joyce8/EMBER2024-capa huggingface dataset:
Function at 0xebe990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
movzx ebx, byte [edx]
test bl, bl
je 0xebec03
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x1c]
dec edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
test esi, esi
je 0xebe9cc
cmp edx, esi
jae 0xebec03
test edi, edi
je 0xebec03
movzx ebp, bl
test bl, bl
js 0xebea10
inc edx
lea ecx, [eax + 2]
mov word [eax], bp
mov esi, ecx
xor esi, eax
not eax
and eax, ecx
add eax, eax
sub eax, esi
sar eax, 1
sub edi, eax
mov eax, ecx
mov esi, dword [esp + 0x24]
mov bh, byte [edx]
mov bl, bh
test bh, bh
jne 0xebe9c0
jmp 0xebec03
mov ecx, ebp
and ecx, 0xffffffe0
cmp ecx, 0xc0
jne 0xebea4b
cmp bl, 0xc2
jb 0xebe9f8
mov bh, byte [edx + 1]
movzx esi, bh
mov ecx, esi
and ecx, 0xffffffc0
cmp ecx, 0x80
jne 0xebeab4
and ebp, 0x1f
shl ebp, 6
add edx, 2
and esi, 0x3f
or esi, ebp
lea ecx, [eax + 2]
mov word [eax], si
jmp 0xebe9e2
mov ecx, ebp
and ecx, 0xfffffff0
cmp ecx, 0xe0
jne 0xebea75
movzx ecx, byte [edx + 1]
cmp bl, 0xed
je 0xebeabe
cmp ebp, 0xe0
jne 0xebeac7
mov ebx, ecx
add bl, 0x40
cmp bl, 0xe0
jb 0xebe9f4
jmp 0xebeac7
mov ecx, ebp
not ecx
or ecx, 0xf8
add ecx, ebp
cmp ecx, 0xef
jne 0xebebde
cmp bl, 0xf4
ja 0xebe9f8
movzx ecx, byte [edx + 1]
je 0xebeb11
cmp ebp, 0xf0
jne 0xebeb1a
mov bh, cl
add bh, 0x40
cmp bh, 0xd0
jb 0xebe9f4
jmp 0xebeb1a
inc edx
mov esi, dword [esp + 0x24]
jmp 0xebe9fa
cmp cl, 0x9f
ja 0xebe9f4
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0xebebe5
mov bh, byte [edx + 2]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0xebebeb
shl ebp, 0xc
and ecx, 0x3f
shl ecx, 6
or ecx, ebp
mov esi, dword [esp]
and esi, 0x3f
or esi, ecx
mov word [eax], si
lea ecx, [eax + 2]
add edx, 3
jmp 0xebe9e2
cmp cl, 0x8f
ja 0xebe9f4
mov esi, ecx
and esi, 0xffffffc0
cmp esi, 0x80
jne 0xebebe5
mov bh, byte [edx + 2]
movzx ebp, bh
mov esi, ebp
and esi, 0xffffffc0
cmp esi, 0x80
jne 0xebebeb
mov bh, byte [edx + 3]
movzx esi, bh
mov dword [esp], esi
and esi, 0xffffffc0
cmp esi, 0x80
jne 0xebebf7
and bl, 7
movzx esi, bl
shl esi, 0x12
and ecx, 0x3f
shl ecx, 0xc
or ecx, esi
and ebp, 0x3f
shl ebp, 6
or ebp, ecx
add edx, 4
mov ecx, ebp
and ecx, 0x1ff800
cmp ecx, 0xd800
je 0xebe9f4
mov ecx, dword [esp]
add ecx, ebp
add ecx, 0xffffff80
cmp ecx, 0x10000
jb 0xebe9f4
cmp edi, 2
jb 0xebebde
add ebp, 0xf0000
shr ebp, 0xa
and ebp, 0x3ff
or ebp, 0xd800
mov word [eax], bp
mov esi, 0x3ff
sub esi, ecx
not esi
or esi, ecx
and esi, 0x3ff
or esi, 0xdc00
lea ecx, [eax + 4]
mov word [eax + 2], si
jmp 0xebe9e2
mov ecx, eax
jmp 0xebe9e2
inc edx
jmp 0xebe9f4
add edx, 2
mov esi, dword [esp + 0x24]
jmp 0xebe9fa
add edx, 3
mov esi, dword [esp + 0x24]
jmp 0xebe9fa
mov word [eax], 0
sub eax, dword [esp + 0x18]
sar eax, 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xebf190
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x150
mov esi, esp
mov eax, dword [ebp + 8]
mov dword [esi + 0x13c], 0
mov dword [esi + 0x138], 0
mov dword [esi + 0x130], 0
mov dword [esi + 0x12c], 0
mov dword [esi + 0x128], 0
mov dword [esi + 0x124], 0
mov dword [esi + 0x120], 0
mov dword [esi + 0x11c], 0
mov dword [esi + 0x114], 0
mov dword [esi + 0x110], 0
mov dword [esi + 0x10c], 0
mov dword [esi + 0x108], 0
mov dword [esi + 0x104], 0x3c
mov dword [esi + 0x118], 0xffffffff
mov dword [esi + 0x134], 0xffffffff
mov edx, 0xfffffffe
mov ecx, dword [0xeff038]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + edx + 2], 0
lea edx, [edx + 2]
jne case.default.0xebf271
sar edx, 1
lea edi, [esi + 0x104]
push edi
push 0
push edx
push eax
call ecx
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0xef9ab4]
Function at 0xec0460
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x23c
mov dword [esp + 0x3c], 0x1785196d
mov dword [esp + 0x40], 0x138b1592
mov dword [esp + 0x44], 0xf9a1184
mov dword [esp + 0x48], 0xb590d6d
mov dword [esp + 0x4c], 0x7540945
mov dword [esp + 0x50], 0x3220554
mov dword [esp + 0x54], 0x3f550158
mov dword [esp + 0x58], 0x3ba83da5
mov dword [esp + 0x5c], 0x37a539a4
mov dword [esp + 0x60], 0x33bd35bf
mov dword [esp + 0x64], 0x2f5c3110
mov dword [esp + 0x68], 0x2b0a2d40
mov dword [esp + 0x6c], 0x27762979
mov dword [esp + 0x70], 0x23722576
mov dword [esp + 0x74], 0x5f7e2167
mov dword [esp + 0x78], 0x5bc35d37
mov dword [esp + 0x7c], 0x571c59ca
mov dword [esp + 0x80], 0x53155518
mov dword [esp + 0x84], 0x4fc65170
mov dword [esp + 0x88], 0x4b064d06
mov dword [esp + 0x8c], 0x47664911
mov dword [esp + 0x90], 0x43d24505
mov dword [esp + 0x94], 0x7fea41d0
mov dword [esp + 0x98], 0x7b117de1
mov dword [esp + 0x9c], 0x77e879e5
mov dword [esp + 0xa0], 0x73eb7503
mov dword [esp + 0xa4], 0x6f3d71fc
mov dword [esp + 0xa8], 0x6b256d21
mov dword [esp + 0xac], 0x67346923
mov dword [esp + 0xb0], 0x6328652b
mov dword [esp + 0xb4], 0x9fc66140
mov dword [esp + 0xb8], 0x9be29deb
mov dword [esp + 0xbc], 0x97e399f4
mov dword [esp + 0xc0], 0x93c695e0
mov dword [esp + 0xc4], 0x8f1a91b0
mov dword [esp + 0xc8], 0x8b1d8d15
mov dword [esp + 0xcc], 0x87a68915
mov dword [esp + 0xd0], 0x831f85ff
mov dword [esp + 0xd4], 0xbf29811f
mov dword [esp + 0xd8], 0xbbe3bd2f
mov dword [esp + 0xdc], 0xb7c9b998
mov dword [esp + 0xe0], 0xb33cb52c
mov dword [esp + 0xe4], 0xaf3bb123
mov dword [esp + 0xe8], 0xabf9ad31
mov dword [esp + 0xec], 0xa7f7a9f9
mov dword [esp + 0xf0], 0xa3f0a5ed
mov dword [esp + 0xf4], 0xdf8ca1f0
mov dword [esp + 0xf8], 0xdb88dd8c
mov dword [esp + 0xfc], 0xd7f6d988
mov dword [esp + 0x100], 0xd3b3d5bb
mov dword [esp + 0x104], 0xcfafd14a
mov dword [esp + 0x108], 0xcb53cd42
mov dword [esp + 0x10c], 0xc78bc99b
mov dword [esp + 0x110], 0xc389c58b
mov dword [esp + 0x114], 0xffb1c192
mov dword [esp + 0x118], 0xfbfafdb6
mov byte [esp + 0x11e], 0
mov word [esp + 0x11c], 0
mov eax, dword [0xeff02c]
mov ecx, 0x42dadf06
mov edx, 0xf9
movzx esi, byte [esp + ecx - 0x42dadeca]
mov edi, edx
and edi, 0x88
mov ebx, ecx
xor ebx, 0x88
or ebx, edi
xor ebx, esi
xor ebx, 0x88
add bl, 0xe2
mov byte [esp + ecx - 0x42dadeca], bl
inc ecx
dec edx
cmp ecx, 0x42dadfe9
jne 0xec06c0
lea ecx, [esp + 0x3c]
push 0
push 0
push 0
push 0
push ecx
call eax
mov ebx, eax
xor eax, eax
test ebx, ebx
setne al
jmp dword [eax*4 + 0xef9c64]
Function at 0xeccc20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0xeccc40
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0xeccc60
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0xeccc80
mov eax, 0xffffffff
jmp 0xeccc89
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.00ebc880
add esp, 4
movzx ecx, word [esi]
mov dword [esp + 4], eax
test cx, cx
je 0xecccc1
add esi, 2
mov eax, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0xecccb0
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [ebp]
test cx, cx
je 0xecccf3
lea edx, [ebp + 2]
mov esi, dword [esp + 4]
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0xeccce0
jmp 0xecccf7
mov esi, dword [esp + 4]
mov word [eax], 0
lea eax, [esp + 8]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.00ef4520
add esp, 0x14
not eax
shr eax, 0x1f
xor ebx, ebx
jmp dword [eax*4 + 0xefb00c]
Function at 0xed1100
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov edi, dword [esp + 0x60]
xor eax, eax
test edi, edi
setne al
xor ebx, ebx
mov dword [esp + 0x38], 0
mov dword [esp], 0
jmp dword [eax*4 + 0xefb654]
Function at 0xed8090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x90
push eax
mov dword [ebp - 0x10], esp
sub esp, 0x1c
mov ebx, esp
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x5c], 0xf935fbd7
mov dword [ebp - 0x58], 0xe576e768
mov dword [ebp - 0x54], 0xe10de328
mov dword [ebp - 0x50], 0xed01ef7c
mov dword [ebp - 0x4c], 0xe90eebc7
mov dword [ebp - 0x48], 0x957e9714
mov dword [ebp - 0x44], 0x9100930f
mov dword [ebp - 0x40], 0x9d759f7c
mov dword [ebp - 0x3c], 0x99749b02
mov dword [ebp - 0x38], 0x8518870f
mov dword [ebp - 0x34], 0x81668368
mov dword [ebp - 0x30], 0x8d108f70
mov dword [ebp - 0x2c], 0x89608b1d
mov dword [ebp - 0x28], 0xb522b71f
mov dword [ebp - 0x24], 0xb12fb35f
lea eax, [ebp - 0x20]
mov word [ebp - 0x20], 0xbfb0
mov dword [ebp - 0x1e], 0
mov byte [ebp - 0x1a], 0
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ecx
add dl, 0xab
xor dl, byte [ebp + ecx - 0x5c]
add dl, 0xa9
mov byte [ebp + ecx - 0x5c], dl
inc ecx
cmp ecx, 0x43
jne 0xed8130
lea esi, [ebp - 0x9a]
lea edx, [ebp - 0x5c]
mov edi, esi
mov ecx, 0xf
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [ebp - 0x5e]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov edi, dword [ebp - 0x10]
push edi
push 0
push 0
push 0x1e
push esi
push 0
call dword [0xf00370]
mov edi, dword [edi]
test edi, edi
jns 0xed8189
mov eax, 0xffffffff
jmp 0xed818c
lea eax, [edi + edi]
push eax
call fcn.00ebc880
add esp, 4
push dword [ebp - 0x10]
push edi
mov dword [ebp - 0x14], eax
push eax
push 0x1e
lea eax, [ebp - 0x9a]
push eax
push 0
call dword [0xf00370]
mov dword [ebx], 0x137a116c
mov dword [ebx + 4], 0x1f881d81
mov dword [ebx + 8], 0x1b771974
mov dword [ebx + 0xc], 0x7640596
mov dword [ebx + 0x10], 0x3900169
mov dword [ebx + 0x14], 0xf0e0d60
mov word [ebx + 0x18], 0
mov byte [ebx + 0x1a], 0
xor edx, edx
xor ecx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx eax, byte [ebx + ecx]
mov dword [ebp - 0x10], eax
mov edi, ecx
xor edi, 0x3cfb82b2
mov esi, edx
and esi, 0x1a
sub esi, edi
lea ebx, [esi + 0x1ed585b6]
and ebx, eax
mov eax, ebx
and eax, 0xfffffffd
mov edi, ebx
or edi, 0xfd
inc edi
imul edi, eax
mov eax, ebx
and eax, 2
or ebx, 2
imul ebx, eax
sub edi, ebx
mov ebx, dword [ebp - 0x18]
lea eax, [edi + esi]
add eax, 0x1ed585b6
add al, byte [ebp - 0x10]
add al, 0xec
mov byte [ebx + ecx], al
inc ecx
add edx, 2
cmp ecx, 0x1b
jne 0xed81f0
push 0
push 0
push ebx
mov esi, dword [ebp - 0x14]
push esi
push dword [ebp + 8]
call fcn.00ed35b0
add esp, 0x14
jmp dword [0xefbfc8]
Function at 0xed8290
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x21ec
call fcn.00ebc7e0
mov dword [esp + 0x11ec], 0x13601174
mov dword [esp + 0x11f0], 0x1f511d51
mov dword [esp + 0x11f4], 0x1b691951
mov dword [esp + 0x11f8], 0x7740578
mov dword [esp + 0x11fc], 0x3660179
mov dword [esp + 0x1200], 0xf7d0d71
mov dword [esp + 0x1204], 0xb780945
mov dword [esp + 0x1208], 0x3534
mov byte [esp + 0x120c], 0
mov eax, 0x5bc1284
mov ecx, 0x1243ed7b
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + eax - 0x5bc0098]
mov edi, ecx
and edi, 0x12018d58
mov edx, eax
and edx, 0x43810a7
or edx, edi
xor edx, esi
mov esi, edx
xor esi, 0xdf29d3cd
add edx, edx
and edx, 0x242302d4
xor edx, 0xb6030690
sub edx, esi
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
mov byte [esp + eax - 0x5bc0098], dl
inc eax
dec ecx
cmp eax, 0x5bc12a5
jne 0xed8310
lea eax, [esp + 0x34]
lea esi, [esp + 0x11ec]
push 0
push 0
push 0x20019
push eax
push esi
call fcn.00ef4c40
add esp, 0x14
shr eax, 0x1f
jmp dword [eax*4 + 0xefbfe0]

Function at 0xeda040
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x840
xor ebp, ebp
mov dword [esp + 8], 0
mov dword [esp], 0x20219
mov eax, 1
mov dword [esp + 4], 0
jmp dword [eax*4 + 0xefc648]
Function at 0xedb070
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
call fcn.00edb090
add esp, 4
test al, al
je 0xedba10
mov al, 1
ret
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xbc
push eax
mov dword [ebp - 0x2c], esp
sub esp, 0x24
mov esi, esp
push eax
mov dword [ebp - 0x10], esp
sub esp, 0x40
mov dword [ebp - 0x18], esp
sub esp, 0x44
mov eax, esp
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], eax
push eax
mov dword [ebp - 0x50], esp
push eax
mov dword [ebp - 0x4c], esp
push eax
mov dword [ebp - 0x34], esp
sub esp, 0x28
mov dword [ebp - 0x40], esp
sub esp, 8
mov dword [ebp - 0xc8], esp
sub esp, 8
mov dword [ebp - 0xc4], esp
sub esp, 8
mov dword [ebp - 0x44], esp
sub esp, 0x24
mov dword [ebp - 0x48], esp
mov dword [ebp - 0xc0], 0x9780b5b
mov dword [ebp - 0xbc], 0x58a0785
mov dword [ebp - 0xb8], 0x176037b
mov dword [ebp - 0xb4], 0x1d4e1f74
mov dword [ebp - 0xb0], 0x19961b63
mov dword [ebp - 0xac], 0x15161760
mov eax, 0x74b62903
nop
nop
nop
nop
nop
movzx ecx, byte [ebp + eax - 0x74b629c3]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xf1
mov byte [ebp + eax - 0x74b629c3], cl
inc eax
cmp eax, 0x74b6291b
jne 0xedbab0
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xa8], 0x3d001dc
mov dword [ebp - 0xa4], 0x7c105c1
mov dword [ebp - 0xa0], 0xbd909c1
mov dword [ebp - 0x9c], 0xfdc0dd8
mov dword [ebp - 0x98], 0x13ce11c9
mov dword [ebp - 0x94], 0x17d715d9
mov dword [ebp - 0x90], 0x1bd219db
mov dword [ebp - 0x8c], 0x1fd01dd5
mov dword [ebp - 0x88], 0x23fe21e5
mov dword [ebp - 0x84], 0x27e925f7
mov dword [ebp - 0x80], 0x2bfe29ee
mov dword [ebp - 0x7c], 0x2fef2dfb
mov dword [ebp - 0x78], 0x33f731e2
mov dword [ebp - 0x74], 0x37e035e8
mov dword [ebp - 0x70], 0x3bd639d9
mov dword [ebp - 0x6c], 0x3fdb3dca
mov dword [ebp - 0x68], 0xc311c11c
mov dword [ebp - 0x64], 0xc723c530
mov dword [ebp - 0x60], 0xcb27c929
mov word [ebp - 0x5c], 0xcdcc
mov dword [ebp - 0x5a], 0
mov eax, 0x39a40
mov ecx, 0x6fbc65bf
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ebp + eax - 0x39ae8]
mov esi, ecx
and esi, 0x46b4202c
mov edx, eax
and edx, 0x312d3
or edx, esi
xor edx, 0xd3
or edx, edi
lea esi, [ecx - 0x6fbc6500]
and esi, edi
not edx
or edx, esi
add dl, 0xc0
mov byte [ebp + eax - 0x39ae8], dl
inc eax
dec ecx
cmp eax, 0x39a92
jne 0xedbba0
lea eax, [ebp - 0xc0]
lea edi, [ebp - 0xa8]
push eax
push edi
call fcn.00eec4c0
add esp, 8
mov ebx, eax
xor eax, eax
test ebx, ebx
sete al
jmp dword [eax*4 + 0xefc7b8]
Function at 0xeddba0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xb8
mov dword [esp + 0x24], 0xc303c125
mov dword [esp + 0x28], 0xc756c554
mov dword [esp + 0x2c], 0xcb6bc90c
mov dword [esp + 0x30], 0xcf6fcd58
mov dword [esp + 0x34], 0xb30eb155
mov dword [esp + 0x38], 0xb719b57a
mov dword [esp + 0x3c], 0xbb1fb92c
mov dword [esp + 0x40], 0xbf1fbd2c
mov dword [esp + 0x44], 0xa349a104
mov dword [esp + 0x48], 0xa71aa54f
mov dword [esp + 0x4c], 0xab0fa93b
mov dword [esp + 0x50], 0xaf3dad3f
mov dword [esp + 0x54], 0x933d9139
mov dword [esp + 0x58], 0x9778953a
mov dword [esp + 0x5c], 0x9b379900
mov dword [esp + 0x60], 0x9f9e9d30
lea eax, [esp + 0x64]
mov dword [esp + 0x64], 0
mov ecx, 0xb0
mov edx, 0x4f
movzx ebx, byte [esp + ecx - 0x8c]
mov esi, ebx
not esi
or esi, edx
or ebx, ecx
and ebx, esi
add bl, 0x90
mov byte [esp + ecx - 0x8c], bl
inc ecx
dec edx
cmp ecx, 0xf4
jne 0xeddc40
lea ebx, [esp + 0x78]
lea edx, [esp + 0x24]
mov edi, ebx
mov ecx, 0x10
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0xb8]
xor ecx, ecx
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea esi, [esp + 0x74]
push esi
push 0
push 0
push 0x1f
push ebx
push 0
call dword [0xf00370]
mov edi, dword [esp + 0x74]
test edi, edi
jns 0xeddcac
mov eax, 0xffffffff
jmp 0xeddcaf
lea eax, [edi + edi]
push eax
call fcn.00ebc880
add esp, 4
mov ebp, eax
push esi
push edi
push eax
push 0x1f
push ebx
push 0
call dword [0xf00370]
lea eax, [esp + 0x18]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.00ef4520
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0xefca10]
Function at 0xedf570
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov esi, ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
cmp byte [ebx + eax], 0
lea eax, [eax + 1]
jne 0xedf590
add eax, ebx
dec eax
mov ecx, ebx
not ecx
and ecx, eax
xor eax, ebx
add ecx, ecx
sub ecx, eax
mov dword [esp + 4], ecx
lea ebp, [ecx + 1]
mov dword [esp + 8], ebp
push ebp
call fcn.00ebc880
add esp, 4
mov dword [esp], esi
mov dword [esi], eax
mov ecx, ebp
shr ecx, 2
mov edx, ebx
mov edi, eax
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebp
and edx, 0xfffffffc
add eax, edx
add edx, ebx
mov esi, ebp
and esi, 3
mov ecx, esi
shr ecx, 1
mov dword [esp + 0xc], edx
mov edi, eax
mov ebp, dword [esp + 0xc]
xchg esi, ebp
rep movsw word es:[edi], word [esi]
xchg esi, ebp
mov ebp, dword [esp + 8]
mov ecx, ebp
xor ecx, 2
and ecx, esi
je 0xedf612
and ebp, 2
add edx, ebp
add eax, ebp
push ecx
push edx
push eax
call fcn.00ebc8b0
add esp, 0xc
cmp dword [esp + 4], 0
je 0xedf6cb
mov ecx, 0xffffffff
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ebx + eax]
xor edi, ecx
mov ecx, edi
shr ecx, 1
mov edx, edi
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov esi, edx
shr esi, 1
mov ecx, edi
shl ecx, 0x1e
sar ecx, 0x1f
and ecx, 0xedb88320
xor ecx, esi
mov ebp, edi
shl ebp, 0x1d
sar ebp, 0x1f
and ebp, 0x76dc419
mov esi, edi
shl esi, 0x1c
sar esi, 0x1f
and esi, 0xedb8832
xor esi, ebp
mov ebp, edi
shl ebp, 0x1b
sar ebp, 0x1f
and ebp, 0x1db71064
shl edi, 0x1a
sar edi, 0x1f
and edi, 0x3b6e20c8
xor edi, ebp
xor edi, esi
mov esi, ecx
shr esi, 6
xor edi, esi
shl edx, 0x1a
sar edx, 0x1f
and edx, 0x76dc4190
xor edx, edi
shl ecx, 0x1a
sar ecx, 0x1f
and ecx, 0xedb88320
xor ecx, edx
inc eax
cmp dword [esp + 4], eax
jne 0xedf630
not ecx
jmp 0xedf6cd
xor ecx, ecx
mov eax, dword [esp]
mov dword [eax + 4], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xee69a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
call fcn.00ebe190
sub esp, 8
push eax
test ebx, ebx
sets al
mov ecx, ebx
sub ecx, 1
sete cl
or al, cl
mov ecx, ebx
sub ecx, 0x25
setge cl
or al, cl
test al, 1
jne 0xee69d7
jmp 0xee69dc
jmp 0xee6b5e
mov ecx, edi
mov eax, dword [ebp + 0x10]
add ecx, eax
add ecx, 0xffffffff
mov byte [edi + eax - 1], 0
cmp esi, 0
jne 0xee69ff
add ecx, 0xffffffff
jmp 0xee69f5
mov byte [ecx], 0x30
jmp 0xee69fa
jmp 0xee6b5a
cmp ebx, 0xa
sete al
test al, 1
jne 0xee6a0e
jmp 0xee6a9a
jmp 0xee6a10
cmp esi, 0x64
setae al
test al, 1
jne 0xee6a1c
jmp 0xee6a56
mov edi, 0x64
mov eax, esi
xor edx, edx
div edi
shl edx, 1
mov al, byte [edx + 0xef76d9]
mov edi, ecx
add edi, 0xffffffff
mov byte [ecx - 1], al
mov al, byte [edx + 0xef76d8]
add edi, 0xffffffff
mov byte [ecx - 2], al
mov ecx, 0x64
mov eax, esi
xor edx, edx
div ecx
mov esi, eax
mov ecx, edi
jmp 0xee6a10
cmp esi, 0xa
setb al
test al, 1
jne 0xee6a62
jmp 0xee6a73
mov dl, byte [esi + 0xef7fd5]
mov eax, ecx
add eax, 0xffffffff
mov byte [ecx - 1], dl
jmp 0xee6a93
shl esi, 1
mov dl, byte [esi + 0xef76d9]
mov eax, ecx
add eax, 0xffffffff
mov byte [ecx - 1], dl
mov dl, byte [esi + 0xef76d8]
add eax, 0xffffffff
mov byte [ecx - 2], dl
jmp 0xee6a93
mov ecx, eax
jmp 0xee6b5a
cmp ebx, 0x10
je 0xee6aa4
jmp 0xee6b2b
jmp 0xee6aa6
cmp esi, 0x100
jb 0xee6adb
mov edx, esi
and edx, 0xff
shl edx, 1
mov bl, byte [edx + 0xef77a2]
mov eax, ecx
add eax, 0xffffffff
mov byte [ecx - 1], bl
mov dl, byte [edx + 0xef77a1]
add eax, 0xffffffff
mov byte [ecx - 2], dl
shr esi, 8
mov ecx, eax
jmp 0xee6aa6
cmp esi, 0x10
jae 0xee6aee
mov al, byte [esi + 0xef7fd5]
add ecx, 0xffffffff
mov byte [ecx], al
jmp 0xee6b5a
mov edx, esi
and edx, 0xfffffffd
mov eax, esi
or eax, 0xfffffffd
xor eax, 0xffffffff
imul eax, edx
mov edx, esi
and edx, 2
or esi, 2
imul esi, edx
add esi, eax
mov al, byte [esi + 0xef77a2]
mov edx, ecx
add edx, 0xffffffff
mov byte [ecx - 1], al
mov al, byte [esi + 0xef77a1]
add edx, 0xffffffff
mov byte [ecx - 2], al
mov ecx, edx
jmp 0xee6b5a
cmp esi, 0
seta al
test al, 1
jne 0xee6b37
jmp 0xee6b58
mov eax, esi
xor edx, edx
div ebx
mov al, byte [edx + 0xef7fd5]
mov edi, ecx
add edi, 0xffffffff
mov byte [ecx - 1], al
mov eax, esi
xor edx, edx
div ebx
mov esi, eax
mov ecx, edi
jmp 0xee6b2b
jmp 0xee6b5a
mov edi, ecx
jmp 0xee6b5e
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xeee210
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x18]
xor ecx, ecx
test eax, eax
setne cl
jmp dword [ecx*4 + 0xefe10c]

Function at 0xeee2c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, ecx
mov ebx, dword [esp + 0x24]
mov dword [esp + 8], 0
mov dword [esp], 0xf4f5f6f7
mov eax, 0x92bb3fd4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x6d44c02c]
xor ecx, eax
mov edx, ecx
not edx
add ecx, 0x2257c0db
or edx, ecx
and edx, 1
or ecx, 1
add ecx, edx
mov byte [esp + eax + 0x6d44c02c], cl
inc eax
cmp eax, 0x92bb3fd8
jne 0xeee2f0
mov edi, dword [esp]
mov eax, dword [0xf00374]
test eax, eax
je 0xeee376
xor ecx, ecx
mov edx, dword [0xf00378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ecx*8], 0x9abdb589
je 0xeee350
inc ecx
cmp eax, ecx
jne 0xeee340
jmp 0xeee376
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0xeee376
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 5
push 4
push dword [0xf0037c]
push eax
call fcn.00ef0f10
add esp, 0x1c
mov edi, eax
mov dword [esp], 0xff3e393c
mov byte [esp + 4], 0
mov eax, 0x7302b58a
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x7302b58a]
xor ecx, eax
mov edx, ecx
and edx, 0x4d
xor ecx, 0x4d
lea ecx, [ecx + edx*2]
inc cl
mov byte [esp + eax - 0x7302b58a], cl
inc eax
cmp eax, 0x7302b58f
jne 0xeee390
cmp edi, dword [esp]
jne 0xeee4c5
mov dword [esp + 0xc], esi
push dword [esp + 8]
call fcn.00eee1b0
add esp, 4
mov ebp, dword [esp + 8]
mov dword [esp], 0xf4f5f6f7
mov edx, 0x92bb3fd4
nop
movzx ecx, byte [esp + edx + 0x6d44c02c]
xor ecx, edx
mov esi, ecx
not esi
add ecx, 0x2257c0db
or esi, ecx
and esi, 1
or ecx, 1
add ecx, esi
mov byte [esp + edx + 0x6d44c02c], cl
inc edx
cmp edx, 0x92bb3fd8
jne 0xeee3e0
mov edi, dword [esp]
mov edx, dword [0xf00374]
test edx, edx
je 0xeee465
xor ecx, ecx
mov esi, dword [0xf00378]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + ecx*8], 0x9abdb589
je 0xeee440
inc ecx
cmp edx, ecx
jne 0xeee430
jmp 0xeee465
mov edx, dword [esi + ecx*8 + 4]
cmp edx, edi
je 0xeee465
push 0
push ebp
push eax
push 5
push 4
push dword [0xf0037c]
push edx
mov esi, eax
call fcn.00ef0f10
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0xeee4bc
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + edi]
movzx ebp, word [ebx + edi]
test si, si
je 0xeee495
add edi, 2
cmp si, bp
je 0xeee480
cmp si, bp
je 0xeee4a7
mov esi, dword [ecx]
test esi, esi
jne 0xeee470
mov edi, 0xc0000225
jmp 0xeee4bc
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0xc]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.00eee210
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 4