joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401207
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [0x41b2f8]
xor edx, edx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [str._0_o]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x28], edi
mov dword [ebp - 0xc], edx
mov esi, dword [edi]
mov ebx, dword [edi + 4]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x2c], 0x9e3779b9
mov dword [ebp - 0x18], eax
call fcn.00401200
add dword [ebp - 0xc], 0x23f
cmp dword [0xae340c], 0x14
jne 0x401263
push edx
lea eax, [ebp - 0x84c]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov ecx, dword [0x41b300]
mov edx, dword [0x41b304]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x18], 2
add dword [ebp - 0x18], 3
mov eax, esi
mov dword [ebp - 8], 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0xae340c], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0xae3408]
cmove eax, dword [ebp - 8]
and dword [ebp - 8], 0
cmp dword [0xae340c], 0x3eb
mov dword [0xae3408], eax
mov eax, dword [0xae3360]
cmove eax, dword [ebp - 8]
mov dword [0xae3360], eax
mov eax, dword [ebp - 0xc]
add eax, esi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
shr eax, 5
mov dword [ebp - 0x10], eax
add dword [ebp - 0x10], edx
xor edx, edx
mov eax, dword [ebp - 4]
mov dword [0xae3404], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x20]
add dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
xor ecx, eax
cmp dword [0xae340c], 0x213
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
jne 0x40135a
push edx
push edx
push edx
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_CompareStringA]
lea eax, [ebp - 0x44c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x38]
push eax
push 0
lea eax, [ebp - 0x4c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
mov ecx, dword [ebp - 0x10]
sub ebx, ecx
mov eax, ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 0xc]
shr edx, cl
add eax, ebx
mov ecx, dword [ebp - 4]
add edx, edi
xor ecx, eax
mov dword [ebp - 0x10], edx
cmp dword [0xae340c], 0xb03
mov dword [ebp - 4], ecx
jne 0x40139d
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
xor ecx, edx
sub esi, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 0xc], eax
dec dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x24]
jne 0x40127f
mov edi, dword [ebp - 0x28]
mov dword [edi], esi
mov dword [edi + 4], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c624
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a5a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407f55
mov dword [ebp - 0x14], eax
cmp dword [0x43ebf0], esi
jne 0x40c717
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c6a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c7f7
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c7f7
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c7f7
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43ebf0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43ebf4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43ebf8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43ec00], eax
test eax, eax
je 0x40c714
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43ebfc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c73c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c72f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c751
push 4
pop eax
jmp 0x40c7f9
cmp dword [ebp - 0x14], esi
je 0x40c751
push dword [0x43ebf0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c736
mov eax, dword [0x43ebfc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c7af
cmp dword [0x43ec00], edi
je 0x40c7af
push eax
call ebx
push dword [0x43ec00]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c7af
test eax, eax
je 0x40c7af
call ecx
test eax, eax
je 0x40c7a4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c7a4
test byte [ebp - 8], 1
jne 0x40c7af
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c7df
mov eax, dword [0x43ebf4]
cmp eax, edi
je 0x40c7dc
push eax
call ebx
test eax, eax
je 0x40c7dc
call eax
mov esi, eax
test esi, esi
je 0x40c7dc
mov eax, dword [0x43ebf8]
cmp eax, edi
je 0x40c7dc
push eax
call ebx
test eax, eax
je 0x40c7dc
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43ebf0]
call ebx
test eax, eax
je 0x40c7f7
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c7f9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040393e
mov esp, ebp
pop ebp
ret
Function at 0x11f9078
Capabilities:
Encode data using xor

Disassembly:
jmp 0x11f9082
pushal
call 0x11f9088
pop ebp
sub ebp, 0x10
sub ebp, 0xdf9078
jmp 0x11f909e
mov eax, 0xdf9078
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c8
mov edx, 0x87e4ee7b
xor byte [eax], dl
inc eax
dec ecx
jne 0x11f90b5
jmp 0x11f90c8
invalid
Function at 0x10001138
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10001162
mov eax, dword [ebp + 8]
push eax
mov dword [0x100daa20], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
push eax
push eax
push eax
push 0x100016ab
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
pop ebp
ret 0xc
Function at 0x1000f530
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
xor esi, esi
sub edi, 1
js 0x1000f568
push ebp
mov ebp, dword [esp + 0x14]
movzx eax, byte [edi + ebp]
push eax
call fcn.1003eb60
lea ecx, [esi + esi*4]
add esp, 4
xor esi, 1
lea eax, [eax + ecx*2]
add ebx, dword [eax*4 + 0x10089c38]
sub edi, 1
jns 0x1000f545
pop ebp
mov eax, 0x66666667
mov ecx, 0xa
imul ebx
sar edx, 2
mov eax, edx
inc edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*4]
add eax, eax
sub eax, ebx
cdq
idiv ecx
push edx
call fcn.1003f0b0
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x10012030
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov dword [esp + 0x14], 0xc
movzx ebx, byte [ebp]
inc ebp
mov eax, ebx
shl eax, 5
movzx edi, ax
mov eax, edi
not eax
and eax, 0x400
neg eax
sbb eax, eax
add edi, edi
and eax, 0xfffff8cd
mov esi, edi
add eax, 0x7fe
movzx ecx, ax
xor esi, ecx
lea eax, [ecx + ecx]
movzx edx, ax
mov eax, edx
xor eax, 0xf35
test esi, 0x400
movzx ecx, ax
mov eax, edx
cmove ecx, eax
add edi, edi
movzx ecx, cx
xor edi, ecx
lea eax, [ecx + ecx]
movzx edx, ax
mov eax, edx
xor eax, 0xf35
test edi, 0x400
movzx ecx, ax
mov eax, edx
cmove ecx, eax
mov eax, 0x7ff
and cx, ax
mov ah, bl
movzx ecx, cx
mov al, bh
movzx edi, ax
mov esi, edi
xor esi, ecx
lea eax, [ecx + ecx]
movzx edx, ax
mov eax, edx
xor eax, 0xf35
test esi, 0x400
movzx ecx, ax
mov eax, edx
cmove ecx, eax
add edi, edi
movzx ecx, cx
mov esi, edi
xor esi, ecx
