joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001f4d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x51
mov dword [ebp - 8], 0
jmp 0x1001f4f2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x35
jge 0x1001f531
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x4c157402]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001f52c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1001f4e9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x35], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001f550
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xbb
mov dword [ebp - 8], 0
jmp 0x1001f572
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x37
jge 0x1001f5b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x44b04816]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001f5ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1001f569
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x37], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001f5d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x5b
mov dword [ebp - 8], 0
jmp 0x1001f5f2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1f
jge 0x1001f631
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x6dbdf221]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001f62c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1001f5e9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1f], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001f650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x16
mov dword [ebp - 8], 0
jmp 0x1001f672
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2f
jge 0x1001f6b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x41f7e28]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001f6ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1001f669
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x2f], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1001f6d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x52
mov dword [ebp - 8], 0
jmp 0x1001f6f2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x31
jge 0x1001f731
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x32930725]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001f72c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1001f6e9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x31], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001f750
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x9f
mov dword [ebp - 8], 0
jmp 0x1001f772
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2d
jge 0x1001f7b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x1b878a5c]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001f7ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1001f769
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x2d], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001f7d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x4c
mov dword [ebp - 8], 0
jmp 0x1001f7f2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2f
jge 0x1001f831
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x382edb02]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001f82c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1001f7e9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x2f], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001f850
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x73
mov dword [ebp - 8], 0
jmp 0x1001f872
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x12
jge 0x1001f8b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x7d758fdb]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001f8ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1001f869
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x12], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1001f8d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x95
mov dword [ebp - 8], 0
jmp 0x1001f8f2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x13
jge 0x1001f931
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x23fd3090]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001f92c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1001f8e9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x13], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001f950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x40
mov dword [ebp - 8], 0
jmp 0x1001f972
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x13
jge 0x1001f9b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x29ca2a1c]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001f9ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x1001f969
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x13], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10021ef0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
push 4
push 0
push 0x100218c0
mov ecx, dword [0x10083160]
call fcn.10025c60
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10021ffd
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x34
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
mov ecx, dword [0x10082630]
call fcn.100011e0
push eax
push 0
lea eax, [ebp - 0x34]
push eax
push 0
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [0x10082634]
call fcn.1000e970
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10022580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x38
mov dword [ebp - 8], 0
jmp 0x100225a2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x14
jge 0x100225e1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x62d1dd5f]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x100225dc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10022599
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x14], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10022b60
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
jmp 0x10022b78
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp - 0xc]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 0
jmp 0x10022bad
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0xc]
movzx eax, word [edx + 6]
cmp dword [ebp - 0x10], eax
jge 0x10022c00
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x28
add ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.1003bf90
add esp, 8
test eax, eax
jne 0x10022bfe
mov eax, dword [ebp - 0x10]
imul eax, eax, 0x28
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax + 0xc]
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x28
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + ecx + 0x10]
mov dword [edx], ecx
mov al, 1
jmp 0x10022c14
jmp 0x10022ba4
jmp 0x10022c12
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x10022d90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10056043
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x94
jmp 0x10022dc0
movzx eax, byte [0x100835c8]
test eax, eax
jne 0x10022dd0
jmp 0x10022f4f
call fcn.10022c20
mov dword [ebp - 0x10], eax
mov ecx, dword [0x10082620]
call fcn.10007ff0
movzx ecx, al
test ecx, ecx
jne 0x10022e94
cmp dword [0x100835cc], 0
je 0x10022e01
cmp dword [ebp - 0x10], 0
jne 0x10022e94
push 0x741b6442
lea ecx, [ebp - 0x60]
call fcn.10023140
mov dword [ebp - 0x94], eax
mov edx, dword [ebp - 0x94]
mov dword [ebp - 0x98], edx
mov dword [ebp - 4], 0
push 0x741b6472
lea ecx, [ebp - 0x90]
call fcn.10023140
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 1
mov ecx, dword [0x10082630]
call fcn.100011e0
push eax
push 0
mov ecx, dword [ebp - 0x98]
push ecx
push 0
mov edx, dword [ebp - 0xa0]
push edx
mov ecx, dword [0x10082634]
call fcn.1000e970
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x90]
call fcn.10023110
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.10023110
mov eax, dword [0x100835cc]
cmp eax, dword [ebp - 0x10]
je 0x10022f3d
mov byte [ebp - 0x30], 0x4d
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x6d
mov byte [ebp - 0x2d], 0x6f
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x79
mov byte [ebp - 0x2a], 0x20
mov byte [ebp - 0x29], 0x6d
mov byte [ebp - 0x28], 0x6f
mov byte [ebp - 0x27], 0x64
mov byte [ebp - 0x26], 0x69
mov byte [ebp - 0x25], 0x66
mov byte [ebp - 0x24], 0x69
mov byte [ebp - 0x23], 0x63
mov byte [ebp - 0x22], 0x61
mov byte [ebp - 0x21], 0x74
mov byte [ebp - 0x20], 0x69
mov byte [ebp - 0x1f], 0x6f
mov byte [ebp - 0x1e], 0x6e
mov byte [ebp - 0x1d], 0x20
mov byte [ebp - 0x1c], 0x44
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x63
mov byte [ebp - 0x17], 0x74
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x14], 0x21
mov byte [ebp - 0x13], 0
mov ecx, dword [0x10082630]
call fcn.100011e0
push eax
push 0
lea ecx, [ebp - 0x30]
push ecx
push 0
lea edx, [ebp - 0x30]
push edx
mov ecx, dword [0x10082634]
call fcn.1000e970
jmp 0x10022f4f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10022fd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
jmp 0x10022feb
push 9
push 0
push 0x10022f60
mov ecx, dword [0x10083160]
call fcn.10025c60
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100230ef
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x39
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
mov ecx, dword [0x10082630]
call fcn.100011e0
push eax
push 0
lea eax, [ebp - 0x34]
push eax
push 0
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [0x10082634]
call fcn.1000e970
jmp 0x10023101
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10023140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xbb
mov dword [ebp - 8], 0
jmp 0x10023162
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2f
jge 0x100231a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x6415507e]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1002319c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10023159
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x2f], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10023580
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10056790
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
mov dword [ebp - 0x68], ecx
jmp 0x100235b0
push 0x10
push 0
push 0x10023260
mov ecx, dword [0x10083160]
call fcn.10025c60
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10023741
mov byte [ebp - 0x44], 0x45
mov byte [ebp - 0x43], 0x52
mov byte [ebp - 0x42], 0x52
mov byte [ebp - 0x41], 0x4f
mov byte [ebp - 0x40], 0x52
mov byte [ebp - 0x3f], 0x21
mov byte [ebp - 0x3e], 0x20
mov byte [ebp - 0x3d], 0x54
mov byte [ebp - 0x3c], 0x68
mov byte [ebp - 0x3b], 0x72
mov byte [ebp - 0x3a], 0x65
mov byte [ebp - 0x39], 0x61
mov byte [ebp - 0x38], 0x64
mov byte [ebp - 0x37], 0x20
mov byte [ebp - 0x36], 0x63
mov byte [ebp - 0x35], 0x72
mov byte [ebp - 0x34], 0x65
mov byte [ebp - 0x33], 0x61
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x69
mov byte [ebp - 0x30], 0x6f
mov byte [ebp - 0x2f], 0x6e
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x66
mov byte [ebp - 0x2c], 0x61
mov byte [ebp - 0x2b], 0x69
mov byte [ebp - 0x2a], 0x6c
mov byte [ebp - 0x29], 0x65
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x2c
mov byte [ebp - 0x26], 0x20
mov byte [ebp - 0x25], 0x54
mov byte [ebp - 0x24], 0x68
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x61
mov byte [ebp - 0x20], 0x64
mov byte [ebp - 0x1f], 0x20
mov byte [ebp - 0x1e], 0x43
mov byte [ebp - 0x1d], 0x6f
mov byte [ebp - 0x1c], 0x64
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x20
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0x78
mov byte [ebp - 0x17], 0x31
mov byte [ebp - 0x16], 0x36
mov byte [ebp - 0x15], 0x21
mov byte [ebp - 0x14], 0
mov ecx, dword [0x10082630]
call fcn.100011e0
push eax
push 0
lea eax, [ebp - 0x44]
push eax
push 0
lea ecx, [ebp - 0x44]
push ecx
mov ecx, dword [0x10082634]
call fcn.1000e970
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x10023753
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10023770
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10056006
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x464
mov dword [ebp - 0x460], ecx
jmp 0x100237a6
push 0x10
mov ecx, dword [0x10083160]
call fcn.10023240
test eax, eax
jne 0x100239e9
mov byte [ebp - 0x43c], 0x54
mov byte [ebp - 0x43b], 0x68
mov byte [ebp - 0x43a], 0x72
mov byte [ebp - 0x439], 0x65
mov byte [ebp - 0x438], 0x61
mov byte [ebp - 0x437], 0x64
mov byte [ebp - 0x436], 0x20
mov byte [ebp - 0x435], 0x63
mov byte [ebp - 0x434], 0x6f
mov byte [ebp - 0x433], 0x6d
mov byte [ebp - 0x432], 0x6d
mov byte [ebp - 0x431], 0x75
mov byte [ebp - 0x430], 0x6e
mov byte [ebp - 0x42f], 0x69
mov byte [ebp - 0x42e], 0x63
mov byte [ebp - 0x42d], 0x61
mov byte [ebp - 0x42c], 0x74
mov byte [ebp - 0x42b], 0x69
mov byte [ebp - 0x42a], 0x6f
mov byte [ebp - 0x429], 0x6e
mov byte [ebp - 0x428], 0x20
mov byte [ebp - 0x427], 0x66
mov byte [ebp - 0x426], 0x61
mov byte [ebp - 0x425], 0x69
mov byte [ebp - 0x424], 0x6c
mov byte [ebp - 0x423], 0x65
mov byte [ebp - 0x422], 0x64
mov byte [ebp - 0x421], 0x21
mov byte [ebp - 0x420], 0x20
mov byte [ebp - 0x41f], 0x54
mov byte [ebp - 0x41e], 0x68
mov byte [ebp - 0x41d], 0x72
mov byte [ebp - 0x41c], 0x65
mov byte [ebp - 0x41b], 0x61
mov byte [ebp - 0x41a], 0x64
mov byte [ebp - 0x419], 0x20
mov byte [ebp - 0x418], 0x63
mov byte [ebp - 0x417], 0x6f
mov byte [ebp - 0x416], 0x64
mov byte [ebp - 0x415], 0x65
mov byte [ebp - 0x414], 0x3a
mov byte [ebp - 0x413], 0x20
mov byte [ebp - 0x412], 0x25
mov byte [ebp - 0x411], 0x64
mov byte [ebp - 0x410], 0
push 0x10
lea eax, [ebp - 0x43c]
push eax
push 0x2000
lea ecx, [ebp - 0x40c]
push ecx
call fcn.100521f0
add esp, 0x10
mov ecx, dword [0x10082630]
call fcn.100011e0
push eax
push 0
lea edx, [ebp - 0x40c]
push edx
push 0
lea eax, [ebp - 0x40c]
push eax
mov ecx, dword [0x10082634]
call fcn.1000e970
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
mov ecx, dword [0x10083160]
call fcn.10023210
jmp 0x10023a08
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10023cf0
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10055fe6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x47c
mov dword [ebp - 0x478], ecx
jmp 0x10023d26
mov eax, dword [0x1008360c]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x100835f8]
mov dword [ebp - 0x14], ecx
mov edx, dword [0x10083604]
mov dword [ebp - 0x10], edx
mov byte [ebp - 0x4c], 0x54
mov byte [ebp - 0x4b], 0x68
mov byte [ebp - 0x4a], 0x72
mov byte [ebp - 0x49], 0x65
mov byte [ebp - 0x48], 0x61
mov byte [ebp - 0x47], 0x64
mov byte [ebp - 0x46], 0x20
mov byte [ebp - 0x45], 0x69
mov byte [ebp - 0x44], 0x6e
mov byte [ebp - 0x43], 0x74
mov byte [ebp - 0x42], 0x65
mov byte [ebp - 0x41], 0x67
mov byte [ebp - 0x40], 0x72
mov byte [ebp - 0x3f], 0x69
mov byte [ebp - 0x3e], 0x74
mov byte [ebp - 0x3d], 0x79
mov byte [ebp - 0x3c], 0x20
mov byte [ebp - 0x3b], 0x66
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x69
mov byte [ebp - 0x38], 0x6c
mov byte [ebp - 0x37], 0x65
mov byte [ebp - 0x36], 0x64
mov byte [ebp - 0x35], 0x21
mov byte [ebp - 0x34], 0x20
mov byte [ebp - 0x33], 0x45
mov byte [ebp - 0x32], 0x72
mov byte [ebp - 0x31], 0x72
mov byte [ebp - 0x30], 0x6f
mov byte [ebp - 0x2f], 0x72
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x63
mov byte [ebp - 0x2c], 0x6f
mov byte [ebp - 0x2b], 0x64
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x3a
mov byte [ebp - 0x28], 0x20
mov byte [ebp - 0x27], 0x25
mov byte [ebp - 0x26], 0x64
mov byte [ebp - 0x25], 0x20
mov byte [ebp - 0x24], 0x54
mov byte [ebp - 0x23], 0x79
mov byte [ebp - 0x22], 0x70
mov byte [ebp - 0x21], 0x65
mov byte [ebp - 0x20], 0x3a
mov byte [ebp - 0x1f], 0x20
mov byte [ebp - 0x1e], 0x25
mov byte [ebp - 0x1d], 0x64
mov byte [ebp - 0x1c], 0
mov dword [ebp - 0x50], 0
jmp 0x10023e16
mov eax, dword [ebp - 0x50]
add eax, 1
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jae 0x10023f38
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp + ecx*4 - 0x18]
push edx
call fcn.10023be0
add esp, 4
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x10023f33
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x50]
push ecx
lea edx, [ebp - 0x4c]
push edx
push 0x2000
lea eax, [ebp - 0x454]
push eax
call fcn.100521f0
add esp, 0x14
mov ecx, dword [0x10082630]
call fcn.100011e0
push eax
push 0
lea ecx, [ebp - 0x454]
push ecx
push 0
lea edx, [ebp - 0x454]
push edx
mov ecx, dword [0x10082634]
call fcn.1000e970
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x10023e0d
jmp 0x10023f4a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret