joyce8/EMBER2024-capa huggingface dataset:
Function at 0x801897a
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0xb4]
sub esp, 0x134
mov eax, dword [0x8230fb8]
xor eax, ebp
mov dword [ebp + 0xb0], eax
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0xbc], esi
push edi
mov edi, ecx
jne 0x8018b65
mov eax, dword [0x823abc8]
xor ebx, ebx
inc ebx
cmp eax, ebx
jne 0x80189fa
push str.atm.ini
push 0x20
lea eax, [ebp + 0x90]
push eax
push 0x819de6c
push 0x819c420
push str.Settings
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x8018b65
push 0x819de5c
lea eax, [ebp + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x8018a69
cmp eax, 2
jne 0x8018a67
cmp dword [0x823abbc], 5
jae 0x8018a71
lea eax, [ebp - 0x78]
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionFont_Drivers
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x8018b65
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push str.Adobe_Type_Manager
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x8018a5a
cmp byte [ebp - 0x74], al
sete al
mov esi, eax
jmp 0x8018a5c
mov esi, ebx
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x8018a69
mov esi, ebx
test esi, esi
jne 0x8018b65
push ebx
mov ecx, edi
call fcn.0801e52e
lea esi, [edi + 0x5a4]
mov dword [ebp - 0x78], 2
mov ebx, 0x7d0
push ebx
call fcn.0804164c
jmp 0x8018ade
cmp dword [0x823abc8], 1
jne 0x8018aba
push 0x819dda0
mov eax, ebx
shr eax, 1
push eax
push dword [esi]
push 0x819ddb0
push 0
push dword [esi - 4]
call dword [0x823101c]
jmp 0x8018abc
xor eax, eax
test eax, eax
je 0x8018ae7
mov ecx, dword [esi]
cmp word [ecx], 0
je 0x8018ae7
lea edx, [ebx - 2]
cmp eax, edx
jb 0x8018af2
push ecx
call fcn.080416a2
add ebx, ebx
push ebx
call fcn.0804164c
pop ecx
test eax, eax
mov dword [esi], eax
pop ecx
jne 0x8018a93
jmp 0x8018af2
push dword [esi]
call fcn.080416a2
and dword [esi], 0
pop ecx
add esi, 8
dec dword [ebp - 0x78]
jne 0x8018a86
xor ebx, ebx
push 0x18
mov dword [edi + 0x5b8], ebx
mov dword [edi + 0x5b0], 0xfffffffe
mov dword [edi + 0x5b4], 0x819ddb0
call fcn.0804164c
cmp eax, ebx
pop ecx
je 0x8018b2b
mov ecx, eax
call fcn.0801895e
jmp 0x8018b2d
xor eax, eax
lea esi, [edi + 0x5c4]
push esi
push 0x20119
push ebx
push str.SoftwareMicrosoftWindows_NTCurrentVersionType_1_InstallerType_1_Fonts
push 0x80000002
mov dword [edi + 0x5c0], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x8018b56
mov dword [esi], ebx
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov dword [edi + 0x5c8], eax
jmp 0x8018b6e
push 0
mov ecx, edi
call fcn.0801e52e
mov ecx, dword [ebp + 0xb0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.08047f9e
add ebp, 0xb4
leave
ret 0x10
Function at 0x801fc55
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call fcn.0801383f
cmp dword [eax + 4], 0
jbe 0x801fc6c
mov ecx, esi
call fcn.0801fc16
mov ecx, esi
call fcn.0801fa88
test byte [esp + 0x14], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
jne 0x801fc92
call edi
mov ecx, dword [esp + 0x10]
sub eax, dword [esi + 0x58]
imul ecx, ecx, 0xa
cmp eax, ecx
jbe 0x801fca8
push dword [esp + 0x14]
