joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100256f0
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100567f6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x484
mov dword [ebp - 0x480], ecx
jmp 0x10025726
movzx eax, byte [ebp + 8]
push eax
call fcn.10025660
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x10025a14
call fcn.100011c0
movzx ecx, al
test ecx, ecx
je 0x10025a14
mov byte [ebp - 0x45c], 0x47
mov byte [ebp - 0x45b], 0x61
mov byte [ebp - 0x45a], 0x6d
mov byte [ebp - 0x459], 0x65
mov byte [ebp - 0x458], 0x20
mov byte [ebp - 0x457], 0x49
mov byte [ebp - 0x456], 0x6e
mov byte [ebp - 0x455], 0x74
mov byte [ebp - 0x454], 0x65
mov byte [ebp - 0x453], 0x67
mov byte [ebp - 0x452], 0x72
mov byte [ebp - 0x451], 0x69
mov byte [ebp - 0x450], 0x74
mov byte [ebp - 0x44f], 0x79
mov byte [ebp - 0x44e], 0x20
mov byte [ebp - 0x44d], 0x66
mov byte [ebp - 0x44c], 0x61
mov byte [ebp - 0x44b], 0x69
mov byte [ebp - 0x44a], 0x6c
mov byte [ebp - 0x449], 0x65
mov byte [ebp - 0x448], 0x64
mov byte [ebp - 0x447], 0x2e
mov byte [ebp - 0x446], 0x20
mov byte [ebp - 0x445], 0x54
mov byte [ebp - 0x444], 0x72
mov byte [ebp - 0x443], 0x79
mov byte [ebp - 0x442], 0x20
mov byte [ebp - 0x441], 0x74
mov byte [ebp - 0x440], 0x6f
mov byte [ebp - 0x43f], 0x20
mov byte [ebp - 0x43e], 0x64
mov byte [ebp - 0x43d], 0x69
mov byte [ebp - 0x43c], 0x73
mov byte [ebp - 0x43b], 0x61
mov byte [ebp - 0x43a], 0x62
mov byte [ebp - 0x439], 0x6c
mov byte [ebp - 0x438], 0x65
mov byte [ebp - 0x437], 0x20
mov byte [ebp - 0x436], 0x61
mov byte [ebp - 0x435], 0x6e
mov byte [ebp - 0x434], 0x74
mov byte [ebp - 0x433], 0x69
mov byte [ebp - 0x432], 0x76
mov byte [ebp - 0x431], 0x69
mov byte [ebp - 0x430], 0x72
mov byte [ebp - 0x42f], 0x75
mov byte [ebp - 0x42e], 0x73
mov byte [ebp - 0x42d], 0x65
mov byte [ebp - 0x42c], 0x73
mov byte [ebp - 0x42b], 0x20
mov byte [ebp - 0x42a], 0x74
mov byte [ebp - 0x429], 0x68
mov byte [ebp - 0x428], 0x65
mov byte [ebp - 0x427], 0x6e
mov byte [ebp - 0x426], 0x20
mov byte [ebp - 0x425], 0x74
mov byte [ebp - 0x424], 0x72
mov byte [ebp - 0x423], 0x79
mov byte [ebp - 0x422], 0x20
mov byte [ebp - 0x421], 0x61
mov byte [ebp - 0x420], 0x67
mov byte [ebp - 0x41f], 0x61
mov byte [ebp - 0x41e], 0x69
mov byte [ebp - 0x41d], 0x6e
mov byte [ebp - 0x41c], 0
lea edx, [ebp - 0x45c]
push edx
push 0x2000
lea eax, [ebp - 0x414]
push eax
call fcn.100521f0
add esp, 0xc
call fcn.10003730
movzx ecx, al
test ecx, ecx
je 0x10025967
mov ecx, dword [0x10082630]
call fcn.100011e0
push eax
push 0
lea edx, [ebp - 0x414]
push edx
push 1
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [0x10082634]
call fcn.1000e970
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x10025a26
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10025ab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
jmp 0x10025acb
push 7
push 0
push 0x10025a40
mov ecx, dword [0x10083160]
call fcn.10025c60
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10025bcf
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x52
mov byte [ebp - 0x31], 0x4f
mov byte [ebp - 0x30], 0x52
mov byte [ebp - 0x2f], 0x21
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x2b], 0x72
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x20
mov byte [ebp - 0x26], 0x63
mov byte [ebp - 0x25], 0x72
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x61
mov byte [ebp - 0x22], 0x74
mov byte [ebp - 0x21], 0x69
mov byte [ebp - 0x20], 0x6f
mov byte [ebp - 0x1f], 0x6e
mov byte [ebp - 0x1e], 0x20
mov byte [ebp - 0x1d], 0x66
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x6c
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x2c
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x54
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x72
mov byte [ebp - 0x12], 0x65
mov byte [ebp - 0x11], 0x61
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x20
mov byte [ebp - 0xe], 0x43
mov byte [ebp - 0xd], 0x6f
mov byte [ebp - 0xc], 0x64
mov byte [ebp - 0xb], 0x65
mov byte [ebp - 0xa], 0x20
mov byte [ebp - 9], 0x30
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x37
mov byte [ebp - 6], 0x21
mov byte [ebp - 5], 0
mov ecx, dword [0x10082630]
call fcn.100011e0
push eax
push 0
lea eax, [ebp - 0x34]
push eax
push 0
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [0x10082634]
call fcn.1000e970
jmp 0x10025be1
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10025c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x38], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 4
call fcn.100011c0
movzx eax, al
test eax, eax
je 0x10025cde
