joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424b14
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x452e20
call fcn.00425116
push 1
call fcn.00424b97
pop ecx
test al, al
jne 0x4249bd
push 7
call fcn.004257a1
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00424b62
mov byte [ebp - 0x24], al
mov eax, dword [0x461f38]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4249b6
test eax, eax
jne 0x424a27
mov dword [0x461f38], ecx
push 0x42835c
push 0x428344
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x424a0a
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x424b0e
push 0x428340
push 0x4282f0
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x461f38], 2
jmp 0x424a2c
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00424cf4
pop ecx
call fcn.00425795
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x424a5c
push esi
call fcn.00424c67
pop ecx
test al, al
je 0x424a5c
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.004259d3
call esi
call fcn.0042579b
mov esi, eax
cmp dword [esi], edi
je 0x424a7a
push esi
call fcn.00424c67
pop ecx
test al, al
je 0x424a7a
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.004258b6
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.004258ec
test al, al
jne 0x424ab3
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x424abc
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00424d11
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x424b0e
call fcn.0042515c
ret
call fcn.00424823
jmp 0x42499e

Function at 0x4264c9
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
jne 0x4264d8
or eax, 0xffffffff
jmp 0x426515
movzx eax, word [edx]
mov ecx, 0x1505
push esi
xor esi, esi
jmp 0x4264f2
imul ecx, ecx, 0x21
movzx eax, ax
xor ecx, eax
inc esi
movzx eax, word [edx + esi*2]
test ax, ax
jne 0x4264e5
imul eax, ecx, 0x41c64e6d
imul ecx, ecx, 0x10dcd
pop esi
add eax, 0x3039
shr eax, 0x10
inc ecx
and ecx, 0xffff0000
or eax, ecx
pop ebp
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000d7b0
Capabilities:
Hash data using crc32b

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push edi
lea edi, [edx + eax]
cmp edx, edi
mov eax, dword [esp + 0x10]
jae 0x1000d7ec
push esi
mov ecx, eax
mov esi, 8
lea esp, [esp]
mov eax, ecx
shl ecx, 1
test eax, eax
jge 0x1000d7de
xor ecx, 0x4c11db7
dec esi
jne 0x1000d7d0
movzx eax, byte [edx]
xor eax, ecx
inc edx
cmp edx, edi
jb 0x1000d7c5
pop esi
not eax
pop edi
ret
Function at 0x1000f060
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret

Function at 0x1000f8a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
lea edi, [esi + eax]
cmp esi, edi
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax + 0x100]
movzx edx, byte [eax + 0x101]
mov dword [esp + 0x10], edi
je 0x1000f91b
push ebx
push ebp
jmp 0x1000f8d0
mov ecx, dword [esp + 0x14]
nop
lea edi, [ecx + 1]
and edi, 0xff
mov bl, byte [edi + eax]
movzx ebp, bl
xor ecx, ecx
add edx, ebp
and edx, 0xff
mov cl, byte [edx + eax]
mov byte [edi + eax], cl
mov byte [edx + eax], bl
mov bl, byte [esi]
mov dword [esp + 0x14], edi
add ecx, ebp
and ecx, 0xff
mov cl, byte [ecx + eax]
xor cl, bl
mov byte [esi], cl
movzx ecx, bl
add edx, ecx
mov ecx, dword [esp + 0x18]
inc esi
cmp esi, ecx
jne 0x1000f8cb
mov cl, byte [esp + 0x14]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
ret

Function at 0x1000f930
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
lea edi, [esi + eax]
cmp esi, edi
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax + 0x100]
movzx edx, byte [eax + 0x101]
mov dword [esp + 0x10], edi
je 0x1000f9ab
push ebx
push ebp
jmp 0x1000f960
mov ecx, dword [esp + 0x14]
nop
lea edi, [ecx + 1]
and edi, 0xff
mov bl, byte [edi + eax]
movzx ebp, bl
xor ecx, ecx
add edx, ebp
and edx, 0xff
mov cl, byte [edx + eax]
mov byte [edi + eax], cl
mov byte [edx + eax], bl
mov bl, byte [esi]
mov dword [esp + 0x14], edi
add ecx, ebp
and ecx, 0xff
mov cl, byte [ecx + eax]
xor cl, bl
mov byte [esi], cl
movzx ecx, cl
add edx, ecx
mov ecx, dword [esp + 0x18]
inc esi
cmp esi, ecx
jne 0x1000f95b
mov cl, byte [esp + 0x14]
pop ebp
pop ebx
pop edi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop esi
ret

Function at 0x10011660
Capabilities:
Encode data using xor

Disassembly:
movzx edx, word [esp + 8]
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
mov cl, byte [esi + 0x16]
add edx, eax
cmp eax, edx
jae 0x10011685
push ebx
mov bl, byte [eax]
add cl, 0x3b
xor bl, cl
mov byte [eax], bl
inc eax
cmp eax, edx
jb 0x10011676
pop ebx
mov byte [esi + 0x16], cl
pop esi
ret

Function at 0x10011690
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov dl, byte [eax + 0x10]
push ebx
movzx ebx, word [esp + 0x10]
push ebp
push esi
mov esi, dword [eax]
mov eax, dword [esp + 0x14]
mov ecx, ebx
mov ebp, ecx
shr ecx, 2
push edi
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebx + eax]
cmp eax, ecx
jae 0x100116da
nop
mov bl, byte [eax]
add dl, 0x3b
xor bl, dl
mov byte [eax], bl
inc eax
cmp eax, ecx
jb 0x100116c0
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov byte [eax + 0x10], dl
pop ebx
ret
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov byte [ecx + 0x10], dl
pop ebx
ret
Function at 0x100116f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push esi
movzx esi, word [esp + 0x10]
push edi
mov edi, dword [esp + 0xc]
mov dl, byte [edi + 1]
mov cl, byte [edi]
add esi, eax
cmp eax, esi
jae 0x1001171e
push ebx
jmp 0x10011710
mov bl, byte [eax]
xor bl, cl
add cl, dl
mov byte [eax], bl
inc eax
cmp eax, esi
jb 0x10011710
pop ebx
mov byte [edi], cl
pop edi
pop esi
ret
Function at 0x10015070
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, eax
push edi
mov edi, dword [esi + 4]
mov byte [esp + 0xf], 1
xor ebx, ebx
mov eax, dword [esi + 0x28]
mov dword [esi + 4], 3
mov byte [esi + 0x24], bl
mov byte [esi + 0x74], bl
cmp byte [eax], bl
je 0x100150a0
mov byte [esi + 0x1a], 1
lea ebx, [ebx]
