joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004b50a
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x1009b20b
call fcn.10094750
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x38]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov ax, word [edi + 0x30]
mov word [esi + 0x30], ax
mov al, byte [edi + 0x32]
mov byte [esi + 0x32], al
mov al, byte [edi + 0x33]
mov byte [esi + 0x33], al
mov al, byte [edi + 0x34]
mov byte [esi + 0x34], al
mov al, byte [edi + 0x35]
mov byte [esi + 0x35], al
mov al, byte [edi + 0x36]
mov byte [esi + 0x36], al
lea eax, [edi + 0x38]
push eax
call fcn.100022c0
and dword [ebp - 4], 0
lea eax, [edi + 0x44]
push eax
lea ecx, [esi + 0x44]
call fcn.10002a00
mov eax, dword [edi + 0x50]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x50], eax
mov eax, dword [edi + 0x54]
mov dword [esi + 0x54], eax
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1004e3f1
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x1009b62a
call fcn.10094750
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x18]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
lea eax, [edi + 0x18]
push eax
call fcn.100022c0
and dword [ebp - 4], 0
lea eax, [edi + 0x24]
push eax
lea ecx, [esi + 0x24]
call fcn.100022c0
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.100022c0
mov al, byte [edi + 0x3c]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x3c], al
mov al, byte [edi + 0x3d]
mov byte [esi + 0x3d], al
mov al, byte [edi + 0x3e]
mov byte [esi + 0x3e], al
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x100508ff
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, ecx
test esi, esi
mov ecx, edx
jbe 0x1005092e
push ebx
push edi
movzx edi, byte [ecx]
movzx edx, ax
shr edx, 8
xor edx, edi
xor ebx, ebx
mov bh, al
mov ax, word [edx*2 + 0x100b93a4]
xor ax, bx
inc ecx
dec esi
jne 0x1005090e
pop edi
pop ebx
pop esi
ret 4
Function at 0x10052345
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x1009b9fa
call fcn.10094750
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
mov ecx, dword [eax]
push edi
mov dword [ebx], ecx
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebx + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [ebx + 0x10], ecx
mov ecx, dword [eax + 0x14]
lea esi, [eax + 0x18]
lea edi, [ebx + 0x18]
mov dword [ebx + 0x14], ecx
mov dword [ebp - 0x10], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x24]
lea edi, [ebx + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov cl, byte [eax + 0x30]
add eax, 0x34
mov byte [ebx + 0x30], cl
lea ecx, [ebx + 0x34]
xor esi, esi
push eax
mov dword [ecx + 4], esi
mov dword [ecx + 8], esi
mov dword [ecx], 0x1009f5c4
call fcn.1004b5c5
mov dword [ebp - 4], esi
mov esi, dword [ebp + 8]
lea ecx, [ebx + 0x40]
lea eax, [esi + 0x40]
push eax
call fcn.1005242a
add esi, 0x54
lea ecx, [ebx + 0x54]
push esi
mov byte [ebp - 4], 1
call fcn.10052476
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10058230
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1009c2cc
call fcn.10094750
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
call fcn.10002a00
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebx + 0xc]
call fcn.10002a00
mov eax, dword [esi + 0x18]
push 5
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 8]
add esi, 0x1c
lea edi, [ebx + 0x1c]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x30]
pop edi
mov dword [ebx + 0x30], ecx
mov ecx, dword [eax + 0x34]
mov dword [ebx + 0x34], ecx
mov ecx, dword [eax + 0x38]
mov dword [ebx + 0x38], ecx
mov ecx, dword [eax + 0x3c]
mov dword [ebx + 0x3c], ecx
mov ecx, dword [eax + 0x40]
mov dword [ebx + 0x40], ecx
mov ecx, dword [eax + 0x44]
mov dword [ebx + 0x44], ecx
mov ecx, dword [eax + 0x48]
mov dword [ebx + 0x48], ecx
mov ecx, dword [eax + 0x4c]
mov dword [ebx + 0x4c], ecx
mov ecx, dword [eax + 0x50]
mov dword [ebx + 0x50], ecx
mov al, byte [eax + 0x54]
mov ecx, dword [ebp - 0xc]
mov byte [ebx + 0x54], al
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x10064bd6
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009d29c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x100a0744
mov dword [esi + 4], 0x100a1168
lea ecx, [esi + 0x10]
mov dword [esp + 8], esi
mov dword [esi + 8], edi
call fcn.10004a4b
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], edi
call fcn.10004a4b
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 1
call fcn.10004a4b
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 2
call fcn.10004a4b
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x4a0], edi
mov dword [esi + 0x4a4], edi
mov dword [esi + 0x4b4], edi
mov eax, 0x100000
mov dword [esi + 0x4c0], edi
mov dword [esi + 0x4c8], eax
mov dword [esi + 0x4cc], eax
mov dword [esi + 0x4d0], eax
mov dword [esi + 0x4d4], eax
mov dword [esi + 0x4d8], 0x10000
mov dword [esi], 0x100a1158
mov dword [esi + 4], 0x100a1144
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x10065ec6
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009d3db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x1009f5e8
mov dword [esi + 4], 0x100a131c
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esp + 8], esi
mov dword [esi + 0x30], edi
lea ecx, [esi + 0x140]
mov dword [esp + 0x14], edi
call fcn.10004a4b
mov dword [esi + 0x6fe4], edi
lea ecx, [esi + 0x6ff8]
mov dword [esi + 0x6ff4], edi
call fcn.10090fe0
mov ecx, dword [esp + 0xc]
mov eax, 1
mov dword [esi + 0x7020], edi
mov dword [esi + 0x6fec], edi
mov dword [esi + 0x6ff0], edi
mov dword [esi + 0x7010], eax
mov byte [esi + 0x6fe0], al
mov dword [esi], 0x100a1304
mov dword [esi + 4], 0x100a12f4
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x10068cc0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x31
call fcn.10068380
push 0x41
mov ecx, esi
call fcn.10068380
push 0x59
mov ecx, esi
call fcn.10068380
push 0x26
mov ecx, esi
call fcn.10068380
push 0x53
mov ecx, esi
call fcn.10068380
push 0x59
mov ecx, esi
call fcn.10068380
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
xor edi, edi
xor ebp, ebp
mov bl, byte [ecx]
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x1c]
cmp edi, 4
mov cl, byte [edx + ebp]
mov byte [esp + 0x14], cl
jne 0x10068d50
test cl, cl
jbe 0x10068d4c
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
and edx, 0xff
and ecx, 0xff
mov edi, eax
shr edi, 0x18
xor edi, edx
shl eax, 8
mov edi, dword [edi*4 + 0x100b96ac]
xor eax, edi
dec ecx
jne 0x10068d36
xor edi, edi
jmp 0x10068d7f
cmp bl, cl
jne 0x10068d57
inc edi
jmp 0x10068d62
mov bl, cl
mov edi, 1
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x18
and edx, 0xff
xor ecx, edx
shl eax, 8
mov ecx, dword [ecx*4 + 0x100b96ac]
xor eax, ecx
mov ecx, dword [esp + 0x20]
inc ebp
cmp ebp, ecx
jb 0x10068d0e
not eax
mov edi, eax
mov ecx, esi
push edi
call fcn.100683c0
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.100684c0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x10068f90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x14]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x8ce0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 8
mov byte [esp + 0x1c], bl
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x8cd4], ebx
mov eax, dword [edx + 0x170]
mov edx, dword [esi]
push edi
push eax
push ecx
push edx
mov ecx, esi
call fcn.10068dc0
mov ecx, dword [esi + 0x8ce0]
cmp byte [ecx + 0x19c], bl
je 0x1006900c
mov eax, dword [esi + 0x8cd8]
lea edx, [eax + eax*8]
shl edx, 3
sub edx, eax
mov eax, dword [ecx + 0x178]
shl edx, 9
mov ecx, dword [edx + eax + 0x8cf0]
call fcn.10090e40
mov eax, dword [esi + 0x8cd4]
xor edx, edx
cmp eax, ebx
jbe 0x10069049
lea edi, [esi + 0x7cd4]
mov eax, dword [esi + 0x8ce0]
add edi, 4
add eax, 0x174
mov ecx, dword [eax]
mov ebp, ecx
add ecx, ecx
shr ebp, 0x1f
or ebp, ecx
mov ecx, dword [edi - 4]
xor ebp, ecx
inc edx
mov dword [eax], ebp
mov eax, dword [esi + 0x8cd4]
cmp edx, eax
jb 0x1006901e
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push edx
mov edx, dword [esi + 8]
lea ecx, [eax*8 + 8]
mov eax, dword [esp + 0x20]
sub ecx, eax
push ecx
mov ecx, dword [esi + 0x8ce0]
push edx
call fcn.10069120
mov eax, dword [esi + 0x8ce0]
cmp byte [eax + 0x19c], bl
je 0x10069107
mov edi, dword [esi + 0x8cd8]
mov ecx, dword [eax + 0x198]
inc edi
cmp edi, ecx
jne 0x10069094
xor edi, edi
cmp dword [eax + 0x1b0], ebx
je 0x100690e4
lea ebx, [eax + 0x140]
mov ecx, ebx
call fcn.100065b9
mov ebp, dword [ebx + 0x28]
mov ecx, 0xf
sub ecx, ebp
xor ebx, ebx
shr ecx, 3
add eax, ecx
adc edx, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x8ce0]
mov eax, dword [edx + 0x1b0]
lea edx, [esp + 0x10]
push edx
lea edx, [esi + 0x8cf8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x8ce0]
lea ecx, [edi + edi*8]
shl ecx, 3
mov edx, dword [eax + 0x178]
sub ecx, edi
shl ecx, 9
lea ecx, [edx + ecx + 0x8cf0]
call fcn.10090e90
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x10074910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, dword [esp + 0x18]
xor edx, edx
mov ecx, dword [esi + 4]
mov ebx, dword [esi]
mov eax, ecx
push edi
imul eax, dword [esp + 0x18]
div ebp
xor edx, edx
lea edi, [eax + ebx - 1]
mov eax, ecx
imul eax, dword [esp + 0x14]
div ebp
mov ecx, dword [esi + 8]
mov ebp, 0x10000
sub ecx, eax
add ebx, eax
mov dword [esi + 8], ecx
mov dword [esi], ebx
mov eax, dword [esi]
mov ecx, eax
xor ecx, edi
test ch, 0x80
je 0x10074973
test ah, 0x40
je 0x100749e0
test edi, 0x4000
jne 0x100749e0
and eax, 0x3fff
or edi, 0x4000
mov dword [esi], eax
mov edx, dword [esi]
and edi, 0x7fff
and edx, 0x7fff
shl edx, 1
mov dword [esi], edx
mov eax, dword [esi + 0x10]
shl edi, 1
or edi, 1
cmp eax, ebp
jb 0x100749c1
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
lea ecx, [esi + 0x18]
cmp eax, edx
jb 0x100749a9
call fcn.10004b39
mov byte [esp + 0x18], al
jmp 0x100749b2
mov dl, byte [eax]
inc eax
mov byte [esp + 0x18], dl
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
and eax, 0xff
or ah, 1
mov dword [esi + 0x10], eax
mov ecx, dword [esi + 0x10]
mov eax, ecx
add ecx, ecx
mov dword [esi + 0x10], ecx
mov edx, dword [esi + 8]
shr eax, 7
and eax, 1
shl edx, 1
or edx, eax
mov dword [esi + 8], edx
jmp 0x1007494a
sub edi, dword [esi]
inc edi
mov dword [esi + 4], edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x10074fe7
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009db0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], esi
mov dword [esi], 0x1009f5e8
mov dword [esi + 4], 0x1009f210
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x40]
mov dword [esp + 0x14], ebx
call fcn.10004a4b
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x88], bl
mov dword [esi], 0x100a1938
mov dword [esi + 4], 0x100a1928
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x100765b7
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1009db8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], esi
mov dword [esi], 0x1009f5e8
mov dword [esi + 4], 0x1009f210
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x40]
mov dword [esp + 0x14], ebx
call fcn.10004a4b
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x3038], bl
mov dword [esi], 0x100a1a90
mov dword [esi + 4], 0x100a1a80
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x10078030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov ecx, eax
imul ecx, edx
mov edx, dword [esi + 0x14]
add edx, ecx
mov dword [esi + 0x14], edx
mov edx, dword [esi + 0x10]
sub edx, ecx
imul eax, dword [esp + 8]
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0xc]
lea edx, [eax + ecx]
xor edx, eax
cmp edx, 0x1000000
jb 0x10078078
cmp ecx, 0x8000
jae 0x100780c2
neg eax
and eax, 0x7fff
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
lea ecx, [esi + 0x20]
cmp eax, edx
jb 0x10078090
call fcn.10004b39
mov byte [esp + 8], al
jmp 0x10078099
mov dl, byte [eax]
inc eax
mov byte [esp + 8], dl
mov dword [ecx], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esp + 8]
shl eax, 8
and ecx, 0xff
or eax, ecx
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x14]
shl ecx, 8
shl eax, 8
mov dword [esi + 0xc], ecx
mov dword [esi + 0x14], eax
jmp 0x10078053
pop esi
ret 4
Function at 0x1007beb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
mov eax, 1
xor bl, bl
push edi
mov edi, dword [esp + 0x38]
cmp esi, eax
mov dword [esp + 0x10], ecx
jbe 0x1007bed8
mov cl, byte [eax + edi]
xor bl, cl
inc eax
cmp eax, esi
jb 0x1007bece
mov ebp, dword [esp + 0x40]
mov ecx, ebp
call fcn.1000183c
mov dword [ebp + 0x14], 0xffffffff
mov al, byte [edi]
cmp bl, al
jne 0x1007bf16
xor ebx, ebx
cmp esi, ebx
jbe 0x1007bf18
mov edx, esi
mov ecx, edi
call fcn.1007bf80
cmp eax, ebx
mov dword [ebp + 0x14], eax
jge 0x1007bf69
mov ecx, dword [esp + 0x10]
dec esi
push ebp
inc edi
push esi
push edi
call fcn.1007bba0
jmp 0x1007bf18
xor ebx, ebx
mov eax, 3
mov ecx, ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.10001865
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
shl edi, 5
add edi, esi
mov ecx, 8
lea esi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, edx
mov dword [ebp + 8], edx
shl eax, 5
mov dword [eax + ecx - 0x20], 0x16
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0xc
Function at 0x1007f770
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov ebp, ecx
mov ecx, dword [esp + 0x10]
push edi
xor edi, edi
xor eax, eax
lea edx, [ebp + 0x100]
lea esi, [edi + ecx]
xor ebx, ebx
add edx, 4
mov bl, byte [esi + eax]
mov ebx, dword [ebx*4 + 0x100bc040]
xor dword [edx - 4], ebx
inc eax
cmp eax, 4
jl 0x1007f787
add edi, 4
cmp edi, 0x10
jl 0x1007f77c
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x1007ffe0
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov dword [ecx + 0x18], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x1c], eax
ret
Function at 0x100812c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
sub esp, 0xa8
and eax, 0xff
mov dl, al
push ebx
mov dh, dl
push esi
mov eax, edx
mov esi, ecx
shl eax, 0x10
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
mov ax, dx
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
xor ecx, ecx
sub esi, eax
mov bl, byte [esp + ecx + 0xc]
lea eax, [esp + ecx + 0xc]
mov dl, byte [esi + eax]
xor bl, dl
inc ecx
cmp ecx, 0x14
mov byte [eax], bl
jb 0x100812f1
lea ecx, [esp + 0x4c]
call fcn.1007ffe0
lea eax, [esp + 0xc]
lea ecx, [esp + 0x4c]
push 0
push 0x40
push eax
mov dword [esp + 0x78], 0
call fcn.100807f0
mov ecx, dword [esp + 0xb8]
push ecx
lea ecx, [esp + 0x50]
call fcn.100808e0
pop edi
pop esi
pop ebx
add esp, 0xa8
ret 4

Function at 0x10081d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
push ebp
xor ebp, ebp
and eax, 7
mov dword [esp + 8], ecx
cmp edx, 5
jae 0x10081d21
xor eax, eax
pop ebp
add esp, 0xc
ret 0xc
push ebx
push esi
mov esi, dword [esp + 0x1c]
add esi, 5
lea edx, [ecx + edx - 4]
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x18], edx
nop
mov ecx, dword [esp + 0x14]
lea edi, [ecx + ebp]
cmp edi, edx
jae 0x10081d5f
jmp 0x10081d50
mov bl, byte [edi]
and bl, 0xfe
cmp bl, 0xe8
je 0x10081d5f
inc edi
cmp edi, edx
jb 0x10081d50
mov ebp, edi
sub ebp, ecx
mov ecx, ebp
sub ecx, dword [esp + 0x10]
cmp edi, edx
jae 0x10081e74
cmp ecx, 3
jbe 0x10081d93
xor eax, eax
mov cl, byte [edi + 4]
mov dword [esp + 0x10], ebp
test cl, cl
je 0x10081dcd
cmp cl, 0xff
je 0x10081dcd
and eax, 3
add eax, eax
or eax, 1
inc ebp
jmp 0x10081d40
dec ecx
shl eax, cl
and eax, 7
je 0x10081d78
movzx ecx, byte [eax + 0x100a1e04]
mov ebx, edi
sub ebx, ecx
cmp byte [eax + 0x100a1dfc], 0
mov cl, byte [ebx + 4]
je 0x10081dbb
test cl, cl
je 0x10081dbb
cmp cl, 0xff
jne 0x10081d78
and eax, 3
add eax, eax
mov dword [esp + 0x10], ebp
or eax, 1
inc ebp
jmp 0x10081d40
movzx edx, cl
movzx ecx, byte [edi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
jmp 0x10081df0
cmp dword [esp + 0x28], 0
je 0x10081dfe
lea ebx, [edx + ebp]
add ebx, esi
jmp 0x10081e04
sub edx, ebp
sub edx, esi
mov ebx, edx
test eax, eax
je 0x10081e46
movzx esi, byte [eax + 0x100a1e04]
add esi, esi
add esi, esi
add esi, esi
mov ecx, 0x18
sub ecx, esi
mov edx, ebx
shr edx, cl
mov cl, dl
test cl, cl
je 0x10081e2b
cmp cl, 0xff
jne 0x10081e42
mov ecx, 0x20
sub ecx, esi
mov esi, dword [esp + 0x20]
mov edx, 1
shl edx, cl
dec edx
xor edx, ebx
jmp 0x10081df0
mov esi, dword [esp + 0x20]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [edi + 4], cl
mov edx, ebx
shr edx, 0x10
mov ecx, ebx
shr ecx, 8
mov byte [edi + 3], dl
mov edx, dword [esp + 0x18]
mov byte [edi + 2], cl
mov byte [edi + 1], bl
add ebp, 5
jmp 0x10081d40
pop edi
pop esi
pop ebx
cmp ecx, 3
jbe 0x10081e8d
mov edx, dword [esp + 0x18]
xor eax, eax
mov dword [edx], eax
mov eax, ebp
pop ebp
add esp, 0xc
ret 0xc
mov edx, dword [esp + 0x18]
dec ecx
shl eax, cl
and eax, 7
mov dword [edx], eax
mov eax, ebp
pop ebp
add esp, 0xc
ret 0xc
Function at 0x100831f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
mov dword [ecx + 0x30], edx
mov dword [ecx + 0x4c], edx
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x2c], 0x20
mov dword [ecx + 0x54], 1
mov dword [ecx + 0x48], 4
mov dword [ecx + 0x58], edx
lea esi, [ecx + 0x70]
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0x10083217
pop esi
ret

Function at 0x10088f20
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x10088f30
pop edi
pop ebx
ret

Function at 0x10088f60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, pe_nt_image_headers32
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
sar ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x10088f70
pop esi
pop ebp
pop ebx
ret 4
Function at 0x10089210
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [esp], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
push ebp
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
xor edx, edx
push edi
cmp edx, dword [esp + 0x1c]
jae 0x10089381
mov eax, edx
or eax, 8
xor edi, edi
cmp eax, 1
je 0x1008929a
lea ebx, [ebx]
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 4]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x10089270
add edi, dword [esp + 8]
mov ecx, dword [esp + 0x20]
mov dword [ecx + edx*4], edi
inc edx
cmp edx, 8
jb 0x10089254
cmp edx, 0x10
jae 0x1008931b
lea eax, [edx - 8]
mov dword [esp + 8], eax
jmp 0x100892c0
cmp edx, dword [esp + 0x1c]
jae 0x10089381
or eax, 8
xor edi, edi
cmp eax, 1
je 0x10089301
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 0x104]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x100892d4
add edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 8], eax
cmp edx, 0x10
jb 0x100892c0
cmp edx, dword [esp + 0x1c]
jae 0x10089381
lea eax, [edx - 0x10]
mov dword [esp + 0x18], eax
jmp 0x10089330
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x10089366
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x10089340
add edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 0x18], eax
cmp edx, dword [esp + 0x1c]
jb 0x10089330
pop edi
pop ebp
add esp, 0xc
ret 0xc