joyce8/EMBER2024-capa huggingface dataset:
Function at 0x87f420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
push ebx
mov ebx, dword [eax + 4]
xor eax, eax
test ebx, ebx
setne al
push esi
mov esi, ecx
test eax, eax
je 0x87f5cb
lea ecx, [ebp + 8]
push ecx
lea edx, [ebx + 0xc]
push edx
mov ecx, esi
call fcn.0087f300
test eax, eax
je 0x87f5cb
mov eax, dword [ebx + 4]
sub eax, dword [ebp + 8]
mov ecx, dword [esi + 0x518]
lea edx, [eax + ecx + 5]
push edi
lea eax, [ebp + 8]
push eax
lea ecx, [ebx + 0x18]
push ecx
mov ecx, esi
mov dword [ebp - 0xc], edx
call fcn.0087f300
test eax, eax
je 0x87f4d5
mov ecx, dword [esi + 0x51c]
mov edi, dword [ebp + 8]
cmp ecx, edi
je 0x87f4d5
test ecx, ecx
je 0x87f4a4
mov eax, dword [esi + 0x520]
test eax, eax
je 0x87f4a4
push eax
call fcn.008f64c0
mov edi, dword [ebp + 8]
add esp, 4
cmp edi, 0x1000000
ja 0x87f4ba
push edi
call fcn.008f6480
mov edi, dword [ebp + 8]
add esp, 4
jmp 0x87f4bc
xor eax, eax
xor edx, edx
test eax, eax
setne dl
mov dword [esi + 0x520], eax
mov eax, edx
test eax, eax
je 0x87f4d5
mov dword [esi + 0x51c], edi
test eax, eax
mov edi, dword [esi + 0x520]
je 0x87f5ca
lea eax, [ebp - 4]
push eax
lea ecx, [ebx + 0x24]
push ecx
mov ecx, esi
call fcn.0087f300
test eax, eax
je 0x87f585
lea edx, [ebp - 8]
push edx
lea eax, [ebx + 0x30]
push eax
mov ecx, esi
call fcn.0087f300
test eax, eax
je 0x87f585
mov ecx, dword [ebp - 8]
cmp dword [esi + 0x51c], ecx
sbb eax, eax
inc eax
je 0x87f5ca
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
push ecx
push edi
push eax
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.008e7020
test eax, eax
je 0x87f5ca
mov eax, dword [ebp - 8]
test eax, eax
jbe 0x87f55f
mov dl, byte [edi]
mov ecx, eax
and ecx, 7
ror dl, cl
add edi, 1
xor dl, al
add dl, al
xor dl, al
ror dl, cl
sub eax, 1
test eax, eax
mov byte [edi - 1], dl
ja 0x87f541
lea eax, [ebp - 8]
push eax
lea ecx, [ebx + 0x3c]
push ecx
mov ecx, esi
call fcn.0087f300
test eax, eax
je 0x87f585
lea edx, [ebp - 0x10]
push edx
add ebx, 0x48
push ebx
mov ecx, esi
call fcn.0087f300
test eax, eax
jne 0x87f590
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x520]
add eax, dword [esi + 0x51c]
mov ecx, dword [ebp - 0x10]
lea edx, [ecx + edi]
cmp eax, edx
sbb eax, eax
inc eax
je 0x87f5ca
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
push ecx
push edi
push eax
mov ecx, esi
mov dword [ebp - 8], eax
call fcn.008e7020
test eax, eax
je 0x87f5ca
mov dword [esi + 0x518], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x8849f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
call fcn.008e7df0
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp edi, dword [esi + 0x518]
ja 0x884a18
cmp edi, dword [esi + 0x51c]
jae 0x884a9d
movzx ax, byte [esi + 0x523]
mov dl, byte [esi + 0x522]
add dl, byte [esi + 0x520]
shl ax, 8
add ax, word [esi + 0x520]
xor ecx, ecx
mov ch, ah
lea eax, [ebp - 4]
push eax
push edi
mov cl, dl
mov word [esi + 0x520], cx
mov ecx, esi
call fcn.008e8e40
test eax, eax
je 0x884abf
movzx ecx, byte [esi + 0x524]
add byte [esi + 0x526], cl
movzx ecx, byte [esi + 0x521]
mov al, byte [esi + 0x526]
mov dl, byte [ebp - 4]
add cl, al
add cl, byte [esi + 0x520]
sub dl, cl
and al, 7
je 0x884a84
movzx ecx, al
rol dl, cl
xor dl, byte [esi + 0x525]
mov ecx, esi
mov byte [ebp - 4], dl
mov edx, dword [ebp - 4]
push edx
push edi
call fcn.008e8790
test eax, eax
je 0x884abf
add edi, 1
sub ebx, 1
jne 0x884a04
mov ecx, esi
call fcn.008e7e10
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x88f290
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x6d7a68]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x40
lea eax, [ebp - 0x44]
push eax
mov esi, ecx
mov ecx, dword [esi + 0x1b4]
push 0
push 0
call fcn.008d5400
cmp eax, 0x40
jae 0x88f2d1
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067de1d
mov esp, ebp
pop ebp
ret
mov ax, word [ebp - 0x44]
cmp ax, 0x5a4d
je 0x88f2e1
cmp ax, 0x4d5a
jne 0x88f2c0
mov ax, word [ebp - 0x42]
test ax, ax
push edi
je 0x88f2fe
movzx ecx, word [ebp - 0x40]
movzx edx, ax
shl ecx, 9
lea edi, [ecx + edx - 0x200]
jmp 0x88f305
movzx edi, word [ebp - 0x40]
shl edi, 9
mov ecx, dword [esi + 0x1b4]
push 4
lea eax, [ebp - 0x48]
push eax
push 0
push edi
mov dword [ebp - 0x48], 0
call fcn.008d5400
cmp dword [ebp - 0x48], 0x4034b50
jne 0x88f33c
lea eax, [edi + 4]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067de1d
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov ecx, dword [esi + 0x1b4]
push 0x34
lea edi, [ebp - 0x98]
push edi
xor edx, edx
push edx
push eax
call fcn.008d5400
cmp eax, 0x34
jb 0x88f3ae
cmp word [ebp - 0x98], 0x454e
jne 0x88f391
test dword [ebp - 0x8c], 0x8000
jne 0x88f391
mov ecx, edi
push ecx
lea edx, [ebp - 0x44]
push edx
mov ecx, esi
call fcn.0088d790
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067de1d
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
mov ecx, dword [esi + 0x1b4]
push 0x18
lea edi, [ebp - 0x64]
push edi
xor edx, edx
push edx
push eax
call fcn.008d5400
cmp eax, 0x18
jae 0x88f3c0
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067de1d
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x64], 0x4550
jne 0x88f3f1
test dword [ebp - 0x4e], 0x2000
jne 0x88f3f1
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x44]
push ecx
mov ecx, esi
call fcn.0088d9d0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067de1d
mov esp, ebp
pop ebp
ret
mov ecx, esi
call fcn.0088d700
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0067de1d
mov esp, ebp
pop ebp
ret
Function at 0x8913b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x6d7a68]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movzx edx, word [eax + 2]
push esi
mov esi, ecx
movzx ecx, word [eax]
mov word [ebp - 0x2e], dx
movzx edx, word [eax + 6]
mov word [ebp - 0x30], cx
movzx ecx, word [eax + 4]
mov word [ebp - 0x2a], dx
movzx edx, word [eax + 0xa]
mov word [ebp - 0x2c], cx
movzx ecx, word [eax + 8]
mov word [ebp - 0x26], dx
mov edx, dword [eax + 0x10]
mov word [ebp - 0x28], cx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x20], edx
movzx edx, word [eax + 0x18]
mov dword [ebp - 0x24], ecx
mov ecx, dword [eax + 0x14]
mov dword [ebp - 0x1c], ecx
movzx ecx, word [eax + 0x1a]
mov word [ebp - 0x18], dx
movzx edx, word [eax + 0x1c]
mov word [ebp - 0x16], cx
movzx ecx, word [eax + 0x1e]
mov word [ebp - 0x14], dx
movzx edx, word [eax + 0x20]
mov word [ebp - 0x12], cx
mov ecx, dword [eax + 0x24]
mov word [ebp - 0x10], dx
mov edx, dword [eax + 0x28]
sub edx, dword [esi + 0x34]
push 0x2e
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0xe], ecx
mov ecx, dword [esi + 0x2c]
push 0
push ecx
mov ecx, dword [esi + 0x38]
mov dword [ebp - 0x34], 0x2014b50
mov dword [ebp - 0xa], edx
call fcn.008d5540
cmp eax, 0x2e
je 0x891471
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0067de1d
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
add dword [esi + 0x2c], 0x2e
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0067de1d
mov esp, ebp
pop ebp
ret 4

Function at 0x894340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00894210
Function at 0x8bf2c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [esi + 0x20]
mov dword [ebp - 8], edi
jmp 0x8bf2d3
mov edi, dword [ebp - 8]
mov eax, dword [esi + 0x60]
mov ebx, dword [esi + 0x30]
mov ecx, dword [esi + 0x68]
sub ebx, eax
sub ebx, ecx
mov dword [ebp - 4], ebx
jne 0x8bf2f2
test eax, eax
jne 0x8bf300
test ecx, ecx
jne 0x8bf300
mov dword [ebp - 4], edi
jmp 0x8bf370
cmp ebx, 0xffffffff
jne 0x8bf300
mov dword [ebp - 4], 0xfffffffe
jmp 0x8bf370
mov ecx, dword [esi + 0x20]
lea edx, [edi + ecx - 0x106]
cmp eax, edx
jb 0x8bf370
mov eax, dword [esi + 0x2c]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.0067cc20
mov edx, dword [esi + 0x40]
mov eax, dword [esi + 0x38]
sub dword [esi + 0x64], edi
sub dword [esi + 0x60], edi
add esp, 0xc
sub dword [esi + 0x50], edi
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x8bf340
sub eax, edi
jmp 0x8bf342
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x8bf331
mov ecx, dword [esi + 0x34]
mov edx, edi
lea ecx, [ecx + edi*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x8bf361
sub eax, edi
jmp 0x8bf363
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x8bf352
add ebx, edi
mov dword [ebp - 4], ebx
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x8bf40f
mov eax, dword [esi + 0x68]
add eax, dword [esi + 0x60]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x2c]
mov edx, dword [ebp - 4]
mov ebx, ecx
cmp ebx, edx
mov dword [ebp - 0xc], eax
jbe 0x8bf396
mov ebx, edx
test ebx, ebx
je 0x8bf3d0
mov edx, dword [edi + 0x18]
sub ecx, ebx
mov dword [edi + 4], ecx
cmp dword [edx + 0x14], 0
jne 0x8bf3be
mov eax, dword [edi]
mov ecx, dword [edi + 0x20]
push ebx
push eax
push ecx
call fcn.008e21d0
mov dword [edi + 0x20], eax
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov edx, dword [edi]
push ebx
push edx
push eax
call fcn.0067cc20
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x68], ebx
mov edi, dword [esi + 0x68]
cmp edi, 3
jb 0x8bf3fb
mov eax, dword [esi + 0x60]
mov ecx, dword [esi + 0x2c]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x4c]
mov dword [esi + 0x3c], eax
movzx edx, byte [edx + 1]
shl eax, cl
xor eax, edx
and eax, dword [esi + 0x48]
mov dword [esi + 0x3c], eax
cmp edi, 0x106
jae 0x8bf40f
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x8bf2d0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8c94f0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
pop ebp
ret
Function at 0x8ce400
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
lea eax, [esi + 0x1c]
push 0
push eax
mov dword [esi + 0x6c], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.0067e0a0
xor eax, eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
add esp, 0xc
mov dword [esi + 0x68], eax
pop esi
ret

Function at 0x8cebb0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
lea eax, [esi + 0x1c]
push 0
push eax
mov dword [esi], 0x6cfd7c
mov dword [esi + 0x6c], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.0067e0a0
xor eax, eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
add esp, 0xc
mov eax, esi
pop esi
ret

Function at 0x8cf4a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push 0x40
lea eax, [esi + 0x1c]
push 0
push eax
mov dword [esi], 0x6cfd7c
mov dword [esi + 0x6c], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.0067e0a0
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor eax, eax
add esp, 0xc
mov dword [esi + 0x5c], eax
push ecx
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
push edx
mov ecx, esi
mov dword [esi + 0x68], eax
call fcn.008cf2f0
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x8d08b0
Capabilities:
Hash data using ripemd320
Hash data using sha1

Disassembly:
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x14], 0x76543210
mov dword [ecx + 0x18], 0xfedcba98
mov dword [ecx + 0x1c], 0x89abcdef
mov dword [ecx + 0x20], 0x1234567
mov dword [ecx + 0x24], 0x3c2d1e0f
mov dword [ecx + 0x68], 0
ret
Function at 0x8d1b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [edi + 8]
xor esi, dword [eax + 8]
mov edx, dword [edi + 4]
xor ebx, dword [edi]
xor edx, dword [eax + 4]
mov dword [ebp - 0xc], esi
mov esi, dword [edi + 0xc]
xor esi, dword [eax + 0xc]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
add edi, 0x20
mov dword [ebp - 0x14], 0xf
jmp 0x8d1bb0
mov eax, ebx
shr eax, 0x10
movzx esi, bh
and eax, 0xff
mov eax, dword [ecx + eax*4 + 0x810]
xor eax, dword [ecx + esi*4 + 0x410]
mov esi, ebx
shr esi, 0x18
xor eax, dword [ecx + esi*4 + 0xc10]
movzx esi, byte [ebp - 2]
mov esi, dword [ecx + esi*4 + 0xc10]
and ebx, 0xff
xor eax, dword [ecx + ebx*4 + 0x10]
movzx ebx, dh
xor esi, dword [ecx + ebx*4 + 0x810]
mov ebx, edx
and edx, 0xff
shr ebx, 0x18
xor esi, dword [ecx + ebx*4 + 0x10]
add edi, 4
xor esi, dword [ecx + edx*4 + 0x410]
mov edx, dword [ebp - 8]
rol edx, 1
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0xc]
lea ebx, [esi + eax]
add ebx, dword [edi - 4]
add edi, 4
xor edx, ebx
lea ebx, [eax + esi*2]
add ebx, dword [edi - 4]
add edi, 4
xor ebx, dword [ebp - 0x18]
ror edx, 1
mov dword [ebp - 0x18], edx
movzx eax, byte [ebp - 0x16]
mov eax, dword [ecx + eax*4 + 0x810]
movzx esi, dh
xor eax, dword [ecx + esi*4 + 0x410]
mov esi, edx
mov dword [ebp - 0xc], edx
and edx, 0xff
shr esi, 0x18
xor eax, dword [ecx + esi*4 + 0xc10]
movzx esi, bh
xor eax, dword [ecx + edx*4 + 0x10]
mov edx, ebx
shr edx, 0x10
and edx, 0xff
mov dword [ebp - 0x1c], esi
mov esi, dword [ecx + edx*4 + 0xc10]
mov edx, dword [ebp - 0x1c]
xor esi, dword [ecx + edx*4 + 0x810]
mov edx, ebx
shr edx, 0x18
xor esi, dword [ecx + edx*4 + 0x10]
mov edx, dword [ebp - 4]
mov dword [ebp - 8], ebx
and ebx, 0xff
xor esi, dword [ecx + ebx*4 + 0x410]
mov ebx, dword [ebp - 0x10]
rol edx, 1
mov dword [ebp - 0x1c], edx
lea edx, [esi + eax]
add edx, dword [edi - 4]
sub edi, 4
xor ebx, edx
lea edx, [eax + esi*2]
add edx, dword [edi + 4]
xor edx, dword [ebp - 0x1c]
ror ebx, 1
sub dword [ebp - 0x14], 1
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], ebx
jne 0x8d1bb0
mov ecx, dword [ebp + 0xc]
mov esi, dword [ecx + 0x10]
xor esi, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov esi, dword [ecx + 0x14]
xor esi, dword [ebp - 8]
pop edi
mov dword [eax + 4], esi
mov esi, dword [ecx + 0x18]
xor esi, ebx
mov dword [eax + 8], esi
mov ecx, dword [ecx + 0x1c]
xor ecx, edx
pop esi
mov dword [eax + 0xc], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x8d1d00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [edi + 0x18]
xor esi, dword [eax + 8]
mov edx, dword [edi + 0x10]
mov ebx, dword [edi + 0x14]
xor edx, dword [eax]
xor ebx, dword [eax + 4]
mov dword [ebp - 8], esi
mov esi, dword [edi + 0x1c]
xor esi, dword [eax + 0xc]
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], esi
add edi, 0x9c
mov dword [ebp - 0x14], 0xf
nop
movzx eax, byte [ebp - 2]
mov eax, dword [ecx + eax*4 + 0x810]
movzx esi, dh
xor eax, dword [ecx + esi*4 + 0x410]
shr edx, 0x18
xor eax, dword [ecx + edx*4 + 0xc10]
mov edx, dword [ebp - 4]
and edx, 0xff
xor eax, dword [ecx + edx*4 + 0x10]
mov edx, ebx
shr edx, 0x10
and edx, 0xff
movzx esi, bh
mov dword [ebp - 0x18], esi
mov esi, dword [ecx + edx*4 + 0xc10]
mov edx, dword [ebp - 0x18]
xor esi, dword [ecx + edx*4 + 0x810]
mov edx, ebx
shr edx, 0x18
xor esi, dword [ecx + edx*4 + 0x10]
mov edx, dword [ebp - 8]
and ebx, 0xff
xor esi, dword [ecx + ebx*4 + 0x410]
rol edx, 1
lea ebx, [eax + esi*2]
add ebx, dword [edi]
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0xc]
xor edx, ebx
lea ebx, [esi + eax]
add ebx, dword [edi - 4]
sub edi, 4
xor ebx, dword [ebp - 0x18]
sub edi, 4
mov eax, ebx
shr eax, 0x10
movzx esi, bh
ror edx, 1
and eax, 0xff
mov eax, dword [ecx + eax*4 + 0x810]
xor eax, dword [ecx + esi*4 + 0x410]
mov dword [ebp - 8], ebx
mov esi, dword [ebp - 8]
shr ebx, 0x18
xor eax, dword [ecx + ebx*4 + 0xc10]
and esi, 0xff
xor eax, dword [ecx + esi*4 + 0x10]
mov dword [ebp - 0x18], edx
movzx esi, byte [ebp - 0x16]
mov esi, dword [ecx + esi*4 + 0xc10]
movzx ebx, dh
xor esi, dword [ecx + ebx*4 + 0x810]
mov ebx, edx
mov dword [ebp - 0xc], edx
and edx, 0xff
shr ebx, 0x18
xor esi, dword [ecx + ebx*4 + 0x10]
mov ebx, dword [ebp - 0x10]
xor esi, dword [ecx + edx*4 + 0x410]
mov edx, dword [ebp - 4]
rol edx, 1
mov dword [ebp - 4], edx
lea edx, [eax + esi*2]
add edx, dword [edi]
sub edi, 4
xor ebx, edx
lea edx, [esi + eax]
add edx, dword [edi]
add edi, 4
xor edx, dword [ebp - 4]
ror ebx, 1
sub dword [ebp - 0x14], 1
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], ebx
jne 0x8d1d40
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
xor esi, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov esi, dword [eax + 4]
xor esi, dword [ebp - 0x18]
pop edi
mov dword [ecx + 4], esi
mov esi, dword [eax + 8]
xor esi, edx
mov dword [ecx + 8], esi
mov eax, dword [eax + 0xc]
xor eax, ebx
pop esi
mov dword [ecx + 0xc], eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x8d2d80
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x10]
xor eax, eax
lea esp, [esp]
mov byte [eax + ecx], al
add eax, 1
cmp eax, 0x100
jl 0x8d2d90
push ebx
push esi
push edi
xor dl, dl
xor edi, edi
xor esi, esi
mov al, byte [edi + ecx]
mov ebx, dword [ebp + 8]
movzx edx, dl
movzx ebx, byte [edx + ebx]
mov byte [ebp - 1], al
movzx eax, al
add ebx, esi
add eax, ebx
and eax, 0x800000ff
jns 0x8d2dcb
dec eax
or eax, 0xffffff00
inc eax
movzx esi, al
movzx eax, byte [esi + ecx]
mov byte [edi + ecx], al
movzx eax, byte [ebp - 1]
mov byte [esi + ecx], al
lea eax, [edx + 1]
cdq
idiv dword [ebp + 0xc]
add edi, 1
cmp edi, 0x100
jl 0x8d2da6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x8d2ee0
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
push 0x40
lea eax, [esi + 0x2c]
push 0
push eax
mov dword [esi + 0x8c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 4], 0x6a09e667
mov dword [esi + 8], 0xbb67ae85
mov dword [esi + 0xc], 0x3c6ef372
mov dword [esi + 0x10], 0xa54ff53a
mov dword [esi + 0x14], 0x510e527f
mov dword [esi + 0x18], 0x9b05688c
mov dword [esi + 0x1c], 0x1f83d9ab
mov dword [esi + 0x20], 0x5be0cd19
call fcn.0067e0a0
xor eax, eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], eax
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], eax
add esp, 0xc
mov dword [esi + 0x88], eax
pop esi
ret
Function at 0x8d3730
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
push 0x80
lea eax, [esi + 0x58]
push edi
push eax
mov dword [esi + 0x118], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 8], 0xf3bcc908
mov dword [esi + 0xc], 0x6a09e667
mov dword [esi + 0x10], 0x84caa73b
mov dword [esi + 0x14], 0xbb67ae85
mov dword [esi + 0x18], 0xfe94f82b
mov dword [esi + 0x1c], 0x3c6ef372
mov dword [esi + 0x20], 0x5f1d36f1
mov dword [esi + 0x24], 0xa54ff53a
mov dword [esi + 0x28], 0xade682d1
mov dword [esi + 0x2c], 0x510e527f
mov dword [esi + 0x30], 0x2b3e6c1f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0xfb41bd6b
mov dword [esi + 0x3c], 0x1f83d9ab
mov dword [esi + 0x40], 0x137e2179
mov dword [esi + 0x44], 0x5be0cd19
call fcn.0067e0a0
push 0x40
push edi
add esi, 0xd8
push esi
call fcn.0067e0a0
add esp, 0x18
pop edi
pop esi
ret
Function at 0x8d65f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x384]
cmp eax, dword [ebp + 0x10]
mov esi, dword [edi + 0x380]
jg 0x8d669e
jl 0x8d661b
cmp esi, dword [ebp + 0xc]
ja 0x8d669e
mov ebx, dword [ebp + 8]
mov edx, dword [edi + 0x388]
movzx eax, byte [ebx + 1]
xor ecx, ecx
add edx, esi
adc ecx, dword [edi + 0x384]
mov dword [ebp - 8], edx
cdq
add eax, dword [ebp + 0xc]
adc edx, dword [ebp + 0x10]
cmp edx, ecx
jg 0x8d669e
jl 0x8d6647
cmp eax, dword [ebp - 8]
ja 0x8d669e
movzx eax, byte [ebx + 1]
xor esi, esi
test eax, eax
jle 0x8d6690
mov ecx, dword [edi + 0x384]
mov eax, dword [edi + 0x380]
mov dword [ebp - 4], ecx
lea ecx, [edi + 0x348]
mov dword [ebp - 8], eax
call fcn.008d7d90
mov eax, dword [edi + 0x350]
mov dl, byte [ebx + esi + 2]
sub eax, dword [ebp - 8]
xor dl, byte [ebp + 0x14]
add eax, dword [ebp + 0xc]
add esi, 1
mov byte [eax + esi - 1], dl
movzx ecx, byte [ebx + 1]
cmp esi, ecx
jl 0x8d6651
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x8d88c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov esi, ecx
xor edi, edi
xor ecx, ecx
cmp dword [esi + 0x48], edi
jbe 0x8d88f1
mov eax, dword [esi + 0x38]
cmp dword [eax + ecx*4], edi
lea eax, [eax + ecx*4]
je 0x8d88e9
mov eax, dword [eax]
mov dword [eax + 0x1c], edi
mov dword [eax + 0x18], edi
mov dword [eax + 0x20], edi
add ecx, 1
cmp ecx, dword [esi + 0x48]
jb 0x8d88d3
mov ecx, dword [esi + 0x40]
cmp ecx, edi
je 0x8d88ff
mov edx, dword [ecx]
mov eax, dword [edx + 0x24]
call eax
mov ecx, dword [esi + 0x3c]
cmp ecx, edi
je 0x8d890b
call fcn.008db780
lea eax, [esi + 0x78]
lea ecx, [ebp - 8]
cmp ecx, eax
je 0x8d891a
mov dword [eax], edi
mov dword [eax + 4], edi
lea eax, [esi + 0x70]
lea edx, [ebp - 8]
cmp edx, eax
je 0x8d8929
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x80], edi
pop edi
mov byte [esi + 0x88], 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x8d9d40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x8d9d6a
xor eax, eax
cmp word [esi + 0x3c], ax
jbe 0x8d9d6a
mov cl, byte [ebp + 8]
mov edx, dword [esi + 4]
xor byte [edx + eax], cl
add edx, eax
movzx edx, word [esi + 0x3c]
add eax, 1
cmp eax, edx
jl 0x8d9d57
pop esi
pop ebp
ret 4

Function at 0x8e2010
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
test ecx, ecx
mov eax, dword [ebp + 8]
je 0x8e2040
mov edx, dword [ebp + 0xc]
push esi
push edi
movzx esi, byte [edx]
movzx edi, al
xor esi, edi
shr eax, 8
xor eax, dword [esi*4 + 0x6d2fd8]
sub ecx, 1
add edx, 1
test ecx, ecx
jne 0x8e2022
pop edi
pop esi
pop ebp
ret