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
push 1
lea edx, [esp + 0x14]
push edx
push eax
call dword [ecx + 0xc]
add esp, 0xc
cmp ax, 1
jne 0x100151b1
mov ecx, dword [esp + 0x10]
push ecx
mov eax, esi
mov byte [esp + 0x13], bl
call fcn.10014f90
add esp, 4
cmp eax, 0xffffffff
je 0x10015288
cmp eax, 2
jne 0x100150a0
mov ecx, dword [esi + 0x28]
mov dword [esi + 4], edi
cmp byte [ecx], bl
je 0x100151a5
mov ax, word [esi + 0x52]
cmp ax, 0x64
jb 0x10015102
cmp ax, 0xc8
jae 0x10015102
mov byte [esi + 0x1a], bl
jmp 0x1001517f
cmp ax, 0x191
jne 0x10015131
cmp dword [ecx + 0x48], ebx
je 0x100151f7
cmp byte [esi + 0x54], 2
je 0x100151ff
mov byte [esi + 0x54], 2
mov edx, dword [ecx + 0x48]
mov dword [esi + 0x58], edx
mov eax, dword [ecx + 0x4c]
mov dword [esi + 0x5c], eax
mov byte [esi + 0x51], 1
jmp 0x1001517f
cmp ax, 0x197
jne 0x10015160
cmp dword [ecx + 0x50], ebx
je 0x10015223
cmp byte [esi + 0x64], 2
je 0x10015247
mov byte [esi + 0x64], 2
mov edx, dword [ecx + 0x50]
mov dword [esi + 0x68], edx
mov eax, dword [ecx + 0x54]
mov dword [esi + 0x6c], eax
mov byte [esi + 0x51], 1
jmp 0x1001517f
cmp ax, 0xcc
jne 0x1001516b
mov dword [esi + 8], ebx
jmp 0x1001517f
cmp ax, 0xc8
jb 0x1001526b
cmp ax, 0x12c
jae 0x1001526b
cmp byte [esi + 0x51], bl
jne 0x10015198
cmp byte [esi + 0x54], 2
jne 0x1001518e
mov byte [esi + 0x54], 1
cmp byte [esi + 0x64], 2
jne 0x10015198
mov byte [esi + 0x64], 1
cmp byte [ecx], bl
je 0x100151a5
cmp byte [esi + 0x1a], bl
je 0x10015082
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
cmp byte [esp + 0xf], bl
je 0x10015288
cmp byte [esi + 0x7c], bl
jne 0x10015288
mov ecx, dword [esi + 0x28]
cmp byte [ecx], bl
je 0x10015288
mov edx, dword [esi]
push ebx
push ebx
push edx
mov byte [esi + 0x51], 1
mov byte [esi + 0x7c], 1
mov dword [esi + 0x10], 3
call fcn.100120e0
add esp, 0xc
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
push ebx
push 0xd1
jmp 0x1001524d
mov esi, dword [esi]
xor ecx, ecx
mov cx, word [esi + 2]
push ebx
push 0xd3
push ecx
push esi
push 7
call fcn.10012260
add esp, 0x14
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 8
ret
mov esi, dword [esi]
xor edx, edx
mov dx, word [esi + 2]
push ebx
push 0xd2
push edx
push esi
push 7
call fcn.10012260
add esp, 0x14
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 8
ret
push ebx
push 0xd4
mov esi, dword [esi]
xor eax, eax
mov ax, word [esi + 2]
push eax
push esi
push 7
call fcn.10012260
add esp, 0x14
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 8
ret
mov ecx, dword [esi + 0x2c]
mov edx, dword [ecx]
mov eax, dword [esi]
push edx
xor ecx, ecx
mov cx, word [eax + 2]
push ebx
push 0x56
push ecx
push eax
push 7
call fcn.100121d0
add esp, 0x18
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 8
ret
Function at 0x10018410
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push str.WS2_32.DLL
call ebx
mov esi, eax
test esi, esi
jne 0x1001842e
push str.WSOCK32.DLL
call ebx
mov esi, eax
cmp esi, 0x20
mov dword [edi + 0x70], esi
jae 0x1001843b
pop esi
xor al, al
pop ebx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.closesocket
push esi
xor bl, bl
call ebp
test eax, eax
mov dword [edi], eax
je 0x1001861c
push str.connect
push esi
call ebp
test eax, eax
mov dword [edi + 4], eax
je 0x1001861c
push str.getsockopt
push esi
call ebp
test eax, eax
mov dword [edi + 0x10], eax
je 0x1001861c
push str.recv
push esi
call ebp
test eax, eax
mov dword [edi + 0x1c], eax
je 0x1001861c
push str.send
push esi
call ebp
test eax, eax
mov dword [edi + 0x20], eax
je 0x1001861c
push str.recvfrom
push esi
call ebp
test eax, eax
mov dword [edi + 0x44], eax
je 0x1001861c
push str.sendto
push esi
call ebp
test eax, eax
mov dword [edi + 0x40], eax
je 0x1001861c
push str.setsockopt
push esi
call ebp
test eax, eax
mov dword [edi + 0x24], eax
je 0x1001861c
push str.socket
push esi
call ebp
test eax, eax
mov dword [edi + 0x28], eax
je 0x1001861c
push str.bind
push esi
call ebp
test eax, eax
mov dword [edi + 0x2c], eax
je 0x1001861c
push str.listen
push esi
call ebp
test eax, eax
mov dword [edi + 0x30], eax
je 0x1001861c
push str.select
push esi
call ebp
test eax, eax
mov dword [edi + 0x34], eax
je 0x1001861c
push str.accept
push esi
call ebp
test eax, eax
mov dword [edi + 0x38], eax
je 0x1001861c
push str.shutdown
push esi
call ebp
test eax, eax
mov dword [edi + 0x3c], eax
je 0x1001861c
push str.getsockname
push esi
call ebp
test eax, eax
mov dword [edi + 8], eax
je 0x1001861c
push str.getpeername
push esi
call ebp
test eax, eax
mov dword [edi + 0xc], eax
je 0x1001861c
push str.WSAGetLastError
push esi
call ebp
test eax, eax
mov dword [edi + 0x5c], eax
je 0x1001861c
push str.WSACleanup
push esi
mov dword [edi + 0x60], eax
call ebp
test eax, eax
mov dword [edi + 0x64], eax
je 0x1001861c
push str.WSAStartup
push esi
call ebp
test eax, eax
mov dword [edi + 0x68], eax
je 0x1001861c
push str.gethostbyaddr
push esi
call ebp
test eax, eax
mov dword [edi + 0x48], eax
je 0x1001861c
push str.gethostbyname
push esi
call ebp
test eax, eax
mov dword [edi + 0x4c], eax
je 0x1001861c
push str.inet_addr
push esi
call ebp
test eax, eax
mov dword [edi + 0x50], eax
je 0x1001861c
push str.gethostname
push esi
call ebp
test eax, eax
mov dword [edi + 0x58], eax
je 0x1001861c
push str.getprotobyname
push esi
call ebp
test eax, eax
mov dword [edi + 0x54], eax
je 0x1001861c
push str.htons
push esi
call ebp
test eax, eax
mov dword [edi + 0x14], eax
je 0x1001861c
push str.ntohs
push esi
call ebp
test eax, eax
mov dword [edi + 0x18], eax
je 0x1001861c
pop ebp
mov bl, 1
pop esi
mov al, bl
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebp
pop esi
mov al, bl
pop ebx
ret
Function at 0x10018d10
Capabilities:
Get socket status

Disassembly:
sub esp, 0x21c
push ebp
push esi
mov esi, dword [esp + 0x22c]
push edi
lea eax, [esp + 0x10]
push eax
push 0x8004667e
xor ebp, ebp
mov edi, 1
push esi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], edi
call sub.WSOCK32.dll_ioctlsocket
test eax, eax
jne 0x10018e66
mov ecx, dword [esp + 0x238]
mov edx, dword [esp + 0x234]
mov eax, dword [esp + 0x22c]
push ebx
push ecx
push edx
push esi
call dword [eax + 4]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
jne 0x10018d7e
mov ecx, dword [esp + 0x230]
call dword [ecx + 0x5c]
movsx edx, ax
mov dword [esp + 0x10], edx
cmp dword [esp + 0x10], 0x2733
jne 0x10018e4d
mov eax, dword [esp + 0x248]
cmp eax, ebp
jne 0x10018d9c
mov eax, 0xa
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x12c]
push ecx
lea edx, [esp + 0x2c]
push edx
push ebp
lea eax, [esi + 1]
push eax
mov dword [esp + 0x34], ebp
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], edi
mov dword [esp + 0x140], esi
mov dword [esp + 0x13c], edi
call sub.WSOCK32.dll_select
lea ecx, [esp + 0x24]
push ecx
push esi
mov edi, eax
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x10018def
mov dword [esp + 0x10], ebp
mov bl, 1
jmp 0x10018e4d
lea edx, [esp + 0x128]
push edx
push esi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x10018e38
mov eax, dword [esp + 0x244]
push eax
mov eax, dword [esp + 0x234]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
push 0x1007
push 0xffff
push esi
push eax
mov dword [esp + 0x34], 4
call fcn.10018820
add esp, 0x1c
jmp 0x10018e4d
cmp edi, ebp
je 0x10018e4d
mov ecx, dword [esp + 0x230]
call dword [ecx + 0x5c]
movsx edx, ax
mov dword [esp + 0x10], edx
lea eax, [esp + 0x14]
push eax
push 0x8004667e
push esi
mov dword [esp + 0x20], ebp
call sub.WSOCK32.dll_ioctlsocket
test bl, bl
pop ebx
jne 0x10018ea8
mov eax, dword [esp + 0xc]
cmp eax, ebp
jne 0x10018e7f
mov ecx, dword [esp + 0x22c]
call dword [ecx + 0x5c]
movsx eax, ax
mov dword [esp + 0xc], eax
mov cl, byte [esp + 0x23c]
test cl, cl
je 0x10018eac
push eax
mov eax, dword [esp + 0x244]
xor edx, edx
mov dx, word [eax + 2]
push 0x3f
push edx
push eax
movzx eax, word [eax]
push eax
call fcn.10012260
add esp, 0x14
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x21c
ret
Function at 0x10019ff0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, dword [esp + 8]
mov ecx, dword [ebp + 0x28]
mov ax, word [ecx + 2]
cmp bx, ax
ja 0x1001a007
cmp ax, 0xffff
jne 0x1001a00f
mov ax, word [ecx]
cmp bx, ax
jne 0x1001a013
xor al, al
pop ebp
ret
cmp bx, ax
push esi
push edi
ja 0x1001a031
cmp ax, 0xffff
je 0x1001a037
mov edi, dword [ecx + 0x10]
mov edi, dword [edi + 0xc]
cmp word [edi + 2], bx
jb 0x1001a023
jmp 0x1001a0ee
cmp ax, 0xffff
jne 0x1001a03e
mov edi, 1
jmp 0x1001a041
lea edi, [eax + 1]
mov eax, dword [ebp + 0x1c]
movzx edx, byte [eax + 1]
movzx eax, byte [eax]
sub eax, edx
movzx edx, di
movzx esi, bx
sub esi, edx
inc esi
cmp eax, esi
jge 0x1001a067
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov byte [eax], 1
mov al, 1
pop ebp
ret
mov esi, dword [ecx + 0x10]
test esi, esi
jne 0x1001a074
mov dword [esp + 0x10], esi
jmp 0x1001a07b
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x10], ecx
cmp di, bx
jae 0x1001a0ba
mov edx, dword [ebp + 0x1c]
call fcn.10019750
xor ecx, ecx
cmp eax, ecx
je 0x1001a0d2
cmp esi, ecx
mov word [eax + 2], di
mov word [eax + 4], cx
mov word [eax + 6], cx
jne 0x1001a0a4
mov dword [esp + 0x10], eax
jmp 0x1001a0a7
mov dword [esi + 0xc], eax
mov esi, eax
mov eax, dword [ebp + 0x28]
mov dl, byte [eax + 0xc]
inc dl
inc edi
cmp di, bx
mov byte [eax + 0xc], dl
jb 0x1001a080
mov edx, dword [ebp + 0x1c]
call fcn.10019750
mov edi, eax
test edi, edi
je 0x1001a0d2
test esi, esi
mov word [edi + 2], bx
jne 0x1001a0d8
jmp 0x1001a0df
pop edi
pop esi
xor al, al
pop ebp
ret
mov eax, dword [esp + 0x10]
mov dword [esi + 0xc], edi
mov dword [edi + 0xc], eax
mov edx, dword [ebp + 0x28]
mov dword [edx + 0x10], edi
mov eax, dword [ebp + 0x28]
inc byte [eax + 0xc]
mov ax, word [esp + 0x14]
mov cx, word [esp + 0x18]
mov edx, dword [edi + 8]
mov esi, dword [esp + 0x1c]
mov word [edi + 4], ax
mov word [edi + 6], cx
mov eax, dword [ebp + 0x20]
mov dword [ebp + 0x20], edx
mov dword [edi + 8], eax
mov ecx, dword [ebp + 0x28]
mov edx, ebx
call fcn.10019f00
mov ebp, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x10]
cmp dword [ecx + 0xc], edi
jne 0x1001a162
mov cl, byte [ebp + 0xc]
test cl, cl
je 0x1001a15c
xor ecx, ecx
mov cx, word [ebp + 2]
cmp cx, 0xffff
je 0x1001a15c
mov edx, dword [ebp + 0x10]
mov edx, dword [edx + 0xc]
cmp word [edx + 4], 0
jbe 0x1001a15c
sub cx, word [edx + 2]
inc ecx
test cx, cx
je 0x1001a15c
mov cx, word [edi + 6]
pop edi
pop esi
mov word [ebp + 0xa], cx
pop ebp
ret
mov word [ebp + 0xa], 0
pop edi
pop esi
pop ebp
ret
Function at 0x1002b950
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov al, byte [ebp + 0x31]
mov cl, byte [ebp + 0x30]
push esi
push edi
mov edx, ebp
call fcn.1002a980
movzx edi, byte [ebp + 0x32]
movzx ebx, byte [edi + ebp + 0x2b]
dec edi
inc ebx
mov eax, ebx
cdq
idiv edi
test edi, edi
mov dword [esp + 0x18], eax
jle 0x1002b9a3
lea esi, [ebp + 0x2c]
mov eax, edi
movzx ecx, byte [esi]
mov edx, dword [esp + 0x18]
add edx, ecx
cmp edx, 0xff
jl 0x1002b999
mov edx, 0xff
sub ecx, edx
add ebx, ecx
mov byte [esi], dl
inc esi
dec eax
jne 0x1002b983
test ebx, ebx
je 0x1002b9d2
test edi, edi
jle 0x1002b9ce
mov edx, 0xffffffd4
lea ecx, [ebp + 0x2c]
sub edx, ebp
movzx eax, byte [ecx]
cmp eax, 0xff
jge 0x1002b9c6
inc al
dec ebx
mov byte [ecx], al
je 0x1002b9d2
inc ecx
lea eax, [ecx + edx]
cmp eax, edi
jl 0x1002b9b5
test ebx, ebx
jne 0x1002b9a7
mov esi, ebp
call fcn.1002ae70
movzx ebx, byte [ebp + 0x31]
mov esi, dword [ebp + 4]
push esi
mov ecx, ebx
mov dword [esp + 0x14], esi
call fcn.10029c90
mov ecx, dword [ebp + edi*4 + 0x1c]
mov edx, dword [esi + ebx*4 + 4]
lea eax, [esi + ebx*4 + 4]
push 0x202
push ecx
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
push edx
push eax
call fcn.1005e200
mov al, byte [ebp + 0x32]
mov ecx, dword [esp + 0x2c]
dec al
mov byte [ebp + 0x32], al
mov edx, dword [ecx]
mov eax, dword [ebp + 8]
push edx
push eax
call fcn.1005e110
movzx ecx, byte [esi + 1]
mov edi, dword [esp + 0x34]
sub ecx, ebx
shl ecx, 2
mov edx, ecx
shr ecx, 2
lea esi, [esi + ebx*4 + 8]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x2c]
mov dl, byte [esi + 1]
add esp, 0x1c
dec dl
movzx eax, dl
cmp ebx, eax
mov byte [esi + 1], dl
jg 0x1002ba84
lea esp, [esp]
xor ecx, ecx
mov cl, bl
push 0
inc cl
push ebx
push 0xff
push 0
mov eax, ebp
push ecx
call fcn.1002ab00
movzx edx, byte [esi + 1]
add esp, 0x14
inc ebx
cmp ebx, edx
jle 0x1002ba60
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1002f0e0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
cmp word [esp + 0x24], 0x24
jb 0x1002f266
mov eax, dword [esp + 0x2c]
cmp word [eax], 0x10
jb 0x1002f266
push esi
push edi
lea ecx, [eax + 3]
lea eax, [esp + 9]
mov edi, 2
jmp 0x1002f110
movzx esi, byte [ecx - 1]
mov edx, esi
shr edx, 4
mov dl, byte [edx + 0x10084a88]
mov byte [eax - 1], dl
and esi, 0xf
mov dl, byte [esi + 0x10084a88]
movzx esi, byte [ecx]
mov byte [eax], dl
mov edx, esi
shr edx, 4
mov dl, byte [edx + 0x10084a88]
mov byte [eax + 1], dl
and esi, 0xf
mov dl, byte [esi + 0x10084a88]
movzx esi, byte [ecx + 1]
mov byte [eax + 2], dl
mov edx, esi
shr edx, 4
mov dl, byte [edx + 0x10084a88]
mov byte [eax + 3], dl
and esi, 0xf
mov dl, byte [esi + 0x10084a88]
movzx esi, byte [ecx + 2]
mov byte [eax + 4], dl
mov edx, esi
shr edx, 4
mov dl, byte [edx + 0x10084a88]
mov byte [eax + 5], dl
and esi, 0xf
mov dl, byte [esi + 0x10084a88]
movzx esi, byte [ecx + 3]
mov byte [eax + 6], dl
mov edx, esi
shr edx, 4
mov dl, byte [edx + 0x10084a88]
mov byte [eax + 7], dl
and esi, 0xf
mov dl, byte [esi + 0x10084a88]
movzx esi, byte [ecx + 4]
mov byte [eax + 8], dl
mov edx, esi
shr edx, 4
mov dl, byte [edx + 0x10084a88]
mov byte [eax + 9], dl
and esi, 0xf
mov dl, byte [esi + 0x10084a88]
movzx esi, byte [ecx + 5]
mov byte [eax + 0xa], dl
mov edx, esi
shr edx, 4
mov dl, byte [edx + 0x10084a88]
mov byte [eax + 0xb], dl
and esi, 0xf
mov dl, byte [esi + 0x10084a88]
movzx esi, byte [ecx + 6]
mov byte [eax + 0xc], dl
mov edx, esi
shr edx, 4
mov dl, byte [edx + 0x10084a88]
and esi, 0xf
mov byte [eax + 0xd], dl
mov dl, byte [esi + 0x10084a88]
mov byte [eax + 0xe], dl
add ecx, 8
add eax, 0x10
dec edi
jne 0x1002f110
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov dword [eax + 6], edx
mov edx, dword [esp + 0x10]
mov dword [eax + 0xb], edx
mov edx, dword [esp + 0x14]
mov dword [eax + 2], ecx
mov dword [eax + 0x10], edx
mov edx, dword [esp + 0x18]
mov cl, 0x2d
mov byte [eax + 0xa], cl
mov byte [eax + 0xf], cl
mov byte [eax + 0x14], cl
mov dword [eax + 0x15], edx
mov edx, dword [esp + 0x1c]
mov byte [eax + 0x19], cl
lea ecx, [eax + 0x1a]
mov dword [ecx], edx
mov edx, dword [esp + 0x20]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x24]
pop edi
mov word [eax], 0x24
mov dword [ecx + 8], edx
xor al, al
pop esi
add esp, 0x20
ret 0xc
call fcn.1001d3f0
mov al, 1
add esp, 0x20
ret 0xc