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
push 0xffffffffffffffff
push 0
push 0x1fffff
lea ecx, [ebp - 8]
push ecx
mov edx, dword [0x1008262c]
mov eax, dword [edx + 0x11c]
call eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x10025cd9
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [0x10082638]
call fcn.10025120
mov eax, dword [ebp - 8]
jmp 0x10025dae
jmp 0x10025dac
lea edx, [ebp - 0xc]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
mov edx, dword [0x1008262c]
mov eax, dword [edx + 0x114]
call eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10025dac
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x38]
call fcn.100260c0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jae 0x10025d98
mov byte [ebp - 0x34], 0x54
mov byte [ebp - 0x33], 0x68
mov byte [ebp - 0x32], 0x72
mov byte [ebp - 0x31], 0x65
mov byte [ebp - 0x30], 0x61
mov byte [ebp - 0x2f], 0x64
mov byte [ebp - 0x2e], 0x20
mov byte [ebp - 0x2d], 0x63
mov byte [ebp - 0x2c], 0x72
mov byte [ebp - 0x2b], 0x65
mov byte [ebp - 0x2a], 0x61
mov byte [ebp - 0x29], 0x74
mov byte [ebp - 0x28], 0x69
mov byte [ebp - 0x27], 0x6f
mov byte [ebp - 0x26], 0x6e
mov byte [ebp - 0x25], 0x20
mov byte [ebp - 0x24], 0x71
mov byte [ebp - 0x23], 0x75
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x72
mov byte [ebp - 0x20], 0x79
mov byte [ebp - 0x1f], 0x20
mov byte [ebp - 0x1e], 0x66
mov byte [ebp - 0x1d], 0x61
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0x6c
mov byte [ebp - 0x1a], 0x65
mov byte [ebp - 0x19], 0x64
mov byte [ebp - 0x18], 0x21
mov byte [ebp - 0x17], 0
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [0x10082638]
call fcn.10025120
mov eax, dword [ebp - 8]
jmp 0x10025dae
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10025dc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
jmp 0x10025ddb
cmp dword [ebp + 8], 0
jne 0x10025de6
jmp 0x10025e8f
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x1008262c]
mov edx, dword [ecx + 0x194]
call edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x102
je 0x10025e7d
mov byte [ebp - 0x1c], 0x54
mov byte [ebp - 0x1b], 0x68
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x4b
mov byte [ebp - 0x14], 0x69
mov byte [ebp - 0x13], 0x6c
mov byte [ebp - 0x12], 0x6c
mov byte [ebp - 0x11], 0x20
mov byte [ebp - 0x10], 0x44
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x74
mov byte [ebp - 0xd], 0x65
mov byte [ebp - 0xc], 0x63
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0
mov ecx, dword [0x10082630]
call fcn.100011e0
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [0x10082634]
call fcn.1000e970
jmp 0x10025e8f
mov esp, ebp
pop ebp
ret 4

Function at 0x10025ea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
jmp 0x10025ebb
cmp dword [ebp + 8], 0
jne 0x10025ec6
jmp 0x10025f7a
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x1008262c]
mov edx, dword [ecx + 0x198]
call edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10025f68
mov byte [ebp - 0x1c], 0x54
mov byte [ebp - 0x1b], 0x68
mov byte [ebp - 0x1a], 0x72
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x61
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x53
mov byte [ebp - 0x14], 0x75
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x70
mov byte [ebp - 0x11], 0x65
mov byte [ebp - 0x10], 0x6e
mov byte [ebp - 0xf], 0x64
mov byte [ebp - 0xe], 0x20
mov byte [ebp - 0xd], 0x44
mov byte [ebp - 0xc], 0x65
mov byte [ebp - 0xb], 0x74
mov byte [ebp - 0xa], 0x65
mov byte [ebp - 9], 0x63
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], 0x65
mov byte [ebp - 6], 0x64
mov byte [ebp - 5], 0
mov ecx, dword [0x10082630]
call fcn.100011e0
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [0x10082634]
call fcn.1000e970
jmp 0x10025f7a
mov esp, ebp
pop ebp
ret 4
Function at 0x10027710
Capabilities:
Contain obfuscated stackstrings
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10056810
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
mov dword [ebp - 0x64], ecx
jmp 0x10027740
call fcn.10027240
push 5
push 0
push 0x100276b0
mov ecx, dword [0x10083160]
call fcn.10025c60
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x100278d2
mov byte [ebp - 0x40], 0x45
mov byte [ebp - 0x3f], 0x52
mov byte [ebp - 0x3e], 0x52
mov byte [ebp - 0x3d], 0x4f
mov byte [ebp - 0x3c], 0x52
mov byte [ebp - 0x3b], 0x21
mov byte [ebp - 0x3a], 0x20
mov byte [ebp - 0x39], 0x54
mov byte [ebp - 0x38], 0x68
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x35], 0x61
mov byte [ebp - 0x34], 0x64
mov byte [ebp - 0x33], 0x20
mov byte [ebp - 0x32], 0x63
mov byte [ebp - 0x31], 0x72
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x61
mov byte [ebp - 0x2e], 0x74
mov byte [ebp - 0x2d], 0x69
mov byte [ebp - 0x2c], 0x6f
mov byte [ebp - 0x2b], 0x6e
mov byte [ebp - 0x2a], 0x20
mov byte [ebp - 0x29], 0x66
mov byte [ebp - 0x28], 0x61
mov byte [ebp - 0x27], 0x69
mov byte [ebp - 0x26], 0x6c
mov byte [ebp - 0x25], 0x65
mov byte [ebp - 0x24], 0x64
mov byte [ebp - 0x23], 0x2c
mov byte [ebp - 0x22], 0x20
mov byte [ebp - 0x21], 0x54
mov byte [ebp - 0x20], 0x68
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x61
mov byte [ebp - 0x1c], 0x64
mov byte [ebp - 0x1b], 0x20
mov byte [ebp - 0x1a], 0x43
mov byte [ebp - 0x19], 0x6f
mov byte [ebp - 0x18], 0x64
mov byte [ebp - 0x17], 0x65
mov byte [ebp - 0x16], 0x20
mov byte [ebp - 0x15], 0x30
mov byte [ebp - 0x14], 0x78
mov byte [ebp - 0x13], 0x35
mov byte [ebp - 0x12], 0x21
mov byte [ebp - 0x11], 0
mov ecx, dword [0x10082630]
call fcn.100011e0
push eax
push 0
lea eax, [ebp - 0x40]
push eax
push 0
lea ecx, [ebp - 0x40]
push ecx
mov ecx, dword [0x10082634]
call fcn.1000e970
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x100278e4
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10031af0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 0x3c], ecx
jmp 0x10031b0b
push 0xf
push 0
push 0x1002f6d0
mov ecx, dword [0x10083160]
call fcn.10025c60
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10031c13
mov byte [ebp - 0x38], 0x45
mov byte [ebp - 0x37], 0x52
mov byte [ebp - 0x36], 0x52
mov byte [ebp - 0x35], 0x4f
mov byte [ebp - 0x34], 0x52
mov byte [ebp - 0x33], 0x21
mov byte [ebp - 0x32], 0x20
mov byte [ebp - 0x31], 0x54
mov byte [ebp - 0x30], 0x68
mov byte [ebp - 0x2f], 0x72
mov byte [ebp - 0x2e], 0x65
mov byte [ebp - 0x2d], 0x61
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x20
mov byte [ebp - 0x2a], 0x63
mov byte [ebp - 0x29], 0x72
mov byte [ebp - 0x28], 0x65
mov byte [ebp - 0x27], 0x61
mov byte [ebp - 0x26], 0x74
mov byte [ebp - 0x25], 0x69
mov byte [ebp - 0x24], 0x6f
mov byte [ebp - 0x23], 0x6e
mov byte [ebp - 0x22], 0x20
mov byte [ebp - 0x21], 0x66
mov byte [ebp - 0x20], 0x61
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x6c
mov byte [ebp - 0x1d], 0x65
mov byte [ebp - 0x1c], 0x64
mov byte [ebp - 0x1b], 0x2c
mov byte [ebp - 0x1a], 0x20
mov byte [ebp - 0x19], 0x54
mov byte [ebp - 0x18], 0x68
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x65
mov byte [ebp - 0x15], 0x61
mov byte [ebp - 0x14], 0x64
mov byte [ebp - 0x13], 0x20
mov byte [ebp - 0x12], 0x43
mov byte [ebp - 0x11], 0x6f
mov byte [ebp - 0x10], 0x64
mov byte [ebp - 0xf], 0x65
mov byte [ebp - 0xe], 0x20
mov byte [ebp - 0xd], 0x30
mov byte [ebp - 0xc], 0x78
mov byte [ebp - 0xb], 0x31
mov byte [ebp - 0xa], 0x35
mov byte [ebp - 9], 0x21
mov byte [ebp - 8], 0
mov ecx, dword [0x10082630]
call fcn.100011e0
push eax
push 0
lea eax, [ebp - 0x38]
push eax
push 0
lea ecx, [ebp - 0x38]
push ecx
mov ecx, dword [0x10082634]
call fcn.1000e970
jmp 0x10031c25
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x10033380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x57
mov dword [ebp - 8], 0
jmp 0x100333a2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x17
jge 0x100333e1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x2dc78e82]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x100333dc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10033399
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x17], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10033440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xb0
mov dword [ebp - 8], 0
jmp 0x10033462
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x20
jge 0x100334a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x3c1068d9]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003349c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10033459
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x20], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100334c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x62
mov dword [ebp - 8], 0
jmp 0x100334e2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1f
jge 0x10033521
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x30378019]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003351c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100334d9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1f], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10033540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x97
mov dword [ebp - 8], 0
jmp 0x10033562
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1f
jge 0x100335a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x27602290]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003359c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10033559
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1f], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100335c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x9a
mov dword [ebp - 8], 0
jmp 0x100335e2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1d
jge 0x10033621
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x61a2c67a]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003361c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100335d9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1d], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10033640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x4c
mov dword [ebp - 8], 0
jmp 0x10033662
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1d
jge 0x100336a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x62950db2]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003369c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10033659
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1d], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100336c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xa7
mov dword [ebp - 8], 0
jmp 0x100336e2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1f
jge 0x10033721
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x11af74d]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003371c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100336d9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1f], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10033740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xa5
mov dword [ebp - 8], 0
jmp 0x10033762
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x1b
jge 0x100337a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x257c10]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003379c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10033759
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x1b], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100337c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xb1
mov dword [ebp - 8], 0
jmp 0x100337e2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x20
jge 0x10033821
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x3ac666d1]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003381c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100337d9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x20], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10033840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xc2
mov dword [ebp - 8], 0
jmp 0x10033862
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3c
jge 0x100338a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x388d62d]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003389c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10033859
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x3c], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100338c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xf6
mov dword [ebp - 8], 0
jmp 0x100338e2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2e
jge 0x10033921
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x74c5974c]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003391c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100338d9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x2e], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10033940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x12
mov dword [ebp - 8], 0
jmp 0x10033962
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x22
jge 0x100339a1
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x5c5639ac]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1003399c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10033959
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x22], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x100339c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x26
mov dword [ebp - 8], 0
jmp 0x100339e2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x29
jge 0x10033a21
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x6bc6184e]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10033a1c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x100339d9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x29], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4