joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d680
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424d78]
jne 0x40d68a
repz ret
jmp fcn.0041045f

Function at 0x415979
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x424d78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00411d40
and dword [ebp - 0x14], 0
cmp dword [0x42707c], 0
mov dword [ebp - 0x18], eax
jne 0x415a2c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x415ad4
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41fb64
push ebx
call edi
test eax, eax
je 0x415ad4
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42707c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x427080], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x427084], eax
call edi
push eax
call esi
mov dword [0x42708c], eax
test eax, eax
je 0x415a2c
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x427088], eax
mov eax, dword [0x427088]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x415a85
cmp dword [0x42708c], ecx
je 0x415a85
push eax
call esi
push dword [0x42708c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x415a85
test ebx, ebx
je 0x415a85
call edi
test eax, eax
je 0x415a7c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x415a7c
test byte [ebp - 8], 1
jne 0x415a85
or dword [ebp + 0x10], 0x200000
jmp 0x415ab8
mov eax, dword [0x427080]
cmp eax, dword [ebp - 0x18]
je 0x415ab8
push eax
call esi
test eax, eax
je 0x415ab8
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x415ab8
mov eax, dword [0x427084]
cmp eax, dword [ebp - 0x18]
je 0x415ab8
push eax
call esi
test eax, eax
je 0x415ab8
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42707c]
call esi
test eax, eax
je 0x415ad4
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x415ad6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d680
leave
ret
Function at 0x402020
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x403428
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
mov dword [ebp - 0x1c], edx
mov dword [ebp - 8], eax
mov eax, 0x4cac68
call fcn.004bc570
mov dword [ebp - 0x24], 2
lea edx, [ebp - 8]
lea eax, [ebp - 8]
call fcn.004c8738
inc dword [ebp - 0x24]
inc dword [ebp - 0x24]
mov word [ebp - 0x30], 0xc
mov word [ebp - 0x30], 0x18
mov edx, 0x4ca8f3
lea eax, [ebp - 0xc]
xor ecx, ecx
call fcn.004c86f8
inc dword [ebp - 0x24]
inc dword [ebp - 0x24]
mov word [ebp - 0x30], 0xc
mov word [ebp - 0x30], 0x24
mov word [ebp - 0x30], 0x3c
xor edx, edx
mov dword [ebp - 0x10], edx
lea edx, [ebp - 8]
lea eax, [ebp - 0x10]
call fcn.004062f8
lea ecx, [ebp - 0x10]
inc dword [ebp - 0x24]
mov eax, dword [ecx]
call fcn.00403028
mov ebx, eax
dec dword [ebp - 0x24]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.004c8b4c
mov word [ebp - 0x30], 0x30
push ebx
call fcn.004b2914
pop ecx
mov esi, eax
mov word [ebp - 0x30], 0x48
xor eax, eax
mov dword [ebp - 0x14], eax
lea edx, [ebp - 8]
lea eax, [ebp - 0x14]
call fcn.004062f8
lea edx, [ebp - 0x14]
inc dword [ebp - 0x24]
mov eax, dword [edx]
mov ecx, ebx
mov edx, esi
call fcn.0040311c
dec dword [ebp - 0x24]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004c8b4c
mov word [ebp - 0x30], 0x54
xor ecx, ecx
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x18]
inc dword [ebp - 0x24]
mov edx, ebx
mov eax, esi
call fcn.004035b4
lea edx, [ebp - 0x18]
lea eax, [ebp - 0xc]
call fcn.004c887c
sub dword [ebp - 0x24], 2
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00401bec
push esi
call fcn.004a639c
pop ecx
mov word [ebp - 0x30], 0x24
mov word [ebp - 0x30], 0xc
jmp 0x40355a
mov word [ebp - 0x30], 0x6c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.004c887c
mov eax, dword [ebp - 0x1c]
mov edx, 2
mov word [ebp - 0x30], 0x78
push eax
lea eax, [ebp - 0xc]
sub dword [ebp - 0x24], 2
call fcn.00401bec
sub dword [ebp - 0x24], 2
lea eax, [ebp - 8]
mov edx, 2
call fcn.00401bec
pop eax
mov word [ebp - 0x30], 0x6c
add dword [ebp - 0x24], 2
mov edx, dword [ebp - 0x40]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42db6c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x42dc15
test eax, edx
je 0x42dc18
push 0
push 0
cmp word [eax - 0xa], 2
je 0x42db95
push edx
mov edx, eax
mov eax, esp
call fcn.00445d40
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x42dbab
push eax
lea eax, [esp + 8]
call fcn.00445d40
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x42dbba
movzx eax, word [eax]
sub eax, ecx
jmp 0x42dbe1
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x42dbfb
add ecx, 4
js 0x42dbd2
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x42dbf8
push eax
mov eax, ecx
mov edx, 2
call fcn.0044510c
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x42dbdf
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x42dbe1
xor eax, eax
ret
test eax, eax
je 0x42dc28
test edx, edx
jne 0x42db7c
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x435063
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00445440
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.004c8e86
mov edi, eax
cmp edi, 0x104
jbe 0x435086
mov eax, edi
add eax, eax
call fcn.004432d8
mov esi, eax
jmp 0x435088
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.004c8e86
push edi
push esi
call fcn.004c9292
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4350c1
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x4350ab
mov eax, esp
cmp esi, eax
je 0x4350ce
mov eax, esi
call fcn.004432f4
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x435108
cmp bl, 0
je 0x435104
cmp bl, 0x41
jl 0x4350ff
cmp bl, 0x5a
jg 0x4350ff
or bl, 0x20
xor al, bl
inc esi
jmp 0x4350e3
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x435048
Function at 0x466598
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x46659e
ret

Function at 0x4e4021
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xc862e58a
jmp 0x4e51ac
jmp 0x4e6790
pushfd
pop dword [esp + 0x38]
push 0x1015e1f
mov word [esp + 0xc], 0x520f
pushfd
push dword [esp + 0x40]
pop dword [ebp]
pushfd
mov byte [esp + 0x20], dh
lea esp, [esp + 0x48]
jmp 0x4e5c7c

Function at 0x4e42ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
pushfd
mov word [ebp], ax
mov word [esp], ax
lea esp, [esp + 0x40]
jmp 0x4e5c7c

Function at 0x4e43d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [esp + 0x34]
pop dword [ebp]
pushfd
mov dword [esp + 8], 0x2dbc2714
pushfd
lea esp, [esp + 0x40]
jmp 0x4e5c7c

Function at 0x4e4414
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.004e60c3
adc esi, 0x498d30d1
add byte [esi - 0x39], ah
mov word [esp + 4], 0xf11f

Function at 0x4e4508
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x4e4f23
mov dword [esp + 4], ecx
pushal
mov byte [esp + 4], 0xd5
mov dword [esp + 0x20], ecx
call fcn.004e4720
pushfd
pop dword [esp + 0x30]
push dword [esp + 0xc]
push edx
jmp 0x4e54ec
push dword [esp + 0x38]
pop dword [ebp]
pushfd
lea esp, [esp + 0x40]
jmp 0x4e5c7c

Function at 0x4e4570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
lea esp, [esp + 0x2c]
jne 0x4e6417
pushfd
stc
bswap bx
mov ebx, eax
test ah, 0x50
and ebx, 0xff0
call fcn.004e6106
rol cl, 1
xchg al, cl
adc cl, 0x7d
setb cl
mov al, byte [ebp]
call fcn.004e41e0
adc eax, 0xccccc388
int3

Function at 0x4e46af
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x10], ecx
pushfd
pop dword [esp + 0x2c]
jmp 0x4e49b7
jmp 0x4e53be
push dword [esp]
mov word [esp], 0x4d8a
push dword [esp + 0x30]
pop dword [ebp]
mov byte [esp], bh
pushfd
mov byte [esp + 4], bh
lea esp, [esp + 0x38]
jmp 0x4e5c7c

Function at 0x4e4846
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub ebp, 2
pushfd
mov byte [esp], bl
pushfd
mov word [ebp], ax
push dword [esp + 8]
lea esp, [esp + 0x38]
jmp 0x4e5c7c

Function at 0x4e4877
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [ebp + 6], ax
call fcn.004e4021
jmp 0x4e4fc8
mov word [ebp + 4], dx
pushal
pushfd
push ebp
jmp 0x4e43b4

Function at 0x4e4b9b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [esp + 0x54]
pop dword [ebp]
mov word [esp], dx
mov byte [esp], 0x66
lea esp, [esp + 0x58]
jmp 0x4e5c7c

Function at 0x4e4d16
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x2c], ebx
mov byte [esp + 4], 0x3c
mov dword [esp + 0x28], esi
pushfd
mov dword [esp + 0x28], eax
pushfd
jmp 0x4e5296
push 0x1a3ac3c4
call fcn.004e5f20

Function at 0x4e4e75
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushal
pushal
mov dword [ebp + 4], edx
call fcn.004e64d2
mov word [ebp + 4], ax
jmp 0x4e69d6
pushfd
pop dword [esp + 0x24]
push dword [esp + 4]
push dword [esp + 0x28]
pop dword [ebp]
push dword [esp]
pushfd
push 0xc9cd01b4
lea esp, [esp + 0x38]
jmp 0x4e5c7c
Function at 0x4e4f45
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [esp], dh
mov word [ebp + 4], ax
push 0x91708089
pushfd
pop dword [esp + 0x30]
call fcn.004e43d0
test ax, si
pushfd
not al
clc
pushal
mov word [esp + 0x14], si
mov dword [esp], esi
not dl
push ecx
sub ebp, 2
push dword [esp + 4]
and al, dl
jmp 0x4e480f

Function at 0x4e52a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pop dword [ebp]
pushal
push 0x3db09a5b
pushal
lea esp, [esp + 0x44]
jmp 0x4e5c7c
jmp 0x4e6937
jmp 0x4e4450
mov dword [ebp + 4], eax
push ebp
pushfd
pop dword [esp + 0x2c]
lea esp, [esp + 0x2c]
jb 0x4e5f95
push ebx
mov word [esp], sp
push dword [esp + 4]
pop dword [ebp]
pushal
mov word [esp], si
push 0x7e411fea
push ebx
lea esp, [esp + 0x30]
jmp 0x4e5c7c

Function at 0x4e591d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov byte [esp + 4], ah
jmp 0x4e4f36
mov word [esp], 0xbbf5
push edx
mov dword [ebp + 4], edx
pushfd
mov dword [ebp + 8], eax
jmp 0x4e40fe

Function at 0x4e593b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xefc739a6
pushal
mov word [ebp], ax
mov byte [esp], 0x6a
mov byte [esp + 4], dl
lea esp, [esp + 0x2c]
jmp 0x4e5c7c

Function at 0x4e60c3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.004e4ed1
movzx dx, dl
jmp 0x4e6497
rol dx, cl
btc dx, 2
rol al, 1
shl dx, 9
sub bl, al
bts dx, 0xe
inc dh
push ebx
mov edx, dword [eax + edi]
cmc
cmc
sub ebp, 4
mov byte [esp], 0x8b
pushfd
pushal
mov dword [ebp], edx
mov byte [esp], bh
pushfd
push 0xab039359
lea esp, [esp + 0x30]
jmp 0x4e5c7c

Function at 0x4e6685
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub bx, ax
push dword [esp]
cmc
cmp cl, 0x7b
sub ebp, 2
lea esp, [esp + 0x34]
jns 0x4e4a61
push esp
mov byte [esp], 0x46
pushfd
mov word [ebp], ax
pushfd
pushal
mov word [esp], 0xce22
lea esp, [esp + 0x2c]
jmp 0x4e5c7c
sub esi, 2
jmp 0x4e5e1b

Function at 0x4e6765
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x24], esi
jmp 0x4e599b
pushfd
push 0x6f6a7405
pushal
pushfd
mov dword [esp + 0x28], ebx
mov byte [esp], 0x4e
jmp 0x4e5050
mov byte [esp], al
lea esp, [esp + 0x44]
jne 0x4e6639
pushfd
mov dword [esp], ebx
pushal
pushal
mov dword [esp + 0x3c], esi
mov word [esp], 0x1495
push 0x33f49a09
mov dword [esp + 0x3c], eax
call fcn.004e4d03

Function at 0x4e686d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [esp + 0x28], ecx
jmp 0x4e6a3f
jmp 0x4e6377
Function at 0x50a28b
Capabilities:
Execute anti-debugging instructions

Disassembly:
inc ebx
cmc
bt esi, esp
cmc
clc
add eax, ecx
cmp esi, 0x90e44974
cmp ebx, eax
pushal
mov word [esp], dx
mov dword [ebp - 4], ebx
jmp 0x508a42

Function at 0x5124a7
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg si, dx
mov edi, dword [esp + 4]
rdtsc
rdtsc
mov esi, dword [esp + 8]
lahf
mov ebx, dword [esp + 0xc]
cwde
mov ecx, dword [ebp + 0x14]
lahf
mov edx, dword [ebp + 0x10]
mov al, dh
lea eax, [ecx*4 - 0x479f72e7]
pop eax
pushfd
mov eax, dword [ebp + 0xc]
jmp 0xde9674
call fcn.00dc1f5a
mov byte [esp + 0xc], 0x36
push ecx
mov dword [esp + 0x10], ecx
jmp 0xdcc97d

Function at 0x5255dc
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
pushfd
mov ebx, dword [esp + 4]
rdtsc
mov edx, dword [ebp + 0x14]
xchg ecx, eax
pushal
bswap cx
mov eax, dword [ebp + 0x10]
jmp 0xdcb5c8
push edx
lea esp, [esp + 0x10]
jl 0x50977f
mov edi, 0x9f46d9f9
pop edi
cwde
movsx esi, cl
pop esi
jmp 0x51a0ce
call fcn.0050fba9

Function at 0xdc8b03
Capabilities:
Check http status code

Disassembly:
pushfd
pushal
test ecx, ecx
mov byte [esp + 0x10], 0x6f
pushfd
lea esp, [esp + 0x2c]
jne 0xde6f2e
pushfd
push dword [esp]
lea esp, [esp + 8]
call fcn.0050dfa1
cwde
btr cx, 1
mov eax, dword [0x4fb8f0]
rcl ch, 6
clc
rcl cl, cl
push esp
rol eax, 0x11
bswap cx
bsr cx, bx
sbb cx, dx
not eax
btc cx, 5
movzx cx, dl
bswap ecx
pushfd
rol eax, 0x11
shld ecx, esp, 0xe
bsf cx, si
not eax
bsf ecx, ebp
not cl
shrd ecx, ebp, cl
add cl, dh
mov ecx, eax
bt edi, ebx
shr eax, 8
pushal
cmc
cmp byte [ecx], al
pushal
push dword [esp]
push ebp
pushfd
lea esp, [esp + 0x50]
je 0xdc0895
pushfd
pushal
lea esp, [esp + 0x24]
jmp 0xde1acb

Function at 0xdcfcf2
Capabilities:
Check http status code

Disassembly:
test eax, eax
pushfd
pushfd
lea esp, [esp + 8]
jne 0xdeaa78
movzx bx, cl
mov bl, cl
push eax
bswap bx
bswap bx
push esi
mov ebx, eax
push 0xc8eee456
and ebx, 0x3ff
lea esp, [esp + 8]
jp 0xdd0762
pushal
push 0xb6c95409
push dword [esp]
mov dword [esp + 0x24], esi
push dword [esp + 8]
push dword [esp]
lea esp, [esp + 0x2c]
call fcn.004e9730
stc
test ah, 0x73
jmp 0xdcbd24

Function at 0xde0345
Capabilities:
Encode data using xor

Disassembly:
lahf
push 0xfc7dddbd
push dword [esp]
mov eax, dword [esi + 8]
bswap edi
mov edi, dword [esp + 8]
pop ebp
push 0x2350d57e
mov ebp, dword [esp + 0xc]
mov byte [esp + 8], ah
push dword [esp + 0x10]
ret 0x18
bt si, bp
pushal
push ecx
stc
cmp dword [ecx + 4], eax
mov dword [esp + 0x10], ebp
lea esp, [esp + 0x24]
jbe 0x4ee678
rcr edx, 3
movsx dx, cl
ror cl, 7
lea esp, [esp]
bts dx, dx
bt cx, cx
mov cl, al
bts dx, 0xe
mov edx, ebx
pushfd
push dword [esp]
stc
rol edx, cl
bsr cx, bp
mov ecx, dword [esi + 8]
bt ebp, edx
push 0xedac516b
add dl, al
cmc
call fcn.00df5157
fsub st(0)
xor al, byte [ebx]
mov edx, 0x87b56ee7
cmp dword [edx - 0x35a13b48], 0x65
test dword [edi], ebx
invalid
call fcn.00db5f0c
pushal
call fcn.00def92e
pushal
call fcn.00df5aac
bt cx, di
xor eax, eax
bt sp, ax
add esp, 0xc
jno 0x50e736
pushal
cmp esp, 0x34180605
cmp dword [ecx + 4], eax
jmp 0xdb4c13
Function at 0xde32e1
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x54]
jb 0x51577f

Function at 0xde33e1
Capabilities:
Check http status code

Disassembly:
jmp 0xde6f0c
push 0xe1c505d6
lea esp, [esp + 8]
jne 0xde6f2e
pushal
lea esp, [esp + 0x20]
call fcn.00506fbc
xchg ch, al
bswap eax
mov eax, dword [0x4fb8f0]

Function at 0xde39a4
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx ax, bl
mov dword [esp + 0x1c], ecx
lea esp, [esp + 0x1c]
jbe 0x51e235
push 0xeeb9dc4d
mov ecx, dword [esi + 0x30]
setne dl
rdtsc
xchg dl, al
bswap ax
mov eax, dword [ecx]
bswap dx
mov edx, dword [eax + 4]
push ecx
mov dword [esp + 4], ebx
lea esp, [esp + 4]
jbe 0xdb4e00
push eax
pushfd
pushal
mov dword [esp + 0x24], 0x50ae4f
mov byte [esp], 0xa
pushfd
pushfd
jmp 0xdf10ee
not ah
lea ecx, [ecx + 0x7b0abd87]
je 0xdc50f2
mov ecx, dword [esi + 0x30]
bswap ax
mov eax, dword [ecx]
push 0x1b016493
call fcn.00dea624
push esp
mov byte [esp], 5
pushal
mov dword [esp + 0x20], 0x50ae4f
mov dword [esp + 4], ebx
mov word [esp + 0x1c], cx
mov dword [esp + 0x1c], edx
push ebp
pushfd
pushfd
mov word [esp], 0x7bc5
push dword [esp + 0x28]
ret 0x2c
not cl
movsx eax, al
mov ecx, dword [esi + 0x30]
cwde
lahf
jmp fcn.00dcc845
call fcn.00de5b0c
xchg dx, ax
mov eax, edi
movzx ax, cl
rdtsc
push ebp
pushal
cdq
rdtsc
movsx eax, al
lea ebp, [esp + 0x20]
jmp 0x4ecced
mov dword [esp + 0x28], edx
mov dword [esp], esi
push dword [esp + 4]
push 0x235d2104
push dword [esp + 0x30]
ret 0x34

Function at 0xe197ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, eax
jmp 0xe1962e
cld
cld
call fcn.00e19240
pop dword [ebp]
pushal
push 0x3db09a5b
pushal
lea esp, [esp + 0x44]
jmp 0xe1934c
push 0x1fe1c354
xchg dword [esp + 0xc], edi
pushfd
mov dword [esp], 0x29a311d6
lea edi, [edi - 0x4796c192]
jmp 0xe17ebd
Function at 0x47eff0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x47eff6
ret
Function at 0x53ede4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x53ee3d
test eax, edx
je 0x53ee40
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x53edfb
movzx eax, word [eax]
sub eax, ecx
jmp 0x53ee22
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x53ee23
add ecx, 4
js 0x53ee13
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x53ee20
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x53ee22
xor eax, eax
ret
test eax, eax
je 0x53ee4c
test edx, edx
jne 0x53edec
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x58b924
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x60f4ec
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x58b946
shr eax, 1
xor eax, 0xedb88320
jmp 0x58b948
shr eax, 1
dec edx
jne 0x58b934
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x58b92d
mov byte [0x60f8ec], 1
pop esi
pop ebx
ret

Function at 0x58b964
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x60f8ec], 0
jne 0x58b97b
call fcn.0058b924
mov eax, edi
dec eax
test eax, eax
jl 0x58b9a3
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x60f4ec]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x58b985
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x58e730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add byte [ecx], al
add byte fs:[eax + eax + 0x49], ah
add byte [ebx], ah
outsd dx, dword [esi]
add byte [esi], ch
add byte [eax], al
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.default.0x58e75c
jmp dword [ecx*4 + 0x58dd63]
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 8], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x10], edx
mov esi, ecx
test esi, esi
jb 0x58e913
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0058d8dc
test eax, eax
je 0x58e913
mov eax, ebx
call fcn.0058e91c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call dword [ebp - 0x18]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0xc], eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 8], eax
dec esi
jne 0x58e8ac
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x58e91c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x58e94d
dec al
je 0x58e988
dec al
je 0x58e9cd
dec al
je 0x58ea36
jmp 0x58eac0
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x58eac0
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x58e95d
jmp 0x58eac0
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x58eac0
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x58e998
jmp 0x58eac0
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x58eac0
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x58e9fc
xor ebp, ebp
jmp 0x58ea0c
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x58ea15
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x58e9dd
jmp 0x58eac0
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x58eac0
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x58ea8f
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0058b9ac
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x58ea4a
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret