joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e1b0
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10020838
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1002c018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
xor edx, edx
mov ecx, 0x49
xor eax, eax
lea esp, [esp]
mov bl, byte [eax + 0x100276bc]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x20], bl
jns 0x1001e20d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x1001e1f0
mov byte [ebp - 0x14], dl
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], edx
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov ebx, dword [ebx]
mov ebx, dword [ebx]
mov ebx, dword [ebx + 0x10]
mov dword [ebp - 0x2c], ebx
mov edx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x20]
push ecx
push edx
call fcn.1001df70
add esp, 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x30]
call dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x1001e261
xor eax, eax
jmp 0x1001e298
push esi
push eax
call fcn.1001df70
add esp, 8
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1001e25d
test edi, edi
jle 0x1001e28f
lea eax, [ebp + 0xc]
mov ecx, edi
jmp 0x1001e280
mov edx, dword [eax + 4]
add eax, 4
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
dec ecx
jne 0x1001e280
call dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001e745
mov esp, ebp
pop ebp
ret

Function at 0x1001e745
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002c018]
jne 0x1001e74f
repz ret
jmp fcn.1001ec0d
Function at 0xaf4050
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov ebp, dword [esp + 0x2c]
test ebp, ebp
je 0xaf4206
mov ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
movzx edi, cx
shr ecx, 0x10
test ebx, ebx
je 0xaf41ff
mov edx, 0x5e6ea9af
mov eax, ebx
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov esi, ebx
sub esi, eax
jmp 0xaf40e3
add ebp, dword [esp + 0xc]
mov esi, dword [esp + 4]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
mov ebx, dword [esp + 0x10]
sub ebx, esi
mov esi, 0x15b0
je 0xaf41ff
xor edx, edx
cmp esi, 8
mov dword [esp + 4], esi
jb 0xaf4164
and esi, 0x1ff8
mov dword [esp], esi
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
mov eax, edx
movzx edx, byte [ebp + edx]
add edx, edi
add ecx, edx
movzx esi, byte [ebp + eax + 1]
mov edi, edx
and edi, esi
xor edx, esi
lea edx, [edx + edi*2]
add ecx, edx
movzx esi, byte [ebp + eax + 2]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 3]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 4]
add esi, edx
add ecx, esi
movzx edx, byte [ebp + eax + 5]
add edx, esi
add ecx, edx
movzx esi, byte [ebp + eax + 6]
add esi, edx
add ecx, esi
movzx edi, byte [ebp + eax + 7]
add edi, esi
mov esi, dword [esp + 4]
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, esi
jb 0xaf4100
add ebp, edx
mov edx, dword [esp]
mov eax, esi
sub eax, edx
mov dword [esp + 0x10], ebx
jbe 0xaf40a8
mov dword [esp], edx
not edx
add edx, esi
mov dword [esp + 8], edx
and esi, 3
mov dword [esp + 0xc], eax
je 0xaf41b3
neg esi
xor edx, edx
mov ebx, ebp
nop
nop
nop
nop
movzx eax, byte [ebx]
inc ebx
add edi, eax
add ecx, edi
dec edx
cmp esi, edx
jne 0xaf4190
mov eax, dword [esp]
sub eax, edx
mov edx, eax
mov eax, dword [esp + 8]
cmp eax, 3
jb 0xaf40a0
jmp 0xaf41c5
mov ebx, ebp
mov eax, dword [esp + 8]
mov edx, dword [esp]
cmp eax, 3
jb 0xaf40a0
mov eax, dword [esp + 4]
sub eax, edx
xor edx, edx
nop
nop
nop
movzx esi, byte [ebx + edx]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebx + edx + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebx + edx + 3]
add edi, esi
add ecx, edi
add edx, 4
cmp eax, edx
jne 0xaf41d0
jmp 0xaf40a0
shl ecx, 0x10
or ecx, edi
jmp 0xaf420b
mov ecx, 1
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0xaf4220
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0xaf427c
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test edx, edx
je 0xaf427e
not eax
xor esi, esi
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0xcbea18]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
mov edi, dword [edi*4 + 0xcbea18]
mov ebx, eax
and ebx, edi
add eax, edi
add ebx, ebx
sub eax, ebx
inc esi
cmp edx, esi
jne 0xaf4240
not eax
jmp 0xaf427e
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0xaf9ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx ecx, word [edi]
test cx, cx
je 0xaf9dca
lea eax, [edi + 2]
xor ebx, ebx
jmp 0xaf9cdd
add ebx, esi
movzx ecx, word [eax]
add eax, 2
test cx, cx
je 0xaf9d01
movzx ebp, cx
xor ecx, ecx
cmp ebp, 0x800
setb dl
mov esi, 1
cmp ebp, 0x80
jb 0xaf9cd0
mov cl, dl
xor ecx, 3
mov esi, ecx
jmp 0xaf9cd0
lea esi, [ebx + 1]
push esi
call fcn.00af9490
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0xaf9dd8
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0xaf9d48
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0xaf9dda
movzx edx, word [edi]
test dx, dx
je 0xaf9dda
cmp dx, 0x7f
jbe 0xaf9d30
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
cmp esi, 0x7ff
ja 0xaf9d90
xor esi, esi
cmp ecx, 2
jb 0xaf9d37
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0xaf9d37
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0xaf9d37
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0xaf9d37
push 1
call fcn.00af9490
add esp, 4
mov ebp, eax
jmp 0xaf9dda
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0xaf9df7
mov eax, ebx
mov byte [esp + ecx + 0xc], al
inc ecx
movzx ebx, byte [ebp + ecx]
mov al, 0x2f
cmp ebx, 0x5c
je 0xaf9df2
test ebx, ebx
jne 0xaf9df0
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.00af6400
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0xb0bcd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov dword [esp + 8], 0xb321b512
mov dword [esp + 0xc], 0xaf37b129
mov dword [esp + 0x10], 0xab7ead62
mov dword [esp + 0x14], 0xa736a936
lea eax, [esp + 0x18]
mov word [esp + 0x18], 0xa5a6
mov dword [esp + 0x1a], 0
mov word [esp + 0x1e], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x17
ja 0xb0bd71
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
lea esi, [ecx + 0xc9]
and esi, edx
add ecx, edx
add esi, esi
sub ecx, esi
add ecx, 0x22d6dbc9
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
add cl, 0x81
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x18
jb 0xb0bd30
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x20]
lea esi, [esp + 8]
mov edx, esi
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x30]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax], 0
lea eax, [eax + 2]
jne 0xb0bda0
lea ecx, [ebx + eax]
add ecx, 0xfffffffe
mov eax, ebx
not eax
and eax, ecx
xor ecx, ebx
add eax, eax
sub eax, ecx
mov edi, esi
cmp eax, 0xffffffed
jge 0xb0bdca
mov eax, 0xffffffff
jmp 0xb0bdcd
add eax, 0x12
push eax
call fcn.00af9490
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0xb0be01
add ebx, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0xb0bdf0
mov word [eax], 0
movzx ecx, word [esp + 0x20]
test cx, cx
je 0xb0be31
lea edx, [esp + 0x22]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0xb0be20
mov word [eax], 0
push edi
push esi
call fcn.00b2d080
add esp, 8
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0xcc379c]
Function at 0xb24eb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
push edi
push esi
mov edx, 0xfffffffe
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp word [ecx + edx + 2], 0
lea edx, [edx + 2]
jne 0xb24ec0
test edx, edx
je 0xb24f3a
sar edx, 1
lea esi, [edx - 1]
mov edi, edx
and edi, 3
je 0xb24ef2
nop
nop
nop
nop
nop
dec edx
movzx ebx, word [ecx]
add ecx, 2
xor ebx, eax
imul eax, ebx, 0x1000193
dec edi
jne 0xb24ee0
cmp esi, 3
jb 0xb24f3a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
movzx edi, word [ecx + esi*2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 2]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 4]
xor edi, eax
imul eax, edi, 0x1000193
movzx edi, word [ecx + esi*2 + 6]
xor edi, eax
imul eax, edi, 0x1000193
add esi, 4
cmp edx, esi
jne 0xb24f00
pop esi
pop edi
pop ebx
ret

Function at 0xb24f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x68
mov dword [esp + 0x20], 0xa3cda1f9
mov dword [esp + 0x24], 0xdf51dd29
mov dword [esp + 0x28], 0xdb47d952
mov dword [esp + 0x2c], 0xd7a8d54d
mov dword [esp + 0x30], 0xd34bd144
mov dword [esp + 0x34], 0xcf53cd5c
mov dword [esp + 0x38], 0xcbc8c991
lea edx, [esp + 0x3c]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov byte [esp + 0x44], 0
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x24
ja 0xb2500c
nop
nop
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
movzx esi, byte [esp + eax + 0x20]
lea eax, [ecx + esi]
add eax, 0xfa8fb4bb
mov edi, 0x5704b44
sub edi, ecx
lea ebx, [ecx + 0xbb]
and ebx, esi
or edi, esi
add edi, ecx
lea ecx, [ebx + edi]
add ecx, 0xfa8fb4bc
mov esi, ecx
xor esi, eax
not ecx
and ecx, eax
add ecx, ecx
sub ecx, esi
mov dword [esp + 0x48], ecx
mov eax, dword [esp + 0x48]
add al, 0xe3
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x20], al
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 0x25
jb 0xb24fb0
lea eax, [esp + 0x48]
lea ebx, [esp + 0x20]
mov esi, ebx
mov ecx, 7
mov edi, eax
xchg esi, esi
rep movsd dword es:[edi], dword [esi]
xchg esi, esi
lea edi, [esp + 0x64]
xor ecx, ecx
xchg esi, edx
rep movsw word es:[edi], word [esi]
xchg esi, edx
lea ecx, [esp + 0xc]
push ecx
push 8
push ebx
push 0xd
push eax
push 0
call dword [0xcc8ba8]
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0xcc61b8]
Function at 0xb28fa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov edx, dword [ecx + 4]
test edx, edx
je 0xb290a0
xor eax, eax
cmp dword [ecx], 0
jne 0xb290a5
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x1c], edx
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], eax
mov dword [esp + 8], 0x1c1d1e1f
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xc
ja 0xb29071
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
mov esi, eax
and esi, 0x2560f27c
xor eax, 0xa560f27c
lea eax, [eax + esi*2]
mov esi, eax
and esi, edx
add eax, edx
add esi, esi
sub eax, esi
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x9c
mov edx, dword [esp]
mov byte [esp + edx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xd
jb 0xb29030
mov eax, dword [esp + 8]
mov esi, dword [0xcc8bac]
test esi, esi
je 0xb290a5
mov edx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0xcc8bb0]
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x94b236a1
je 0xb290af
inc edi
cmp esi, edi
jne 0xb29090
jmp 0xb290a5
mov eax, 0xc0000008
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0xb290a5
lea eax, [esp + 0x1c]
lea edi, [esp + 0x24]
push eax
push edi
push edx
push ecx
push 4
push dword [0xcc8bb4]
push esi
call fcn.00b2a560
add esp, 0x1c
jmp 0xb290a5

Function at 0xb290e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [ecx]
test eax, eax
je 0xb291c7
mov esi, ecx
mov dword [esp + 8], 0x1c1d1e1f
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xc
ja 0xb29173
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
mov edi, ecx
and edi, 0x2560f27c
xor ecx, 0xa560f27c
lea ecx, [ecx + edi*2]
mov edi, ecx
and edi, edx
add ecx, edx
add edi, edi
sub ecx, edi
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x9c
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xd
jb 0xb29130
mov ecx, dword [0xcc8bac]
test ecx, ecx
je 0xb291ba
mov edx, dword [esp + 8]
xor edi, edi
mov ebx, dword [0xcc8bb0]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x11081610
je 0xb291a0
inc edi
cmp ecx, edi
jne 0xb29190
jmp 0xb291ba
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0xb291ba
push eax
push 1
push dword [0xcc8bb4]
push ecx
call fcn.00b2a560
add esp, 0x10
mov dword [esi], 0
mov dword [esi + 4], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xb291d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, 0xc0000008
cmp dword [ecx + 4], 0
je 0xb293ce
mov esi, ecx
mov eax, dword [ecx]
test eax, eax
je 0xb293ce
mov dword [esp + 8], 0x1c1d1e1f
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0xc
ja 0xb29273
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 8]
mov edi, ecx
and edi, 0x2560f27c
xor ecx, 0xa560f27c
lea ecx, [ecx + edi*2]
mov edi, ecx
and edi, edx
add ecx, edx
add edi, edi
sub ecx, edi
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
add cl, 0x9c
mov edx, dword [esp]
mov byte [esp + edx + 8], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0xd
jb 0xb29230
mov ebx, dword [ebp + 0x10]
mov edi, dword [esp + 8]
mov edx, dword [0xcc8bac]
test edx, edx
je 0xb292c5
xor ecx, ecx
mov ebx, dword [0xcc8bb0]
nop
nop
nop
nop
cmp dword [ebx + ecx*8], 0xac3673b8
je 0xb292a3
inc ecx
cmp edx, ecx
jne 0xb29290
mov ebx, dword [ebp + 0x10]
jmp 0xb292c5
mov ecx, dword [ebx + ecx*8 + 4]
cmp ecx, edi
mov ebx, dword [ebp + 0x10]
je 0xb292c5
push dword [ebp + 8]
push eax
push 2
push dword [0xcc8bb4]
push ecx
call fcn.00b2a560
add esp, 0x14
mov edi, eax
cmp dword [ebp + 0xc], 1
mov eax, ebx
sbb eax, 0
jl 0xb293c3
cmp edi, 0xc000010a
jne 0xb293c3
mov ecx, 0xffffd8f0
mov edi, dword [ebp + 0xc]
mov eax, edi
mul ecx
sub edx, edi
imul ecx, ebx, 0xffffd8f0
add ecx, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esi]
mov dword [esp + 8], 0x1c1d1e1f
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0xc
ja 0xb29376
nop
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
mov edi, ecx
and edi, 0x2560f27c
xor ecx, 0xa560f27c
lea ecx, [ecx + edi*2]
mov edi, ecx
and edi, edx
add ecx, edx
add edi, edi
sub ecx, edi
mov dword [esp], ecx
mov ecx, dword [esp]
add cl, 0x9c
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0xd
jb 0xb29330
mov edi, dword [esp + 8]
mov ecx, dword [0xcc8bac]
test ecx, ecx
je 0xb293c3
xor edx, edx
mov ebx, dword [0xcc8bb0]
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0xb33e16a3
je 0xb293a0
inc edx
cmp ecx, edx
jne 0xb29390
jmp 0xb293c3
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, edi
je 0xb293c3
lea edx, [esp + 0x18]
push edx
push 0
push eax
push 3
push dword [0xcc8bb4]
push ecx
call fcn.00b2a560
add esp, 0x18
mov edi, eax
test edi, edi
js 0xb293ce
mov ecx, esi
call fcn.00b290e0
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0xb293e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov edx, dword [ebp + 0x14]
test edx, edx
jne 0xb293f7
lea edx, [esp + 0x18]
mov ecx, dword [ecx]
mov dword [esp + 8], 0x1c1d1e1f
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov byte [esp + 0x14], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0xc
ja 0xb29471
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 8]
mov edi, eax
and edi, 0x2560f27c
xor eax, 0xa560f27c
lea eax, [eax + edi*2]
mov edi, eax
and edi, esi
add eax, esi
add edi, edi
sub eax, edi
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add al, 0x9c
mov esi, dword [esp]
mov byte [esp + esi + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0xd
jb 0xb29430
mov eax, dword [esp + 8]
mov esi, dword [0xcc8bac]
test esi, esi
je 0xb294c4
xor edi, edi
mov ebx, dword [0xcc8bb0]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xc99a73c4
je 0xb294a0
inc edi
cmp esi, edi
jne 0xb29490
jmp 0xb294c4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0xb294c4
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
push 5
push dword [0xcc8bb4]
push esi
call fcn.00b2a560
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x401000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
test ecx, ecx
jle 0x4010a8
sub edx, edi
push ebx
mov dword [ebp - 4], edx
mov dword [ebp + 8], ecx
push esi
lea ebx, [ebx]
mov ecx, dword [eax + 0x104]
inc ecx
and ecx, 0x800000ff
jns 0x401037
dec ecx
or ecx, 0xffffff00
inc ecx
mov dword [eax + 0x104], ecx
movzx esi, byte [ecx + eax]
add esi, dword [eax + 0x108]
and esi, 0x800000ff
jns 0x401057
dec esi
or esi, 0xffffff00
inc esi
mov dword [eax + 0x108], esi
mov dl, byte [ecx + eax]
mov bl, byte [esi + eax]
mov byte [ecx + eax], bl
mov byte [esi + eax], dl
mov ecx, dword [eax + 0x108]
movzx edx, byte [ecx + eax]
mov ecx, dword [eax + 0x104]
movzx ecx, byte [ecx + eax]
add edx, ecx
and edx, 0x800000ff
jns 0x40108f
dec edx
or edx, 0xffffff00
inc edx
movzx edx, byte [edx + eax]
mov ecx, dword [ebp - 4]
xor dl, byte [ecx + edi]
inc edi
dec dword [ebp + 8]
mov byte [edi - 1], dl
jne 0x401020
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x4010c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor edi, edi
mov dword [ecx + 0x100], eax
mov dword [ecx + 0x104], edi
mov dword [ecx + 0x108], edi
xor eax, eax
mov edi, edi
mov byte [eax + ecx], al
inc eax
cmp eax, 0x100
jl 0x4010e0
mov eax, 1
sub eax, ecx
mov dword [ebp - 0xc], eax
mov eax, 2
sub eax, ecx
mov dword [ebp - 0x10], eax
mov eax, 3
sub eax, ecx
mov dword [ebp - 8], edi
mov esi, ecx
mov dword [ebp - 0x14], eax
mov edi, edi
movzx edx, byte [esi]
mov eax, dword [ebp - 8]
mov byte [ebp - 1], dl
cdq
idiv dword [ecx + 0x100]
movzx eax, byte [edx + ebx]
movzx edx, byte [ebp - 1]
add edi, eax
add edi, edx
and edi, 0x800000ff
jns 0x40113c
dec edi
or edi, 0xffffff00
inc edi
movzx eax, byte [edi + ecx]
movzx edx, byte [ebp - 1]
mov byte [esi], al
mov byte [edi + ecx], dl
movzx eax, byte [esi + 1]
mov byte [ebp - 1], al
mov eax, dword [ebp - 0xc]
lea eax, [eax + esi]
cdq
idiv dword [ecx + 0x100]
movzx eax, byte [edx + ebx]
movzx edx, byte [ebp - 1]
add edi, eax
add edi, edx
and edi, 0x800000ff
jns 0x401179
dec edi
or edi, 0xffffff00
inc edi
movzx eax, byte [edi + ecx]
movzx edx, byte [ebp - 1]
mov byte [esi + 1], al
mov byte [edi + ecx], dl
movzx eax, byte [esi + 2]
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x10]
lea eax, [eax + esi]
cdq
idiv dword [ecx + 0x100]
movzx eax, byte [edx + ebx]
movzx edx, byte [ebp - 1]
add edi, eax
add edi, edx
and edi, 0x800000ff
jns 0x4011b7
dec edi
or edi, 0xffffff00
inc edi
movzx eax, byte [edi + ecx]
movzx edx, byte [ebp - 1]
mov byte [esi + 2], al
mov byte [edi + ecx], dl
movzx eax, byte [esi + 3]
mov byte [ebp - 1], al
mov eax, dword [ebp - 0x14]
lea eax, [eax + esi]
cdq
idiv dword [ecx + 0x100]
movzx eax, byte [edx + ebx]
movzx edx, byte [ebp - 1]
add edi, eax
add edi, edx
and edi, 0x800000ff
jns 0x4011f5
dec edi
or edi, 0xffffff00
inc edi
movzx eax, byte [edi + ecx]
movzx edx, byte [ebp - 1]
mov byte [esi + 3], al
mov eax, dword [ebp - 8]
add eax, 4
add esi, 4
mov byte [edi + ecx], dl
mov dword [ebp - 8], eax
cmp eax, 0x100
jl 0x401110
pop edi
pop esi
mov esp, ebp
pop ebp
ret