joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e00a0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, 0x51
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov dword [esp + 8], 0
mov dword [esi], eax
mov dword [esi + 0x24], 0x1111ff1f
mov dword [esi + 0x38], eax
lea ecx, [esi + 0xf8]
mov dword [ecx], eax
inc eax
add ecx, 4
cmp eax, 0xa
jb 0x5e00cc
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [esi + 0xa0], eax
jne 0x5e010f
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x5e0106
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], 1
pop edi
mov eax, 1
pop esi
pop ecx
ret
lea eax, [esp + 8]
push eax
push 0
push esi
push 0x5e0f00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0xa4], eax
jne 0x5e0150
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x5e0147
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], 4
pop edi
mov eax, 1
pop esi
pop ecx
ret
push 0xf
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
xor eax, eax
pop esi
pop ecx
ret
Function at 0x5e1ba0
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x277fba8
push 8
push edi
call fcn.005e1c00
add esp, 8
mov edx, 8
shl eax, 0x18
mov dword [esi], eax
mov ebx, eax
mov ecx, ebx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
dec edx
mov ebx, eax
jne 0x5e1bc1
push 0x20
push eax
mov dword [esi], ebx
call fcn.005e1c00
mov dword [esi], eax
add esp, 8
add esi, 4
inc edi
cmp esi, 0x277ffa4
jle 0x5e1baa
pop edi
pop esi
pop ebx
ret

Function at 0x5e1c30
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
or eax, 0xffffffff
test edx, edx
je 0x5e1c63
push ebx
push esi
lea esi, [edx]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x277fba8]
xor eax, edx
inc ecx
dec esi
jne 0x5e1c43
pop esi
pop ebx
not eax
ret

Function at 0x5e1c70
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1004
call fcn.005c6530
mov eax, dword [esp + 0x1008]
push ebx
push esi
or esi, 0xffffffff
cmp eax, 0x400000
je 0x5e1d46
push ebp
push edi
mov ecx, 0x3ff
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
mov ebp, dword [esp + 0x1020]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x101c]
mov dword [esp + 0x10], eax
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x14]
cmp ebp, 0x1000
lea ebx, [esp + 0x14]
rep stosd dword es:[edi], eax
jl 0x5e1ce0
mov edi, 0x1000
sub ebp, 0x1000
jmp 0x5e1ce4
mov edi, ebp
xor ebp, ebp
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x1018]
lea ecx, [esp + 0x14]
push ecx
push edi
push edx
push eax
call fcn.005ea180
add esp, 0x10
mov ecx, edi
dec edi
test ecx, ecx
je 0x5e1d25
inc edi
mov edx, esi
xor eax, eax
mov al, byte [ebx]
and edx, 0xff
xor edx, eax
shr esi, 8
mov ecx, dword [edx*4 + 0x277fba8]
xor esi, ecx
inc ebx
dec edi
jne 0x5e1d07
mov ecx, dword [esp + 0x10]
add ecx, 0x1000
test ebp, ebp
mov dword [esp + 0x10], ecx
jne 0x5e1cba
pop edi
pop ebp
mov eax, esi
pop esi
not eax
pop ebx
add esp, 0x1004
ret
mov ecx, dword [esp + 0x1018]
mov eax, dword [esp + 0x1014]
test ecx, ecx
je 0x5e1d76
mov edx, esi
xor ebx, ebx
mov bl, byte [eax]
and edx, 0xff
xor edx, ebx
shr esi, 8
mov edx, dword [edx*4 + 0x277fba8]
xor esi, edx
inc eax
dec ecx
jne 0x5e1d58
mov eax, esi
pop esi
not eax
pop ebx
add esp, 0x1004
ret
Function at 0x5e8f50
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x20
cdq
and edx, 0xf
add eax, edx
sar eax, 4
test eax, eax
jle 0x5e9001
mov ecx, dword [esp + 0x2c]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
sub edi, ecx
mov esi, ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], eax
jmp 0x5e8f86
mov edi, dword [esp + 0x3c]
lea ecx, [esp + 0x10]
add edi, esi
mov ebp, 4
xor eax, eax
mov ebx, dword [ecx]
xor edx, edx
mov dl, byte [edi + eax]
shl ebx, 8
xor edx, ebx
inc eax
cmp eax, 4
mov dword [ecx], edx
jl 0x5e8f93
add ecx, 4
add edi, 4
dec ebp
jne 0x5e8f91
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x20]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.005e6c90
add esp, 0xc
lea ebp, [esp + 0x20]
mov edx, 4
mov edi, dword [ebp]
xor eax, eax
mov ecx, 0x18
mov ebx, edi
sub ecx, eax
add eax, 8
shr ebx, cl
inc esi
cmp eax, 0x20
mov byte [esi - 1], bl
jl 0x5e8fd5
add ebp, 4
dec edx
jne 0x5e8fd0
mov eax, dword [esp + 0x38]
dec eax
mov dword [esp + 0x38], eax
jne 0x5e8f82
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x5e9010
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x20
cdq
and edx, 0xf
add eax, edx
sar eax, 4
test eax, eax
jle 0x5e90c1
mov ecx, dword [esp + 0x2c]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
sub edi, ecx
mov esi, ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], eax
jmp 0x5e9046
mov edi, dword [esp + 0x3c]
lea ecx, [esp + 0x10]
add edi, esi
mov ebp, 4
xor eax, eax
mov ebx, dword [ecx]
xor edx, edx
mov dl, byte [edi + eax]
shl ebx, 8
xor edx, ebx
inc eax
cmp eax, 4
mov dword [ecx], edx
jl 0x5e9053
add ecx, 4
add edi, 4
dec ebp
jne 0x5e9051
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x20]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
call fcn.005e7dc0
add esp, 0xc
lea ebp, [esp + 0x20]
mov edx, 4
mov edi, dword [ebp]
xor eax, eax
mov ecx, 0x18
mov ebx, edi
sub ecx, eax
add eax, 8
shr ebx, cl
inc esi
cmp eax, 0x20
mov byte [esi - 1], bl
jl 0x5e9095
add ebp, 4
dec edx
jne 0x5e9090
mov eax, dword [esp + 0x38]
dec eax
mov dword [esp + 0x38], eax
jne 0x5e9042
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x5e90d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
mov eax, dword [esp + 0x38]
mov dword [esp], 0x12345678
cdq
and edx, 0xf
mov dword [esp + 4], 0x56785678
add eax, edx
mov dword [esp + 8], 0x9abc5678
sar eax, 4
test eax, eax
mov dword [esp + 0xc], 0xdeff5678
jle 0x5e91a7
mov ecx, dword [esp + 0x3c]
push ebx
mov ebx, dword [esp + 0x38]
push ebp
push esi
push edi
mov esi, ecx
sub ebx, ecx
mov dword [esp + 0x48], eax
lea edi, [ebx + esi]
xor ecx, ecx
xor eax, eax
mov ebp, dword [esp + ecx + 0x20]
xor edx, edx
mov dl, byte [edi + eax]
shl ebp, 8
xor edx, ebp
inc eax
cmp eax, 4
mov dword [esp + ecx + 0x20], edx
jl 0x5e9123
mov eax, edx
mov edx, dword [esp + ecx + 0x10]
xor edx, eax
add edi, 4
mov dword [esp + ecx + 0x10], edx
add ecx, 4
cmp ecx, 0x10
jl 0x5e9121
mov ecx, dword [esp + 0x50]
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x14]
push edx
push eax
call fcn.005e6c90
add esp, 0xc
xor ebp, ebp
mov edi, dword [esp + ebp + 0x30]
xor eax, eax
mov dword [esp + ebp + 0x10], edi
mov ecx, 0x18
mov edx, edi
sub ecx, eax
add eax, 8
shr edx, cl
inc esi
cmp eax, 0x20
mov byte [esi - 1], dl
jl 0x5e9175
add ebp, 4
cmp ebp, 0x10
jl 0x5e916b
mov eax, dword [esp + 0x48]
dec eax
mov dword [esp + 0x48], eax
jne 0x5e911c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret

Function at 0x5e91b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
mov eax, dword [esp + 0x48]
mov dword [esp], 0x12345678
cdq
and edx, 0xf
mov dword [esp + 4], 0x56785678
add eax, edx
mov dword [esp + 8], 0x9abc5678
sar eax, 4
test eax, eax
mov dword [esp + 0xc], 0xdeff5678
jle 0x5e9295
mov ecx, dword [esp + 0x4c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x50]
push edi
sub esi, ecx
mov edi, ecx
mov dword [esp + 0x5c], esi
mov dword [esp + 0x58], eax
jmp 0x5e9206
mov esi, dword [esp + 0x5c]
lea ecx, [esp + 0x20]
add esi, edi
mov ebp, 4
xor eax, eax
mov ebx, dword [ecx]
xor edx, edx
mov dl, byte [esi + eax]
shl ebx, 8
xor edx, ebx
inc eax
cmp eax, 4
mov dword [ecx], edx
jl 0x5e9213
add ecx, 4
add esi, 4
dec ebp
jne 0x5e9211
mov eax, dword [esp + 0x60]
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.005e7dc0
add esp, 0xc
xor esi, esi
mov eax, dword [esp + esi + 0x30]
mov ecx, dword [esp + esi + 0x10]
xor eax, ecx
mov ecx, dword [esp + esi + 0x20]
mov dword [esp + esi + 0x40], eax
mov ebp, eax
mov dword [esp + esi + 0x10], ecx
xor eax, eax
mov ecx, 0x18
mov edx, ebp
sub ecx, eax
add eax, 8
shr edx, cl
inc edi
cmp eax, 0x20
mov byte [edi - 1], dl
jl 0x5e9263
add esi, 4
cmp esi, 0x10
jl 0x5e9249
mov eax, dword [esp + 0x58]
dec eax
mov dword [esp + 0x58], eax
jne 0x5e9202
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret
Function at 0x5e9ff0
Capabilities:
Parse pe header

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
jne 0x5e9ffb
xor eax, eax
ret
cmp word [ecx], 0x5a4d
je 0x5ea005
xor eax, eax
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
xor ecx, ecx
cmp dword [eax], 0x4550
setne cl
dec ecx
and eax, ecx
ret

Function at 0x5ea380
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
ret
Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x5ffe36c4
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x65953bce
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x7d8058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x7d81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7d807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d806a
add dl, dl
jne 0x7d8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d80dc
xor eax, eax
add dl, dl
jne 0x7d8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7d817d
add dl, dl
jne 0x7d80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7d80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7d8075
mov eax, 1
add dl, dl
jne 0x7d80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7d80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d80e1
sub eax, ebx
mov ebx, 1
jne 0x7d8128
mov ecx, 1
add dl, dl
jne 0x7d810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7d813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7d814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7d8136
cmp eax, 0x7d00
jae 0x7d816d
cmp eax, 0x500
jb 0x7d8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
cmp eax, 0x7f
ja 0x7d8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7d8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7d819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7d8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x10002c4c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov edx, ecx
mov edi, dword [ebp + 8]
mov ecx, dword [ecx + 4]
xor eax, eax
sub ecx, edi
jb 0x10002d52
mov ebx, dword [edx]
cmp ebx, ecx
ja 0x10002d52
mov esi, ebx
shr esi, 3
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x18], eax
cmp eax, esi
jbe 0x10002d5f
mov ecx, ebx
and ecx, 7
mov eax, dword [edx + 8]
mov dword [ebp - 0x1c], eax
movzx eax, byte [eax + esi]
cmp edi, 1
jne 0x10002cb0
xor cl, 7
movzx ecx, cl
mov esi, eax
xor eax, eax
bt esi, ecx
setb al
xor edi, edi
inc edi
jmp 0x10002d4e
test ecx, ecx
je 0x10002ce3
mov dword [ebp - 0x10], eax
mov eax, 8
sub eax, ecx
mov dword [ebp - 0x20], eax
sub eax, edi
mov dword [ebp - 0x14], eax
jae 0x10002d3f
xor edi, edi
dec edi
mov eax, dword [ebp - 0x20]
mov ecx, eax
shl edi, cl
mov ecx, dword [ebp + 8]
sub ecx, eax
not edi
mov eax, dword [ebp - 0x10]
and eax, edi
shl eax, cl
inc esi
jmp 0x10002ce7
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], edx
cmp ecx, 8
jb 0x10002d1a
xor ebx, ebx
mov edi, dword [ebp - 0x18]
sub edi, esi
cmovb edi, ebx
lea ebx, [ecx - 8]
shr ebx, 3
cmp edi, ebx
jbe 0x10002d5c
add ecx, 0xfffffff8
mov edx, dword [ebp - 0x1c]
movzx edx, byte [edx + esi]
shl edx, cl
or eax, edx
inc esi
cmp ecx, 7
ja 0x10002d02
test ecx, ecx
mov edi, dword [ebp + 8]
je 0x10002d37
cmp dword [ebp - 0x18], esi
jbe 0x10002d62
mov edx, dword [ebp - 0x1c]
movzx edx, byte [edx + esi]
mov bl, 8
sub bl, cl
mov ecx, ebx
shr edx, cl
or eax, edx
mov edx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
jmp 0x10002d4e
mov eax, 0xff
shr eax, cl
and eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
shr eax, cl
add ebx, edi
mov dword [edx], ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3
int3
int3

Function at 0x10005877
Capabilities:
Access peb ldr_data
Get process heap flags
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
push ebx
push ebp
sub esp, 0x38
mov edi, dword [0x104414c6]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
mov edx, dword [ebx]
cmp edx, ebx
je 0x100058ec
xor ebp, ebp
Function at 0x100058a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [edx + 0x30]
mov ecx, ebp
movzx eax, word [esi]
test eax, eax
je 0x100058de
mov dword [esp + 8], edx
mov eax, ebp
mov dword [esp + 4], ebx
mov dword [esp], edi
movzx ebx, word [esi + eax*2]
inc eax
lea edx, [ebx - 0x41]
cmp edx, 0x19
sbb dword [ebp + 0x276207b], ecx
mov edi, ebx
movzx edx, di
movzx ebx, word [esi + eax*2]
add ecx, edx
test ebx, ebx
jne 0x100058b4
mov edx, dword [esp + 8]
mov ebx, dword [esp + 4]
mov edi, dword [esp]
cmp al, 0x24
cmp edi, ecx
je 0x1000616d
mov edx, dword [edx]
cmp edx, ebx
jne 0x1000589b
xor ebx, ebx
mov ecx, dword [ebx + 0x3c]
add ecx, ebx
mov esi, dword [0x104414a6]
mov edi, dword [0x104414d2]
mov edx, dword [0x104414de]
mov eax, dword [ecx + esi*8 + 0x78]
mov dword [esp + 0xc], edx
mov edx, dword [eax + ebx + 0x24]
push esp
sbb byte [ebx + ecx*4], ah
je 0x1000592c
and byte [ebx], al
ror dword [ebx + 0x31c184c], cl
mov eax, dword [eax + ebx + 0x18]
add ecx, ebx
test eax, eax
jbe 0x100059ad
mov dword [esp + 0x30], ebx
mov ebx, dword [edx + 0x18]
jmp 0x100058ee

Function at 0x100058be
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [edx + 0x30]
mov ecx, ebp
movzx eax, word [esi]
test eax, eax
je 0x100058de
mov dword [esp + 8], edx
mov eax, ebp
mov dword [esp + 4], ebx
mov dword [esp], edi
movzx ebx, word [esi + eax*2]
inc eax
lea edx, [ebx - 0x41]
cmp edx, 0x19
sbb dword [ebp + 0x276207b], ecx
mov edi, ebx
movzx edx, di
movzx ebx, word [esi + eax*2]
add ecx, edx
test ebx, ebx
jne 0x100058b4
mov edx, dword [esp + 8]
mov ebx, dword [esp + 4]
mov edi, dword [esp]
cmp al, 0x24
cmp edi, ecx
je 0x1000616d
mov edx, dword [edx]
cmp edx, ebx
jne 0x1000589b
xor ebx, ebx
mov ecx, dword [ebx + 0x3c]
add ecx, ebx
mov esi, dword [0x104414a6]
mov edi, dword [0x104414d2]
mov edx, dword [0x104414de]
mov eax, dword [ecx + esi*8 + 0x78]
mov dword [esp + 0xc], edx
mov edx, dword [eax + ebx + 0x24]
push esp
sbb byte [ebx + ecx*4], ah
je 0x1000592c
and byte [ebx], al
ror dword [ebx + 0x31c184c], cl
mov eax, dword [eax + ebx + 0x18]
add ecx, ebx
test eax, eax
jbe 0x100059ad
mov dword [esp + 0x30], ebx
mov ebx, dword [edx + 0x18]
jmp 0x100058ee
Function at 0x100058dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [edx + 0x30]
mov ecx, ebp
movzx eax, word [esi]
test eax, eax
je 0x100058de
mov dword [esp + 8], edx
mov eax, ebp
mov dword [esp + 4], ebx
mov dword [esp], edi
movzx ebx, word [esi + eax*2]
inc eax
lea edx, [ebx - 0x41]
cmp edx, 0x19
sbb dword [ebp + 0x276207b], ecx
mov edi, ebx
movzx edx, di
movzx ebx, word [esi + eax*2]
add ecx, edx
test ebx, ebx
jne 0x100058b4
mov edx, dword [esp + 8]
mov ebx, dword [esp + 4]
mov edi, dword [esp]
cmp al, 0x24
cmp edi, ecx
je 0x1000616d
mov edx, dword [edx]
cmp edx, ebx
jne 0x1000589b
xor ebx, ebx
mov ecx, dword [ebx + 0x3c]
add ecx, ebx
mov esi, dword [0x104414a6]
mov edi, dword [0x104414d2]
mov edx, dword [0x104414de]
mov eax, dword [ecx + esi*8 + 0x78]
mov dword [esp + 0xc], edx
mov edx, dword [eax + ebx + 0x24]
push esp
sbb byte [ebx + ecx*4], ah
je 0x1000592c
and byte [ebx], al
ror dword [ebx + 0x31c184c], cl
mov eax, dword [eax + ebx + 0x18]
add ecx, ebx
test eax, eax
jbe 0x100059ad
mov dword [esp + 0x30], ebx
mov ebx, dword [edx + 0x18]
jmp 0x100058ee

Function at 0x1000590e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [edx + 0x30]
mov ecx, ebp
movzx eax, word [esi]
test eax, eax
je 0x100058de
mov dword [esp + 8], edx
mov eax, ebp
mov dword [esp + 4], ebx
mov dword [esp], edi
movzx ebx, word [esi + eax*2]
inc eax
lea edx, [ebx - 0x41]
cmp edx, 0x19
sbb dword [ebp + 0x276207b], ecx
mov edi, ebx
movzx edx, di
movzx ebx, word [esi + eax*2]
add ecx, edx
test ebx, ebx
jne 0x100058b4
mov edx, dword [esp + 8]
mov ebx, dword [esp + 4]
mov edi, dword [esp]
cmp al, 0x24
cmp edi, ecx
je 0x1000616d
mov edx, dword [edx]
cmp edx, ebx
jne 0x1000589b
xor ebx, ebx
mov ecx, dword [ebx + 0x3c]
add ecx, ebx
mov esi, dword [0x104414a6]
mov edi, dword [0x104414d2]
mov edx, dword [0x104414de]
mov eax, dword [ecx + esi*8 + 0x78]
mov dword [esp + 0xc], edx
mov edx, dword [eax + ebx + 0x24]
push esp
sbb byte [ebx + ecx*4], ah
je 0x1000592c
and byte [ebx], al
ror dword [ebx + 0x31c184c], cl
mov eax, dword [eax + ebx + 0x18]
add ecx, ebx
test eax, eax
jbe 0x100059ad
mov dword [esp + 0x30], ebx
mov ebx, dword [edx + 0x18]
jmp 0x100058ee

Function at 0x1000592f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor ebp, ebp
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx

Function at 0x10005964
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb al, 0x89
je 0x1000598c
adc al, 0x89
jl fcn.10005990
adc byte [ebx + 0xf0c246c], cl
mov dh, 0x34
adc byte [ebx], dh
fild dword [ebp + 0x330976ed]
in eax, dx
jbe 0x10005984
xor edi, edi
inc edi
add ebx, ecx
cmp edi, ebp

Function at 0x10005978
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb al, 0x89
je 0x1000598c
adc al, 0x89
jl fcn.10005990
adc byte [ebx + 0xf0c246c], cl
mov dh, 0x34
adc byte [ebx], dh
fild dword [ebp + 0x330976ed]
in eax, dx
jbe 0x10005984
xor edi, edi
inc edi
add ebx, ecx
cmp edi, ebp
Function at 0x10006d49
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push eax
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10006deb
movzx eax, word [ecx]
mov dword [ebp - 0x10], eax
add eax, 0xffffffd5
xor edx, edx
test eax, 0xfffd
sete dl
movzx eax, word [ecx + edx*2]
lea esi, [eax - 1]
xor edi, edi
cmp si, 0x7e
ja 0x10006ddd
lea ebx, [ecx + edx*2]
add ebx, 2
xor edi, edi
movzx eax, ax
push eax
call fcn.1024d21e
add esp, 4
test eax, eax
je 0x10006ddd
movzx esi, word [ebx - 2]
xor ecx, ecx
cmp esi, 0x7f
ja 0x10006db3
push esi
call fcn.1024d21e
add esp, 4
add esi, 0xffffffd0
test eax, eax
cmove esi, eax
mov ecx, esi
mov eax, ecx
xor eax, 0x7fffffff
mov edx, 0xcccccccd
mul edx
shr edx, 3
cmp edi, edx
jg 0x10006def
lea eax, [edi + edi*4]
lea edi, [ecx + eax*2]
movzx eax, word [ebx]
mov ecx, eax
dec ecx
add ebx, 2
cmp cx, 0x7f
jb 0x10006d85
mov eax, edi
neg eax
cmp word [ebp - 0x10], 0x2d
cmovne eax, edi
jmp 0x10006dfe
xor eax, eax
jmp 0x10006dfe
xor eax, eax
cmp word [ebp - 0x10], 0x2d
sete al
add eax, 0x7fffffff
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1000fbd0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov eax, dword [0x10443bf0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 4]
test eax, eax
je 0x1000fc0c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
lea edi, [ebp - 0x10]
mov dword [edi], esi
push esi
push edi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
test eax, eax
je 0x1000fc0e
mov esi, dword [ebp - 0x10]
jmp 0x1000fc0e
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1023b4d8
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebp
ret 8

Function at 0x1000fc30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 8
mov eax, dword [0x10443bf0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 4]
test eax, eax
je 0x1000fc6c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
lea edi, [ebp - 0x10]
mov dword [edi], esi
push esi
push edi
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test eax, eax
je 0x1000fc6e
mov esi, dword [ebp - 0x10]
jmp 0x1000fc6e
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1023b4d8
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebp
ret 8

Function at 0x1004cc70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add ecx, 0x10
pop ebp
jmp fcn.10005b18

Function at 0x1004cc80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add ecx, 0x10
pop ebp
jmp fcn.10005ada