joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401fed
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b2110]
jne 0x401ff7
repz ret
jmp fcn.00402f26

Function at 0x40ffc0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404ec6
and dword [ebp - 4], 0
cmp dword [0x4b461c], 0
mov ebx, eax
jne 0x410071
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x410122
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x410122
push eax
call fcn.00404e54
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4b461c], eax
call esi
push eax
call fcn.00404e54
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4b4620], eax
call esi
push eax
call fcn.00404e54
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4b4624], eax
call esi
push eax
call fcn.00404e54
pop ecx
mov dword [0x4b462c], eax
test eax, eax
je 0x410071
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404e54
pop ecx
mov dword [0x4b4628], eax
mov eax, dword [0x4b4628]
cmp eax, ebx
je 0x4100c9
cmp dword [0x4b462c], ebx
je 0x4100c9
push eax
call fcn.00404ecf
push dword [0x4b462c]
mov esi, eax
call fcn.00404ecf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4100c9
test edi, edi
je 0x4100c9
call esi
test eax, eax
je 0x4100c0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4100c0
test byte [ebp - 0xc], 1
jne 0x4100c9
or dword [ebp + 0x10], 0x200000
jmp 0x410102
mov eax, dword [0x4b4620]
cmp eax, ebx
je 0x410102
push eax
call fcn.00404ecf
pop ecx
test eax, eax
je 0x410102
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x410102
mov eax, dword [0x4b4624]
cmp eax, ebx
je 0x410102
push eax
call fcn.00404ecf
pop ecx
test eax, eax
je 0x410102
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4b461c]
call fcn.00404ecf
pop ecx
test eax, eax
je 0x410122
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x410124
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4ac480
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x41c
mov eax, dword [0x4b2110]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
push edi
mov dword [esp + 0xc], eax
jle 0x4ac55b
mov edi, dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [ebp + 0xc], 0x2d
jne 0x4ac4e8
push 0
push str.fikojini_zujokobixexezonakeweguneleg_lejoyuxalanetexitevelanebubu_satoretik_tajufejefavohiyelirixago
call edi
push str.fepekoniguvisenevuwuki_jin
push str.pocudinapefiwuwuracuyehopasa
push str.giciyojozabuxos_joguzi_zunibizece
push str.cerowitalapotovonemadudukadoga_wumivuxikeyiwezayopoyevocirah_fuhehoguh_nivipapeniloxaceyobogetamixari_fufozimepofezawipogobonemetibe
call ebx
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
call fcn.004ac3d0
mov ecx, dword [esp + 0xc]
xor byte [ecx + esi], al
cmp dword [ebp + 0xc], 0xf
jne 0x4ac551
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor eax, eax
push eax
lea edx, [esp + 0x24]
push edx
push 0x4af950
mov dword [esp + 0x1e], eax
mov dword [esp + 0x22], eax
mov dword [esp + 0x26], eax
mov word [esp + 0x2a], ax
xor ecx, ecx
lea eax, [esp + 0x1c]
push eax
push ecx
push ecx
mov word [esp + 0x28], cx
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push str.kalagekovidayacizocopexutovumofi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x4ac4bb
cmp dword [ebp + 0xc], 0x2d
jne 0x4ac575
mov dword [0x4b57b8], 0xa62e7790
mov dword [0x4b57bc], 0xffffffff
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401fed
mov esp, ebp
pop ebp
ret
Function at 0x4ac970
Capabilities:
Access the windows event log
Manipulate console buffer
Set file attributes

Disassembly:
sub esp, 0x14
mov eax, dword [0x4b542c]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
push esi
mov dword [esp + 0x10], 0x1540b5
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xcc1
jne 0x4ac9aa
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov eax, dword [0x4b542c]
mov dword [0x4b5420], 0x8e468c60
cmp eax, 0x3dc
jne 0x4aca15
push 0
push 0x4afb98
call ebx
xor ecx, ecx
xor eax, eax
lea edx, [esp + 0x18]
push edx
mov word [esp + 0x14], ax
mov word [esp + 0x16], cx
mov eax, dword [esp + 0x14]
push eax
push ecx
push ecx
push ecx
call ebp
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28]
push edx
push esi
push 0
push 0
push edi
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AccessCheckByTypeResultList]
push str.rugenalef
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
mov eax, dword [0x4b542c]
sub dword [esp + 0x14], 1
jne 0x4ac998
mov edi, dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
xor esi, esi
mov ebp, 0xec58acac
or ebx, 0xffffffff
cmp eax, 0x997
jne 0x4aca42
push 0
push 0
call edi
mov eax, dword [0x4b542c]
cmp esi, 0x846373
jne 0x4aca59
mov eax, dword [0x4b3bc4]
add eax, 0xa231
mov dword [0x4b542c], eax
cmp eax, 0x141
jne 0x4aca6c
mov dword [0x4b4c00], ebp
mov dword [0x4b4c04], ebx
inc esi
cmp esi, 0x123c962
jl 0x4aca30
call fcn.004ac5d0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 0x10
Function at 0x4010d0
Capabilities:
Delete file
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
xor ebx, ebx
cmp dword [0x84376c], 0x594
mov dword [ebp - 8], eax
jne 0x4010f9
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomA]
mov ecx, dword [0x423f68]
mov edx, dword [0x423f6c]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edx
call fcn.004010c0
mov eax, dword [0x423f70]
mov ecx, dword [0x423f74]
add dword [ebp - 0x18], 0x23f
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov ecx, dword [0x84376c]
mov eax, edi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x401196
push ebx
lea edx, [ebp - 0x38]
push edx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov eax, dword [ebp + 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_PurgeComm]
xor ecx, ecx
xor edx, edx
lea eax, [ebp - 0x3c]
push eax
mov word [ebp - 0x1c], cx
mov word [ebp - 0x1a], dx
mov ecx, dword [ebp - 0x1c]
push ecx
push ebx
push str.kezurutiric
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
mov eax, dword [ebp - 4]
mov ecx, dword [0x84376c]
add eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
jne 0x4011b0
mov dword [0x843768], 0xedeb2e40
jmp 0x4011cc
cmp ecx, 0x3eb
jne 0x4011cc
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [0x84311c], ebx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
add edx, edi
mov dword [ebp - 0x14], edx
mov edx, edi
shr edx, cl
mov dword [0x843764], 0xf4ea3dee
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
nop
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 4]
shr esi, cl
mov ecx, dword [ebp - 0x14]
push ecx
push edx
add esi, dword [ebp - 0x34]
call fcn.004010a0
cmp dword [0x84376c], 0xb03
mov dword [ebp - 4], eax
jne 0x401255
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
mov eax, dword [ebp - 4]
xor eax, esi
mov dword [ebp - 4], eax
sub edi, eax
lea eax, [ebp - 0x18]
call fcn.00401090
sub dword [ebp - 0x20], 1
jne 0x401135
cmp dword [0x84376c], 0xa6d
mov esi, dword [ebp + 8]
mov dword [esi], edi
jne 0x40129b
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [ebp - 8]
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 8]
pop edi
mov dword [esi + 4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404220
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x423538]
jne 0x40422a
repz ret
jmp fcn.00407b40

Function at 0x407863
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404c87
and dword [ebp - 4], 0
cmp dword [0x425b64], 0
mov ebx, eax
jne 0x407914
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4079c5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4079c5
push eax
call fcn.00404c15
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x425b64], eax
call esi
push eax
call fcn.00404c15
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x425b68], eax
call esi
push eax
call fcn.00404c15
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x425b6c], eax
call esi
push eax
call fcn.00404c15
pop ecx
mov dword [0x425b74], eax
test eax, eax
je 0x407914
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404c15
pop ecx
mov dword [0x425b70], eax
mov eax, dword [0x425b70]
cmp eax, ebx
je 0x40796c
cmp dword [0x425b74], ebx
je 0x40796c
push eax
call fcn.00404c90
push dword [0x425b74]
mov esi, eax
call fcn.00404c90
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40796c
test edi, edi
je 0x40796c
call esi
test eax, eax
je 0x407963
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407963
test byte [ebp - 0xc], 1
jne 0x40796c
or dword [ebp + 0x10], 0x200000
jmp 0x4079a5
mov eax, dword [0x425b68]
cmp eax, ebx
je 0x4079a5
push eax
call fcn.00404c90
pop ecx
test eax, eax
je 0x4079a5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4079a5
mov eax, dword [0x425b6c]
cmp eax, ebx
je 0x4079a5
push eax
call fcn.00404c90
pop ecx
test eax, eax
je 0x4079a5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x425b64]
call fcn.00404c90
pop ecx
test eax, eax
je 0x4079c5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4079c7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
push ebx
push esi
push edi
call fcn.10002ec3
mov esi, eax
test esi, esi
je 0x100015bf
mov ecx, esi
call fcn.10001a90
lea eax, [ebp - 0x198]
push eax
mov eax, dword [esi + 0x84]
push 0x202
call eax
lea eax, [esi + 0xe4]
mov dword [esi + 0x4f8], eax
mov dword [esi + 0x6c8], eax
mov eax, dword [esi + 0x50]
call eax
imul eax, eax, 0x2c31
lea ebx, [esi + 0x500]
mov dword [ebp - 4], 0x1ff
mov dword [esi + 0x604], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 0x10]
push ebx
call eax
test eax, eax
jne 0x100013f9
mov word [ebx], 0x3f
mov eax, dword [esi + 0x4c]
push ebx
call eax
inc eax
mov dword [esi + 0x6e4], 0xffffffff
mov dword [esi + 0x600], eax
lea eax, [esi + 0x6cc]
push eax
mov eax, dword [esi + 0x54]
call eax
mov ecx, esi
call fcn.10001bd0
xor edi, edi
nop word [eax + eax]
xor edx, edx
nop dword [eax]
nop word [eax + eax]
imul ecx, dword [esi + 0x604], 0x343fd
mov eax, dword [esi + 0x4f8]
add ecx, 0x269ec3
mov dword [esi + 0x604], ecx
mov byte [edx + eax], cl
imul ecx, dword [esi + 0x604], 0x343fd
mov eax, dword [esi + 0x4f8]
add ecx, 0x269ec3
mov dword [esi + 0x604], ecx
mov byte [eax + edx + 1], cl
imul ecx, dword [esi + 0x604], 0x343fd
mov eax, dword [esi + 0x4f8]
add ecx, 0x269ec3
mov dword [esi + 0x604], ecx
mov byte [eax + edx + 2], cl
imul ecx, dword [esi + 0x604], 0x343fd
mov eax, dword [esi + 0x4f8]
add ecx, 0x269ec3
mov dword [esi + 0x604], ecx
mov byte [eax + edx + 3], cl
add edx, 4
cmp edx, 0x100
jl 0x10001440
mov eax, dword [esi + 0x4f8]
mov byte [eax + 0x110], 0
mov eax, dword [esi + 0x4f8]
add eax, 0x100
push eax
lea eax, [esi + 0xd4]
push 0x10
push eax
call fcn.10002f01
mov eax, dword [esi + 0x4f8]
add esp, 0xc
add eax, 0x111
push ebx
push eax
mov eax, dword [esi + 0x48]
call eax
mov eax, dword [esi + 0x600]
xor ebx, ebx
add eax, 0x111
mov dword [esi + 0x4fc], eax
add eax, 0xffffff00
je 0x10001549
mov ecx, dword [esi + 0x4f8]
movzx eax, bl
lea edx, [ecx + ebx]
inc ebx
mov al, byte [eax + ecx]
xor byte [edx + 0x100], al
mov eax, dword [esi + 0x4fc]
sub eax, 0x100
cmp ebx, eax
jb 0x10001524
mov ecx, esi
call fcn.10001d00
test eax, eax
je 0x10001569
mov ecx, esi
call fcn.10001060
lea ebx, [esi + 0x500]
test eax, eax
jne 0x10001430
mov eax, dword [esi + 0x6c0]
add eax, 1
mov dword [esi + 0x6c0], eax
js 0x10001582
cmp eax, dword [esi + 0x6c4]
jl 0x1000158c
mov dword [esi + 0x6c0], 0
mov eax, dword [esi + 0x18]
push 0xafc8
call eax
add edi, 0x2d
lea ebx, [esi + 0x500]
cmp edi, 0x708
jl 0x10001430
mov ecx, esi
xor edi, edi
call fcn.10001bd0
lea ebx, [esi + 0x500]
jmp 0x10001430
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001820
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.10001750
push 0
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x20], 0x775c3a63
push ecx
lea eax, [esi + 0x10]
mov dword [ebp - 0x11], 0x32336d65
push eax
lea eax, [esi + 4]
mov dword [ebp - 0xb], 0x652e646d
push eax
mov eax, dword [edi + 0x2c]
mov dword [ebp - 0x16], 0x7379735c
mov dword [ebp - 0x1b], 0x776f646e
mov word [ebp - 7], 0x6578
mov word [ebp - 0xd], 0x635c
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 5], 0
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x17], 0x73
mov dword [ebp - 0x2c], 0xc
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 1
call eax
test eax, eax
jne 0x100018ac
mov dword [ebp - 4], 0x92
jmp 0x1000197c
push 0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0xc
push eax
lea eax, [esi + 8]
mov dword [ebp - 0x34], 0
push eax
mov eax, dword [edi + 0x2c]
lea ebx, [esi + 0xc]
push ebx
mov dword [ebp - 0x30], 1
call eax
test eax, eax
jne 0x100018e4
mov dword [ebp - 4], 0x9b
jmp 0x1000197c
lea eax, [ebp - 0x90]
push 0x44
push eax
call fcn.10002eda
xor eax, eax
mov dword [ebp - 0x90], 0x44
mov word [ebp - 0x60], ax
mov eax, dword [ebx]
mov dword [ebp - 0x58], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x48]
push 0x10
push eax
mov dword [ebp - 0x64], 0x101
call fcn.10002eda
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x90]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [edi + 0x30]
call eax
test eax, eax
jne 0x10001954
mov dword [ebp - 4], 0xac
jmp 0x1000197c
mov eax, dword [ebp - 0x44]
mov dword [esi + 0x1c], eax
mov eax, dword [ebp - 0x48]
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 0x40]
push 8
push edi
mov dword [esi + 0x24], eax
call fcn.10002f6b
add esp, 8
test eax, eax
jne 0x100019a5
mov dword [ebp - 4], 0xba
push 2
lea eax, [ebp - 4]
mov edx, 4
push eax
movzx eax, byte [esi]
mov ecx, edi
push eax
call fcn.100020e0
add esp, 0xc
mov edx, esi
mov ecx, edi
call fcn.10001750
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push eax
mov dword [eax], edi
mov dword [eax + 4], esi
push 0x100015d0
mov dword [esi + 0x14], 1
call fcn.10002fc0
add esp, 4
push eax
mov eax, dword [edi + 0x20]
push 0
push 0
call eax
mov dword [esi + 0x18], eax
test eax, eax
jne 0x100019da
mov dword [eax], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
xor ebx, ebx
mov word [ebp - 0x17], 0x7365
push ebx
push 0x80
push 3
push ebx
push 1
mov esi, ecx
mov dword [ebp - 0x27], 0x73755c3a
push 0x80000000
lea eax, [ebp - 0x28]
mov dword [ebp - 0xc], 0x696e69
push eax
mov eax, dword [esi + 0x40]
mov dword [ebp - 0x23], 0x5c737265
mov word [ebp - 0x1f], 0x7570
mov dword [ebp - 0x10], 0x2e6e6f69
mov dword [ebp - 0x1c], 0x5c63696c
mov dword [ebp - 0x15], 0x70697263
mov byte [ebp - 0x1d], 0x62
mov byte [ebp - 0x28], 0x63
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x11], 0x74
call eax
mov dword [ebp - 8], eax
lea edi, [esi + 0xd4]
cmp eax, 0xffffffff
je 0x10001b38
push ebx
lea ecx, [ebp - 4]
push ecx
push 0x10
push edi
push eax
mov eax, dword [esi + 0x38]
call eax
test eax, eax
je 0x10001b28
cmp dword [ebp - 4], 0x10
mov eax, 1
cmove ebx, eax
push dword [ebp - 8]
mov eax, dword [esi + 0x1c]
call eax
test ebx, ebx
jne 0x10001bc3
mov eax, dword [esi + 0xb8]
push edi
call eax
test eax, eax
je 0x10001b83
xor edx, edx
nop word [eax + eax]
imul ecx, dword [esi + 0x604], 0x343fd
add ecx, 0x269ec3
imul eax, ecx, 0x343fd
movsx ecx, cl
add eax, 0x269ec3
mov dword [esi + 0x604], eax
movsx eax, al
imul ecx, eax
mov byte [edx + edi], cl
inc edx
cmp edx, 0x10
jb 0x10001b50
lea eax, [ebp - 0x28]
push eax
mov eax, dword [esi + 0x44]
call eax
push 0
push 0x80
push 1
push 0
push 1
push 0x40000000
lea eax, [ebp - 0x28]
push eax
mov eax, dword [esi + 0x40]
call eax
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10001bc3
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x3c]
push 0x10
push edi
push ebx
call eax
mov eax, dword [esi + 0x1c]
push ebx
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001f00
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
mov ebx, ecx
mov ecx, 1
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], ebx
mov edx, dword [ebx + 0x6e4]
xor esi, esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 8], ecx
nop word [eax + eax]
mov eax, dword [ebx + 0x94]
test ecx, ecx
je 0x10001ff5
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x134], edx
push ecx
push 0
push 0
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x138], 1
push ecx
push 0
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x24], 0
call eax
test eax, eax
js 0x100020cf
jne 0x10001f7f
inc edi
jmp 0x10002066
push 0
mov eax, 5
sub eax, esi
push eax
lea eax, [ebp - 0x14]
add eax, esi
push eax
push dword [ebp - 0x18]
mov eax, dword [ebx + 0x9c]
call eax
test eax, eax
jle 0x100020cf
add esi, eax
inc edi
cmp esi, 5
jne 0x10002066
cmp byte [ebp - 0x14], 0x17
jne 0x100020cf
cmp byte [ebp - 0x13], 3
jne 0x100020cf
cmp byte [ebp - 0x12], 3
jne 0x100020cf
movzx eax, byte [ebp - 0x11]
mov byte [ebp - 3], al
movzx eax, byte [ebp - 0x10]
mov byte [ebp - 4], al
movzx ebx, word [ebp - 4]
mov dword [ebp - 0x1c], ebx
test ebx, ebx
je 0x100020cf
mov ebx, dword [ebp - 0xc]
xor ecx, ecx
mov dword [ebp - 8], ecx
xor esi, esi
jmp 0x10002069
mov ebx, dword [ebp - 0x1c]
mov ecx, ebx
sub ecx, esi
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x30]
push ecx
push 0
push 0
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x240], 1
push ecx
push 0
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], 0
call eax
test eax, eax
js 0x100020cf
jne 0x1000203d
inc edi
jmp 0x10002063
mov ecx, dword [ebp - 0xc]
push 0
push dword [ebp - 0x20]
lea eax, [ecx + 0x6ec]
add eax, esi
push eax
push dword [ebp - 0x18]
mov eax, dword [ecx + 0x9c]
call eax
test eax, eax
jle 0x100020cf
add esi, eax
cmp esi, ebx
je 0x10002076
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
cmp edi, 0x5a
jge 0x100020cf
mov edx, dword [ebp - 0x18]
jmp 0x10001f30
mov esi, dword [ebp - 0x1c]
xor ebx, ebx
test esi, esi
je 0x100020cf
mov edi, dword [ebp - 0xc]
mov eax, dword [edi + 0x6c8]
lea edx, [edi + ebx]
movzx ecx, bl
inc ebx
mov al, byte [ecx + eax]
xor byte [edx + 0x6ec], al
cmp ebx, esi
jb 0x10002082
cmp esi, 2
jb 0x100020cf
lea eax, [esi - 2]
mov dword [edi + 0x618], eax
movsx eax, byte [edi + 0x6ec]
mov dword [edi + 0x610], eax
mov al, byte [edi + 0x6ed]
mov byte [edi + 0x614], al
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100020e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
add eax, 7
push edi
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x58]
lea ebx, [esi + 0x6cc]
push ebx
call eax
cmp dword [esi + 0x6e8], 0
je 0x1000211b
mov eax, dword [esi + 0x5c]
push ebx
call eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
lea edi, [edx + 2]
cmp edi, 0xffff
ja 0x1000214d
movzx ecx, di
mov eax, ecx
mov word [esi + 0x106eb], 0x317
shr eax, 8
mov byte [esi + 0x106ed], 3
mov byte [esi + 0x106ee], al
mov byte [esi + 0x106ef], cl
mov eax, dword [ebp - 4]
mov byte [esi + 0x106f0], al
mov al, byte [ebp + 8]
mov byte [esi + 0x106f1], al
test edx, edx
je 0x10002176
lea eax, [esi + 0x106f2]
push eax
push edx
push dword [ebp + 0xc]
call fcn.10002f01
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x1000219a
nop dword [eax]
mov eax, dword [esi + 0x6c8]
lea edx, [esi + ebx]
movzx ecx, bl
inc ebx
mov al, byte [ecx + eax]
xor byte [edx + 0x106f0], al
cmp ebx, edi
jb 0x10002180
push dword [ebp - 8]
mov edx, dword [esi + 0x6e4]
lea eax, [esi + 0x106eb]
push eax
push ecx
mov ecx, esi
call fcn.10003000
mov ecx, dword [esi + 0x5c]
add esp, 0xc
test eax, eax
lea eax, [esi + 0x6cc]
push eax
jne 0x100021d8
mov dword [esi + 0x6e8], 1
call ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call ecx
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret