joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10024dd0
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10042086
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x484
mov dword [ebp - 0x480], ecx
jmp 0x10024e06
movzx eax, byte [ebp + 8]
push eax
call fcn.10024d40
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x100250f4
call fcn.10001460
movzx ecx, al
test ecx, ecx
je 0x100250f4
mov byte [ebp - 0x45c], 0x47
mov byte [ebp - 0x45b], 0x61
mov byte [ebp - 0x45a], 0x6d
mov byte [ebp - 0x459], 0x65
mov byte [ebp - 0x458], 0x20
mov byte [ebp - 0x457], 0x49
mov byte [ebp - 0x456], 0x6e
mov byte [ebp - 0x455], 0x74
mov byte [ebp - 0x454], 0x65
mov byte [ebp - 0x453], 0x67
mov byte [ebp - 0x452], 0x72
mov byte [ebp - 0x451], 0x69
mov byte [ebp - 0x450], 0x74
mov byte [ebp - 0x44f], 0x79
mov byte [ebp - 0x44e], 0x20
mov byte [ebp - 0x44d], 0x66
mov byte [ebp - 0x44c], 0x61
mov byte [ebp - 0x44b], 0x69
mov byte [ebp - 0x44a], 0x6c
mov byte [ebp - 0x449], 0x65
mov byte [ebp - 0x448], 0x64
mov byte [ebp - 0x447], 0x2e
mov byte [ebp - 0x446], 0x20
mov byte [ebp - 0x445], 0x54
mov byte [ebp - 0x444], 0x72
mov byte [ebp - 0x443], 0x79
mov byte [ebp - 0x442], 0x20
mov byte [ebp - 0x441], 0x74
mov byte [ebp - 0x440], 0x6f
mov byte [ebp - 0x43f], 0x20
mov byte [ebp - 0x43e], 0x64
mov byte [ebp - 0x43d], 0x69
mov byte [ebp - 0x43c], 0x73
mov byte [ebp - 0x43b], 0x61
mov byte [ebp - 0x43a], 0x62
mov byte [ebp - 0x439], 0x6c
mov byte [ebp - 0x438], 0x65
mov byte [ebp - 0x437], 0x20
mov byte [ebp - 0x436], 0x61
mov byte [ebp - 0x435], 0x6e
mov byte [ebp - 0x434], 0x74
mov byte [ebp - 0x433], 0x69
mov byte [ebp - 0x432], 0x76
mov byte [ebp - 0x431], 0x69
mov byte [ebp - 0x430], 0x72
mov byte [ebp - 0x42f], 0x75
mov byte [ebp - 0x42e], 0x73
mov byte [ebp - 0x42d], 0x65
mov byte [ebp - 0x42c], 0x73
mov byte [ebp - 0x42b], 0x20
mov byte [ebp - 0x42a], 0x74
mov byte [ebp - 0x429], 0x68
mov byte [ebp - 0x428], 0x65
mov byte [ebp - 0x427], 0x6e
mov byte [ebp - 0x426], 0x20
mov byte [ebp - 0x425], 0x74
mov byte [ebp - 0x424], 0x72
mov byte [ebp - 0x423], 0x79
mov byte [ebp - 0x422], 0x20
mov byte [ebp - 0x421], 0x61
mov byte [ebp - 0x420], 0x67
mov byte [ebp - 0x41f], 0x61
mov byte [ebp - 0x41e], 0x69
mov byte [ebp - 0x41d], 0x6e
mov byte [ebp - 0x41c], 0
lea edx, [ebp - 0x45c]
push edx
push 0x2000
lea eax, [ebp - 0x414]
push eax
call fcn.1003d8b0
add esp, 0xc
call fcn.100049d0
movzx ecx, al
test ecx, ecx
je 0x10025047
mov ecx, dword [0x10067830]
call fcn.10001480
push eax
push 0
lea edx, [ebp - 0x414]
push edx
push 1
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [0x10067834]
call fcn.10010200
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x10025106
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10025190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
jmp 0x100251ab
push 7
push 0
push 0x10025120
mov ecx, dword [0x10068360]
call fcn.10025340
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100252af
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x37
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
mov ecx, dword [0x10067830]
call fcn.10001480
push eax
push 0
lea eax, [ebp - 0x34]
push eax
push 0
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [0x10067834]
call fcn.10010200
jmp 0x100252c1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10025340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 4
call fcn.10001460
movzx eax, al
test eax, eax
je 0x100253be
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0xffffffffffffffff
push 0
push 0x1fffff
lea ecx, [ebp - 8]
push ecx
mov edx, dword [0x1006782c]
mov eax, dword [edx + 0x11c]
call eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x100253b9
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [0x10067838]
call fcn.10024800
mov eax, dword [ebp - 8]
jmp 0x1002548e
jmp 0x1002548c
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
mov edx, dword [0x1006782c]
mov eax, dword [edx + 0x114]
call eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1002548c
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x38]
call fcn.100257a0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jae 0x10025478
mov byte [ebp - 0x34], 0x54
mov byte [ebp - 0x33], 0x68
mov byte [ebp - 0x32], 0x72
mov byte [ebp - 0x31], 0x65
mov byte [ebp - 0x30], 0x61
mov byte [ebp - 0x2f], 0x64
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x63
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x61
mov byte [ebp - 0x29], 0x74
mov byte [ebp - 0x28], 0x69
mov byte [ebp - 0x27], 0x6f
mov byte [ebp - 0x26], 0x6e
mov byte [ebp - 0x25], 0x20
mov byte [ebp - 0x24], 0x71
mov byte [ebp - 0x23], 0x75
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x72
mov byte [ebp - 0x20], 0x79
mov byte [ebp - 0x1f], 0x20
mov byte [ebp - 0x1e], 0x66
mov byte [ebp - 0x1d], 0x61
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], 0x64
mov byte [ebp - 0x18], 0x21
mov byte [ebp - 0x17], 0
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [0x10067838]
call fcn.10024800
mov eax, dword [ebp - 8]
jmp 0x1002548e
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100254a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
jmp 0x100254bb
cmp dword [ebp + 8], 0
jne 0x100254c6
jmp 0x1002556f
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x1006782c]
mov edx, dword [ecx + 0x194]
call edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x102
je 0x1002555d
mov byte [ebp - 0x1c], 0x54
mov byte [ebp - 0x1b], 0x68
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x4b
mov byte [ebp - 0x14], 0x69
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0x12], 0x6c
mov byte [ebp - 0x11], 0x20
mov byte [ebp - 0x10], 0x44
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0
mov ecx, dword [0x10067830]
call fcn.10001480
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [0x10067834]
call fcn.10010200
jmp 0x1002556f
mov esp, ebp
pop ebp
ret 4

Function at 0x10025580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
jmp 0x1002559b
cmp dword [ebp + 8], 0
jne 0x100255a6
jmp 0x1002565a
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x1006782c]
mov edx, dword [ecx + 0x198]
call edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10025648
mov byte [ebp - 0x1c], 0x54
mov byte [ebp - 0x1b], 0x68
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x53
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xe], 0x20
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x63
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x64
mov byte [ebp - 5], 0
mov ecx, dword [0x10067830]
call fcn.10001480
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [0x10067834]
call fcn.10010200
jmp 0x1002565a
mov esp, ebp
pop ebp
ret 4
Function at 0x10026e30
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100420a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
mov dword [ebp - 0x64], ecx
jmp 0x10026e60
call fcn.10026950
push 5
push 0
push 0x10026dd0
mov ecx, dword [0x10068360]
call fcn.10025340
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10026ff2
mov byte [ebp - 0x40], 0x45
mov byte [ebp - 0x3f], 0x52
mov byte [ebp - 0x3e], 0x52
mov byte [ebp - 0x3d], 0x4f
mov byte [ebp - 0x3c], 0x52
mov byte [ebp - 0x3b], 0x21
mov byte [ebp - 0x3a], 0x20
mov byte [ebp - 0x39], 0x54
mov byte [ebp - 0x38], 0x68
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x35], 0x61
mov byte [ebp - 0x34], 0x64
mov byte [ebp - 0x33], 0x20
mov byte [ebp - 0x32], 0x63
mov byte [ebp - 0x31], 0x72
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x61
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x69
mov byte [ebp - 0x2c], 0x6f
mov byte [ebp - 0x2b], 0x6e
mov byte [ebp - 0x2a], 0x20
mov byte [ebp - 0x29], 0x66
mov byte [ebp - 0x28], 0x61
mov byte [ebp - 0x27], 0x69
mov byte [ebp - 0x26], 0x6c
mov byte [ebp - 0x25], 0x65
mov byte [ebp - 0x24], 0x64
mov byte [ebp - 0x23], 0x2c
mov byte [ebp - 0x22], 0x20
mov byte [ebp - 0x21], 0x54
mov byte [ebp - 0x20], 0x68
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x61
mov byte [ebp - 0x1c], 0x64
mov byte [ebp - 0x1b], 0x20
mov byte [ebp - 0x1a], 0x43
mov byte [ebp - 0x19], 0x6f
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x30
mov byte [ebp - 0x14], 0x78
mov byte [ebp - 0x13], 0x35
mov byte [ebp - 0x12], 0x21
mov byte [ebp - 0x11], 0
mov ecx, dword [0x10067830]
call fcn.10001480
push eax
push 0
lea eax, [ebp - 0x40]
push eax
push 0
lea ecx, [ebp - 0x40]
push ecx
mov ecx, dword [0x10067834]
call fcn.10010200
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x10027004
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100311f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], ecx
jmp 0x1003120b
push 0xf
push 0
push 0x1002edd0
mov ecx, dword [0x10068360]
call fcn.10025340
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10031313
mov byte [ebp - 0x38], 0x45
mov byte [ebp - 0x37], 0x52
mov byte [ebp - 0x36], 0x52
mov byte [ebp - 0x35], 0x4f
mov byte [ebp - 0x34], 0x52
mov byte [ebp - 0x33], 0x21
mov byte [ebp - 0x32], 0x20
mov byte [ebp - 0x31], 0x54
mov byte [ebp - 0x30], 0x68
mov byte [ebp - 0x2f], 0x72
mov byte [ebp - 0x2e], 0x65
mov byte [ebp - 0x2d], 0x61
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x20
mov byte [ebp - 0x2a], 0x63
mov byte [ebp - 0x29], 0x72
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], 0x61
mov byte [ebp - 0x26], 0x74
mov byte [ebp - 0x25], 0x69
mov byte [ebp - 0x24], 0x6f
mov byte [ebp - 0x23], 0x6e
mov byte [ebp - 0x22], 0x20
mov byte [ebp - 0x21], 0x66
mov byte [ebp - 0x20], 0x61
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x64
mov byte [ebp - 0x1b], 0x2c
mov byte [ebp - 0x1a], 0x20
mov byte [ebp - 0x19], 0x54
mov byte [ebp - 0x18], 0x68
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x14], 0x64
mov byte [ebp - 0x13], 0x20
mov byte [ebp - 0x12], 0x43
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x20
mov byte [ebp - 0xd], 0x30
mov byte [ebp - 0xc], 0x78
mov byte [ebp - 0xb], 0x31
mov byte [ebp - 0xa], 0x35
mov byte [ebp - 9], 0x21
mov byte [ebp - 8], 0
mov ecx, dword [0x10067830]
call fcn.10001480
push eax
push 0
lea eax, [ebp - 0x38]
push eax
push 0
lea ecx, [ebp - 0x38]
push ecx
mov ecx, dword [0x10067834]
call fcn.10010200
jmp 0x10031325
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x100335f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x57
mov dword [ebp - 8], 0
jmp 0x10033612
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x17
jge 0x10033651
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x2dc78e82]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003364c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10033609
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x17], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10034870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x86
mov dword [ebp - 8], 0
jmp 0x10034892
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xa
jge 0x100348d1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x2287eb8e]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x100348cc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10034889
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xa], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100348f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x20
mov dword [ebp - 8], 0
jmp 0x10034912
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x13
jge 0x10034951
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x1b521880]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003494c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10034909
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x13], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10034970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xf3
mov dword [ebp - 8], 0
jmp 0x10034992
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xc
jge 0x100349d1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x2f9653fd]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x100349cc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10034989
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xc], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100349f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x1f
mov dword [ebp - 8], 0
jmp 0x10034a12
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x13
jge 0x10034a51
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x41263524]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10034a4c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10034a09
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x13], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10034a70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xb4
mov dword [ebp - 8], 0
jmp 0x10034a92
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xc
jge 0x10034ad1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x34f8a0b4]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10034acc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10034a89
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xc], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10034af0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x40
mov dword [ebp - 8], 0
jmp 0x10034b12
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xc
jge 0x10034b51
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0xdfb7cba]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10034b4c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10034b09
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xc], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10034b70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x52
mov dword [ebp - 8], 0
jmp 0x10034b92
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 6
jge 0x10034bd1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x6a6c475a]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10034bcc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10034b89
mov eax, dword [ebp - 0xc]
mov byte [eax + 6], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10034bf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xfd
mov dword [ebp - 8], 0
jmp 0x10034c12
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x10034c51
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x65b2226c]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10034c4c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10034c09
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10034c70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xbd
mov dword [ebp - 8], 0
jmp 0x10034c92
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xf
jge 0x10034cd1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x2224d501]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10034ccc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10034c89
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xf], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10034cf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xe0
mov dword [ebp - 8], 0
jmp 0x10034d12
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe
jge 0x10034d51
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x7067e4b1]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10034d4c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10034d09
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10034d70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xfe
mov dword [ebp - 8], 0
jmp 0x10034d92
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jge 0x10034dd1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x6b3a1d24]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10034dcc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10034d89
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xb], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10034df0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xce
mov dword [ebp - 8], 0
jmp 0x10034e12
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jge 0x10034e51
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x27c4a0cc]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10034e4c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10034e09
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xb], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4