joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e9a4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x712f53
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41e9df
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41e9f8
lea eax, [ebp - 0x10]
mov edx, dword [0x72b248]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41ea0b
lea eax, [ebp - 0x10]
mov edx, dword [0x72b248]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41ea17
adc edx, 0
mov edx, dword [edx*4 + 0x72a0d8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406af4
mov esi, eax
cmp esi, 0xffffffff
je 0x41eb25
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41eb18
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406d9c
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41eb18
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41eb18
cmp dx, 0x150
ja 0x41eb18
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d3c
test eax, eax
je 0x41eb18
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41eb18
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406aac
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41eb3d
inc ebx
cmp ebx, 0x19
jne 0x41e9d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x712f5a
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x100257f
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor esi, esi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], esi
call dword [sym.imp.ulib.dll_public:_void___thiscall_DSTRING::constructor_void_]
or ebx, 0xffffffff
push ebx
push 0x100135c
lea ecx, [ebp - 0x1c]
call dword [sym.imp.ulib.dll_public:_unsigned_char___thiscall_WSTRING::Initialize_char_const___unsigned_long_int_]
test al, al
je 0x10026fb
call fcn.01001561
test al, al
je 0x10026fb
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, dword [0x1006028]
push eax
call dword [sym.imp.ulib.dll_public:_unsigned_char___thiscall_WSTRING::Initialize_unsigned_short_int_const___unsigned_long_int_]
test al, al
je 0x10026fb
mov dword [0x100602c], esi
push edi
mov eax, dword [0x1006028]
mov edi, dword [0x100602c]
push dword [ebp - 0x14]
mov esi, eax
mov eax, dword [eax + 8]
lea eax, [eax + edi*2]
push eax
call dword [sym.imp.msvcrt.dll_wcscspn]
add eax, edi
pop ecx
pop ecx
cmp eax, dword [esi + 0xc]
jb 0x1002609
mov eax, ebx
cmp eax, ebx
je 0x1002631
inc eax
push 0x1001358
mov dword [0x100602c], eax
call fcn.010019b9
test al, al
je 0x10025e1
push 0
push 0
push 0x5a0c
call fcn.01004488
jmp 0x10025e1
xor eax, eax
mov dword [0x1006030], eax
mov dword [0x100602c], eax
mov dword [0x100603c], eax
call fcn.01001855
push 0x1001354
call fcn.010019b9
call fcn.01001855
mov eax, dword [0x1006028]
mov ecx, dword [0x100602c]
pop edi
cmp ecx, dword [eax + 0xc]
jae 0x100268f
push 0x1001310
call fcn.010019b9
test al, al
je 0x100269d
call fcn.01001855
mov eax, dword [0x1006028]
mov ecx, dword [0x100602c]
cmp ecx, dword [eax + 0xc]
jae 0x100268f
call fcn.010018ad
push 0x10
push 1
push ebx
push 3
call fcn.0100192f
jmp 0x10026ef
push 0x100134c
call fcn.010019b9
test al, al
je 0x10026b2
call fcn.010023f9
jmp 0x10026ef
push 0x1001224
call fcn.010019b9
test al, al
je 0x10026c7
call fcn.010023a2
jmp 0x10026ef
push 0x1001344
call fcn.010019b9
test al, al
je 0x10026dc
call fcn.010024cb
jmp 0x10026ef
push 0x100124c
call fcn.010019b9
test al, al
je 0x10026f4
call fcn.01002244
mov dword [ebp - 4], eax
jmp 0x1002707
call fcn.010018ad
jmp 0x1002707
push ebx
push esi
push 0x5a31
call fcn.01004488
call fcn.010015bf
lea ecx, [ebp - 0x1c]
call dword [sym.imp.ulib.dll_public_virtual:_void___thiscall_DSTRING::destructor_void_]
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret
Function at 0x1004189
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [str.jr_n:]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.ulib.dll_public:_void___thiscall_DSTRING::constructor_void_]
lea ecx, [ebp - 0x434]
mov dword [ebp - 0x41c], eax
call edi
lea ecx, [ebp - 0x448]
call dword [sym.imp.ulib.dll_public:_void___thiscall_FSTRING::constructor_void_]
lea ecx, [ebp - 0x460]
call edi
lea eax, [ebx + 0x210]
xor ebx, ebx
mov dword [esi], 1
cmp eax, ebx
jne 0x1004219
mov esi, dword [sym.imp.ulib.dll_public_virtual:_void___thiscall_DSTRING::destructor_void_]
lea ecx, [ebp - 0x460]
call esi
lea ecx, [ebp - 0x448]
call dword [sym.imp.ulib.dll_public_virtual:_void___thiscall_OBJECT::destructor_void_]
lea ecx, [ebp - 0x434]
call esi
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100493a
leave
ret 0xc
mov eax, dword [eax + 8]
push 0x20a
lea ecx, [ebp - 0x418]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x1004259
mov esi, dword [sym.imp.ulib.dll_public_virtual:_void___thiscall_DSTRING::destructor_void_]
lea ecx, [ebp - 0x460]
call esi
lea ecx, [ebp - 0x448]
call dword [sym.imp.ulib.dll_public_virtual:_void___thiscall_OBJECT::destructor_void_]
lea ecx, [ebp - 0x434]
call esi
mov al, bl
jmp 0x1004208
push 0xffffffffffffffff
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x434]
mov dword [esi], ebx
call dword [sym.imp.ulib.dll_public:_unsigned_char___thiscall_WSTRING::Initialize_unsigned_short_int_const___unsigned_long_int_]
mov eax, dword [ebp - 0x41c]
add eax, 0x210
push eax
lea ecx, [ebp - 0x434]
call dword [sym.imp.ulib.dll_public:_unsigned_long_int___thiscall_WSTRING::Strstr_class_WSTRING_const__const]
cmp eax, 0xffffffff
setne bl
jmp 0x1004233
Function at 0x1004295
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [str.jr_n:]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.ulib.dll_public:_void___thiscall_DSTRING::constructor_void_]
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x434]
mov byte [ebp - 0x419], 0
call esi
lea ecx, [ebp - 0x448]
call dword [sym.imp.ulib.dll_public:_void___thiscall_FSTRING::constructor_void_]
lea ecx, [ebp - 0x460]
call esi
mov dword [edi], 1
test ebx, ebx
je 0x10043c5
add ebx, 0x210
je 0x10043c5
mov ebx, dword [ebx + 8]
push 0x20a
lea eax, [ebp - 0x418]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x1004347
xor bl, bl
mov esi, dword [sym.imp.ulib.dll_public_virtual:_void___thiscall_DSTRING::destructor_void_]
lea ecx, [ebp - 0x460]
call esi
lea ecx, [ebp - 0x448]
call dword [sym.imp.ulib.dll_public_virtual:_void___thiscall_OBJECT::destructor_void_]
lea ecx, [ebp - 0x434]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0100493a
leave
ret 8
and dword [edi], 0
push 0xffffffffffffffff
push 0x100146c
lea ecx, [ebp - 0x448]
lea esi, [ebp - 0x418]
call dword [sym.imp.ulib.dll_public:_class_WSTRING____thiscall_FSTRING::Initialize_unsigned_short_int___unsigned_long_int_]
cmp word [ebp - 0x418], 0
je 0x10043c5
push 0xffffffffffffffff
push esi
lea ecx, [ebp - 0x434]
call dword [sym.imp.ulib.dll_public:_unsigned_char___thiscall_WSTRING::Initialize_unsigned_short_int_const___unsigned_long_int_]
test al, al
je 0x10043c5
push dword [ebp - 0x42c]
call dword [sym.imp.msvcrt.dll__wcsupr]
cmp byte [ebp - 0x419], 0
pop ecx
jne 0x10043c5
lea eax, [ebp - 0x448]
push eax
lea ecx, [ebp - 0x434]
call dword [sym.imp.ulib.dll_public:_unsigned_long_int___thiscall_WSTRING::Strstr_class_WSTRING_const__const]
cmp eax, 0xffffffff
je 0x10043b5
mov byte [ebp - 0x419], 1
mov eax, dword [ebp - 0x428]
lea esi, [esi + eax*2 + 2]
cmp word [esi], 0
jne 0x100436d
mov bl, byte [ebp - 0x419]
jmp 0x1004312
Function at 0x4059d0
Capabilities:
Accept command line arguments
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x405a40
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x54
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x405a97
xor ecx, ecx
xor edx, edx
jmp 0x405a79
cmp ax, 0x5c
jne 0x405b00
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x405a97
cmp ax, 9
je 0x405a85
cmp ax, 0x20
jne 0x405a60
test ecx, ecx
je 0x405aeb
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x405a79
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x20], 1
je 0x405b20
movzx esi, word [ebp - 0x1c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00404340
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x405ae8
cmp ax, 0x20
je 0x405ae8
jmp 0x405a97
cmp ax, 0x22
jne 0x405a89
and edx, 1
jne 0x405a89
xor ecx, 1
jmp 0x405a6d
mov eax, 1
mov esi, 1
mov word [ebp - 0x1c], ax
jmp 0x405ab0
Function at 0x405a40
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x405a40
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x54
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x405a97
xor ecx, ecx
xor edx, edx
jmp 0x405a79
cmp ax, 0x5c
jne 0x405b00
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x405a97
cmp ax, 9
je 0x405a85
cmp ax, 0x20
jne 0x405a60
test ecx, ecx
je 0x405aeb
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x405a79
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x20], 1
je 0x405b20
movzx esi, word [ebp - 0x1c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00404340
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x405ae8
cmp ax, 0x20
je 0x405ae8
jmp 0x405a97
cmp ax, 0x22
jne 0x405a89
and edx, 1
jne 0x405a89
xor ecx, 1
jmp 0x405a6d
mov eax, 1
mov esi, 1
mov word [ebp - 0x1c], ax
jmp 0x405ab0
Function at 0x407260
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push esi
or esi, 0xffffffff
test eax, eax
je 0x407415
push ebx
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 8], ebx
je 0x407414
mov eax, dword [0x40b0d8]
push ebp
push 0x1000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x10], ebp
je 0x40740c
push edi
nop
push 0
lea ecx, [esp + 0x20]
push ecx
push 0x1000
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x1c]
cmp edx, 8
mov eax, ebp
mov edi, edx
jb 0x4073ce
mov ebp, edx
shr ebp, 3
lea ebx, [ebx]
movzx ebx, byte [eax]
xor ebx, esi
and ebx, 0xff
add eax, 1
mov ecx, esi
shr ecx, 8
xor ecx, dword [ebx*4 + 0x409100]
movzx ebx, byte [eax]
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x409100]
movzx ebx, byte [eax + 1]
xor ebx, ecx
and ebx, 0xff
add eax, 1
shr ecx, 8
xor ecx, dword [ebx*4 + 0x409100]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x409100]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x409100]
movzx ebx, byte [eax + 1]
xor ebx, ecx
add eax, 1
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x409100]
movzx ebx, byte [eax + 1]
add eax, 1
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x409100]
movzx ebx, byte [eax + 1]
add eax, 1
xor ebx, ecx
and ebx, 0xff
shr ecx, 8
xor ecx, dword [ebx*4 + 0x409100]
add eax, 1
sub edi, 8
sub ebp, 1
mov esi, ecx
jne 0x4072f0
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
test edi, edi
je 0x4073ef
movzx ecx, byte [eax]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x409100]
add eax, 1
sub edi, 1
jne 0x4073d2
cmp edx, 0x1000
je 0x4072c0
mov edx, dword [0x40b0d8]
push ebp
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
pop ebx
mov eax, esi
not eax
pop esi
add esp, 8
ret 4

Function at 0x407420
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x7f31350c
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x2b33577
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0xb83420
Capabilities:
Decompress data using aplib

Disassembly:
call 0xb83570
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xb83446
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb83432
add dl, dl
jne 0xb83451
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb834a4
xor eax, eax
add dl, dl
jne 0xb8345e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xb83545
add dl, dl
jne 0xb8346d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb83478
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb83483
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb8348e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xb8349a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xb8343d
mov eax, 1
add dl, dl
jne 0xb834b2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb834bd
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb834a9
sub eax, ebx
mov ebx, 1
jne 0xb834f0
mov ecx, 1
add dl, dl
jne 0xb834d6
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb834e1
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb834cd
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb8343d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xb83507
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb83512
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xb834fe
cmp eax, 0x7d00
jae 0xb83535
cmp eax, 0x500
jb 0xb83530
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb8343d
cmp eax, 0x7f
ja 0xb83538
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xb8343d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xb83566
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xb8343d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1000a45a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x1004837c]
add ebx, 0x237
mov dword [0x10048380], ebx
mov dword [0x10048384], 0
mov dword [0x10048388], 0
mov dword [0x10048390], 0
mov dword [0x1004837c], 0xfffff69c
cmp eax, 0
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
je 0x1000a5ed
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x28]
mov edi, 0x100
mov dword [0x1004837c], 0x2168
add ecx, 1
mov dword [ebp - 0x30], eax
mov eax, ecx
mov dword [ebp - 0x34], edx
cdq
idiv edi
mov dword [0x10048384], edx
mov ecx, dword [ebp - 0x24]
movzx ebx, byte [ecx + edx]
mov ecx, dword [ebp - 0x34]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv edi
mov dword [0x10048388], edx
add esi, 0x2bc
mov dword [0x1004837c], esi
mov ecx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x1004838c], cl
mov dword [0x1004837c], 0x142b
mov edi, dword [ebp - 0x24]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov dword [0x1004837c], 0x834
mov cl, byte [0x1004838c]
mov edx, dword [0x10048388]
mov byte [edi + edx], cl
mov dword [0x10048380], 0x1eba
mov edx, dword [0x10048384]
movzx edx, byte [edi + edx]
mov ebx, dword [0x10048388]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x10048390], ebx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
mov cl, byte [edx + ecx]
xor cl, byte [edi + ebx]
mov ebx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x30]
mov byte [ebx + edx], cl
mov ecx, dword [0x1004837c]
add ecx, 0x217a
mov dword [0x1004837c], ecx
add edx, 1
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
mov dword [ebp - 0x3c], edx
je 0x1000a5ed
mov eax, dword [0x10048380]
mov ecx, dword [0x10048388]
mov edx, dword [0x10048384]
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x2c], esi
jmp 0x1000a4d2
mov dword [0x1004837c], 0x442
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000a70c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov ecx, dword [0x1004837c]
add ecx, 0xffffef8e
mov dword [0x1004837c], ecx
mov dword [0x10048380], 0x4cf
mov dword [ebp - 0x10], eax
call fcn.1000aaf0
xor ecx, ecx
mov edx, eax
mov dword [0x10048380], 0x1570
mov esi, dword [eax + 0x3c]
mov dword [0x1004837c], 0x1161
mov esi, dword [eax + esi + 0x78]
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov ebx, dword [eax + esi + 0x24]
mov dword [0x1004837c], 0x1c17
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
je 0x1000a88c
jmp 0x1000a80a
xor eax, eax
mov ecx, dword [ebp - 0x2c]
add ecx, 2
mov edx, dword [ebp - 0x30]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x28], eax
jae 0x1000a88c
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + ecx*4]
mov dword [0x10048380], 0x4cf
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x40], edx
jmp 0x1000a822
mov eax, dword [ebp - 0x44]
add eax, 1
mov cl, byte [ebp - 0x45]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x46]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x40], eax
jne 0x1000a822
jmp 0x1000a84b
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
add eax, ecx
mov dword [ebp - 0x4c], eax
xor eax, eax
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
jmp 0x1000a7ba
mov eax, dword [ebp - 0x40]
mov ecx, eax
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bh
mov byte [ebp - 0x46], cl
jne 0x1000a7e0
mov al, byte [ebp - 0x46]
test al, 1
jne 0x1000a857
jmp 0x1000a792
mov eax, dword [ebp - 0x2c]
movzx ecx, word [eax]
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add eax, dword [eax + ecx + 0x1c]
mov edx, dword [ebp - 0x50]
mov eax, dword [eax + edx*4]
mov dword [0x10048380], 0xd9
mov esi, dword [ebp - 0x1c]
add esi, eax
mov dword [0x1004837c], 0xffffc4f8
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x28]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret