joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x65cc08c7
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x308d16b2
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40
mov esi, 0x1000
push esi
push esi
xor edi, edi
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 1
push edi
push edi
push 0x10002054
push edi
push edi
mov dword [0x10003228], eax
call ebx
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f2
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f0
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dc
call eax
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x7ffe5478
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword fs:[0x30]
call 0x7ffe5483
pop edx
xor dx, dx
add edx, 0xd5e0
and al, 0xff
xor ecx, ecx
cld
add al, 0
mov cl, 0x1e
add al, 0
xor byte [ecx + edx], 0xe9
loop 0x7ffe5498
cld
push dword fs:[0x24]
pop dword [edx + 0xa]
nop
push es
pop ds
mov cl, 0xff
push eax
pop eax
push edx
loop 0x7ffe54b0
cld
mov dword [edx + 0x11], 0xffffacbb
mov ecx, dword [eax + 0x2c]
cld
inc esi
dec esi
mov dword [edx + 0x1b], ecx
add al, 0
mov dword [edx + 0x100], ecx
stc
mov dword [eax + 0x2c], esp
push 0
add eax, 0
push 0
and al, 0xff
push 0
cld
push 0
push 0x30
nop
push eax
pop eax
push 0x20
push eax
pop eax
push 0
cld
push 0
add edx, 0xffff7f37
stc
push es
pop ds
push edx
push es
pop ds
push edx
cld
push 0
call dword [edx + 0x820c]
nop
push eax
pop eax
add esp, 0x3f8
inc esi
dec esi
xor eax, eax
clc
inc eax
ret 0xc
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x1001bba0
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1003fc88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, 4
call fcn.10012402
mov ebx, esp
lea eax, [ebp - 0x28]
push 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1001bc7d
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 8], eax
lea edi, [eax - 1]
not edi
and edi, ebx
sub edi, eax
lea eax, [esi + 0x2000]
cmp edi, eax
jb 0x1001bc7d
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1001bc7d
add esi, dword [ebp - 0x1c]
test dword [ebp - 0x18], 0x1000
je 0x1001bc00
test dword [ebp - 0x14], 0x100
mov esi, dword [ebp - 0x28]
je 0x1001bc42
mov eax, 1
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003cb60
mov esp, ebp
pop ebp
ret
cmp edi, esi
jb 0x1001bc7d
mov edi, dword [ebp - 8]
push 4
push 0x1000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea eax, [ebp - 0xc]
push eax
push 0x104
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003cb60
mov esp, ebp
pop ebp
ret
xor eax, eax
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003cb60
mov esp, ebp
pop ebp
ret
Function at 0x10011fea
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10012012
push 0
push 0xdba
push 0
push 0
push 0x71d
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10012037
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 4
mov esp, ebp
pop ebp
ret
Function at 0x1001bb33
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001bb5a
push 0
push 0xdba
push 0
push 0
push 0x71d
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1001bb71
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x1002a6c6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002a73b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push 4
push 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
mov eax, dword [ebp - 4]
push dword [eax + 0x34]
push 0x647d
push 0x7089
call fcn.1002311d
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x1002a739
push 4
push 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push 0
push 0x647d
push 0x7089
call fcn.1002311d
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x1002a753
push 0
push 0xdba
push 0
push 0
push 0x71d
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret
Function at 0x1002b7c3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0x3a57
lea eax, [ebp + 8]
push eax
push 1
call fcn.1002b585
add esp, 0x10
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002b7f8
xor eax, eax
jmp 0x1002b94a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002b816
xor eax, eax
jmp 0x1002b94a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 1
push 0x6d84
call fcn.1002b5e0
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x1002b83a
xor eax, eax
jmp 0x1002b94a
push 1
push dword [ebp - 0x10]
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0x3db5
push 0x2089
lea eax, [ebp - 0xc]
push eax
push 0x58ec
lea eax, [ebp - 0x24]
push eax
call fcn.1002a804
add esp, 0x24
push 0
push 0x1e74
push 0x63af
push 0x2b1e
push dword [ebp - 8]
push dword [ebp - 4]
push 0x284d
push dword [ebp + 8]
push 0x7c
call fcn.1002a804
add esp, 0x24
lea eax, [ebp - 0x1c]
push eax
push 1
push 0xe1a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.1002b630
add esp, 0x14
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
push eax
push 0x17f6
push 1
call fcn.1002b69d
add esp, 0x10
push dword [ebp - 4]
call fcn.1002a5a9
pop ecx
test eax, eax
jne 0x1002b8d1
xor eax, eax
jmp 0x1002b94a
push dword [ebp - 4]
push 1
call fcn.10024fae
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002b932
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x14], ecx
jne 0x1002b8fc
xor eax, eax
jmp 0x1002b94a
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002b915
xor eax, eax
jmp 0x1002b94a
push 0x2d31
push 0x238f
push 0x333
lea eax, [ebp - 4]
push eax
push 1
call fcn.1002b6fc
add esp, 0x14
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002b943
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
jmp 0x1002b947
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret
Function at 0x1003e226
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003e264
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
push dword [eax + 0x18]
push 0
call fcn.1003b21c
pop ecx
pop ecx
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
jmp 0x1003e288
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003e288
push 0
push 0xdba
push 0
push 0
push 0x71d
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret

Function at 0x1003e8ae
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1003e91b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x18]
push dword [eax]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ecx]
add ecx, eax
push ecx
mov ecx, dword [ebp - 0x28]
call fcn.10043f56
jmp 0x1003e92c
push 0x1244
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov esp, ebp
pop ebp
ret
Function at 0x1007810f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008938c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006ffaa
mov dword [ebp - 0x14], eax
cmp dword [0x10676108], esi
jne 0x10078202
push 0x800
push esi
push 0x100061f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1007818f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100782e2
push esi
push esi
push 0x100061f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x100782e2
push 0x10006210
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100782e2
push eax
call ebx
push 0x1000621c
push edi
mov dword [0x10676108], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x1000622c
push edi
mov dword [0x1067610c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10006240
push edi
mov dword [0x10676110], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10676118], eax
test eax, eax
je 0x100781ff
push 0x1000625c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10676114], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10078227
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1007821a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007823c
push 4
pop eax
jmp 0x100782e4
cmp dword [ebp - 0x14], esi
je 0x1007823c
push dword [0x10676108]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10078221
mov eax, dword [0x10676114]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1007829a
cmp dword [0x10676118], edi
je 0x1007829a
push eax
call ebx
push dword [0x10676118]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1007829a
test eax, eax
je 0x1007829a
call ecx
test eax, eax
je 0x1007828f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1007828f
test byte [ebp - 8], 1
jne 0x1007829a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x100782ca
mov eax, dword [0x1067610c]
cmp eax, edi
je 0x100782c7
push eax
call ebx
test eax, eax
je 0x100782c7
call eax
mov esi, eax
test esi, esi
je 0x100782c7
mov eax, dword [0x10676110]
cmp eax, edi
je 0x100782c7
push eax
call ebx
test eax, eax
je 0x100782c7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10676108]
call ebx
test eax, eax
je 0x100782e2
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x100782e4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10069c92
mov esp, ebp
pop ebp
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x39112102
nop
nop
nop
nop
test eax, eax
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x675e06fe
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x402e80
Capabilities:
Hash data using djb2

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x402eba
mov edx, dword [esp + 0x10]
mov edi, 0x1505
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [edx + esi]
test ebx, ebx
je 0x402ec1
mov eax, edi
shl eax, 5
add eax, edi
add eax, ebx
inc esi
mov edi, eax
cmp ecx, esi
jne 0x402ea0
jmp 0x402ec3
mov eax, 0x1505
jmp 0x402ec3
mov eax, edi
pop esi
pop edi
pop ebx
ret

Function at 0x4035d0
Capabilities:
Compute adler32 checksum
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x403796
mov ebp, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test ebp, ebp
je 0x40378f
mov edx, 0x5e6ea9af
mov eax, ebp
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebp
sub edx, eax
jmp 0x403673
mov edx, dword [esp]
mov eax, edx
sub eax, dword [esp + 4]
add ebx, eax
mov ebp, edx
not ebp
mov esi, dword [esp + 0xc]
and ebp, esi
not esi
mov eax, ecx
mov edx, 0x80078071
mul edx
and esi, dword [esp]
shr edx, 0xf
imul eax, edx, 0xfff1
mov dword [esp], eax
mov eax, edi
mov edx, 0x80078071
mul edx
sub ecx, dword [esp]
shr edx, 0xf
imul eax, edx, 0xfff1
sub edi, eax
mov edx, 0x15b0
sub ebp, esi
je 0x40378f
xor eax, eax
cmp edx, 8
mov dword [esp + 0xc], ebp
jb 0x4036f2
mov eax, edx
and eax, 0x1ff8
mov dword [esp + 4], eax
mov ebp, edx
xor edx, edx
nop
nop
nop
mov eax, edx
movzx edx, byte [ebx + edx]
add edx, edi
add ecx, edx
movzx esi, byte [ebx + eax + 1]
mov edi, edx
and edi, esi
xor edx, esi
lea edx, [edx + edi*2]
add ecx, edx
movzx esi, byte [ebx + eax + 2]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 3]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 4]
add esi, edx
add ecx, esi
movzx edx, byte [ebx + eax + 5]
add edx, esi
add ecx, edx
movzx esi, byte [ebx + eax + 6]
add esi, edx
add ecx, esi
movzx edi, byte [ebx + eax + 7]
add edi, esi
add ecx, edi
lea edx, [eax + 8]
add eax, 0xf
cmp eax, ebp
jb 0x403690
add ebx, edx
mov edx, ebp
mov eax, dword [esp + 4]
mov esi, eax
sub esi, edx
mov dword [esp], edx
jae 0x40362b
mov ebp, edx
and ebp, 3
mov dword [esp + 4], eax
je 0x403742
mov dword [esp + 8], esi
neg ebp
xor eax, eax
mov edx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec eax
cmp ebp, eax
jne 0x403720
mov ebp, dword [esp + 4]
sub ebp, eax
mov esi, dword [esp + 8]
cmp esi, 0xfffffffc
ja 0x403620
jmp 0x40374f
mov ebp, eax
mov edx, ebx
cmp esi, 0xfffffffc
ja 0x403620
mov eax, dword [esp]
sub eax, ebp
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + ebp]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + ebp + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + ebp + 3]
add edi, esi
add ecx, edi
add ebp, 4
cmp eax, ebp
jne 0x403760
jmp 0x403620
shl ecx, 0x10
or ecx, edi
jmp 0x40379b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4037b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4037de
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebx, ebx
je 0x40387c
not eax
test bl, 1
jne 0x4037e5
mov edx, ebx
cmp ebx, 1
jne 0x403816
jmp 0x40387a
xor eax, eax
jmp 0x40387c
lea edx, [ebx - 1]
movzx esi, byte [ecx]
mov edi, eax
shr edi, 4
xor eax, esi
and eax, 0xf
xor edi, dword [eax*4 + 0x43f80c]
inc ecx
mov eax, edi
shr eax, 4
and edi, 0xf
shr esi, 4
xor esi, edi
xor eax, dword [esi*4 + 0x43f80c]
cmp ebx, 1
je 0x40387a
xor esi, esi
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43f80c]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43f80c]
movzx edi, byte [ecx + esi + 1]
mov ebx, eax
shr ebx, 4
xor eax, edi
and eax, 0xf
xor ebx, dword [eax*4 + 0x43f80c]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x43f80c]
add esi, 2
cmp edx, esi
jne 0x403820
not eax
pop esi
pop edi
pop ebx
ret
Function at 0x4088e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4088fb
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0x408903
mov word [ebx], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0x40899b
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0x408949
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0x4089aa
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0x40895e
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0x408970
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0x408930
jmp 0x408979
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0x408930
cmp edi, ebx
jge 0x408990
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0x408934
jmp 0x408994
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0x40893d
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0x408a32
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0x408a32
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0x4089e4
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0x4089d0
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0x408a32
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0x4089f0
dec eax
mov ecx, 1
xor esi, esi
jmp 0x408a4c
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0x4088fb
test edx, edx
mov dword [esp], ecx
js 0x408a80
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0x408a90
inc ebp
dec edx
cmp edi, ebp
jne 0x408a60
mov edx, 0xffffffff
jmp 0x408a92
xor edi, edi
jmp 0x408a95
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0x408a40
and ebp, 3
je 0x408ac8
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0x408ab0
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0x408aca
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0x408a40
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0x408ae0
jmp 0x408a40