joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10087304
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x1008736a
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.100857f8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.10084234
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x10087354
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x10087371
lea eax, [ebp - 0x10]
call fcn.10085588
ret

Function at 0x1008b790
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.dll_GetLocaleInfoA
test eax, eax
jle 0x1008b7c9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.10085678
jmp 0x1008b7d2
mov eax, ebx
mov edx, esi
call fcn.100855dc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1008b7dc
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.dll_GetLocaleInfoA
test eax, eax
jle 0x1008b7fd
mov al, byte [esp]
jmp 0x1008b7ff
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x1008be94
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x1008bcfc
mov eax, dword [0x1012fdf0]
cmp byte [eax], 0
je 0x1008bf10
mov eax, dword [0x1012fcf8]
call fcn.10083f2c
call fcn.10083b28
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.USER32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.100890e4
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
push eax
call sub.KERNEL32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x1008bf58
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
push eax
call sub.KERNEL32.dll_WriteFile
jmp 0x1008bf46
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x1012fcd4]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x10130660]
call fcn.100867ac
push eax
call sub.USER32.dll_LoadStringA
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.USER32.dll_MessageBoxA
add esp, 0x444
ret
Function at 0x1008cc58
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x1008ccbc
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.KERNEL32.dll_GetLocaleInfoA
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.100857f8
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_GetACP
mov edx, eax
pop eax
call fcn.10088c20
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1008ccc3
lea eax, [ebp - 0xc]
call fcn.10085588
ret

Function at 0x1008dd84
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0x1011f33c
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0x1008de48
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0x1008ddbc
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0x1008de5f
dec edx
je 0x1008dea0
jmp 0x1008defd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0x1008defd
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1008df60
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x1008df7d
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x1008e08f
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x1008dfb0
je 0x1008dffc
sub ecx, 0x2b
je 0x1008dff2
sub ecx, 4
je 0x1008dff7
dec ecx
sub ecx, 0xa
jb 0x1008dfe1
jmp 0x1008dfff
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x1008dfc2
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x1008dfd0
jmp 0x1008dfff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x1008dfff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x1008dfff
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x1008dfff
mov byte [eax], 0x3e
jmp 0x1008dfff
mov byte [eax], 0x3f
jmp 0x1008dfff
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x1008df8f
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x1008e04f
cmp byte [esp + 3], 0xff
jne 0x1008e04f
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x1008e087
cmp dl, 0xff
je 0x1008e087
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x1008df88
add esp, 0xc
pop ebp
pop edi
pop esi
ret

Function at 0x1008e11c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
xor ebx, ebx
mov ecx, 0x101307a0
mov eax, ebx
mov edx, 8
test al, 1
je 0x1008e138
shr eax, 1
xor eax, 0xedb88320
jmp 0x1008e13a
shr eax, 1
dec edx
jne 0x1008e12b
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x1008e124
pop ebx
ret
Function at 0x1008e150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x1008e159
mov eax, dword [ebp - 4]
add esp, 0xfffffebc
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.10085a38
xor eax, eax
push ebp
push 0x1008e239
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.1008e11c
mov eax, dword [0x1012fe0c]
mov byte [eax], 0
mov dword [ebx], 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
call fcn.10083e7c
mov edx, 1
lea eax, [ebp - 0x154]
call fcn.10084218
call fcn.10083ba8
test eax, eax
jne 0x1008e216
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x10145]
mov ecx, 0xfff1
lea eax, [ebp - 0x154]
call fcn.10083fcc
mov dx, word [ebp - 8]
test dx, dx
jbe 0x1008e210
lea eax, [ebp - 0x10145]
xor ecx, ecx
mov cl, byte [eax]
mov esi, dword [ebx]
and esi, 0xff
xor ecx, esi
mov ecx, dword [ecx*4 + 0x101307a0]
mov esi, dword [ebx]
shr esi, 8
xor ecx, esi
mov dword [ebx], ecx
inc eax
dec dx
jne 0x1008e1ec
cmp dword [ebp - 8], 0
jne 0x1008e1c3
lea eax, [ebp - 0x154]
call fcn.10083fec
not dword [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1008e240
lea eax, [ebp - 4]
call fcn.10085588
ret

Function at 0x10099718
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x10099738
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x10099726
pop edi
pop esi
pop ebx
ret
Function at 0x100a1fd4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
xor ebp, ebp
mov ebx, 0x10130cb4
mov eax, ebp
shr eax, 1
and eax, 0xff
mov dword [esp], eax
mov esi, ebp
and esi, 1
mov eax, ebp
and eax, 0x200
shr eax, 8
or esi, eax
mov edx, dword [esi*4 + 0x10125670]
mov eax, dword [esi*4 + 0x101256b0]
xor eax, dword [esp]
call fcn.100a1f70
mov edi, eax
shl edi, 0x18
mov eax, edi
call fcn.100a1fac
mov dword [ebx], eax
mov edx, dword [esi*4 + 0x10125680]
mov eax, dword [esi*4 + 0x101256c0]
xor eax, dword [esp]
call fcn.100a1f70
mov edi, eax
shl edi, 0x10
mov eax, edi
call fcn.100a1fac
mov dword [ebx + 0x1000], eax
mov edx, dword [esi*4 + 0x10125690]
mov eax, dword [esi*4 + 0x101256d0]
xor eax, dword [esp]
call fcn.100a1f70
mov edi, eax
shl edi, 8
mov eax, edi
call fcn.100a1fac
mov dword [ebx + 0x2000], eax
mov edx, dword [esi*4 + 0x101256a0]
mov eax, dword [esi*4 + 0x101256e0]
xor eax, dword [esp]
call fcn.100a1f70
mov edi, eax
mov eax, edi
call fcn.100a1fac
mov dword [ebx + 0x3000], eax
inc ebp
add ebx, 4
cmp ebp, 0x400
jne 0x100a1fe0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x100a2138
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax + edx*4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
lea eax, [eax + eax*2]
mov edx, dword [ebp - 4]
lea eax, [edx + eax*4 + 0x4c]
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [eax + ebx*4], edx
inc ebx
cmp ebx, 3
jne 0x100a216d
xor ebx, ebx
mov eax, ebx
mov esi, 3
xor edx, edx
div esi
mov eax, dword [ebp - 0x14]
lea eax, [eax + edx*4]
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [eax + ecx]
and edx, 3
mov esi, dword [ebp - 8]
lea edx, [esi + edx*2]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov dx, word [edx]
and dx, 1
movzx edx, dx
mov esi, dword [ebp - 0x18]
mov esi, dword [esi]
add esi, esi
or esi, edx
mov edi, dword [ebp - 0x18]
mov dword [edi], esi
mov esi, dword [ebp - 0x1c]
movzx esi, word [esi]
shr esi, 1
xor dx, 1
shl edx, 0xf
or si, dx
mov edx, dword [ebp - 0x1c]
mov word [edx], si
inc eax
cmp eax, 4
jne 0x100a2193
inc ebx
cmp ebx, 0xf
jne 0x100a217d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 8
jne 0x100a214f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100a7894
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
mov bl, dl
dec ebx
test ebx, ebx
jb 0x100a78e8
inc ebx
xor edx, edx
mov ecx, edx
shl ecx, 2
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x10128f14]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x10129314]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x10129714]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x10129b14]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x100a78a3
pop edi
pop esi
pop ebx
ret
Function at 0x100aaf64
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], eax
mov ebx, dword [esp]
and ebx, 0xff
mov ecx, dword [esp]
shr ecx, 8
and ecx, 0xff
mov eax, dword [esp]
shr eax, 0x10
and eax, 0xff
mov esi, dword [esp]
shr esi, 0x18
mov dword [esp + 8], esi
cmp dword [esp + 4], 0x100
jne 0x100aaff5
movzx ebx, byte [ebx + 0x1012a1f4]
mov esi, dword [edx + 0xc]
mov edi, esi
and edi, 0xff
xor ebx, edi
movzx ecx, byte [ecx + 0x1012a0f4]
mov edi, esi
shr edi, 8
and edi, 0xff
xor ecx, edi
movzx eax, byte [eax + 0x1012a0f4]
mov edi, esi
shr edi, 0x10
and edi, 0xff
xor eax, edi
mov edi, dword [esp + 8]
movzx edi, byte [edi + 0x1012a1f4]
shr esi, 0x18
xor edi, esi
mov dword [esp + 8], edi
cmp dword [esp + 4], 0xc0
jb 0x100ab04f
movzx ebx, byte [ebx + 0x1012a1f4]
mov esi, dword [edx + 8]
mov edi, esi
and edi, 0xff
xor ebx, edi
movzx ecx, byte [ecx + 0x1012a1f4]
mov edi, esi
shr edi, 8
and edi, 0xff
xor ecx, edi
movzx eax, byte [eax + 0x1012a0f4]
mov edi, esi
shr edi, 0x10
and edi, 0xff
xor eax, edi
mov edi, dword [esp + 8]
movzx edi, byte [edi + 0x1012a0f4]
shr esi, 0x18
xor edi, esi
mov dword [esp + 8], edi
movzx ebx, byte [ebx + 0x1012a0f4]
mov esi, dword [edx + 4]
and esi, 0xff
xor ebx, esi
movzx ebx, byte [ebx + 0x1012a0f4]
mov esi, dword [edx]
and esi, 0xff
xor ebx, esi
mov ebx, dword [ebx*4 + 0x10134ce4]
movzx ecx, byte [ecx + 0x1012a1f4]
mov esi, dword [edx + 4]
shr esi, 8
and esi, 0xff
xor ecx, esi
movzx ecx, byte [ecx + 0x1012a0f4]
mov esi, dword [edx]
shr esi, 8
and esi, 0xff
xor ecx, esi
xor ebx, dword [ecx*4 + 0x101350e4]
movzx eax, byte [eax + 0x1012a0f4]
mov ecx, dword [edx + 4]
shr ecx, 0x10
and ecx, 0xff
xor eax, ecx
movzx eax, byte [eax + 0x1012a1f4]
mov ecx, dword [edx]
shr ecx, 0x10
and ecx, 0xff
xor eax, ecx
xor ebx, dword [eax*4 + 0x101354e4]
mov eax, dword [esp + 8]
movzx eax, byte [eax + 0x1012a1f4]
mov ecx, dword [edx + 4]
shr ecx, 0x18
xor eax, ecx
movzx eax, byte [eax + 0x1012a1f4]
mov edx, dword [edx]
shr edx, 0x18
xor eax, edx
xor ebx, dword [eax*4 + 0x101358e4]
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret

Function at 0x100ab10c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor ebx, ebx
and ecx, 0xff
imul ecx, ecx, 0x1010101
mov esi, dword [edx + ebx*4]
xor esi, ecx
mov dword [eax + ebx*4], esi
mov esi, dword [edx + ebx*4 + 4]
xor esi, ecx
mov dword [eax + ebx*4 + 4], esi
mov esi, dword [edx + ebx*4 + 8]
xor esi, ecx
mov dword [eax + ebx*4 + 8], esi
mov esi, dword [edx + ebx*4 + 0xc]
xor esi, ecx
mov dword [eax + ebx*4 + 0xc], esi
add ebx, 4
cmp ebx, 0x40
jb 0x100ab11c
pop esi
pop ebx
ret
Function at 0x100abee0
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp + 0x18], 0x100
mov esi, 0x1012a0f4
mov ebx, 0x10134ce4
movzx edi, byte [esi]
mov dword [esp], edi
mov eax, edi
call fcn.100aae30
mov dword [esp + 8], eax
mov eax, edi
call fcn.100aae40
mov dword [esp + 0x10], eax
movzx edi, byte [esi + 0x100]
mov dword [esp + 4], edi
mov eax, edi
call fcn.100aae30
mov dword [esp + 0xc], eax
mov eax, edi
call fcn.100aae40
mov ebp, eax
mov dword [esp + 0x14], ebp
mov eax, edi
mov edx, dword [esp + 0xc]
shl edx, 8
or eax, edx
mov edx, ebp
shl edx, 0x10
or eax, edx
mov edx, ebp
shl edx, 0x18
or eax, edx
mov dword [ebx], eax
mov eax, dword [esp + 0x10]
mov edx, eax
mov ecx, eax
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x400], edx
mov edx, dword [esp + 0xc]
shl ebp, 8
or edx, ebp
shl edi, 0x10
or edx, edi
mov ecx, dword [esp + 0x14]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x800], edx
mov edx, dword [esp + 8]
mov ecx, dword [esp]
shl ecx, 8
or edx, ecx
shl eax, 0x10
or edx, eax
mov eax, dword [esp + 8]
shl eax, 0x18
or edx, eax
mov dword [ebx + 0xc00], edx
add ebx, 4
inc esi
dec dword [esp + 0x18]
jne 0x100abef9
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x100c72c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x100c72f1
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x100c7370
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.100c5a0c
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x100c733e
mov cx, word [esp]
sub cx, si
jmp 0x100c7340
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x100c7327
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x100c7366
mov cx, word [esp]
sub cx, si
jmp 0x100c7368
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x100c734f
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x100c73cd
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.100c6f98
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x100c73b8
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x100c73cd
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x100c72ce
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xb70058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00b701a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xb7007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb7006a
add dl, dl
jne 0xb70089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb700dc
xor eax, eax
add dl, dl
jne 0xb70096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb7017d
add dl, dl
jne 0xb700a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb700b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb700bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb700c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xb700d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xb70075
mov eax, 1
add dl, dl
jne 0xb700ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb700f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb700e1
sub eax, ebx
mov ebx, 1
jne 0xb70128
mov ecx, 1
add dl, dl
jne 0xb7010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb70119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb70105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb70075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xb7013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb7014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb70136
cmp eax, 0x7d00
jae 0xb7016d
cmp eax, 0x500
jb 0xb70168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb70075
cmp eax, 0x7f
ja 0xb70170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb70075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xb7019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xb70075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x43afa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x43afaf
pop dword [ebp - 0x14]
mov eax, 0x96fd7650
sub eax, 0x96b9c6a1
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x5bba6977
sub dword [ebp - 0x24], 0xd68242c
mov dword [ebp - 0x20], 0xcff1b219
add dword [ebp - 0x20], 0x62419a2c
mov dword [ebp - 0x1c], 0xfc13bcfb
add dword [ebp - 0x1c], 0x50388733
mov dword [ebp - 0x18], 0x638ac0e6
add dword [ebp - 0x18], 0x9c753f1a
lea eax, [ebp - 0x24]
push eax
mov eax, 0x8a092dd4
add eax, 0x76406280
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x3e9b19a6
add dword [ebp - 0x24], 0x35d74fb0
mov dword [ebp - 0x20], 0x19302c56
sub dword [ebp - 0x20], 0xd7c3cae1
mov dword [ebp - 0x1c], 0xd5b59f2f
sub dword [ebp - 0x1c], 0x724632c3
mov dword [ebp - 0x18], 0xf6189d06
add dword [ebp - 0x18], 0x9e762fa
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x58661119
add eax, 0xa7e37f0b
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x6edc3
push 0
call eax
mov ecx, 0xbeace26b
add ecx, 0x415369b0
mov esi, eax
mov edi, 0x4c5e00
add edi, dword [ebp - 0x14]
mov ebx, 0x66cc9506
xor dword [ebp - 4], edx
mov edx, dword [edi]
sub dword [ebp - 0xc], ecx
add edx, ebx
sub dword [ebp - 4], edi
mov dword [esi], edx
add esi, 0xa32cb7b5
sub esi, 0xa32cb7b1
add edi, 0x753c3ad0
sub edi, 0x753c3acc
loop 0x43b0c5
add eax, 0x1233f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x8dc497d0
sub ecx, 0x8d8497d0
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x44f533
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x44f548
xor eax, eax
jmp 0x44f627
push ebx
mov ebx, dword [ebp + 8]
push edi
push 8
push ebx
call main
mov edi, eax
mov dword [ebp - 0x10], edi
pop ecx
pop ecx
test edi, edi
je 0x44f593
test byte [ebp + 0x10], 1
mov eax, dword [esi]
mov dword [edi], eax
jne 0x44f577
xor eax, eax
inc eax
cmp dword [esi], eax
jle 0x44f577
add eax, eax
cmp eax, dword [esi]
jl 0x44f571
imul eax, eax, 0x18
push eax
push ebx
call main
mov dword [edi + 4], eax
pop ecx
pop ecx
test eax, eax
jne 0x44f59a
push edi
push ebx
call main
pop ecx
pop ecx
xor eax, eax
jmp 0x44f625
and dword [ebp - 8], 0
cmp dword [esi], 0
mov ecx, dword [esi + 4]
mov dword [ebp + 0xc], ecx
jle 0x44f623
lea edx, [eax + 0x10]
sub eax, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov dword [ebp - 0xc], eax
push 0
push dword [ebp + 0x10]
push dword [ecx]
push ebx
call main
mov ecx, dword [ebp + 0xc]
mov dword [edi + ecx], eax
push dword [ecx + 4]
push ebx
call main
mov ecx, dword [ebp - 4]
mov dword [ecx - 0xc], eax
mov eax, dword [ebp + 0xc]
push dword [eax + 8]
push ebx
call main
mov edx, dword [ebp - 4]
add esp, 0x20
mov ecx, dword [ebp + 0xc]
mov dword [edx - 8], eax
mov al, byte [ecx + 0xc]
and dword [edx], 0xfffffffe
mov byte [edx - 4], al
mov eax, dword [ecx + 0x10]
xor eax, dword [edx]
and eax, 2
xor dword [edx], eax
mov eax, dword [ecx + 0x14]
add ecx, 0x18
mov dword [edx + 4], eax
add edx, 0x18
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov dword [ebp + 0xc], ecx
cmp eax, dword [esi]
jl 0x44f5b6
mov edi, dword [ebp - 0x10]
mov eax, edi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret