joyce8/EMBER2024-capa huggingface dataset:
Function at 0x585180
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x4c], 1
mov esi, dword [edi + 0x1c0]
mov dword [ebp - 0x18], esi
jne 0x5851a6
mov eax, 0x1fe
mov byte [esi + 0x1c], 1
jmp 0x5851ab
xor eax, eax
mov byte [esi + 0x1c], al
push dword [edi + 0x64]
mov ecx, dword [edi + 4]
mov dword [ebp - 4], eax
add eax, 0x100
push eax
push 1
mov eax, dword [ecx + 8]
push edi
call eax
xor ebx, ebx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
mov dword [ebp - 8], ebx
cmp dword [edi + 0x64], ebx
jle 0x5852b9
nop dword [eax]
mov ecx, dword [esi + ebx*4 + 0x20]
cdq
idiv ecx
cmp dword [ebp - 4], 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
je 0x5851fd
mov eax, dword [esi + 0x18]
add dword [eax + ebx*4], 0xff
mov eax, dword [esi + 0x18]
mov edi, dword [eax + ebx*4]
lea eax, [ecx + 0xfe]
lea ecx, [ecx*2 - 2]
cdq
idiv ecx
xor ebx, ebx
mov dword [ebp - 0x14], edi
mov edx, eax
xor esi, esi
nop dword [eax]
cmp esi, edx
jle 0x585255
mov ecx, dword [ebp - 0x10]
imul eax, ebx, 0x1fe
lea edi, [ecx*2 - 2]
add ecx, 0xfe
add ecx, eax
nop dword [eax]
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x585240
mov edi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
movzx eax, bl
movzx ecx, cl
imul ecx, eax
mov byte [esi + edi], cl
inc esi
cmp esi, 0xff
jle 0x585220
cmp dword [ebp - 4], 0
je 0x5852a0
mov ecx, 1
lea edx, [edi - 1]
nop dword [eax + eax]
movzx eax, byte [edi]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [edi + 0xff]
mov byte [edi + ecx + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x585280
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 8], ebx
cmp ebx, dword [eax + 0x64]
mov eax, dword [ebp - 0xc]
jl 0x5851e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5a2c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x5a2cd0
mov ecx, dword [esi]
xor eax, eax
push ebx
push edi
xor edi, edi
mov byte [ecx + 0x16], al
mov ecx, dword [esi]
mov byte [ecx + 0x17], al
mov ecx, dword [esi]
mov byte [ecx + 0x18], al
mov ecx, dword [esi]
mov byte [ecx + 0x19], al
mov ebx, dword [esi + 4]
test ebx, ebx
jle 0x5a2c80
mov esi, dword [esi]
movzx edx, byte [esi + edi]
mov ecx, eax
shr ecx, 0x18
inc edi
xor edx, ecx
shl eax, 8
xor eax, dword [edx*4 + 0x7127b0]
cmp edi, ebx
jl 0x5a2c63
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0xc]
xor edi, edi
test ebx, ebx
jle 0x5a2cad
mov esi, dword [esi + 8]
nop dword [eax]
movzx edx, byte [esi + edi]
mov ecx, eax
shr ecx, 0x18
inc edi
xor edx, ecx
shl eax, 8
xor eax, dword [edx*4 + 0x7127b0]
cmp edi, ebx
jl 0x5a2c90
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov edx, eax
shr edx, 8
pop edi
pop ebx
mov byte [ecx + 0x16], al
mov ecx, dword [esi]
mov byte [ecx + 0x17], dl
mov edx, eax
mov ecx, dword [esi]
shr edx, 0x10
shr eax, 0x18
mov byte [ecx + 0x18], dl
mov ecx, dword [esi]
mov byte [ecx + 0x19], al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5c2be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x93d814]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x128], eax
push esi
mov esi, dword [ebp + 0xc]
cmp ebx, 8
jae 0x5c2c1e
pop esi
mov eax, 0xffffff7c
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c33e1
mov esp, ebp
pop ebp
ret
cmp dword [esi], 0x7375704f
jne 0x5c2c09
cmp dword [esi + 4], 0x64616548
jne 0x5c2c09
cmp ebx, 9
jae 0x5c2c49
pop esi
mov eax, 0xffffff7b
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c33e1
mov esp, ebp
pop ebp
ret
movzx eax, byte [esi + 8]
mov dword [ebp - 0x124], eax
cmp eax, 0xf
jle 0x5c2c6d
pop esi
mov eax, 0xffffff7a
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c33e1
mov esp, ebp
pop ebp
ret
cmp ebx, 0x13
jb 0x5c2c34
movzx ecx, byte [esi + 0xb]
movzx eax, byte [esi + 0xa]
shl ecx, 8
or ecx, eax
lea eax, [esi + 0xc]
push edi
movzx edi, byte [esi + 9]
push eax
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x11c], ecx
call fcn.005c2ab0
movzx ecx, byte [esi + 0x11]
add esp, 4
shl ecx, 8
mov dword [ebp - 0x118], eax
movzx eax, byte [esi + 0x10]
or ecx, eax
xor ecx, 0x8000
sub ecx, 0x8000
mov dword [ebp - 0x114], ecx
movzx ecx, byte [esi + 0x12]
mov dword [ebp - 0x110], ecx
test ecx, ecx
jne 0x5c2d14
dec edi
cmp edi, 1
ja 0x5c2dda
cmp dword [ebp - 0x124], 1
jg 0x5c2ceb
cmp ebx, 0x13
ja 0x5c2dda
mov ebx, dword [ebp - 0x128]
mov dword [ebp - 0x10c], 1
mov dword [ebp - 0x108], edi
test ebx, ebx
je 0x5c2dc7
mov word [ebx + 0x20], 0x100
jmp 0x5c2db5
cmp ecx, 1
jne 0x5c2df0
lea eax, [edi - 1]
cmp eax, 7
ja 0x5c2dda
lea eax, [edi + 0x15]
cmp ebx, eax
jb 0x5c2dda
cmp dword [ebp - 0x124], ecx
jg 0x5c2d44
cmp ebx, eax
ja 0x5c2dda
movzx eax, byte [esi + 0x13]
mov dword [ebp - 0x10c], eax
cmp eax, 1
jl 0x5c2dda
movzx ecx, byte [esi + 0x14]
mov dword [ebp - 0x108], ecx
cmp ecx, eax
jg 0x5c2dda
test edi, edi
jle 0x5c2d9a
add eax, ecx
mov ebx, 0xffffffeb
mov dword [ebp - 0x12c], eax
lea ecx, [esi + 0x15]
sub ebx, esi
nop dword [eax + eax]
mov dl, byte [ecx]
movzx eax, dl
cmp eax, dword [ebp - 0x12c]
jl 0x5c2d92
cmp dl, 0xff
jne 0x5c2dda
inc ecx
lea eax, [ebx + ecx]
cmp eax, edi
jl 0x5c2d80
mov ebx, dword [ebp - 0x128]
test ebx, ebx
je 0x5c2dc7
push edi
lea eax, [esi + 0x15]
push eax
lea eax, [ebx + 0x20]
push eax
call fcn.005c6210
add esp, 0xc
push 0x20
lea eax, [ebp - 0x124]
push eax
push ebx
call fcn.005c6210
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c33e1
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffff7b
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c33e1
mov esp, ebp
pop ebp
ret
cmp ecx, 0xff
mov eax, 0xffffff7b
mov ecx, dword [ebp - 4]
mov edx, 0xffffff7e
pop edi
cmove eax, edx
xor ecx, ebp
pop esi
pop ebx
call fcn.005c33e1
mov esp, ebp
pop ebp
ret

Function at 0x5d7c6a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005d7ae7

Function at 0x5dca5b
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005dc6fd
Function at 0x6b4fc0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 8
test edx, edx
jle 0x6b5125
mov ecx, dword [ebp + 8]
movss xmm4, dword [0x736fd0]
add ecx, 0x28
movss xmm3, dword [0x6ee148]
nop word [eax + eax]
mov eax, dword [ecx - 8]
movss xmm0, dword [ecx - 0x28]
mov dword [ebp - 8], eax
subss xmm0, dword [ebp - 8]
mov eax, dword [ecx - 4]
mov dword [ebp - 4], eax
movss dword [ecx - 8], xmm0
movss xmm0, dword [ecx - 0x24]
subss xmm0, dword [ebp - 4]
movss dword [ecx - 4], xmm0
movss xmm0, dword [ecx - 0x28]
addss xmm0, dword [ebp - 8]
movss dword [ecx - 0x28], xmm0
movss xmm0, dword [ecx - 0x24]
addss xmm0, dword [ebp - 4]
movss dword [ecx - 0x24], xmm0
movss xmm2, dword [ecx + 4]
movss xmm0, dword [ecx - 0x20]
movaps xmm1, xmm2
addss xmm1, dword [ecx]
subss xmm2, dword [ecx]
mulss xmm1, xmm3
mulss xmm2, xmm3
subss xmm0, xmm1
movss dword [ecx], xmm0
movss xmm0, dword [ecx - 0x1c]
subss xmm0, xmm2
movss dword [ecx + 4], xmm0
addss xmm1, dword [ecx - 0x20]
movss xmm0, dword [ecx - 0x1c]
addss xmm0, xmm2
movss dword [ecx - 0x20], xmm1
movss dword [ecx - 0x1c], xmm0
movss xmm1, dword [ecx + 0xc]
movss xmm0, dword [ecx - 0x18]
movss xmm2, dword [ecx + 8]
subss xmm0, xmm1
xorps xmm2, xmm4
movss dword [ecx + 8], xmm0
movss xmm0, dword [ecx - 0x14]
subss xmm0, xmm2
movss dword [ecx + 0xc], xmm0
movss xmm0, dword [ecx - 0x18]
addss xmm0, xmm1
movss dword [ecx - 0x18], xmm0
movss xmm0, dword [ecx - 0x14]
addss xmm0, xmm2
movss dword [ecx - 0x14], xmm0
movss xmm2, dword [ecx + 0x14]
movss xmm0, dword [ecx - 0x10]
movaps xmm1, xmm2
subss xmm1, dword [ecx + 0x10]
xorps xmm2, xmm4
subss xmm2, dword [ecx + 0x10]
mulss xmm1, xmm3
mulss xmm2, xmm3
subss xmm0, xmm1
movss dword [ecx + 0x10], xmm0
movss xmm0, dword [ecx - 0xc]
subss xmm0, xmm2
movss dword [ecx + 0x14], xmm0
movss xmm0, dword [ecx - 0xc]
addss xmm1, dword [ecx - 0x10]
addss xmm0, xmm2
movss dword [ecx - 0x10], xmm1
movss dword [ecx - 0xc], xmm0
add ecx, 0x40
sub edx, 1
jne 0x6b4ff0
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1000c2c7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002b19c]
jne 0x1000c2d1
repz ret
jmp fcn.10011efc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403910
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040fe], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404670], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x404604], eax
mov dword [0x4040f6], eax
mov dword [0x4045f0], 0x30
mov dword [0x4045f4], 2
jmp 0x403955
mov dword [0x4045f8], 0x402f69
mov dword [0x4045fc], 0
mov dword [0x404600], 0
mov dword [0x404618], 0x404564
mov dword [0x404610], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x404608], eax
mov dword [0x40461c], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x40460c], eax
push 0x4045f0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4040f6]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.asdlkjalsdj_ai8
push str.first
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404668], eax
push 5
push dword [0x404668]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404668]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404620]
jmp 0x403a29
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a1b
mov eax, dword [0x404628]
jmp 0x403a44
call 0x402a90
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x401c66
pop dword [ebp - 8]
mov eax, 0x401c66
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x1b12aa47
sub dword [ebp - 0x18], 0xccc064fc
mov dword [ebp - 0x14], 0xfd8897ac
add dword [ebp - 0x14], 0x34aab499
mov dword [ebp - 0x10], 0x92ece505
sub dword [ebp - 0x10], 0x46a0a0d7
mov dword [ebp - 0xc], 0xb30c9e14
add dword [ebp - 0xc], 0x4cf361ec
lea eax, [ebp - 0x18]
push eax
mov eax, 0x3090d9f
add eax, 0xfd3722b5
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x685f0d44
add dword [ebp - 0x18], 0xc135c12
mov dword [ebp - 0x14], 0x1caa2d87
add dword [ebp - 0x14], 0x24c233ee
mov dword [ebp - 0x10], 0x42ad9b8d
add dword [ebp - 0x10], 0x20c1d0df
mov dword [ebp - 0xc], 0x2e10511c
sub dword [ebp - 0xc], 0x2e10511c
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x8545b322
sub eax, 0x850582f6
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x33036
push 0
call eax
mov ecx, 0x632fca3e
add ecx, 0x9cd06fe3
xor edx, edx
add edx, eax
mov ebx, 0x407000
add ebx, dword [ebp - 8]
mov edi, 0xa874f31e
add edi, 0xe3766598
xor dword [ebp - 4], eax
mov esi, dword [ebx]
add dword [ebp - 4], 0x6a23c8ce
sub esi, edi
add dword [ebp - 4], 0xed4a586f
mov dword [edx], esi
add edx, 0xcde9d239
sub edx, 0xcde9d235
add ebx, 0x6128e834
sub ebx, 0x6128e830
loop 0x401d7f
add eax, 0x352653e1
sub eax, 0x3525788a
