joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101a9cd0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x2c
push ebp
mov ebp, dword [esp + 0x34]
sub ecx, ebp
sar ecx, 5
mov dword [esp + 0x38], ecx
cmp ecx, 2
jl 0x101a9e33
mov eax, ecx
cdq
sub eax, edx
push edi
mov edi, eax
sar edi, 1
test edi, edi
jle 0x101a9e32
lea eax, [ecx - 1]
mov dword [esp + 0xc], eax
cdq
sub eax, edx
push ebx
push esi
mov esi, eax
mov eax, edi
sar esi, 1
shl eax, 5
mov dword [esp + 0x40], esi
add eax, ebp
nop dword [eax + eax]
movups xmm0, xmmword [eax - 0x20]
sub eax, 0x20
dec edi
mov dword [esp + 0x18], eax
mov ebx, edi
mov dword [esp + 0x10], edi
movups xmmword [esp + 0x1c], xmm0
movups xmm0, xmmword [eax + 0x10]
mov eax, edi
movups xmmword [esp + 0x2c], xmm0
cmp edi, esi
jge 0x101a9dbd
mov edi, dword [esp + 0x40]
nop word [eax + eax]
lea esi, [ebx*2 + 2]
mov edx, esi
lea ebx, [esi - 1]
shl edx, 5
mov ecx, dword [edx + ebp - 0x20]
cmp dword [edx + ebp], ecx
cmovae ebx, esi
shl eax, 5
add eax, ebp
mov edx, ebx
shl edx, 5
add edx, ebp
mov ecx, dword [edx]
mov dword [eax], ecx
mov cl, byte [edx + 4]
mov byte [eax + 4], cl
mov cx, word [edx + 6]
mov word [eax + 6], cx
mov ecx, dword [edx + 8]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
mov ecx, dword [edx + 0x10]
mov dword [eax + 0x10], ecx
mov ecx, dword [edx + 0x14]
mov dword [eax + 0x14], ecx
mov ecx, dword [edx + 0x18]
mov dword [eax + 0x18], ecx
mov ecx, dword [edx + 0x1c]
mov dword [eax + 0x1c], ecx
mov eax, ebx
cmp ebx, edi
jl 0x101a9d50
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
cmp ebx, esi
jne 0x101a9e0c
test cl, 1
jne 0x101a9e0c
shl ecx, 5
shl eax, 5
add eax, ebp
lea edx, [ecx + ebp]
mov ecx, dword [edx - 0x20]
mov dword [eax], ecx
mov cl, byte [edx - 0x1c]
mov byte [eax + 4], cl
mov cx, word [edx - 0x1a]
mov word [eax + 6], cx
mov ecx, dword [edx - 0x18]
mov dword [eax + 8], ecx
mov ecx, dword [edx - 0x14]
mov dword [eax + 0xc], ecx
mov ecx, dword [edx - 0x10]
mov dword [eax + 0x10], ecx
mov ecx, dword [edx - 0xc]
mov dword [eax + 0x14], ecx
mov ecx, dword [edx - 8]
mov dword [eax + 0x18], ecx
mov ecx, dword [edx - 4]
mov dword [eax + 0x1c], ecx
mov eax, dword [esp + 0x14]
push dword [esp + 0x48]
lea ecx, [esp + 0x20]
push ecx
push edi
push eax
push ebp
call fcn.101aa150
mov eax, dword [esp + 0x2c]
add esp, 0x14
mov ecx, dword [esp + 0x44]
test edi, edi
jg 0x101a9d20
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x2c
ret
Function at 0x101aa040
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x1c]
dec esi
mov dword [esp + 0xc], ecx
mov eax, esi
mov dword [esp + 0x18], esi
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
push edi
mov edi, ecx
cmp ecx, ebx
jge 0x101aa0d5
nop dword [eax]
lea esi, [edi*2 + 2]
mov edx, esi
lea edi, [esi - 1]
shl edx, 5
mov eax, dword [edx + ebp - 0x20]
cmp dword [edx + ebp], eax
cmovae edi, esi
shl ecx, 5
add ecx, ebp
mov edx, edi
shl edx, 5
add edx, ebp
mov eax, dword [edx]
mov dword [ecx], eax
mov al, byte [edx + 4]
mov byte [ecx + 4], al
mov ax, word [edx + 6]
mov word [ecx + 6], ax
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [edx + 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [ecx + 0x14], eax
mov eax, dword [edx + 0x18]
mov dword [ecx + 0x18], eax
mov eax, dword [edx + 0x1c]
mov dword [ecx + 0x1c], eax
mov ecx, edi
cmp edi, ebx
jl 0x101aa070
mov esi, dword [esp + 0x1c]
cmp edi, ebx
jne 0x101aa12c
mov edx, dword [esp + 0x20]
test dl, 1
jne 0x101aa12c
shl edx, 5
shl ecx, 5
add ecx, ebp
mov eax, dword [edx + ebp - 0x20]
mov dword [ecx], eax
mov al, byte [edx + ebp - 0x1c]
mov byte [ecx + 4], al
mov ax, word [edx + ebp - 0x1a]
mov word [ecx + 6], ax
mov eax, dword [edx + ebp - 0x18]
mov dword [ecx + 8], eax
mov eax, dword [edx + ebp - 0x14]
mov dword [ecx + 0xc], eax
mov eax, dword [edx + ebp - 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [edx + ebp - 0xc]
mov dword [ecx + 0x14], eax
mov eax, dword [edx + ebp - 8]
mov dword [ecx + 0x18], eax
mov eax, dword [edx + ebp - 4]
mov dword [ecx + 0x1c], eax
mov ecx, esi
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x18]
push ecx
push ebp
call fcn.101aa150
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x101aa150
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x14]
lea eax, [ecx - 1]
push esi
mov esi, dword [esp + 0x1c]
cdq
sub eax, edx
push edi
mov edi, eax
sar edi, 1
cmp ebp, ecx
jge 0x101aa1c8
mov edx, edi
shl edx, 5
add edx, ebx
mov eax, dword [edx]
cmp eax, dword [esi]
jae 0x101aa1c8
shl ecx, 5
add ecx, ebx
mov dword [ecx], eax
mov al, byte [edx + 4]
mov byte [ecx + 4], al
mov ax, word [edx + 6]
mov word [ecx + 6], ax
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [edx + 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [ecx + 0x14], eax
mov eax, dword [edx + 0x18]
mov dword [ecx + 0x18], eax
mov eax, dword [edx + 0x1c]
mov dword [ecx + 0x1c], eax
lea eax, [edi - 1]
cdq
mov ecx, edi
sub eax, edx
mov edi, eax
sar edi, 1
cmp ebp, ecx
jl 0x101aa172
mov eax, dword [esi]
shl ecx, 5
add ecx, ebx
pop edi
mov dword [ecx], eax
mov al, byte [esi + 4]
mov byte [ecx + 4], al
mov ax, word [esi + 6]
mov word [ecx + 6], ax
mov eax, dword [esi + 8]
mov dword [ecx + 8], eax
mov eax, dword [esi + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ecx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ecx + 0x18], eax
mov eax, dword [esi + 0x1c]
pop esi
pop ebp
mov dword [ecx + 0x1c], eax
pop ebx
ret

Function at 0x101aa210
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
push esi
mov esi, dword [esp + 0x2c]
mov eax, esi
push edi
mov edi, dword [esp + 0x2c]
sub eax, edi
sar eax, 5
cmp eax, 2
jl 0x101aa2b8
push ebx
push ebp
mov ebp, 0xfffffffa
mov ebx, 0x1a
add esi, 0xffffffe6
sub ebp, edi
sub ebx, edi
cmp eax, 2
jl 0x101aa2a8
movups xmm0, xmmword [esi - 6]
mov eax, dword [edi]
push dword [esp + 0x3c]
movups xmmword [esp + 0x14], xmm0
movups xmm0, xmmword [esi + 0xa]
mov dword [esi - 6], eax
mov al, byte [edi + 4]
mov byte [esi - 2], al
mov ax, word [edi + 6]
mov word [esi], ax
mov eax, dword [edi + 8]
mov dword [esi + 2], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 6], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0xa], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0xe], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x12], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x16], eax
lea eax, [esp + 0x14]
push eax
lea eax, [esi + ebp]
sar eax, 5
push eax
push 0
push edi
movups xmmword [esp + 0x34], xmm0
call fcn.101aa040
add esp, 0x14
sub esi, 0x20
lea eax, [ebx + esi]
sar eax, 5
cmp eax, 2
jge 0x101aa245
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x20
ret
Function at 0x101b6170
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1026adb2
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10583760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
lea esi, [edi + 0x18]
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [ebp - 0x14], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10021b80
mov dword [esi], eax
mov eax, edi
mov byte [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0x7fffffff
mov dword [edi + 0x40], 0x7fffffff
mov dword [edi + 0x44], 0x80000000
mov dword [edi + 0x48], 0x80000000
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x101bc970
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1026b5cb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10583760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0
call fcn.1018bb20
mov dword [esi + 0x24], eax
add esp, 4
lea eax, [esi + 0x30]
mov dword [esi + 0x28], 0xffffffff
mov byte [esi + 0x2c], 0
mov dword [eax + 0x14], 0xf
mov dword [eax + 0x10], 0
cmp dword [eax + 0x14], 0x10
jb 0x101bc9ec
mov eax, dword [eax]
mov byte [eax], 0
push 1
lea ecx, [esi + 0x48]
mov dword [ebp - 4], 0
call fcn.10190e60
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x101d14d0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1026cd6f
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10583760]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], 0
mov ecx, dword [ebx + 0xd0]
sub ecx, dword [ebx + 0xcc]
sar ecx, 2
div ecx
mov eax, dword [ebx + 0xcc]
mov ebx, dword [eax + edx*4]
mov dword [ebp + 0x10], ebx
lea ecx, [ebx + 0x5c]
call fcn.10190e80
mov ecx, dword [ebp + 0x20]
lea eax, [ebx + 0x20]
mov edx, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
push eax
lea eax, [ebx + 0x18]
mov dword [ebx + 0x34], esi
push eax
lea eax, [ebx + 0x10]
mov dword [ebx + 0x30], edi
push eax
push ecx
push edx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x3c], ecx
mov dword [ebx + 0xc], 0
push esi
push dword [esi + 0x10c]
call fcn.101d1650
add esp, 0x24
mov dword [ebp - 4], 0xffffffff
push 0x10
call fcn.101f594f
add esp, 4
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x101d15ab
push ebx
push esi
push dword [ebp + 8]
mov ecx, eax
call fcn.101d0ea0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101d5230
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
mov ecx, 0x40
push esi
mov esi, dword [esp + 0x14]
sub ecx, ebx
push edi
mov eax, dword [esi]
mov edx, dword [esi + 4]
call fcn.101f6da0
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x1c]
or dword [ecx], eax
or dword [ecx + 4], edx
mov eax, dword [edi]
cmp eax, ebx
jge 0x101d538f
sub ebx, eax
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x24]
push ebp
cmp dword [ebx], 0x40
jl 0x101d5312
mov ebp, dword [esp + 0x24]
mov ecx, dword [ebp]
movzx eax, byte [ecx]
cdq
mov edi, eax
mov ebx, edx
movzx eax, byte [ecx + 1]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 2]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 3]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 4]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 5]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 6]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
movzx eax, byte [ecx + 7]
shld ebx, edi, 8
cdq
shl edi, 8
or ebx, edx
or edi, eax
mov dword [esi + 4], ebx
mov eax, dword [esp + 0x28]
mov dword [esi], edi
mov edi, dword [esp + 0x20]
mov dword [edi], 0x40
add dword [ebp], 8
add dword [eax], 0xffffffc0
jmp 0x101d5370
mov dword [esi], 0
mov ebp, 0x38
mov dword [esi + 4], 0
mov dword [edi], 0x40
cmp dword [ebx], 0
mov dword [esp + 0x28], 0
jle 0x101d5368
mov edi, dword [esp + 0x24]
nop dword [eax + eax]
mov eax, dword [edi]
mov ecx, ebp
movzx eax, byte [eax]
cdq
call fcn.101f6d80
or dword [esi], eax
or dword [esi + 4], edx
inc dword [edi]
add ebp, 0xfffffff8
adc dword [esp + 0x28], 0xffffffff
add dword [ebx], 0xfffffff8
cmp dword [ebx], 0
jg 0x101d5340
mov edi, dword [esp + 0x20]
jge 0x101d5370
mov dword [ebx], 0
mov ebx, dword [esp + 0x18]
mov ecx, 0x40
mov eax, dword [esi]
sub ecx, ebx
mov edx, dword [esi + 4]
call fcn.101f6da0
mov ecx, dword [esp + 0x14]
pop ebp
or dword [ecx], eax
or dword [ecx + 4], edx
mov eax, dword [esi]
mov ecx, ebx
mov edx, dword [esi + 4]
call fcn.101f6d80
mov dword [esi], eax
mov dword [esi + 4], edx
sub dword [edi], ebx
jne 0x101d53b1
mov dword [esi], 0
mov dword [esi + 4], 0
pop edi
pop esi
pop ebx
ret 0x18
Function at 0x101e279d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x10213a5c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.102138db

Function at 0x1021a910
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1021a5d0
Function at 0x1023d560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], ecx
xor ebx, ebx
mov dword [ebp - 0x24], esi
push edi
mov dword [ebp - 0x10], 0
mov eax, dword [esi + 4]
lea edi, [esi + 0x38]
mov dword [ebp - 0x18], eax
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 8]
mov dword [ebp - 0x20], ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x34]
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], eax
cmp eax, 4
jg 0x1023d5ab
cmp eax, 2
setle bl
add ebx, 2
jmp 0x1023d5b1
cmp eax, 0x10
setle bl
push ecx
mov ecx, ebx
mov eax, 1
shl eax, cl
dec edx
add edx, eax
shr edx, cl
mov ecx, esi
call fcn.1023d940
add esp, 4
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x1023d6f7
mov eax, dword [esi + 8]
mov ecx, 1
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
cdq
push edx
push eax
call fcn.10229ce0
add esp, 8
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x1023d601
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x18]
push ebx
push dword [ebp - 0x14]
mov ebx, dword [ebp - 0xc]
push dword [ebp - 8]
push ebx
push edi
push dword [esi + 0x14]
push dword [eax + 0x38]
call fcn.1023d710
mov ecx, dword [ebp - 4]
mov edx, 1
push 1
call fcn.10251010
mov ecx, dword [ebp - 4]
add esp, 0x24
mov edx, 3
push 2
call fcn.10251010
mov ecx, dword [ebp - 4]
lea edx, [ebx - 1]
add esp, 4
push 8
call fcn.10251010
dec ebx
add esp, 4
cmp ebx, 1
jl 0x1023d6c2
nop dword [eax]
mov esi, dword [edi + ebx*4 - 4]
mov eax, esi
mov edi, dword [edi + ebx*4]
and eax, 0xff00ff00
mov edx, edi
mov ecx, edi
and edx, 0xff00
and ecx, 0xffff00ff
sub edx, eax
and edi, 0xff00ff00
mov eax, esi
sub edx, 0xff01
and eax, 0xff00ff
and esi, 0xff00ff00
sub ecx, eax
sub edi, esi
mov esi, dword [ebp - 0x24]
add ecx, 0xff00
xor edx, ecx
add edi, 0xff00ff
and edx, 0xff00ff
xor edx, edi
lea edi, [esi + 0x38]
mov dword [edi + ebx*4], edx
dec ebx
cmp ebx, 1
jge 0x1023d660
mov ecx, dword [ebp - 4]
lea eax, [esi + 0x438]
push 0x14
push 1
push dword [ebp - 0xc]
mov edx, edi
push eax
lea eax, [esi + 0x468]
push eax
call fcn.1023e190
mov ecx, dword [ebp - 0x10]
add esp, 0x14
mov esi, eax
call fcn.10229d10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
call fcn.10229d10
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1023daf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10583760]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, dx
mov byte [ebp - 0x18], al
sar eax, 8
push esi
mov esi, ecx
mov byte [ebp - 0x17], al
mov ecx, dword [ebp + 8]
movzx eax, cx
mov byte [ebp - 0xc], al
sar eax, 8
shr edx, 0x10
mov byte [ebp - 0xb], al
lea eax, [ebp - 0x1c]
shr ecx, 0x10
push esi
mov byte [ebp - 0x16], dl
mov byte [ebp - 0xa], cl
push 0x15
sar edx, 8
sar ecx, 8
push eax
mov eax, dword [esi + 0x48]
mov dword [ebp - 0x1c], 0x46464952
mov dword [ebp - 0x14], 0x50424557
mov dword [ebp - 0x10], 0x4c385056
mov byte [ebp - 8], 0x2f
mov byte [ebp - 0x15], dl
mov byte [ebp - 9], cl
call eax
mov ecx, dword [ebp - 4]
add esp, 0xc
neg eax
sbb eax, eax
xor ecx, ebp
and eax, 0xfffffff8
add eax, 8
pop esi
call fcn.101f6477
mov esp, ebp
pop ebp
ret

Function at 0x10245a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [ebp + 8], 0
lea eax, [ebx + eax*4]
mov edi, eax
sub edi, ebx
add edi, 3
shr edi, 2
cmp ebx, eax
cmova edi, ecx
test edi, edi
je 0x10245af4
push esi
mov esi, dword [ebp + 0x10]
nop
mov edx, dword [ebx]
lea esi, [esi + 2]
mov ecx, edx
lea ebx, [ebx + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xd
xor cl, al
mov eax, edx
and cl, 7
shr eax, 0x10
xor cl, al
mov eax, edx
mov byte [esi - 2], cl
mov ecx, edx
shr ecx, 5
shr eax, 3
xor cl, al
shr edx, 5
mov eax, dword [ebp + 8]
and cl, 0x1f
xor cl, dl
inc eax
mov byte [esi - 1], cl
mov dword [ebp + 8], eax
cmp eax, edi
jb 0x10245ab0
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10245b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 8], 0
lea eax, [edi + eax*4]
mov ebx, eax
sub ebx, edi
add ebx, 3
shr ebx, 2
cmp edi, eax
cmova ebx, ecx
test ebx, ebx
je 0x10245b6b
push esi
mov esi, dword [ebp + 0x10]
nop
mov edx, dword [edi]
lea esi, [esi + 2]
mov ecx, edx
lea edi, [edi + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xc
xor cl, al
mov eax, edx
shr eax, 0x10
and cl, 0xf
xor cl, al
mov eax, edx
shr eax, 0x1c
xor al, dl
mov byte [esi - 2], cl
and al, 0xf
xor al, dl
mov byte [esi - 1], al
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, ebx
jb 0x10245b30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10246690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
test edi, edi
jle 0x102467a3
push ebx
mov ebx, dword [ebp + 8]
cmp edi, 8
jb 0x1024676e
mov ecx, edi
and ecx, 0x80000007
jns 0x102466bd
dec ecx
or ecx, 0xfffffff8
inc ecx
movaps xmm4, xmmword [0x103d83f0]
mov edx, edi
movaps xmm6, xmmword [0x103d8850]
sub edx, ecx
movaps xmm7, xmmword [0x103d8550]
mov ecx, 8
movd xmm3, ecx
mov ecx, 0x10
movd xmm5, ecx
nop dword [eax + eax]
movups xmm2, xmmword [ebx + eax*4]
movaps xmm0, xmm2
psrld xmm0, xmm3
pand xmm0, xmm4
movaps xmm1, xmm0
pslld xmm1, xmm5
por xmm1, xmm0
movaps xmm0, xmm6
pand xmm0, xmm2
paddd xmm1, xmm0
movaps xmm0, xmmword [0x103d8830]
pand xmm0, xmm2
pand xmm1, xmm7
por xmm1, xmm0
movups xmmword [ebx + eax*4], xmm1
movups xmm2, xmmword [ebx + eax*4 + 0x10]
movaps xmm0, xmm2
psrld xmm0, xmm3
pand xmm0, xmm4
movaps xmm1, xmm0
pslld xmm1, xmm5
por xmm1, xmm0
movaps xmm0, xmm2
pand xmm2, xmmword [0x103d8830]
pand xmm0, xmm6
paddd xmm1, xmm0
pand xmm1, xmm7
por xmm1, xmm2
movups xmmword [ebx + eax*4 + 0x10], xmm1
add eax, 8
cmp eax, edx
jl 0x102466f0
cmp eax, edi
jge 0x102467a2
push esi
mov esi, dword [ebx + eax*4]
mov ecx, esi
shr ecx, 8
movzx ecx, cl
mov edx, ecx
shl edx, 0x10
or edx, ecx
mov ecx, esi
and ecx, 0xffff00ff
add edx, ecx
xor edx, esi
and edx, 0xff00ff
xor edx, esi
mov dword [ebx + eax*4], edx
inc eax
cmp eax, edi
jl 0x10246773
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x102504d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10583760]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x103d80c0]
mov eax, ecx
push ebx
mov ebx, 1
mov dword [ebp - 0x20], eax
push edi
mov edx, dword [eax + 0x18]
mov edi, ebx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x2c], edi
movups xmmword [ebp - 0x14], xmm0
cmp edx, ebx
jle 0x10250617
lea ecx, [eax + 0x474]
mov eax, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
push esi
nop dword [eax]
xor esi, esi
mov dword [ebp - 0x28], 0
test ebx, ebx
jle 0x1025055e
mov edx, dword [ebp - 0x20]
add edx, 0x198
mov ecx, eax
call fcn.10250630
test eax, eax
mov eax, dword [ebp - 0x1c]
jne 0x10250551
inc esi
add edx, 0x2dc
cmp esi, ebx
jl 0x10250536
jmp 0x10250558
mov dword [ebp - 0x28], 1
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
cmp dword [ebp - 0x28], 0
mov dword [ebp + edi*4 - 0x14], esi
jne 0x10250588
cmp ebx, edi
je 0x1025057e
mov edi, dword [ebp - 0x18]
mov ecx, 0xb7
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
inc ebx
add ecx, 0x2dc
mov dword [ebp - 0x18], ecx
inc edi
add eax, 0x2dc
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x1c], eax
cmp edi, edx
jl 0x10250520
cmp ebx, edx
jge 0x10250616
mov edi, dword [ebp - 0x20]
mov esi, dword [edi + 0x2c]
imul esi, dword [edi + 0x28]
test esi, esi
jle 0x102505dc
nop word [eax + eax]
mov eax, dword [edi + 0x5858]
dec esi
mov ecx, dword [eax + esi*8]
lea edx, [eax + esi*8]
mov eax, ecx
shr eax, 5
and eax, 3
mov eax, dword [ebp + eax*4 - 0x14]
shl eax, 5
xor eax, ecx
and eax, 0x60
xor eax, ecx
mov dword [edx], eax
test esi, esi
jg 0x102505b0
mov edx, dword [ebp - 0x24]
imul eax, ebx, 0x2dc
lea esi, [edi - 0x144]
mov dword [edi + 0x18], ebx
add esi, eax
add eax, 0x198
add eax, edi
mov dword [ebp - 0x20], esi
sub edx, ebx
nop dword [eax]
mov edi, eax
mov ecx, 0xb7
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x20]
add eax, 0x2dc
sub edx, 1
jne 0x10250600
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.101f6477
mov esp, ebp
pop ebp
ret
Function at 0x10254e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, edx
push esi
push edi
mov dword [ebp - 0x10], ebx
mov edi, dword [ebx]
lea eax, [ecx + edi*2]
add eax, edi
imul esi, eax, 0x2c
mov eax, dword [ebx + 4]
add esi, dword [ebx + 0x14]
test eax, eax
jns 0x10254e74
mov edx, esi
xor ecx, ecx
call fcn.10254b90
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp edi, eax
jg 0x10254f7f
nop dword [eax]
mov edx, esi
mov ecx, 1
call fcn.10254b90
mov eax, dword [ebx + 8]
movsx eax, word [eax + edi*2]
mov dword [ebp - 4], eax
test eax, eax
jne 0x10254ec9
nop word [eax + eax]
lea edx, [esi + 4]
xor ecx, ecx
inc edi
call fcn.10254b90
movzx eax, byte [edi + 0x103c63b0]
imul esi, eax, 0x84
mov eax, dword [ebx + 8]
movsx eax, word [eax + edi*2]
add esi, dword [ebx + 0x14]
mov dword [ebp - 4], eax
test eax, eax
je 0x10254ea0
inc edi
lea edx, [esi + 4]
mov ecx, 1
mov dword [ebp - 0xc], edi
call fcn.10254b90
mov eax, dword [ebp - 4]
lea edx, [esi + 8]
inc eax
mov ecx, 2
cmp ecx, eax
sbb ecx, ecx
neg ecx
call fcn.10254b90
test eax, eax
jne 0x10254efd
mov esi, dword [ebx + 0x14]
add esi, 0x2c
jmp 0x10254f67
mov eax, dword [ebp - 4]
mov ecx, 0x43
cdq
xor eax, edx
mov dword [ebp - 4], 0
sub eax, edx
cmp eax, 0x43
cmovg eax, ecx
movzx ebx, word [eax*4 + 0x103ca96c]
shr ebx, 1
movzx ecx, word [eax*4 + 0x103ca96e]
mov dword [ebp - 8], ecx
je 0x10254f5e
mov edi, dword [ebp - 4]
lea edx, [esi + 0xc]
mov esi, ecx
test bl, 1
je 0x10254f53
mov ecx, edi
mov eax, 2
shl eax, cl
and eax, esi
neg eax
sbb eax, eax
neg eax
mov ecx, eax
call fcn.10254b90
inc edi
add edx, 4
sar ebx, 1
jne 0x10254f36
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebx + 0x14]
add esi, 0x58
movzx eax, byte [edi + 0x103c63b0]
imul ecx, eax, 0x84
add esi, ecx
cmp edi, dword [ebx + 4]
jle 0x10254e80
cmp edi, 0x10
jge 0x10254f8d
mov edx, esi
xor ecx, ecx
call fcn.10254b90
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret