joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42050d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x485650]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42054d
cmp byte [ebx], 0xa
jne 0x42054d
or byte [eax + edi + 0x28], 4
jmp 0x420552
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x420650
mov al, byte [edx]
cmp al, 0x1a
je 0x420632
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x420581
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4205a6
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4205b0
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x420563
jmp 0x420650
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42062d
cmp dword [ebp - 0xc], 0
je 0x42062d
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x485650]
test byte [eax + edi + 0x28], 0x48
je 0x420607
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4205f2
mov byte [esi], dl
jmp 0x420603
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x485650]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x420650
cmp byte [ebp - 1], 0xa
jne 0x420616
cmp esi, ebx
jne 0x420616
mov byte [esi], 0xa
jmp 0x42064f
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0042108d
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x420650
mov byte [esi], 0xd
jmp 0x42064f
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x485650]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x42064c
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x420650
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x420659
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x485650]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42069c
cmp word [esi], dx
jne 0x42069c
or byte [edi + eax + 0x28], 4
jmp 0x4206a1
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4207f4
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4207d4
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4206e3
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x420719
cmp eax, edx
jae 0x420725
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4206bb
jmp 0x4207f4
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4207d0
cmp dword [ebp - 0x14], 0
je 0x4207d0
mov eax, dword [ebx*4 + 0x485650]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4207a8
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x420771
mov word [esi], cx
jmp 0x4207a4
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x485650]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x485650]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x485650]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4207f4
pop ebx
cmp word [ebp - 4], bx
jne 0x4207b9
cmp esi, dword [ebp + 0xc]
jne 0x4207b9
mov word [esi], bx
jmp 0x4207f1
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0042108d
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4207f4
push 0xd
jmp 0x4207ed
mov ecx, dword [ebx*4 + 0x485650]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4207eb
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4207f4
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x423ec7
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x483680]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x423f12
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.00424066
test al, al
jne 0x423f0c
sub edx, 2
cmp edx, edi
jne 0x423ef2
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x423f34
lea eax, [edi + 2]
cmp edx, eax
je 0x423f34
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00423e13
add esp, 0x10
jmp 0x42402e
push esi
lea ecx, [ebp - 0x255]
call fcn.00424066
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x423f77
push dword [ebp - 0x25c]
jmp 0x423f24
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x423fb4
cmp word [ebp - 0x226], 0
je 0x423fd5
cmp word [ebp - 0x226], ax
jne 0x423fb4
cmp word [ebp - 0x224], 0
je 0x423fd5
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00423e13
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x424021
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x423f8e
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x424009
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x42402e
push 0x423c43
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0042adc0
add esp, 0x10
jmp 0x423ffe
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040bf55
leave
ret
Function at 0x3002680
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
xor eax, eax
test ecx, ecx
je 0x3002787
test edx, edx
je 0x3002787
mov ebp, dword [esp + 0x30]
test ebp, ebp
mov dword [esp], ecx
je 0x30026ca
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
nop
movzx ebx, byte [edx + edi]
test ebx, ebx
je 0x30026d1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, ebx
inc edi
mov ecx, esi
cmp ebp, edi
jne 0x30026b0
jmp 0x30026d3
mov esi, 0x1505
jmp 0x30026d3
mov esi, ecx
mov ebp, dword [esp]
mov edi, dword [ebp + 0x20]
mov ecx, edi
sub ecx, 1
jb 0x3002787
mov dword [esp + 8], edx
and ecx, esi
mov dword [esp + 0x18], ecx
mov eax, edi
or eax, 0xfffffffe
mov ecx, edi
and ecx, 0xfffffffe
add eax, ecx
inc eax
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 4]
mov dword [esp + 0x10], eax
xor ebx, ebx
mov edx, edi
mov dword [esp + 4], edi
jmp 0x3002715
inc ebx
cmp edx, ebx
je 0x3002785
mov eax, ebx
mov edi, dword [esp + 0x18]
and eax, edi
mov ecx, ebx
xor ecx, edi
lea eax, [ecx + eax*2]
and eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edi, dword [ecx + eax*4]
cmp edi, 0xffffffff
je 0x3002785
mov eax, dword [ebp + 8]
cmp dword [eax + edi*4], esi
jne 0x3002710
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 0xc], eax
push eax
call fcn.03008e40
mov edx, dword [esp + 8]
mov ebp, dword [esp + 4]
add esp, 4
cmp eax, dword [esp + 0x30]
jne 0x3002710
push dword [esp + 0x30]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.03008e60
mov edx, dword [esp + 0x10]
mov ebp, dword [esp + 0xc]
add esp, 0xc
test eax, eax
jne 0x3002710
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + edi*4]
jmp 0x3002787
xor eax, eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x3003530
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0x30036e6
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x30036df
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x30035c1
add ebp, dword [esp + 0x10]
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp + 4]
mov ebx, 0x15b0
je 0x30036df
xor eax, eax
cmp ebx, 8
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
jb 0x300363c
mov eax, ebx
and eax, 0x1ff8
mov dword [esp], eax
mov edx, 7
nop
movzx eax, byte [ebp]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + 3]
add esi, eax
add ecx, esi
movzx edi, byte [ebp + 4]
add edi, esi
mov eax, ecx
and eax, edi
xor ecx, edi
movzx esi, byte [ebp + 5]
add esi, edi
movzx ebx, byte [ebp + 6]
add ebx, esi
add esi, ecx
lea ecx, [esi + eax*2]
movzx edi, byte [ebp + 7]
add edi, ebx
add ecx, ebx
mov ebx, dword [esp + 4]
add ecx, edi
add ebp, 8
add edx, 8
cmp edx, ebx
jb 0x30035e0
mov esi, dword [esp + 8]
mov eax, dword [esp]
mov edx, ebx
sub edx, eax
jbe 0x3003588
mov dword [esp + 0x10], edx
mov dword [esp], eax
not eax
add eax, ebx
mov edx, ebx
and edx, 3
je 0x3003691
mov dword [esp + 0xc], eax
neg edx
xor eax, eax
mov ebx, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx]
add edi, esi
add ecx, edi
inc ebx
dec eax
cmp edx, eax
jne 0x3003670
mov edx, dword [esp]
sub edx, eax
mov eax, dword [esp + 0xc]
cmp eax, 3
jb 0x3003580
jmp 0x300369f
mov ebx, ebp
mov edx, dword [esp]
cmp eax, 3
jb 0x3003580
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0x30036b0
jmp 0x3003580
shl ecx, 0x10
or ecx, edi
jmp 0x30036eb
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x3003700
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x3003757
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test edx, edx
je 0x3003759
not eax
nop
nop
nop
nop
nop
nop
nop
mov esi, edx
not esi
add edx, edx
movzx edi, byte [ecx]
inc ecx
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x303da18]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x303da18]
add edx, esi
jne 0x3003720
not eax
jmp 0x3003759
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x30092b0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.03009340
sub esp, 0x100
mov esi, esp
jmp 0x30092c3
call fcn.03037ce0
jmp 0x30092ca
test al, 1
jne 0x30092d0
jmp 0x300930c
call fcn.03032d00
test al, 1
jne 0x30092db
jmp 0x3009307
call fcn.0300a680
test al, 1
jne 0x30092e6
jmp 0x3009305
lea eax, str.system_or_character_via_spellings_glyphs_a_is_uses_that_in_their_modified_other_on_often_reflection_or_resemblance_on_it_leetspeak__used_similarity_internet._play_eleet_the_of_the_replacements_of_primarily_ways
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.03009320
add esp, 8
call fcn.030101e0
jmp 0x3009305
jmp 0x3009307
call fcn.030388e0
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x30093a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0x30094cb
lea eax, [edi + 2]
xor ebx, ebx
jmp 0x30093dd
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0x3009401
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0x30093d0
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0x30093d0
lea esi, [ebx + 1]
push esi
call fcn.03008c00
add esp, 4
test ebx, ebx
jle 0x30094d5
add ebx, eax
add esi, eax
mov dword [esp + 8], esi
mov ebp, eax
jmp 0x3009445
mov byte [ebp], dl
mov esi, 1
add edi, 2
add ebp, esi
cmp ebp, ebx
jae 0x30094d7
movzx edx, word [edi]
test dx, dx
je 0x30094d7
cmp dx, 0x7f
jbe 0x3009430
mov ecx, ebp
not ecx
add ecx, dword [esp + 8]
movzx esi, dx
cmp ecx, 2
jb 0x3009490
cmp esi, 0x7ff
ja 0x3009490
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [ebp], cl
and dl, 0x3f
or dl, 0x80
mov byte [ebp + 1], dl
mov esi, 2
jmp 0x3009438
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x3009438
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [ebp], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [ebp + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [ebp + 2], dl
mov esi, 3
jmp 0x3009438
push 1
call fcn.03008c00
add esp, 4
mov ebp, eax
mov edi, dword [esp + 0x228]
mov esi, dword [esp + 0x224]
mov byte [ebp], 0
movzx edx, byte [eax]
lea ecx, [esp + 0xc]
mov ebx, ecx
test dl, dl
je 0x3009516
inc eax
lea ebx, [esp + 0xc]
jmp 0x300950b
mov byte [ebx], dh
inc ebx
movzx edx, byte [eax]
inc eax
test dl, dl
je 0x3009516
mov dh, 0x2f
cmp dl, 0x5c
je 0x3009500
mov dh, dl
jmp 0x3009500
mov byte [ebx], 0
push 0
push 0
push 0
mov eax, dword [esp + 0xc]
push dword [eax + 8]
add eax, 0x10
push 0
push 0
push edi
push esi
push ecx
push eax
call fcn.03005860
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x300a580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x300a66c
mov ebp, dword [esp + 0x14]
xor esi, esi
mov edi, 2
jmp 0x300a5b6
mov edx, ebp
nop
lea eax, [edi + 4]
add edi, 2
mov esi, edx
cmp edi, ecx
mov edi, eax
mov ebp, dword [esp + 0x14]
jae 0x300a66e
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.0300fef0
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.0300fef0
add esp, 4
mov bl, al
shl bh, 2
xor al, 0xc0
mov ecx, ebx
or cl, 0x30
and cl, al
shr cl, 4
add cl, bh
lea edx, [esi + 1]
mov eax, dword [esp + 0x1c]
mov byte [eax + esi], cl
mov ecx, dword [esp + 0x18]
cmp edi, ecx
jae 0x300a5a0
movzx eax, byte [ebp + edi]
push eax
mov ebp, edx
call fcn.0300fef0
mov edx, ebp
mov ecx, dword [esp + 0x1c]
add esp, 4
cmp al, 0x40
je 0x300a5a0
mov bh, al
shl bl, 4
shr al, 2
and al, 0xf
or al, bl
lea ebp, [esi + 2]
mov edx, dword [esp + 0x1c]
mov byte [edx + esi + 1], al
lea eax, [edi + 1]
cmp eax, ecx
jae 0x300a59d
mov eax, dword [esp + 0x14]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.0300fef0
mov ecx, dword [esp + 0x1c]
add esp, 4
cmp al, 0x40
mov edx, ebp
je 0x300a5a0
shl bh, 6
add al, bh
mov edx, dword [esp + 0x1c]
mov byte [edx + esi + 2], al
add esi, 3
mov edx, esi
jmp 0x300a5a0
xor edx, edx
mov eax, edx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x3014fd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x3014ff0
mov edi, dword [ecx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x3015010
sar esi, 1
sar eax, 1
lea ecx, [esi + eax]
add ecx, 2
test ecx, ecx
jns 0x3015030
mov eax, 0xffffffff
jmp 0x3015037
add eax, esi
add eax, eax
add eax, 4
push eax
call fcn.03008c00
add esp, 4
mov ebx, eax
movzx ecx, word [edi]
test cx, cx
je 0x3015061
add edi, 2
mov eax, ebx
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x3015050
mov word [eax], 0x5c
add eax, 2
mov edx, dword [ebp + 0x10]
movzx ecx, word [edx]
test cx, cx
je 0x3015091
add edx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x3015080
mov word [eax], 0
lea eax, [esp + 8]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.0303b820
add esp, 0x14
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x30425f4]
mov ecx, 0xa9e320a9
xor ecx, dword [str._nTeV_f]
add eax, ecx
inc eax
mov dword [esp + 0x24], ebx
jmp eax
Function at 0x301a4e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov dword [esp + 8], 0xb8915ba
mov dword [esp + 0xc], 0xf870991
mov dword [esp + 0x10], 0x35e0d5a
mov dword [esp + 0x14], 0x7a601a6
lea eax, [esp + 0x18]
mov word [esp + 0x18], 0x506
mov dword [esp + 0x1a], 0
mov dword [esp + 0x1e], 0
mov dword [esp + 0x22], 0
mov byte [esp + 0x26], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x1e
ja 0x301a5a7
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
mov esi, ecx
and esi, 0x61fd3ad
xor ecx, 0x61fd3ad
lea ecx, [ecx + esi*2]
mov esi, ecx
and esi, edx
add ecx, edx
add esi, esi
sub ecx, esi
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
add cl, 0x45
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
mov ecx, dword [esp + 4]
mov edx, ecx
and edx, 1
xor ecx, 1
lea ecx, [ecx + edx*2]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
cmp ecx, 0x1f
jb 0x301a550
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x28]
lea esi, [esp + 8]
mov edx, esi
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x38]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor eax, eax
nop
cmp word [ebx + eax], 0
lea eax, [eax + 2]
jne 0x301a5d0
lea ecx, [ebx + eax]
add ecx, 0xfffffffe
add eax, ebx
mov edx, 1
sub edx, eax
and edx, ebx
mov eax, ebx
not eax
and eax, ecx
sub eax, edx
mov edi, esi
cmp eax, 0xffffffed
jge 0x301a601
mov eax, 0xffffffff
jmp 0x301a604
add eax, 0x12
push eax
call fcn.03008c00
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x301a631
add ebx, 2
mov eax, esi
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x301a620
mov word [eax], 0
movzx ecx, word [esp + 0x28]
test cx, cx
je 0x301a661
lea edx, [esp + 0x2a]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x301a650
mov word [eax], 0
push edi
push esi
call fcn.0303b9f0
add esp, 8
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x30432dc]
mov ecx, 0x7dd318ba
xor ecx, dword [0x30432e4]
add eax, ecx
inc eax
jmp eax
Function at 0x301d8a0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov dword [esp + 0x10], 0x3430125
mov dword [esp + 0x14], 0x7760574
mov dword [esp + 0x18], 0xb6b094c
mov dword [esp + 0x1c], 0xf6f0d78
mov dword [esp + 0x20], 0x134e1135
mov dword [esp + 0x24], 0x177e1540
mov dword [esp + 0x28], 0x1b74196d
mov dword [esp + 0x2c], 0x1f7b1d78
mov dword [esp + 0x30], 0x23402152
mov dword [esp + 0x34], 0x2754254d
mov dword [esp + 0x38], 0x2b76294c
mov dword [esp + 0x3c], 0x2f5c2d7c
mov dword [esp + 0x40], 0x3354315f
mov dword [esp + 0x44], 0x375a355d
mov dword [esp + 0x48], 0x3b49395d
lea eax, [esp + 0x4c]
mov word [esp + 0x4c], 0x3d3c
mov dword [esp + 0x4e], 0
mov word [esp + 0x52], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x43
ja 0x301d99e
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x10]
add ecx, 0x65c86280
xor ecx, edx
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x5c]
mov edx, ecx
or edx, 0x7f
and ecx, 0x7f
add ecx, edx
inc cl
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x44
jb 0x301d960
lea ebx, [esp + 0x5c]
lea edx, [esp + 0x10]
mov ecx, 0xf
mov edi, ebx
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x98]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0x1e
push ebx
push 0
call dword [0x3049b34]
mov edi, dword [esp + 0xc]
test edi, edi
jns 0x301d9e7
mov eax, 0xffffffff
jmp 0x301d9ea
lea eax, [edi + edi]
push eax
call fcn.03008c00
add esp, 4
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
push esi
push 0x1e
push ebx
push 0
call dword [0x3049b34]
mov dword [esp + 0x10], 0x3b903982
mov dword [esp + 0x14], 0x3f923dad
mov dword [esp + 0x18], 0x2387219a
mov dword [esp + 0x1c], 0x278625b0
mov dword [esp + 0x20], 0x2bba298d
mov dword [esp + 0x24], 0x2f2c2d8e
mov dword [esp + 0x28], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x1b
ja 0x301da8f
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + 0x4311ab07]
and edx, ecx
add eax, ecx
add eax, 0x4311ab07
add edx, edx
sub eax, edx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0xcf
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x1c
jb 0x301da50
push 0
push 0
lea eax, [esp + 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.03018200
add esp, 0x14
mov ebx, eax
jmp dword [0x3043b8c]
Function at 0x30366c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, dword [ebp + 8]
mov dword [esp + 8], 0xabaaadfc
mov dword [esp + 0xc], 0
mov word [esp + 0x10], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 9
ja 0x3036745
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0xbbef571a
add eax, 0xbbef571a
and eax, ecx
add eax, eax
mov ecx, eax
xor ecx, edx
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x4a
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xa
jb 0x3036700
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
mov edi, dword [eax + 0x18]
mov ebx, dword [0x3052b6c]
mov eax, dword [0x30471f0]
mov ecx, 0x70d8a2e7
xor ecx, dword [0x30471f8]
add eax, ecx
inc eax
jmp eax
Function at 0x303a8d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 0x18], 0x73726d5c
mov dword [esp + 0x1c], 0
mov byte [esp + 0x20], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 8
ja 0x303a95f
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x18]
lea edx, [eax + 0x6e]
and edx, ecx
mov esi, 0x86572991
sub esi, eax
or esi, ecx
not esi
add esi, ecx
sub esi, edx
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x14]
add al, 0xfe
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x18], al
mov eax, dword [esp + 4]
mov ecx, eax
xor ecx, 1
and eax, 1
lea eax, [ecx + eax*2]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
cmp eax, 9
jb 0x303a910
mov ecx, dword [esp + 0x18]
mov eax, dword [0x3048cbc]
mov edx, 0x92e472e6
xor edx, dword [0x3048cc0]
add eax, edx
inc eax
jmp eax