joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e8cb
Capabilities:
Create thread

Disassembly:
jae 0x1000e8c9
jmp 0x1000e8c4
call fcn.1000e8cb
jae 0x1000e8c4
add esp, 4
jmp 0x1000e8d0
dec dword [esp]
jno 0x1000e8d5
jns 0x1000e8c0
jp 0x1000e8d9
add esp, 4
popf
jmp 0x1000e8e0
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e8f9
jne 0x1000e8f9
call 0x1fc11c4d
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x1000e7a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000e92d
call fcn.10013240
clc
jae 0x1000e932
stosd dword es:[edi], eax
dec ebp
pushf
push 0xa
jae 0x1000e93f
jmp 0x1000e93a
call 0x1000e941
jae 0x1000e93a
add esp, 4
jmp 0x1000e946
dec dword [esp]
jno 0x1000e94b
jns 0x1000e936
jp 0x1000e94f
add esp, 4
popf
jmp 0x1000e956
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e96f
jne 0x1000e96f
dec ebp
jl 0x1000e974
jmp 0x1000e976
je 0x1000e971
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000e990
jne 0x1000e98f
call 0x9304da17
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000e99e
jne 0x1000e99e
call 0xd086a9d5
xor eax, eax
test eax, eax
je 0x1000e9a7
jne 0x1000e9a6
call 0x9304da2e
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
mov al, 0x74
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1000e9b5
jmp 0x1000e9b7
je 0x1000e9b2
clc
jae 0x1000e9bc
xor byte [eax + 0x1750374], 0xb0
je 0x1000e9c1
jne 0x1000e9c1
mov al, 0x66
pushfd
pushf
push 0xa
jae 0x1000e9ce
jmp 0x1000e9c9
call 0x1000e9d0
jae 0x1000e9c9
add esp, 4
jmp 0x1000e9d5
dec dword [esp]
jno 0x1000e9da
jns 0x1000e9c5
jp 0x1000e9de
add esp, 4
popf
jmp 0x1000e9e5
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e9fe
jne 0x1000e9fe
call 0x1fc11d52
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x1000e6b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000ea32
call fcn.10013240
clc
jae 0x1000ea37
clc
pop eax
pushf
push 0xa
jae 0x1000ea44
jmp 0x1000ea3f
call 0x1000ea46
jae 0x1000ea3f
add esp, 4
jmp 0x1000ea4b
dec dword [esp]
jno 0x1000ea50
jns 0x1000ea3b
jp 0x1000ea54
add esp, 4
popf
jmp 0x1000ea5b
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000ea74
jne 0x1000ea74
pop eax
jl 0x1000ea79
jmp 0x1000ea7b
je 0x1000ea76
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000ea95
jne 0x1000ea94
call 0x9304db1c
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000eaa3
jne 0x1000eaa3
call 0x6ffd3032
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e9d0
Capabilities:
Create thread

Disassembly:
jae 0x1000e8c9
jmp 0x1000e8c4
call fcn.1000e8cb
jae 0x1000e8c4
add esp, 4
jmp 0x1000e8d0
dec dword [esp]
jno 0x1000e8d5
jns 0x1000e8c0
jp 0x1000e8d9
add esp, 4
popf
jmp 0x1000e8e0
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e8f9
jne 0x1000e8f9
call 0x1fc11c4d
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x1000e7a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000e92d
call fcn.10013240
clc
jae 0x1000e932
stosd dword es:[edi], eax
dec ebp
pushf
push 0xa
jae 0x1000e93f
jmp 0x1000e93a
call 0x1000e941
jae 0x1000e93a
add esp, 4
jmp 0x1000e946
dec dword [esp]
jno 0x1000e94b
jns 0x1000e936
jp 0x1000e94f
add esp, 4
popf
jmp 0x1000e956
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e96f
jne 0x1000e96f
dec ebp
jl 0x1000e974
jmp 0x1000e976
je 0x1000e971
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000e990
jne 0x1000e98f
call 0x9304da17
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000e99e
jne 0x1000e99e
call 0xd086a9d5
xor eax, eax
test eax, eax
je 0x1000e9a7
jne 0x1000e9a6
call 0x9304da2e
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
mov al, 0x74
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1000e9b5
jmp 0x1000e9b7
je 0x1000e9b2
clc
jae 0x1000e9bc
xor byte [eax + 0x1750374], 0xb0
je 0x1000e9c1
jne 0x1000e9c1
mov al, 0x66
pushfd
pushf
push 0xa
jae 0x1000e9ce
jmp 0x1000e9c9
call 0x1000e9d0
jae 0x1000e9c9
add esp, 4
jmp 0x1000e9d5
dec dword [esp]
jno 0x1000e9da
jns 0x1000e9c5
jp 0x1000e9de
add esp, 4
popf
jmp 0x1000e9e5
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000e9fe
jne 0x1000e9fe
call 0x1fc11d52
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x1000e6b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x1000ea32
call fcn.10013240
clc
jae 0x1000ea37
clc
pop eax
pushf
push 0xa
jae 0x1000ea44
jmp 0x1000ea3f
call 0x1000ea46
jae 0x1000ea3f
add esp, 4
jmp 0x1000ea4b
dec dword [esp]
jno 0x1000ea50
jns 0x1000ea3b
jp 0x1000ea54
add esp, 4
popf
jmp 0x1000ea5b
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000ea74
jne 0x1000ea74
pop eax
jl 0x1000ea79
jmp 0x1000ea7b
je 0x1000ea76
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000ea95
jne 0x1000ea94
call 0x9304db1c
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000eaa3
jne 0x1000eaa3
call 0x6ffd3032
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000f310
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x1a
mov dword [ebp - 4], 0
jmp 0x1000f332
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x12
jge 0x1000f371
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x7d1d0edb]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000f36c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000f329
mov eax, 1
imul ecx, eax, 0x12
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000f390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x25
mov dword [ebp - 4], 0
jmp 0x1000f3b2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x1000f3f1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x464dc7f0]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000f3ec
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000f3a9
mov eax, 1
shl eax, 3
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000f410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x34
mov dword [ebp - 4], 0
jmp 0x1000f432
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc
jge 0x1000f471
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x10bbf953]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000f46c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000f429
mov eax, 1
imul ecx, eax, 0xc
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1000f490
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x39
mov dword [ebp - 4], 0
jmp 0x1000f4b2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x10
jge 0x1000f4f1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x1bda9b36]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000f4ec
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000f4a9
mov eax, 1
shl eax, 4
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000f510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x3d
mov dword [ebp - 4], 0
jmp 0x1000f532
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe
jge 0x1000f571
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x59721512]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000f56c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000f529
mov eax, 1
imul ecx, eax, 0xe
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000f590
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x41
mov dword [ebp - 4], 0
jmp 0x1000f5b2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe
jge 0x1000f5f1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x4f2c80b4]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000f5ec
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000f5a9
mov eax, 1
imul ecx, eax, 0xe
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1000f610
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x46
mov dword [ebp - 4], 0
jmp 0x1000f632
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xd
jge 0x1000f671
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x2b93394b]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000f66c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000f629
mov eax, 1
imul ecx, eax, 0xd
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000f690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x56
mov dword [ebp - 4], 0
jmp 0x1000f6b2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 7
jge 0x1000f6f1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x4dc046fe]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000f6ec
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000f6a9
mov eax, 1
imul ecx, eax, 7
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000f710
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x64
mov dword [ebp - 4], 0
jmp 0x1000f732
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x12
jge 0x1000f771
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x25ec44e5]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000f76c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000f729
mov eax, 1
imul ecx, eax, 0x12
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1000f790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x6b
mov dword [ebp - 4], 0
jmp 0x1000f7b2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x28
jge 0x1000f7f1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x60d6ced3]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000f7ec
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000f7a9
mov eax, 1
imul ecx, eax, 0x28
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000f810
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x6c
mov dword [ebp - 4], 0
jmp 0x1000f832
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x14
jge 0x1000f871
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x1efe0e6c]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000f86c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000f829
mov eax, 1
imul ecx, eax, 0x14
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000f890
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x74
mov dword [ebp - 4], 0
jmp 0x1000f8b2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x12
jge 0x1000f8f1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x61129fa5]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000f8ec
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000f8a9
mov eax, 1
imul ecx, eax, 0x12
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1000f910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x78
mov dword [ebp - 4], 0
jmp 0x1000f932
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 6
jge 0x1000f971
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x3a6f7719]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000f96c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000f929
mov eax, 1
imul ecx, eax, 6
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000f990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x90
mov dword [ebp - 4], 0
jmp 0x1000f9b2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc
jge 0x1000f9f1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x192d1952]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000f9ec
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000f9a9
mov eax, 1
imul ecx, eax, 0xc
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000fa10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x97
mov dword [ebp - 4], 0
jmp 0x1000fa32
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 9
jge 0x1000fa71
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x4f835340]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000fa6c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000fa29
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1000fa90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xa2
mov dword [ebp - 4], 0
jmp 0x1000fab2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x10
jge 0x1000faf1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x19a68456]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000faec
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000faa9
mov eax, 1
shl eax, 4
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000fb10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xb4
mov dword [ebp - 4], 0
jmp 0x1000fb32
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xd
jge 0x1000fb71
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x37d3da54]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000fb6c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000fb29
mov eax, 1
imul ecx, eax, 0xd
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000fb90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xb6
mov dword [ebp - 4], 0
jmp 0x1000fbb2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xd
jge 0x1000fbf1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x5d425b0f]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000fbec
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000fba9
mov eax, 1
imul ecx, eax, 0xd
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1000fc10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xbd
mov dword [ebp - 4], 0
jmp 0x1000fc32
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x10
jge 0x1000fc71
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x1e98ecf8]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000fc6c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000fc29
mov eax, 1
shl eax, 4
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000fc90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xc
mov dword [ebp - 4], 0
jmp 0x1000fcb2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x16
jge 0x1000fcf1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x54270ca5]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000fcec
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000fca9
mov eax, 1
imul ecx, eax, 0x16
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000fd10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xc9
mov dword [ebp - 4], 0
jmp 0x1000fd32
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe
jge 0x1000fd71
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x5eac05c6]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000fd6c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000fd29
mov eax, 1
imul ecx, eax, 0xe
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4