joyce8/EMBER2024-capa huggingface dataset:
Function at 0x386100d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x38610108
mov edx, dword [ebp + 0xc]
cmp edx, 4
jb 0x38610108
mov ecx, 0
and edx, 0xfffffffc
jbe 0x38610100
push edi
mov edi, dword [ebp + 0x10]
mov eax, ecx
xor eax, edi
xor dword [ecx + esi], eax
add ecx, 4
cmp ecx, edx
jb 0x386100f1
pop edi
mov eax, 1
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x38619fa0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, ecx
push ebx
push esi
push edi
mov esi, dword [eax + 4]
mov dword [eax + 0x20], 0
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], esi
movzx edi, word [esi + 6]
mov dword [ebp - 0x18], edi
test edi, edi
je 0x3861a0f0
cmp edi, 0x7fff
ja 0x3861a0f0
mov edx, dword [eax + 0x2c]
lea ecx, [esi + 0x1400]
movzx ebx, word [esi + 0x14]
xor eax, eax
add ebx, 0x18
mov dword [ebp - 0x10], ecx
mov ecx, dword [esi + 0xdc10]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
test edi, edi
je 0x3861a0c3
sub esi, ecx
lea edi, [ebx + ecx]
mov dword [ebp - 0x1c], esi
cmp ebx, 0x3d8
ja 0x3861a013
add esi, edi
jmp 0x3861a036
mov eax, dword [ebp - 0x10]
mov esi, eax
push 0x28
push eax
push edi
push dword [ebp - 0x14]
call 0x37e6b7f0
add esp, 0x10
cmp eax, 0x28
jne 0x3861a0c3
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
add ebx, 0x28
add edi, 0x28
test dword [esi + 0x24], 0x20000000
je 0x3861a0b0
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
test ecx, ecx
je 0x3861a0ad
cmp ecx, edx
jae 0x3861a0ad
test eax, eax
je 0x3861a0ad
cmp eax, edx
jae 0x3861a0ad
sub edx, ecx
cmp eax, edx
jbe 0x3861a063
mov eax, edx
add eax, ecx
cmp eax, ecx
jbe 0x3861a0ad
mov esi, dword [ebp - 0xc]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov eax, 0x1fffffff
mov ecx, dword [esi + 0x20]
sar ecx, 3
sub eax, ecx
cmp eax, 1
jb 0x3861a0db
push 8
lea eax, [ecx*8]
push 0
push eax
lea ecx, [esi + 0x1c]
call fcn.38624fc0
test eax, eax
je 0x3861a0db
lea ecx, [ebp - 0x24]
push ecx
lea edx, [eax + 8]
push edx
push eax
lea ecx, [esi + 0x1c]
call fcn.38622210
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
inc eax
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp eax, dword [ebp - 0x18]
jb 0x3861a007
mov eax, dword [ebp - 0xc]
test dword [eax + 0x20], 0xfffffff8
lea ecx, [eax + 0x1c]
je 0x3861a0f0
call fcn.38625f40
test al, al
jne 0x3861a0e7
pop edi
pop esi
mov eax, 0x80000041
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x8000004c
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x3861c7f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
cmp ecx, 4
jb 0x3861c819
shr ecx, 2
xor eax, eax
test ecx, ecx
je 0x3861c819
mov edx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
jmp 0x3861c810
xor dword [esi + eax*4], edx
inc eax
cmp eax, ecx
jb 0x3861c810
pop esi
pop ebp
ret

Function at 0x3861c820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
xor eax, eax
test edx, edx
je 0x3861c841
push ebx
mov bl, byte [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
xor byte [eax + esi], bl
lea ecx, [eax + esi]
inc eax
cmp eax, edx
jb 0x3861c834
pop esi
pop ebx
pop ebp
ret

Function at 0x3861df40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
xor eax, eax
test ecx, ecx
je 0x3861df5e
mov edx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
xor dword [eax + esi], edx
add eax, 4
cmp eax, ecx
jb 0x3861df53
pop esi
pop ebp
ret

Function at 0x3861df60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
xor eax, eax
test edx, edx
je 0x3861df81
push ebx
mov bl, byte [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
xor byte [eax + esi], bl
lea ecx, [eax + esi]
inc eax
cmp eax, edx
jb 0x3861df74
pop esi
pop ebx
pop ebp
ret
Function at 0x3861f020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor bl, bl
xor edx, edx
test esi, esi
je 0x3861f062
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x18]
jmp 0x3861f040
lea ecx, [ebx + eax]
and eax, 0xffffff00
movzx ecx, cl
or ecx, eax
mov eax, dword [ebp + 0xc]
xor byte [eax + edx], cl
mov bl, byte [eax + edx]
lea eax, [ecx + edi]
inc edx
rol eax, 8
cmp edx, esi
jb 0x3861f040
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret

Function at 0x386288e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jne 0x386288f5
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x14], 0
push ebx
push esi
je 0x386289fa
cmp dword [ebp + 0x18], 0
je 0x386289fa
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], 0
cmp ecx, dword [ebx + 0xdc14]
jae 0x386289e1
cmp edi, 0x800
jbe 0x38628940
mov esi, 0x800
mov dword [ebp - 0xc], esi
jmp 0x38628945
mov esi, edi
mov dword [ebp - 0xc], edi
push 1
push ebx
call 0x37ac3a70
add esp, 8
test ax, ax
jne 0x386289fa
lea eax, [ebx + 0x1400]
push esi
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
push ebx
call 0x37e6b7f0
add esp, 0x10
cmp eax, esi
jne 0x386289fa
test esi, esi
je 0x386289a9
mov ecx, dword [ebp - 0x10]
mov ebx, esi
mov edi, dword [ebp - 8]
mov esi, dword [ebp + 0x14]
mov eax, edi
lea ecx, [ecx + 1]
xor edx, edx
inc edi
div dword [ebp + 0x18]
mov al, byte [edx + esi]
xor byte [ecx - 1], al
sub ebx, 1
jne 0x38628987
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], edi
mov edi, dword [ebp + 0x10]
push esi
lea eax, [ebx + 0x1400]
push eax
push dword [ebp - 4]
push ebx
call 0x37e6b820
add esp, 0x10
cmp eax, esi
jne 0x386289fa
add dword [ebp - 4], esi
mov eax, esi
mov ecx, dword [ebp + 0xc]
sub edi, esi
not eax
mov dword [ebp + 0x10], edi
cmp ecx, eax
jae 0x386289fa
add ecx, esi
mov dword [ebp + 0xc], ecx
test edi, edi
jne 0x38628922
push dword [ebp - 0x14]
push ebx
call 0x37e6b760
add esp, 8
cmp eax, 1
sete al
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
pop esi
pop ebx
xor al, al
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x3864d9b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
movzx esi, word [edi + 0x14]
add esi, 0x18
cmp esi, 0x3d8
ja 0x3864da2f
mov ecx, 0x400
mov eax, 0xcccccccd
sub ecx, esi
mul ecx
movzx ecx, word [edi + 6]
shr edx, 5
mov ebx, ecx
cmp edx, ecx
ja 0x3864d9e6
movzx ebx, dx
xor eax, eax
lea edx, [esi + edi]
xor ecx, ecx
mov dword [ebp + 8], edx
cmp ax, bx
jae 0x3864da2f
mov edi, dword [ebp + 0xc]
jmp 0x3864da00
movzx eax, cx
lea eax, [eax + eax*4]
lea esi, [edx + eax*8]
mov edx, dword [esi + 0x14]
test edx, edx
je 0x3864da1d
cmp edx, edi
jae 0x3864da1d
mov eax, dword [esi + 0x10]
add eax, edx
cmp eax, edi
ja 0x3864da28
inc ecx
cmp cx, bx
jae 0x3864da2f
mov edx, dword [ebp + 8]
jmp 0x3864da00
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x3864ec30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov cl, byte [eax]
mov bl, byte [eax + 1]
xor eax, eax
test esi, esi
je 0x3864ec60
movzx ecx, cl
push edi
mov edi, dword [ebp + 0xc]
and ecx, 7
mov dl, byte [eax + edi]
xor dl, bl
ror dl, cl
mov byte [eax + edi], dl
inc eax
cmp eax, esi
jb 0x3864ec50
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x38677a20
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
jmp 0x38677a30
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x38677a30
xor bh, bh
xor edi, edi
nop
mov eax, edi
mov bl, byte [edi + esi]
xor edx, edx
div dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
movzx eax, byte [edx + eax]
add al, bl
add bh, al
movzx ecx, bh
movzx eax, byte [ecx + esi]
mov byte [edi + esi], al
inc edi
mov byte [ecx + esi], bl
cmp edi, 0x100
jl 0x38677a40
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x38677a70
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor esi, esi
xor bh, bh
xor cl, cl
cmp dword [ebp + 0x10], esi
jle 0x38677abf
push edi
mov edi, dword [ebp + 8]
inc bh
movzx edx, bh
mov bl, byte [edx + edi]
add cl, bl
mov byte [ebp - 1], cl
movzx ecx, cl
movzx eax, byte [ecx + edi]
mov byte [edx + edi], al
mov byte [ecx + edi], bl
movzx ecx, byte [edx + edi]
movzx eax, bl
add ecx, eax
movzx eax, cl
mov ecx, dword [ebp + 0xc]
movzx eax, byte [eax + edi]
xor byte [esi + ecx], al
inc esi
mov cl, byte [ebp - 1]
cmp esi, dword [ebp + 0x10]
jl 0x38677a85
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x3867d3d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp esi, ecx
jb 0x3867d4a2
cmp esi, edx
jae 0x3867d4a2
movzx eax, byte [esi]
movzx ecx, word [eax*2 + 0x7428fa8]
movzx eax, byte [esi + 1]
movzx edx, byte [ecx + eax + 0x74291a8]
test edx, edx
jne 0x3867d318
push esi
call 0x37e8a7b0
add esp, 4
mov edx, eax
cmp edx, 0xffffffff
je 0x3867d3a9
movzx ebx, byte [esi]
lea ecx, [ebx - 0x81]
cmp ecx, 0x7e
ja 0x3867d488
movzx eax, byte [ecx + 0x7c1ba38]
jmp dword [eax*4 + 0x7c1ba1c]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call 0x37ac2614
mov esp, ebp
pop ebp
ret
add byte [ebx + 0xf01c47d], al
test dword [ebp - 0x48000000], ebp
call 0xc167d3e4
inc ebp
shr cl, 1
mov al, byte [0x8a000000]
inc esi
add dword [eax + eax*2], edi
jae 0x3867d488
test al, 0x38
jne 0x3867d488
cmp dword [ebp - 0x34], 0
je 0x3867d488
movzx eax, al
and eax, 7
mov dword [ebp - 0x38], eax
jmp 0x3867d488
add esi, edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x40]
inc eax
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x30], eax
cmp eax, 0x3e8
jb 0x3867d2e2
mov eax, dword [ebp - 0x44]
push eax
push edi
call 0x37ea3270
add esp, 8
test eax, eax
je 0x3867d3a9
cmp eax, dword [edi + 0xdc14]
jae 0x3867d3a9
push 8
lea ecx, [ebp - 0x5c]
push ecx
push eax
push edi
call 0x37e6b7f0
mov eax, dword [ebp - 0x5c]
add esp, 0x10
xor eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x28]
cmp eax, 0x81ec8b55
jne 0x3867d3a9
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call 0x37ac2614
mov esp, ebp
pop ebp
ret
Function at 0x3868ace0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 8], ebx
mov edx, dword [ebx]
cmp word [edx + 0xdc4c], 0
jne 0x3868af36
cmp dword [edx], 0x4550
jne 0x3868af36
mov eax, 0x14c
cmp word [edx + 4], ax
jne 0x3868af36
mov eax, 0x10b
cmp word [edx + 0x18], ax
jne 0x3868af36
mov eax, 0x2000
test word [edx + 0x16], ax
jne 0x3868af36
movzx eax, word [edx + 0x5c]
cmp eax, 2
je 0x3868ad49
cmp eax, 3
jne 0x3868af36
mov eax, dword [edx + 0xdc6c]
cmp dword [eax + 0x2c0], 0
jne 0x3868af36
push 1
push edx
call 0x37fb8c60
add esp, 8
test eax, eax
jne 0x3868af36
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebx]
call 0x37fb8e60
add esp, 0x10
test eax, eax
jne 0x3868af36
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x3868af36
mov edi, dword [ebp - 4]
cmp edi, 0x200
jb 0x3868af36
cmp edi, 0xc00
jbe 0x3868adb5
mov edi, 0xc00
mov dword [ebp - 4], edi
mov esi, 0x7c2478c
lea ebx, [ebx]
cmp byte [esi + 5], 0
movzx ecx, byte [esi + 4]
mov eax, dword [esi]
push ecx
push eax
push edi
push ebx
je 0x3868add7
call 0x37e62750
jmp 0x3868addc
call 0x37e62660
add esp, 0x10
test eax, eax
je 0x3868ae3e
add esi, 8
cmp esi, 0x7c247ac
jne 0x3868adc0
mov dword [ebp - 0xc], 0
mov esi, 0x7c247ac
lea ebx, [ebx]
cmp byte [esi + 5], 0
movzx ecx, byte [esi + 4]
mov eax, dword [esi]
push ecx
push eax
push edi
push ebx
je 0x3868ae17
call 0x37e62750
jmp 0x3868ae1c
call 0x37e62660
add esp, 0x10
test eax, eax
je 0x3868ae33
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, 2
jae 0x3868af3f
add esi, 8
cmp esi, 0x7c247cc
jne 0x3868ae00
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 4]
push 0x40000
mov dword [ebp - 0xc], esi
push dword [edi]
call 0x37fb8c60
add esp, 8
test eax, eax
jne 0x3868af36
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [edi]
call 0x37fbae00
add esp, 0xc
test eax, eax
jne 0x3868af36
mov edx, dword [ebp - 0x14]
mov dword [ebp - 8], edx
test edx, edx
je 0x3868af36
cmp dword [ebp - 0x18], esi
jb 0x3868af36
mov ah, byte [ebx]
mov edi, edx
mov edx, dword [ebp - 0xc]
mov esi, 1
jmp 0x3868aea0
mov cl, byte [esi + ebx]
lea edi, [edi + 1]
mov al, cl
inc esi
xor al, ah
mov ah, cl
mov byte [edi - 1], al
cmp esi, edx
jb 0x3868aea0
lea eax, [edx - 1]
mov esi, 0x7c247cc
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp byte [esi + 5], 0
movzx edi, byte [esi + 4]
mov ecx, dword [esi]
push edi
push ecx
push eax
push edx
je 0x3868aed9
call 0x37e62750
jmp 0x3868aede
call 0x37e62660
add esp, 0x10
test eax, eax
je 0x3868af36
mov edx, dword [ebp - 8]
add esi, 8
mov eax, dword [ebp - 0xc]
cmp esi, 0x7c247ec
jne 0x3868aec2
xor edi, edi
mov esi, 0x7c247ec
mov ebx, edx
nop
cmp byte [esi + 5], 0
movzx ecx, byte [esi + 4]
mov eax, dword [esi]
push ecx
push eax
push dword [ebp - 0xc]
push ebx
je 0x3868af19
call 0x37e62750
jmp 0x3868af1e
call 0x37e62660
add esp, 0x10
test eax, eax
je 0x3868af2b
inc edi
cmp edi, 2
jae 0x3868af3f
add esi, 8
cmp esi, 0x7c2480c
jne 0x3868af00
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x38692f10
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push ebx
mov dword [ebp - 0x10], esi
call fcn.386917a0
push ebx
call fcn.38690750
add esp, 8
cmp dword [ebp + 0x10], esi
jbe 0x38693554
mov ebx, dword [ebp + 0xc]
push edi
lea esp, [esp]
mov edi, esi
and edi, 0xfffffff0
cmp edi, dword [ebp - 0x10]
je 0x38692f63
push 1
push dword [ebp + 8]
call 0x37ac3a70
add esp, 8
test ax, ax
jne fcn.38693550
mov dword [ebp - 0x10], edi
mov dl, byte [esi + ebx]
lea edi, [esi + ebx]
movzx eax, dl
movzx ecx, word [eax*2 + 0x7428fa8]
movzx eax, byte [edi + 1]
movzx eax, byte [ecx + eax + 0x74291a8]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x38692f95
push edi
call 0x37e8a7b0
mov dl, byte [edi]
add esp, 4
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov dword [ebp - 8], 0
mov dword [ebp - 4], ecx
cmp eax, 1
jge 0x38692fad
mov dword [ebp - 0xc], 1
movzx edx, dl
lea eax, [edx - 0x33]
cmp eax, 0xcc
ja 0x38693544
movzx eax, byte [eax + 0x7c319a4]
jmp dword [eax*4 + 0x7c3196c]
add esi, dword [ebp - 0xc]
cmp esi, dword [ebp + 0x10]
jb 0x38692f40
Function at 0x38696f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x7076dbc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xb4], eax
test edi, edi
je 0x3869713f
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x3869713f
mov dword [ebp - 0x10], 0x6e756628
lea ecx, [ebp - 0x88]
mov dword [ebp - 0xb0], ecx
lea ecx, [ebp - 0x44]
mov dword [ebp - 0xa8], ecx
lea ecx, [ebp - 0x58]
mov dword [ebp - 0xa0], ecx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x98], ecx
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x90], ecx
mov esi, edi
mov dword [ebp - 0xc], 0x6f697463
mov ecx, ebx
mov byte [ebp - 8], 0x6e
mov dword [ebp - 0x20], 0x70612e29
mov dword [ebp - 0x1c], 0x646e6570
mov dword [ebp - 0x18], 0x6c696843
mov word [ebp - 0x14], 0x2864
mov dword [ebp - 0x88], 0x7974732e
mov dword [ebp - 0x84], 0x702e656c
mov dword [ebp - 0x80], 0x7469736f
mov dword [ebp - 0x7c], 0x206e6f69
mov dword [ebp - 0x78], 0x6127203d
mov dword [ebp - 0x74], 0x6c6f7362
mov dword [ebp - 0x70], 0x27657475
mov dword [ebp - 0x44], 0x7974732e
mov dword [ebp - 0x40], 0x622e656c
mov dword [ebp - 0x3c], 0x6564726f
mov dword [ebp - 0x38], 0x203d2072
mov byte [ebp - 0x34], 0x27
mov dword [ebp - 0x58], 0x7974732e
mov dword [ebp - 0x54], 0x682e656c
mov dword [ebp - 0x50], 0x68676965
mov dword [ebp - 0x4c], 0x203d2074
mov byte [ebp - 0x48], 0x27
mov dword [ebp - 0x30], 0x7974732e
mov dword [ebp - 0x2c], 0x772e656c
mov dword [ebp - 0x28], 0x68746469
mov dword [ebp - 0x24], 0x27203d20
mov dword [ebp - 0x6c], 0x75636f64
mov dword [ebp - 0x68], 0x746e656d
mov dword [ebp - 0x64], 0x6972772e
mov dword [ebp - 0x60], 0x27286574
mov dword [ebp - 0x5c], 0x7669643c
mov dword [ebp - 0xac], 0x1c
mov dword [ebp - 0xa4], 0x11
mov dword [ebp - 0x9c], 0x11
mov dword [ebp - 0x94], 0x10
mov dword [ebp - 0x8c], 0x14
cmp ebx, 0xe
jb 0x3869713f
lea edx, [ebx - 9]
test edx, edx
je 0x3869713f
lea ebx, [ebx]
push ecx
push esi
push 9
lea ecx, [ebp - 0x10]
push ecx
push eax
call 0x37e79b30
mov esi, eax
add esp, 0x14
test esi, esi
je 0x3869713f
mov edx, esi
lea ecx, [ebx - 0xe]
sub edx, edi
cmp edx, ecx
ja 0x3869713f
mov eax, edi
sub eax, esi
add eax, ebx
cmp eax, 0x1f4
jbe 0x38697106
mov eax, 0x1f4
jmp 0x3869710b
cmp eax, 0xe
jb 0x3869713f
push eax
push esi
push 0xe
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0xb4]
call 0x37e79b30
add esp, 0x14
test eax, eax
jne 0x38697152
add esi, 9
lea edx, [ebx - 9]
mov ecx, edi
mov eax, esi
sub ecx, esi
sub eax, edi
add ecx, ebx
cmp eax, edx
mov eax, dword [ebp - 0xb4]
jb 0x386970d0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call 0x37abc614
mov esp, ebp
pop ebp
ret
push 5
lea ecx, [ebp - 0xb0]
sub eax, esi
push ecx
push eax
push esi
push dword [ebp - 0xb4]
call fcn.38696ee0
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop edi
pop esi
pop ebx
call 0x37abc614
mov esp, ebp
pop ebp
ret
Function at 0x386d3690
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0x40
push 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
add eax, 0x28
push eax
call fcn.3862d010
add esp, 0xc
pop ebp
ret

Function at 0x386d39a0
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0x40
push 0
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x20], 0
mov dword [eax + 0x24], 0
add eax, 0x28
push eax
call fcn.3862d010
add esp, 0xc
pop ebp
ret
Function at 0x386e82e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add esi, ebx
mov dword [ebp - 4], esi
cmp esi, edx
jae 0x386e8292
lea ecx, [ecx]
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x386e828f
inc esi
cmp esi, edx
jb 0x386e8280
mov dword [ebp - 4], esi
mov ebx, esi
sub ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, edi
cmp esi, edx
jae 0x386e83ba
cmp ecx, 3
jbe 0x386e82d2
xor eax, eax
mov cl, byte [esi + 4]
mov edi, ebx
mov dword [ebp - 0x10], edi
jge 0x386e82a2
test cl, cl
je 0x386e8310
cmp cl, 0xff
je 0x386e8310
mov edx, dword [ebp + 0xc]
and eax, 3
mov esi, dword [ebp + 8]
add eax, eax
mov ecx, 1
or eax, 1
add ebx, ecx
jmp 0x386e8274
dec ecx
shl eax, cl
and eax, 7
je 0x386e82aa
cmp byte [eax + 0x744f628], 0
je 0x386e82fd
add byte [edx + ebx + 0xf], dh
mov dh, 0x88
xor dh, dh
inc esp
pop es
movzx ecx, byte [eax + 0x744f630]
mov edx, esi
sub edx, ecx
mov cl, byte [edx + 4]
test cl, cl
je 0x386e82fa
cmp cl, 0xff
jne 0x386e82aa
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
and eax, 3
add eax, eax
mov edi, ebx
or eax, 1
inc ebx
jmp 0x386e8274
movzx edi, cl
movzx ecx, byte [esi + 3]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 2]
shl edi, 8
or edi, ecx
movzx ecx, byte [esi + 1]
mov esi, dword [ebp + 0x10]
shl edi, 8
or edi, ecx
cmp dword [ebp + 0x18], 0
je 0x386e833e
lea edx, [edi + ebx]
add edx, esi
jmp 0x386e8344
mov edx, edi
sub edx, ebx
sub edx, esi
test eax, eax
je 0x386e8382
movzx edi, byte [eax + 0x744f630]
mov ecx, 0x18
shl edi, 3
sub ecx, edi
mov dword [ebp - 0xc], edi
mov edi, edx
shr edi, cl
mov ecx, edi
mov dword [ebp - 8], edi
test cl, cl
je 0x386e836e
cmp cl, 0xff
jne 0x386e8382
mov ecx, 0x20
mov edi, 1
sub ecx, dword [ebp - 0xc]
shl edi, cl
dec edi
xor edi, edx
jmp 0x386e8331
mov esi, dword [ebp - 4]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 1
neg cl
mov byte [esi + 1], dl
mov byte [esi + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, edx
mov edx, dword [ebp + 0xc]
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, 5
mov esi, dword [ebp + 8]
add ebx, ecx
jmp 0x386e8274
pop edi
pop esi
cmp ecx, 3
jbe 0x386e83cf
mov ecx, dword [ebp + 0x14]
xor eax, eax
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
dec ecx
shl eax, cl
mov ecx, dword [ebp + 0x14]
and eax, 7
mov dword [ecx], eax
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003271
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov eax, 0x6b
mov word [ebp - 0x24], ax
mov ecx, 0x65
mov word [ebp - 0x22], cx
mov edx, 0x72
mov word [ebp - 0x20], dx
mov eax, 0x6e
mov word [ebp - 0x1e], ax
mov ecx, 0x65
mov word [ebp - 0x1c], cx
mov edx, 0x6c
mov word [ebp - 0x1a], dx
mov eax, 0x33
mov word [ebp - 0x18], ax
mov ecx, 0x32
mov word [ebp - 0x16], cx
mov edx, 0x2e
mov word [ebp - 0x14], dx
mov eax, 0x64
mov word [ebp - 0x12], ax
mov ecx, 0x6c
mov word [ebp - 0x10], cx
mov edx, 0x6c
mov word [ebp - 0xe], dx
xor eax, eax
mov word [ebp - 0xc], ax
mov dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x10003325
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.10003201
add esp, 8
cmp eax, 0
mov eax, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x100032fe
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003331
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
push ebp
push edi
mov edi, ecx
mov ebp, edx
test edi, edi
je 0x1000334c
test ebp, ebp
je 0x1000334c
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x10003354
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x10], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp ecx, ebx
ja 0x10003394
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x18], eax
test eax, eax
je 0x100033f0
mov ecx, ebx
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x100033eb
mov eax, dword [esp + 0x14]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100033d6
test dl, dl
je 0x100033d2
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100033d6
add ecx, 2
add eax, 2
test dl, dl
jne 0x100033b6
xor eax, eax
jmp 0x100033db
sbb eax, eax
or eax, 1
test eax, eax
je 0x100033fa
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
inc esi
cmp esi, eax
jb 0x100033a3
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x14
ret