joyce8/EMBER2024-capa huggingface dataset:
Function at 0x131c6d68
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x131c6f02
push dword fs:[eax]
mov dword fs:[eax], esp
push 4
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x13148848]
call fcn.131462b8
add esp, 4
mov eax, dword [ebp - 4]
mov byte [eax], 0xf2
mov eax, dword [ebp - 4]
mov byte [eax + 1], 0x53
mov eax, dword [ebp - 4]
mov byte [eax + 2], 0x50
mov eax, dword [ebp - 4]
mov byte [eax + 3], 0xc6
xor esi, esi
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 1]
movzx eax, dl
movzx eax, byte [eax + 0x1325e448]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 4]
sub al, byte [ecx + esi]
mov ecx, dword [ebp - 4]
add byte [ecx], al
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 2]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 4]
movzx ecx, byte [ecx + esi]
xor al, byte [ecx + 0x1325e448]
sub dl, al
mov eax, dword [ebp - 4]
mov byte [eax + 1], dl
mov eax, dword [ebp - 4]
movzx edx, byte [eax + 3]
mov eax, edx
mov ecx, dword [ebp - 4]
sub dl, byte [ecx]
movzx eax, al
movzx eax, byte [eax + 0x1325e448]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 4]
add al, byte [ecx + esi]
mov ecx, dword [ebp - 4]
xor al, byte [ecx + 2]
mov ecx, dword [ebp - 4]
mov byte [ecx + 2], al
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
movzx eax, byte [eax + esi]
add dl, byte [eax + 0x1325e448]
mov ecx, dword [ebp - 4]
mov eax, edx
mov byte [ecx + 3], al
mov edx, dword [ebp - 4]
movzx ebx, byte [edx]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 1]
shl edx, 8
add ebx, edx
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 2]
shl edx, 0x10
add ebx, edx
movzx eax, al
shl eax, 0x18
add ebx, eax
mov eax, ebx
shr ebx, 0x1d
shl eax, 3
or ebx, eax
mov eax, ebx
and eax, 0xff
mov edx, dword [ebp - 4]
mov byte [edx], al
mov ecx, pe_nt_image_headers32
mov eax, ebx
xor edx, edx
div ecx
mov ebx, eax
mov eax, ebx
and eax, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 1], al
mov ecx, pe_nt_image_headers32
mov eax, ebx
xor edx, edx
div ecx
mov ebx, eax
mov eax, ebx
and eax, 0xff
mov edx, dword [ebp - 4]
mov byte [edx + 2], al
shr ebx, 8
mov eax, dword [ebp - 4]
mov byte [eax + 3], bl
inc esi
cmp esi, 4
jne 0x131c6dbb
mov eax, dword [ebp - 8]
add eax, 4
mov edx, dword [0x13148848]
call fcn.131463b8
mov eax, dword [ebp - 8]
add eax, 4
mov edx, dword [ebp - 4]
mov ecx, dword [0x13148848]
call fcn.131463f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131c6f09
lea eax, [ebp - 4]
mov edx, dword [0x13148848]
call fcn.131463b8
ret
Function at 0x131c7238
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.131450b8
xor eax, eax
push ebp
push 0x131c72bf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.1314805c
mov word [ebp - 0x18], bx
mov dword [ebp - 0x1c], 0x10
mov dword [ebp - 0x20], 0x18
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.131450c8
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x131c72a7
mov bl, 1
jmp 0x131c72a9
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131c72c6
lea eax, [ebp - 4]
call fcn.13144c28
ret
Function at 0x131d85a0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x13148204]
call fcn.131457c4
xor eax, eax
push ebp
push 0x131d8741
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x1325e78c], 0
jne 0x131d85fb
mov ecx, dword [0x132ac66c]
mov dl, 1
mov eax, dword [0x131488a0]
call fcn.1314da8c
call fcn.131445bc
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.13143618
mov eax, ebx
call fcn.131455bc
mov dword [ebp - 0x24], eax
mov esi, 0x131d8750
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.13146a9c
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.131455cc
test eax, eax
jle 0x131d86e4
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x131d86d0
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.13144ea8
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x131d8676
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.13144ec0
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x131d868c
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.13144ec0
mov eax, dword [ebp - 0x54]
call fcn.131450c8
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.13144ea8
mov eax, dword [ebp - 0x58]
call fcn.131450c8
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x131d86d2
xor eax, eax
test al, al
je 0x131d86dd
mov ebx, 0x15
jmp 0x131d86e9
mov ebx, 0x10
jmp 0x131d86e9
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x1325e78c]
call fcn.131d83c4
mov eax, dword [ebp - 4]
call fcn.131d83c4
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.13146ab4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131d8748
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.13144c4c
lea eax, [ebp - 0xc]
mov edx, dword [0x13148204]
call fcn.13145894
ret
Function at 0x131ed0a4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x131ed0c8
cmp eax, 0
jbe 0x131ed1d1
jmp 0x131ed0ce
jle 0x131ed1d1
mov eax, dword [ebp + 8]
add eax, 0xffffff04
xor ecx, ecx
mov edx, 0xf8
call fcn.13143618
mov eax, dword [ebp + 8]
lea edx, [eax - 0x13c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov ecx, 0x40
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 0x40
jne 0x131ed1d1
mov eax, dword [ebp + 8]
cmp word [eax - 0x13c], 0x5a4d
jne 0x131ed1d1
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x100]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
xor ecx, ecx
mov esi, dword [eax]
call dword [esi + 0x14]
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 0x100]
jne 0x131ed1d1
mov eax, dword [ebp + 8]
lea edx, [eax - 0xfc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov ecx, 4
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 4
jne 0x131ed1d1
mov eax, dword [ebp + 8]
cmp dword [eax - 0xfc], 0x4550
jne 0x131ed1d1
mov eax, dword [ebp + 8]
lea edx, [eax - 0xf8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov ecx, 0x14
mov esi, dword [eax]
call dword [esi + 0xc]
cmp eax, 0x14
jne 0x131ed1d1
mov eax, dword [ebp + 8]
cmp word [eax - 0xf8], 0x14c
jne 0x131ed1d1
mov eax, dword [ebp + 8]
movzx ecx, word [eax - 0xe8]
mov eax, dword [ebp + 8]
lea edx, [eax - 0xe4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x140]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp + 8]
movzx edx, word [edx - 0xe8]
cmp eax, edx
jne 0x131ed1d1
mov bl, 1
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x131ed820
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor edx, edx
mov eax, dword [ebp + 8]
movzx eax, word [eax - 0xf6]
test ax, ax
jbe 0x131ed900
mov edx, dword [ebp + 8]
movzx eax, ax
dec eax
test eax, eax
jl 0x131ed8fe
inc eax
mov dword [ebp - 4], eax
xor ebx, ebx
mov esi, ebx
add esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8 + 0xc]
xor edx, edx
test eax, 0x20000000
je 0x131ed896
test eax, 0x40000000
je 0x131ed882
test eax, 0x80000000
je 0x131ed87d
or edx, 0x40
jmp 0x131ed8bd
or edx, 0x20
jmp 0x131ed8bd
test eax, 0x80000000
je 0x131ed891
or edx, 0x80
jmp 0x131ed8bd
or edx, 0x10
jmp 0x131ed8bd
test eax, 0x40000000
je 0x131ed8ae
test eax, 0x80000000
je 0x131ed8a9
or edx, 4
jmp 0x131ed8bd
or edx, 2
jmp 0x131ed8bd
test eax, 0x80000000
je 0x131ed8ba
or edx, 8
jmp 0x131ed8bd
or edx, 1
test eax, 0x4000000
je 0x131ed8ca
or edx, 0x200
mov eax, dword [ebp + 8]
add eax, 0xfffffebc
push eax
push edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8 + 8]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + esi*8]
push eax
call sub.kernel32.dll_VirtualProtect
inc ebx
dec dword [ebp - 4]
jne 0x131ed850
mov dl, 1
mov eax, edx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x131ef44c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.131455bc
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x131ef465
test al, 0x10
jne 0x131ef469
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x131ef788
Capabilities:
Create directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.131457a4
xor eax, eax
push ebp
push 0x131ef8ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.13145690
jne 0x131ef7df
mov ecx, 0x131ef8e8
mov dl, 1
mov eax, dword [0x13148a38]
call fcn.1314d9d0
mov edx, eax
mov dword [edx + 0xc], 3
mov eax, edx
call fcn.131445bc
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.131ef3e0
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.13145450
mov eax, dword [ebp - 4]
call fcn.131ef44c
test al, al
jne 0x131ef89e
mov eax, dword [ebp - 4]
call fcn.131455cc
cmp eax, 3
jl 0x131ef89e
mov eax, dword [ebp - 4]
call fcn.131ef44c
test al, al
jne 0x131ef89e
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.13144ec0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.1314a488
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.131455ac
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.13145690
je 0x131ef89e
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.131ef364
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.131ef788
test al, al
je 0x131ef87d
push 0
mov eax, dword [ebp - 4]
call fcn.131455bc
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x131ef881
xor ebx, ebx
jmp 0x131ef883
mov bl, 1
test bl, bl
je 0x131ef89e
test si, si
jbe 0x131ef89e
movzx eax, si
push eax
mov eax, dword [ebp - 4]
call fcn.131455bc
push eax
call sub.kernel32.dll_SetFileAttributesW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131ef8d5
lea eax, [ebp - 0x18]
call fcn.131453ec
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.13144c4c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.13145404
ret
Function at 0x131f184c
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
test dl, dl
je 0x131f185e
add esp, 0xfffffff0
call fcn.1314406c
mov esi, ecx
mov ebx, edx
mov edi, eax
lea eax, [ebp + 0x1c]
call fcn.131457a4
xor eax, eax
push ebp
push 0x131f190a
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, edi
call fcn.13143cd8
mov dword [edi + 0x38], esi
lea eax, [edi + 0xc]
mov edx, dword [ebp + 0x1c]
call fcn.13145428
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [edi + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x18], eax
movzx eax, byte [ebp + 8]
mov byte [edi + 0x1c], al
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x20], eax
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
push 0
lea eax, [edi + 0x40]
mov ecx, 1
mov edx, dword [0x131ee53c]
call fcn.131462b8
add esp, 4
mov eax, edi
call fcn.131f16a0
test al, al
jne 0x131f18f4
call fcn.1314d9a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131f1911
lea eax, [ebp + 0x1c]
call fcn.131453ec
ret
Function at 0x131f1e5c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x14
add esp, 0xfffff004
push eax
dec eax
jne 0x131f1e65
mov eax, dword [ebp - 4]
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14018], ecx
mov dword [ebp - 0x1401c], ecx
mov dword [ebp - 0x14008], edx
mov ebx, eax
lea eax, [ebp - 0x14008]
call fcn.131457a4
xor eax, eax
push ebp
push 0x131f207e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x14009], 0
lea edx, [ebp - 0x1401c]
mov eax, dword [ebp - 0x14008]
call fcn.131ef5cc
mov eax, dword [ebp - 0x1401c]
lea edx, [ebp - 0x14018]
call fcn.131ef904
mov eax, dword [ebp - 0x14018]
mov edx, 0x131f2098
call fcn.13145690
jne 0x131f2055
mov dword [ebx + 0xa8], 0
mov dword [ebx + 0xac], 0
mov byte [ebx + 0xa0], 0
push 0
push 3
push 0
push 0
mov eax, dword [ebp - 0x14008]
call fcn.131455bc
mov ecx, 1
mov edx, 0x80000000
call fcn.131ef9c8
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x131f204e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
mov edx, 2
mov eax, dword [ebp - 4]
call fcn.131efa5c
mov dword [ebp - 0x14010], eax
push 0
push 0x10000
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.131efa5c
push 0
lea eax, [ebp - 0x14014]
push eax
push 0x14000
lea eax, [ebp - 0x14004]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile
mov edi, dword [ebp - 0x14014]
sub edi, 6
test edi, edi
jb 0x131f1fc3
inc edi
xor esi, esi
push ebp
mov eax, esi
call fcn.131f1e24
pop ecx
mov byte [ebx + 0xa0], al
cmp byte [ebx + 0xa0], 0
je 0x131f1fbf
lea eax, [esi + 0x10000]
xor edx, edx
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], edx
mov byte [ebp - 0x14009], 1
jmp 0x131f1fc3
inc esi
dec edi
jne 0x131f1f8a
cmp byte [ebx + 0xa0], 0
jne 0x131f2037
push ebp
call fcn.131f1d34
pop ecx
mov esi, eax
cmp esi, dword [ebp - 0x14010]
je 0x131f2037
mov eax, esi
xor edx, edx
push edx
push eax
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.131efa5c
push 0
lea eax, [ebp - 0x14014]
push eax
push 6
lea eax, [ebp - 0x14004]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_ReadFile
push ebp
xor eax, eax
call fcn.131f1e24
pop ecx
mov byte [ebx + 0xa0], al
cmp byte [ebx + 0xa0], 0
je 0x131f2037
mov eax, esi
xor edx, edx
mov dword [ebx + 0xa8], eax
mov dword [ebx + 0xac], edx
mov byte [ebp - 0x14009], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131f2055
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131f2085
lea eax, [ebp - 0x1401c]
mov edx, 2
call fcn.13145404
lea eax, [ebp - 0x14008]
call fcn.131453ec
ret
Function at 0x131f2564
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, 0xc
mov eax, 0x132a41c4
mov ecx, 0x132a4194
mov ebx, dword [ecx]
xor ebx, dword [eax]
not ebx
mov dword [eax], ebx
add ecx, 4
add eax, 4
dec edx
jne 0x131f2574
mov edx, 0xc
mov eax, 0x132a4224
mov ecx, 0x132a41f4
mov ebx, dword [ecx]
xor ebx, dword [eax]
not ebx
mov dword [eax], ebx
add ecx, 4
add eax, 4
dec edx
jne 0x131f2594
mov edx, 0x132a41c4
mov eax, 0x132a4194
mov ecx, 0x30
call fcn.13148054
mov edx, 0x132a4224
mov eax, 0x132a41f4
mov ecx, 0x30
call fcn.13148054
mov eax, 0x132a41c4
xor ecx, ecx
mov edx, 0x30
call fcn.13143618
mov eax, 0x132a4224
xor ecx, ecx
mov edx, 0x30
call fcn.13143618
pop ebx
ret
Function at 0x131f27b4
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
js 0x131f27cb
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x131f27c4
mov ecx, esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor ebx, ebx
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0
inc ebx
cmp ebx, 0x10
jne 0x131f27d8
xor eax, eax
mov dword [ebp - 0x10], eax
mov ebx, 4
lea eax, [ebp - 0x24]
xor edx, edx
mov dword [eax], edx
add eax, 4
dec ebx
jne 0x131f27f2
lea esi, [ebp - 0x24]
xor ebx, ebx
mov eax, dword [ebp - 0x10]
push eax
push 0x10
mov edi, ebx
add edi, edi
add edi, edi
lea eax, [esi + edi]
mov ecx, dword [ebp - 8]
xor edx, edx
call fcn.131f2684
add dword [ebp - 0x10], 0x10
mov eax, dword [ebp - 0x10]
push eax
push 2
lea eax, [esi + edi]
mov ecx, dword [ebp - 8]
mov edx, 0x16
call fcn.131f2684
add dword [ebp - 0x10], 2
inc ebx
cmp ebx, 4
jne 0x131f2801
xor ebx, ebx
mov edx, 0xa
sub edx, ebx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + edx*4]
mov eax, 2
sub eax, ebx
xor edx, dword [ebp + eax*4 - 0x24]
mov ecx, dword [ebp + eax*4 - 0x20]
and ecx, 0xffff
xor edx, ecx
mov dword [ebp + eax*4 - 0x24], edx
inc ebx
cmp ebx, 3
jne 0x131f2840
xor eax, eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
lea ecx, [ebp - 0x24]
mov esi, dword [ebp - 0xc]
lea eax, [ebx + 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + eax*4]
imul dword [ecx]
xor edx, edx
div dword [esi]
mov eax, edx
xor eax, dword [esi + 0x20]
xor eax, dword [ebp - 0x14]
mov edx, dword [ecx]
and edx, 0xffff
mov dword [ebp - 0x14], edx
mov edx, ebx
add edx, edx
mov edi, dword [ebp - 4]
lea edx, [edi + edx]
push edx
mov edx, eax
and dl, 0xff
pop edi
mov byte [edi], dl
mov edx, ebx
add edx, edx
mov edi, dword [ebp - 4]
lea edx, [edi + edx + 1]
push edx
movzx eax, ax
shr eax, 8
pop edx
mov byte [edx], al
inc ebx
add esi, 4
add ecx, 4
cmp ebx, 4
jne 0x131f287b
xor eax, eax
mov dword [ebp - 0x24], eax
lea esi, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
push eax
push 0x10
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, esi
call fcn.131f2684
lea esi, [ebp - 0x24]
movzx eax, byte [esi + 1]
xor al, byte [esi]
xor al, 0x3d
mov byte [esi], al
mov al, 0xf8
xor ebx, ebx
mov edx, dword [ebp - 4]
xor al, byte [edx + ebx]
inc ebx
cmp ebx, 8
jne 0x131f28fc
cmp al, byte [esi + 1]
je 0x131f2912
or eax, 0xffffffff
jmp 0x131f2915
movzx eax, byte [esi]
mov edi, dword [ebp - 0x30]
mov esi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x28]
mov esp, ebp
pop ebp
ret 4
Function at 0x131f2a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test esi, esi
js 0x131f2a5a
mov edi, dword [ebx + esi*4]
dec esi
push edi
jns 0x131f2a53
mov dword [ebp + 0xc], esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov esi, dword [ebp + 0xc]
add esi, 0x10
mov edi, 0x132c4770
mov eax, ebx
add eax, eax
mov edx, dword [ebp - 8]
movzx eax, byte [edx + eax + 1]
shl eax, 8
mov edx, ebx
add edx, edx
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + edx]
or eax, edx
mov dword [ebp - 0x14], eax
mov edx, dword [esi - 0x10]
mov eax, dword [esi]
call fcn.131f2a04
xor edx, edx
div dword [esi - 0x10]
mov ecx, edx
mov eax, dword [esi + 0x10]
xor eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x10]
imul ecx
xor edx, edx
div dword [esi - 0x10]
mov dword [edi], edx
mov eax, dword [edi]
and eax, 0xffff
mov dword [ebp - 0x10], eax
inc ebx
add edi, 4
add esi, 4
cmp ebx, 4
jne 0x131f2a78
mov eax, dword [0x132c477c]
and eax, 0xffff
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov edx, 2
sub edx, ebx
mov eax, dword [edx*4 + 0x132c4770]
mov ecx, eax
and ecx, 0xffff
mov dword [ebp - 0x10], ecx
mov ecx, 0xa
sub ecx, ebx
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi + ecx*4]
xor ecx, eax
xor ecx, dword [ebp - 0x14]
mov dword [edx*4 + 0x132c4770], ecx
inc ebx
cmp ebx, 3
jne 0x131f2adf
xor eax, eax
xor ebx, ebx
mov edx, dword [ebp - 4]
mov byte [edx + ebx], 0
inc ebx
cmp ebx, 0xb
jne 0x131f2b21
mov dword [0x132c4780], 0x132c4770
xor ebx, ebx
push 0
push 0x10
mov esi, ebx
add esi, esi
add esi, esi
mov edx, dword [0x132c4780]
lea ecx, [edx + esi]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.131f2684
push 0x16
push 2
mov edx, dword [0x132c4780]
lea ecx, [edx + esi]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.131f2684
inc ebx
cmp ebx, 4
jne 0x131f2b3a
mov byte [0x132c4784], 0xf8
xor ebx, ebx
mov edx, dword [ebp - 8]
movzx edx, byte [edx + ebx]
xor byte [0x132c4784], dl
inc ebx
cmp ebx, 8
jne 0x131f2b7d
mov dword [0x132c4780], 0x132c4770
mov edx, dword [0x132c4780]
movzx ecx, byte [0x132c4784]
mov byte [edx + 1], cl
movzx edx, byte [ebp - 0xc]
xor dl, byte [0x132c4784]
xor dl, 0x3d
mov ecx, dword [0x132c4780]
mov byte [ecx], dl
push 0
push 0x10
mov ecx, dword [0x132c4780]
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.131f2684
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 8

Function at 0x131f2cc1
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, ecx
dec esi
test esi, esi
jl 0x131f2ce4
inc esi
xor ecx, ecx
lea ebx, [edx + ecx]
and ebx, 0x1f
movzx ebx, byte [ebx + 0x132a4254]
xor bl, byte [eax + ecx - 1]
xor byte [eax + ecx], bl
inc ecx
dec esi
jne 0x131f2ccc
pop esi
pop ebx
ret
Function at 0x131f4714
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x131f4743
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x131f47c2
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.131f2fd0
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x131f4790
mov cx, word [esp]
sub cx, si
jmp 0x131f4792
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x131f4779
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x131f47b8
mov cx, word [esp]
sub cx, si
jmp 0x131f47ba
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x131f47a1
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x131f481f
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.131f43e8
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x131f480a
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x131f481f
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x131f471e
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x131face8
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x132c4790
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x131fad0a
shr eax, 1
xor eax, 0xedb88320
jmp 0x131fad0c
shr eax, 1
dec edx
jne 0x131facf8
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x131facf1
mov byte [0x132c4b90], 1
pop esi
pop ebx
ret

Function at 0x131fad28
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x132c4b90], 0
jne 0x131fad3f
call fcn.131face8
mov eax, edi
dec eax
test eax, eax
jl 0x131fad67
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x132c4790]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x131fad49
mov eax, ebx
pop edi
pop esi
pop ebx
ret