lea eax, [ecx + ecx]
movzx edx, ax
mov eax, edx
xor eax, 0xf35
test esi, 0x400
movzx ecx, ax
lea esi, [edi + edi]
mov eax, edx
cmove ecx, eax
movzx ecx, cx
xor esi, ecx
lea eax, [ecx + ecx]
movzx edx, ax
mov eax, edx
xor eax, 0xf35
test esi, 0x400
movzx ecx, ax
mov eax, edx
cmove ecx, eax
movzx ecx, cx
movzx ebx, byte [ebp]
lea edx, [ecx + ecx]
lea ebp, [ebp + 1]
lea eax, [ebx*8]
movzx edi, ax
mov eax, edx
xor eax, 0xf35
mov esi, edi
xor esi, ecx
movzx ecx, ax
test esi, 0x400
movzx eax, dx
cmove ecx, eax
add edi, edi
movzx eax, cx
mov edx, edi
xor edx, eax
lea ecx, [eax + eax]
mov eax, ecx
xor eax, 0xf35
test edx, 0x400
movzx esi, ax
movzx eax, cx
cmove esi, eax
add edi, edi
mov eax, 0x7ff
and si, ax
movzx eax, si
mov esi, edi
xor esi, eax
lea edx, [eax + eax]
mov eax, edx
xor eax, 0xf35
test esi, 0x400
movzx ecx, ax
movzx eax, dx
cmove ecx, eax
add edi, edi
movzx eax, cx
mov esi, edi
xor esi, eax
lea edx, [eax + eax]
mov eax, edx
xor eax, 0xf35
test esi, 0x400
movzx ecx, ax
movzx eax, dx
cmove ecx, eax
add edi, edi
movzx eax, cx
xor edi, eax
lea edx, [eax + eax]
mov eax, edx
xor eax, 0xf35
test edi, 0x400
movzx ecx, ax
movzx eax, dx
cmove ecx, eax
mov ah, bl
movzx ecx, cx
mov al, bh
movzx edi, ax
mov esi, edi
xor esi, ecx
lea edx, [ecx + ecx]
mov eax, edx
xor eax, 0xf35
test esi, 0x400
movzx ecx, ax
movzx eax, dx
cmove ecx, eax
add edi, edi
movzx eax, cx
mov esi, edi
xor esi, eax
lea edx, [eax + eax]
mov eax, edx
xor eax, 0xf35
test esi, 0x400
movzx ecx, ax
movzx eax, dx
cmove ecx, eax
lea edx, [edi + edi]
movzx eax, cx
xor edx, eax
lea ecx, [eax + eax]
mov eax, ecx
xor eax, 0xf35
test edx, 0x400
movzx esi, ax
movzx eax, cx
cmove esi, eax
mov eax, 0x7ff
and si, ax
sub dword [esp + 0x14], 1
movzx ecx, si
jne 0x10012125
pop edi
pop esi
pop ebp
pop ebx
mov ax, cx
ret
Function at 0x10042a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
sub ecx, eax
push ebx
mov ebx, dword [esp + 0x14]
cmp ecx, ebx
jge 0x10042a77
xor eax, eax
pop ebx
ret
cmp dword [esp + 0x28], 0
push ebp
push esi
jne 0x10042b6b
test ecx, ecx
je 0x10042b6b
mov ebp, dword [esp + 0x10]
xor edx, edx
push edi
xor edi, edi
cmp ecx, dword [esp + 0x24]
cmovg ecx, dword [esp + 0x24]
lea esi, [eax + ebp]
add ebx, ebx
lea eax, [esi - 1]
not ebx
add eax, ecx
and ebx, 2
mov dword [esp + 0x18], eax
xor ecx, ecx
or ebx, 1
cmp esi, eax
jae 0x10042b0b
sub eax, esi
cmp eax, 2
jb 0x10042af8
mov eax, dword [esp + 0x18]
mov ebp, ebx
xor ebp, 2
dec eax
mov dword [esp + 0x1c], eax
nop
movzx eax, byte [esi]
sub eax, 0x30
imul eax, ebx
add edx, eax
movzx eax, byte [esi + 1]
sub eax, 0x30
add esi, 2
imul eax, ebp
add edi, eax
mov eax, esi
cmp esi, dword [esp + 0x1c]
jb 0x10042ad0
cmp eax, dword [esp + 0x18]
jae 0x10042b02
movzx ecx, byte [esi]
sub ecx, 0x30
imul ecx, ebx
inc esi
mov ebp, dword [esp + 0x14]
lea eax, [edi + edx]
add ecx, eax
mov eax, 0x66666667
imul ecx
pop edi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea edx, [eax + eax*4]
add edx, edx
sub edx, ecx
lea eax, [edx + 0xa]
neg edx
sbb edx, edx
and edx, eax
movzx eax, byte [esi]
sub eax, 0x30
cmp edx, eax
je 0x10042b6b
mov eax, dword [esp + 0x24]
mov ecx, esi
sub ecx, ebp
inc ecx
mov dword [eax], 3
mov eax, dword [esp + 0x28]
mov dword [eax], ecx
lea eax, [edx + 0x30]
push eax
movzx eax, byte [esi]
push eax
push str.Bad_checksum__c__expected__c
push dword [esp + 0x38]
call fcn.100076e0
add esp, 0x10
xor eax, eax
pop esi
pop ebp
pop ebx
ret
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x10042ce0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push esi
mov esi, ebp
and esi, 1
add esi, esi
push edi
or esi, 1
xor edi, edi
test ebp, ebp
jle 0x10042d1e
nop word [eax + eax]
mov eax, dword [esp + 0x14]
movzx eax, byte [edi + eax]
push eax
call fcn.1003eb60
imul eax, esi
inc edi
add esp, 4
xor esi, 2
add ebx, eax
cmp edi, ebp
jl 0x10042d00
mov eax, 0x66666667
mov ecx, 0xa
imul ebx
sar edx, 2
mov eax, edx
inc edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*4]
add eax, eax
sub eax, ebx
cdq
idiv ecx
push edx
call fcn.1003f0b0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10045660
Capabilities:
Get geographical location

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x14
push esi
mov esi, dword [esp + 0x20]
sub esi, eax
cmp esi, dword [esp + 0x28]
jl 0x100457cf
test esi, esi
je 0x10045685
cmp esi, 0x14
jl 0x100457cf
cmp dword [esp + 0x3c], 0
push ebx
push ebp
push edi
jne 0x100457c2
test esi, esi
je 0x100457c2
mov ecx, dword [esp + 0x28]
xorps xmm0, xmm0
add ecx, eax
movlpd qword [esp + 0x14], xmm0
cmp esi, dword [esp + 0x38]
movlpd qword [esp + 0x1c], xmm0
cmovg esi, dword [esp + 0x38]
lea eax, [esi + ecx]
mov dword [esp + 0x10], eax
cmp ecx, eax
jae 0x100457c2
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
nop dword [eax]
movzx eax, byte [ecx]
cdq
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], edx
cmp esi, 0xa
jle 0x1004571a
mov eax, edi
mov edx, ebp
shld edx, eax, 2
shl eax, 2
add edi, eax
mov eax, dword [esp + 0x2c]
adc ebp, edx
shld ebp, edi, 1
add edi, edi
add edi, dword [esp + 0x30]
adc ebp, dword [esp + 0x34]
add edi, 0xffffffd0
adc ebp, 0xffffffff
jmp 0x1004574b
mov edx, dword [esp + 0x2c]
mov eax, ebx
mov dword [esp + 0x2c], edx
shld edx, eax, 2
shl eax, 2
add ebx, eax
mov eax, dword [esp + 0x2c]
adc eax, edx
shld eax, ebx, 1
add ebx, ebx
add ebx, dword [esp + 0x30]
adc eax, dword [esp + 0x34]
add ebx, 0xffffffd0
adc eax, 0xffffffff
mov dword [esp + 0x2c], eax
inc ecx
dec esi
cmp ecx, dword [esp + 0x10]
jb 0x100456e0
test ebp, ebp
ja 0x1004576d
jb 0x10045761
cmp edi, 0x6b49d200
ja 0x1004576d
test eax, eax
jne 0x1004576d
cmp ebx, 0xd693a400
jbe 0x100457c2
mov eax, dword [esp + 0x3c]
mov dword [eax], 3
test ebp, ebp
jne 0x10045794
cmp edi, 0x6b49d200
ja 0x10045794
mov eax, dword [esp + 0x40]
sub ecx, dword [esp + 0x28]
mov dword [eax], ecx
mov eax, str.longitude
jmp 0x100457a6
mov eax, dword [esp + 0x40]
sub ecx, dword [esp + 0x28]
sub ecx, 0xa
mov dword [eax], ecx
mov eax, str.latitude
push eax
push str.Invalid__s
push dword [esp + 0x4c]
call fcn.100076e0
add esp, 0xc
xor eax, eax
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x14
ret
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
add esp, 0x14
ret
xor eax, eax
pop esi
add esp, 0x14
ret
Function at 0x1004cb50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, dword [esp + 0x38]
mov ebp, dword [esi + 0x208]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
push ebp
mov dword [esp + 0x18], eax
lea eax, [esi + 0x108]
push 0
push edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x38], eax
call fcn.10058d80
add esp, 0xc
cmp dword [esi + 0x20c], 0
je 0x1004cc4b
mov ecx, dword [esp + 0x30]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ecx
test ecx, ecx
jle 0x1004ccf0
mov ecx, dword [esp + 0x34]
lea esi, [edi - 1]
add esi, ebp
mov dword [esp + 0x24], ecx
lea edx, [ebp - 1]
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], edx
movzx ecx, byte [eax + ecx]
movzx eax, byte [esi]
xor ecx, eax
je 0x1004cc1a
mov eax, dword [esp + 0x14]
mov esi, edx
movzx ebp, byte [ecx + eax]
test esi, esi
jle 0x1004cc08
mov edx, dword [esp + 0x2c]
lea eax, [edi - 1]
add edx, esi
add eax, esi
cmp byte [edx - 0x100], 0
je 0x1004cbfc
movzx ecx, byte [edx]
add ecx, ebp
mov cl, byte [ecx + ebx]
xor cl, byte [eax]
jmp 0x1004cbfe
mov cl, byte [eax]
mov byte [eax + 1], cl
dec esi
dec eax
dec edx
test esi, esi
jg 0x1004cbe7
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x18]
movzx eax, byte [eax]
add eax, ebp
mov al, byte [eax + ebx]
jmp 0x1004cc2a
push edx
lea eax, [edi + 1]
push edi
push eax
call fcn.10058800
add esp, 0xc
xor al, al
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov byte [edi], al
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, dword [esp + 0x1c]
jl 0x1004cbc3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov esi, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x18], ebx
test esi, esi
jle 0x1004ccf0
mov ecx, dword [esp + 0x34]
lea eax, [edi - 1]
add eax, ebp
lea edx, [ebp - 1]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
movzx ecx, byte [ebx + ecx]
movzx eax, byte [eax]
xor ecx, eax
je 0x1004ccc9
mov eax, dword [esp + 0x14]
movzx ebp, byte [ecx + eax]
test edx, edx
jle 0x1004ccb7
mov ebx, dword [esp + 0x2c]
lea esi, [edx + edi]
sub ebx, edi
mov edi, dword [esp + 0x10]
movzx eax, byte [ebx + esi]
lea esi, [esi - 1]
add eax, ebp
dec edx
mov al, byte [eax + edi]
xor al, byte [esi]
mov byte [esi + 1], al
test edx, edx
jg 0x1004cc95
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
movzx eax, byte [eax]
add eax, ebp
mov al, byte [eax + ecx]
jmp 0x1004ccd9
push edx
lea eax, [edi + 1]
push edi
push eax
call fcn.10058800
add esp, 0xc
xor al, al
mov edx, dword [esp + 0x24]
inc ebx
mov ecx, dword [esp + 0x34]
mov byte [edi], al
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], ebx
cmp ebx, esi
jl 0x1004cc71
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x1004cd00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x3c]
mov eax, dword [esi]
mov ebp, dword [esi + 0x208]
mov ebx, dword [esi + 4]
mov dword [esp + 0x18], eax
lea eax, [esi + 0x108]
mov dword [esp + 0x30], eax
lea eax, [ebp*4]
push eax
push 0
push edi
call fcn.10058d80
add esp, 0xc
cmp dword [esi + 0x20c], 0
je 0x1004ce19
mov ecx, dword [esp + 0x34]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
test ecx, ecx
jle 0x1004ceb1
lea edx, [ebp - 1]
lea esi, [edi - 4]
mov dword [esp + 0x28], edx
lea esi, [esi + ebp*4]
lea ebp, [edx*4]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], ebp
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x20], ebp
mov eax, dword [ebp + eax*4]
xor eax, dword [esi]
je 0x1004cde3
mov ebp, dword [esp + 0x18]
mov esi, edx
movzx ebp, byte [eax + ebp]
test esi, esi
jle 0x1004cdcc
mov edx, dword [esp + 0x30]
lea ecx, [edi - 4]
add edx, esi
lea ecx, [ecx + esi*4]
cmp byte [edx - 0x100], 0
je 0x1004cdba
movzx eax, byte [edx]
add eax, ebp
movzx eax, byte [eax + ebx]
xor eax, dword [ecx]
jmp 0x1004cdbc
mov eax, dword [ecx]
mov dword [ecx + 4], eax
dec esi
sub ecx, 4
dec edx
test esi, esi
jg 0x1004cda4
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x1c]
movzx eax, byte [eax]
add eax, ebp
mov ebp, dword [esp + 0x20]
movzx eax, byte [eax + ebx]
jmp 0x1004cdfa
push dword [esp + 0x24]
lea eax, [edi + 4]
push edi
push eax
call fcn.10058800
mov ecx, dword [esp + 0x1c]
add esp, 0xc
xor eax, eax
mov edx, dword [esp + 0x28]
mov dword [edi], eax
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, ecx
jl 0x1004cd82
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov eax, dword [esp + 0x34]
xor esi, esi
test eax, eax
jle 0x1004ceb1
mov eax, dword [esp + 0x38]
lea ecx, [edi - 4]
lea ecx, [ecx + ebp*4]
dec ebp
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ebp
nop word [eax + eax]
mov eax, dword [eax + esi*4]
xor eax, dword [ecx]
je 0x1004ce89
mov ecx, dword [esp + 0x18]
movzx edx, byte [eax + ecx]
mov eax, ebp
test eax, eax
jle 0x1004ce7a
mov ebp, dword [esp + 0x30]
nop dword [eax]
movzx ecx, byte [eax + ebp]
add ecx, edx
movzx ecx, byte [ecx + ebx]
xor ecx, dword [edi + eax*4 - 4]
mov dword [edi + eax*4], ecx
dec eax
test eax, eax
jg 0x1004ce60
mov ebp, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
movzx eax, byte [eax]
add eax, edx
movzx eax, byte [eax + ebx]
jmp 0x1004cea0
lea eax, [ebp*4]
push eax
lea eax, [edi + 4]
push edi
push eax
call fcn.10058800
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x24]
inc esi
mov dword [edi], eax
mov eax, dword [esp + 0x38]
cmp esi, dword [esp + 0x34]
jl 0x1004ce40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x1004cec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
lea edx, [ebx + 8]
mov eax, dword [ebx + 4]
mov ebp, dword [ebx]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [ebx + 0x208], eax
mov byte [edx], 1
cmp eax, 1
jl 0x1004cf70
mov ecx, dword [esp + 8]
mov ebx, eax
push esi
mov esi, dword [esp + 0x24]
push edi
xor edi, edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edi
mov byte [edx + edi + 1], 1
mov eax, edi
test edi, edi
jle 0x1004cf3d
mov edi, dword [esp + 0x10]
mov bl, byte [eax + edx]
test bl, bl
je 0x1004cf23
movzx ecx, bl
movzx ecx, byte [ecx + ebp]
add ecx, esi
mov bl, byte [ecx + edi]
mov cl, byte [eax + edx - 1]
xor cl, bl
mov byte [eax + edx], cl
dec eax
test eax, eax
jg 0x1004cf10
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
movzx eax, byte [edx]
inc edi
mov dword [esp + 0x14], edi
movzx eax, byte [eax + ebp]
add eax, esi
inc esi
sub ebx, 1
mov dword [esp + 0x18], ebx
mov al, byte [eax + ecx]
mov byte [edx], al
jne 0x1004cf01
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
pop edi
pop esi
mov dword [ebx + 0x20c], 0
jmp 0x1004cf7e
mov dword [ebx + 0x20c], 0
test eax, eax
js 0x1004cfa3
lea ecx, [eax + 1]
movzx eax, byte [edx]
lea edx, [edx + 1]
mov al, byte [eax + ebp]
mov byte [edx + 0xff], al
xor eax, eax
cmp byte [edx - 1], al
sete al
or dword [ebx + 0x20c], eax
sub ecx, 1
jne 0x1004cf81
pop ebp
pop ebx
add esp, 0xc
ret