mov ebx, eax
add eax, 0x6901667f
sub eax, 0x6901667a
mov ecx, 0xf2788bb1
sub ecx, 0xf2388bb1
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x40f3a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov esp, 0x44fffffc
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0040eb2b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040eae0
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0040eb2b
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040eae0
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], pe_nt_image_headers32
invalid
Function at 0x4419fa
Capabilities:
Delete file
Set file attributes

Disassembly:
push 8
mov eax, 0x470332
call fcn.004436f6
push 4
sub esp, 0x30
mov ecx, esp
mov dword [ebp - 0x14], esp
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0xd]
push eax
push dword [ebp + 8]
call fcn.0040ca90
and dword [ebp - 4], 0
or dword [ebp - 4], 0xffffffff
call fcn.00456412
add esp, 0x34
test al, al
jne 0x441a38
mov eax, esi
jmp 0x441a78
push dword [ebp + 8]
xor edi, edi
call fcn.0044089e
test eax, eax
jne 0x441a76
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x8001
call esi
push 0x80
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
test eax, eax
pop eax
push 0
cmovne edi, eax
call esi
mov eax, edi
call fcn.004436c4
ret 4
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10007c2e
pop dword [ebp - 0x28]
mov eax, 0x5e1713df
sub eax, 0x4e1697b1
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x7daac4f5
sub dword [ebp - 0x38], 0x2f587faa
mov dword [ebp - 0x34], 0x607f2368
add dword [ebp - 0x34], 0xd1b428dd
mov dword [ebp - 0x30], 0x4249891f
sub dword [ebp - 0x30], 0xf5fd44f1
mov dword [ebp - 0x2c], 0x5b9e4c68
add dword [ebp - 0x2c], 0xa461b398
lea eax, [ebp - 0x38]
push eax
mov eax, 0xca6cb543
add eax, 0x4593cb11
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xa1624fa
sub dword [ebp - 0x38], 0x95a3bba4
mov dword [ebp - 0x34], 0xb2a2be05
add dword [ebp - 0x34], 0x8ec9a370
mov dword [ebp - 0x30], 0x664b9155
sub dword [ebp - 0x30], 0x2dc24e9
mov dword [ebp - 0x2c], 0x9affcc10
sub dword [ebp - 0x2c], 0x9affcc10
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x413d37df
add eax, 0xcec34871
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x31f8e
push 0
call eax
mov ecx, 0x314c3e97
add ecx, 0xceb3f6a1
xor edi, edi
add edi, eax
mov edx, 0xe933096f
add edx, 0x26cdf091
add edx, dword [ebp - 0x28]
mov esi, 0xd54ada46
sub dword [ebp - 0x1c], 0xca19b0dd
mov ebx, dword [edx]
xor dword [ebp - 0x14], ecx
xor ebx, esi
mov dword [edi], ebx
add dword [ebp - 0xc], edx
add edi, 0xce18e630
add edi, 0x31e719d4
add edx, 4
loop 0x10007d4c
add eax, 0x3cd7d6b7
sub eax, 0x3cd70f04
mov ebx, eax
add eax, 0xbc92d413
sub eax, 0xbc92d40e
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10002950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebx + 0x2c]
push edi
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
mov eax, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x2c]
lea edx, [esi + ecx - 0x106]
sub edi, eax
cmp eax, edx
jae 0x10002a6f
mov dword [ebp - 4], edi
mov edi, dword [ebx]
cmp dword [edi + 4], 0
jne 0x1000298e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x74]
add eax, dword [ebx + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [ebx + 0x38]
mov ebx, ecx
mov dword [ebp - 8], eax
cmp ebx, dword [ebp - 4]
ja 0x1000fe17
test ebx, ebx
je 0x1000fe1f
mov edx, dword [edi + 0x1c]
sub ecx, ebx
mov dword [edi + 4], ecx
cmp dword [edx + 0x18], 1
push ebx
jne 0x1000fe26
mov eax, dword [edi]
push eax
mov eax, dword [edi + 0x30]
push eax
call sym.zlibwapi.dll_adler32
mov ecx, dword [ebp - 8]
mov dword [edi + 0x30], eax
mov eax, dword [edi]
push ebx
push eax
push ecx
call fcn.10009fe0
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
mov eax, ebx
mov edi, dword [ebp + 8]
add dword [edi + 0x74], eax
mov edx, dword [edi + 0x74]
cmp edx, 3
jb 0x10002a14
mov ebx, dword [edi + 0x6c]
add ebx, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx eax, byte [ebx]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [ebx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp edx, 0x106
jb 0x1000fe39
mov eax, dword [edi + 0x16c0]
mov ecx, dword [edi + 0x3c]
cmp eax, ecx
jae 0x10002987
mov esi, dword [edi + 0x6c]
add esi, edx
cmp eax, esi
jae 0x1000fe46
sub ecx, esi
mov ebx, 0x102
cmp ecx, 0x102
ja 0x10002a4f
mov ebx, ecx
mov ecx, dword [edi + 0x38]
push ebx
add ecx, esi
push 0
push ecx
call fcn.10009790
add esp, 0xc
add ebx, esi
mov dword [edi + 0x16c0], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx + 0x38]
push esi
lea ecx, [eax + esi]
push ecx
push eax
call fcn.10009fe0
mov edx, dword [ebx + 0x4c]
mov eax, dword [ebx + 0x44]
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
add esp, 0xc
sub dword [ebx + 0x5c], esi
lea eax, [eax + edx*2]
movzx ecx, word [eax - 2]
sub eax, 2
cmp ecx, esi
jae 0x10002ace
xor ecx, ecx
dec edx
mov word [eax], cx
jne 0x10002a92
mov ecx, dword [ebx + 0x40]
mov edx, esi
lea ecx, [ecx + esi*2]
lea ecx, [ecx]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, esi
jb 0x10002aca
sub eax, esi
dec edx
mov word [ecx], ax
jne 0x10002ab0
add edi, esi
jmp 0x1000297c
xor eax, eax
jmp 0x10002abd
sub ecx, esi
jmp 0x10002a9f
mov ebx, edi
jmp 0x1000295f
mov ebx, dword [ebp - 4]
jmp 0x100029a8
xor eax, eax
jmp 0x100029e9
push 1
push 0
push eax
push edi
call fcn.100142e4
add esp, 0x14
jmp 0x100029e9
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x1000fe10
jmp 0x10002a20
lea edx, [esi + 0x102]
cmp eax, edx
jae 0x10002987
sub esi, eax
add esi, 0x102
sub ecx, eax
cmp esi, ecx
jbe 0x1000fe64
mov esi, ecx
mov ecx, dword [edi + 0x38]
push esi
add ecx, eax
push 0
push ecx
call fcn.10009790
add esp, 0xc
add dword [edi + 0x16c0], esi
jmp 0x10002987
Function at 0x100049e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x10004a05
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x10004a1d
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x10004a4c
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x10004a8e
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x10004b62
sub edx, 0x10000
js 0x10004b62
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x10004a74
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x10004a74
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x10004ae5
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x10004ae2
add edx, 8
jne 0x10004ac9
jmp 0x10004b53
add edx, 4
test eax, 0xffff
jne 0x10004af2
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x10004b53
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x10004b26
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x10004a74
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x10004b62
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x10004a74
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x10004b73
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x10008b53
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10022388]
jne 0x10008b5d
repz ret
jmp fcn.1000c9a5