joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011800
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10041328
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x350
mov dword [ebp - 0x35c], ecx
mov dword [ebp - 0x358], 0
lea ecx, [ebp - 0x2c]
call fcn.10007750
mov dword [ebp - 4], 0
mov byte [ebp - 0x244], 0
cmp dword [ebp + 0xc], 0
je 0x10011878
mov eax, dword [ebp + 0xc]
push eax
call sub.MSVCR90.dll_strlen
add esp, 4
test eax, eax
je 0x10011878
lea ecx, [ebp - 0x244]
push ecx
push 0x103
mov edx, dword [0x10068824]
mov eax, dword [edx + 0x140]
call eax
test eax, eax
jne 0x100118aa
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10002040
mov edx, dword [ebp - 0x358]
or edx, 1
mov dword [ebp - 0x358], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10002080
mov eax, dword [ebp + 8]
jmp 0x100119c6
mov ax, word [0x1004c95c]
mov word [ebp - 0x30], ax
mov cl, byte [0x1004c95e]
mov byte [ebp - 0x2e], cl
mov dword [ebp - 0x248], 0
lea edx, [ebp - 0x244]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [ebp - 0x30], cl
push 0x104
lea edx, [ebp - 0x13c]
push edx
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x1001196d
lea ecx, [ebp - 0x13c]
push ecx
call sub.MSVCR90.dll_strlen
add esp, 4
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0x104
jae 0x1001196d
mov edx, dword [ebp - 0x24c]
push edx
lea eax, [ebp - 0x13c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call sub.MSVCR90.dll_strncmp
add esp, 0xc
neg eax
sbb eax, eax
add eax, 1
mov dword [ebp - 0x248], eax
je 0x1001196d
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x24c]
push edx
lea eax, [ebp - 0x30]
push eax
push str._s_s
lea ecx, [ebp - 0x354]
push ecx
call fcn.10011cc0
add esp, 0x10
lea edx, [ebp - 0x354]
push edx
lea ecx, [ebp - 0x2c]
call fcn.100077a0
mov eax, dword [ebp - 0x10]
movsx ecx, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
test ecx, ecx
je 0x10011982
jmp 0x1001196d
cmp dword [ebp - 0x248], 0
jne 0x10011999
mov eax, dword [ebp - 0x10]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x100118d0
lea edx, [ebp - 0x2c]
push edx
mov ecx, dword [ebp + 8]
call fcn.10002040
mov eax, dword [ebp - 0x358]
or eax, 1
mov dword [ebp - 0x358], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10002080
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x10011cf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xac
mov dword [ebp - 8], 0
jmp 0x10011d12
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2d
jge 0x10011d51
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x39f6f87]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10011d4c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10011d09
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x2d], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10011e70
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x28
push 0xffffffffffffffff
mov ecx, dword [0x10068824]
mov edx, dword [ecx + 0x1b4]
call edx
test eax, eax
jne 0x10011e9e
xor al, al
jmp 0x10011ecf
push 2
push 0x1004c7f4
mov eax, dword [ebp - 4]
push eax
call fcn.10011e10
add esp, 0xc
movzx ecx, al
test ecx, ecx
jne 0x10011ebc
xor al, al
jmp 0x10011ecf
mov edx, dword [ebp - 4]
push edx
mov eax, dword [0x10068824]
mov ecx, dword [eax + 0x8c]
call ecx
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x100169c0
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100411c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
lea eax, [ebp - 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10016acf
lea ecx, [ebp - 0x1c]
push ecx
push 0x1004c094
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x14], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x20]
push edx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x10016acf
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10016cf0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100411a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x470
mov dword [ebp - 0x414], 0
jmp 0x10016d29
mov eax, dword [ebp - 0x414]
add eax, 1
mov dword [ebp - 0x414], eax
mov ecx, 0x10069950
call fcn.1000b190
cmp dword [ebp - 0x414], eax
jae 0x10016ee2
mov ecx, dword [ebp - 0x414]
push ecx
mov ecx, 0x10069950
call fcn.10017f60
mov edx, dword [eax]
mov dword [ebp - 0x41c], edx
mov eax, dword [ebp - 0x414]
push eax
mov ecx, 0x10069950
call fcn.10017f60
add eax, 4
mov dword [ebp - 0x418], eax
lea ecx, [ebp - 0x410]
push ecx
mov ecx, dword [ebp - 0x418]
call fcn.1000a4b0
push eax
lea edx, [ebp - 0x40c]
push edx
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x10016edd
mov ecx, dword [ebp - 0x410]
push ecx
push 0
mov ecx, dword [ebp - 0x418]
call fcn.10017eb0
push eax
lea edx, [ebp - 0x40c]
push edx
call sub.MSVCR90.dll_memcmp
add esp, 0xc
test eax, eax
je 0x10016edd
mov eax, 0xbcc2ad74
push eax
lea ecx, [ebp - 0x427]
call fcn.100059c0
mov dword [ebp - 0x468], eax
mov ecx, 0xf68a3d1
push ecx
lea ecx, [ebp - 0x444]
call fcn.1001eb60
mov dword [ebp - 0x46c], eax
push 0x10
mov edx, dword [ebp - 0x468]
push edx
mov eax, dword [ebp - 0x46c]
push eax
call fcn.10011f90
add esp, 0xc
lea ecx, [ebp - 0x444]
call fcn.10018010
lea ecx, [ebp - 0x427]
call fcn.100326d0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x10016d1a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10016fd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10043038
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
jmp 0x10016ffd
call fcn.10016ae0
push 0
push 0
push 0x10016f80
push 0x10016960
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10068838], eax
push 0
push 0
push 0x10016f80
push 0x10012fe0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10069240], eax
push 0
push 0
push 0x10016f80
push 0x10016ef0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [0x10068830]
call fcn.100113a0
test eax, eax
jne 0x100170b1
mov eax, 0xfdb74fdf
push eax
lea ecx, [ebp - 0x41]
call fcn.1001ebe0
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 4], 0
mov ecx, dword [0x10068828]
call fcn.100014a0
push eax
push 0
mov edx, dword [ebp - 0x4c]
push edx
push 0
push 0
mov ecx, dword [0x1006882c]
call fcn.10011500
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x41]
call fcn.10018040
call fcn.100056c0
call fcn.100169c0
mov ecx, dword [0x10068818]
call fcn.1000a410
movzx ecx, al
test ecx, ecx
jne 0x100170ea
mov ecx, dword [0x10069248]
call fcn.100263b0
cmp eax, 1
jle 0x100170ea
push 0
mov ecx, dword [0x10069248]
call fcn.10025ab0
mov ecx, dword [0x1006924c]
call fcn.10022560
mov byte [ebp - 0xd], 0
mov ecx, 0x1004961a
call fcn.1000a420
mov dword [ebp - 0x18], eax
mov ecx, dword [0x10069248]
call fcn.100267e0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10017132
mov edx, dword [ebp - 0x14]
push edx
push 0
push 0x40
mov eax, dword [0x10068824]
mov ecx, dword [eax + 0x148]
call ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x10017143
mov dword [ebp - 0x18], 0xfffffffe
mov byte [ebp - 0xd], 1
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [0x10068830]
call fcn.100254e0
movzx eax, byte [ebp - 0xd]
test eax, eax
jne 0x1001716c
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [0x10068824]
mov eax, dword [edx + 0x8c]
call eax
mov ecx, dword [0x10068830]
call fcn.100257c0
call fcn.10001480
movzx ecx, al
test ecx, ecx
je 0x10017199
mov ecx, dword [0x10068830]
call fcn.10011ee0
mov ecx, dword [0x10068830]
call fcn.10011f10
mov ecx, dword [0x10069248]
call fcn.10023e10
mov ecx, dword [0x10069248]
call fcn.10023dd0
mov ecx, dword [0x10069248]
call fcn.10023c50
mov ecx, dword [0x10069248]
call fcn.10023c90
mov ecx, dword [0x10069248]
call fcn.10023d10
mov ecx, dword [0x10069248]
call fcn.10023d50
mov ecx, dword [0x10069248]
call fcn.10023cd0
mov ecx, dword [0x10069248]
call fcn.10023d90
mov ecx, dword [0x10069248]
call fcn.100237b0
jmp 0x1001720e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100179f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
push dword [ebp + 4]
pop dword [ebp - 4]
push 4
call sub.MSVCR90.dll___2_YAPAXI_Z
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10017a26
mov ecx, dword [ebp - 0x10]
call fcn.10016f10
mov dword [ebp - 0x2c], eax
jmp 0x10017a2d
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x1006883c], ecx
mov ecx, dword [0x1006883c]
call fcn.100173d0
call dword [sym.imp.KERNEL32.dll_AllocConsole]
mov edx, 0x928f34b1
push edx
lea ecx, [ebp - 0x23]
call fcn.1001efe0
mov dword [ebp - 0x30], eax
push 0
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x23]
call fcn.10017df0
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [0x10068818]
call fcn.1000a3a0
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [0x1006883c]
call fcn.10017220
push 1
mov ecx, dword [0x10068818]
call fcn.1000a3a0
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x10017b70
Capabilities:
Create thread
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
jmp 0x10017b88
mov eax, dword [0x10068838]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0
mov ecx, dword [0x10068838]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10017bbb
push 0
mov edx, dword [0x10068838]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x10017bc5
mov dword [0x10068838], 0
cmp dword [0x10068838], 0
jne 0x10017c7e
push 0
push 0
push 0
push 0x10012fe0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10068838], eax
push 0x10
mov eax, 0xbcc2b024
push eax
lea ecx, [ebp - 0xb]
call fcn.100059c0
push eax
push 0x3401f55c
lea ecx, [ebp - 0x1f]
call fcn.1001f060
push eax
call fcn.10011f90
add esp, 0xc
lea ecx, [ebp - 0x1f]
call fcn.100327c0
lea ecx, [ebp - 0xb]
call fcn.100326d0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [0x10069240]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0
mov edx, dword [0x10069240]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10017cb1
push 0
mov eax, dword [0x10069240]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x10017cbb
mov dword [0x10069240], 0
cmp dword [0x10069240], 0
jne 0x10017d75
push 0
push 0
push 0
push 0x10016960
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10069240], eax
push 0x10
mov ecx, 0xbcc2b064
push ecx
lea ecx, [ebp - 0x47]
call fcn.100059c0
push eax
mov edx, 0xe63a9af0
push edx
lea ecx, [ebp - 0x5b]
call fcn.1001f0e0
push eax
call fcn.10011f90
add esp, 0xc
lea ecx, [ebp - 0x5b]
call fcn.100327c0
lea ecx, [ebp - 0x47]
call fcn.100326d0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
jmp 0x10017d87
mov esp, ebp
pop ebp
ret

Function at 0x10018a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xbc
mov dword [ebp - 8], 0
jmp 0x10018a42
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe
jge 0x10018a81
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x56f545c7]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10018a7c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10018a39
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10018aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xe7
mov dword [ebp - 8], 0
jmp 0x10018ac2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jge 0x10018b01
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x33a0561c]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10018afc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10018ab9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xb], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10018b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xda
mov dword [ebp - 8], 0
jmp 0x10018b42
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe
jge 0x10018b81
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x4ef54134]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10018b7c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10018b39
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10018ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x4b
mov dword [ebp - 8], 0
jmp 0x10018bc2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 7
jge 0x10018c01
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x26c724e2]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10018bfc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10018bb9
mov eax, dword [ebp - 0xc]
mov byte [eax + 7], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10018c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0
jmp 0x10018c42
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 9
jge 0x10018c81
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x342d97a3]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10018c7c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10018c39
mov eax, dword [ebp - 0xc]
mov byte [eax + 9], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10018ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x90
mov dword [ebp - 8], 0
jmp 0x10018cc2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x18
jge 0x10018d01
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x26e4fa07]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10018cfc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10018cb9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x18], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10018d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x6f
mov dword [ebp - 8], 0
jmp 0x10018d42
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x11
jge 0x10018d81
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x29d418d0]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10018d7c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10018d39
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x11], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10018da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xc1
mov dword [ebp - 8], 0
jmp 0x10018dc2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jge 0x10018e01
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x5b29ca06]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10018dfc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10018db9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xb], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10018e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0xd2
mov dword [ebp - 8], 0
jmp 0x10018e42
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x13
jge 0x10018e81
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x2c5a55e1]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10018e7c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10018e39
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x13], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10018ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 7
mov dword [ebp - 8], 0
jmp 0x10018ec2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xc
jge 0x10018f01
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x35f421c1]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10018efc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10018eb9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xc], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10018f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x10
mov dword [ebp - 8], 0
jmp 0x10018f42
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xa
jge 0x10018f81
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x3f510c34]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10018f7c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10018f39
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xa], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10018fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x97
mov dword [ebp - 8], 0
jmp 0x10018fc2
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x12
jge 0x10019001
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx + 0x1d413dd1]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x10018ffc
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10018fb9
mov eax, dword [ebp - 0xc]
mov byte [eax + 0x12], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4

Function at 0x10019020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], 0x99
mov dword [ebp - 8], 0
jmp 0x10019042
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xe
jge 0x10019081
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movsx edx, byte [ecx - 0x32b0bccd]
xor edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
and edx, 0x800000ff
jns 0x1001907c
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 4], edx
jmp 0x10019039
mov eax, dword [ebp - 0xc]
mov byte [eax + 0xe], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4