joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ed18c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x3c]
sub eax, dword [ebx + 0x74]
sub eax, dword [ebx + 0x6c]
mov dword [ebp - 8], eax
jmp 0x7ed1c7
mov edx, dword [ebx + 0x2c]
sub edx, 0x106
add edx, esi
cmp edx, dword [ebx + 0x6c]
ja 0x7ed248
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov edi, esi
add edx, edi
push edx
push eax
call fcn.007eb440
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], edi
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x7ed215
mov cx, word [ebp - 4]
sub cx, si
jmp 0x7ed217
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x7ed1fe
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [ebp - 4], ecx
cmp esi, dword [ebp - 4]
ja 0x7ed23d
mov cx, word [ebp - 4]
sub cx, si
jmp 0x7ed23f
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x7ed226
add dword [ebp - 8], esi
mov edi, dword [ebx]
cmp dword [edi + 4], 0
je 0x7ed2aa
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebx + 0x38]
add edx, dword [ebx + 0x6c]
add edx, dword [ebx + 0x74]
push edx
push edi
call fcn.007ece50
add esp, 0xc
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x7ed295
mov ecx, dword [ebx + 0x38]
mov eax, dword [ebx + 0x6c]
movzx eax, byte [ecx + eax]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x7ed2aa
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x7ed19b
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x7f210c
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x8ceaf8
test edx, edx
jne 0x7f212b
xor eax, eax
jmp 0x7f2249
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x7f2148
push esi
push edx
push eax
call fcn.007f2250
add esp, 0xc
jmp 0x7f2249
push esi
push edx
push eax
call fcn.007f2510
add esp, 0xc
jmp 0x7f2249
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x834648
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0xfffffff8
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [edi], eax
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
cmp eax, dword [ebp - 4]
jle 0x8346c2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x70]
sub eax, dword [ebp - 4]
cdq
xor eax, edx
sub eax, edx
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x6c]
mov ecx, dword [eax]
call dword [ecx]
mov esi, eax
xor ebx, ebx
mov eax, dword [ebp + 8]
cmp ebx, dword [eax - 0x18]
jge 0x8346b4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x74]
sub eax, ebx
cdq
xor eax, edx
sub eax, edx
fld dword [esi + eax*4]
mov eax, dword [edi]
fstp qword [eax]
wait
inc ebx
add dword [edi], 8
mov eax, dword [ebp + 8]
cmp ebx, dword [eax - 0x18]
jl 0x834693
inc dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
cmp eax, dword [ebp - 4]
jg 0x83466d
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x83b534
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], edx
mov ebx, dword [eax]
mov eax, dword [eax + 4]
xor esi, esi
mov edx, 0x9e3779b9
mov edi, dword [ecx]
mov dword [esp + 4], edi
mov edi, dword [ecx + 4]
mov dword [esp + 8], edi
mov edi, dword [ecx + 8]
mov dword [esp + 0xc], edi
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, 0xffffffe0
add esi, edx
mov edi, eax
shl edi, 4
add edi, dword [esp + 4]
xor edi, eax
add edi, esi
mov ebp, eax
shr ebp, 5
xor edi, ebp
add edi, dword [esp + 8]
add ebx, edi
mov edi, ebx
shl edi, 4
add edi, dword [esp + 0xc]
xor edi, ebx
add edi, esi
mov ebp, ebx
shr ebp, 5
xor edi, ebp
add edi, dword [esp + 0x10]
add eax, edi
inc ecx
jne 0x83b56a
mov edx, dword [esp]
mov dword [edx], ebx
mov edx, dword [esp]
mov dword [edx + 4], eax
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x83b5b8
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp], edx
mov ebx, dword [eax]
mov eax, dword [eax + 4]
mov esi, 0xc6ef3720
mov edx, 0x9e3779b9
mov edi, dword [ecx]
mov dword [esp + 4], edi
mov edi, dword [ecx + 4]
mov dword [esp + 8], edi
mov edi, dword [ecx + 8]
mov dword [esp + 0xc], edi
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, 0xffffffe0
mov edi, ebx
shl edi, 4
add edi, dword [esp + 0xc]
xor edi, ebx
add edi, esi
mov ebp, ebx
shr ebp, 5
xor edi, ebp
add edi, dword [esp + 0x10]
sub eax, edi
mov edi, eax
shl edi, 4
add edi, dword [esp + 4]
xor edi, eax
add edi, esi
mov ebp, eax
shr ebp, 5
xor edi, ebp
add edi, dword [esp + 8]
sub ebx, edi
sub esi, edx
inc ecx
jne 0x83b5f1
mov edx, dword [esp]
mov dword [edx], ebx
mov edx, dword [esp]
mov dword [edx + 4], eax
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x83b640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, 8
call fcn.00404360
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 4]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xc]
mov ecx, 8
pop edx
call fcn.00868614
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
dec eax
test eax, eax
jl 0x83b755
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jge 0x83b724
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x14]
mov eax, 8
call fcn.00805a1c
mov ebx, eax
mov ecx, ebx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
call fcn.0040e578
cmp ebx, 8
jge 0x83b6fb
mov edi, ebx
dec edi
test edi, edi
jl 0x83b709
inc edi
xor esi, esi
mov eax, dword [ebp - 8]
movzx eax, byte [eax + esi]
mov edx, dword [ebp - 0x24]
xor byte [edx + esi], al
inc esi
dec edi
jne 0x83b6e8
jmp 0x83b709
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
call fcn.0083b534
mov ecx, ebx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0040e578
add dword [ebp - 0x20], ebx
add dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jl 0x83b6ba
cmp word [ebp + 0xa], 0
je 0x83b749
fild dword [ebp - 0x10]
fild dword [ebp - 0x1c]
fdivp st(1)
fmul dword [0x83b768]
call fcn.00404894
mov ecx, eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
call dword [ebp + 8]
inc dword [ebp - 0x10]
dec dword [ebp - 0x28]
jne 0x83b6a0
mov eax, dword [ebp - 0x24]
call fcn.0040437c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x83b76c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, 8
call fcn.00404360
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 4]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0xc]
mov ecx, 8
pop edx
call fcn.00868614
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
dec eax
test eax, eax
jl 0x83b881
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jge 0x83b850
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0x14]
mov eax, 8
call fcn.00805a1c
mov ebx, eax
mov ecx, ebx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
call fcn.0040e578
cmp ebx, 8
jge 0x83b827
mov edi, ebx
dec edi
test edi, edi
jl 0x83b835
inc edi
xor esi, esi
mov eax, dword [ebp - 8]
movzx eax, byte [eax + esi]
mov edx, dword [ebp - 0x24]
xor byte [edx + esi], al
inc esi
dec edi
jne 0x83b814
jmp 0x83b835
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
call fcn.0083b5b8
mov ecx, ebx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0040e578
add dword [ebp - 0x20], ebx
add dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jl 0x83b7e6
cmp word [ebp + 0xa], 0
je 0x83b875
fild dword [ebp - 0x10]
fild dword [ebp - 0x1c]
fdivp st(1)
fmul dword [0x83b894]
call fcn.00404894
mov ecx, eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0xc]
call dword [ebp + 8]
inc dword [ebp - 0x10]
dec dword [ebp - 0x28]
jne 0x83b7cc
mov eax, dword [ebp - 0x24]
call fcn.0040437c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x86b714
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov ebx, edx
mov dword [esp], eax
mov byte [esp + 4], 0
mov eax, dword [esp]
call fcn.0086b1e0
test ebp, ebp
je 0x86b82b
mov esi, ebx
xor ebx, ebx
mov edx, 0x86b838
mov ecx, 0xd
mov eax, esi
call fcn.004160fc
test al, al
je 0x86b774
cmp ebp, ebx
jle 0x86b774
mov edx, 0x86b848
lea eax, [esi + ebx]
mov ecx, 6
call fcn.004160fc
test al, al
je 0x86b76f
add ebx, 6
jmp 0x86b774
inc ebx
cmp ebp, ebx
jg 0x86b754
cmp ebp, ebx
jle 0x86b78d
cmp byte [esi + ebx], 0x1c
je 0x86b78d
inc ebx
cmp ebp, ebx
jg 0x86b778
jmp 0x86b78d
cmp byte [esi + ebx + 1], 0x1c
jne 0x86b794
inc ebx
lea eax, [ebx + 1]
cmp ebp, eax
jg 0x86b785
cmp byte [esi + ebx], 0x1c
jne 0x86b824
inc ebx
lea eax, [ebx + 4]
cmp ebp, eax
jle 0x86b824
movzx eax, byte [esi + ebx]
mov dword [esp + 8], eax
inc ebx
movzx ecx, byte [esi + ebx]
inc ebx
test byte [esi + ebx], 0x80
je 0x86b7e2
movzx edi, byte [esi + ebx + 2]
shl edi, 0x18
movzx eax, byte [esi + ebx + 3]
shl eax, 0x10
add edi, eax
movzx eax, byte [esi + ebx + 4]
shl eax, 8
add edi, eax
movzx eax, byte [esi + ebx + 5]
add edi, eax
add ebx, 6
jmp 0x86b7f3
movzx edi, byte [esi + ebx]
shl edi, 8
movzx eax, byte [esi + ebx + 1]
or edi, eax
add ebx, 2
mov eax, edi
cdq
xor eax, edx
sub eax, edx
mov edi, eax
lea eax, [edi + ebx]
cmp ebp, eax
jl 0x86b824
lea eax, [esi + ebx]
push eax
push edi
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
call fcn.0086b0b0
add ebx, edi
mov byte [esp + 4], 1
cmp ebp, ebx
jg 0x86b794
mov eax, dword [esp]
mov byte [eax + 0xc], 0
movzx eax, byte [esp + 4]
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x8730d8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
test dl, dl
je 0x8730ec
add esp, 0xfffffff0
call fcn.00405d8c
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00405828
mov dl, 1
mov eax, dword [0x85e41c]
call fcn.00886cb8
mov dword [esi + 8], eax
mov byte [esi + 0x34], 0
xor eax, eax
mov dword [esi + 0xa8], eax
xor eax, eax
mov dword [esi + 0xa0], eax
xor eax, eax
mov dword [esi + 0xa4], eax
mov byte [esi + 0x95], 1
xor eax, eax
mov dword [esi + 0x38], eax
xor eax, eax
mov dword [esi + 0x3c], eax
xor eax, eax
mov dword [esi + 0x40], eax
mov byte [esi + 0x94], 2
xor eax, eax
mov dword [esi + 0x44], eax
xor eax, eax
mov dword [esi + 0xc], eax
mov byte [esi + 0x4c], 0
xor eax, eax
mov dword [esi + 0x10], eax
mov byte [esi + 0x4d], 0
xor eax, eax
mov dword [esi + 0x18], eax
xor eax, eax
mov dword [esi + 0x14], eax
mov byte [esi + 0x4e], 1
xor eax, eax
mov dword [esi + 0x1c], eax
xor eax, eax
mov dword [esi + 0x20], eax
xor eax, eax
mov dword [esi + 0x24], eax
xor eax, eax
mov dword [esi + 0x28], eax
mov byte [esi + 0x4f], 0
mov byte [esi + 0x50], 0
mov byte [esi + 0x51], 0
mov dl, 1
mov eax, dword [0x4306d0]
call fcn.00405828
mov dword [esi + 0x2c], eax
mov dl, 1
mov eax, dword [0x4306d0]
call fcn.00405828
mov dword [esi + 0x30], eax
mov byte [esi + 0x60], 1
xor eax, eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
xor eax, eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
xor eax, eax
call fcn.00887324
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp dword [0x91a4e8], 0xffffffff
jne 0x87320b
cmp dword [0x91a4e4], 0xffffffff
jne 0x87320b
cmp dword [ebp - 4], 0
jne 0x8731f3
cmp dword [ebp - 8], 0
jne 0x8731f3
mov dword [esi + 0x58], 0x2000000
mov dword [esi + 0x5c], 0
jmp 0x87321d
fild qword [ebp - 8]
fld xword [0x873278]
fdivp st(1)
call fcn.00404894
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], edx
jmp 0x87321d
mov eax, dword [0x91a4e4]
mov dword [esi + 0x58], eax
mov eax, dword [0x91a4e8]
mov dword [esi + 0x5c], eax
xor eax, eax
xor edx, edx
mov dword [esi + eax*4 + 0x78], edx
inc eax
cmp eax, 4
jne 0x87321f
xor eax, eax
mov dword [esi + 0x8c], eax
movzx eax, byte [0x873284]
mov byte [esi + 4], al
mov dword [esi + 0x64], pe_nt_image_headers32
mov dword [esi + 0x90], 0x20
mov dword [esi + 0x9c], 0xffffffff
mov eax, esi
test bl, bl
je 0x87326d
call fcn.00405de4
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0xa042ae
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0xa042cb
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa042bc
add dl, dl
jne 0xa042d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa04322
xor eax, eax
add dl, dl
jne 0xa042e3
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa043bf
add dl, dl
jne 0xa042f2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa042fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa04308
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa04313
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa0431d
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0xa042c2
mov eax, 1
add dl, dl
jne 0xa04330
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa0433b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa04327
sub eax, 2
jne 0xa0436a
mov ecx, 1
add dl, dl
jne 0xa04350
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa0435b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa04347
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa042c2
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa04381
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa0438c
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa04378
cmp eax, 0x7d00
jae 0xa043af
cmp eax, 0x500
jb 0xa043aa
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa042c2
cmp eax, 0x7f
ja 0xa043b2
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa042c2
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa043db
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa042c2
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8

Function at 0xa348a0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0xa5e03c], 0x8088405
inc edx
mov dword [0xa5e03c], edx
mul edx
mov eax, edx
ret

Function at 0xa3bd80
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffefc
mov ebp, edx
mov dword [esp], eax
xor ebx, ebx
mov esi, dword [esp]
lea edi, [esp + 4]
mov byte [esi], bl
mov eax, ebx
cdq
idiv ecx
add edx, ebp
mov al, byte [edx]
mov byte [edi], al
inc ebx
inc edi
inc esi
cmp ebx, 0x100
jne 0xa3bd98
xor esi, esi
mov ebx, pe_nt_image_headers32
mov eax, dword [esp]
lea edi, [esp + 4]
mov dl, byte [eax]
xor ecx, ecx
mov cl, dl
add esi, ecx
xor ecx, ecx
mov cl, byte [edi]
add esi, ecx
and esi, 0xff
mov ecx, dword [esp]
mov cl, byte [ecx + esi]
mov byte [eax], cl
mov ecx, dword [esp]
mov byte [ecx + esi], dl
inc edi
inc eax
dec ebx
jne 0xa3bdbe
mov edx, dword [esp]
mov eax, dword [esp]
add eax, 0x100
mov ecx, pe_nt_image_headers32
call fcn.00a37a90
add esp, 0x104
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xa3be18
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
xor ecx, ecx
xor edx, edx
mov ebx, dword [ebp + 8]
dec ebx
test ebx, ebx
jl 0xa3bea9
inc ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], 0
inc ecx
and cl, 0xff
xor ebx, ebx
mov bl, cl
add dl, byte [eax + ebx]
and dl, 0xff
xor ebx, ebx
mov bl, cl
mov bl, byte [eax + ebx]
mov byte [ebp - 9], bl
mov esi, edx
and esi, 0xff
xor ebx, ebx
mov bl, cl
lea edi, [eax + ebx]
mov bl, byte [eax + esi]
mov byte [edi], bl
mov bl, byte [ebp - 9]
mov byte [eax + esi], bl
xor ebx, ebx
mov bl, cl
mov bl, byte [eax + ebx]
mov esi, edx
and esi, 0xff
add bl, byte [eax + esi]
and bl, 0xff
mov byte [ebp - 9], bl
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 0x10]
mov bl, byte [ebx + esi]
movzx esi, byte [ebp - 9]
xor bl, byte [eax + esi]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0x10]
mov byte [esi + edi], bl
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0xa3be3e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0xa43448
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 0x54], eax
xor eax, eax
mov dword [ebp - 0x58], eax
xor edi, edi
mov dword [ebp - 0x10], 0x67452301
mov dword [ebp - 0xc], 0xefcdab89
mov dword [ebp - 8], 0x98badcfe
mov dword [ebp - 4], 0x10325476
mov eax, ebx
shl eax, 3
mov edx, eax
add edx, dword [ebp - 0x54]
cmp edx, dword [ebp - 0x54]
jae 0xa43491
inc dword [ebp - 0x58]
add dword [ebp - 0x54], eax
mov eax, ebx
shr eax, 0x1d
add dword [ebp - 0x58], eax
mov esi, dword [ebp + 0xc]
cmp ebx, 0x40
jb 0xa434b9
mov edx, esi
lea eax, [ebp - 0x10]
call fcn.00a43558
add esi, 0x40
sub ebx, 0x40
cmp ebx, 0x40
jae 0xa434a4
test ebx, ebx
jbe 0xa434ce
mov edi, ebx
lea eax, [ebp - 0xa8]
mov ecx, edi
mov edx, esi
call fcn.00a37a90
push edi
lea esi, [ebp - 0x10]
lea edi, [ebp - 0x68]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
lea edx, [ebp - 0xa8]
lea eax, [ebp - 0x50]
mov ecx, edi
call fcn.00a37a90
mov byte [ebp + edi - 0x50], 0x80
lea eax, [edi + 1]
cmp eax, 0x38
jbe 0xa43517
mov edx, 0x40
sub edx, eax
lea eax, [ebp + eax - 0x50]
call fcn.00a37aa4
lea edx, [ebp - 0x50]
lea eax, [ebp - 0x68]
call fcn.00a43558
xor eax, eax
mov edx, 0x38
sub edx, eax
lea eax, [ebp + eax - 0x50]
call fcn.00a37aa4
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x50]
lea eax, [ebp - 0x68]
call fcn.00a43558
mov eax, dword [ebp + 8]
mov edi, eax
lea esi, [ebp - 0x68]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0xa4d5b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, edx
mov esi, eax
mov ebp, edi
mov dword [esp], 1
mov cl, 1
mov edx, edi
mov eax, esi
call fcn.00a4aa48
mov ebx, eax
mov byte [ebp + 0xb4], bl
xor eax, eax
mov al, bl
xor edx, edx
mov dl, byte [esi + 0x10]
add eax, edx
mov edx, eax
and edx, 0xf0
cmp edx, 0x90
jg 0xa4d606
je 0xa4d666
sub edx, 1
jb 0xa4d61c
sub edx, 0x2f
je 0xa4d633
sub edx, 0x50
je 0xa4d655
jmp 0xa4d80d
sub edx, 0xa0
je 0xa4d67f
sub edx, 0x10
je 0xa4d76d
jmp 0xa4d80d
cmp eax, 2
jae 0xa4d80d
mov edx, edi
mov eax, esi
call fcn.00a49664
jmp 0xa4d80d
cmp eax, 0x31
jne 0xa4d80d
mov eax, dword [ebp + 0x94]
xor edx, edx
mov dword [ebp + 0x28], eax
mov eax, dword [ebp + 0x90]
mov dword [ebp + 0x20], eax
jmp 0xa4d80d
mov edx, edi
mov eax, esi
call fcn.00a4b6bc
mov dword [esp], eax
jmp 0xa4d80d
mov edx, ebx
add dl, byte [esi + 0x10]
and dl, 0xf
mov ecx, edi
mov eax, esi
call fcn.00a4d408
mov dword [esp], eax
jmp 0xa4d80d
xor edx, edx
mov dl, byte [ebp + 0xb4]
xor eax, eax
mov al, byte [esi + 0x10]
add edx, eax
mov eax, edx
and eax, 7
cmp eax, 4
je 0xa4d69d
cmp eax, 5
jne 0xa4d6ab
mov edx, edi
mov eax, esi
call fcn.00a4a8a8
jmp 0xa4d80d
cmp edx, 0xaf
jne 0xa4d714
push edi
lea ecx, [ebp + 0xa2]
lea edx, [ebp + 0xa7]
mov eax, esi
call fcn.00a49478
lea edx, [ebp + 0xa2]
mov ecx, edi
mov eax, esi
call fcn.00a49738
mov ebx, eax
lea edx, [ebp + 0xa7]
mov ecx, edi
mov eax, esi
call fcn.00a49738
imul ebx, eax
push edi
lea edx, [ebp + 0xa7]
mov ecx, ebx
mov eax, esi
call fcn.00a497c4
mov eax, ebx
xor edx, edx
push edx
push eax
mov ecx, edi
mov dl, byte [ebp + 0xac]
mov eax, esi
call fcn.00a49854
jmp 0xa4d80d
cmp edx, 0xa2
jne 0xa4d80d
mov eax, dword [ebp + 0x20]
sub eax, 1
jb 0xa4d72f
je 0xa4d750
jmp 0xa4d80d
mov dword [ebp + 0x20], 2
mov dword [ebp + 0x2c], 0x756e6547
mov dword [ebp + 0x24], 0x6c65746e
mov dword [ebp + 0x28], 0x49656e69
jmp 0xa4d80d
mov dword [ebp + 0x20], 0xf10
mov dword [ebp + 0x2c], 0xb
xor eax, eax
mov dword [ebp + 0x24], eax
xor eax, eax
mov dword [ebp + 0x28], eax
jmp 0xa4d80d
xor eax, eax
mov al, byte [ebp + 0xb4]
xor edx, edx
mov dl, byte [esi + 0x10]
add eax, edx
and eax, 7
cmp eax, 6
jne 0xa4d790
mov dword [ebp + 0xac], 1
jmp 0xa4d79a
mov dword [ebp + 0xac], 2
push edi
lea ecx, [ebp + 0xa2]
lea edx, [ebp + 0xa7]
mov eax, esi
call fcn.00a49478
lea edx, [ebp + 0xa2]
mov ecx, edi
mov eax, esi
call fcn.00a49738
mov ebx, eax
xor eax, eax
mov al, byte [ebp + 0xb4]
xor edx, edx
mov dl, byte [esi + 0x10]
add eax, edx
test al, 8
je 0xa4d7f3
cmp dword [ebp + 0xac], 1
jne 0xa4d7e8
mov edx, ebx
mov eax, esi
call fcn.00a48ec0
mov ebx, eax
jmp 0xa4d7f3
mov edx, ebx
mov eax, esi
call fcn.00a48ebc
mov ebx, eax
mov dword [ebp + 0xac], 4
push edi
lea edx, [ebp + 0xa7]
mov ecx, ebx
mov eax, esi
call fcn.00a497c4
mov eax, dword [esp]
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret