joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415c9c
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x58
call fcn.00403218
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x883638
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x883655
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x883646
add dl, dl
jne 0x883660
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8836ac
xor eax, eax
add dl, dl
jne 0x88366d
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x883749
add dl, dl
jne 0x88367c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x883687
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x883692
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x88369d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8836a7
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x88364c
mov eax, 1
add dl, dl
jne 0x8836ba
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8836c5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8836b1
sub eax, 2
jne 0x8836f4
mov ecx, 1
add dl, dl
jne 0x8836da
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x8836e5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8836d1
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x88364c
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x88370b
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x883716
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x883702
cmp eax, 0x7d00
jae 0x883739
cmp eax, 0x500
jb 0x883734
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x88364c
cmp eax, 0x7f
ja 0x88373c
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x88364c
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x883765
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x88364c
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x912786
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [ecx + 0x48]
and ecx, 0x20000
jmp 0x9127d4
mov ecx, dword [ecx + 0x48]
and ecx, 0x40000
jmp 0x9127d4
mov eax, dword [esp + 4]
mov edx, 0x365
cmp eax, edx
jbe 0x9a0c45
mov edx, 0x4e4
cmp eax, edx
ja 0x9a0d9e
je 0x9127ee
sub eax, 0x36a
je 0x9a0d90
sub eax, 0x3a
je 0x90c043
sub eax, 4
je 0x91277b
sub eax, 0xd
je 0x9127e3
dec eax
jne 0x9a0d6c
mov ecx, dword [ecx + 0x48]
and ecx, 0x100000
xor eax, eax
or ecx, eax
jne 0x9a0e02
xor eax, eax
ret 4
mov ecx, dword [ecx + 0x48]
and ecx, 0x80000
jmp 0x9127d4
mov ecx, dword [ecx + 0x48]
and ecx, 1
jmp 0x9127d4
je 0x9a0d5a
add edx, 0xfffffff4
cmp eax, edx
ja 0x9a0cf0
je 0x9a0ce5
sub eax, 0x1b5
je 0x9a0cda
sub eax, 0x10f
je 0x9a0ccc
sub eax, 0x1d
je 0x9a0cbe
sub eax, 0x26
je 0x9a0cb0
sub eax, 0x4b
je 0x9a0ca2
dec eax
dec eax
je 0x9a0c94
sub eax, 3
jne 0x9127de
mov ecx, dword [ecx + 0x4c]
and ecx, 0x2000000
jmp 0x9a0d63
mov ecx, dword [ecx + 0x4c]
and ecx, 0x4000000
jmp 0x9a0d63
mov ecx, dword [ecx + 0x4c]
and ecx, 0x40000000
jmp 0x9a0d63
mov ecx, dword [ecx + 0x4c]
and ecx, 0x8000000
jmp 0x9a0d63
mov ecx, dword [ecx + 0x4c]
and ecx, 0x10000000
jmp 0x9a0d63
mov ecx, dword [ecx + 0x4c]
and ecx, 0x20000000
jmp 0x9a0d63
mov ecx, dword [ecx + 0x4c]
and ecx, 0x80000000
jmp 0x9a0d63
mov ecx, dword [ecx + 0x4c]
and ecx, 0x1000000
jmp 0x9a0d63
sub eax, 0x35c
je 0x9a0d4f
dec eax
je 0x9a0d44
dec eax
je 0x9a0d39
dec eax
je 0x9a0d2e
dec eax
je 0x9a0d23
dec eax
je 0x9a0d18
dec eax
jne 0x9127de
mov ecx, dword [ecx + 0x4c]
and ecx, 0x20000
jmp 0x9a0d63
mov ecx, dword [ecx + 0x4c]
and ecx, 0x40000
jmp 0x9a0d63
mov ecx, dword [ecx + 0x4c]
and ecx, 0x80000
jmp 0x9a0d63
mov ecx, dword [ecx + 0x4c]
and ecx, 0x100000
jmp 0x9a0d63
mov ecx, dword [ecx + 0x4c]
and ecx, 0x200000
jmp 0x9a0d63
mov ecx, dword [ecx + 0x4c]
and ecx, 0x400000
jmp 0x9a0d63
mov ecx, dword [ecx + 0x4c]
and ecx, 0x800000
jmp 0x9a0d63
mov ecx, dword [ecx + 0x4c]
and ecx, 0x10000
xor eax, eax
or eax, ecx
jmp 0x9127d8
sub eax, 0x12c
je 0x9a0d85
dec eax
jne 0x9127de
mov ecx, dword [ecx + 0x48]
and ecx, 4
jmp 0x9127d4
mov ecx, dword [ecx + 0x48]
and ecx, 2
jmp 0x9127d4
mov ecx, dword [ecx + 0x48]
and ecx, 0x10000
jmp 0x9127d4
sub eax, 0x4e5
je 0x9a0df7
dec eax
je 0x9a0dec
dec eax
je 0x9a0de1
dec eax
je 0x9a0dd6
dec eax
je 0x9a0dc8
sub eax, 0x68
jne 0x9127de
mov ecx, dword [ecx + 0x48]
and ecx, 0x200000
jmp 0x9127d4
mov ecx, dword [ecx + 0x48]
and ecx, 0x80
jmp 0x9127d4
mov ecx, dword [ecx + 0x48]
and ecx, 0x40
jmp 0x9127d4
mov ecx, dword [ecx + 0x48]
and ecx, 0x20
jmp 0x9127d4
mov ecx, dword [ecx + 0x48]
and ecx, 0x10
jmp 0x9127d4
mov ecx, dword [ecx + 0x48]
and ecx, 8
jmp 0x9127d4
xor eax, eax
inc eax
jmp 0x9127e0
Function at 0x9263a9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
and al, 2
sub esp, 0x6c
sub al, 2
neg al
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sbb eax, eax
inc eax
xor ebx, ebx
cmp esi, ebx
mov edi, eax
je 0x926463
neg eax
sbb eax, eax
and eax, 0x16
add eax, esi
push dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
push dword [ebp + 0x14]
push eax
mov eax, edi
neg eax
sbb eax, eax
and eax, 0x16
sub ecx, eax
push ecx
push dword [ebp + 8]
call fcn.00925d12
cmp eax, ebx
mov dword [ebp + 0x18], eax
je 0x926403
cmp edi, ebx
jne 0x9b0619
mov eax, dword [ebp + 0x18]
pop edi
pop esi
pop ebx
leave
ret 0x14
xor eax, eax
jmp 0x9263d6
add dword [ebp + 0x18], 0x16
cmp esi, ebx
je 0x926403
lea eax, [ebp - 0x6c]
mov byte [esi], 0xd7
mov byte [esi + 1], 0xcd
mov byte [esi + 2], 0xc6
mov byte [esi + 3], 0x9a
push eax
mov byte [esi + 4], bl
mov byte [esi + 5], bl
push 0x6c
push dword [ebp + 8]
mov byte [esi + 0x10], bl
mov byte [esi + 0x11], bl
mov byte [esi + 0x12], bl
mov byte [esi + 0x13], bl
call fcn.00a3f8cf
test eax, eax
je 0x9b06c9
fild dword [ebp - 0x24]
fidiv dword [ebp - 0x1c]
fmul dword [0x39859d54]
fiadd dword [ebp - 0x20]
fidiv dword [ebp - 0x18]
fmul dword [0x39859d54]
fmul dword [0x3987fff4]
fild dword [ebp - 0x54]
fmul st(1)
call fcn.009452d5
fild dword [ebp - 0x50]
mov byte [esi + 6], al
mov byte [esi + 7], ah
fmul st(1)
call fcn.009452d5
fild dword [ebp - 0x4c]
mov byte [esi + 8], al
mov byte [esi + 9], ah
fmul st(1)
call fcn.009452d5
fild dword [ebp - 0x48]
mov byte [esi + 0xa], al
mov byte [esi + 0xb], ah
fmul st(1)
call fcn.009452d5
fmul dword [0x3985a5e8]
mov byte [esi + 0xc], al
mov byte [esi + 0xd], ah
call fcn.009452d5
mov byte [esi + 0xe], al
mov byte [esi + 0xf], ah
jmp 0x9b06ec
mov byte [esi + 6], bl
mov byte [esi + 7], bl
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov byte [esi + 0xa], 0xd0
mov byte [esi + 0xb], 7
mov byte [esi + 0xc], 0xd0
mov byte [esi + 0xd], 7
mov byte [esi + 0xe], 0x60
mov byte [esi + 0xf], bl
lea edx, [esi + 0x14]
cmp esi, edx
mov ecx, esi
mov dword [ebp + 8], ebx
mov ax, bx
jae 0x9b0704
xor ax, word [ecx]
inc ecx
inc ecx
cmp ecx, edx
jb 0x9b06fb
mov word [ecx], ax
jmp 0x926403
Function at 0x9386e8
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, dword [esi + 8]
test eax, eax
jne 0x9c7c99
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
test eax, eax
je 0x9c7cd3
cmp eax, 2
je 0x93872e
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x9c7ca1
jmp 0x92efc7
lea ebx, [ebx]
jmp 0x92efc7
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x93870e
push esi
call fcn.009389db
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x9c7c89
mov dword [esi + 0x14], 0xcb
mov ecx, dword [esi + 0x14]
cmp ecx, 0xcb
jne 0x9c7cd9
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
jne 0x92f0ae
mov eax, dword [esi + 0x94]
mov dword [esi + 0x9c], eax
call fcn.0093a478
pop esi
ret 4
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret 4
push esi
call dword [eax]
jmp 0x92efd2
cmp eax, 3
je 0x9c7caf
cmp eax, 1
jne 0x92efc7
mov eax, dword [ecx + 4]
inc eax
mov edx, eax
mov dword [ecx + 4], eax
mov eax, dword [ecx + 8]
cmp edx, eax
jl 0x92efc7
mov edx, dword [esi + 0x144]
add edx, eax
mov dword [ecx + 8], edx
jmp 0x92efc7
xor eax, eax
pop esi
ret 4
cmp ecx, 0xcc
je 0x9c7cf0
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
push esi
mov dword [eax + 0x18], ecx
call dword [eax]
call fcn.0093a478
pop esi
ret 4

Function at 0x93a478
Capabilities:
Check for software breakpoints

Disassembly:
cmp dword [esi + 0x14], 0xcc
je 0x93a49b
mov eax, dword [esi + 0x1a8]
push esi
call dword [eax]
mov dword [esi + 0x8c], 0
mov dword [esi + 0x14], 0xcc
mov ecx, dword [esi + 0x1a8]
mov eax, dword [ecx + 8]
test eax, eax
jne 0x9c7b93
mov edx, dword [esi + 0x44]
xor eax, eax
test edx, edx
setne al
add eax, 0xcd
mov dword [esi + 0x14], eax
mov eax, 1
ret
mov eax, dword [esi]
push esi
mov dword [eax + 0x14], 0x30
call dword [eax]
mov edx, dword [esi + 0x1a8]
mov eax, dword [edx + 8]
test eax, eax
jne 0x9c7b93
jmp 0x93a4ac
Function at 0x952453
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cx, word [eax]
push 9
pop edx
mov dword [ebp + 8], ecx
lea ecx, [eax + 2]
mov ax, word [ebp + 8]
xor ax, word [ecx]
inc ecx
inc ecx
dec edx
jne 0x95246b
pop ebp
ret 4

Function at 0x966c7c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebx + 0x24]
push esi
mov dword [ebp - 8], edx
push edi
mov ecx, dword [ebx + 0x64]
mov eax, dword [ebx + 0x34]
mov esi, dword [ebx + 0x6c]
sub eax, ecx
sub eax, esi
mov dword [ebp - 4], eax
je 0x9c691e
cmp eax, 0xffffffff
je 0x9c6935
mov esi, dword [ebx + 0x24]
lea esi, [edx + esi - 0x106]
cmp ecx, esi
jae 0x9c693d
mov esi, dword [ebx]
cmp dword [esi + 4], 0
mov dword [ebp - 0xc], esi
je 0x966d69
mov edi, dword [ebx + 0x6c]
add edi, dword [ebx + 0x64]
mov ecx, dword [esi + 4]
add edi, dword [ebx + 0x30]
cmp ecx, eax
mov dword [ebp - 4], ecx
ja 0x9c69a5
cmp dword [ebp - 4], 0
je 0x9c69ad
sub ecx, dword [ebp - 4]
mov eax, dword [esi + 0x1c]
mov dword [esi + 4], ecx
cmp dword [eax + 0x18], 0
jne 0x966d0d
push dword [ebp - 4]
push dword [esi]
push dword [esi + 0x30]
call fcn.00962838
mov edx, dword [ebp - 8]
mov dword [esi + 0x30], eax
mov ecx, dword [ebp - 4]
mov esi, dword [esi]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov eax, dword [ebp - 0xc]
add dword [eax], ecx
add dword [eax + 8], ecx
add dword [ebx + 0x6c], ecx
mov edi, dword [ebx + 0x6c]
cmp edi, 3
jb 0x966d55
mov eax, dword [ebx + 0x64]
mov ecx, dword [ebx + 0x30]
lea esi, [ecx + eax]
movzx eax, byte [esi]
mov ecx, dword [ebx + 0x50]
mov dword [ebx + 0x40], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [ebx + 0x4c]
mov dword [ebx + 0x40], eax
cmp edi, 0x106
jae 0x966d69
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x966c8a
pop edi
pop esi
leave
ret
test ecx, ecx
jne 0x966ca9
test esi, esi
jne 0x966ca9
mov eax, edx
jmp 0x966cbb
push 0xfffffffffffffffe
pop eax
jmp 0x966cbb
mov edi, dword [ebx + 0x30]
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea esi, [edx + edi]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx + 0x44]
mov eax, dword [ebx + 0x3c]
sub dword [ebx + 0x68], edx
sub dword [ebx + 0x64], edx
sub dword [ebx + 0x54], edx
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx esi, word [eax]
mov edi, esi
sub edi, edx
cmp esi, edx
sbb esi, esi
not esi
and esi, edi
dec ecx
mov word [eax], si
jne 0x9c6965
mov eax, dword [ebx + 0x38]
mov esi, edx
lea eax, [eax + edx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edi, ecx
sub edi, edx
cmp ecx, edx
sbb ecx, ecx
not ecx
and ecx, edi
dec esi
mov word [eax], cx
jne 0x9c6984
mov eax, dword [ebp - 4]
add eax, edx
jmp 0x966cbb
mov dword [ebp - 4], eax
jmp 0x966ce1
xor ecx, ecx
jmp 0x966d2a
Function at 0x967f6e
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
test edx, edx
je 0x9c6826
mov eax, dword [esp + 0xc]
cmp eax, 8
push ebx
push esi
mov esi, dword [esp + 0xc]
not esi
mov ecx, 0xff
jb 0x96803d
push edi
mov edi, eax
shr edi, 3
xor ebx, ebx
mov bl, byte [edx]
sub eax, 8
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x3986a2a8]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x3986a2a8]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x3986a2a8]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x3986a2a8]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x3986a2a8]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x3986a2a8]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x3986a2a8]
xor ebx, ebx
inc edx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x3986a2a8]
inc edx
dec edi
jne 0x967f9a
pop edi
test eax, eax
je 0x968057
xor ebx, ebx
mov bl, byte [edx]
xor ebx, esi
and ebx, ecx
shr esi, 8
xor esi, dword [ebx*4 + 0x3986a2a8]
inc edx
dec eax
jne 0x968041
mov eax, esi
pop esi
not eax
pop ebx
ret 0xc
xor eax, eax
jmp 0x96805d
Function at 0x980df6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov cx, word [ebp + 0x14]
or word [eax + 0x84], 0xffff
push ebx
push esi
push edi
mov word [eax + 0x32], cx
mov cx, word [ebp + 0x10]
xor edx, edx
mov word [eax + 0x20], cx
push 9
pop ecx
mov ebx, 0x39883120
mov esi, ebx
lea edi, [eax + 0x44]
rep movsd dword es:[edi], dword [esi]
movzx ecx, word [ebp + 0x14]
mov esi, dword [ebp + 0xc]
imul ecx, ecx, 0x38
mov byte [eax], 0x47
mov byte [eax + 1], 0x44
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x1c], 3
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x6c], edx
mov dword [eax + 0x70], edx
mov dword [eax + 0x68], edx
mov word [eax + 0x22], 0x7fff
mov word [eax + 0x24], 0x7fff
mov word [eax + 0x26], 0x8000
mov word [eax + 0x28], 0x8000
mov word [eax + 0x86], dx
mov dword [eax + 0x88], edx
mov word [eax + 0x2a], dx
mov word [eax + 0x2e], dx
mov dword [eax + 0x34], 2
mov dword [eax + 0x38], edx
mov word [eax + 0x3c], dx
mov word [eax + 0x3e], dx
mov word [eax + 0x40], dx
mov word [eax + 0x42], dx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov dword [eax + 0x80], edx
mov esi, dword [esi + 8]
add ecx, esi
push 9
mov dword [eax + 0x8c], ecx
mov word [ecx + 0x28], dx
pop ecx
mov esi, ebx
lea edi, [eax + 0x90]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword [eax + 0xb4], 1
pop ebx
pop ebp
ret 0x10
Function at 0x9e5883
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
mov eax, dword [ebp + 8]
je 0x9e58b3
push esi
mov esi, dword [ebp + 0x10]
xor edx, edx
mov dl, byte [eax]
shr esi, 8
xor edx, dword [ebp + 0x10]
and edx, 0xff
xor esi, dword [edx*4 + 0x398e7b00]
inc eax
dec ecx
mov dword [ebp + 0x10], esi
jne 0x9e5891
pop esi
mov eax, dword [ebp + 0x10]
pop ebp
ret 0xc
Function at 0xa1d644
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push esi
movzx esi, byte [eax]
lea ecx, [eax + 1]
movzx eax, byte [ecx]
xor edx, edx
shl esi, 8
push edi
mov edi, dword [0x39995008]
inc edx
add esi, eax
cmp edi, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
jb 0xa1d7f0
mov eax, dword [0x39994ffc]
push ebx
mov ecx, dword [ebp - 8]
add ecx, edi
shr ecx, 1
movzx edx, byte [eax + ecx*8 - 8]
movzx ebx, byte [eax + ecx*8 - 7]
shl edx, 8
add edx, ebx
cmp edx, esi
jae 0xa1d69e
lea edx, [ecx + 1]
mov dword [ebp - 8], edx
jmp 0xa1d6a3
jbe 0xa1d6a8
lea edi, [ecx - 1]
cmp edi, dword [ebp - 8]
jae 0xa1d67c
cmp edi, dword [ebp - 8]
jb 0xa1d7ef
mov ebx, dword [ebp - 0xc]
lea ecx, [eax + ecx*8]
mov esi, dword [ecx - 4]
mov edi, dword [ecx + 4]
add esi, eax
add edi, eax
mov al, byte [ebx]
mov dword [ebp - 8], 0xffff
mov dword [ebp - 0x10], 1
mov byte [ebp - 1], al
jmp 0xa1d7e7
mov eax, dword [ebp + 8]
cmp ebx, dword [eax]
jae 0xa1d7ef
jmp 0xa1d754
mov al, byte [ebp - 1]
mov ecx, dword [ebp - 8]
and al, 0x7f
movzx ax, al
inc ecx
imul eax, ecx
inc dword [ebp - 0x10]
mov dword [ebp - 8], eax
movzx eax, byte [ebp - 1]
inc ebx
cmp dword [eax*4 + 0x399901e8], 2
mov al, byte [ebx]
mov byte [ebp - 1], al
jl 0xa1d754
test al, al
je 0xa1d75a
mov eax, dword [ebp + 8]
cmp ebx, dword [eax]
jae 0xa1d75a
movzx eax, byte [ebp - 1]
mov eax, dword [eax*4 + 0x399901e8]
cdq
push 2
pop ecx
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 1
jne 0xa1d754
mov eax, dword [ebp + 8]
mov eax, dword [eax]
add eax, 0xfffffffe
cmp ebx, eax
ja 0xa1d75a
cmp byte [ebx + 1], 0xec
je 0xa1d754
cmp ebx, eax
je 0xa1d75a
cmp byte [ebx + 2], 0xec
jne 0xa1d75a
cmp byte [ebp - 1], 0x7f
ja 0xa1d6e6
cmp esi, edi
jae 0xa1d7da
mov ecx, dword [ebp - 0x10]
push 2
pop edx
mov ax, word [esi]
cmp cx, ax
je 0xa1d789
jb 0xa1d7da
cmp esi, edi
jae 0xa1d7da
cmp al, 2
jne 0xa1d77a
add esi, edx
jmp 0xa1d783
add esi, edx
movzx eax, word [esi]
lea esi, [esi + eax*2 + 2]
cmp esi, edi
jb 0xa1d764
jmp 0xa1d7da
add esi, edx
cmp cx, dx
jne 0xa1d79b
push edx
push dword [ebp + 0xc]
call fcn.00a1ca86
jmp 0xa1d7da
xor eax, eax
mov ax, word [esi]
add esi, edx
test ax, ax
mov dword [ebp - 0xc], eax
jbe 0xa1d7da
mov ax, word [esi]
cmp word [ebp - 8], ax
je 0xa1d7c7
jbe 0xa1d7d3
add dword [ebp - 0xc], 0xffff
inc esi
inc esi
cmp word [ebp - 0xc], 0
ja 0xa1d7aa
jmp 0xa1d7da
movzx eax, cx
push eax
push dword [ebp + 0xc]
call fcn.00a1ca86
movzx eax, word [ebp - 0xc]
lea esi, [esi + eax*2]
cmp byte [ebp - 1], 0x80
jb 0xa1d7ef
mov eax, dword [ebp + 8]
cmp ebx, dword [eax]
ja 0xa1d7ef
cmp esi, edi
jb 0xa1d6d9
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0xa3d6f2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0xa3d720
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0xa3d727
cmp ebx, dword [eax + 4]
jae 0xa3d727
xor eax, eax
jmp 0xa3d917
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0xa3d738
xor eax, eax
inc eax
jmp 0xa3d916
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0xa3d74e
cmp ecx, edx
jae 0xa3d893
cmp dword [eax + 4], 0
je 0xa3d757
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0xa3d73f
cmp dword [ebp + 8], 0
je 0xa3d779
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0xa3d893
cmp eax, esi
jae 0xa3d893
mov eax, dword [0x39995390]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0xa3d79e
cmp dword [esi*4 + 0x39995398], edi
je 0xa3d897
inc esi
cmp esi, eax
jl 0xa3d78c
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x39801034]
test eax, eax
je 0xa3d913
cmp dword [ebp - 8], 0x1000000
jne 0xa3d913
test byte [ebp - 0xc], 0xcc
je 0xa3d81c
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0xa3d913
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0xa3d913
cmp word [eax + 0x18], 0x10b
jne 0xa3d913
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0xa3d913
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0xa3d81c
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0xa3d81c
test byte [ecx + 0x27], 0x80
jne 0xa3d893
push 1
push 0x399953d8
call dword [0x398010ac]
test eax, eax
jne 0xa3d730
mov ecx, dword [0x39995390]
test ecx, ecx
mov edx, ecx
jle 0xa3d850
lea eax, [ecx*4 + 0x39995394]
cmp dword [eax], edi
je 0xa3d850
dec edx
sub eax, 4
test edx, edx
jg 0xa3d844
test edx, edx
jne 0xa3d881
push 0xf
pop ebx
cmp ecx, ebx
jg 0xa3d85d
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0xa3d875
lea eax, [edx*4 + 0x39995398]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0xa3d863
cmp ecx, 0x10
jge 0xa3d881
inc ecx
mov dword [0x39995390], ecx
push 0
push 0x399953d8
call dword [0x398010ac]
jmp 0xa3d730
xor eax, eax
jmp 0xa3d916
test esi, esi
jle 0xa3d730
mov ebx, dword [0x398010ac]
push 1
push 0x399953d8
call ebx
test eax, eax
jne 0xa3d730
cmp dword [esi*4 + 0x39995398], edi
je 0xa3d8ed
mov eax, dword [0x39995390]
lea esi, [eax - 1]
test esi, esi
jl 0xa3d8db
cmp dword [esi*4 + 0x39995398], edi
je 0xa3d8d7
dec esi
jns 0xa3d8cb
test esi, esi
jge 0xa3d8eb
cmp eax, 0x10
jge 0xa3d8e6
inc eax
mov dword [0x39995390], eax
lea esi, [eax - 1]
jmp 0xa3d8ed
je 0xa3d905
xor ecx, ecx
test esi, esi
jl 0xa3d905
lea eax, [ecx*4 + 0x39995398]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0xa3d8f3
push 0
push 0x399953d8
call ebx
jmp 0xa3d730
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0xa6d57e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov al, byte [esi + 0xc]
mov cl, byte [esi]
mov dx, word [esi + 0xe]
push edi
mov byte [ebp - 1], al
push 0x20
pop eax
sub eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov al, 1
shl al, cl
dec al
mov byte [ebp - 3], al
mov ecx, dword [ebp - 8]
mov ebx, dword [ebp + 8]
shr ebx, cl
mov cl, byte [esi]
and bl, al
xor eax, eax
inc eax
shl eax, cl
mov byte [ebp - 2], bl
cmp dx, ax
jne 0xa6d5d8
push edx
mov ecx, esi
call fcn.00a6d473
mov ecx, esi
call fcn.00a6a580
movzx dx, bl
jmp 0xa6d67a
mov cl, byte [ebp - 1]
movzx eax, bl
mov ebx, eax
movzx edi, dx
shl eax, cl
shl ebx, 0xc
add ebx, edi
xor eax, edi
lea edi, [esi + eax*2 + 0x4020]
mov ax, word [edi]
jmp 0xa6d612
movzx ecx, ax
mov ecx, dword [esi + ecx*4 + 0x20]
mov dword [ebp - 0xc], ecx
and ecx, 0xfffff
cmp ebx, ecx
je 0xa6d655
mov eax, dword [ebp - 0xc]
shr eax, 0x14
test ax, ax
jne 0xa6d5f8
push edx
mov ecx, esi
call fcn.00a6d473
xor eax, eax
mov ax, word [esi + 2]
cmp ax, 0xfff
jae 0xa6d659
movzx ecx, word [edi]
inc eax
movzx edx, ax
shl ecx, 0x14
add ecx, ebx
mov dword [esi + edx*4 + 0x20], ecx
mov word [edi], ax
mov cl, byte [esi + 1]
mov word [esi + 2], ax
xor eax, eax
inc eax
shl eax, cl
cmp edx, eax
jl 0xa6d675
inc cl
mov byte [esi + 1], cl
jmp 0xa6d675
mov edx, eax
jmp 0xa6d67a
cmp byte [esi + 0xd], 0
jne 0xa6d675
mov cl, byte [esi]
xor eax, eax
inc eax
shl eax, cl
mov ecx, esi
push eax
call fcn.00a6d473
mov ecx, esi
call fcn.00a6a580
movzx dx, byte [ebp - 2]
mov ecx, dword [ebp + 0xc]
sub dword [ebp + 0x10], ecx
cmp dword [ebp + 0x10], ecx
jl 0xa6d690
shl dword [ebp + 8], cl
mov al, byte [ebp - 3]
jmp 0xa6d5a7
pop edi
mov word [esi + 0xe], dx
pop esi
mov al, 1
pop ebx
leave
ret 0xc

Function at 0xa7176f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
inc eax
xor ecx, ecx
cmp dword [esi + 0xc], ecx
push edi
mov edi, dword [esi + 0x20]
mov dword [ebp - 4], eax
mov dword [esi + 0x18], ebx
je 0xa71794
mov dl, byte [esi + 0x1c]
mov byte [ebx], dl
cmp dword [ebp + 0x10], ecx
jne 0xa717bc
push 0xc
push esi
mov dx, 0x10
call fcn.00a713f3
push 0xc
push esi
mov dx, 0x10
call fcn.00a713f3
cmp dword [esi + 0xc], 0
je 0xa71815
inc dword [esi + 0x18]
jmp 0xa71815
cmp dword [esi + 0x14], eax
jne 0xa717d0
push 0xc
push esi
mov dx, 0x10
mov dword [esi + 0x14], ecx
call fcn.00a713f3
mov edx, dword [esi + 4]
mov ecx, dword [ebp + 0x10]
mov eax, edi
call fcn.00a712b0
test eax, eax
jle 0xa717fb
mov ebx, eax
push dword [ebp - 4]
movzx eax, word [edi]
push esi
call fcn.00a7144e
xor dword [ebp - 4], 1
inc edi
inc edi
dec ebx
jne 0xa717e3
mov ebx, dword [ebp + 0xc]
push 0xc
push esi
mov dx, 0x10
call fcn.00a713f3
cmp dword [esi + 0xc], 0
je 0xa71815
mov eax, dword [esi + 0x18]
mov al, byte [eax]
mov byte [esi + 0x1c], al
mov eax, dword [esi + 0x18]
pop edi
pop esi
sub eax, ebx
pop ebx
leave
ret 0xc