joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x50e518c7
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x23d41897
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x403a80
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x403ae1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x403ac4
cmp edi, 2
jb 0x403ac4
cmp byte [esi], cl
jne 0x403ac4
cmp byte [esi + 1], cl
jne 0x403ac4
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4325f0]
jmp 0x403a95
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x4325f0]
test edi, edi
jne 0x403a95
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x403b10
cmp cl, 0x23
jne 0x403af7
cmp byte [esi], cl
jne 0x403af7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x4325f0]
test cl, cl
jne 0x403ae8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x403c20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x403c34
mov dword [ebx], 0
mov edx, 0x4323d0
call fcn.00403b20
mov esi, eax
test esi, esi
je 0x403d22
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x403d18
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x403d18
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x403d18
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x403d18
mov eax, dword [0x43964c]
test eax, eax
je 0x403cac
inc dword [eax + 0x36c]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x403d18
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x403cfd
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x43964c]
add esp, 4
test eax, eax
je 0x403cea
dec dword [eax + 0x36c]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x403d0f
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405380
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x439040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xc4]
lea edx, [ebp - 8]
push ebx
mov ebx, dword [ecx + 0xcc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
mov dword [ebp - 8], edi
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x4325f0]
sub esi, 1
jne 0x4053b3
mov eax, dword [0x43964c]
not ebx
cmp dword [eax + 0x1be0], ebx
jne 0x4053e2
mov dword [eax + 0x1be4], ebx
cmp dword [eax + 0x1c1c], ebx
jne 0x4053f1
mov byte [eax + 0x1c20], 1
cmp dword [eax + 0x1bc8], ebx
jne 0x40540a
push ecx
push edi
mov edx, 4
mov ecx, ebx
call fcn.00414d40
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004300a0
mov esp, ebp
pop ebp
ret 4
Function at 0x409a20
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x409a5d
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x409a43
cmp byte [esi], bl
jne 0x409a43
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x4325f0]
test bl, bl
jne 0x409a34
pop edi
pop esi
not ecx
pop ebx
jmp fcn.004099c0
Function at 0x413e30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x2fa8], 0
lea esi, [edi + 0x2fac]
je 0x413eb2
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x413e6c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00415970
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.00404030
mov edx, dword [esi]
mov ecx, 0x439648
push dword [edi + 0x2fa8]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x2fb4]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.00404030
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41de90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x41deca
mov eax, dword [0x43964c]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x41debd
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x41defb
mov eax, dword [0x43964c]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x41deee
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x41df2c
mov eax, dword [0x43964c]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x41df1f
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x41df79
mov eax, dword [0x43964c]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x41df6c
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x41dfaa
mov eax, dword [0x43964c]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x41df9d
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x41dfdb
mov eax, dword [0x43964c]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x41dfce
dec dword [eax + 0x36c]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.00420720
Function at 0x430ba6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x430be5
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x430be5
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x430be5
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x430be5
cmp dword [ecx + 0x74], 0xe
jbe 0x430be5
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401fe0
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [0x410e80]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push 0
push 0x3e9
push eax
call esi
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call edi
mov ecx, dword [0x410e80]
push 0
push 0x3ea
push ecx
call esi
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call ebx
lea edx, [esp + 0x10]
mov dword [0x410ffc], 0
push edx
push 0
push 0
push 0x401e50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
call fcn.00401000
push 1
call fcn.00402560
add esp, 4
mov dword [0x410ffc], 1
push 0xa
call ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x410e80]
push 1
push 0x3e9
push eax
call esi
push eax
call edi
mov ecx, dword [0x410e80]
push 1
push 0x3ea
push ecx
call esi
push eax
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
Function at 0x403490
Capabilities:
Get common file path

Disassembly:
sub esp, 0x1d8
mov dl, byte [0x415688]
push ebx
push ebp
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xe1]
mov byte [esp + 0xe0], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x31
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xe0]
mov ebx, 1
push eax
push 0x104
mov byte [esp + 0x17], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov ecx, dword [esp + 0x1e8]
push 0
push 2
push 0
push ecx
call dword [sym.imp.SETUPAPI.dll_SetupOpenInfFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x403511
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1d8
ret
mov al, byte [0x413818]
push esi
test al, al
je 0x403631
mov dword [esp + 0x18], 0x413818
mov edi, dword [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0xc8
and ecx, 3
lea edx, [esp + 0x28]
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x28]
push ecx
push edx
push ebp
call dword [sym.imp.SETUPAPI.dll_SetupDiGetActualSectionToInstallA]
call dword [sym.imp.SETUPAPI.dll_SetupOpenFileQueue]
mov esi, eax
test esi, esi
je 0x403626
cmp esi, 0xffffffff
je 0x403626
mov eax, dword [0x410e80]
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.SETUPAPI.dll_SetupInitDefaultQueueCallbackEx]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
je 0x403610
lea ecx, [esp + 0xe4]
push 4
lea edx, [esp + 0x20]
push ecx
push edx
push esi
push 0
push ebp
call dword [sym.imp.SETUPAPI.dll_SetupInstallFilesFromInfSectionA]
test eax, eax
je 0x4035d8
mov eax, dword [0x410e80]
push edi
push 0x403660
push esi
push eax
call dword [sym.imp.SETUPAPI.dll_SetupCommitFileQueueA]
test eax, eax
je 0x403622
mov ebx, 1
jmp 0x4035da
xor ebx, ebx
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, eax
mov al, byte [esp + 0x13]
inc dl
add al, dl
mov byte [esp + 0x13], al
movsx eax, al
mov cl, byte [eax + 0x413818]
lea eax, [eax + 0x413818]
test cl, cl
mov dword [esp + 0x18], eax
jne 0x403527
jmp 0x403635
push esi
xor ebx, ebx
call dword [sym.imp.SETUPAPI.dll_SetupCloseFileQueue]
push ebp
call dword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
jmp 0x403639
xor ebx, ebx
jmp 0x403639
push ebp
xor ebx, ebx
call dword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
jmp 0x403635
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x14]
push edi
call dword [sym.imp.SETUPAPI.dll_SetupTermDefaultQueueCallback]
push esi
call dword [sym.imp.SETUPAPI.dll_SetupCloseFileQueue]
push ebp
call dword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
pop esi
pop edi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x1d8
ret
Function at 0x403940
Capabilities:
Delete file

Disassembly:
sub esp, 0x848
mov dl, byte [0x415688]
push ebx
push ebp
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], dl
mov ebx, dword [esp + 0x85c]
mov ebp, dword [esp + 0x858]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 2
push ebx
push ebp
stosb byte es:[edi], al
call dword [sym.imp.SETUPAPI.dll_SetupDiBuildDriverInfoList]
test eax, eax
je 0x403b11
push esi
mov ecx, 0xc7
xor eax, eax
lea edi, [esp + 0x21c]
xor esi, esi
push eax
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x220], 0x31c
mov dword [esp + 0x224], 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.00403b30
cmp al, 1
jne 0x4039ef
lea eax, [esp + 0x21c]
mov dword [esp + 0x21c], 0x30c
push eax
jmp 0x403a02
lea ecx, [esp + 0x21c]
mov dword [esp + 0x21c], 0x31c
push ecx
push esi
push 2
push ebx
push ebp
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDriverInfoA]
test eax, eax
je 0x403b10
push 0
lea edx, [esp + 0x53c]
push 0x31d
lea eax, [esp + 0x224]
push edx
push eax
push ebx
push ebp
mov dword [esp + 0x550], 0x31d
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDriverInfoDetailA]
lea edi, [esp + 0x650]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
lea esi, [esp + 0x14]
sub ecx, 3
lea edi, [esp + 0x118]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x118]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40e17c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x118]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call esi
lea ecx, [esp + 0x14]
push ecx
call esi
mov eax, dword [esp + 0x10]
mov ecx, 0xc7
inc eax
lea edi, [esp + 0x21c]
mov dword [esp + 0x10], eax
xor eax, eax
mov esi, dword [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x21c], 0x31c
mov dword [esp + 0x220], 2
jmp 0x4039d1
pop esi
push 2
push ebx
push ebp
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDriverInfoList]
pop edi
pop ebp
pop ebx
add esp, 0x848
ret
Function at 0x403b30
Capabilities:
Get common file path

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetVersion]
push 0x104
push 0x410e84
mov dword [0x41508c], eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [0x41508c]
mov edx, ecx
and edx, 0xff
cmp edx, 4
jb 0x403b72
test eax, eax
je 0x403b72
and ecx, 0x80000000
neg ecx
sbb cl, cl
add ecx, 2
mov al, cl
ret
mov eax, dword [0x410e80]
push 0x10
push str.Initialize
push str.Windows_version_or_directory_error
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [0x410e80]
push 0x81
push ecx
call dword [sym.imp.USER32.dll_EndDialog]
or al, 0xff
ret
Function at 0x1003eee0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
sub esp, 0x4c
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x44], ecx
add eax, 0x1b
mov dword [esp + 0x48], eax
mov eax, dword [0x10067310]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
add eax, 0x5685fba8
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
mov eax, dword [eax]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
cmp eax, 1
sete al
mov byte [esp + 0x33], al
mov cl, byte [esp + 0x33]
xor eax, eax
test cl, 1
mov dword [esp + 0x2c], eax
jne 0x1003efc4
jmp 0x1003ef42
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x48]
mov dword [esp + 0x28], eax
mov bh, byte [edx + eax]
mov esi, 0x1b
xor edx, edx
div esi
mov eax, dword [esp + 0x28]
mov bl, byte [ecx + edx]
mov dl, bh
xor dl, 0xff
and dl, 0xd9
mov cl, 0xff
xor cl, 0xd9
and bh, cl
mov dh, bl
xor dh, 0xff
and dh, 0xd9
and bl, cl
mov ecx, dword [esp + 0x44]
or dl, bh
or dh, bl
xor dl, dh
mov byte [ecx + eax], dl
xor ecx, ecx
sub ecx, 1
sub eax, ecx
cmp eax, 5
mov dword [esp + 0x2c], eax
jne 0x1003ef42
mov eax, dword [0x10067310]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
add eax, 0x5685fba8
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [eax], 1
jmp 0x1003efc4
mov eax, dword [0x10068cf8]
mov dword [esp + 0x18], eax
mov eax, dword [0x10068cf4]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
add eax, 0x61355437
sub eax, 1
sub eax, 0x61355437
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
imul eax, ecx
and eax, 1
cmp eax, 0
sete al
mov byte [esp + 0x13], al
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x1c]
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
mov byte [esp + 0x11], dl
xor al, cl
mov byte [esp + 0x12], al
mov cl, byte [esp + 0x12]
mov al, byte [esp + 0x11]
or al, cl
mov byte [esp + 0x10], al
mov al, byte [esp + 0x10]
test al, 1
jne 0x1003f03e
jmp 0x1003f109
mov eax, dword [0x10068cf8]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [0x10068cf4]
mov edx, eax
sub edx, 0x7294e557
sub edx, 1
add edx, 0x7294e557
imul eax, edx
and eax, 1
cmp eax, 0
sete ah
cmp ecx, 0xa
setl al
mov ch, ah
xor ch, 0xff
mov byte [esp + 5], ch
mov dl, al
xor dl, 0xff
mov byte [esp + 6], dl
mov cl, 1
xor cl, 0
mov byte [esp + 7], cl
and ch, 0
mov byte [esp + 8], ch
and ah, cl
mov byte [esp + 9], ah
and dl, 0
mov byte [esp + 0xa], dl
and al, cl
mov byte [esp + 0xb], al
mov cl, byte [esp + 9]
mov al, byte [esp + 8]
or al, cl
mov byte [esp + 4], al
mov cl, byte [esp + 7]
mov dl, byte [esp + 6]
mov al, byte [esp + 5]
mov ah, byte [esp + 4]
mov dh, byte [esp + 0xb]
mov ch, byte [esp + 0xa]
or ch, dh
xor ah, ch
mov byte [esp + 2], ah
or al, dl
xor al, 0xff
or cl, 0
and al, cl
mov byte [esp + 3], al
mov cl, byte [esp + 3]
mov al, byte [esp + 2]
or al, cl
mov byte [esp + 1], al
mov al, byte [esp + 1]
test al, 1
jne 0x1003f103
jmp 0x1003f109
add esp, 0x4c
pop esi
pop ebx
ret
jmp 0x1003f03e
Function at 0x10044d10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [esp + 0x44]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
add eax, 0x17
mov dword [esp + 0x2c], eax
mov eax, dword [0x10067344]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
add eax, 0x33653273
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
cmp eax, 1
sete al
mov byte [esp + 0x17], al
mov cl, byte [esp + 0x17]
xor eax, eax
test cl, 1
mov dword [esp + 0x10], eax
jne 0x10044df4
jmp 0x10044d73
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov dl, byte [edx + eax]
mov byte [esp + 0xf], dl
mov edi, 0x17
xor edx, edx
div edi
mov eax, dword [esp + 8]
mov edi, edx
mov dh, byte [esp + 0xf]
mov bl, byte [esi + edi]
mov bh, dh
xor bh, 0xff
mov dl, bl
and dl, bh
xor bl, 0xff
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
sub eax, 0x70e4660
add eax, 1
add eax, 0x70e4660
cmp eax, 6
mov dword [esp + 0x10], eax
jne 0x10044d73
mov eax, dword [0x10067344]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x33653273
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
jmp 0x10044df4
add esp, 0x30
pop esi
pop edi
pop ebx
ret
Function at 0x10047f40
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x4c
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x44], ecx
add eax, 0x11
mov dword [esp + 0x48], eax
mov eax, dword [0x10067364]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
add eax, 0x418212b9
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
mov eax, dword [eax]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
cmp eax, 1
sete al
mov byte [esp + 0x33], al
mov cl, byte [esp + 0x33]
xor eax, eax
test cl, 1
mov dword [esp + 0x2c], eax
jne 0x10048024
jmp 0x10047fa2
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x48]
mov dword [esp + 0x28], eax
mov bh, byte [edx + eax]
mov esi, 0x11
xor edx, edx
div esi
mov eax, dword [esp + 0x28]
mov bl, byte [ecx + edx]
mov dl, bh
xor dl, 0xff
and dl, 0x9f
mov cl, 0xff
xor cl, 0x9f
and bh, cl
mov dh, bl
xor dh, 0xff
and dh, 0x9f
and bl, cl
mov ecx, dword [esp + 0x44]
or dl, bh
or dh, bl
xor dl, dh
mov byte [ecx + eax], dl
xor ecx, ecx
sub ecx, 1
sub eax, ecx
cmp eax, 0x15
mov dword [esp + 0x2c], eax
jne 0x10047fa2
mov eax, dword [0x10067364]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
add eax, 0x418212b9
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [eax], 1
jmp 0x10048024
mov eax, dword [0x10068c58]
mov dword [esp + 0x18], eax
mov eax, dword [0x10068c54]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
sub eax, 0x791c8d6d
sub eax, 1
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
add ecx, 0x791c8d6d
imul eax, ecx
and eax, 1
cmp eax, 0
sete al
mov byte [esp + 0x13], al
mov eax, dword [esp + 0x1c]
cmp eax, 0xa
setl al
mov byte [esp + 0x12], al
mov cl, byte [esp + 0x12]
mov al, byte [esp + 0x13]
mov dl, al
and dl, cl
mov byte [esp + 0x10], dl
xor al, cl
mov byte [esp + 0x11], al
mov cl, byte [esp + 0x11]
mov al, byte [esp + 0x10]
or al, cl
test al, 1
jne 0x1004809f
jmp 0x10048161
mov eax, dword [0x10068c58]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [0x10068c54]
mov edx, eax
sub edx, 0xff0299b7
sub edx, 1
add edx, 0xff0299b7
imul eax, edx
and eax, 1
cmp eax, 0
sete al
mov byte [esp + 9], al
cmp ecx, 0xa
setl cl
mov byte [esp + 0xa], cl
xor al, 0xff
mov byte [esp + 0xb], al
mov cl, byte [esp + 0xa]
mov ah, byte [esp + 9]
mov dl, byte [esp + 0xb]
mov al, cl
xor al, 0xff
mov byte [esp + 5], al
mov ch, 1
xor ch, 1
mov byte [esp + 6], ch
and dl, 0xff
and ah, ch
and al, 0xff
and cl, ch
or dl, ah
mov byte [esp + 7], dl
or al, cl
mov byte [esp + 8], al
mov cl, byte [esp + 5]
mov al, byte [esp + 0xb]
mov ah, byte [esp + 8]
mov dl, byte [esp + 7]
xor dl, ah
mov byte [esp + 3], dl
or al, cl
mov byte [esp + 4], al
mov cl, byte [esp + 6]
mov al, byte [esp + 4]
xor al, 0xff
or cl, 1
and al, cl
mov byte [esp + 2], al
mov cl, byte [esp + 2]
mov al, byte [esp + 3]
or al, cl
test al, 1
jne 0x1004815b
jmp 0x10048161
add esp, 0x4c
pop esi
pop ebx
ret
jmp 0x1004809f
Function at 0x1004fa50
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
add eax, 0x10
mov dword [esp + 0x24], eax
mov eax, dword [0x10067390]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
add eax, 0xaecd1714
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, 1
sete al
mov byte [esp + 0xf], al
mov cl, byte [esp + 0xf]
xor eax, eax
test cl, 1
mov dword [esp + 8], eax
jne 0x1004fb20
jmp 0x1004fab3
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
mov dh, byte [edx + eax]
mov edi, eax
and edi, 0xf
mov bl, byte [esi + edi]
mov bh, dh
xor bh, 0xff
mov dl, bl
and dl, bh
xor bl, 0xff
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
cmp eax, 3
mov dword [esp + 8], eax
jne 0x1004fab3
mov eax, dword [0x10067390]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0xaecd1714
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
jmp 0x1004fb20
add esp, 0x28
pop esi
pop edi
pop ebx
ret