joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414360
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x49441c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
add edx, 1
mov eax, dword [ebp - 4]
mov dword [eax + 8], edx
mov esp, ebp
pop ebp
ret

Function at 0x414420
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edx
mov eax, dword [0x49441c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
add ecx, dword [edx + 8]
mov dword [ebp - 4], ecx
pop edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x414530
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x49441c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
mov edx, dword [ebp - 4]
add eax, dword [edx + 8]
mov esp, ebp
pop ebp
ret

Function at 0x414660
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x49441c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0xc], 0xffffffff
jne 0x414684
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 8]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 8]
add ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
sub eax, 4
cmp dword [ebp - 8], eax
jl 0x4146d1
mov ecx, dword [ebp - 8]
add ecx, 0x4000
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 4]
add ecx, 5
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x4a55dc]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
add ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
add edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x414730
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x49441c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
cmp edx, dword [ecx]
jb 0x41476e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 8]
cmp dword [ebp + 8], ecx
ja 0x41476e
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
sub ecx, dword [eax]
add ecx, 1
mov eax, ecx
jmp 0x414770
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x42da20
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x42dac1
push ebx
push ebp
push esi
mov esi, dword [ecx]
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov esi, dword [ecx + 4]
xor eax, eax
cmp esi, edx
push edi
jle 0x42da6f
mov edi, dword [ecx]
movzx ebx, byte [edi + edx]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
shl eax, 8
xor eax, dword [ebx*4 + 0x448590]
add edx, 1
cmp edx, esi
jl 0x42da51
xor edx, edx
mov esi, dword [ecx + 0xc]
cmp esi, edx
jle 0x42da9c
mov edi, dword [ecx + 8]
lea esp, [esp]
movzx ebx, byte [edi + edx]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
shl eax, 8
xor eax, dword [ebx*4 + 0x448590]
add edx, 1
cmp edx, esi
jl 0x42da80
mov edx, dword [ecx]
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
pop edi
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
pop esi
shr eax, 0x18
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret
Function at 0x43da2d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4a51b0], ebx
mov esi, eax
mov dword [ebp - 0xc], esi
jne 0x43da63
push 0x4a5194
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4a51b0], 1
push 0x4a5194
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4a51ac]
cmp eax, ebx
mov edi, eax
je 0x43dac7
cmp dword [ebp - 4], ebx
jne 0x43dc07
xor eax, eax
inc eax
lea ecx, [edi + 0x114]
cmp esi, dword [ecx]
je 0x43da9a
inc eax
add ecx, 4
cmp eax, 0x40
jl 0x43da8b
jmp 0x43dab8
push dword [ebp + 0xc]
lea esi, [edi + eax*4 + 0x210]
push dword [ebp + 8]
call fcn.0043d87f
mov esi, dword [ebp - 0xc]
pop ecx
pop ecx
mov dword [ebp - 4], 1
mov edi, dword [edi]
cmp edi, ebx
jne 0x43da79
cmp dword [ebp - 4], ebx
jne 0x43dc07
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebx
push ebx
push 0x100000
lea eax, [ebp - 8]
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x43dc07
mov edi, dword [0x4a51ac]
jmp 0x43db07
cmp dword [edi + 0xc], 0x3f
jl 0x43dba1
mov edi, dword [edi]
cmp edi, ebx
jne 0x43dafb
push 0x310
push 8
push dword [0x4a47ec]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, ebx
je 0x43dbfe
push ebx
push 1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
cmp eax, ebx
mov dword [edi + 8], eax
je 0x43dbf0
push ebx
push ebx
push edi
push 0x43d8d0
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 8]
mov dword [edi + 0x114], esi
push 0x1000
lea esi, [edi + 0x214]
push ebx
mov dword [edi + 0x14], eax
mov dword [esi], ebx
mov dword [edi + 0xc], 2
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x43dbe7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043d87f
mov eax, dword [0x4a51ac]
cmp eax, ebx
pop ecx
pop ecx
mov dword [edi + 4], ebx
mov dword [edi], eax
je 0x43db99
mov dword [eax + 4], edi
mov dword [0x4a51ac], edi
jmp 0x43dc07
mov eax, dword [edi + 0xc]
mov ecx, dword [ebp - 8]
push dword [ebp + 0xc]
mov dword [edi + eax*4 + 0x10], ecx
mov eax, dword [edi + 0xc]
push dword [ebp + 8]
mov dword [edi + eax*4 + 0x110], esi
mov eax, dword [edi + 0xc]
mov dword [edi + eax*4 + 0x210], ebx
mov eax, dword [edi + 0xc]
lea esi, [edi + eax*4 + 0x210]
call fcn.0043d87f
inc dword [edi + 0xc]
pop ecx
pop ecx
push ebx
push 1
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
jmp 0x43dc07
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebx
push dword [0x4a47ec]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4a5194
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x43ef2c
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x154
push 8
push dword [0x4a47ec]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x4a5554]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x4a5558], esi
and dword [esi + 0x88], 0
or dword [esi + 0x8c], 0xffffffff
or dword [esi + 0x90], 0xffffffff
push esi
mov dword [esi + 0x84], 0xffffff
mov dword [esi + 0x6c], 2
mov dword [esi + 0x70], 0x3f
call fcn.004442e1
mov dword [esi + 0x58], 0x43eeab
mov dword [esi + 0x5c], 0x43eeea
mov dword [esi + 0x10], fcn.0043e079
mov dword [esi + 0x30], 0x43e1f8
mov dword [esi + 0x64], 0x43e301
mov dword [esi + 0x60], 0x43e34c
mov dword [esi + 0x34], 0x43ea4a
mov dword [esi + 0x24], 0x43e8e9
mov dword [esi + 0x28], 0x43e912
mov dword [esi + 0x2c], 0x43e93d
mov dword [esi + 0x44], 0x43ed3b
mov eax, esi
pop esi
ret 4

Function at 0x43fc1b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0x20], 0
push esi
mov esi, dword [ecx + 0xb4]
mov dword [ebp - 4], esi
je 0x43fc8e
mov eax, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
imul eax, dword [ebp + 0x18]
add eax, dword [ebp + 8]
push ebx
lea edx, [eax + edx*4]
push edi
mov eax, dword [ecx + 0xac]
imul eax, dword [ebp + 0x14]
add eax, dword [ecx + 0xa8]
mov edi, edx
add eax, esi
cmp dword [ebp + 0x1c], 0
jle 0x43fc7d
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0x10], ebx
mov bl, byte [edi + 2]
xor byte [eax + 2], bl
mov bl, byte [edi + 1]
xor byte [eax + 1], bl
mov bl, byte [edi]
xor byte [eax], bl
add eax, dword [ebp - 4]
add edi, 4
dec dword [ebp + 0x10]
jne 0x43fc62
dec dword [ebp + 0x20]
inc dword [ebp + 0x14]
add edx, dword [ebp + 0xc]
cmp dword [ebp + 0x20], 0
jne 0x43fc42
pop edi
pop ebx
pop esi
leave
ret 0x1c

Function at 0x440a1a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x20], 0
mov edx, dword [ecx + 0xb4]
je 0x440a96
push ebx
imul eax, eax, 3
push esi
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x18]
add edi, dword [ebp + 8]
mov esi, edx
imul esi, dword [ebp + 0x10]
add eax, edi
mov edi, eax
mov dword [ebp + 0x18], eax
mov eax, dword [ecx + 0xac]
imul eax, dword [ebp + 0x14]
add eax, dword [ecx + 0xa8]
add eax, esi
cmp dword [ebp + 0x1c], 0
jle 0x440a7e
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0x10], ebx
mov bl, byte [edi + 2]
xor byte [eax + 2], bl
mov bl, byte [edi + 1]
xor byte [eax + 1], bl
mov bl, byte [edi]
xor byte [eax], bl
add edi, 3
add eax, edx
dec dword [ebp + 0x10]
jne 0x440a64
mov edi, dword [ebp + 0x18]
dec dword [ebp + 0x20]
add edi, dword [ebp + 0xc]
inc dword [ebp + 0x14]
cmp dword [ebp + 0x20], 0
mov dword [ebp + 0x18], edi
jne 0x440a46
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c
Function at 0x440af2
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
imul eax, eax, 3
cmp dword [ebp + 0x1c], 0
mov dword [ebp - 4], eax
je 0x440b82
mov eax, dword [ebp + 0x10]
imul ecx, ecx, 3
imul eax, dword [ebp + 0x18]
add eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, edx
imul esi, esi, 3
add ecx, eax
push edi
mov edi, ecx
mov dword [ebp + 0xc], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xac]
imul ecx, dword [ebp + 0x14]
add ecx, dword [eax + 0xa8]
mov edx, dword [ebp - 4]
add ecx, esi
test edx, edx
jle 0x440b6a
mov eax, 0xff
sub eax, dword [ebp + 0x20]
mov dword [ebp + 0x18], edx
mov dword [ebp - 8], eax
movzx eax, byte [ecx]
movzx edx, byte [edi]
imul eax, dword [ebp - 8]
imul edx, dword [ebp + 0x20]
add eax, edx
cdq
mov ebx, 0xff
idiv ebx
inc edi
mov byte [ecx], al
inc ecx
dec dword [ebp + 0x18]
jne 0x440b49
mov edi, dword [ebp + 0xc]
dec dword [ebp + 0x1c]
add edi, dword [ebp + 0x10]
inc dword [ebp + 0x14]
cmp dword [ebp + 0x1c], 0
mov dword [ebp + 0xc], edi
jne 0x440b1f
pop edi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x100d2630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x168
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x10180a0c], 0xfffff9aa
mov dword [0x10180a08], 0xfffff636
mov edx, ecx
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], ecx
jmp 0x100d2718
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x140]
lea edx, section..data
imul esi, eax, 0xac
mov edi, edx
add edi, esi
add edi, 0xa8
mov esi, dword [edi]
imul edi, eax, 0xac
mov ebx, edx
add ebx, edi
add ebx, 4
mov edi, dword [ebx]
imul ebx, eax, 0xac
add edx, ebx
add edx, 0xa4
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x144]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x150], edx
call fcn.100d2f11
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x14c]
add eax, ecx
mov edx, dword [ebp - 0x148]
add edx, 1
cmp edx, 0x3f7
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], edx
je 0x100d2825
jmp 0x100d266e
mov eax, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x134]
xor edx, edx
lea esi, section..data
imul edi, eax, 0xac
mov ebx, esi
add ebx, edi
add ebx, 0xa4
imul edi, eax, 0xac
add esi, edi
add esi, 0xa8
add eax, 1
mov esi, dword [esi]
movzx edi, word [ebx]
xor edi, esi
add edi, ecx
cmp eax, 0x3f7
mov ecx, edi
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x154], edi
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x158], edx
jne 0x100d2718
mov eax, dword [ebp - 0x158]
mov cl, byte [eax + 0x10154582]
mov dl, byte [eax + 0x10154553]
sub dl, cl
mov byte [ebp + eax - 0x12c], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x158], eax
jne 0x100d2779
lea eax, [ebp - 0x12c]
mov dword [0x10180a08], 0x1275
mov dword [0x10180a0c], 0x1d34
mov dword [ebp - 0x15c], eax
call fcn.100d257a
mov dword [esp], eax
mov eax, dword [ebp - 0x15c]
mov dword [esp + 4], eax
call fcn.100d34bc
mov ecx, eax
mov dword [0x10180a28], eax
mov eax, esp
mov edx, dword [ebp - 0x154]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x13c], ecx
jmp 0x100d266e
lea eax, [0x10154561]
mov ecx, 0x20
lea edx, [ebp - 0x10c]
mov esi, dword [0x10180a0c]
add esi, 0xfffff3ae
mov dword [0x10180a08], esi
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x20
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x164], ecx
call fcn.100d3911
mov dword [0x10180a08], 0x25a3
mov eax, dword [ebp - 0x160]
mov dword [esp], eax
mov ecx, dword [ebp - 0x144]
mov dword [esp + 4], ecx
mov dword [esp + 8], ecx
mov edx, dword [ebp - 0x154]
mov dword [esp + 0xc], edx
call fcn.100d3a4c
xor eax, eax
mov ecx, dword [ebp - 0x144]
add ecx, 0x1a6dc
mov edx, dword [ebp - 0x130]
mov dword [edx], ecx
mov dword [edx + 4], 0x150c00
mov ecx, dword [ebp - 0x144]
add ecx, 0x13846
mov dword [edx + 8], ecx
mov dword [edx + 0xc], 0x1f40
mov dword [0x10180a08], 0x35b
add esp, 0x168
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100d304a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, 0xffffffff
mov dword [0x10180a08], 0x181d
cmp ecx, 0
sete bl
cmp eax, 0
sete bh
and bl, bh
test bl, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
jne 0x100d3262
jmp 0x100d30d6
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov dword [0x10180a08], ecx
mov dword [ebp - 0x18], eax
jmp 0x100d3262
mov eax, dword [ebp - 0x20]
mov ecx, eax
add ecx, 0x24
mov edx, dword [eax + 0x28]
mov esi, dword [eax + 0x10]
mov edi, dword [ebp - 0x10]
cmp esi, edi
sete bl
mov bh, byte [ebp - 0x21]
and bh, bl
test bh, 1
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], esi
jne 0x100d3142
jmp 0x100d315c
mov dword [0x10180a08], 0x19f
mov dword [0x10180a0c], 0x300
mov ecx, dword fs:[0x18]
xor eax, eax
mov dword [0x10180a0c], 0x2302
mov ecx, dword [ecx + 0x30]
mov ecx, dword [ecx + 0xc]
mov edx, ecx
add edx, 0x14
mov ecx, dword [ecx + 0x14]
mov dword [0x10180a08], 0x1d23
cmp ecx, edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x18], eax
je 0x100d3262
mov eax, dword [ebp - 0x10]
cmp eax, 0
setne cl
mov edx, dword [ebp - 0x38]
mov byte [ebp - 0x21], cl
mov dword [ebp - 0x20], edx
jmp 0x100d30a2
mov dword [0x10180a08], 0x1250
mov eax, dword [ebp - 0x28]
add eax, 0xfffffff8
mov dword [ebp - 0x18], eax
jmp 0x100d3262
mov eax, 0x1250
xor ecx, ecx
mov edx, dword [ebp - 0x2c]
mov si, word [edx]
mov dword [0x10180a0c], 0x92b
shr si, 1
movzx edi, si
cmp si, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], eax
je 0x100d323a
mov eax, dword [ebp - 0x40]
mov ecx, 0x21ba
mov edx, dword [ebp - 0x30]
mov si, word [edx + eax*2]
mov di, si
add di, 0xffbf
mov bx, si
add bx, 0x20
cmp di, 0x1a
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], ecx
mov word [ebp - 0x52], si
mov word [ebp - 0x54], bx
jb 0x100d31ca
mov ax, word [ebp - 0x52]
mov word [ebp - 0x54], ax
mov ax, word [ebp - 0x54]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x4c]
cmp word [ecx + edx*2], ax
sete bl
cmp ax, 0
sete bh
mov al, bl
xor al, 1
or bh, al
test bh, 1
mov esi, dword [ebp - 0x50]
mov byte [ebp - 0x55], bl
mov dword [ebp - 0x5c], esi
jne 0x100d3215
mov eax, 0x21b7
mov ecx, dword [ebp - 0x4c]
add ecx, 1
mov edx, dword [ebp - 0x44]
cmp ecx, edx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x5c], eax
jb 0x100d318e
mov eax, dword [ebp - 0x5c]
mov cl, byte [ebp - 0x55]
test cl, 1
mov edx, eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x48], edx
jne 0x100d322a
jmp 0x100d323a
mov eax, dword [ebp - 0x60]
mov dword [0x10180a08], eax
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x18], ecx
jmp 0x100d3262
mov eax, dword [ebp - 0x48]
mov dword [0x10180a0c], 0x1e38
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
mov esi, dword [ebp - 0x3c]
cmp edx, esi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x100d308f
jmp 0x100d30a2
mov eax, dword [ebp - 0x18]
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100d3647
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov dword [0x10180a08], 0x7f2
mov dword [ebp - 0x10], eax
call fcn.100d32f1
xor ecx, ecx
mov edx, eax
mov dword [0x10180a08], 0x383
mov esi, dword [eax + 0x3c]
mov dword [0x10180a08], 0x14bb
mov esi, dword [eax + esi + 0x78]
mov dword [0x10180a08], 0xffffffcc
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov dword [0x10180a0c], 0xffffe830
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ecx
je 0x100d37b2
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov esi, dword [ebp - 0x14]
mov edi, dword [esi + eax*4]
mov dword [0x10180a08], 0x7f2
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
mov ecx, eax
mov edx, dword [ebp - 0x38]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x41], bh
mov byte [ebp - 0x42], cl
je 0x100d3743
mov eax, dword [ebp - 0x40]
add eax, 1
mov cl, byte [ebp - 0x41]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x42]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x3c], eax
jne 0x100d36f2
mov al, byte [ebp - 0x42]
test al, 1
jne 0x100d378d
jmp 0x100d374c
mov eax, dword [ebp - 0x34]
add eax, 2
mov ecx, dword [ebp - 0x30]
add ecx, 1
mov edx, dword [ebp - 0x18]
cmp ecx, edx
setb bl
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 0x4d], bl
xor eax, eax
mov cl, byte [ebp - 0x4d]
test cl, 1
mov edx, dword [ebp - 0x48]
mov esi, dword [ebp - 0x4c]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], eax
jne 0x100d36ce
jmp 0x100d37b2
mov eax, dword [ebp - 0x34]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x10180a08], 0x154e
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100d3911
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10180a14], 0
mov byte [0x10180a18], 0
mov dword [0x10180a08], 0xda6
mov dword [0x10180a10], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x10180a10]
add eax, 1
mov dword [0x10180a10], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x100d3956
xor eax, eax
mov dword [0x10180a08], 0x253d
mov dword [0x10180a10], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x10180a1c], 0
mov edx, dword [0x10180a14]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x10180a1c], edi
mov eax, edi
cdq
idiv ecx
mov dword [0x10180a14], edx
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
mov cl, byte [ecx + edi]
mov byte [0x10180a18], cl
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov dword [0x10180a08], 0x1fde
mov cl, byte [0x10180a18]
mov edx, dword [0x10180a14]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov edx, dword [0x10180a08]
add edx, 0xffffdcb1
mov dword [0x10180a08], edx
mov edx, dword [0x10180a10]
add edx, 1
mov dword [0x10180a10], edx
cmp edx, 0x100
mov dword [ebp - 0x20], edx
jl 0x100d3995
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100d3a4c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x10180a10], 0
mov dword [0x10180a14], 0
mov dword [0x10180a20], 0
mov dword [0x10180a08], 0xffa
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x100d3bd4
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov edi, dword [0x10180a0c]
add edi, 0xffffee49
mov dword [0x10180a0c], edi
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x10180a10], edx
mov dword [0x10180a08], 0x4809
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x10180a14], edx
mov dword [0x10180a08], 0x2080
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x10180a18], cl
mov dword [0x10180a0c], 0x1c28
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x10180a0c], 0x4cc
mov cl, byte [0x10180a18]
mov edx, dword [0x10180a14]
mov byte [edi + edx], cl
mov edx, dword [0x10180a10]
movzx edx, byte [edi + edx]
mov ebx, dword [0x10180a14]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x10180a20], ebx
mov dword [0x10180a08], 0x62d
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x2c]
mov ch, byte [edx + ebx]
mov byte [0x10180a25], ch
mov byte [0x10180a26], cl
xor ch, cl
mov byte [0x10180a24], ch
mov edx, dword [ebp - 0x1c]
mov byte [edx + ebx], ch
mov dword [0x10180a08], 0x1cd7
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x100d3bd4
mov eax, dword [0x10180a10]
mov ecx, dword [0x10180a14]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
jmp 0x100d3aaf
mov dword [0x10180a08], 0x12c9
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret