joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a41f0
Capabilities:
Enumerate devices by category

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x20]
push eax
call fcn.0041c1d0
mov ebx, eax
mov eax, dword [esi + 0x2c]
xor ebp, ebp
add esp, 4
cmp eax, ebp
mov dword [esp + 0x18], ebx
jne 0x4a428c
mov eax, dword [esi + 0x18]
lea edi, [esi + 0x18]
cmp eax, ebp
je 0x4a422e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi], ebp
push ebp
call dword [sym.imp.ole32.dll_CoInitialize]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebp
push edx
push 0x4c58d0
push 1
push ebp
push 0x4c54a0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x4a4270
mov eax, dword [esp + 0x20]
push ebp
push edi
push 0x4c5490
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [esp + 0x20]
push eax
mov edx, dword [eax]
call dword [edx + 8]
push ebp
push str.999999
call fcn.0041c1d0
add esp, 4
mov ecx, esi
push eax
call fcn.004a4180
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebp
mov edi, dword [esi + 0x20]
mov eax, dword [esi + 0x1c]
cmp edi, eax
jge 0x4a43a2
mov ecx, dword [esi + 0x2c]
dec ecx
cmp ebx, ecx
jle 0x4a43a2
cmp edi, eax
mov dword [esp + 0x14], edi
jge 0x4a43a2
mov ecx, dword [esi + 0x20]
lea edx, [esp + 0x10]
inc ecx
push edx
mov dword [esi + 0x20], ecx
push edi
mov ecx, esi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x18], ebp
call fcn.004a4180
cmp eax, edi
jne 0x4a42e8
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
push 0x4c5980
mov ecx, dword [eax]
push ebp
push ebp
push eax
call dword [ecx + 0x20]
cmp dword [esp + 0x20], ebp
je 0x4a437f
mov eax, dword [esi + 0x28]
lea edi, [esi + 0x28]
cmp eax, ebp
je 0x4a4304
mov edi, eax
mov eax, dword [edi]
cmp eax, ebp
jne 0x4a42fc
mov eax, dword [esi + 0x2c]
push 0xa
push eax
call fcn.00459b20
push 0xa8
mov ebx, eax
call fcn.0041ec00
add esp, 0xc
cmp eax, ebp
je 0x4a432c
push ebx
mov ecx, eax
call fcn.00489b70
mov ebp, eax
push ebx
mov ecx, 0x4da3e8
call fcn.0041e810
push 0x3c
call fcn.0041ec00
add esp, 4
test eax, eax
je 0x4a4358
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x24]
push ecx
push ebp
push edx
mov ecx, eax
call fcn.004a3730
jmp 0x4a435a
xor eax, eax
push eax
mov ecx, ebp
mov dword [edi], eax
call fcn.00489c60
mov edi, dword [esi + 0x2c]
mov eax, dword [esp + 0x20]
inc edi
push eax
mov dword [esi + 0x2c], edi
mov ecx, dword [eax]
call dword [ecx + 8]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
xor ebp, ebp
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x4a438d
mov edx, dword [eax]
push eax
call dword [edx + 8]
cmp ebx, dword [esi + 0x2c]
jl 0x4a43a2
mov eax, dword [esi + 0x1c]
inc edi
cmp edi, eax
mov dword [esp + 0x14], edi
jl 0x4a42b2
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x4a4920
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x74
push ebp
push esi
lea eax, [esp + 8]
push edi
xor ebp, ebp
push eax
push 1
push ebp
push str.SoftwareMicrosoftMultimediaSound_Mapper
push 0x80000001
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4a4a90
mov edi, dword [esp + 0x84]
mov eax, str.Record
test edi, edi
jne 0x4a4975
mov eax, str.Playback
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0
push eax
push edx
call esi
test eax, eax
jne 0x4a4a90
mov eax, dword [esp + 0x14]
inc eax
push eax
call fcn.0041ec00
add esp, 4
mov ebp, eax
test edi, edi
mov eax, str.Record
jne 0x4a49b4
mov eax, str.Playback
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
push ebp
push 0
push 0
push eax
push edx
call esi
test eax, eax
jne 0x4a4a90
test edi, edi
je 0x4a49da
call dword [sym.imp.WINMM.dll_waveInGetNumDevs]
jmp 0x4a49e0
call dword [sym.imp.WINMM.dll_waveOutGetNumDevs]
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
jle 0x4a4a90
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4a4a3c
lea eax, [esp + 0x1c]
push 0x30
push eax
push edi
call dword [sym.imp.WINMM.dll_waveInGetDevCapsA]
mov esi, ebp
lea eax, [esp + 0x24]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4a4a31
test cl, cl
je 0x4a4a2d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4a4a31
add eax, 2
add esi, 2
test cl, cl
jne 0x4a4a0d
xor eax, eax
jmp 0x4a4a36
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4a4a8c
jmp 0x4a4a7d
lea eax, [esp + 0x4c]
push 0x34
push eax
push edi
call dword [sym.imp.WINMM.dll_waveOutGetDevCapsA]
mov esi, ebp
lea eax, [esp + 0x54]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4a4a74
test cl, cl
je 0x4a4a70
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4a4a74
add eax, 2
add esi, 2
test cl, cl
jne 0x4a4a50
xor eax, eax
jmp 0x4a4a79
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4a4a8c
mov eax, dword [esp + 0x18]
inc edi
cmp edi, eax
jl 0x4a49ee
jmp 0x4a4a90
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4a4a9f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x4a4aac
push ebp
call fcn.0041ec10
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0x74
ret
Function at 0x4a4db0
Capabilities:
Capture microphone audio

Disassembly:
push ecx
push ebp
mov ebp, ecx
push esi
mov ecx, dword [ebp + 4]
add ecx, 0x24
call fcn.004a52b0
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
mov byte [eax], 0
inc esi
mov dword [esp + 8], esi
je 0x4a4ec6
mov cl, byte [ebp + 0x2aa]
test cl, cl
jne 0x4a4e9b
mov ecx, dword [ebp + 0x28c]
test ecx, ecx
jle 0x4a4e9b
mov byte [eax], 1
push ebx
mov ebx, dword [ebp + 0x24c]
lea eax, [ebp + 0x290]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 0x48]
mov esi, dword [ebp + ebx*4 + 8]
mov edi, dword [esp + 0x18]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x28c]
xor ecx, ecx
dec esi
mov eax, esi
mov dword [ebp + 0x28c], esi
test eax, eax
jle 0x4a4e53
lea eax, [ebp + 0x24c]
mov edx, dword [eax + 4]
inc ecx
mov dword [eax], edx
mov edx, dword [ebp + 0x28c]
add eax, 4
cmp ecx, edx
jl 0x4a4e40
lea eax, [ebp + 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp]
push 0x20
shl ebx, 5
lea eax, [ebx + ebp + 0x4c]
push eax
push ecx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov al, byte [ebp + 0x2a8]
pop edi
test al, al
pop ebx
je 0x4a4e91
mov edx, dword [ebp]
push edx
call dword [sym.imp.WINMM.dll_waveInStart]
mov byte [ebp + 0x2a8], 0
mov eax, dword [esp + 8]
pop esi
pop ebp
pop ecx
ret 8
mov al, byte [ebp + 0x2a9]
test al, al
je 0x4a4ebe
mov eax, dword [ebp]
push eax
call dword [sym.imp.WINMM.dll_waveInStart]
mov eax, esi
mov byte [ebp + 0x2a9], 0
pop esi
pop ebp
pop ecx
ret 8
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x4a4f60
Capabilities:
Capture microphone audio

Disassembly:
sub esp, 0x18
lea eax, [esp + 4]
push ebx
push ebp
mov ebp, ecx
push esi
push edi
push eax
mov ecx, dword [ebp + 4]
add ecx, 0x9c
push ecx
call fcn.004a48a0
mov edx, dword [esp + 0x34]
lea edi, [ebp + 8]
add esp, 8
mov dword [ebp + 0x28c], 0
mov byte [ebp + 0x2a8], 0
mov dword [ebp + 0x48], edx
mov esi, edi
mov ebx, 0x10
mov eax, dword [esp + 0x2c]
push eax
call fcn.0041ec00
mov dword [esi], eax
add esp, 4
add esi, 4
dec ebx
jne 0x4a4fa2
mov edx, dword [ebp + 4]
push 0x30000
push ebp
lea ecx, [esp + 0x1c]
mov eax, dword [edx + 0x50]
push 0x4a4ed0
push ecx
push eax
push ebp
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
jne 0x4a503b
xor ebx, ebx
lea esi, [ebp + 0x4c]
mov dword [esp + 0x10], edi
mov ecx, 8
xor eax, eax
mov edi, esi
push 0x20
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
push esi
mov edx, dword [ecx]
mov dword [esi], edx
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov ecx, dword [ebp]
push ecx
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov edx, dword [ebp]
push 0x20
push esi
push edx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov edi, dword [esp + 0x10]
inc ebx
add edi, 4
add esi, 0x20
cmp ebx, 0x10
mov dword [esp + 0x10], edi
jl 0x4a4fe2
mov byte [ebp + 0x2a9], 1
mov byte [ebp + 0x2aa], 0
xor ecx, ecx
pop edi
test eax, eax
sete cl
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x18
ret 4

Function at 0x4a5190
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
mov dword [esi + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
xor edi, edi
test ebx, ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
je 0x4a51ca
mov dword [esi + 0x28], ebx
jmp 0x4a51e2
lea edx, [esi + 0x28]
push edx
push 0
push esi
push 0x4a52d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
mov eax, dword [esp + 0x18]
dec eax
je 0x4a51f0
dec eax
jne 0x4a51f9
push 1
jmp 0x4a51f2
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test ebx, ebx
jne 0x4a5208
test edi, edi
je 0x4a5208
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x4a5210
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea esi, [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
mov dword [edi], 1
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x4a5267
push esi
call ebx
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebp
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
sub eax, edx
cmp eax, ecx
jae 0x4a5279
jmp 0x4a523c
push esi
mov edi, 1
call ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
Function at 0x4b7130
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
push eax
push esi
xor edi, edi
call dword [0x59d5e0]
mov ecx, eax
add esp, 8
add ecx, 0x20
mov ebx, 8
sar ecx, 6
xor eax, eax
mov al, byte [esi + 7]
sub eax, ecx
cdq
mov ebp, eax
xor eax, eax
mov al, byte [esi + 6]
xor ebp, edx
sub eax, ecx
sub ebp, edx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
xor eax, eax
mov al, byte [esi + 5]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
xor eax, eax
mov al, byte [esi + 4]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
xor eax, eax
mov al, byte [esi + 3]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
xor eax, eax
mov al, byte [esi + 2]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
xor eax, eax
mov al, byte [esi + 1]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
xor eax, eax
mov al, byte [esi]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x18]
add eax, edi
add esi, edx
dec ebx
lea edi, [eax + ebp]
jne 0x4b7156
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4b76d0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
mov eax, 2
sub eax, edi
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x28], eax
mov eax, 3
sub eax, edi
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov eax, 4
sub eax, edi
mov ebp, 1
mov dword [esp + 0x14], eax
mov eax, 5
sub eax, edi
sub ebp, edi
mov dword [esp + 0x18], eax
mov eax, 6
sub eax, edi
lea ecx, [ebx + edi + 1]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], 8
xor eax, eax
xor edx, edx
mov al, byte [ecx - 1]
mov dl, byte [ebx]
lea eax, [eax + edx + 1]
cdq
sub eax, edx
xor edx, edx
sar eax, 1
mov byte [esi], al
mov dl, byte [ecx]
xor eax, eax
mov al, byte [ebx + 1]
add ebx, edi
lea eax, [eax + edx + 1]
cdq
sub eax, edx
xor edx, edx
sar eax, 1
mov byte [esi + 1], al
mov dl, byte [ecx + 1]
xor eax, eax
mov al, byte [ecx + ebp]
lea eax, [eax + edx + 1]
cdq
sub eax, edx
mov edx, dword [esp + 0x28]
sar eax, 1
mov byte [esi + 2], al
xor eax, eax
mov al, byte [edx + ecx]
xor edx, edx
mov dl, byte [ecx + 2]
lea eax, [eax + edx + 1]
cdq
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
mov byte [esi + 3], al
xor eax, eax
mov al, byte [ecx + edx]
xor edx, edx
mov dl, byte [ecx + 3]
lea eax, [eax + edx + 1]
cdq
sub eax, edx
mov edx, dword [esp + 0x14]
sar eax, 1
mov byte [esi + 4], al
xor eax, eax
mov al, byte [ecx + edx]
xor edx, edx
mov dl, byte [ecx + 4]
lea eax, [eax + edx + 1]
cdq
sub eax, edx
mov edx, dword [esp + 0x18]
sar eax, 1
mov byte [esi + 5], al
xor eax, eax
mov al, byte [ecx + edx]
xor edx, edx
mov dl, byte [ecx + 5]
lea eax, [eax + edx + 1]
cdq
sub eax, edx
mov edx, dword [esp + 0x1c]
sar eax, 1
mov byte [esi + 6], al
xor eax, eax
mov al, byte [ecx + edx]
xor edx, edx
mov dl, byte [ecx + 6]
add ecx, edi
lea eax, [eax + edx + 1]
cdq
sub eax, edx
sar eax, 1
mov byte [esi + 7], al
mov eax, dword [esp + 0x24]
add esi, edi
dec eax
mov dword [esp + 0x24], eax
jne 0x4b772d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4b8d70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
shl esi, 0xe
mov eax, dword [edi]
xor ebp, ebp
add eax, 4
add esi, 0x4dd494
sar eax, 3
cmp eax, 1
jge 0x4b8d9b
mov eax, 1
jmp 0x4b8da7
cmp eax, 0xfe
jle 0x4b8da7
mov eax, 0xfe
mov edx, dword [esp + 0x18]
mov ebx, 0x3f
sub edi, edx
mov dword [edx], eax
lea ecx, [edx + 4]
mov eax, dword [edi + ecx]
add ecx, 4
mov eax, dword [esi + eax*4]
mov dword [ecx - 4], eax
cdq
xor eax, edx
sub eax, edx
add ebp, eax
dec ebx
jne 0x4b8db7
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret

Function at 0x4b90d0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
shl esi, 0xe
add esi, 0x4dd494
sub edi, ecx
mov ebp, 0x40
mov eax, dword [edi + ecx]
add ecx, 4
mov eax, dword [esi + eax*4]
mov dword [ecx - 4], eax
cdq
xor eax, edx
sub eax, edx
add ebx, eax
dec ebp
jne 0x4b90f2
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
ret
Function at 0x4c0a60
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov eax, ecx
mov ebx, dword [esp + 0x10]
cdq
and edx, 7
push ebp
add eax, edx
and ecx, 7
sar eax, 3
push esi
mov esi, dword [esp + 0x10]
test eax, eax
mov ebp, ecx
jle 0x4c0aab
push edi
mov edi, eax
push 8
mov ecx, esi
call fcn.004bb900
xor ecx, ecx
and eax, 0xff
mov cl, bh
xor edx, edx
xor eax, ecx
mov dh, bl
mov ebx, dword [eax*4 + 0x4cb274]
xor ebx, edx
dec edi
jne 0x4c0a86
pop edi
test ebp, ebp
jle 0x4c0ad7
push 1
mov ecx, esi
call fcn.004bb900
mov ecx, ebx
and ebx, 0x7fff
shr ecx, 0xf
and ecx, 1
xor eax, ecx
shl ebx, 1
test eax, eax
je 0x4c0ad4
xor ebx, 0x8005
dec ebp
jne 0x4c0aaf
pop esi
mov eax, ebx
pop ebp
pop ebx
ret
Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x822260
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x82229a
mov edx, dword [esp + 0x10]
mov edi, 0x1505
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
test ebx, ebx
je 0x8222a1
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp ecx, esi
jne 0x822280
jmp 0x8222a3
mov eax, 0x1505
jmp 0x8222a3
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x822990
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x822b56
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test ebp, ebp
je 0x822b4f
mov edx, 0x5e6ea9af
mov eax, ebp
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebp
sub edx, eax
jmp 0x822a33
mov edx, dword [esp]
mov eax, edx
sub eax, dword [esp + 4]
add ebx, eax
mov ebp, edx
not ebp
mov esi, dword [esp + 0xc]
and ebp, esi
not esi
mov eax, ecx
mov edx, 0x80078071
mul edx
and esi, dword [esp]
shr edx, 0xf
imul eax, edx, 0xfff1
mov dword [esp], eax
mov eax, edi
mov edx, 0x80078071
mul edx
sub ecx, dword [esp]
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov edx, 0x15b0
sub ebp, esi
je 0x822b4f
xor eax, eax
cmp edx, 8
mov dword [esp], edx
jb 0x822ab4
and edx, 0x1ff8
mov dword [esp + 4], edx
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add eax, 8
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 4]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 5]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 6]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 7]
add edi, esi
mov esi, ecx
xor esi, edi
and ecx, edi
lea ecx, [esi + ecx*2]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x822a50
add ebx, eax
mov eax, dword [esp + 4]
mov dword [esp + 0xc], ebp
mov esi, eax
sub esi, edx
jae 0x8229eb
mov ebp, edx
and ebp, 3
mov dword [esp + 4], eax
je 0x822b02
mov dword [esp + 8], esi
neg ebp
xor eax, eax
mov edx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec eax
cmp ebp, eax
jne 0x822ae0
mov ebp, dword [esp + 4]
sub ebp, eax
mov esi, dword [esp + 8]
cmp esi, 0xfffffffc
ja 0x8229e0
jmp 0x822b0f
mov ebp, eax
mov edx, ebx
cmp esi, 0xfffffffc
ja 0x8229e0
mov eax, dword [esp]
sub eax, ebp
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + ebp]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + ebp + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 3]
add edi, esi
add ecx, edi
add ebp, 4
cmp eax, ebp
jne 0x822b20
jmp 0x8229e0
shl ecx, 0x10
or ecx, edi
jmp 0x822b5b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x822b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x822bc8
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x822bca
not eax
xor esi, esi
nop
nop
nop
nop
movzx ebx, byte [ecx + esi]
mov edi, eax
shr edi, 4
xor eax, ebx
and eax, 0xf
xor edi, dword [eax*4 + 0x85f80c]
mov eax, edi
shr eax, 4
shr ebx, 4
mov ebp, ebx
and ebp, edi
and edi, 0xf
or edi, ebx
xor edi, ebp
xor eax, dword [edi*4 + 0x85f80c]
inc esi
cmp edx, esi
jne 0x822b90
not eax
jmp 0x822bca
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x827c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x827c5b
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0x827c63
mov word [ebx], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0x827cfb
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0x827ca9
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0x827d0a
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0x827cbe
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0x827cd0
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0x827c90
jmp 0x827cd9
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0x827c90
cmp edi, ebx
jge 0x827cf0
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0x827c94
jmp 0x827cf4
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0x827c9d
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0x827d92
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0x827d92
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0x827d44
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0x827d30
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0x827d92
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0x827d50
dec eax
mov ecx, 1
xor esi, esi
jmp 0x827dac
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0x827c5b
test edx, edx
mov dword [esp], ecx
js 0x827de0
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0x827df0
inc ebp
dec edx
cmp edi, ebp
jne 0x827dc0
mov edx, 0xffffffff
jmp 0x827df2
xor edi, edi
jmp 0x827df5
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0x827da0
and ebp, 3
je 0x827e28
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0x827e10
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0x827e2a
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0x827da0
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0x827e40
jmp 0x827da0