joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x4caf6c3e
nop
nop
nop
nop
test eax, eax
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x731a703f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x73a61e4c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x73a63018]
jne 0x73a61e55
ret
nop
nop
nop
nop
nop
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x73a63018]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x73a6307c]
test eax, eax
je 0x73a61e7e
call eax
cmp dword [0x73a63080], 0
je 0x73a61ec5
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x73a63080]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.73a61e4c
add ebp, 0x2a8
leave
ret
Function at 0x73051c9d
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x73051cb4
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
je 0x73051cb6
xor eax, eax
ret

Function at 0x73052295
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
push esi
push edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
push eax
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
pop eax
mov eax, dword [ebp - 4]
mov edi, dword [eax + 0xc]
add edi, 0xc
mov dword [ebp - 0xc], edi
mov esi, dword [edi]
cmp esi, edi

Function at 0x730524fe
Capabilities:
Authenticate hmac

Disassembly:
push esi
mov esi, ecx
push esi
call fcn.7305224e
pop ecx
test eax, eax
je 0x7305251f
lea ecx, [esi + eax*2]
mov edx, ecx
dec eax
sub ecx, 2
cmp word [ecx], 0x5c
je 0x73052524
test eax, eax
jne 0x7305250f
or eax, 0xffffffff
pop esi
ret
mov ecx, edx
pop esi
jmp fcn.73051d41

Function at 0x73052861
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, ecx
mov byte [ebp + 0xb], cl
shr eax, 0x18
mov byte [ebp + 8], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp + 9], al
mov eax, ecx
push edi
mov edi, edx
shr eax, 8
xor ecx, ecx
mov byte [ebp + 0xa], al
mov edx, ecx
test edi, edi
je 0x730528a8
mov al, byte [ebp + ecx + 8]
xor byte [edx + esi], al
lea eax, [ecx + 1]
sub ecx, 3
inc edx
neg ecx
sbb ecx, ecx
and ecx, eax
cmp edx, edi
jb 0x73052890
pop edi
pop esi
pop ebp
ret

Function at 0x730529b9
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push edi
movzx edi, word [ecx + 6]
xor esi, esi
test edi, edi
je 0x730529e5
movzx eax, word [ecx + 0x14]
add ecx, 0x18
add ecx, eax
cmp edx, dword [ecx + 0xc]
jb 0x730529dd
mov eax, dword [ecx + 0x10]
add eax, dword [ecx + 0xc]
cmp edx, eax
jbe 0x730529eb
inc esi
add ecx, 0x28
cmp esi, edi
jb 0x730529ce
or eax, 0xffffffff
pop edi
pop esi
ret
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
add eax, edx
jmp 0x730529e8
Function at 0x730545a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
jmp 0x730545d2
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
add edx, 0x28
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 6]
cmp dword [ebp - 8], ecx
jge 0x73054616
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x10]
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp + 0xc]
cmp ecx, dword [ebp - 0xc]
jb 0x73054614
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0x10]
ja 0x73054614
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
add eax, dword [ecx + 0x14]
jmp 0x73054619
jmp 0x730545c0
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x73056070
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
call fcn.73051c9d
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp - 8]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
jmp 0x730560a4
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
movzx eax, word [edx + 6]
cmp dword [ebp - 4], eax
jge 0x730560ef
imul ecx, dword [ebp - 4], 0x28
mov edx, dword [ebp - 0xc]
cmp dword [edx + ecx], 0x7865742e
jne 0x730560ed
imul eax, dword [ebp - 4], 0x28
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
imul ecx, dword [ebp - 4], 0x28
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov edx, dword [ebp - 0xc]
add eax, dword [edx + ecx + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov al, 1
jmp 0x730560f1
jmp 0x7305609b
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x730562c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
call fcn.73051c9d
mov dword [ebp - 0xc], eax
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebp - 0xc]
add ecx, dword [eax + edx + 0x78]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x20]
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x1c]
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x24]
mov dword [ebp - 0x14], edx
mov ecx, 1
test ecx, ecx
je 0x7305638b
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.73056050
add esp, 0xc
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + edx*2]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x1c]
mov edx, dword [ebp - 0x18]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.73056290
add esp, 8
mov dword [ebp - 8], eax
mov edx, dword [ebp + 8]
add edx, 0x3c
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.73056190
add esp, 0xc
movzx edx, al
test edx, edx
je 0x73056389
mov eax, dword [ebp - 8]
jmp 0x7305638d
jmp 0x73056319
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x7305a230
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
and eax, 0x20000000
je 0x7305a250
mov dword [ebp - 0x14], 1
jmp 0x7305a257
mov dword [ebp - 0x14], 0
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
and edx, 0x40000000
je 0x7305a271
mov dword [ebp - 0x18], 1
jmp 0x7305a278
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
and ecx, 0x80000000
je 0x7305a292
mov dword [ebp - 0x1c], 1
jmp 0x7305a299
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 8], 0
jne 0x7305a2bd
cmp dword [ebp - 0xc], 0
jne 0x7305a2bd
cmp dword [ebp - 0x10], 0
jne 0x7305a2bd
mov dword [ebp - 4], 1
jmp 0x7305a37e
cmp dword [ebp - 8], 0
jne 0x7305a2db
cmp dword [ebp - 0xc], 0
jne 0x7305a2db
cmp dword [ebp - 0x10], 0
je 0x7305a2db
mov dword [ebp - 4], 8
jmp 0x7305a37e
cmp dword [ebp - 8], 0
jne 0x7305a2f9
cmp dword [ebp - 0xc], 0
je 0x7305a2f9
cmp dword [ebp - 0x10], 0
jne 0x7305a2f9
mov dword [ebp - 4], 2
jmp 0x7305a37e
cmp dword [ebp - 8], 0
jne 0x7305a314
cmp dword [ebp - 0xc], 0
je 0x7305a314
cmp dword [ebp - 0x10], 0
je 0x7305a314
mov dword [ebp - 4], 4
jmp 0x7305a37e
cmp dword [ebp - 8], 0
je 0x7305a32f
cmp dword [ebp - 0xc], 0
jne 0x7305a32f
cmp dword [ebp - 0x10], 0
jne 0x7305a32f
mov dword [ebp - 4], 0x10
jmp 0x7305a37e
cmp dword [ebp - 8], 0
je 0x7305a34a
cmp dword [ebp - 0xc], 0
jne 0x7305a34a
cmp dword [ebp - 0x10], 0
je 0x7305a34a
mov dword [ebp - 4], 0x80
jmp 0x7305a37e
cmp dword [ebp - 8], 0
je 0x7305a365
cmp dword [ebp - 0xc], 0
je 0x7305a365
cmp dword [ebp - 0x10], 0
jne 0x7305a365
mov dword [ebp - 4], 0x20
jmp 0x7305a37e
cmp dword [ebp - 8], 0
je 0x7305a37e
cmp dword [ebp - 0xc], 0
je 0x7305a37e
cmp dword [ebp - 0x10], 0
je 0x7305a37e
mov dword [ebp - 4], 0x40
mov eax, dword [ebp + 8]
and eax, 0x4000000
je 0x7305a394
mov ecx, dword [ebp - 4]
or ecx, 0x200
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x7305e2a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
call fcn.73051c9d
mov dword [ebp - 4], eax
push 4
push 0x1000
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x50]
push edx
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x80]
call ecx
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x6c], 0
jne 0x7305e2e6
xor al, al
jmp 0x7305e3b0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x54]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x6c]
push eax
call fcn.73052211
add esp, 0xc
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + 6]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp - 4]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0
jmp 0x7305e339
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
add edx, 0x28
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jae 0x7305e386
mov dword [ebp - 0xc], 0
jmp 0x7305e353
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x10]
jae 0x7305e384
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20]
mov eax, dword [ebp - 8]
add edx, dword [eax + 0x14]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x6c]
mov ecx, dword [ebp - 8]
add eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0xc]
mov dl, byte [edx + esi]
mov byte [eax + ecx], dl
jmp 0x7305e34a
jmp 0x7305e327
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x34]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x6c]
push edx
call fcn.7305a3a0
add esp, 0xc
movzx eax, al
test eax, eax
jne 0x7305e3ae
xor al, al
jmp 0x7305e3b0
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x7305e2e8
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
call fcn.73051c9d
mov dword [ebp - 4], eax
push 4
push 0x1000
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x50]
push edx
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x80]
call ecx
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x6c], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x6c], 0
jne 0x7305e2e6
xor al, al
jmp 0x7305e3b0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x54]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x6c]
push eax
call fcn.73052211
add esp, 0xc
mov ecx, dword [ebp - 4]
movzx edx, word [ecx + 6]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp - 4]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0
jmp 0x7305e339
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 8]
add edx, 0x28
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jae 0x7305e386
mov dword [ebp - 0xc], 0
jmp 0x7305e353
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x10]
jae 0x7305e384
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20]
mov eax, dword [ebp - 8]
add edx, dword [eax + 0x14]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x6c]
mov ecx, dword [ebp - 8]
add eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0xc]
mov dl, byte [edx + esi]
mov byte [eax + ecx], dl
jmp 0x7305e34a
jmp 0x7305e327
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x34]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x6c]
push edx
call fcn.7305a3a0
add esp, 0xc
movzx eax, al
test eax, eax
jne 0x7305e3ae
xor al, al
jmp 0x7305e3b0
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x7305eb00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, edx
push esi
mov esi, ecx
mov ecx, dword [ebx + 0xcb8]
mov eax, dword [ebx + 0xcb0]
mov dword [esi + 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x28], eax
mov dword [esi + 0x24], ecx
test cl, 3
je 0x7305eb39
nop word [eax + eax]
inc ecx
test cl, 3
jne 0x7305eb30
mov dword [esi + 0x24], ecx
mov eax, dword [esi + 0xc]
push ecx
call eax
add esp, 4
mov dword [esi + 0x20], eax
test eax, eax
jne 0x7305eb55
or dword [esi + 0x38], 2
xor al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x1c]
push dword [esi + 0x18]
push eax
call fcn.73052211
xor edx, edx
add esp, 0xc
cmp dword [esi + 0x24], edx
jbe 0x7305eb81
nop dword [eax + eax]
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x28]
xor dword [ecx + edx], eax
add edx, 4
cmp edx, dword [esi + 0x24]
jb 0x7305eb70
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jne 0x7305eb90
xor edx, edx
jmp 0x7305eba0
cmp eax, 1
jne 0x7305eb99
mov edx, eax
jmp 0x7305eba0
cmp eax, 2
jne 0x7305ebc4
mov edx, eax
lea eax, [esi + 0x30]
mov dword [edi], esi
push eax
mov ecx, ebx
call fcn.7305ea80
add esp, 4
mov dword [esi + 0x2c], eax
test eax, eax
jne 0x7305ebc4
or dword [esi + 0x38], 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
mov ebx, dword [esi + 0x1c]
add ebx, dword [esi + 0x18]
mov dword [ebp - 4], eax
lea eax, [esi + 0x40]
push eax
mov eax, dword [esi]
push 0x40
push ecx
push ebx
mov dword [ebp + 0x10], ecx
call eax
test eax, eax
jne 0x7305ebee
or dword [esi + 0x38], 1
xor bl, bl
jmp 0x7305ec08
push dword [ebp + 0x10]
mov dword [esi + 0x2c], ebx
push dword [ebp - 4]
push ebx
call fcn.73052211
mov eax, dword [esi + 0x2c]
push edi
call eax
add esp, 0x10
mov bl, al
test byte [esi + 0x34], 1
jne 0x7305ec22
xor ecx, ecx
cmp dword [esi + 0x30], ecx
jbe 0x7305ec22
mov eax, dword [esi + 0x2c]
mov byte [ecx + eax], 0
inc ecx
cmp ecx, dword [esi + 0x30]
jb 0x7305ec15
mov eax, dword [esi + 0x20]
test eax, eax
je 0x7305ec32
push eax
mov eax, dword [esi + 0x14]
call eax
add esp, 4
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7318a7cd
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
movzx ecx, word [edi]
xor esi, esi
xor eax, eax
xor edx, edx
xor ebx, ebx
cmp si, cx
je 0x7318a807
movzx esi, cx
mov ecx, edx
shl ecx, 3
movzx esi, si
shl esi, cl
xor ecx, ecx
xor eax, esi
inc ebx
movzx esi, word [edi + ebx*2]
inc edx
and edx, 3
cmp cx, si
jne 0x7318a7eb
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x7318f09b
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
push edi
mov edi, dword [ebp + 0x10]
test eax, eax
jle 0x7318f0dc
push ebx
movzx edx, byte [ecx]
dec eax
inc ecx
movzx ebx, byte [ecx]
shl ebx, 8
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
test eax, eax
jg 0x7318f0b5
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x7318f0fa
dec esi
je 0x7318f0f1
dec esi
jne 0x7318f0ff
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
movzx edx, byte [ecx]
shl edx, 8
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x73190641
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
and dword [ebx + 0x28], 0
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 4], eax
xor eax, eax
cmp byte [ebp + 0x24], 0
mov word [ebx + 0xc], ax
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x24], ecx
mov esi, 0x8000
jne 0x73190691
push esi
push eax
add eax, esi
push eax
call fcn.7318c10e
add esp, 0xc
xor eax, eax
and dword [ebx + 0x30], eax
mov word [ebx + 0x2c], ax
call fcn.73190078
and dword [ebx + 0x20], 0
mov eax, esi
push 2
mov word [ebx + 0x3c], ax
mov eax, dword [ebx + 0x14]
pop ecx
mov dword [ebx + 0x34], esi
add eax, esi
push edi
movzx edi, byte [eax]
mov edx, dword [ebx + 0x20]
shl edx, 5
xor edx, edi
and edx, 0x7fff
inc eax
dec ecx
mov dword [ebx + 0x20], edx
jne 0x731906b5
cmp byte [ebp + 0x24], cl
je 0x731906db
mov edi, ebx
call fcn.7318feb9
jmp 0x731906ed
xor eax, eax
mov ecx, esi
mov edx, dword [ebx + 0x18]
xor edi, edi
mov word [eax + edx], di
inc eax
inc eax
dec ecx
jne 0x731906df
push 8
pop edi
push 0x43
pop edx
mov eax, ebx
call fcn.7318f279
push 0x4b
pop edx
call fcn.7318f279
call fcn.731903be
mov ecx, dword [ebp + 0x28]
inc eax
inc eax
cmp byte [ebp + 0x24], 0
movzx eax, ax
mov dword [ecx], eax
pop edi
je 0x7319072c
mov eax, dword [ebx + 0x14]
push esi
lea ecx, [eax + 0x8000]
push ecx
push eax
call fcn.7318c10e
add esp, 0xc
mov eax, dword [ebx + 0x28]
neg eax
sbb eax, eax
pop esi
and eax, 3
pop ebx
pop ebp
ret 0x24
Function at 0x73192c68
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc9c
mov eax, dword [0x7319cd14]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc88], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 0xc8c], eax
mov eax, dword [esi + 0x870]
add eax, 0x20
mov ecx, eax
shl ecx, 3
mov dword [ebp - 0xc9c], ecx
cmp ecx, 0x320
jb 0x73192cb5
xor eax, eax
jmp 0x73192e97
push ebx
push edi
mov edi, eax
shl edi, 4
push edi
lea eax, [ebp - 0xc84]
push 0
push eax
call fcn.7318c124
push edi
lea eax, [ebp - 0x644]
push 0
push eax
call fcn.7318c124
mov ecx, dword [ebp + 0x18]
add esp, 0x18
test ecx, ecx
jbe 0x73192e14
mov eax, dword [ebp + 0x14]
mov ebx, dword [esi + 0x34]
mov edi, dword [esi + 0x30]
shl eax, 2
mov dword [ebp - 0xc90], eax
mov eax, dword [ebp + 0x10]
shl eax, 2
mov dword [ebp - 0xc94], eax
mov dword [ebp - 0xc98], ecx
jmp 0x73192d14
mov eax, dword [ebp - 0xc94]
mov ecx, dword [ebp - 0xc88]
and ecx, 7
xor edx, edx
inc edx
shl edx, cl
mov ecx, dword [ebp - 0xc88]
shr ecx, 3
mov cl, byte [ecx + ebx]
test cl, dl
jne 0x73192d3e
mov eax, dword [ebp - 0xc88]
movzx eax, byte [edi + eax]
jmp 0x73192d82
mov ecx, dword [ebp - 0xc88]
cmp byte [edi + ecx], 7
mov ecx, dword [esi + 0x2c]
push dword [ecx + eax]
push esi
jae 0x73192d6c
call fcn.73190ec9
mov ecx, dword [ebp - 0xc88]
movzx ecx, byte [edi + ecx]
movzx eax, al
lea eax, [ecx + eax*8 + 0x100]
jmp 0x73192d7b
call fcn.73190ec9
movzx eax, al
lea eax, [eax*8 + 0x107]
add dword [ebp - 0xc94], 4
inc dword [ebp - 0xc88]
lea eax, [ebp + eax*2 - 0xc84]
inc word [eax]
mov eax, dword [ebp - 0xc8c]
xor edx, edx
mov ecx, eax
and ecx, 7
inc edx
shl edx, cl
mov ecx, eax
shr ecx, 3
mov cl, byte [ecx + ebx]
test cl, dl
jne 0x73192db4
movzx eax, byte [edi + eax]
jmp 0x73192df8
cmp byte [edi + eax], 7
mov ecx, dword [ebp - 0xc90]
mov eax, dword [esi + 0x2c]
push dword [ecx + eax]
push esi
jae 0x73192de2
call fcn.73190ec9
mov ecx, dword [ebp - 0xc8c]
movzx ecx, byte [edi + ecx]
movzx eax, al
lea eax, [ecx + eax*8 + 0x100]
jmp 0x73192df1
call fcn.73190ec9
movzx eax, al
lea eax, [eax*8 + 0x107]
add dword [ebp - 0xc90], 4
inc dword [ebp - 0xc8c]
lea eax, [ebp + eax*2 - 0x644]
inc word [eax]
dec dword [ebp - 0xc98]
jne 0x73192d0e
xor esi, esi
xor ebx, ebx
cmp dword [ebp - 0xc9c], esi
jbe 0x73192e93
mov edi, 0x100
movzx eax, word [ebp + esi*2 - 0xc84]
mov ecx, edi
cmp ax, cx
movzx eax, ax
jae 0x73192e40
movzx eax, byte [eax + 0x731924f0]
jmp 0x73192e4d
shr eax, 8
movzx eax, byte [eax + 0x731924f0]
add eax, 8
movzx ecx, word [ebp + esi*2 - 0x644]
mov edx, edi
cmp cx, dx
movzx ecx, cx
jae 0x73192e68
movzx ecx, byte [ecx + 0x731924f0]
jmp 0x73192e75
shr ecx, 8
movzx ecx, byte [ecx + 0x731924f0]
add ecx, 8
mov eax, dword [eax*4 + 0x731924a8]
sub eax, dword [ecx*4 + 0x731924a8]
cdq
xor eax, edx
sub eax, edx
add ebx, eax
inc esi
cmp esi, dword [ebp - 0xc9c]
jb 0x73192e25
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.7305227d
leave
ret 0x14
Function at 0x10418058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x104181a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1041807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1041806a
add dl, dl
jne 0x10418089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104180dc
xor eax, eax
add dl, dl
jne 0x10418096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1041817d
add dl, dl
jne 0x104180a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104180b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104180bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104180c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104180d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10418075
mov eax, 1
add dl, dl
jne 0x104180ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104180f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104180e1
sub eax, ebx
mov ebx, 1
jne 0x10418128
mov ecx, 1
add dl, dl
jne 0x1041810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10418119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10418105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10418075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1041813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1041814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10418136
cmp eax, 0x7d00
jae 0x1041816d
cmp eax, 0x500
jb 0x10418168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10418075
cmp eax, 0x7f
ja 0x10418170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10418075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1041819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10418075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10