joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440d30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 8], 0x2a252427
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edi + 8]
mov dword [esp + 4], eax
mov ecx, edi
and ecx, 0xb
xor ecx, 0x2828347b
mov ebx, edi
and ebx, 4
sub ebx, ecx
mov ecx, eax
not ecx
lea esi, [eax + ecx*2]
mov edx, 0xfffffffe
sub edx, esi
mov ecx, 0xfe
sub ecx, esi
and ecx, eax
or ecx, edx
lea esi, [ecx + ecx]
not esi
add esi, ecx
mov ecx, ebx
not ecx
mov dword [esp], ecx
mov edx, ebx
and edx, 0xd7d7cb9d
and ecx, 2
imul ecx, edx
mov edx, ebx
and edx, 2
mov eax, ebx
or eax, 2
imul eax, edx
lea edx, [eax + ecx]
add eax, ecx
inc eax
xor eax, ebx
xor edx, 0x17d7cb9e
and edx, ebx
add edx, edx
sub edx, eax
and edx, dword [esp]
or edx, esi
or ebx, dword [esp + 4]
and ebx, edx
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x18]
add al, 0x5d
mov byte [esp + edi + 8], al
inc edi
cmp edi, 0xc
jne 0x440d60
mov eax, dword [esp + 8]
mov ecx, dword [0x44d628]
test ecx, ecx
je 0x440e51
xor edx, edx
mov esi, dword [0x44d62c]
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x47a01aa3
je 0x440e20
inc edx
cmp ecx, edx
jne 0x440e10
jmp 0x440e51
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x440e51
lea eax, [esp + 0x18]
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push 9
push dword [0x44d630]
push ecx
call fcn.0043dbc0
add esp, 0x30
cmp eax, 0x103
jne 0x440f68
mov dword [esp + 8], 0x2a252427
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 8]
mov dword [esp + 4], edx
mov esi, eax
and esi, 0xb
xor esi, 0x2828347b
mov ecx, eax
and ecx, 4
sub ecx, esi
mov esi, edx
not esi
lea esi, [edx + esi*2]
mov edi, 0xfffffffe
sub edi, esi
mov ebx, 0xfe
sub ebx, esi
and ebx, edx
or ebx, edi
lea esi, [ebx + ebx]
not esi
add esi, ebx
mov edi, ecx
not edi
mov dword [esp], edi
mov ebx, ecx
and ebx, 0xd7d7cb9d
and edi, 2
imul edi, ebx
mov ebx, ecx
and ebx, 2
mov edx, ecx
or edx, 2
imul edx, ebx
lea ebx, [edx + edi]
add edx, edi
inc edx
xor edx, ecx
xor ebx, 0x17d7cb9e
and ebx, ecx
add ebx, ebx
sub ebx, edx
and ebx, dword [esp]
or ebx, esi
or ecx, dword [esp + 4]
and ecx, ebx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
add cl, 0x5d
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 0xc
jne 0x440e80
mov eax, dword [esp + 8]
mov ecx, dword [0x44d628]
test ecx, ecx
je 0x440f60
xor edx, edx
mov esi, dword [0x44d62c]
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x39c83604
je 0x440f40
inc edx
cmp ecx, edx
jne 0x440f30
jmp 0x440f60
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x440f60
push 0
push 0
push dword [ebp + 8]
push 3
push dword [0x44d630]
push ecx
call fcn.0043dbc0
add esp, 0x18
test eax, eax
js 0x440f68
mov eax, dword [esp + 0x18]
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x440f7e
xor ecx, ecx
cmp eax, 0xc0000011
je 0x440f7c
mov ecx, dword [esp + 0x1c]
mov dword [edx], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440f90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp + 8], 0x2a252427
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [esp + edi + 8]
mov dword [esp + 4], eax
mov ecx, edi
and ecx, 0xb
xor ecx, 0x2828347b
mov ebx, edi
and ebx, 4
sub ebx, ecx
mov ecx, eax
not ecx
lea ecx, [eax + ecx*2]
mov edx, 0xfffffffe
sub edx, ecx
mov esi, 0xfe
sub esi, ecx
and esi, eax
or esi, edx
lea ecx, [esi + esi]
not ecx
add ecx, esi
mov edx, ebx
not edx
mov dword [esp], edx
mov esi, ebx
and esi, 0xd7d7cb9d
and edx, 2
imul edx, esi
mov esi, ebx
and esi, 2
mov eax, ebx
or eax, 2
imul eax, esi
lea esi, [eax + edx]
add eax, edx
inc eax
xor eax, ebx
xor esi, 0x17d7cb9e
and esi, ebx
add esi, esi
sub esi, eax
and esi, dword [esp]
or esi, ecx
or ebx, dword [esp + 4]
and ebx, esi
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x18]
add al, 0x5d
mov byte [esp + edi + 8], al
inc edi
cmp edi, 0xc
jne 0x440fc0
mov eax, dword [esp + 8]
mov ecx, dword [0x44d628]
test ecx, ecx
je 0x4410b1
xor edx, edx
mov esi, dword [0x44d62c]
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xa1e50e2a
je 0x441080
inc edx
cmp ecx, edx
jne 0x441070
jmp 0x4410b1
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x4410b1
lea eax, [esp + 0x18]
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push 0
push 0
push 0
push dword [ebp + 8]
push 9
push dword [0x44d630]
push ecx
call fcn.0043dbc0
add esp, 0x30
cmp eax, 0x103
jne 0x4411c8
mov dword [esp + 8], 0x2a252427
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax + 8]
mov dword [esp + 4], edx
mov esi, eax
and esi, 0xb
xor esi, 0x2828347b
mov ecx, eax
and ecx, 4
sub ecx, esi
mov esi, edx
not esi
lea esi, [edx + esi*2]
mov edi, 0xfffffffe
sub edi, esi
mov ebx, 0xfe
sub ebx, esi
and ebx, edx
or ebx, edi
lea edi, [ebx + ebx]
not edi
add edi, ebx
mov ebx, ecx
not ebx
mov dword [esp], ebx
mov esi, ecx
and esi, 0xd7d7cb9d
and ebx, 2
imul ebx, esi
mov esi, ecx
and esi, 2
mov edx, ecx
or edx, 2
imul edx, esi
lea esi, [edx + ebx]
add edx, ebx
inc edx
xor edx, ecx
xor esi, 0x17d7cb9e
and esi, ecx
add esi, esi
sub esi, edx
and esi, dword [esp]
or esi, edi
or ecx, dword [esp + 4]
and ecx, esi
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
add cl, 0x5d
mov byte [esp + eax + 8], cl
inc eax
cmp eax, 0xc
jne 0x4410e0
mov eax, dword [esp + 8]
mov ecx, dword [0x44d628]
test ecx, ecx
je 0x4411c0
xor edx, edx
mov esi, dword [0x44d62c]
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x39c83604
je 0x4411a0
inc edx
cmp ecx, edx
jne 0x441190
jmp 0x4411c0
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x4411c0
push 0
push 0
push dword [ebp + 8]
push 3
push dword [0x44d630]
push ecx
call fcn.0043dbc0
add esp, 0x18
test eax, eax
js 0x4411c8
mov eax, dword [esp + 0x18]
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x4411d5
mov ecx, dword [esp + 0x1c]
mov dword [edx], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4411e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edx], 0
lea edx, [edx + 2]
jne 0x441200
add edx, 0xfffffffe
and edx, 0xfffe
mov word [esp + 0xc], dx
add edx, 2
mov word [esp + 0xe], dx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x2c], 0x18
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], 0x40
lea eax, [esp + 0xc]
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x18], 0x2a252427
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + eax + 0x18]
mov dword [esp + 8], ebx
mov ecx, eax
and ecx, 0xb
xor ecx, 0x2828347b
mov edi, eax
and edi, 4
sub edi, ecx
mov ecx, ebx
not ecx
lea ecx, [ebx + ecx*2]
mov edx, 0xfffffffe
sub edx, ecx
mov esi, 0xfe
sub esi, ecx
and esi, ebx
or esi, edx
lea ecx, [esi + esi]
not ecx
add ecx, esi
mov edx, edi
not edx
mov dword [esp + 4], edx
mov esi, edi
and esi, 0xd7d7cb9d
and edx, 2
imul edx, esi
mov esi, edi
and esi, 2
mov ebx, edi
or ebx, 2
imul ebx, esi
lea esi, [ebx + edx]
add edx, ebx
inc edx
xor edx, edi
xor esi, 0x17d7cb9e
and esi, edi
add esi, esi
sub esi, edx
and esi, dword [esp + 4]
or esi, ecx
or edi, dword [esp + 8]
and edi, esi
mov dword [esp + 0x14], edi
mov ecx, dword [esp + 0x14]
add cl, 0x5d
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0xc
jne 0x441270
mov eax, dword [esp + 0x18]
mov ecx, dword [0x44d628]
test ecx, ecx
je 0x441357
xor edx, edx
mov esi, dword [0x44d62c]
nop
nop
nop
cmp dword [esi + edx*8], 0x55708665
je 0x441330
inc edx
cmp ecx, edx
jne 0x441320
jmp 0x441357
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x441357
lea eax, [esp + 0x2c]
push dword [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 4
push dword [0x44d630]
push ecx
call fcn.0043dbc0
add esp, 0x1c
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xaba2f60
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0xabc7008], 0x8088405
inc edx
mov dword [ebx + 0xabc7008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0xaba6fec
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
ret

Function at 0xaba70ac
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffcec
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebx, eax
xor eax, eax
mov edx, ebx
lea ecx, [edx]
cmp word [ecx], 0x5a4d
jne 0xaba726f
add edx, 0x3c
mov edx, dword [edx]
add edx, ebx
lea ecx, [edx]
cmp dword [ecx], 0x4550
jne 0xaba726f
lea eax, [edx + 0x18]
lea edx, [eax]
cmp word [edx], 0x20b
je 0xaba7107
lea edx, [eax + 0x60]
mov ecx, edx
mov ecx, dword [ecx]
mov dword [esp + 0xc], ecx
add edx, 4
mov eax, dword [edx]
mov dword [esp + 0x10], eax
jmp 0xaba711b
lea edx, [eax + 0x70]
mov ecx, edx
mov ecx, dword [ecx]
mov dword [esp + 0xc], ecx
add edx, 4
mov eax, dword [edx]
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0xc]
add ebp, ebx
xor edi, edi
xor esi, esi
lea eax, [ebp + 0x20]
mov eax, dword [eax]
add eax, ebx
mov edx, edi
add edx, edx
add edx, edx
add eax, edx
mov eax, dword [eax]
add eax, ebx
mov dword [esp + 8], eax
mov edx, dword [esp]
mov eax, dword [esp + 8]
call fcn.0aba6ff8
test al, al
je 0xaba724b
add edi, edi
lea eax, [ebp + 0x24]
add edi, dword [eax]
add edi, ebx
movzx eax, word [edi]
and ax, 0xffff
movzx eax, ax
add eax, eax
add eax, eax
add ebp, 0x1c
add eax, dword [ebp]
add eax, ebx
mov esi, dword [eax]
add esi, ebx
mov eax, dword [esp + 0xc]
add eax, ebx
cmp esi, eax
jbe 0xaba725b
mov eax, dword [esp + 0xc]
add eax, dword [esp + 0x10]
add ebx, eax
cmp esi, ebx
jae 0xaba725b
lea edx, [esp + 0x14]
mov eax, esi
call fcn.0aba6e9c
mov ebx, eax
xor esi, esi
mov eax, 0xaba7288
xor ecx, ecx
mov edx, ebx
call fcn.0aba6f20
mov ebp, eax
test ebp, ebp
je 0xaba725b
mov byte [ebx + ebp - 1], 0
lea eax, [esp + 0x114]
mov edx, pe_nt_image_headers32
call fcn.0aba6e94
lea edx, [esp + 0x114]
mov eax, ebx
call fcn.0aba6e9c
call fcn.0aba6e38
mov edi, eax
mov eax, edi
call fcn.0aba6e10
mov byte [edi + eax], 0x2e
mov byte [edi + eax + 1], 0x64
mov byte [edi + eax + 2], 0x6c
mov byte [edi + eax + 3], 0x6c
mov byte [edi + eax + 4], 0
lea eax, [esp + 0x214]
mov edx, pe_nt_image_headers32
call fcn.0aba6e94
lea eax, [ebx + ebp]
lea edx, [esp + 0x214]
call fcn.0aba6e9c
mov ebp, eax
push edi
call fcn.0aba7090
mov ebx, eax
test ebx, ebx
jne 0xaba723a
push edi
call fcn.0aba72a8
mov ebx, eax
test ebx, ebx
jbe 0xaba725b
mov edx, ebp
mov eax, ebx
call fcn.0aba728c
mov esi, eax
jmp 0xaba725b
inc edi
test esi, esi
jne 0xaba725b
lea eax, [ebp + 0x18]
cmp edi, dword [eax]
jne 0xaba7125
test esi, esi
jne 0xaba726d
lea eax, [esp + 0x14]
mov edx, pe_nt_image_headers32
call fcn.0aba6e94
mov eax, esi
mov edx, dword [esp + 4]
mov dword [edx], eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
add esp, 0x314
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xababfb4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov esi, edx
dec ecx
test ecx, ecx
jl 0xabac01d
inc ecx
inc byte [eax + 0x100]
movzx edx, byte [eax + 0x100]
movzx edx, byte [eax + edx]
add byte [eax + 0x101], dl
movzx edi, byte [eax + 0x100]
movzx edx, byte [eax + edi]
movzx ebx, byte [eax + 0x101]
movzx ebx, byte [eax + ebx]
push ebx
pop ebx
mov byte [eax + edi], bl
movzx ebx, byte [eax + 0x101]
mov byte [eax + ebx], dl
movzx edx, byte [eax + 0x100]
movzx edx, byte [eax + edx]
movzx ebx, byte [eax + 0x101]
add dl, byte [eax + ebx]
movzx edx, dl
movzx edx, byte [eax + edx]
xor byte [esi], dl
inc esi
dec ecx
jne 0xababfbf
pop edi
pop esi
pop ebx
ret

Function at 0xabac0c8
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp], eax
mov esi, 0xabc8188
mov byte [esp + 4], 4
mov edi, dword [esp]
add edi, 2
mov al, 4
mov edx, edi
mov ecx, edx
movzx ebx, byte [ecx]
movzx ebx, byte [esi + ebx]
mov byte [ecx], bl
inc edx
dec al
jne 0xabac0e5
add edi, 4
dec byte [esp + 4]
jne 0xabac0e1
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0xabac104
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp], eax
mov esi, 0xabc8288
mov byte [esp + 4], 4
mov edi, dword [esp]
add edi, 2
mov al, 4
mov edx, edi
mov ecx, edx
movzx ebx, byte [ecx]
movzx ebx, byte [esi + ebx]
mov byte [ecx], bl
inc edx
dec al
jne 0xabac121
add edi, 4
dec byte [esp + 4]
jne 0xabac11d
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0xabac248
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov byte [ebp - 9], 4
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 0x10], eax
mov bl, 4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 8]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
add eax, 4
dec bl
jne 0xabac269
xor ebx, ebx
lea esi, [ebp - 8]
mov eax, dword [ebp - 0x10]
mov edi, eax
movzx edx, byte [esi]
mov al, 2
call fcn.0abac210
push eax
movzx eax, bl
inc eax
and eax, 3
movzx edx, byte [ebp + eax - 8]
mov al, 3
call fcn.0abac210
pop edx
xor dl, al
movzx eax, bl
add eax, 2
and eax, 3
xor dl, byte [ebp + eax - 8]
movzx eax, bl
add eax, 3
and eax, 3
xor dl, byte [ebp + eax - 8]
mov byte [edi], dl
inc ebx
add edi, 4
inc esi
cmp bl, 4
jne 0xabac280
inc dword [ebp - 0x10]
dec byte [ebp - 9]
jne 0xabac261
lea eax, [ebp - 8]
mov edx, 4
call fcn.0abab260
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xabac2e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov byte [ebp - 9], 4
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 0x10], eax
mov bl, 4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 8]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
add eax, 4
dec bl
jne 0xabac305
xor ebx, ebx
lea esi, [ebp - 8]
mov eax, dword [ebp - 0x10]
mov edi, eax
movzx edx, byte [esi]
mov al, 0xe
call fcn.0abac210
push eax
movzx eax, bl
inc eax
and eax, 3
movzx edx, byte [ebp + eax - 8]
mov al, 0xb
call fcn.0abac210
pop edx
xor dl, al
push edx
movzx eax, bl
add eax, 2
and eax, 3
movzx edx, byte [ebp + eax - 8]
mov al, 0xd
call fcn.0abac210
pop edx
xor dl, al
push edx
movzx eax, bl
add eax, 3
and eax, 3
movzx edx, byte [ebp + eax - 8]
mov al, 9
call fcn.0abac210
pop edx
xor dl, al
mov byte [edi], dl
inc ebx
add edi, 4
inc esi
cmp bl, 4
jne 0xabac31c
inc dword [ebp - 0x10]
dec byte [ebp - 9]
jne 0xabac2fd
lea eax, [ebp - 8]
mov edx, 4
call fcn.0abab260
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xabac3b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 0x18], eax
movzx eax, byte [ebp - 0xd]
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [edx + eax*4]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov esi, eax
mov edi, esi
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0abac39c
xor byte [edi], al
inc ebx
add esi, 4
cmp bl, 4
jne 0xabac3e6
inc byte [ebp - 0xd]
inc dword [ebp - 0x18]
cmp byte [ebp - 0xd], 4
jne 0xabac3cf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xabac7b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
mov eax, ecx
dec eax
test eax, eax
jl 0xabac7c5
inc eax
movzx ecx, byte [edx]
xor byte [esi], cl
inc esi
inc edx
dec eax
jne 0xabac7bb
pop esi
ret

Function at 0xabac8d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xabac8e1
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.0aba2e38
cmp dword [ebp - 0xc], 0
jl 0xabac96c
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.0aba2e38
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
movzx eax, byte [ebp - 0x100c]
xor byte [esi], al
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.0aba2e38
movzx eax, byte [esi]
mov byte [ebp + ebx - 0x200d], al
dec dword [ebp - 0xc]
inc esi
cmp dword [ebp - 0xc], 0
jge 0xabac91a
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.0abab260
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0xabac984
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xabac98d
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.0aba2e38
cmp dword [ebp - 0xc], 0
jl 0xabaca1c
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.0aba2e38
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
movzx eax, byte [ebp - 0x100c]
xor byte [esi], al
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.0aba2e38
movzx eax, byte [ebp - 0x100c]
mov byte [ebp + ebx - 0x200d], al
dec dword [ebp - 0xc]
inc esi
cmp dword [ebp - 0xc], 0
jge 0xabac9c6
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.0abab260
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0xabad47c
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
lea ebx, [eax + 0x18]
movzx edx, word [eax + 0x14]
add ebx, edx
movzx edi, word [eax + 6]
dec edi
test edi, edi
jl 0xabad517
inc edi
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
add eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x10]
test edx, edx
jne 0xabad4e4
mov esi, dword [ebp - 0x10]
test esi, esi
jle 0xabad511
push 0x40
push 0x1000
push esi
push eax
call dword [0xabd4fe8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 8], eax
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.0aba6e94
jmp 0xabad511
mov esi, edx
push 0x40
push 0x1000
push esi
push eax
call dword [0xabd4fe8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebx + 0x14]
lea edx, [eax + edx]
mov ecx, esi
mov eax, dword [ebp - 0xc]
call fcn.0aba6e74
mov eax, dword [ebp - 0xc]
mov dword [ebx + 8], eax
add ebx, 0x28
dec edi
jne 0xabad4a9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xabad760
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor edi, edi
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ebx, eax
add ebx, 0xf8
movzx esi, word [eax + 6]
dec esi
test esi, esi
jl 0xabad855
inc esi
xor edx, edx
mov eax, dword [ebx + 0x24]
mov ecx, eax
and ecx, 0x20000000
cmp ecx, 0x20000000
jne 0xabad7a1
or edx, 0x10
mov ecx, eax
and ecx, 0x40000000
cmp ecx, 0x40000000
jne 0xabad7b4
or edx, 2
mov ecx, eax
and ecx, 0x80000000
cmp ecx, 0x80000000
jne 0xabad7c7
or edx, 8
mov ecx, eax
and ecx, 0x4000000
cmp ecx, 0x4000000
jne 0xabad7dd
or edx, 0x200
and eax, 0x2000000
cmp eax, 0x2000000
jne 0xabad800
push 0x4000
mov eax, dword [ebx + 0x10]
push eax
mov eax, dword [ebx + 8]
or eax, edi
push eax
call dword [0xabd4fec]
jmp 0xabad84e
mov eax, dword [ebx + 0x10]
test eax, eax
jne 0xabad835
mov ecx, dword [ebx + 0x24]
and ecx, 0x40
cmp ecx, 0x40
jne 0xabad81c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 0x20]
jmp 0xabad835
mov ecx, dword [ebx + 0x24]
and ecx, 0x80
cmp ecx, 0x80
jne 0xabad835
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
test eax, eax
jle 0xabad84b
lea ecx, [ebp - 8]
push ecx
push edx
push eax
mov eax, dword [ebx + 8]
or eax, edi
push eax
call dword [0xabd4ff0]
add ebx, 0x28
dec esi
jne 0xabad789
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0xabae000
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0xabd500c
mov eax, ebx
mov edx, 8
test al, 1
je 0xabae01c
shr eax, 1
xor eax, 0xedb88320
jmp 0xabae01e
shr eax, 1
dec edx
jne 0xabae00f
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0xabae008
mov byte [0xabc874c], 1
pop ebx
ret

Function at 0xabae038
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov edi, 0xabd500c
mov esi, eax
mov eax, ecx
cmp edx, 4
jbe 0xabae089
xor eax, dword [esi]
add esi, 4
movzx ecx, al
mov ecx, dword [edi + ecx*4]
shr eax, 8
xor ecx, eax
mov eax, ecx
movzx ecx, al
mov ecx, dword [edi + ecx*4]
shr eax, 8
xor ecx, eax
mov eax, ecx
movzx ecx, al
mov ecx, dword [edi + ecx*4]
shr eax, 8
xor ecx, eax
mov eax, ecx
movzx ecx, al
mov ecx, dword [edi + ecx*4]
shr eax, 8
xor ecx, eax
mov eax, ecx
sub edx, 4
cmp edx, 4
ja 0xabae048
test dl, dl
jbe 0xabae0a3
mov ecx, eax
xor cl, byte [esi]
movzx ecx, cl
mov ecx, dword [edi + ecx*4]
shr eax, 8
xor ecx, eax
mov eax, ecx
inc esi
dec dl
jne 0xabae08d
pop edi
pop esi
ret

Function at 0xabae0dc
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0aba6e10
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0
xor edx, edx
lea eax, [ebp - 0x116]
mov byte [eax], dl
inc edx
inc eax
cmp edx, 0x100
jne 0xabae10b
mov byte [ebp - 0xd], 0
xor esi, esi
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x116]
cmp esi, dword [ebp - 0x14]
jge 0xabae136
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + esi]
jmp 0xabae138
xor ecx, ecx
inc esi
cmp esi, dword [ebp - 0x14]
jl 0xabae140
xor esi, esi
add cl, byte [eax]
add byte [ebp - 0xd], cl
movzx ecx, byte [eax]
movzx ebx, byte [ebp - 0xd]
movzx ebx, byte [ebp + ebx - 0x116]
mov byte [eax], bl
movzx ebx, byte [ebp - 0xd]
mov byte [ebp + ebx - 0x116], cl
inc eax
dec edx
jne 0xabae128
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0xabae1ca
inc eax
xor edx, edx
inc byte [ebp - 0x16]
movzx ecx, byte [ebp - 0x16]
movzx ecx, byte [ebp + ecx - 0x116]
add byte [ebp - 0x15], cl
movzx ebx, byte [ebp - 0x15]
movzx ebx, byte [ebp + ebx - 0x116]
movzx esi, byte [ebp - 0x16]
mov byte [ebp + esi - 0x116], bl
movzx ebx, byte [ebp - 0x15]
mov byte [ebp + ebx - 0x116], cl
movzx ebx, byte [ebp - 0x16]
add cl, byte [ebp + ebx - 0x116]
mov ebx, dword [ebp - 8]
movzx ebx, byte [ebx + edx]
movzx ecx, cl
xor bl, byte [ebp + ecx - 0x116]
mov ecx, dword [ebp - 8]
mov byte [ecx + edx], bl
inc edx
dec eax
jne 0xabae170
pop esi
pop ebx
mov esp, ebp
pop ebp
ret