joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005d720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0
mov byte [ebp - 0xa], 0
mov byte [ebp - 9], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
push eax
call fcn.10013a30
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1005d829
mov dword [ebp - 4], 0
jmp 0x1005d769
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 8]
jae 0x1005d79f
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 4
div ecx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movsx ecx, byte [eax]
movzx ebx, byte [ebp + edx - 0xc]
xor ebx, ecx
mov eax, dword [ebp - 4]
xor edx, edx
mov ecx, 4
div ecx
mov byte [ebp + edx - 0xc], bl
jmp 0x1005d760
movzx edx, byte [ebp - 0xc]
movzx eax, byte [ebp - 0xb]
shl eax, 8
or edx, eax
movzx ecx, byte [ebp - 0xa]
shl ecx, 0x10
or edx, ecx
movzx eax, byte [ebp - 9]
shl eax, 0x18
or edx, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 0
jmp 0x1005d7d3
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 4
jae 0x1005d829
mov dword [ebp - 0x14], 0
jmp 0x1005d7eb
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0xc]
jae 0x1005d827
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x343fd
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x269ec3
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
sar eax, 0x10
and eax, 0x7fff
mov ecx, dword [ebp - 4]
shl ecx, 4
add ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x14]
mov byte [ecx + edx], al
jmp 0x1005d7e2
jmp 0x1005d7ca
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1005e100
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x1005e132
xor al, al
jmp 0x1005e181
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov byte [ebp - 1], al
cmp dword [ebp + 0x10], 0
je 0x1005e17e
push 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1005e190
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
test eax, eax
jne 0x1005e1c2
xor al, al
jmp 0x1005e211
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x1c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x18]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [ebp - 1], al
cmp dword [ebp + 0xc], 0
je 0x1005e20e
push 1
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
add ecx, 4
push ecx
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 8

Function at 0x1005e270
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x8c], ecx
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x8c]
add edx, 0x18
push edx
push str.SjyPkt_
push str.._s_s
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x88]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x8c]
add edx, 0x10
push edx
lea eax, [ebp - 0x84]
push eax
push 3
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceA]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
jne 0x1005e302
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Remove_dos_device_define
call fcn.1005d830
add esp, 8
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret
Function at 0x100600b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.CNdisAdapter.0
movzx ecx, byte [0x1008af91]
test ecx, ecx
je 0x100600d6
push str.Enter_CNdisAdaper_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0xffffffff
je 0x100600f1
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 4]
call fcn.100028c0
movzx ecx, byte [0x1008af91]
test ecx, ecx
je 0x10060107
push str.Leave_CNdisAdaper_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
add ecx, 0xa8
call fcn.10001850
mov esp, ebp
pop ebp
ret
Function at 0x10060af0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x624], 1
mov dword [ebp - 0x62c], 0
mov dword [ebp - 0x620], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [ebp - 0x628], eax
push 1
mov eax, dword [ebp - 0x628]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
mov edx, dword [ebp + 0x14]
mov dword [edx + 0xa24], 0
mov dword [ebp - 8], 0
jmp 0x10060b66
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jae 0x10060d24
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.10013a30
add esp, 4
push eax
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x10060bbd
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x62c]
add ecx, 1
mov dword [ebp - 0x62c], ecx
cmp dword [ebp - 0x62c], 0xa
jne 0x10060bbb
xor eax, eax
jmp 0x10060d26
jmp 0x10060b70
push 0
push 0x3e8
push 1
lea edx, [ebp - 0x628]
push edx
push 1
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x10060be7
cmp dword [ebp - 4], 0x102
jne 0x10060bf1
jmp 0x10060b5d
lea eax, [ebp - 0x61c]
push eax
mov ecx, dword [ebp - 0x628]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.WS2_32.dll_WSAEnumNetworkEvents]
mov eax, dword [ebp - 0x61c]
and eax, 1
je 0x10060d1f
push 0x5dd
push 0
lea ecx, [ebp - 0x5f0]
push ecx
call fcn.100139b0
add esp, 0xc
push 0
push 0x5dc
lea edx, [ebp - 0x5f0]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x624], eax
cmp dword [ebp - 0x624], 0
jle 0x10060d14
mov ecx, dword [ebp + 0x14]
cmp dword [ecx + 0xa24], 0
jne 0x10060c86
push 0xffffffffffffffff
lea edx, [ebp - 0x5f0]
push edx
mov eax, dword [ebp - 0x624]
add eax, 1
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.100169bf
add esp, 0x10
jmp 0x10060ca5
mov edx, dword [ebp - 0x624]
add edx, 1
push edx
lea eax, [ebp - 0x5f0]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.10016a74
add esp, 0x10
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0xa24]
add eax, dword [ebp - 0x624]
mov ecx, dword [ebp + 0x14]
mov dword [ecx + 0xa24], eax
push 0
push 0x3e8
push 1
lea edx, [ebp - 0x628]
push edx
push 1
call dword [sym.imp.WS2_32.dll_WSAWaitForMultipleEvents]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x10060ce7
cmp dword [ebp - 4], 0x102
jne 0x10060ce9
jmp 0x10060d14
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x5dc
lea eax, [ebp - 0x5f0]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x624], eax
jmp 0x10060c4c
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0xa24]
jmp 0x10060d26
jmp 0x10060b5d
xor eax, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret
Function at 0x10060d40
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp + 8]
add eax, 0x4ca
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x20], eax
push 4
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.10013640
add esp, 0xc
push 8
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.100139b0
add esp, 0xc
mov eax, dword [ebp + 8]
cmp dword [eax + 0x3c0], 0
je 0x10060dba
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3c0]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x3c0], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x3c0], 0
jae 0x10060de8
push str.socket
call fcn.10016d4e
add esp, 4
mov eax, 2
mov word [ebp - 0x14], ax
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x3c6]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3c0]
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jge 0x10060e2d
push str.connect
call fcn.10016d4e
add esp, 4
mov eax, dword [ebp + 0x10]
push eax
call fcn.10013a30
add esp, 4
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100609c0
add esp, 4
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x794
push edx
mov eax, dword [str.Simple_UPnP_0.9_Realtek_WPS_1.2]
push eax
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x3c6]
push edx
mov eax, dword [ebp + 8]
add eax, 0x4ca
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x614
push ecx
mov edx, dword [str.POST__s_HTTP_1.1_r_nHost:__s:_d_r_nUser_Agent:__s_r_nSOAPACTION:___s_s__r_nContent_Type:_text_xml__charset_utf_8__r_nContent_Length:__d_r_n_r_n_s_r_n]
push edx
push 0xffffffffffffffff
push 0x5dc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xa18]
push ecx
call fcn.10016910
add esp, 0x30
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xa18]
push eax
call fcn.10013a30
add esp, 4
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xa18]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c0]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret
Function at 0x10060ee0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp + 8]
add eax, 0x4ca
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x20], eax
push 4
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx]
push eax
lea ecx, [ebp - 0x10]
push ecx
call fcn.10013640
add esp, 0xc
push 8
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.100139b0
add esp, 0xc
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x3bc], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x3bc], 0
jae 0x10060f6c
push 0x1007be9c
call fcn.10016d4e
add esp, 4
mov eax, 2
mov word [ebp - 0x14], ax
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x3c6]
push edx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3bc]
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jge 0x10060fb1
push 0x1007bea4
call fcn.10016d4e
add esp, 4
mov eax, dword [ebp + 0x10]
push eax
call fcn.10013a30
add esp, 4
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100609c0
add esp, 4
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x794
push edx
mov eax, dword [str.Simple_UPnP_0.9_Realtek_WPS_1.2]
push eax
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x3c6]
push edx
mov eax, dword [ebp + 8]
add eax, 0x4ca
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x614
push ecx
mov edx, dword [str.POST__s_HTTP_1.1_r_nHost:__s:_d_r_nUser_Agent:__s_r_nSOAPACTION:___s_s__r_nContent_Type:_text_xml__charset_utf_8__r_nContent_Length:__d_r_n_r_n_s_r_n]
push edx
push 0xffffffffffffffff
push 0x5dc
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xa18]
push ecx
call fcn.10016910
add esp, 0x30
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xa18]
push eax
call fcn.10013a30
add esp, 4
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xa18]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3bc]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret
Function at 0x10064700
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret

Function at 0x10064bd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x30
mov byte [ebp - 0x17], 0x31
mov byte [ebp - 0x16], 0x32
mov byte [ebp - 0x15], 0x33
mov byte [ebp - 0x14], 0x34
mov byte [ebp - 0x13], 0x35
mov byte [ebp - 0x12], 0x36
mov byte [ebp - 0x11], 0x37
mov byte [ebp - 0x10], 0x38
mov byte [ebp - 0xf], 0x39
mov byte [ebp - 0xe], 0x41
mov byte [ebp - 0xd], 0x42
mov byte [ebp - 0xc], 0x43
mov byte [ebp - 0xb], 0x44
mov byte [ebp - 0xa], 0x45
mov byte [ebp - 9], 0x46
mov ecx, dword [ebp + 0x14]
push ecx
push 0x30
mov edx, dword [ebp + 0x10]
push edx
call fcn.100139b0
add esp, 0xc
mov eax, dword [ebp + 0x10]
add eax, dword [ebp + 0x14]
mov byte [eax], 0
movzx ecx, byte [ebp + 0x18]
test ecx, ecx
je 0x10064c9d
mov dword [ebp - 4], 0
jmp 0x10064c5b
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jge 0x10064c9b
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
and edx, 0xf
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dl, byte [ebp + edx - 0x18]
mov byte [ecx + eax*2 + 1], dl
mov eax, dword [ebp + 8]
add eax, dword [ebp - 4]
movzx ecx, byte [eax]
sar ecx, 4
and ecx, 0xf
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp + ecx - 0x18]
mov byte [eax + edx*2], cl
jmp 0x10064c52
jmp 0x10064d04
mov edx, dword [ebp + 0xc]
sub edx, 1
mov dword [ebp - 4], edx
jmp 0x10064cb1
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jl 0x10064d04
cmp dword [ebp - 0x1c], 0
jle 0x10064d04
mov ecx, dword [ebp - 0x1c]
sub ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
and eax, 0xf
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 0x1c]
mov dl, byte [ebp + eax - 0x18]
mov byte [ecx], dl
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movzx edx, byte [ecx]
sar edx, 4
and edx, 0xf
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x1c]
mov cl, byte [ebp + edx - 0x18]
mov byte [eax], cl
jmp 0x10064ca8
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret
Function at 0x10067d00
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x10067d10
mov eax, 1
jmp 0x10067d74
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x18], 0
xor edx, edx
mov eax, dword [ebp + 8]
mov word [eax + 0x1c], dx
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x67452301
mov edx, dword [ebp + 8]
mov dword [edx + 4], 0xefcdab89
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0x10325476
mov edx, dword [ebp + 8]
mov dword [edx + 0x10], 0xc3d2e1f0
mov eax, dword [ebp + 8]
mov dword [eax + 0x60], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x64], 0
xor eax, eax
pop ebp
ret

Function at 0x10067fc0
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x180
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 0x14], 0x40
jle 0x10068025
lea eax, [ebp - 0x180]
push eax
call fcn.10067d00
add esp, 4
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x180]
push eax
call fcn.10067bf0
add esp, 0xc
lea ecx, [ebp - 0xac]
push ecx
lea edx, [ebp - 0x180]
push edx
call fcn.10067ef0
add esp, 8
lea eax, [ebp - 0xac]
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], 0x14
push 0x41
push 0
lea ecx, [ebp - 0x98]
push ecx
call fcn.100139b0
add esp, 0xc
push 0x41
push 0
lea edx, [ebp - 0x50]
push edx
call fcn.100139b0
add esp, 0xc
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x98]
push edx
call fcn.10013640
add esp, 0xc
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x50]
push edx
call fcn.10013640
add esp, 0xc
mov dword [ebp - 4], 0
jmp 0x10068085
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x40
jge 0x100680b7
mov ecx, dword [ebp - 4]
movzx edx, byte [ebp + ecx - 0x98]
xor edx, 0x36
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x98], dl
mov ecx, dword [ebp - 4]
movzx edx, byte [ebp + ecx - 0x50]
xor edx, 0x5c
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x50], dl
jmp 0x1006807c
lea ecx, [ebp - 0x118]
push ecx
call fcn.10067d00
add esp, 4
push 0x40
lea edx, [ebp - 0x98]
push edx
lea eax, [ebp - 0x118]
push eax
call fcn.10067bf0
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x118]
push eax
call fcn.10067bf0
add esp, 0xc
mov ecx, dword [ebp + 0x18]
push ecx
lea edx, [ebp - 0x118]
push edx
call fcn.10067ef0
add esp, 8
lea eax, [ebp - 0x118]
push eax
call fcn.10067d00
add esp, 4
push 0x40
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x118]
push edx
call fcn.10067bf0
add esp, 0xc
push 0x14
mov eax, dword [ebp + 0x18]
push eax
lea ecx, [ebp - 0x118]
push ecx
call fcn.10067bf0
add esp, 0xc
mov edx, dword [ebp + 0x18]
push edx
lea eax, [ebp - 0x118]
push eax
call fcn.10067ef0
add esp, 8
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret
Function at 0x10068750
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x10086ba0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.10013640
add esp, 0xc
mov eax, dword [ebp + 0x1c]
sar eax, 0x18
and eax, 0xff
mov ecx, dword [ebp + 0x14]
mov byte [ebp + ecx - 0x40], al
mov edx, dword [ebp + 0x1c]
sar edx, 0x10
and edx, 0xff
mov eax, dword [ebp + 0x14]
mov byte [ebp + eax - 0x3f], dl
mov ecx, dword [ebp + 0x1c]
sar ecx, 8
and ecx, 0xff
mov edx, dword [ebp + 0x14]
mov byte [ebp + edx - 0x3e], cl
mov eax, dword [ebp + 0x1c]
and eax, 0xff
mov ecx, dword [ebp + 0x14]
mov byte [ebp + ecx - 0x3d], al
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x14]
add edx, 4
push edx
lea eax, [ebp - 0x40]
push eax
call fcn.10067fc0
add esp, 0x14
push 0x14
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp + 0x20]
push edx
call fcn.10013640
add esp, 0xc
mov dword [ebp - 0x1c], 1
jmp 0x100687fe
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp + 0x18]
jge 0x10068869
lea edx, [ebp - 0x40]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x14
lea edx, [ebp - 0x18]
push edx
call fcn.10067fc0
add esp, 0x14
push 0x14
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x18]
push ecx
call fcn.10013640
add esp, 0xc
mov dword [ebp - 0x44], 0
jmp 0x10068844
mov edx, dword [ebp - 0x44]
add edx, 1
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 0x14
jge 0x10068867
mov eax, dword [ebp - 0x44]
movzx ecx, byte [ebp + eax - 0x40]
mov edx, dword [ebp + 0x20]
add edx, dword [ebp - 0x44]
movzx eax, byte [edx]
xor eax, ecx
mov ecx, dword [ebp + 0x20]
add ecx, dword [ebp - 0x44]
mov byte [ecx], al
jmp 0x1006883b
jmp 0x100687f5
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001362b
mov esp, ebp
pop ebp
ret

Function at 0x484ce1
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x484a08
dec ecx
add esi, esi
add ecx, 0xf6394361
call fcn.00484d25
sub ecx, esi
add ecx, 1
xor dword [eax], edx
sub ecx, 0xcee2360d
add esi, esi
sub esi, 0xc7588dea
add eax, 2
sub ecx, esi
cmp eax, ebx
jl fcn.00484ce1
or ecx, ecx
add esi, 0x65677cb3
ret