joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb1c6a0
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
lea ebx, [ebp - 8]
mov eax, dword [0xb9fcec]
mov dword [ebx], eax
mov eax, dword [0xb9fcf0]
mov dword [ebx + 4], eax
call fcn.00b1c520
xor eax, dword [ebx]
xor edx, dword [ebx + 4]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov ecx, 0xb9fcf8
mov eax, ecx
cdq
add eax, dword [ebx]
adc edx, dword [ebx + 4]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x20]
mov dword [ebx], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x143]
mov eax, ecx
cdq
add eax, dword [ebx]
adc edx, dword [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x28]
mov dword [ebx], eax
mov eax, dword [ebp - 0x24]
mov dword [ebx + 4], eax
push 0
call sub.kernel32.dll_Sleep_2
call fcn.00b1c520
add eax, dword [ebx]
adc edx, dword [ebx + 4]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x30]
mov dword [ebx], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x18]
push eax
call sub.kernel32.dll_QueryPerformanceFrequency
test eax, eax
je 0xb1c749
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov dword [ebp - 0xc], pe_nt_image_headers32
lea eax, [ebp - 0x143]
xor ecx, ecx
mov edx, 0x103
call fcn.00a13bc8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x143]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0xb1c79c
lea eax, [ebp - 0x143]
mov edx, dword [ebp - 0xc]
call fcn.00b1c664
xor edx, edx
add eax, dword [ebx]
adc edx, dword [ebx + 4]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x38]
mov dword [ebx], eax
mov eax, dword [ebp - 0x34]
mov dword [ebx + 4], eax
mov dword [ebp - 0xc], pe_nt_image_headers32
lea eax, [ebp - 0x143]
xor ecx, ecx
mov edx, 0x103
call fcn.00a13bc8
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x143]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0xb1c7ef
lea eax, [ebp - 0x143]
mov edx, dword [ebp - 0xc]
call fcn.00b1c664
xor edx, edx
add eax, dword [ebx]
adc edx, dword [ebx + 4]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x40]
mov dword [ebx], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebx + 4], eax
call sub.kernel32.dll_GetCurrentProcessId
xor edx, edx
xor eax, dword [ebx]
xor edx, dword [ebx + 4]
mov dword [ebx], eax
mov dword [ebx + 4], edx
mov eax, dword [ebx]
call fcn.00b1c4a4
mov dword [ebx], eax
mov eax, dword [ebx + 4]
call fcn.00b1c4c4
mov dword [ebx + 4], eax
mov eax, dword [ebx]
mov dword [0xb9fcf8], eax
mov eax, dword [ebx + 4]
mov dword [0xb9fcfc], eax
mov byte [0xb9fcf4], 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xb1d5c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0xb1d6a6
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
mov eax, dword [ebp + 0xc]
call fcn.00b1d560
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
mov ecx, edi
mov edx, esi
call fcn.00a15718
mov edx, dword [ebp - 0x14]
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.00b1d278
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.00a15488
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
mov edx, esi
call fcn.00a15718
mov edx, dword [ebp - 0x1c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call fcn.00b1d370
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.00a15488
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00a15b20
mov esi, ebx
test esi, esi
jle 0xb1d680
mov ebx, 1
lea eax, [ebp - 0xc]
call fcn.00a158f0
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0xb1d661
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00a15444
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb1d6ad
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00a15414
ret
Function at 0xb1ecc4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, edx
cmp ebx, 0x80
jle 0xb1ecf2
push 0xb1ee14
mov ecx, 2
mov dl, 1
mov eax, dword [0xb1ebd8]
call fcn.00b1ec2c
call fcn.00a14d24
cmp ebx, 1
jge 0xb1ed12
push 0xb1ee3c
mov ecx, 2
mov dl, 1
mov eax, dword [0xb1ebd8]
call fcn.00b1ec2c
call fcn.00a14d24
cmp dword [ebp - 4], 0
jle 0xb1ed21
cmp dword [ebp - 4], 0x400
jle 0xb1ed3c
push 0xb1ee60
mov ecx, 3
mov dl, 1
mov eax, dword [0xb1ebd8]
call fcn.00b1ec2c
call fcn.00a14d24
mov edx, dword [ebp + 8]
mov ecx, ebx
call fcn.00a132b8
mov edx, ebx
cmp edx, 0x7f
jg 0xb1ed78
mov eax, dword [ebp + 8]
lea eax, [eax + edx - 1]
mov ecx, edx
sub ecx, ebx
mov esi, dword [ebp + 8]
movzx ecx, byte [esi + ecx]
add cl, byte [eax]
movzx ecx, cl
movzx ecx, byte [ecx + 0xba0240]
mov byte [eax + 1], cl
inc edx
inc eax
cmp edx, 0x80
jne 0xb1ed54
mov ebx, dword [ebp - 4]
add ebx, 7
test ebx, ebx
jns 0xb1ed85
add ebx, 7
sar ebx, 3
mov ecx, dword [ebp - 4]
add ecx, 8
movzx eax, bl
add eax, eax
add eax, eax
add eax, eax
sub ecx, eax
mov eax, 1
shl eax, cl
push eax
mov eax, 0xff
pop edx
mov ecx, edx
xor edx, edx
div ecx
mov eax, edx
movzx esi, bl
mov edx, 0x80
sub edx, esi
mov ecx, dword [ebp + 8]
and al, byte [ecx + edx]
movzx eax, al
mov ecx, dword [ebp + 8]
movzx eax, byte [eax + 0xba0240]
mov byte [ecx + edx], al
mov edx, 0x7f
sub edx, esi
cmp edx, 0
jl 0xb1ee04
mov eax, dword [ebp + 8]
lea eax, [eax + edx + 1]
movzx ecx, bl
add ecx, edx
mov esi, dword [ebp + 8]
movzx ecx, byte [esi + ecx]
xor cl, byte [eax]
movzx ecx, cl
movzx ecx, byte [ecx + 0xba0240]
mov byte [eax - 1], cl
dec edx
dec eax
cmp edx, 0xffffffff
jne 0xb1ede2
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0xb1f5e8
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax + 4], edx
xor esi, esi
mov ebx, 0xba0340
movzx eax, byte [ebx]
dec eax
movzx edx, al
mov ecx, edx
and ecx, 0x1f
push ecx
mov ecx, 0x1f
pop edi
sub ecx, edi
mov edi, 1
shl edi, cl
shr edx, 5
mov eax, dword [esp]
and edi, dword [eax + edx*4]
je 0xb1f663
mov eax, esi
and eax, 0x8000001f
jns 0xb1f642
dec eax
or eax, 0xffffffe0
inc eax
mov ecx, 0x1f
sub ecx, eax
mov eax, 1
shl eax, cl
mov edx, esi
test edx, edx
jns 0xb1f659
add edx, 0x1f
sar edx, 5
mov ecx, dword [esp + 4]
or dword [ecx + edx*4], eax
inc esi
inc ebx
cmp esi, 0x38
jne 0xb1f60d
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0xb1f670
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax + 4], edx
xor esi, esi
mov ebx, 0xba0388
movzx eax, byte [ebx]
dec eax
movzx edx, al
mov ecx, edx
and ecx, 0x1f
push ecx
mov ecx, 0x1f
pop edi
sub ecx, edi
mov edi, 1
shl edi, cl
shr edx, 5
mov eax, dword [esp]
and edi, dword [eax + edx*4]
je 0xb1f6eb
mov eax, esi
and eax, 0x8000001f
jns 0xb1f6ca
dec eax
or eax, 0xffffffe0
inc eax
mov ecx, 0x1f
sub ecx, eax
mov eax, 1
shl eax, cl
mov edx, esi
test edx, edx
jns 0xb1f6e1
add edx, 0x1f
sar edx, 5
mov ecx, dword [esp + 4]
or dword [ecx + edx*4], eax
inc esi
inc ebx
cmp esi, 0x30
jne 0xb1f695
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0xb1fde4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp], eax
mov esi, 0xba0788
mov byte [esp + 4], 4
mov edi, dword [esp]
add edi, 2
mov al, 4
mov edx, edi
mov ecx, edx
movzx ebx, byte [ecx]
movzx ebx, byte [esi + ebx]
mov byte [ecx], bl
inc edx
dec al
jne 0xb1fe01
add edi, 4
dec byte [esp + 4]
jne 0xb1fdfd
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0xb1fe20
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp], eax
mov esi, 0xba0888
mov byte [esp + 4], 4
mov edi, dword [esp]
add edi, 2
mov al, 4
mov edx, edi
mov ecx, edx
movzx ebx, byte [ecx]
movzx ebx, byte [esi + ebx]
mov byte [ecx], bl
inc edx
dec al
jne 0xb1fe3d
add edi, 4
dec byte [esp + 4]
jne 0xb1fe39
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0xb1ff60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], eax
mov byte [esp + 8], 4
mov eax, dword [esp]
add eax, 2
mov dword [esp + 0xc], eax
mov bl, 4
mov eax, dword [esp + 0xc]
lea edx, [esp + 4]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
add eax, 4
dec bl
jne 0xb1ff83
xor ebx, ebx
lea esi, [esp + 4]
mov eax, dword [esp + 0xc]
mov edi, eax
movzx edx, byte [esi]
mov al, 2
call fcn.00b1ff28
push eax
movzx ebp, bl
mov eax, ebp
inc eax
and eax, 3
movzx edx, byte [esp + eax + 8]
mov al, 3
call fcn.00b1ff28
pop edx
xor dl, al
mov eax, ebp
add eax, 2
and eax, 3
xor dl, byte [esp + eax + 4]
add ebp, 3
and ebp, 3
xor dl, byte [esp + ebp + 4]
mov byte [edi], dl
inc ebx
add edi, 4
inc esi
cmp bl, 4
jne 0xb1ff9c
inc dword [esp + 0xc]
dec byte [esp + 8]
jne 0xb1ff79
lea eax, [esp + 4]
mov edx, 4
call fcn.00b1ec70
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xb20004
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], eax
mov byte [esp + 8], 4
mov eax, dword [esp]
add eax, 2
mov dword [esp + 0xc], eax
mov bl, 4
mov eax, dword [esp + 0xc]
lea edx, [esp + 4]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
add eax, 4
dec bl
jne 0xb20027
xor ebx, ebx
lea esi, [esp + 4]
mov eax, dword [esp + 0xc]
mov edi, eax
movzx edx, byte [esi]
mov al, 0xe
call fcn.00b1ff28
push eax
movzx ebp, bl
mov eax, ebp
inc eax
and eax, 3
movzx edx, byte [esp + eax + 8]
mov al, 0xb
call fcn.00b1ff28
pop edx
xor dl, al
push edx
mov eax, ebp
add eax, 2
and eax, 3
movzx edx, byte [esp + eax + 8]
mov al, 0xd
call fcn.00b1ff28
pop edx
xor dl, al
push edx
add ebp, 3
and ebp, 3
movzx edx, byte [esp + ebp + 8]
mov al, 9
call fcn.00b1ff28
pop edx
xor dl, al
mov byte [edi], dl
inc ebx
add edi, 4
inc esi
cmp bl, 4
jne 0xb20040
inc dword [esp + 0xc]
dec byte [esp + 8]
jne 0xb2001d
lea eax, [esp + 4]
mov edx, 4
call fcn.00b1ec70
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xb200d8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov byte [esp + 0xc], 0
mov eax, dword [esp]
add eax, 2
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0xc]
add eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
xor ebx, ebx
mov eax, dword [esp + 0x10]
mov esi, eax
mov edi, esi
mov edx, ebp
mov eax, ebx
call fcn.00b200c4
xor byte [edi], al
inc ebx
add esi, 4
cmp bl, 4
jne 0xb20111
inc byte [esp + 0xc]
inc dword [esp + 0x10]
cmp byte [esp + 0xc], 4
jne 0xb200f9
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xb21170
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
mov eax, ecx
dec eax
test eax, eax
jl 0xb21185
inc eax
movzx ecx, byte [edx]
xor byte [esi], cl
inc esi
inc edx
dec eax
jne 0xb2117b
pop esi
ret

Function at 0xb213a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb213a9
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00a132b8
cmp dword [ebp - 0xc], 0
jl 0xb21434
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.00a132b8
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
movzx eax, byte [ebp - 0x100c]
xor byte [esi], al
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.00a132b8
movzx eax, byte [esi]
mov byte [ebp + ebx - 0x200d], al
dec dword [ebp - 0xc]
inc esi
cmp dword [ebp - 0xc], 0
jge 0xb213e2
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00b1ec70
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0xb2144c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb21455
mov eax, dword [ebp - 4]
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x2010]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00a132b8
cmp dword [ebp - 0x10], 0
jl 0xb214ea
lea edx, [ebp - 0x1010]
lea eax, [ebp - 0x2010]
mov ecx, ebx
call fcn.00a132b8
lea edx, [ebp - 0x1010]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x2010]
lea eax, [ebp - 0x200f]
call fcn.00a132b8
movzx eax, byte [esi]
mov byte [ebp - 9], al
movzx eax, byte [ebp - 9]
mov byte [ebp + ebx - 0x2011], al
movzx eax, byte [ebp - 9]
xor al, byte [ebp - 0x1010]
mov byte [esi], al
dec dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 0
jge 0xb2148e
lea eax, [ebp - 0x1010]
mov edx, ebx
call fcn.00b1ec70
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0xb21500
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb21509
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00a132b8
cmp dword [ebp - 0xc], 0
jl 0xb21598
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.00a132b8
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
movzx eax, byte [ebp - 0x100c]
xor byte [esi], al
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.00a132b8
movzx eax, byte [ebp - 0x100c]
mov byte [ebp + ebx - 0x200d], al
dec dword [ebp - 0xc]
inc esi
cmp dword [ebp - 0xc], 0
jge 0xb21542
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00b1ec70
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0xb215b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0xb215b9
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.00a132b8
cmp dword [ebp - 0xc], 0
jl 0xb21648
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.00a132b8
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.00a132b8
movzx eax, byte [ebp - 0x100c]
mov byte [ebp + ebx - 0x200d], al
movzx eax, byte [ebp - 0x100c]
xor byte [esi], al
dec dword [ebp - 0xc]
inc esi
cmp dword [ebp - 0xc], 0
jge 0xb215f2
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00b1ec70
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0xb410b4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0xa
add esp, 0xfffff004
push eax
dec eax
jne 0xb410bd
mov eax, dword [ebp - 4]
add esp, 0xffffffc8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xa03c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0xb4159a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xe], 0
lea eax, [ebp - 4]
call fcn.00a153f0
xor ecx, ecx
mov dl, 1
mov eax, dword [0xb10c78]
call fcn.00b12c04
mov dword [ebp - 0x20], eax
xor ecx, ecx
push ebp
push 0xb4156d
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b12cf0
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x54], edx
mov dword [eax + 0x50], 0xb410b0
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x64], edx
mov dword [eax + 0x60], 0xb41094
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x8c], edx
mov dword [eax + 0x88], 0xb41098
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x90]
movzx edx, byte [0xb415ac]
call fcn.00b120ac
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
call fcn.00af0c84
test al, al
je 0xb41195
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b12558
jmp 0xb411a3
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x20]
call fcn.00b125d8
mov eax, dword [ebp - 0xc]
movzx edx, word [eax + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00b12658
xor eax, eax
push ebp
push 0xb4120a
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov dl, 1
mov eax, dword [ebp - 0x20]
call fcn.00b12518
jmp 0xb411f2
push 0x1f4
call sub.kernel32.dll_Sleep_2
mov eax, dword [0xba9da8]
mov eax, dword [eax]
call fcn.00a86f08
mov eax, dword [ebp - 0x20]
cmp byte [eax + 0x30], 0
jne 0xb41200
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0xfa0
jbe 0xb411d3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xb41214
push ebx
mov ebx, 0x1ab7964
Function at 0xb76734
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0xbb22c0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0xb76756
shr eax, 1
xor eax, 0xedb88320
jmp 0xb76758
shr eax, 1
dec edx
jne 0xb76744
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0xb7673d
mov byte [0xbb26c0], 1
pop esi
pop ebx
ret

Function at 0xb76774
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0xbb26c0], 0
jne 0xb7678b
call fcn.00b76734
mov eax, edi
dec eax
test eax, eax
jl 0xb767b3
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0xbb22c0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0xb76795
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0xb78c08
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x45d]
movzx ecx, dl
cmp ecx, 6
ja case.0xb78ca2.0
jmp dword [ecx*4 + 0xb78c3b]
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0xb78c6d
sub dl, 8
je 0xb78c7c
jmp case.0xb78ca2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xb78974
jmp case.0xb78ca2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xb789cc
jmp case.0xb78ca2.0
movzx ecx, byte [eax + 0x45c]
cmp ecx, 0x10
ja case.0xb78ca2.0
movzx ecx, byte [ecx + 0xb78ca9]
jmp dword [ecx*4 + 0xb78cba]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xb78a24
jmp case.0xb78ca2.0
cmp dl, 3
jne 0xb78ce7
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xb78a78
jmp case.0xb78ca2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xb78a34
jmp case.0xb78ca2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xb78abc
jmp case.0xb78ca2.0
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0xb78d12
sub dl, 8
je 0xb78d1e
jmp case.0xb78ca2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xb78ad8
jmp case.0xb78ca2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xb78b44
jmp case.0xb78ca2.0
movzx edx, byte [eax + 0x45c]
sub dl, 8
je 0xb78d3d
sub dl, 8
je 0xb78d49
jmp case.0xb78ca2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xb78bb4
jmp case.0xb78ca2.0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0xb78bdc
mov esi, dword [eax + 0x448]
mov edx, dword [ebx + 0x1c]
dec edx
imul esi, edx
add esi, dword [eax + 0x44c]
mov dword [ebp - 0xc], esi
mov eax, dword [eax + 0x450]
mov dword [ebp - 8], eax
mov esi, edx
test esi, esi
jb 0xb78dd9
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00b77f68
test eax, eax
je 0xb78dd9
mov eax, ebx
call fcn.00b78de4
mov eax, dword [ebp - 8]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x448]
sub dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0xb78d79
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0xb78de4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0xb78e15
dec al
je 0xb78e50
dec al
je 0xb78e95
dec al
je 0xb78efe
jmp 0xb78f88
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0xb78f88
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0xb78e25
jmp 0xb78f88
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0xb78f88
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0xb78e60
jmp 0xb78f88
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0xb78f88
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0xb78ec4
xor ebp, ebp
jmp 0xb78ed4
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0xb78edd
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0xb78ea5
jmp 0xb78f88
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0xb78f88
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0xb78f57
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.00b767bc
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0xb78f12
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret