joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404bb0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [0x4c4a00]
sub esp, 0x41c
cmp eax, ecx
push ebx
push ebp
push esi
push edi
jae 0x404d5d
mov ecx, eax
mov esi, eax
sar ecx, 5
and esi, 0x1f
mov edx, dword [ecx*4 + 0x4c4900]
lea edi, [ecx*4 + 0x4c4900]
shl esi, 3
mov dword [esp + 0x24], edi
mov dword [esp + 0x14], esi
mov cl, byte [esi + edx + 4]
test cl, 1
je 0x404d5d
mov ebx, dword [esp + 0x438]
xor ebp, ebp
cmp ebx, ebp
mov dword [esp + 0x10], ebp
mov dword [esp + 0x20], ebp
jne 0x404c1e
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
test cl, 0x20
je 0x404c2f
push 2
push ebp
push eax
call fcn.00404af0
add esp, 0xc
mov eax, dword [edi]
add eax, esi
test byte [eax + 4], 0x80
je 0x404d8e
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x18], 0
test ebx, ebx
mov edi, ebp
jbe 0x404cd9
lea eax, [esp + 0x28]
mov ecx, edi
sub ecx, ebp
cmp ecx, ebx
jae 0x404c8a
mov cl, byte [edi]
inc edi
cmp cl, 0xa
jne 0x404c77
mov esi, dword [esp + 0x20]
mov byte [eax], 0xd
inc esi
inc eax
mov dword [esp + 0x20], esi
mov byte [eax], cl
inc eax
mov edx, eax
lea ecx, [esp + 0x28]
sub edx, ecx
cmp edx, 0x400
jl 0x404c5a
mov esi, eax
lea edx, [esp + 0x28]
lea eax, [esp + 0x1c]
sub esi, edx
mov edx, dword [esp + 0x24]
push 0
push eax
lea ecx, [esp + 0x30]
mov eax, dword [edx]
push esi
push ecx
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx + eax]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404d7f
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
add edx, eax
cmp eax, esi
mov dword [esp + 0x10], edx
jl 0x404cd5
mov eax, edi
sub eax, ebp
cmp eax, ebx
jb 0x404c56
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x404d4e
mov eax, dword [esp + 0x18]
test eax, eax
je 0x404d22
cmp eax, 5
jne 0x404d0b
mov dword [0x4c3624], eax
mov dword [0x4c3620], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
push eax
call fcn.00405240
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov ecx, dword [esp + 0x24]
mov edx, dword [ecx]
test byte [esi + edx + 4], 0x40
je 0x404d42
cmp byte [ebp], 0x1a
jne 0x404d42
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov dword [0x4c3620], 0x1c
jmp 0x404d67
sub eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x41c
ret
mov dword [0x4c3620], 9
pop edi
pop esi
pop ebp
mov dword [0x4c3624], 0
or eax, 0xffffffff
pop ebx
add esp, 0x41c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
jmp 0x404cd5
mov edx, dword [eax]
lea ecx, [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x438]
push ecx
push ebx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404dbf
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], eax
jmp 0x404cd9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], eax
jmp 0x404cd9
Function at 0x1001162d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0xec
mov eax, 0x349bc6c
call fcn.10060e97
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xf8], ebx
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebx], edx
mov dword [ebx + 4], edx
mov eax, dword [ebp + 0xc]
lea edi, [ebx + 0x10]
mov dword [ebx + 8], eax
xor eax, eax
mov word [ebx + 0xc], dx
mov byte [ebx + 0xe], dl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x24], 0xf
mov byte [ebx + 0x10], dl
mov eax, dword [ebp + 0x10]
lea ecx, [ebx + 0x30]
mov byte [ebp - 4], 4
mov dword [ebx + 0x28], eax
lea eax, [ebp + 0x28]
push eax
mov byte [ebx + 0x2c], dl
call fcn.1001bd7f
mov ax, word [ebp + 0x14]
lea ecx, [ebx + 0x4c]
mov word [ebx + 0x48], ax
call fcn.100014c0
xor ecx, ecx
lea eax, [ebx + 0x63]
push 0x2000
push ecx
mov word [ebx + 0x60], cx
push eax
mov byte [ebx + 0x62], 1
call fcn.10061dc0
xor eax, eax
add esp, 0xc
mov dword [ebx + 0x2064], eax
mov dword [ebx + 0x2068], eax
mov dword [ebx + 0x206c], eax
lea eax, [ebp + 0x20]
lea ecx, [ebx + 0x2070]
push eax
call fcn.1001acc3
mov ecx, dword [ebp + 0x1c]
xor edx, edx
mov dword [ebx + 0x2078], edx
mov dword [ebx + 0x207c], edx
test ecx, ecx
je 0x100116f8
lock inc dword [ecx + 4]
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
mov dword [ebx + 0x2078], eax
mov dword [ebx + 0x207c], ecx
lea eax, [ebp - 0xf4]
mov byte [ebp - 4], 9
lea esi, [ebx + 0x2080]
mov dword [ebp - 0xf4], 0x1e
push eax
mov ecx, esi
mov dword [ebp - 0xf0], edx
call fcn.1001d8d5
pop ecx
lea ecx, [ebx + 0x2088]
mov byte [ebp - 4], 0xa
call fcn.1000c2ed
lea edi, [ebx + 0x20a0]
and dword [edi + 0x24], 0
lea eax, [ebx + 0x20c8]
and dword [eax + 0x24], 0
mov byte [ebp - 4], 0xd
lock inc dword [0x34c5580]
xor al, al
lea ecx, [ebx + 0xc]
xchg byte [ecx], al
xor al, al
lea ecx, [ebx + 0xd]
xchg byte [ecx], al
xor al, al
lea ecx, [ebx + 0xe]
xchg byte [ecx], al
xor al, al
lea ecx, [ebx + 0x60]
xchg byte [ecx], al
mov al, 1
lea ecx, [ebx + 0x61]
xchg byte [ecx], al
push 8
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x34233221
push eax
lea ecx, [ebx + 0x4c]
mov dword [ebp - 0x18], 0x32367857
call fcn.100015f2
mov edx, dword [esi]
mov dword [ebp - 0xf4], 0x3431ec9
mov dword [ebp - 0xf0], ebx
mov ecx, dword [edx]
lea eax, [edx + 0x28]
push eax
lea eax, [ebp - 0xf4]
add edx, 8
push eax
push edx
call fcn.10021835
mov ecx, dword [ebx + 0x2078]
lea eax, [ebp - 0xc8]
add ecx, 4
push eax
call fcn.1001b2b1
movzx ecx, word [eax + 2]
push ecx
call 0x1025430e
ret
Function at 0x10030eb3
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov eax, dword [0x34c10e4]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 8], eax
push edi
mov edi, dword [esp + 0x34]
test cl, 7
je 0x10030ee8
push 0xffffffffffffffce
pop eax
jmp 0x10030fbb
test ecx, ecx
je 0x10030fb9
push ebp
push esi
lea ebp, [ecx - 1]
push 8
shr ebp, 3
pop esi
cmp edx, 1
jne 0x10030f55
mov edx, ebx
sub edi, eax
sub edx, eax
inc ebp
mov dword [esp + 0x10], edx
mov ecx, eax
mov dword [esp + 0x18], esi
mov al, byte [edi + ecx]
xor al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
sub esi, 1
jne 0x10030f11
mov ecx, dword [esp + 0x1c]
mov edx, ebx
push ebx
call fcn.10030c69
push 8
pop esi
push esi
push ebx
push dword [esp + 0x20]
call fcn.10061840
mov edx, dword [esp + 0x20]
add esp, 0x10
mov eax, dword [esp + 0x14]
add edx, esi
add ebx, esi
mov dword [esp + 0x10], edx
add edi, esi
sub ebp, 1
jne 0x10030f0b
jmp 0x10030fb7
sub eax, ebx
sub ebx, edi
mov dword [esp + 0x10], eax
inc ebp
push esi
lea eax, [esp + 0x28]
push edi
push eax
call fcn.10061840
mov ecx, dword [esp + 0x28]
lea eax, [ebx + edi]
push eax
mov edx, edi
mov dword [esp + 0x28], eax
call fcn.10030c69
mov ecx, dword [esp + 0x20]
add esp, 0x10
mov edx, dword [esp + 0x18]
mov dword [esp + 0x20], esi
mov al, byte [ecx + edx]
xor byte [edx], al
inc edx
sub esi, 1
jne 0x10030f8c
push 8
pop esi
push esi
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x1c]
call fcn.10061840
sub dword [esp + 0x1c], esi
add esp, 0xc
add edi, esi
sub ebp, 1
jne 0x10030f5e
pop esi
pop ebp
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.100601b3
add esp, 0x20
ret
Function at 0x10034ed2
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
xor esi, esi
mov ebx, ecx
and dword [esp + 0xc], esi
mov ebp, edx
mov dword [esp + 0x10], ebx
push edi
test ebx, ebx
je 0x100350a8
lea eax, [ebx + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [eax]
test eax, eax
je 0x10034f16
push 1
push esi
push dword [esp + 0x2c]
push ebp
push 2
push ebx
call eax
mov esi, eax
add esp, 0x18
test esi, esi
jle 0x100350aa
mov edi, ebx
mov ebx, dword [ebx + 0xc]
test ebx, ebx
jne 0x10034f16
mov ebx, dword [esp + 0x14]
test esi, esi
js 0x10035089
mov eax, dword [edi + 4]
test eax, eax
je 0x10034f49
mov eax, dword [eax + 0x108]
test eax, eax
je 0x10034f49
push dword [esp + 0x24]
push ebp
push edi
call eax
add esp, 0xc
mov esi, eax
cmp byte [edi + 0x44], 7
jne 0x10034f7c
test esi, esi
jle 0x10034f7c
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x10034f7c
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], eax
push ecx
push ebp
mov edx, eax
mov ecx, ebp
call fcn.1004dc46
mov esi, dword [esp + 0x1c]
test eax, eax
pop ecx
pop ecx
push 0xffffffffffffffff
pop eax
cmovne esi, eax
cmp byte [edi + 0x44], 5
jne 0x10034fa6
push dword [esp + 0x24]
lea edx, [esp + 0x1c]
mov ecx, edi
call fcn.100355e8
mov esi, eax
pop ecx
test esi, esi
jle 0x10034fa6
push esi
push dword [esp + 0x1c]
push ebp
call fcn.10061840
add esp, 0xc
cmp byte [edi + 0x44], 4
jne 0x10034fbc
push dword [esp + 0x24]
mov edx, ebp
mov ecx, edi
call fcn.10034e2d
pop ecx
mov esi, eax
cmp byte [edi + 0x44], 6
jne 0x10034fd6
push dword [edi + 0x18]
push dword [esp + 0x28]
push 1
push ebp
call fcn.10068dfb
add esp, 0x10
mov esi, eax
cmp byte [edi + 0x44], 3
jne 0x10035025
cmp dword [ebx + 0x3c], 0
jne 0x10035020
push dword [esp + 0x24]
mov ecx, dword [edi + 0x18]
mov edx, ebp
and dword [edi + 0x40], 0xffffffef
call fcn.1003163e
mov esi, eax
pop ecx
test esi, esi
je 0x10035017
jns 0x10035025
mov ecx, dword [edi + 0x18]
xor edx, edx
call fcn.100317a0
cmp eax, 2
je 0x10035011
cmp eax, 3
jne 0x10035017
or dword [edi + 0x40], 0x10
jmp 0x10035025
mov dword [ebx + 0x3c], 1
jmp 0x10035025
or eax, 0xffffffff
mov esi, eax
cmp byte [edi + 0x44], 8
jne 0x1003506d
test esi, esi
jle 0x1003506d
mov ecx, dword [edi + 0x18]
call fcn.100311d3
cmp eax, 0x357
jne 0x1003505b
test ecx, ecx
je 0x10035054
test ebp, ebp
je 0x10035054
push esi
mov edx, ebp
call fcn.10031059
pop ecx
cmp eax, 1
je 0x1003506d
or eax, 0xffffffff
mov esi, eax
jmp 0x1003506d
push esi
mov edx, ebp
call fcn.100312d8
pop ecx
cmp eax, 1
push 0xffffffffffffffff
pop eax
cmovne esi, eax
cmp edi, ebx
je 0x10035089
mov edi, dword [edi + 8]
test esi, esi
mov eax, esi
cmovle eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
test edi, edi
jne 0x10034f23
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
test eax, eax
je 0x100350a8
push esi
push 0
push dword [esp + 0x2c]
push ebp
push 0x82
push ebx
call eax
add esp, 0x18
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x1003aa86
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x64
mov eax, dword [0x34c10e4]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
mov eax, ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], eax
mov ebp, edx
push esi
push edi
movzx eax, byte [eax + edx - 1]
mov ecx, edx
mov edi, dword [esp + 0x78]
sub ecx, eax
sub ebp, edi
xor ebx, ebx
sub ebp, 0x100
mov esi, ebx
dec ecx
mov dword [esp + 0x14], esi
mov eax, ebp
mov dword [esp + 0x1c], ecx
shr eax, 0x1f
sub ecx, edi
dec eax
and ebp, eax
mov eax, ecx
shr eax, 0x1f
dec eax
and ecx, eax
lea eax, [edi - 1]
mov edx, eax
mov dword [esp + 0x10], ecx
and edx, edi
mov dword [esp + 0x2c], eax
push 0x30
mov dword [esp + 0x2c], edx
pop edx
jne 0x1003aafa
mov esi, edi
sub esi, ebp
add esi, ecx
and esi, eax
jmp 0x1003ab0c
cmp edi, 0x14
jne 0x1003ab12
mov eax, ecx
sub eax, ebp
push edi
pop ecx
add eax, ecx
cdq
idiv ecx
mov esi, edx
mov dword [esp + 0x14], esi
jmp 0x1003ab28
cmp edi, edx
jne 0x1003ab28
mov eax, ecx
sub eax, ebp
add eax, edx
push 0x30
cdq
pop ecx
idiv ecx
mov esi, edx
mov dword [esp + 0x14], edx
push edi
lea eax, [esp + 0x34]
push ebx
push eax
call fcn.10061dc0
add esp, 0xc
cmp ebp, dword [esp + 0x18]
jge 0x1003abac
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x30]
mov edx, ebp
sub edx, eax
sub eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], ebx
test edi, edi
jle 0x1003aba0
lea eax, [esp + 0x30]
add eax, ebx
add eax, edx
mov dword [esp + 0x10], eax
cmp eax, esi
jge 0x1003ab9e
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
sub ecx, ebx
mov esi, dword [esp + 0x24]
sub ecx, ebp
dec ecx
add eax, edx
shr ecx, 0x1f
add eax, ebx
dec cl
shr eax, 0x1f
dec al
and cl, al
mov eax, dword [esp + 0x10]
and cl, byte [eax + esi]
or byte [esp + ebx + 0x30], cl
inc ebx
mov esi, dword [esp + 0x18]
cmp ebx, edi
jl 0x1003ab59
xor ebx, ebx
add ebp, edi
add edx, edi
cmp ebp, esi
jl 0x1003ab51
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x28], 0
jne 0x1003abd6
test edi, edi
jle 0x1003ac21
mov ecx, dword [esp + 0x7c]
sub esi, ecx
mov edx, dword [esp + 0x2c]
lea eax, [esi + ecx]
and eax, edx
mov al, byte [esp + eax + 0x30]
xor al, byte [ecx]
or bl, al
inc ecx
sub edi, 1
jne 0x1003abc1
jmp 0x1003ac21
push 0x14
pop ebp
cmp edi, ebp
jne 0x1003abfb
mov ecx, dword [esp + 0x7c]
mov edi, ebp
sub esi, ecx
lea eax, [ecx + esi]
cdq
idiv ebp
mov al, byte [esp + edx + 0x30]
xor al, byte [ecx]
or bl, al
inc ecx
sub edi, 1
jne 0x1003abe5
jmp 0x1003ac21
push 0x30
pop ecx
cmp edi, ecx
jne 0x1003ac21
mov edi, dword [esp + 0x7c]
mov ebp, ecx
sub esi, edi
lea eax, [edi + esi]
cdq
idiv ecx
push 0x30
mov cl, byte [esp + edx + 0x34]
xor cl, byte [edi]
or bl, cl
inc edi
pop ecx
sub ebp, 1
jne 0x1003ac0a
mov ecx, dword [esp + 0x70]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100601b3
add esp, 0x64
ret
Function at 0x1003ac36
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x54
mov eax, dword [0x34c10e4]
xor eax, esp
mov dword [esp + 0x50], eax
push ebx
push ebp
mov ebp, dword [esp + 0x68]
push esi
mov dword [esp + 0x18], ecx
push edi
lea esi, [ebp - 1]
mov dword [esp + 0x14], edx
add esi, edx
lea eax, [ebp - 1]
mov edi, 0xff
mov cl, byte [esi]
movzx ebx, cl
mov dword [esp + 0x18], ebx
sub ebx, ebp
add ebx, dword [esp + 0x6c]
shr ebx, 0x1f
dec bl
cmp eax, edi
jg 0x1003ac7f
mov edi, eax
test eax, eax
jle 0x1003aca6
mov ebp, dword [esp + 0x18]
xor edx, edx
mov ah, cl
mov al, byte [esi]
mov ecx, ebp
sub ecx, edx
xor al, ah
shr ecx, 0x1f
dec cl
and cl, al
or bl, cl
inc edx
dec esi
cmp edx, edi
jl 0x1003ac87
mov ebp, dword [esp + 0x70]
mov edx, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
mov eax, ebp
sub eax, dword [esp + 0x68]
sub eax, dword [esp + 0x6c]
push 1
push 1
push dword [esp + 0x7c]
dec eax
push dword [esp + 0x74]
push eax
push edx
lea eax, [esp + 0x38]
push eax
push esi
call dword [esi + 0x158]
movzx esi, byte [esi + 0x445]
mov edi, eax
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x40]
push eax
push esi
mov edx, ebp
call fcn.1003aa86
or al, bl
add esp, 0x28
not al
mov cl, al
shr cl, 4
and al, cl
movzx eax, al
mov ecx, eax
shr ecx, 2
and ecx, eax
mov eax, ecx
shr eax, 1
and eax, ecx
mov ecx, 0xfffffecf
dec eax
add eax, edi
pop edi
pop esi
cmovne eax, ecx
mov ecx, dword [esp + 0x58]
pop ebp
pop ebx
xor ecx, esp
call fcn.100601b3
add esp, 0x54
ret
Function at 0x1003af5b
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x70
mov eax, dword [0x34c10e4]
xor eax, esp
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x74]
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x2c], edx
mov ecx, dword [esp + 0x88]
push edi
xor edi, edi
mov dword [esp + 0x38], ecx
mov cl, byte [esi + 0x441]
mov ebp, edi
movzx ebx, byte [esi + 0x445]
mov dword [esp + 0x28], esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x34], edi
cmp cl, 1
jne 0x1003b0d3
movzx ecx, word [esi + 0x568]
mov dword [esp + 0x14], ecx
test cx, cx
jns 0x1003afcb
movzx ecx, word [esi + 0x43c]
mov dword [esp + 0x10], ecx
mov ecx, eax
mov dword [esp + 0x34], 1
sub ecx, dword [esp + 0x10]
test dword [esp + 0x14], 0x4000
movzx ebp, byte [ecx + edx - 1]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x2c], ebp
je 0x1003b025
push dword [esp + 0x88]
push ecx
push ebx
push ebp
mov ecx, esi
call fcn.1003ac36
add esp, 0x10
test eax, eax
jne 0x1003b14e
cmp byte [esi + 0x441], 2
jne 0x1003b13e
movzx eax, word [esi + 0x43e]
jmp 0x1003b146
sub eax, ebx
xor esi, esi
push 1
push 1
push dword [esp + 0x90]
lea ecx, [eax - 1]
cmp ebp, ecx
mov dword [esp + 0x20], ecx
cmova ebp, esi
mov esi, dword [esp + 0x20]
xor ecx, ecx
mov dword [esp + 0x28], ebp
cmp dword [esp + 0x38], esi
mov esi, dword [esp + 0x34]
cmovbe ecx, dword [esp + 0x1c]
push ecx
sub eax, ecx
mov dword [esp + 0x30], ecx
dec eax
push eax
push edx
lea eax, [esp + 0x54]
push eax
push esi
call dword [esi + 0x158]
add esp, 0x20
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], edi
test ebx, ebx
je 0x1003b0c0
mov edx, dword [esp + 0x18]
mov ebp, ebx
mov esi, dword [esp + 0x30]
neg ebp
mov eax, ebp
sub eax, dword [esp + 0x20]
add eax, edx
movzx ecx, byte [eax + esi - 1]
mov eax, dword [esp + 0x10]
movzx eax, byte [esp + eax + 0x3c]
xor ecx, eax
mov eax, dword [esp + 0x10]
or edi, ecx
inc eax
inc ebp
mov dword [esp + 0x10], eax
cmp eax, ebx
jl 0x1003b088
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
test edi, edi
jne 0x1003b137
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x1003b137
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x2c], eax
ja 0x1003b137
jmp 0x1003b00c
test cl, cl
jne 0x1003b00c
push 1
push 1
push dword [esp + 0x90]
sub eax, ebx
push 0xffffffffffffffff
push eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x50]
push edx
push eax
push esi
call dword [esi + 0x158]
add esp, 0x20
mov dword [esp + 0x20], eax
test ebx, ebx
je 0x1003b12f
mov edx, dword [esp + 0x18]
mov ebp, edi
add edx, dword [esp + 0x30]
movzx ecx, byte [esp + ebp + 0x3c]
movzx eax, byte [edx]
xor ecx, eax
or edi, ecx
inc ebp
inc edx
cmp ebp, ebx
jl 0x1003b111
mov ebp, dword [esp + 0x1c]
test edi, edi
jne 0x1003b137
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1003b00c
mov eax, 0xfffffecf
jmp 0x1003b14e
mov eax, dword [esp + 0x34]
add eax, ebx
add eax, ebp
mov ecx, dword [esp + 0x38]
mov dword [ecx], eax
xor eax, eax
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100601b3
add esp, 0x70
ret
Function at 0x1004b3ef
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x474
mov eax, dword [0x34c10e4]
xor eax, esp
mov dword [esp + 0x46c], eax
mov eax, dword [esp + 0x478]
push ebx
mov ebx, dword [esp + 0x480]
mov dword [esp + 0x10], ebx
inc ebx
push ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x488]
push esi
shr ebx, 1
mov esi, ecx
mov ecx, dword [esp + 0x494]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x490]
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], ecx
push edi
mov edi, edx
cmp ebx, 0x104
ja 0x1004b5c6
mov ebp, dword [esp + 0x49c]
add ebp, eax
cmp ebp, 0x80
ja 0x1004b5c6
cmp edi, 0xe0
ja 0x1004b5c6
push edi
lea eax, [esp + 0x18c]
push 0
push eax
call fcn.10061dc0
add esp, 0xc
lea eax, [esp + 0xa8]
push edi
push 0
push eax
call fcn.10061dc0
add esp, 0xc
lea eax, [esp + 0x268]
push ebx
push dword [esp + 0x1c]
push eax
call fcn.10061840
mov eax, dword [esp + 0x28]
add esp, 0xc
mov ecx, dword [esp + 0x18]
and eax, 1
sub ecx, eax
lea eax, [esp + 0x370]
add ecx, ebx
push ebx
push ecx
push eax
call fcn.10061840
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x34]
add esp, 0xc
push ecx
push dword [esp + 0x24]
push eax
call fcn.10061840
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x34]
add esp, 0xc
add eax, ecx
push dword [esp + 0x49c]
push dword [esp + 0x28]
push eax
call fcn.10061840
pop ecx
pop ecx
push dword [esp + 0x4a4]
lea eax, [esp + 0x30]
mov edx, edi
push 1
push ebp
push eax
lea eax, [esp + 0x27c]
push ebx
push eax
lea ecx, [esp + 0x1a4]
call fcn.1004b1be
mov ebp, eax
add esp, 0x1c
test ebp, ebp
jne 0x1004b5c2
mov eax, dword [esp + 0x14]
mov edx, edi
add eax, dword [esp + 0x49c]
push ecx
push dword [esp + 0x4a4]
lea ecx, [esp + 0xb0]
push 2
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x384]
push ebx
push eax
call fcn.1004b1be
mov ebp, eax
add esp, 0x1c
test ebp, ebp
jne 0x1004b5c2
push edi
lea eax, [esp + 0x18c]
push eax
push esi
call fcn.10061840
mov eax, esi
lea ecx, [esp + 0xb4]
or eax, edi
add esp, 0xc
or eax, ecx
test al, 3
jne 0x1004b5aa
shr edi, 2
test edi, edi
je 0x1004b5c2
sub ecx, esi
mov eax, dword [ecx + esi]
xor dword [esi], eax
lea esi, [esi + 4]
sub edi, 1
jne 0x1004b59b
jmp 0x1004b5c2
test edi, edi
je 0x1004b5c2
lea ecx, [esp + 0xa8]
sub ecx, esi
mov al, byte [esi + ecx]
xor byte [esi], al
inc esi
sub edi, 1
jne 0x1004b5b7
mov eax, ebp
jmp 0x1004b5cb
mov eax, 0xffffff7c
mov ecx, dword [esp + 0x47c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100601b3
add esp, 0x474
ret

Function at 0x1004c5d3
Capabilities:
Check for software breakpoints

Disassembly:
push esi
push edi
mov edi, dword [ecx + 4]
xor eax, eax
xor esi, esi
movzx ecx, word [edi]
cmp ax, cx
jae 0x1004c5ff
movzx eax, si
mov al, byte [eax + edi + 4]
cmp al, 0x13
je 0x1004c60a
cmp al, 0xc0
je 0x1004c60a
cmp al, 0xcc
je 0x1004c60a
add esi, 2
cmp si, cx
jb 0x1004c5e4
movzx eax, byte [edx + 1]
bts eax, 2
mov byte [edx + 1], al
pop edi
pop esi
ret
Function at 0x1004c60d
Capabilities:
Check for software breakpoints

Disassembly:
push esi
push edi
mov edi, dword [ecx + 4]
xor eax, eax
xor esi, esi
movzx ecx, word [edi]
cmp ax, cx
jae 0x1004c639
movzx eax, si
mov al, byte [eax + edi + 4]
cmp al, 0x13
je 0x1004c644
cmp al, 0xc0
je 0x1004c644
cmp al, 0xcc
je 0x1004c644
add esi, 2
cmp si, cx
jb 0x1004c61e
movzx eax, byte [edx + 1]
bts eax, 3
mov byte [edx + 1], al
pop edi
pop esi
ret
Function at 0x1004db4a
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
push ecx
push ebx
push ebp
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x1004dbdb
test ebx, ebx
je 0x1004dbdb
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x1004dbdb
movzx edx, byte [edi]
mov ecx, dword [esp + 0x1c]
movzx eax, byte [edi + 1]
mov dword [esp + 0xc], edx
test ecx, ecx
je 0x1004dbd2
sub ebx, ebp
push esi
mov dl, byte [edi + edx + 2]
dec ecx
movzx esi, dl
add eax, esi
mov dword [esp + 0x20], ecx
movzx eax, al
mov dword [esp + 0x14], eax
mov cl, byte [edi + eax + 2]
mov eax, dword [esp + 0x10]
mov byte [edi + eax + 2], cl
mov eax, dword [esp + 0x14]
mov byte [edi + eax + 2], dl
mov eax, dword [esp + 0x10]
inc eax
movzx edx, al
movzx eax, cl
mov ecx, dword [esp + 0x20]
add eax, esi
movzx eax, al
mov dword [esp + 0x10], edx
mov al, byte [eax + edi + 2]
xor al, byte [ebp]
mov byte [ebx + ebp], al
inc ebp
mov eax, dword [esp + 0x14]
test ecx, ecx
jne 0x1004db7d
pop esi
mov byte [edi + 1], al
xor eax, eax
mov byte [edi], dl
jmp 0x1004dbe0
mov eax, 0xffffff53
pop edi
pop ebp
pop ebx
pop ecx
pop ecx
ret