joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b080
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
or edi, dword [eax - 0x39]
cmp al, 0x10
add byte [eax], al
add byte [eax], al
xor al, 0x71
mov al, byte [esi + 8]
test al, al
pop edi
push 0xffffffffffffff8b
push esi
add al, 0x8d
dec ebp
or byte [edx], bh
push ecx
push cs
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x40b0f2
push esi
xor eax, sym.imp.KERNEL32.dll_GetLastError
call esi
test eax, eax
jne 0x40b0d2
mov ecx, dword [ebp + 0x14]
pop edi
add dword [esi], edx
push ss
rcr byte [ebp - 0x3d], 1
call esi
std
cmp ah, 0xa
add byte [0xafced], bh
jne 0x40b0e5
mov eax, 0x1117e
xchg esi, eax
dec ebp
adc al, 0x5f
mov ebx, 0x70000187
add byte [eax], al
pop ebp
ret
add byte [ebp - 0x3d], bl
mov eax, dword [ebp + 8]
xlatb
sal byte [ebp + 0xe], 0x8b
push ebp
adc al, 0xad
pop esi
mov dword [edx], eax
je 0x40b10d
add byte [eax], al
add cl, dl
ret
mov eax, dword [esi + 0xc]
test eax, eax
je 0x40b137
dec esi
or byte [ecx + ecx*8 + 0x4e8b1c75], al
jns 0x40b0ef
dec eax
mov ch, 0x8b
inc esi
push eax
mov edx, dword [esi + 0x11]
mov ecx, 0x20
call 0xd6b810
inc esp
push esi
or al, 0x89
inc edx
or al, 0x8b
inc esi
or al, 0x8b
push ebp
or al, 0xe1
lea ecx, [ebp + 0x10]
jge 0x40b0ce
mov dword [edx + 0xc], eax
mov eax, dword [esi + 0xc]
mov edx, dword [ebp + 0xc]
loope 0x40b0cc
dec ebp
adc byte [ebp - 0x75], bh
jge 0x40b149
push ecx
ficom dword [edx + 0x50]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40b134
xor eax, eax
jmp 0x419f85
Function at 0x10006960
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp + 8]
jne 0x10006999
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1000699d
cmp edx, esi
jne 0x10006982
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp + 8]
jne 0x100069bd
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100069c1
cmp edx, esi
jne 0x100069a6
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp + 8]
jne 0x100069e1
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x100069e5
cmp edx, esi
jne 0x100069ca
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10006b00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
jmp 0x10006b15
cmp dword [ebp + 0xc], 1
jne 0x10006b51
push 0
push 0
push 0
push 0x100068c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x100069f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp + 8]
push eax
call fcn.10006960
add esp, 4
jmp 0x10006b63
mov eax, 1
pop ebp
ret 0xc

Function at 0x10006c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x99
mov dword [ebp - 8], 0
jmp 0x10006c82
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe
jge 0x10006cc1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x32b0bccd]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10006cbc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10006c79
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10006ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x2c
mov dword [ebp - 8], 0
jmp 0x10006d02
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x10006d41
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x248a0127]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10006d3c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10006cf9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x10], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10006d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x45
mov dword [ebp - 8], 0
jmp 0x10006d82
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe
jge 0x10006dc1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x9a99bca]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10006dbc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10006d79
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10006de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x1b
mov dword [ebp - 8], 0
jmp 0x10006e02
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x12
jge 0x10006e41
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x7d799029]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10006e3c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10006df9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x12], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10006e60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x85
mov dword [ebp - 8], 0
jmp 0x10006e82
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x79
jge 0x10006ec1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x3f3fc042]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10006ebc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10006e79
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x79], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10006ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x8d
mov dword [ebp - 8], 0
jmp 0x10006f02
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3f
jge 0x10006f41
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x2dd13ad7]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10006f3c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10006ef9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x3f], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10006f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xa7
mov dword [ebp - 8], 0
jmp 0x10006f82
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x12
jge 0x10006fc1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x72e58f56]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10006fbc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10006f79
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x12], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10006fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xc3
mov dword [ebp - 8], 0
jmp 0x10007002
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x32
jge 0x10007041
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x7e7f1b4a]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000703c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10006ff9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x32], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10007060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x33
mov dword [ebp - 8], 0
jmp 0x10007082
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3f
jge 0x100070c1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x1d67353c]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x100070bc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10007079
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x3f], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x100070e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xe4
mov dword [ebp - 8], 0
jmp 0x10007102
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x15
jge 0x10007141
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x6b7cd5f]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000713c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100070f9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x15], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10007190
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x78
mov dword [ebp - 8], 0
jmp 0x100071b2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 9
jge 0x100071f1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x78280739]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x100071ec
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100071a9
mov eax, dword [ebp - 0xc]
mov byte [eax + 9], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10007210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x40
mov dword [ebp - 8], 0
jmp 0x10007232
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x18
jge 0x10007271
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x391c1554]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000726c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10007229
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x18], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100072f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xb5
mov dword [ebp - 8], 0
jmp 0x10007312
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 9
jge 0x10007351
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x2e7952ed]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000734c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10007309
mov eax, dword [ebp - 0xc]
mov byte [eax + 9], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10007370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x3d
mov dword [ebp - 8], 0
jmp 0x10007392
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x11
jge 0x100073d1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x4ff142e0]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x100073cc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10007389
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x11], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100075c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x45
mov dword [ebp - 8], 0
jmp 0x100075e2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x20
jge 0x10007621
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x60fc7d8c]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000761c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100075d9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x20], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10007640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 5
mov dword [ebp - 8], 0
jmp 0x10007662
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe
jge 0x100076a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x57a8ceec]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000769c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10007659
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100076c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xa1
mov dword [ebp - 8], 0
jmp 0x100076e2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x20
jge 0x10007721
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x1792fbb2]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000771c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100076d9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x20], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10007740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xac
mov dword [ebp - 8], 0
jmp 0x10007762
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1c
jge 0x100077a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x1cb3073d]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000779c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10007759
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1c], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100077c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x80
mov dword [ebp - 8], 0
jmp 0x100077e2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x20
jge 0x10007821
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x6214cc5e]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000781c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100077d9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x20], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10007840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x2c
mov dword [ebp - 8], 0
jmp 0x10007862
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x17
jge 0x100078a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x39f7ffb]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000789c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10007859
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x17], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100078c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xb1
mov dword [ebp - 8], 0
jmp 0x100078e2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x20
jge 0x10007921
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x6b227c2e]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000791c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100078d9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x20], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10007940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x7e
mov dword [ebp - 8], 0
jmp 0x10007962
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x20
jge 0x100079a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x34740aee]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1000799c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10007959
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x20], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100079c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xb7
mov dword [ebp - 8], 0
jmp 0x100079e2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x20
jge 0x10007a21
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x7e49b16c]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10007a1c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100079d9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x20], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10007a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x38
mov dword [ebp - 8], 0
jmp 0x10007a62
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x19
jge 0x10007aa1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x41b2f576]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10007a9c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10007a59
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x19], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10007ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xdc
mov dword [ebp - 8], 0
jmp 0x10007ae2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x17
jge 0x10007b21
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x4ef42576]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10007b1c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10007ad9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x17], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4