mov ecx, esi
push dword [esp + 0x14]
call fcn.0801f9e6
or ebx, eax
call edi
mov dword [esi + 0x58], eax
pop edi
pop esi
mov eax, ebx
pop ebx
ret 8

Function at 0x80200af
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x10]
push eax
push str.CLSID
push 0x80000000
xor bl, bl
call esi
test eax, eax
jne 0x8020164
and dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x802015b
and dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push str.InProcServer32
push dword [ebp - 0xc]
call esi
test eax, eax
jne 0x8020152
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0
push 0x818f80f
push dword [ebp - 8]
mov dword [ebp - 4], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
je 0x8020149
mov eax, 0x103
cmp dword [ebp - 4], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
ja 0x8020143
lea eax, [ebp - 4]
mov eax, dword [eax]
mov byte [esi + eax], 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x80426f3
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xc8
mov eax, dword [0x8230fb8]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
xor ebx, ebx
push esi
mov esi, ecx
push edi
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x2c], esi
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov byte [esi + 6], bl
mov byte [esi + 7], bl
mov byte [esi + 8], bl
mov dword [esi + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x50]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x80428a0
cmp dword [ebp - 0x1c], 5
ja 0x8042767
jne 0x80427a2
cmp dword [ebp - 0x18], 1
jb 0x80427a2
mov edi, dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
push 3
call edi
test eax, eax
setne al
push 6
mov byte [esi + 4], al
call edi
test eax, eax
setne al
push 0xa
mov byte [esi + 5], al
call edi
test eax, eax
setne al
push 7
mov byte [esi + 6], al
mov byte [esi + 7], bl
call edi
test eax, eax
setne al
jmp 0x804289d
cmp dword [ebp - 0x10], 2
jne 0x80427be
cmp word [ebp - 0x50], bx
jne 0x80428a0
cmp word [ebp - 0x30], 5
jae 0x80427cf
jmp 0x80428a0
cmp dword [ebp - 0x38], 0x24a
sbb al, al
inc al
je 0x80428a0
mov byte [ebp - 0x25], bl
mov byte [ebp - 0x23], bl
mov byte [ebp - 0x24], bl
mov byte [ebp - 0x22], bl
mov byte [ebp - 0x21], bl
push ebx
push esi
push edi
mov eax, 0x80000000
cpuid
cmp eax, 0x80000000
jbe 0x804287c
xor eax, eax
cpuid
cmp ebx, 0x756e6547
jne 0x8042811
cmp edx, 0x49656e69
jne 0x8042811
cmp ecx, 0x6c65746e
jne 0x8042811
jmp 0x8042840
cmp ebx, 0x68747541
jne 0x804283e
cmp edx, 0x69746e65
jne 0x804283e
cmp ecx, 0x444d4163
jne 0x804283e
mov eax, 0x80000001
cpuid
test edx, 0x80000000
je 0x8042840
mov byte [ebp - 0x21], 1
jmp 0x8042840
jmp 0x804287c
cmp eax, 1
jl 0x804287c
mov eax, 1
cpuid
test edx, 0x2000000
je 0x8042858
mov byte [ebp - 0x23], 1
test edx, 0x4000000
je 0x8042864
mov byte [ebp - 0x24], 1
test ecx, 1
je 0x8042870
mov byte [ebp - 0x22], 1
test edx, 0x800000
je 0x804287c
mov byte [ebp - 0x25], 1
pop edi
pop esi
pop ebx
mov esi, dword [ebp - 0x2c]
mov al, byte [ebp - 0x25]
mov byte [esi + 4], al
mov al, byte [ebp - 0x23]
mov byte [esi + 5], al
mov al, byte [ebp - 0x24]
mov byte [esi + 6], al
mov al, byte [ebp - 0x22]
mov byte [esi + 7], al
mov al, byte [ebp - 0x21]
mov byte [esi + 8], al
mov ecx, dword [ebp + 0x74]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.08047f9e
add ebp, 0x78
leave
ret

Function at 0x8047f9e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x8230fb8]
jne 0x8047fa8
repz ret
jmp fcn.08171744
Function at 0x806dbc1
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x823dffc], 0
je 0x806dc1b
push esi
mov esi, dword [0x823dfe8]
cmp dword [0x823dfe4], esi
je 0x806dc0c
mov eax, dword [0x823e00c]
cmp eax, esi
movzx edx, word [0x823e00a]
jae 0x806dc0c
push ebx
mov cl, dh
xor cl, byte [eax]
movzx bx, cl
add bx, dx
imul bx, bx, 0x3193
mov dx, 0x58bf
sub dx, bx
mov byte [eax], cl
inc eax
cmp eax, esi
movzx edx, dx
jb 0x806dbea
pop ebx
and dword [0x823dffc], 0
and dword [0x823dff8], 0
pop esi
ret
Function at 0x80807e5
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
mov esi, eax
mov eax, dword [esp + 0xc]
push edi
mov edi, ecx
movzx ecx, word [eax]
mov eax, dword [esp + 0xc]
mov dword [eax], edx
dec edx
js 0x808081e
push ebx
mov al, ch
xor al, byte [esi]
inc esi
movzx bx, al
add bx, cx
imul bx, bx, 0x3193
mov cx, 0x58bf
sub cx, bx
mov byte [edi], al
inc edi
dec edx
movzx ecx, cx
jns 0x80807fc
pop ebx
mov eax, dword [esp + 0x10]
pop edi
mov word [eax], cx
pop esi
ret

Function at 0x8089d71
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
mov edi, eax
mov dword [ebp - 4], 1
xor ecx, ecx
movsx eax, cx
mov al, byte [eax + edx]
cmp al, 0x61
jb 0x8089d93
cmp al, 0x66
jbe 0x8089da1
cmp al, 0x41
jb 0x8089d9b
cmp al, 0x46
jbe 0x8089da1
sub al, 0x30
cmp al, 9
ja 0x8089daa
inc ecx
cmp cx, 4
jl 0x8089d85
jmp 0x8089dad
mov dword [ebp - 4], esi
mov ebx, 0xd971
cmp dword [ebp - 4], 0
je 0x8089def
mov al, byte [edx]
inc edx
dec dword [ebp + 8]
js 0x8089e1d
and al, 0xdf
cmp al, 0x41
jb 0x8089dce
movzx eax, al
sub eax, 0x37
jmp 0x8089dd1
and eax, 0xf
shl eax, 4
movzx ecx, ax
mov al, byte [edx]
and al, 0xdf
inc edx
cmp al, 0x41
jb 0x8089de8
movzx eax, al
sub eax, 0x37
jmp 0x8089deb
and eax, 0xf
or ecx, eax
jmp 0x8089df7
movzx ax, byte [edx]
movzx ecx, ax
inc edx
mov al, bh
xor al, cl
add ecx, ebx
imul ecx, ecx, 0x3193
mov byte [edi], al
mov eax, 0x58bf
sub eax, ecx
inc edi
cmp si, 4
movzx ebx, ax
jge 0x8089e17
dec edi
inc esi
dec dword [ebp + 8]
js 0x8089db2
pop edi
pop esi
pop ebx
leave
ret

Function at 0x8089e22
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
dec dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, ecx
mov edi, eax
mov esi, edx
mov ecx, 0xd7e5
jmp 0x8089e60
movzx ax, byte [edi]
movzx edx, ax
mov al, ch
xor al, dl
mov byte [esi], al
movzx ax, al
add ax, cx
imul ax, ax, 0x522f
mov cx, 0x4de1
inc edi
sub cx, ax
inc esi
dec dword [ebp + 0xc]
movzx ecx, cx
cmp dword [ebp + 0xc], 0
jg 0x8089e38
movzx ax, byte [ebx]
movzx edx, ax
mov al, ch
xor al, dl
mov byte [esi], al
movzx ax, al
add ax, cx
imul ax, ax, 0x522f
mov cx, 0x4de1
inc ebx
sub cx, ax
inc esi
dec dword [ebp + 8]
movzx ecx, cx
jns 0x8089e66
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x808c27b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x30], ebx
jne 0x808c293
xor eax, eax
jmp 0x808c372
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [ebp + 8]
add edi, dword [ebp + 0xc]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ebp + 0xc], ebx
call fcn.08020350
movzx ebx, al
test ebx, ebx
je 0x808c320
mov eax, dword [ebp + 0x10]
and eax, 1
mov dword [ebp + 0x10], eax
mov ecx, dword [esi + 0x30]
inc dword [esi + 0x2c]
call fcn.0801ff0e
push eax
call fcn.0801a51c
xor dword [esi + 0x28], eax
pop ecx
mov ecx, dword [esi + 0x30]
lea eax, [ebp - 0xc]
push eax
call fcn.0801fed5
test al, al
je 0x808c2ed
mov eax, dword [ebp - 0xc]
xor dword [esi + 0x28], eax
cmp dword [ebp + 0x10], 0
jne 0x808c30d
mov eax, dword [ebp + 0xc]
push 0xa
cdq
pop ecx
idiv ecx
inc dword [ebp + 0xc]
test edx, edx
jne 0x808c30d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
ja 0x808c31c
mov ecx, dword [esi + 0x30]
call fcn.08020350
movzx ebx, al
test ebx, ebx
jne 0x808c2c2
test ebx, ebx
jne 0x808c36e
mov ecx, dword [esi + 0x30]
push dword [ecx + 0x14]
call fcn.0808cc7b
mov ecx, dword [esi + 0x30]
push eax
call fcn.0808cc82
mov eax, dword [ebp + 8]
xor ecx, ecx
inc ecx
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
cmp eax, dword [esi + 0x24]
jne 0x808c352
mov edx, dword [esi + 0x28]
cmp edx, dword [esi + 0x20]
jne 0x808c352
and dword [ebp - 4], 0
jmp 0x808c355
mov dword [ebp - 4], ecx
push dword [esi + 8]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [esi + 0x20], eax
call fcn.0801a51c
and dword [esi + 0x2c], 0
pop ecx
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x80b26ea
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp dword [esp + 4], 0
mov edx, 0x10ea
je 0x80b271f
push ebx
push esi
mov bl, byte [ecx]
movzx si, bl
add si, dx
imul si, si, 0x3193
mov al, dh
xor al, bl
mov dx, 0x58bf
sub dx, si
mov byte [ecx], al
inc ecx
dec dword [esp + 0xc]
movzx edx, dx
jne 0x80b26f8
pop esi
pop ebx
ret

Function at 0x80b2720
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
test esi, esi
mov edx, 0xd3f5
jle 0x80b2752
push ebx
push edi
mov bl, byte [ecx]
movzx di, bl
add di, dx
imul di, di, 0x405d
mov al, dh
xor al, bl
add di, 0x53eb
mov byte [ecx], al
inc ecx
dec esi
test esi, esi
movzx edx, di
jg 0x80b272e
pop edi
pop ebx
pop esi
ret
Function at 0x80fa851
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push esi
push edi
push ebx
call fcn.080fa5ac
movzx eax, word [esi + 0xc]
push eax
push edi
push ebx
call fcn.080fd5cd
movzx eax, word [esi + 0xe]
push eax
push edi
push ebx
call fcn.080fd5cd
movzx eax, word [esi + 0x10]
push eax
push edi
push ebx
call fcn.080fd5cd
movzx eax, word [esi + 0x12]
push eax
push edi
push ebx
call fcn.080fd5cd
movzx eax, word [esi + 0x14]
push eax
push edi
push ebx
call fcn.080fd5cd
movzx eax, word [esi + 0x16]
add esp, 0x48
push eax
push edi
push ebx
call fcn.080fd5cd
movzx eax, word [esi + 0x18]
push eax
push edi
push ebx
call fcn.080fd5cd
mov eax, dword [esi + 0x20]
and dword [ebp + 0x10], 0
add esp, 0x18
test eax, eax
mov dword [ebp - 4], eax
jbe 0x80fa8f1
mov eax, dword [esi + 0x1c]
mov ecx, dword [ebp + 0x10]
movzx eax, word [eax + ecx*8]
push eax
push edi
push ebx
call fcn.080fd5cd
add esp, 0xc
inc dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 4]
jb 0x80fa8d1
movzx eax, word [esi + 0x1a]
push eax
push edi
push ebx
call fcn.080fd5cd
and dword [ebp + 0x10], 0
add esp, 0xc
cmp dword [ebp - 4], 0
jbe 0x80fa92b
mov eax, dword [esi + 0x1c]
mov ecx, dword [ebp + 0x10]
movzx eax, word [eax + ecx*8 + 2]
push eax
push edi
push ebx
call fcn.080fd5cd
add esp, 0xc
inc dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 4]
jb 0x80fa90a
and dword [ebp + 0x10], 0
cmp dword [ebp - 4], 0
jbe 0x80fa956
mov eax, dword [esi + 0x1c]
mov ecx, dword [ebp + 0x10]
movzx eax, word [eax + ecx*8 + 4]
push eax
push edi
push ebx
call fcn.080fd5cd
add esp, 0xc
inc dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 4]
jb 0x80fa935
and dword [ebp + 0x10], 0
cmp dword [ebp - 4], 0
jbe 0x80fa981
mov eax, dword [esi + 0x1c]
mov ecx, dword [ebp + 0x10]
movzx eax, word [eax + ecx*8 + 6]
push eax
push edi
push ebx
call fcn.080fd5cd
add esp, 0xc
inc dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 4]
jb 0x80fa960
and dword [ebp + 0x10], 0
cmp dword [esi + 0x2c], 0
jbe 0x80fa9ab
mov eax, dword [esi + 0x24]
mov ecx, dword [ebp + 0x10]
movzx eax, word [eax + ecx*4]
push eax
push edi
push ebx
call fcn.080fd5cd
add esp, 0xc
inc dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
cmp eax, dword [esi + 0x2c]
jb 0x80fa98b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x810421f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 4], 0
cmp dword [esi], 0xc
mov eax, dword [esi + 0x38]
push edi
mov edi, dword [eax]
mov dword [ebp - 8], 0xb
mov dword [ebp - 0x18], 0x7078616d
mov dword [ebp - 0x14], 0x656d616e
mov dword [ebp - 0x10], 0x70657270
jne 0x810428d
mov dword [ebp - 0x38], 0x322f534f
mov dword [ebp - 0x34], 0x20747663
mov dword [ebp - 0x30], 0x6d677066
mov dword [ebp - 0x2c], 0x66796c67
mov dword [ebp - 0x28], 0x64616568
mov dword [ebp - 0x24], 0x61656868
mov dword [ebp - 0x20], 0x78746d68
mov dword [ebp - 0x1c], 0x61636f6c
lea eax, [ebp - 0x38]
jmp 0x81042c1
mov dword [ebp - 0x30], 0x322f534f
mov dword [ebp - 0x2c], 0x20747663
mov dword [ebp - 0x28], 0x6d677066
mov dword [ebp - 0x24], 0x64616568
mov dword [ebp - 0x20], 0x61656868
mov dword [ebp - 0x1c], 0x78746d68
lea eax, [ebp - 0x30]
mov dword [ebp - 8], 9
cmp dword [edi + 0x3c], 0
mov dword [ebp - 0xc], eax
jne 0x8104345
push esi
call fcn.08103df7
test eax, eax
pop ecx
jne 0x81042db
mov ax, 5
jmp 0x8104349
push eax
push dword [esi + 0x14]
call fcn.080febec
test eax, eax
pop ecx
pop ecx
mov dword [edi + 0x38], eax
je 0x81042d5
push ebx
push eax
push esi
call fcn.08103e25
push dword [ebp - 8]
push dword [ebp - 0xc]
push esi
call fcn.08103ee3
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x8104338
push ebx
push dword [esi + 0x14]
call fcn.080febec
test eax, eax
pop ecx
pop ecx
mov dword [edi + 0x3c], eax
jne 0x8104325
mov dword [ebp - 4], 5
jmp 0x8104344
push dword [ebp - 8]
push dword [ebp - 0xc]
push esi
call fcn.08103ee3
add esp, 0xc
test eax, eax
jne 0x8104341
mov dword [ebp - 4], 6
jmp 0x8104344
mov dword [edi + 4], ebx
pop ebx
mov ax, word [ebp - 4]
pop edi
leave
ret
Function at 0x811c6dd
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
push edi
push dword [esp + 0xc]
xor ebx, ebx
mov edi, eax
inc ebx
lea eax, [esi + 0x2c]
push ebx
push eax
call fcn.0811c4d1
add esp, 0xc
test eax, eax
je 0x811c700
mov dword [esi + 4], ebx
mov eax, ebx
jmp 0x811c733
mov edx, dword [esp + 0xc]
test edx, edx
mov eax, dword [esi + 0x30]
jbe 0x811c731
mov cl, byte [edi]
mov bl, byte [esi + 0x29]
xor bl, cl
mov byte [eax], bl
movzx cx, cl
add cx, word [esi + 0x28]
inc edi
imul cx, cx, 0x3193
mov bx, 0x58bf
sub bx, cx
inc eax
dec edx
mov word [esi + 0x28], bx
jne 0x811c70b
xor eax, eax
pop edi
pop ebx
ret

Function at 0x812067f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
push edi
jl 0x81206f1
mov edi, dword [esp + 0x10]
mov edx, dword [edi]
cmp ebx, edx
jg 0x81206f1
mov eax, dword [esp + 0x14]
sub edx, ebx
push esi
mov esi, dword [esp + 0x1c]
mov dword [edi], edx
mov ecx, 0x10ea
mov edi, edx
jmp 0x81206c1
movzx dx, byte [eax]
add dx, cx
imul dx, dx, 0x3193
mov cx, 0x58bf
sub cx, dx
dec ebx
movzx ecx, cx
inc eax
test ebx, ebx
jne 0x81206a9
jmp 0x81206e8
mov dl, byte [eax]
mov bl, ch
xor bl, dl
movzx dx, dl
add dx, cx
imul dx, dx, 0x3193
dec edi
inc eax
mov cx, 0x58bf
mov byte [esi], bl
inc esi
sub cx, dx
movzx ecx, cx
test edi, edi
jne 0x81206c7
xor eax, eax
pop esi
jmp 0x81206f4
push 6
pop eax
pop edi
pop ebx
ret
Function at 0x8124f6f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [edi + 0x38]
push ebx
mov dword [esi], ecx
mov ecx, dword [ebp + 8]
xor ebx, ebx
test eax, eax
mov dword [esi + 4], ecx
je 0x8124fae
test byte [eax], 1
je 0x8124fae
test byte [edi + 0x28], 1
jne 0x8124fae
add eax, 0x16
push eax
push 1
mov eax, edi
call fcn.08124f45
test eax, eax
pop ecx
pop ecx
je 0x8124fab
xor eax, eax
inc eax
jmp 0x8125053
inc dword [esi + 4]
mov eax, dword [edi + 0x2c]
cmp eax, 0xffffffff
je 0x8125034
test eax, eax
je 0x8125000
cmp eax, 1
je 0x8124fe2
cmp eax, 4
jne 0x8125005
push 0x81d7c10
push eax
mov eax, edi
call fcn.08124f45
test eax, eax
pop ecx
pop ecx
jne 0x8124fa3
add dword [esi + 4], 4
mov ebx, 0x42da
jmp 0x8125005
push 0x81d7c10
push 1
mov eax, edi
call fcn.08124f45
test eax, eax
pop ecx
pop ecx
jne 0x8124fa3
inc dword [esi + 4]
mov ebx, 0x6c4d
jmp 0x8125005
mov ebx, 0x10ea
mov eax, dword [ebp + 8]
test eax, eax
mov ecx, dword [ebp + 0xc]
jle 0x8125034
mov dword [ebp - 4], eax
mov al, bh
xor al, byte [ecx]
movzx dx, al
add dx, bx
imul dx, dx, 0x3193
mov bx, 0x58bf
sub bx, dx
mov byte [ecx], al
inc ecx
dec dword [ebp - 4]
movzx ebx, bx
jne 0x8125012
push dword [ebp + 0xc]
mov eax, edi
push dword [ebp + 8]
call fcn.08124f45
test eax, eax
pop ecx
pop ecx
jne 0x8124fa3
mov eax, dword [esi + 4]
add dword [edi + 0x38], eax
xor eax, eax
pop ebx
leave
ret

Function at 0x8126196
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x8230fb8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push esi
push edi
mov edi, ecx
mov esi, edx
lea eax, [ebp - 0x48]
je 0x8126203
push ebx
movzx edx, word [esi + 0x250]
dec dword [ebp + 8]
mov cl, dh
xor cl, byte [edi]
inc edi
movzx bx, cl
add bx, dx
imul bx, bx, 0x3193
mov dx, 0x58bf
sub dx, bx
movzx ecx, cl
mov word [esi + 0x250], dx
mov edx, ecx
shr edx, 4
mov dl, byte [edx + 0x81d7bfc]
and ecx, 0xf
mov cl, byte [ecx + 0x81d7bfc]
mov byte [eax], dl
inc eax
mov byte [eax], cl
inc eax
cmp dword [ebp + 8], 0
jne 0x81261b6
pop ebx
cmp dword [ebp + 0xc], 0
je 0x812621f
mov edx, dword [esi + 0x34]
jmp 0x8126212
mov byte [eax], cl
inc eax
inc edx
mov cl, byte [edx]
test cl, cl
jne 0x812620e
and dword [esi + 0x254], 0
lea ecx, [ebp - 0x48]
push ecx
sub eax, ecx
push eax
call fcn.08126166
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.08047f9e
leave
ret
Function at 0x812623b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, eax
mov ecx, dword [esi + 0x24c]
test ecx, ecx
je 0x8126314
mov eax, dword [esi]
test al, 0x40
push ebx
push edi
je 0x81262ff
test byte [esi + 0x28], 8
lea edx, [esi + 0x4c]
mov dword [ebp - 4], ecx
mov ebx, edx
je 0x81262a4
movzx ecx, word [esi + 0x250]
dec dword [ebp - 4]
mov al, ch
xor al, byte [ebx]
movzx di, al
add di, cx
imul di, di, 0x3193
mov cx, 0x58bf
sub cx, di
mov word [esi + 0x250], cx
mov byte [ebx], al
inc ebx
cmp dword [ebp - 4], 0
jne 0x812626a
push edx
push dword [esi + 0x24c]
jmp 0x8126304
test al, 0x20
je 0x81262b2
push 0x17
and eax, 0xffffffdf
pop edi
mov dword [esi], eax
jmp 0x81262bd
push 0x40
pop edi
sub edi, dword [esi + 0x254]
shr edi, 1
cmp edi, ecx
ja 0x81262dc
push 1
push edi
mov ecx, ebx
mov edx, esi
call fcn.08126196
sub dword [ebp - 4], edi
pop ecx
pop ecx
add ebx, edi
push 0x20
pop edi
cmp dword [ebp - 4], edi
jae 0x81262c1
cmp dword [ebp - 4], 0
jbe 0x81262f2
push 0
push dword [ebp - 4]
mov ecx, ebx
mov edx, esi
call fcn.08126196
pop ecx
pop ecx
mov eax, dword [ebp - 4]
add eax, eax
add dword [esi + 0x254], eax
jmp 0x812630b
lea eax, [esi + 0x4c]
push eax
push ecx
call fcn.08126166
pop ecx
pop ecx
and dword [esi + 0x24c], 0
pop edi
pop ebx
pop esi
leave
ret

Function at 0x8130d83
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x14]
and dword [edi], 0
cmp dword [esp + 0x10], 0
mov esi, ecx
jne 0x8130d99
xor eax, eax
jmp 0x8130dde
push dword [esi + 0x10]
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
call dword [sym.imp.MSVCR80.dll_fread]
add esp, 0x10
test eax, eax
mov dword [edi], eax
jne 0x8130dc3
push dword [esi + 0x10]
call dword [sym.imp.MSVCR80.dll_feof]
test eax, eax
pop ecx
je 0x8130d95
push dword [esi + 0x10]
call dword [sym.imp.MSVCR80.dll_ferror]
test eax, eax
pop ecx
je 0x8130ddb
push dword [esi + 0x10]
call dword [sym.imp.MSVCR80.dll_clearerr]
pop ecx
xor eax, eax
inc eax
pop edi
pop esi
ret 0xc

Function at 0x8130de3
Capabilities:
Write file on windows

Disassembly:
push dword [ecx + 0x10]
push dword [esp + 0xc]
push 1
push dword [esp + 0x10]
call dword [sym.imp.MSVCR80.dll_fwrite]
sub eax, dword [esp + 0x18]
add esp, 0x10
neg eax
sbb eax, eax
inc eax
ret 8