
mov ebx, dword [ebp + 0x1c0]
mov dword [esp + 0x1c], ebx
jne 0x1008e915
mov esi, 0x1fe
mov byte [ebx + 0x1c], 1
jmp 0x1008e91b
xor esi, esi
mov byte [ebx + 0x1c], 0
push dword [ebp + 0x64]
mov ecx, dword [ebp + 4]
lea eax, [esi + 0x100]
push eax
push 1
push ebp
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], esi
call eax
xor ecx, ecx
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x14]
add esp, 0x10
mov dword [esp + 0x14], ecx
cmp dword [ebp + 0x64], ecx
jle 0x1008ea30
push edi
nop dword [eax]
mov edi, dword [ebx + ecx*4 + 0x20]
cdq
idiv edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], eax
test esi, esi
je 0x1008e96d
mov eax, dword [ebx + 0x18]
add dword [eax + ecx*4], 0xff
mov eax, dword [ebx + 0x18]
xor ebx, ebx
mov ebp, dword [eax + ecx*4]
lea eax, [edi + 0xfe]
lea ecx, [edi*2 - 2]
cdq
idiv ecx
xor esi, esi
mov edx, eax
nop dword [eax]
cmp esi, edx
jle 0x1008e9c6
mov ecx, dword [esp + 0x10]
lea edi, [edi*2 - 2]
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
nop dword [eax]
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x1008e9b0
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
movzx eax, bl
movzx ecx, cl
imul ecx, eax
mov byte [esi + ebp], cl
inc esi
cmp esi, 0xff
jle 0x1008e990
mov esi, dword [esp + 0x14]
test esi, esi
je 0x1008ea11
mov ecx, 1
lea edx, [ebp - 1]
nop
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x1008e9f0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, dword [eax + 0x64]
mov eax, dword [esp + 0x1c]
jl 0x1008e950
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x101049d0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x101049f0
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x101049f0
mov eax, dword [eax + 0x44]
test eax, eax
je 0x101049f0
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1011f790
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub esp, 0x14
push esi
push 0
push 0
push 0
push 2
push 0
push dword [esp + 0x30]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 0x14], eax
test eax, eax
je 0x1011f7e8
push ebx
lea ebx, [esi + 0x20]
push ebx
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1011f82f
push dword [ebx]
push 0
push 0
push 4
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x18], eax
test eax, eax
je 0x1011f876
pop ebx
pop esi
add esp, 0x14
ret 4
lea eax, [esp + 0x10]
mov dword [esp + 0xc], vtable.std::exception.0
push eax
lea eax, [esp + 8]
mov dword [esp + 8], str.failed_to_create_file_mapping
xorps xmm0, xmm0
mov byte [esp + 0xc], 1
push eax
movq qword [esp + 0x18], xmm0
call fcn.1026deb7
add esp, 8
mov dword [esp + 0xc], vtable.std::runtime_error.0
lea eax, [esp + 0xc]
push 0x10410c5c
push eax
call fcn.1026eb3b
lea eax, [esp + 0x14]
mov dword [esp + 0x10], vtable.std::exception.0
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], str.failed_to_get_the_file_size
xorps xmm0, xmm0
mov byte [esp + 0x10], 1
push eax
movq qword [esp + 0x1c], xmm0
call fcn.1026deb7
add esp, 8
mov dword [esp + 0x10], vtable.std::runtime_error.0
lea eax, [esp + 0x10]
push 0x10410c5c
push eax
call fcn.1026eb3b
lea eax, [esp + 0x14]
mov dword [esp + 0x10], vtable.std::exception.0
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], str.failed_to_map_the_file
xorps xmm0, xmm0
mov byte [esp + 0x10], 1
push eax
movq qword [esp + 0x1c], xmm0
call fcn.1026deb7
add esp, 8
mov dword [esp + 0x10], vtable.std::runtime_error.0
lea eax, [esp + 0x10]
push 0x10410c5c
push eax
call fcn.1026eb3b
int3
Function at 0x10120600
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x102993e8
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1012074c
cmp byte [ebx + 0x3d], 0
je 0x1012074c
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x10120654
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
push esi
mov dword [ebp - 4], 0
push edi
mov ecx, dword [ebp - 0x14]
nop dword [eax]
cmp ecx, 0x10
lea eax, [ebp - 0x10]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x101206ce
sub eax, 1
je 0x101206d2
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x10120725
xor bl, bl
jmp 0x10120727
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x10]
cmovae eax, edx
sub esi, eax
je 0x10120707
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.10276c65
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x101206ca
cmp byte [ebx + 0x3d], 0
je 0x10120725
test esi, esi
jne 0x10120690
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.1001c460
jmp 0x10120686
mov bl, 1
pop edi
pop esi
cmp ecx, 0x10
jb 0x1012073b
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.10005270
mov al, bl
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov al, 1
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1012da50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x24
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x83d64]
test eax, eax
je 0x1012da79
push 2
push 0
push 0x20
push dword [ebx + 0x83d68]
call eax
add esp, 0x10
test eax, eax
jne 0x1012dc4c
push esi
xor esi, esi
xor eax, eax
mov dword [esp + 8], esi
cmp ax, word [ebx + 0x14]
jae 0x1012dc27
push ebp
push edi
nop
xor edi, edi
xor eax, eax
mov dword [esp + 0x20], edi
cmp ax, word [ebx + 0x16]
jae 0x1012dc14
mov eax, esi
and eax, 7
lea edx, [eax + eax]
mov dword [esp + 0x30], edx
nop
movzx ecx, word [ebx + 0x5483c]
mov eax, edi
and eax, 1
or eax, edx
mov edx, esi
shr edx, cl
lea ebp, [eax + eax]
movzx eax, word [ebx + 0x1e]
imul edx, eax
mov eax, edi
shr eax, cl
mov ecx, ebp
mov dword [esp + 0x28], ebp
add edx, eax
mov eax, dword [ebx + 0x194]
shr eax, cl
and eax, 3
lea ecx, [eax + edx*4]
mov eax, dword [ebx + 8]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
mov dword [esp + 0x2c], eax
jne 0x1012dbff
mov eax, dword [esp + 0x10]
xor esi, esi
add eax, 2
mov dword [esp + 0x1c], esi
xor edx, edx
mov dword [esp + 0x18], edx
lea ebp, [eax - 4]
cmp ebp, eax
ja 0x1012dbfb
nop dword [eax]
lea ecx, [edi + 2]
lea eax, [ecx - 4]
mov dword [esp + 0x14], ecx
cmp eax, ecx
ja 0x1012dbda
movzx edi, word [ebx + 0x14]
mov ecx, ebp
and ecx, 7
add ecx, ecx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x14]
cmp ebp, edi
jae 0x1012dbcd
movzx ecx, word [ebx + 0x16]
cmp eax, ecx
jae 0x1012dbc9
mov edx, dword [ebx + 0x194]
mov ecx, eax
and ecx, 1
mov edi, edx
or ecx, dword [esp + 0x24]
add ecx, ecx
shr edi, cl
mov ecx, dword [esp + 0x28]
shr edx, cl
xor edx, edi
test dl, 3
jne 0x1012dbc1
movzx ecx, word [ebx + 0x5483c]
mov esi, ebp
shr esi, cl
mov edx, eax
movzx ecx, word [ebx + 0x1e]
and edi, 3
imul esi, ecx
movzx ecx, word [ebx + 0x5483c]
shr edx, cl
mov ecx, dword [ebx + 8]
add esi, edx
lea edx, [edi + esi*4]
mov esi, dword [esp + 0x1c]
movzx ecx, word [ecx + edx*2]
mov edx, dword [esp + 0x18]
movzx edi, word [ebx + 0x14]
test cx, cx
je 0x1012dbc9
inc esi
add edx, ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], edx
jmp 0x1012dbc9
mov edx, dword [esp + 0x18]
movzx edi, word [ebx + 0x14]
mov ecx, dword [esp + 0x14]
inc eax
cmp eax, ecx
jbe 0x1012db45
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebp
add eax, 2
cmp ebp, eax
jbe 0x1012db20
test esi, esi
je 0x1012dbfb
mov eax, edx
mov ecx, dword [esp + 0x2c]
xor edx, edx
div esi
mov word [ecx], ax
mov esi, dword [esp + 0x10]
movzx eax, word [ebx + 0x16]
inc edi
mov edx, dword [esp + 0x30]
mov dword [esp + 0x20], edi
cmp edi, eax
jb 0x1012dab0
movzx eax, word [ebx + 0x14]
inc esi
mov dword [esp + 0x10], esi
cmp esi, eax
jb 0x1012da90
pop edi
pop ebp
mov eax, dword [ebx + 0x83d64]
pop esi
test eax, eax
je 0x1012dc47
push 2
push 1
push 0x20
push dword [ebx + 0x83d68]
call eax
add esp, 0x10
test eax, eax
jne 0x1012dc63
pop ebx
add esp, 0x24
ret
push 0x10404af8
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 6
push eax
call fcn.1026eb3b
push 0x10404af8
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 6
push eax
call fcn.1026eb3b
int3
Function at 0x10134c10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x56c
push ebx
push esi
mov esi, dword [esp + 0x578]
mov ebx, ecx
push edi
push esi
push 0xff
call fcn.102808ac
push esi
push 0xd8
call fcn.102808ac
mov edi, dword [esp + 0x590]
add esp, 0x10
mov ecx, str.Exif
lea eax, [edi + 6]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10134c70
test dl, dl
je 0x10134c6c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10134c70
add eax, 2
add ecx, 2
test dl, dl
jne 0x10134c50
xor eax, eax
jmp 0x10134c75
sbb eax, eax
or eax, 1
test eax, eax
je 0x10134cd7
movq xmm0, qword [0x102c7c24]
mov ax, word [0x102c7c2c]
push 0x568
movq qword [esp + 0x10], xmm0
mov word [esp + 0x18], ax
call dword [sym.imp.WS2_32.dll_htons]
push esi
push 0xa
mov word [esp + 0x16], ax
lea eax, [esp + 0x14]
push 1
push eax
call fcn.10276c65
add esp, 0x10
lea eax, [esp + 0x18]
mov ecx, ebx
push 0
push eax
call fcn.1015e880
push esi
push 0x560
lea eax, [esp + 0x20]
push 1
push eax
call fcn.10276c65
add esp, 0x10
mov eax, dword [esp + 0x584]
push esi
add eax, 0xfffffffe
push eax
lea eax, [edi + 2]
push 1
push eax
call fcn.10276c65
add esp, 0x10
pop edi
pop esi
pop ebx
add esp, 0x56c
ret 0xc
Function at 0x1013e890
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x18
push ebx
mov ebx, ecx
mov word [esp + 4], 0xffff
push esi
push edi
push 2
mov ecx, dword [ebx + 0x54800]
lea edx, [esp + 0x10]
push 1
push edx
mov dword [esp + 0x1c], ebx
xor esi, esi
mov eax, dword [ecx]
xor edi, edi
call dword [eax + 8]
mov ecx, ebx
call fcn.10135240
cmp eax, 0x80008
jne 0x1013e9c1
mov ecx, ebx
call fcn.10135240
test eax, eax
je 0x1013e9c1
push ebp
mov ecx, ebx
call fcn.1013c960
movzx ebp, ax
cmp ebp, 0xa
je 0x1013e8f5
cmp ebp, 0xc
jne 0x1013e9c0
mov eax, 0xffff
mov dword [esp + 0x18], esi
mov ecx, ebp
mov dword [esp + 0x20], 8
shl ax, cl
not ax
mov dword [esp + 0x24], eax
mov eax, ebx
lea ebx, [eax + 0x24f74]
nop word [eax + eax]
mov dword [esp + 0x1c], 8
cmp esi, ebp
jge 0x1013e994
mov ecx, dword [eax + 0x54800]
lea edx, [esp + 0x10]
push 2
mov word [esp + 0x14], 0xffff
push 1
mov eax, dword [ecx]
push edx
call dword [eax + 8]
mov eax, dword [esp + 0x14]
mov ecx, 0x4949
cmp word [eax + 0x54860], cx
jne 0x1013e965
movzx eax, byte [esp + 0x11]
movzx ecx, byte [esp + 0x10]
jmp 0x1013e96f
movzx eax, byte [esp + 0x10]
movzx ecx, byte [esp + 0x11]
mov edx, dword [esp + 0x18]
shl eax, 8
or eax, ecx
shl edi, 0x10
mov ecx, edx
inc edx
and ecx, 1
mov dword [esp + 0x18], edx
movzx ecx, word [ecx*2 + 0x102b6788]
xor ecx, eax
or edi, ecx
add esi, 0x10
sub esi, ebp
mov eax, edi
mov ecx, esi
shr eax, cl
and eax, dword [esp + 0x24]
mov word [ebx], ax
add ebx, 2
sub dword [esp + 0x1c], 1
mov eax, dword [esp + 0x14]
jne 0x1013e928
sub dword [esp + 0x20], 1
jne 0x1013e920
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x10144a00
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2074
call fcn.1026a090
mov eax, ecx
xorps xmm0, xmm0
mov ecx, 0x810
mov dword [esp], eax
movlpd qword [esp + 4], xmm0
movups xmmword [esp + 0x24], xmm0
cmp word [eax + 0x16], cx
jbe 0x10144a33
fldz
add esp, 0x2074
ret 0x10
push ebx
mov ebx, dword [esp + 8]
xor edx, edx
push ebp
mov ebp, dword [esp + 0x2084]
mov ecx, 0x40
sub ecx, dword [esp + 0x2080]
push esi
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x40]
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x30], edx
mov dword [esp + 0x20], ecx
nop dword [eax]
nop dword [eax + eax]
mov ecx, dword [eax + 0x54800]
test edx, edx
mov eax, dword [esp + 0x2090]
cmovne eax, dword [esp + 0x2094]
push 0
mov esi, dword [ecx]
cdq
push edx
push eax
call dword [esi + 0xc]
mov eax, dword [esp + 0x10]
xor esi, esi
xor ecx, ecx
mov dword [esp + 0x28], esi
xor edx, edx
cmp cx, word [eax + 0x16]
jae 0x10144b61
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x2c], ecx
sub edx, dword [esp + 0x2088]
mov dword [esp + 0x1c], edx
jns 0x10144b16
nop
movq xmm1, qword [esp + 0x14]
xor esi, esi
movd xmm0, ebp
psllq xmm1, xmm0
movq qword [esp + 0x14], xmm1
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test ebp, ebp
jle 0x10144b0a
mov ecx, dword [eax + 0x54800]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ecx, esi
add esi, 8
shl eax, cl
or ebx, eax
mov eax, dword [esp + 0x10]
cmp esi, ebp
jl 0x10144ae2
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
add edx, ebp
mov dword [esp + 0x1c], edx
js 0x10144ac0
mov esi, dword [esp + 0x28]
mov ecx, 0x40
mov eax, ebx
sub ecx, edx
mov edx, edi
sub ecx, dword [esp + 0x2088]
call fcn.1026a570
mov ecx, dword [esp + 0x24]
call fcn.1026a600
mov ecx, dword [esp + 0x2c]
inc esi
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x28], esi
mov word [ecx], ax
add ecx, 2
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], ecx
movzx eax, word [eax + 0x16]
cmp esi, eax
mov eax, dword [esp + 0x10]
jl 0x10144ab1
mov edx, dword [esp + 0x30]
add dword [esp + 0x20], 0x1020
inc edx
mov dword [esp + 0x30], edx
cmp edx, 2
jl 0x10144a70
movzx ebx, word [eax + 0x16]
xor edi, edi
dec ebx
test ebx, ebx
jle 0x10144c04
nop word [eax + eax]
movzx eax, word [esp + edi*2 + 0x1066]
mov edx, edi
movzx esi, word [esp + edi*2 + 0x44]
and edx, 1
sub esi, eax
mov ecx, esi
sar ecx, 0x1f
mov eax, ecx
xor eax, esi
movzx esi, word [esp + edi*2 + 0x1064]
sub eax, ecx
movd xmm0, eax
movzx eax, word [esp + edi*2 + 0x46]
sub esi, eax
cvtdq2pd xmm0, xmm0
mov ecx, esi
sar ecx, 0x1f
mov eax, ecx
xor eax, esi
sub eax, ecx
addsd xmm0, qword [esp + edx*8 + 0x34]
movsd qword [esp + edx*8 + 0x34], xmm0
mov edx, edi
movd xmm0, eax
not edx
cvtdq2pd xmm0, xmm0
and edx, 1
inc edi
addsd xmm0, qword [esp + edx*8 + 0x34]
movsd qword [esp + edx*8 + 0x34], xmm0
cmp edi, ebx
jl 0x10144b90
movups xmm0, xmmword [esp + 0x34]
jmp 0x10144c07
xorps xmm0, xmm0
movaps xmm1, xmm0
unpckhpd xmm1, xmm0
divsd xmm0, xmm1
call fcn.102821f0
mulsd xmm0, qword [0x103f9640]
pop edi
pop esi
pop ebp
pop ebx
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x14], xmm0
fld dword [esp + 0x14]
add esp, 0x2074
ret 0x10
Function at 0x1014a1d0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0xc], 0
push ebx
push ebp
push esi
push edi
mov esi, ecx
je 0x1014a313
mov eax, dword [esi + 0x547fc]
mov dword [eax + 0x220], 0
mov eax, dword [esi + 0x547fc]
mov edx, dword [eax + 0x220]
cmp edx, 4
jae 0x1014a238
mov ecx, dword [esp + 0x20]
nop word [eax + eax]
imul ecx, ecx, 0x2e90edd
inc ecx
mov dword [eax + edx*4 + 0x20], ecx
mov eax, dword [esi + 0x547fc]
inc dword [eax + 0x220]
mov eax, dword [esi + 0x547fc]
mov edx, dword [eax + 0x220]
cmp edx, 4
jb 0x1014a210
mov edx, dword [esi + 0x547fc]
mov ecx, dword [edx + 0x28]
xor ecx, dword [edx + 0x20]
mov eax, dword [edx + 0x2c]
add eax, eax
shr ecx, 0x1f
or ecx, eax
mov dword [edx + 0x2c], ecx
mov eax, dword [esi + 0x547fc]
mov dword [eax + 0x220], 4
mov eax, dword [esi + 0x547fc]
cmp dword [eax + 0x220], 0x7f
jae 0x1014a2b2
mov edi, dword [esi + 0x547fc]
mov edx, dword [edi + 0x220]
mov ecx, dword [edi + edx*4 + 0x1c]
xor ecx, dword [edi + edx*4 + 0x14]
mov eax, dword [edi + edx*4 + 0x18]
xor eax, dword [edi + edx*4 + 0x10]
add eax, eax
shr ecx, 0x1f
or ecx, eax
mov dword [edi + edx*4 + 0x20], ecx
mov eax, dword [esi + 0x547fc]
inc dword [eax + 0x220]
mov eax, dword [esi + 0x547fc]
cmp dword [eax + 0x220], 0x7f
jb 0x1014a270
mov eax, dword [esi + 0x547fc]
mov dword [eax + 0x220], 0
mov eax, dword [esi + 0x547fc]
mov eax, dword [eax + 0x220]
cmp eax, 0x7f
jae 0x1014a313
mov ebx, dword [sym.imp.WS2_32.dll_htonl]
nop dword [eax]
mov edi, dword [esi + 0x547fc]
push dword [edi + eax*4 + 0x20]
call ebx
mov ecx, dword [edi + 0x220]
mov dword [edi + ecx*4 + 0x20], eax
mov eax, dword [esi + 0x547fc]
inc dword [eax + 0x220]
mov eax, dword [esi + 0x547fc]
mov eax, dword [eax + 0x220]
cmp eax, 0x7f
jb 0x1014a2e0
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x1014a35e
mov ebx, dword [esp + 0x14]
nop
mov edi, dword [esi + 0x547fc]
lea ebx, [ebx + 4]
mov edx, dword [edi + 0x220]
lea ecx, [edx - 0x3f]
and ecx, 0x7f
lea eax, [edx + 1]
and eax, 0x7f
and edx, 0x7f
mov ecx, dword [edi + ecx*4 + 0x20]
xor ecx, dword [edi + eax*4 + 0x20]
mov dword [edi + edx*4 + 0x20], ecx
xor dword [ebx - 4], ecx
mov eax, dword [esi + 0x547fc]
inc dword [eax + 0x220]
sub ebp, 1
jne 0x1014a320
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x1015e690
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x24
push ebx
mov ebx, ecx
lea edx, [esp + 8]
push ebp
mov ebp, 2
mov dword [esp + 8], ebx
push ebp
mov ecx, dword [ebx + 0x54800]
xorps xmm0, xmm0
push ebp
push edx
movups xmmword [esp + 0x20], xmm0
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [esp + 0x30]
movsd xmm0, qword [esp + 0x1c]
sub eax, ebp
je 0x1015e784
movsd qword [esp + 0x24], xmm0
movsd xmm0, qword [esp + 0x14]
push esi
movsd qword [esp + 0x18], xmm0
push edi
mov ecx, dword [ebx + 0x54800]
lea esi, [esp + 0x14]
dec eax
lea esi, [esi + ebp*2]
push 1
mov dword [esp + 0x3c], eax
mov eax, dword [ecx]
push 2
push esi
call dword [eax + 8]
movzx esi, byte [esi]
mov ebx, ebp
movzx ecx, byte [esp + ebp*2 + 0x15]
xor ebx, 2
movzx edi, byte [esp + ebx*2 + 0x14]
movzx edx, byte [esp + ebx*2 + 0x15]
mov eax, edi
shl eax, 8
or edx, eax
mov eax, esi
shl eax, 8
or ecx, eax
movzx eax, byte [esp + ebp*2 + 0x15]
sub edx, ecx
shl eax, 8
movzx ecx, byte [esp + ebx*2 + 0x15]
or eax, esi
shl ecx, 8
inc ebp
mov ebx, dword [esp + 0x10]
or ecx, edi
movd xmm0, edx
sub ecx, eax
cvtdq2pd xmm0, xmm0
mov eax, dword [esp + 0x38]
and ebp, 3
mulsd xmm0, xmm0
addsd xmm0, qword [esp + 0x1c]
movaps xmm1, xmm0
movd xmm0, ecx
movsd qword [esp + 0x1c], xmm1
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm0
addsd xmm0, qword [esp + 0x2c]
movsd qword [esp + 0x2c], xmm0
test eax, eax
jne 0x1015e6e0
pop edi
pop esi
jmp 0x1015e78a
movsd xmm1, qword [esp + 0x14]
comisd xmm0, xmm1
mov eax, 0x4949
mov ecx, 0x4d4d
pop ebp
pop ebx
cmova eax, ecx
add esp, 0x24
ret 4
Function at 0x10170d00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0x10]
push eax
mov dword [esi + 0x38], eax
call fcn.10271b4d
xor edi, edi
mov dword [esi + 0x34], eax
add esp, 4
cmp dword [esi + 0x18], edi
jbe 0x10170d72
push ebp
mov ebp, 0x3bcd0
mov ecx, 0x11f9f253
nop
imul eax, ebx, 0x63d
xor edx, edx
add eax, 0xca25
div ebp
mov ebx, edx
mov eax, ebx
mul ecx
mov ecx, ebx
shrd eax, edx, 0x18
shl ecx, 8
sub ecx, eax
sar edx, 0x18
shr ecx, 1
add ecx, eax
mov eax, dword [esi + 0x14]
shr ecx, 0x11
xor cl, byte [edi + eax]
mov eax, dword [esi + 0x34]
mov byte [edi + eax], cl
inc edi
mov ecx, 0x11f9f253
cmp edi, dword [esi + 0x18]
jb 0x10170d30
pop ebp
pop edi
pop esi
pop ebx
ret