joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f9f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xd7
mov dword [ebp - 4], 0
jmp 0x1000fa12
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1f
jge 0x1000fa51
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x26700b95]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000fa4c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000fa09
mov eax, 1
imul ecx, eax, 0x1f
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000fad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1007e274]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x44
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x2e
mov byte [ebp - 8], 0x64
mov byte [ebp - 7], 0x6c
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0
lea eax, [ebp - 0x10]
push eax
call dword [0x100651a8]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x1000fb84
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x6e
mov byte [ebp - 0x21], 0x64
mov byte [ebp - 0x20], 0x62
mov byte [ebp - 0x1f], 0x6f
mov byte [ebp - 0x1e], 0x78
mov byte [ebp - 0x1d], 0x69
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x20
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x21
mov byte [ebp - 0x11], 0
lea ecx, [ebp - 0x24]
push ecx
call fcn.1001c000
add esp, 4
call fcn.1001c250
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003eb3c
mov esp, ebp
pop ebp
ret
Function at 0x1000fd67
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jae 0x1000fd65
jmp 0x1000fd60
call fcn.1000fd67
jae 0x1000fd60
add esp, 4
jmp 0x1000fd6c
dec dword [esp]
jno 0x1000fd71
jns 0x1000fd5c
jp 0x1000fd75
add esp, 4
popf
jmp 0x1000fd7c
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000fd95
jne 0x1000fd95
inc edx
jl 0x1000fd9a
jmp 0x1000fd9c
je 0x1000fd97
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000fdb6
jne 0x1000fdb5
call 0x9304ee3d
rol byte [ebx + eax*4], 0xf0
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000fdc4
add eax, 0x1750374
jne 0x1000fdc4
call 0x35e5438e
mov byte [ebp - 0x1c], 0x25
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x25
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x25
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x25
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x25
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x25
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x25
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0
lea eax, [ebp - 0x1c]
push eax
call dword [0x10065160]
clc
jae 0x1000fe2f
jg 0x1000fdbe
pushf
push 0xa
jae 0x1000fe3c
jmp 0x1000fe37
call 0x1000fe3e
jae 0x1000fe37
add esp, 4
jmp 0x1000fe43
dec dword [esp]
jno 0x1000fe48
jns 0x1000fe33
jp 0x1000fe4c
add esp, 4
popf
jmp 0x1000fe53
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000fe6c
jne 0x1000fe6c
invalid
jl 0x1000fe71
jmp 0x1000fe73
je 0x1000fe6e
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000fe8d
jne 0x1000fe8c
call 0x9304ef14
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000fe9b
jne 0x1000fe9b
call 0x9b5c5cfe
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003eb3c
mov esp, ebp
pop ebp
ret

Function at 0x1000fee8
Capabilities:
Access peb ldr_data

Disassembly:
jae 0x1000fee6
jmp 0x1000fee1
call fcn.1000fee8
jae 0x1000fee1
add esp, 4
jmp 0x1000feed
dec dword [esp]
jno 0x1000fef2
jns 0x1000fedd
jp 0x1000fef6
add esp, 4
popf
jmp 0x1000fefd
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000ff16
jne 0x1000ff16
call 0x1fc1326a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x20], 0x20000
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1001b2d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1007e274]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov byte [ebp - 0x2c], 0x50
mov byte [ebp - 0x2b], 0x6b
mov byte [ebp - 0x2a], 0x48
mov byte [ebp - 0x29], 0x59
mov byte [ebp - 0x28], 0x63
mov byte [ebp - 0x27], 0x71
mov byte [ebp - 0x26], 0x50
mov byte [ebp - 0x25], 0x45
mov byte [ebp - 0x24], 0x4c
mov byte [ebp - 0x23], 0x49
mov byte [ebp - 0x22], 0x79
mov byte [ebp - 0x21], 0x6e
mov byte [ebp - 0x20], 0x52
mov byte [ebp - 0x1f], 0x45
mov byte [ebp - 0x1e], 0x44
mov byte [ebp - 0x1d], 0x4f
mov byte [ebp - 0x1c], 0
mov dword [ebp - 0x40], 0x6235d4
mov byte [ebp - 0x18], 0x72
mov byte [ebp - 0x17], 0x6f
mov byte [ebp - 0x16], 0x6c
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x72
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x64
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x72
mov byte [ebp - 0xf], 0
mov dword [ebp - 0x44], 0x680f80
mov byte [ebp - 0xc], 0x73
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0xa], 0x61
mov byte [ebp - 9], 0x6c
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0
mov dword [ebp - 0x48], 0x680f4c
xorps xmm0, xmm0
movss dword [ebp - 0x4c], xmm0
push 0x104
push 0x1007f968
push 0
call dword [0x100651ac]
push 0x1007f968
call fcn.10044270
add esp, 4
sub eax, 1
mov dword [ebp - 0x30], eax
jmp 0x1001b3b4
mov eax, dword [ebp - 0x30]
sub eax, 1
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x1001b3f0
mov ecx, dword [ebp - 0x30]
movsx edx, byte [ecx + 0x1007f968]
cmp edx, 0x5c
jne 0x1001b3ee
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x104
jae 0x1001b3dd
jmp 0x1001b3e2
call fcn.1003ea62
mov ecx, dword [ebp - 0x34]
mov byte [ecx + 0x1007f968], 0
jmp 0x1001b3f0
jmp 0x1001b3ab
push str.FullScreen.ini
push 0x1007f968
call fcn.1004b5b0
add esp, 8
push 0x1007f968
push 0x19
push 0x100667f8
push 0x10066800
call dword [0x10065084]
cmp eax, 0xa00
jle 0x1001b429
mov dword [ebp - 0x38], 0xa00
jmp 0x1001b443
push 0x1007f968
push 0x19
push str.Width
push 0x10066810
call dword [0x10065084]
mov dword [ebp - 0x38], eax
mov edx, dword [ebp - 0x38]
mov dword [0x1007f8f4], edx
push 0x1007f968
push 0x19
push 0x10066818
push 0x10066820
call dword [0x10065084]
cmp eax, 0x5a0
jle 0x1001b473
mov dword [ebp - 0x3c], 0x5a0
jmp 0x1001b48d
push 0x1007f968
push 0x19
push str.Height
push 0x10066830
call dword [0x10065084]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [0x1007f8f8], eax
push 0x1007f968
push 0x3c
push 0x10066838
push str.Screen
call dword [0x10065084]
mov dword [0x1007f8fc], eax
cmp dword [0x1007f8fc], 0x384
jle 0x1001b4c7
mov dword [0x1007f8fc], 0x384
cmp dword [0x1007f8fc], 0x3c
jge 0x1001b4da
mov dword [0x1007f8fc], 0x3c
cmp dword [0x1007f8fc], 0x3c
jle 0x1001b4f2
mov ecx, dword [0x1007f8fc]
push ecx
call fcn.1001bc40
add esp, 4
clc
jae 0x1001b4f7
xchg edi, eax
mov al, 0x66
pushfd
pushf
push 0xa
Function at 0x1001c250
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x8003
call dword [0x100650a0]
xor eax, eax
test eax, eax
je 0x1001c26a
jne 0x1001c269
call 0x9305b2f1
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001c278
jmp 0x1001c27a
je 0x1001c275
clc
jae 0x1001c27f
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x1001c284
jne 0x1001c284
pop eax
pushf
push 0xa
jae 0x1001c291
jmp 0x1001c28c
call 0x1001c293
jae 0x1001c28c
add esp, 4
jmp 0x1001c298
dec dword [esp]
jno 0x1001c29d
jns 0x1001c288
jp 0x1001c2a1
add esp, 4
popf
jmp 0x1001c2a8
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001c2c1
jne 0x1001c2c1
call 0x1fc1f615
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0xffffffffffffffff
call fcn.1004c418
clc
jae 0x1001c2de
shl byte [ecx], 1
pushf
push 0xa
jae 0x1001c2eb
jmp 0x1001c2e6
call 0x1001c2ed
jae 0x1001c2e6
add esp, 4
jmp 0x1001c2f2
dec dword [esp]
jno 0x1001c2f7
jns 0x1001c2e2
jp 0x1001c2fb
add esp, 4
popf
jmp 0x1001c302
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001c31b
jne 0x1001c31b
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x1001c320
jmp 0x1001c322
je 0x1001c31d
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001c33c
jne 0x1001c33b
call 0x9305b3c3
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001c34a
jne 0x1001c34a
call fcn.1001c40a
add byte [ebx], dh
rol byte [ebp + 0x750374c0], 0
mov esp, 0
xor eax, eax
test eax, eax
je 0x1001c358
add esi, dword [ebp]
jne 0x1001c357
call 0x9305b3df
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
out 0x74, eax
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001c366
jmp 0x1001c368
je 0x1001c363
clc
jae 0x1001c36d
jp 0x1001c354
je 0x1001c372
jne 0x1001c372
out 0x66, eax
pushfd
pushf
push 0xa
jae 0x1001c37f
jmp 0x1001c37a
call 0x1001c381
jae 0x1001c37a
add esp, 4
jmp 0x1001c386
dec dword [esp]
jno 0x1001c38b
jns 0x1001c376
jp 0x1001c38f
add esp, 4
popf
jmp 0x1001c396
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001c3af
jne 0x1001c3af
call 0x1fc1f703
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1001c293
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x8003
call dword [0x100650a0]
xor eax, eax
test eax, eax
je 0x1001c26a
jne 0x1001c269
call 0x9305b2f1
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
pop eax
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001c278
jmp 0x1001c27a
je 0x1001c275
clc
jae 0x1001c27f
sub dword [eax + 0x74], ebx
add esi, dword [ebp + 1]
je 0x1001c284
jne 0x1001c284
pop eax
pushf
push 0xa
jae 0x1001c291
jmp 0x1001c28c
call 0x1001c293
jae 0x1001c28c
add esp, 4
jmp 0x1001c298
dec dword [esp]
jno 0x1001c29d
jns 0x1001c288
jp 0x1001c2a1
add esp, 4
popf
jmp 0x1001c2a8
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001c2c1
jne 0x1001c2c1
call 0x1fc1f615
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0xffffffffffffffff
call fcn.1004c418
clc
jae 0x1001c2de
shl byte [ecx], 1
pushf
push 0xa
jae 0x1001c2eb
jmp 0x1001c2e6
call 0x1001c2ed
jae 0x1001c2e6
add esp, 4
jmp 0x1001c2f2
dec dword [esp]
jno 0x1001c2f7
jns 0x1001c2e2
jp 0x1001c2fb
add esp, 4
popf
jmp 0x1001c302
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001c31b
jne 0x1001c31b
and dword [ebx + eax - 0x15], edi
add esp, dword [ecx]
jl 0x1001c320
jmp 0x1001c322
je 0x1001c31d
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001c33c
jne 0x1001c33b
call 0x9305b3c3
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001c34a
jne 0x1001c34a
call fcn.1001c40a
add byte [ebx], dh
rol byte [ebp + 0x750374c0], 0
mov esp, 0
xor eax, eax
test eax, eax
je 0x1001c358
add esi, dword [ebp]
jne 0x1001c357
call 0x9305b3df
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
out 0x74, eax
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001c366
jmp 0x1001c368
je 0x1001c363
clc
jae 0x1001c36d
jp 0x1001c354
je 0x1001c372
jne 0x1001c372
out 0x66, eax
pushfd
pushf
push 0xa
jae 0x1001c37f
jmp 0x1001c37a
call 0x1001c381
jae 0x1001c37a
add esp, 4
jmp 0x1001c386
dec dword [esp]
jno 0x1001c38b
jns 0x1001c376
jp 0x1001c38f
add esp, 4
popf
jmp 0x1001c396
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001c3af
jne 0x1001c3af
call 0x1fc1f703
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1001c6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x26
mov dword [ebp - 4], 0
jmp 0x1001c6c2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x1001c701
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x5e8de71]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001c6fc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1001c6b9
mov eax, 1
shl eax, 2
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001c750
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0xc]
add edx, 0xc
cmp dword [ebp - 8], edx
je 0x1001c823
cmp dword [ebp - 8], 0
je 0x1001c823
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
cmp edx, dword [ecx + 0x18]
jne 0x1001c816
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x1c]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x20]
mov dword [eax + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x30]
mov dword [eax + 0x18], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x2c]
mov word [eax + 0x14], dx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x2e]
mov word [eax + 0x16], dx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x28]
mov dword [eax + 0x10], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x24]
mov word [eax + 0xc], dx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov dx, word [ecx + 0x26]
mov word [eax + 0xe], dx
mov al, 1
jmp 0x1001c825
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 8], ecx
jmp 0x1001c772
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x1001cf00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x31
mov dword [ebp - 4], 0
jmp 0x1001cf22
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x14
jge 0x1001cf61
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0xe0e17dc]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001cf5c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1001cf19
mov eax, 1
imul ecx, eax, 0x14
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001cf80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x32
mov dword [ebp - 4], 0
jmp 0x1001cfa2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 9
jge 0x1001cfe1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x360db817]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001cfdc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1001cf99
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001d000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x65
mov dword [ebp - 4], 0
jmp 0x1001d022
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x18
jge 0x1001d061
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x1177187e]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001d05c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1001d019
mov eax, 1
imul ecx, eax, 0x18
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1001d080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x9b
mov dword [ebp - 4], 0
jmp 0x1001d0a2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x12
jge 0x1001d0e1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x654a77ba]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001d0dc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1001d099
mov eax, 1
imul ecx, eax, 0x12
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001d100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xa7
mov dword [ebp - 4], 0
jmp 0x1001d122
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x3e
jge 0x1001d161
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x56615325]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001d15c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1001d119
mov eax, 1
imul ecx, eax, 0x3e
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1001d200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xf
mov dword [ebp - 4], 0
jmp 0x1001d222
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 9
jge 0x1001d261
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x6a21bdf2]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001d25c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1001d219
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x1001d280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xf4
mov dword [ebp - 4], 0
jmp 0x1001d2a2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 9
jge 0x1001d2e1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x2692055e]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001d2dc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1001d299
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10020650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x1c
mov dword [ebp - 4], 0
jmp 0x10020672
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x12
jge 0x100206b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x7439b674]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x100206ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10020669
mov eax, 1
imul ecx, eax, 0x12
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100206d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x8f
mov dword [ebp - 4], 0
jmp 0x100206f2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc
jge 0x10020731
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x1048d96e]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1002072c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x100206e9
mov eax, 1
imul ecx, eax, 0xc
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10020750
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xd6
mov dword [ebp - 4], 0
jmp 0x10020772
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 9
jge 0x100207b1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x57268526]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x100207ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10020769
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4