joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ac918
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffc30
lea edx, [esp + 0x58]
push edx
push eax
call sub.kernel32.dll_FindNextFileA
push edi
push ebp
push ebx
call sub.kernel32.dll_FindFirstChangeNotificationA
mov eax, dword [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push esi
call sub.user32.dll_OpenWindowStationA
lea eax, [esp + 0x198]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.gdi32.dll_GetTextMetricsA
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
call fcn.0042acd0
mov eax, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push eax
call sub.kernel32.dll_ClearCommError
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push eax
call sub.user32.dll_ReleaseDC
lea eax, [esp + 0x1d0]
push eax
call sub.user32.dll_RegisterClassW
lea eax, [esp + 0x23c]
push eax
lea eax, [esp + 0x1fc]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
call sub.advapi32.dll_CreateProcessAsUserA
lea eax, [esp + 0x24c]
push eax
call sub.gdi32.dll_CreateColorSpaceA
mov eax, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x54]
push eax
call sub.gdi32.dll_GetObjectW
lea eax, [esp + 0x394]
push eax
call sub.gdi32.dll_CreateFontIndirectA
add esp, 0x3d0
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x658b6851
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x4c9075b9
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x18ccd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push edi
push esi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
test ecx, ecx
sete dl
test eax, eax
sete dh
or dh, dl
jne 0x18cd15
mov dh, byte [ecx]
test dh, dh
je 0x18cd20
inc ecx
nop
movzx esi, byte [eax]
test esi, esi
setne dl
je 0x18cd22
movzx edi, dh
mov dh, byte [edi + 0x74e148]
cmp dh, byte [esi + 0x74e148]
jne 0x18cd30
inc eax
mov dh, byte [ecx]
inc ecx
test dh, dh
jne 0x18ccf0
jmp 0x18cd22
or ecx, eax
sete al
movzx eax, al
pop esi
pop edi
ret
mov dl, 1
cmp byte [eax], 0
setne al
xor al, dl
movzx eax, al
pop esi
pop edi
ret
xor eax, eax
movzx eax, al
pop esi
pop edi
ret

Function at 0x195d50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x1c]
cmp byte [esp + 0x20], 0
mov ebx, edx
jne 0x195db1
mov dword [esp], edi
push 0x750d7e
push esi
call fcn.004f8da0
add esp, 8
lea edi, [eax + 2]
test eax, eax
cmove edi, esi
push 0x3f
push edi
call fcn.004f8d90
add esp, 8
mov ebx, eax
push 0x2f
push edi
call fcn.004f8d90
add esp, 8
test eax, eax
je 0x195e79
test ebx, ebx
mov edi, dword [esp]
je 0x195e8f
cmp eax, ebx
cmovb ebx, eax
xor eax, eax
test ebp, ebp
je 0x195e71
movzx eax, byte [esp + 0x24]
xor al, 1
mov dword [esp], eax
nop word cs:[eax + eax]
cmp esi, ebx
jb 0x195e10
movzx eax, byte [esi]
cmp eax, 0x3f
je 0x195df0
cmp eax, 0x20
jne 0x195df9
test byte [esp], 1
je 0x195e26
push 3
push 0x750d7a
jmp 0x195e13
mov dword [esp], 0
jmp 0x195e10
cmp al, 0x20
jb 0x195e10
cmp eax, 0x20
je 0x195e10
cmp eax, 0x7f
je 0x195e10
cmp al, 0x7f
jae 0x195e2f
nop dword [eax + eax]
push 1
push esi
push edi
call fcn.001b82c0
add esp, 0xc
test eax, eax
jne 0x195e5b
inc esi
dec ebp
jne 0x195dd0
jmp 0x195e6f
push 1
push 0x750d3c
jmp 0x195e13
mov byte [esp + 5], 0x25
mov ecx, eax
shr ecx, 4
movzx ecx, byte [ecx + 0x750d3e]
mov byte [esp + 6], cl
and eax, 0xf
movzx eax, byte [eax + 0x750d3e]
mov byte [esp + 7], al
push 3
lea eax, [esp + 9]
push eax
jmp 0x195e13
cmp eax, 0x64
mov eax, 0x1f
mov ecx, 7
cmove ecx, eax
mov eax, ecx
jmp 0x195e71
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
call fcn.004f8b98
add esp, 4
add eax, esi
test ebx, ebx
mov edi, dword [esp]
jne 0x195dac
push esi
mov edi, eax
call fcn.004f8b98
add esp, 4
mov ebx, eax
mov eax, edi
mov edi, dword [esp]
add ebx, esi
jmp 0x195dac
Function at 0x19feb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
mov eax, 0x1080
call fcn.004f9f40
mov esi, ecx
mov edi, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x130]
mov eax, dword [edi + 0x1a8]
mov dword [esp + 0x64], eax
mov dword [esp + 0x6c], edx
mov byte [edx], 0
lea eax, [esi + 0x18]
mov dword [esp + 8], eax
lea eax, [esi + 0x98]
mov dword [esp + 0x54], eax
lea eax, [edi + 0x308]
mov dword [esp + 0x34], eax
lea eax, [edi + 0x360]
mov dword [esp + 0x68], eax
lea eax, [edi + 0x32c]
mov dword [esp + 0x1c], eax
lea eax, [edi + 0x330]
mov dword [esp + 0x50], eax
lea eax, [ecx + 0x14]
mov dword [esp + 0x40], eax
lea eax, [ecx + 4]
mov dword [esp + 0x4c], eax
lea eax, [ecx + 0x58]
mov dword [esp + 0x60], eax
lea eax, [ecx + 0x30]
mov dword [esp + 0x48], eax
mov eax, dword [edi + 0x31c]
mov dword [esp + 0x5c], 0
xor ebx, ebx
mov dword [esp + 4], esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], ecx
jmp 0x19ff86
Function at 0x1b3270
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
xor edi, edi
test ecx, ecx
je 0x1b3321
mov esi, ecx
push ecx
call fcn.001c2870
add esp, 4
test al, al
jne 0x1b3321
push esi
call fcn.004f8b98
add esp, 4
mov edi, eax
push eax
push 0x2e
push esi
call fcn.001b4880
add esp, 0xc
xor ebx, ebx
test eax, eax
je 0x1b32c6
sub eax, esi
push eax
push 0x2e
push esi
call fcn.001b4880
add esp, 0xc
test eax, eax
je 0x1b32c6
inc eax
add edi, esi
sub edi, eax
mov ebx, eax
test ebx, ebx
cmovne esi, ebx
test edi, edi
jle 0x1b331c
add edi, esi
mov ebx, 0x1505
nop word cs:[eax + eax]
movsx eax, byte [esi]
inc esi
push eax
call fcn.0018ccb0
add esp, 4
movsx eax, al
mov ecx, ebx
shl ecx, 5
add ebx, ecx
xor ebx, eax
cmp esi, edi
jb 0x1b32e0
mov ecx, 0x4104105
mov eax, ebx
mul ecx
mov edi, ebx
sub edi, edx
shr edi, 1
add edi, edx
shr edi, 5
mov eax, edi
shl eax, 6
sub edi, eax
add edi, ebx
jmp 0x1b3321
mov edi, 0x1a
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x1ec350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c0
mov ebp, edx
mov ebx, ecx
mov edi, dword [esp + 0x1d8]
mov eax, dword [ecx + 8]
mov dword [esp], eax
lea esi, [esp + 0x5c]
push 0x100
push 0x75e82c
push esi
call fcn.004f8d80
add esp, 0xc
mov dword [esp + 4], ebp
push ebp
push ebx
call fcn.0019cf00
add esp, 8
mov dword [esp + 8], eax
call fcn.003262a0
mov ebp, eax
and eax, 0xff800000
cmp eax, 0xa000000
jne 0x1ec438
mov eax, ebp
and eax, 0x7fffff
cmp eax, 0x414
jg 0x1ec3db
cmp eax, 0x86
je 0x1ec3ed
cmp eax, 0xcf
jne 0x1ec438
mov eax, dword [esp]
or byte [eax + 0x2d8], 8
mov esi, 0x75e96c
jmp 0x1ec587
cmp eax, 0x45c
je 0x1ec53d
cmp eax, 0x415
jne 0x1ec438
mov eax, dword [esp]
push dword [eax + 0x10c]
call fcn.00277730
add esp, 4
mov edi, 0x3c
test eax, eax
je 0x1ec582
mov ecx, dword [esp + 8]
mov dword [ecx + 0x48], eax
push eax
call fcn.003a2250
add esp, 4
lea esi, [esp + 0x5c]
push eax
push 0x75e92c
push 0x100
push esi
call fcn.0017c960
add esp, 0x10
jmp 0x1ec587
mov byte [esp + 0x5c], 0
push 0x100
push esi
push ebp
call fcn.00326ac0
add esp, 0xc
cmp byte [esp + 0x5c], 0
je 0x1ec461
mov eax, edi
xor eax, 0x23
or eax, ebp
je 0x1ec48b
jmp 0x1ec587
test ebp, ebp
mov eax, 0x75e9cd
mov ecx, 0x75e9bf
cmove ecx, eax
lea eax, [esp + 0x5c]
push ecx
push eax
call fcn.004f8b88
add esp, 8
mov eax, edi
xor eax, 0x23
or eax, ebp
jne 0x1ec587
mov ebp, dword [esp + 0x1d4]
xorps xmm0, xmm0
movups xmmword [esp + 0x4c], xmm0
movups xmmword [esp + 0x3c], xmm0
movups xmmword [esp + 0x2c], xmm0
movups xmmword [esp + 0x1c], xmm0
movups xmmword [esp + 0xc], xmm0
nop
call reloc.ws2_32.dll_WSAGetLastError
mov esi, eax
lea edi, [esp + 0x15c]
push edi
push 0
push 0
push dword [esp + 0x10]
push dword [ebx + 4]
call fcn.001aa4a0
add esp, 0x14
test esi, esi
sete al
cmp ebp, 5
setne cl
or cl, al
jne 0x1ec502
lea ebx, [esp + 0xc]
push 0x50
push ebx
push esi
call fcn.0018d090
add esp, 0xc
cmp byte [esp + 0xc], 0
mov eax, 0x75ea37
cmovne eax, ebx
mov ecx, dword [esp]
jmp 0x1ec516
mov eax, 0x75eaba
cmp ebp, 0xa
mov ecx, dword [esp]
ja 0x1ec516
mov eax, dword [ebp*4 + 0x75f2c4]
push edi
push dword [esp + 0x1bc]
push dword [ecx + 0xf4]
push eax
push 0x75e98f
push dword [esp + 0x18]
call fcn.001b4f40
add esp, 0x18
mov edi, 0x23
jmp 0x1ec599
mov byte [esp + 0x5c], 0
lea esi, [esp + 0x5c]
push 0x100
push esi
push ebp
call fcn.00326ac0
add esp, 0xc
mov edi, 0x62
cmp byte [esp + 0x5c], 0
jne 0x1ec587
mov word [esp + 0x68], 0x72
mov dword [esp + 0x64], 0x6f727265
mov dword [esp + 0x60], 0x206e776f
mov dword [esp + 0x5c], 0x6e6b6e55
jmp 0x1ec587
mov esi, 0x75e948
push esi
push 0x75e9bc
push dword [esp + 0xc]
call fcn.001b4f40
add esp, 0xc
mov eax, edi
add esp, 0x1c0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1f8640
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [esp + 0x1c]
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 0x14]
lea eax, [ecx + eax*2]
add eax, 0xc
push 0x76087d
push 0x43
push eax
call fcn.001771e0
add esp, 0xc
mov esi, eax
test eax, eax
je 0x1f8756
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov dword [esi], edi
add eax, 0xc
mov dword [esi + 4], eax
mov ecx, dword [edi + 0xc]
add ecx, eax
mov dword [esi + 8], ecx
cmp dword [edi + 0x10], ebx
jae 0x1f86b5
push eax
call dword [edi]
add esp, 4
push ebx
push ebp
push dword [esi + 4]
call dword [edi + 4]
add esp, 0xc
mov ebp, dword [esi + 8]
add ebp, dword [edi + 0xc]
push dword [esi + 4]
push ebp
call dword [edi + 8]
add esp, 8
mov ebx, dword [edi + 0x14]
mov eax, dword [esi + 4]
push eax
call dword [edi]
add esp, 4
push dword [esi + 8]
call dword [edi]
add esp, 4
test ebx, ebx
mov ecx, edi
je 0x1f871a
xor edi, edi
mov dword [esp + 4], ebx
nop
movzx eax, byte [ebp + edi]
xor al, 0x36
mov byte [esp + 3], al
push 1
lea eax, [esp + 7]
push eax
push dword [esi + 4]
mov ebx, esi
mov esi, ebp
mov ebp, ecx
call dword [ecx + 4]
add esp, 0xc
movzx eax, byte [esi + edi]
xor al, 0x5c
mov byte [esp + 3], al
push 1
lea eax, [esp + 7]
push eax
push dword [ebx + 8]
call dword [ebp + 4]
mov ecx, ebp
mov ebp, esi
mov esi, ebx
mov ebx, dword [esp + 0x10]
add esp, 0xc
inc edi
cmp ebx, edi
jne 0x1f86d0
cmp ebx, dword [ecx + 0x10]
jae 0x1f8756
mov edi, ecx
nop word cs:[eax + eax]
push 1
push 0x760884
push dword [esi + 4]
call dword [edi + 4]
add esp, 0xc
push 1
push 0x760885
push dword [esi + 8]
call dword [edi + 4]
add esp, 0xc
inc ebx
cmp ebx, dword [edi + 0x10]
jb 0x1f8730
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x20a7e0
Capabilities:
Parse credit card information

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 8]
mov ecx, eax
and ecx, 3
jmp dword [ecx*4 + 0x769b00]
Function at 0x225ef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
mov edi, dword [ebx + 0x28]
push dword [edi + 0x84]
call fcn.0022f3a0
add esp, 4
mov esi, eax
mov dword [esp + 4], edi
imul esi, dword [edi + 8]
push dword [ebx + 0x2c]
call fcn.0022f400
add esp, 4
push dword [ebx + 0x30]
call fcn.0022eac0
add esp, 4
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x38], 0
test ebp, ebp
je 0x225f5b
mov dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x48]
cmp dword [esp + 8], 0
je 0x225f69
inc eax
mov dword [ebx + 0x48], eax
cmp eax, esi
jae 0x225f77
cmp dword [ebx + 0x5c], 0
je 0x226037
mov esi, dword [ebx + 0x54]
test esi, esi
jne 0x225f8a
mov dword [ebx + 0x54], 0xc
mov esi, 0xc
mov edi, dword [esp]
push edi
push esi
push 0
push ebx
call fcn.0023c320
add esp, 0x10
push edi
push dword [ebx + 0x58]
push esi
push dword [ebx + 0x44]
call dword [ebx + 0x40]
add esp, 0x10
push dword [ebx + 0x2c]
call fcn.0022f400
add esp, 4
push dword [ebx + 0x30]
call fcn.0022eac0
add esp, 4
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x38], 0
mov eax, dword [ebx + 0x28]
movzx ecx, word [ebx]
push ecx
push dword [eax + 0x90]
call fcn.0022e6f0
add esp, 8
push dword [ebx + 0x34]
call fcn.0022eac0
add esp, 4
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
push dword [ebx + 0x3c]
call fcn.00232ed0
add esp, 4
mov eax, dword [0x88fc38]
push ebx
call dword [eax]
add esp, 4
push dword [esp + 4]
call fcn.00238880
add esp, 4
mov eax, 0xc
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.00226050
Function at 0x240c50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov esi, ecx
and esi, 0xff
je 0x240c81
test dl, 3
je 0x240ce3
movzx eax, byte [edx]
test al, al
sete ah
cmp al, cl
sete al
or al, ah
je 0x240c90
mov eax, edx
pop esi
pop edi
pop ebx
ret
push 0
push edx
call fcn.00241990
add esp, 8
pop esi
pop edi
pop ebx
ret
lea eax, [edx + 1]
test al, 3
je 0x240ce1
movzx ebx, byte [eax]
test bl, bl
sete bh
cmp bl, cl
sete bl
or bl, bh
jne 0x240d2d
lea eax, [edx + 2]
test al, 3
je 0x240ce1
movzx ebx, byte [eax]
test bl, bl
sete bh
cmp bl, cl
sete bl
or bl, bh
jne 0x240d2d
lea eax, [edx + 3]
test al, 3
je 0x240ce1
movzx ebx, byte [eax]
test bl, bl
sete bh
cmp bl, cl
sete bl
or bl, bh
jne 0x240d2d
add edx, 4
jmp 0x240ce3
mov edx, eax
imul esi, esi, 0x1010101
add edx, 0xfffffffb
mov eax, edx
nop
mov edi, dword [eax + 5]
mov edx, 0x1010100
sub edx, edi
or edx, edi
xor edi, esi
mov ebx, 0x1010100
sub ebx, edi
or ebx, edi
and edx, ebx
not edx
add eax, 4
test edx, 0x80808080
je 0x240cf0
jmp 0x240d24
cmp dl, cl
je 0x240d2d
movzx edx, byte [eax + 1]
inc eax
test dl, dl
jne 0x240d20
pop esi
pop edi
pop ebx
ret

Function at 0x241990
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
test dl, 3
je 0x2419d0
cmp byte [edx], cl
jne 0x2419a8
mov eax, edx
pop esi
pop edi
ret
lea eax, [edx + 1]
test al, 3
je 0x2419ce
cmp byte [eax], cl
je 0x241a0a
lea eax, [edx + 2]
test al, 3
je 0x2419ce
cmp byte [eax], cl
je 0x241a0a
lea eax, [edx + 3]
test al, 3
je 0x2419ce
cmp byte [eax], cl
je 0x241a0a
add edx, 4
jmp 0x2419d0
mov edx, eax
movzx eax, cl
imul eax, eax, 0x1010101
add edx, 0xfffffffb
nop dword [eax]
mov esi, dword [edx + 5]
xor esi, eax
mov edi, 0x1010100
sub edi, esi
or edi, esi
not edi
add edx, 4
test edi, 0x80808080
je 0x2419e0
nop dword [eax + eax]
lea eax, [edx + 1]
cmp byte [edx + 1], cl
mov edx, eax
jne 0x241a00
pop esi
pop edi
ret
Function at 0x2548b0
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov dword [eax], 0
test ebx, ebx
jne 0x2548dc
push ebp
call fcn.004f8b98
add esp, 4
mov ebx, eax
lea eax, [ebx*4]
mov ecx, 0xaaaaaaab
mul ecx
shr edx, 1
add edx, 4
push edi
push edx
call dword [edi + 4]
add esp, 8
test eax, eax
je 0x2549a9
mov dword [esp], eax
mov esi, eax
mov dword [esp + 4], ebx
test ebx, ebx
je 0x254a0f
mov eax, dword [esp + 4]
lea ecx, [eax - 2]
mov dword [esp + 8], ecx
dec eax
mov dword [esp + 0xc], eax
xor ebx, ebx
mov esi, dword [esp]
nop word cs:[eax + eax]
movzx edx, byte [ebp + ebx]
cmp dword [esp + 0xc], ebx
je 0x2549b0
movzx ecx, byte [ebp + ebx + 1]
cmp dword [esp + 8], ebx
je 0x2549d2
mov eax, dword [esp + 0x28]
movzx ebp, byte [eax + ebx + 2]
mov edi, edx
shr edi, 2
shl edx, 4
and edx, 0x30
movzx eax, byte [edi + 0x78ffef]
mov byte [esi], al
mov eax, ecx
shr eax, 4
movzx eax, byte [eax + edx + 0x78ffef]
and ecx, 0xf
mov byte [esi + 1], al
mov eax, ebp
shr eax, 6
movzx eax, byte [eax + ecx*4 + 0x78ffef]
mov byte [esi + 2], al
and ebp, 0x3f
movzx eax, byte [ebp + 0x78ffef]
mov ebp, dword [esp + 0x28]
mov byte [esi + 3], al
add esi, 4
add ebx, 3
cmp dword [esp + 4], ebx
jne 0x254930
jmp 0x254a0f
xor eax, eax
add esp, 0x10
jmp 0x254a24
mov ecx, edx
shr ecx, 2
shl edx, 4
and edx, 0x30
movzx ecx, byte [ecx + 0x78ffef]
mov byte [esi], cl
movzx ecx, byte [edx + 0x78ffef]
mov byte [esi + 1], cl
mov cl, 0x3d
jmp 0x254a05
mov eax, edx
shr eax, 2
mov ebx, ecx
shr bl, 4
shl dl, 4
or dl, bl
and dl, 0x3f
and ecx, 0xf
movzx ebx, byte [eax + 0x78ffef]
mov byte [esi], bl
movzx edx, dl
movzx edx, byte [edx + 0x78ffef]
mov byte [esi + 1], dl
movzx ecx, byte [ecx*4 + 0x78ffef]
mov byte [esi + 2], cl
mov byte [esi + 3], 0x3d
add esi, 4
mov byte [esi], 0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp]
mov dword [eax], ecx
push ecx
call fcn.004f8b98
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x2d6d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x1c]
mov edi, dword [ecx + 4]
xor eax, eax
test edi, edi
je 0x2d6d87
mov ebx, dword [ecx]
movzx ecx, byte [ebx]
shr ecx, 6
mov esi, 1
shl esi, cl
cmp edi, esi
jae 0x2d6d8f
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push ebx
call fcn.00358ac0
add esp, 4
sub edi, esi
je 0x2d6e7b
and eax, 0xfffffffe
xor eax, 2
or eax, edx
mov eax, 0
jne 0x2d6d87
add ebx, esi
movzx ecx, byte [ebx]
shr ecx, 6
mov edx, 1
shl edx, cl
cmp edi, edx
jb 0x2d6d87
sub edi, edx
je 0x2d6d87
add ebx, edx
movzx ecx, byte [ebx]
shr ecx, 6
mov edx, 1
shl edx, cl
cmp edi, edx
jb 0x2d6d87
sub edi, edx
je 0x2d6d87
add ebx, edx
movzx ecx, byte [ebx]
shr ecx, 6
mov esi, 1
shl esi, cl
sub edi, esi
jb 0x2d6d87
push ebx
call fcn.00358ac0
add esp, 4
mov dword [esp + 4], eax
mov dword [esp], edx
or eax, edx
je 0x2d6e5b
add ebx, esi
xor eax, eax
xor edx, edx
xor esi, esi
test edi, edi
je 0x2d6d87
movzx ecx, byte [ebx]
shr ecx, 6
mov ebp, 1
shl ebp, cl
cmp edi, ebp
jb 0x2d6d87
sub edi, ebp
je 0x2d6d87
add ebx, ebp
movzx ecx, byte [ebx]
shr ecx, 6
mov ebp, 1
shl ebp, cl
sub edi, ebp
jb 0x2d6d87
add ebx, ebp
add edx, 1
adc esi, 0
cmp edx, dword [esp + 4]
mov ecx, esi
sbb ecx, dword [esp]
jb 0x2d6e0c
mov ecx, dword [esp + 4]
add ecx, 1
mov edx, dword [esp]
adc edx, 0
mov eax, dword [esp + 0x20]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov eax, 1
jmp 0x2d6d87
xor eax, eax
jmp 0x2d6d87
Function at 0x2fa170
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov dword [esp + 4], edx
mov edi, ecx
mov ebp, dword [esp + 0x40]
push ecx
call fcn.002f9790
add esp, 4
lea edx, [eax + 7]
lea ecx, [eax + 0xe]
test edx, edx
cmovns ecx, edx
sar ecx, 3
xor esi, esi
cmp dword [esp + 0x48], 0
mov ebx, 0
mov edx, 0
je 0x2fa2f1
add ecx, edx
cmp ebp, 0xffffffff
je 0x2fa320
cmp ecx, ebp
jle 0x2fa230
movups xmm0, xmmword [edi]
movups xmmword [esp + 0x18], xmm0
mov eax, dword [edi + 0x10]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x1c]
test eax, eax
mov dword [esp], edx
jle 0x2fa1f7
mov ecx, dword [esp + 0x18]
nop dword [eax]
cmp dword [ecx + eax*4 - 4], 0
jne 0x2fa1f3
lea edx, [eax - 1]
cmp eax, 1
mov eax, edx
jg 0x2fa1e0
xor eax, eax
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x2fa203
mov dword [esp + 0x24], 0
lea eax, [esp + 0x18]
push eax
call fcn.002f9790
add esp, 4
mov ecx, eax
add eax, 7
add ecx, 0xe
test eax, eax
cmovns ecx, eax
sar ecx, 3
add ecx, dword [esp]
mov eax, 0xffffffff
cmp ecx, ebp
jg 0x2fa346
mov eax, dword [edi + 8]
test eax, eax
je 0x2fa32d
mov dword [esp], esi
mov esi, dword [esp + 0x44]
xor edx, edx
cmp esi, 1
sete cl
test ebp, ebp
je 0x2fa344
mov dl, cl
lea ecx, [edx*2 - 1]
mov dword [esp + 0x10], ecx
cmp esi, 1
mov ecx, dword [esp + 4]
lea esi, [ecx + ebp - 1]
cmove esi, ecx
mov ecx, dword [edi + 4]
shl eax, 2
mov edx, 1
sub edx, eax
mov dword [esp + 0xc], edx
shl ecx, 2
neg ecx
mov dword [esp + 4], ecx
mov dword [esp + 8], edi
xor edi, edi
xor eax, eax
mov dword [esp + 0x14], ebp
nop word cs:[eax + eax]
mov ecx, dword [esp + 8]
mov ecx, dword [ecx]
mov edx, eax
and edx, 0xfffffffc
mov ebp, dword [ecx + edx]
mov ecx, dword [esp + 4]
lea edx, [ecx + edi]
lea ecx, [eax*8]
shr ebp, cl
sar edx, 0x1f
and edx, ebp
mov ebp, dword [esp + 0x14]
movzx ecx, dl
xor ecx, dword [esp]
add ebx, ecx
mov byte [esi], bl
movzx edx, bl
xor ebx, ebx
cmp ecx, edx
seta bl
mov ecx, dword [esp + 0xc]
add ecx, eax
shr ecx, 0x1f
add eax, ecx
add esi, dword [esp + 0x10]
inc edi
cmp ebp, edi
jne 0x2fa2a0
jmp 0x2fa340
mov ebx, dword [edi + 0xc]
xor edx, edx
test ebx, ebx
sete dl
mov dword [esp], edx
mov esi, 0xff
cmove esi, ebx
lea edx, [ecx*8]
cmp edx, eax
mov edx, dword [esp]
cmovne edx, ebx
add ecx, edx
cmp ebp, 0xffffffff
jne 0x2fa1ba
mov ebp, ecx
mov eax, dword [edi + 8]
test eax, eax
jne 0x2fa23b
test ebp, ebp
je 0x2fa344
push ebp
push 0
push dword [esp + 0xc]
call fcn.004f8b70
add esp, 0xc
mov eax, ebp
jmp 0x2fa346
xor eax, eax
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x2fa590
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov esi, dword [edx]
mov ebp, dword [edx + 4]
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
movzx eax, byte [edx + 0x10]
shr al, 2
cmp ebp, ecx
sete dl
and dl, al
cmp dl, 1
jne 0x2fa629
xor eax, eax
test ebp, ebp
jle 0x2fa65f
xor edi, edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], ebp
nop word cs:[eax + eax]
mov ecx, dword [esi + edi*4]
mov ebp, dword [ebx + edi*4]
mov edx, ebp
xor edx, ecx
mov ebx, ecx
sub ebx, ebp
xor ebx, ebp
or ebx, edx
xor ebx, ecx
sar ebx, 0x1f
mov esi, ebx
not ebx
and ebx, eax
or ebx, esi
mov esi, dword [esp + 8]
mov eax, ebp
sub eax, ecx
xor eax, ecx
or eax, edx
xor eax, ebp
mov ebp, dword [esp]
sar eax, 0x1f
mov ecx, eax
not eax
and eax, ebx
mov ebx, dword [esp + 4]
and ecx, 1
or eax, ecx
inc edi
cmp ebp, edi
jne 0x2fa5e0
jmp 0x2fa65f
mov eax, ebp
sub eax, ecx
jne 0x2fa65f
jmp 0x2fa64d
mov ecx, dword [esi + ebp*4 - 4]
mov edx, dword [ebx + ebp*4 - 4]
dec ebp
cmp ecx, edx
jne 0x2fa655
test ebp, ebp
jg 0x2fa640
xor eax, eax
jmp 0x2fa65f
xor eax, eax
cmp edx, ecx
adc eax, 0xffffffff
or eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret