joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1023be40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x1c]
cmp edi, ebx
jne 0x1023bf07
mov eax, dword [esi + 8]
test eax, eax
jne 0x1023bea0
push ebx
push dword [esi + 4]
push dword [esi]
call sub.MSVCR110.dll_memcpy
push dword [esi]
push dword [ebp + 0xc]
call dword [ebp + 0x10]
mov edi, dword [esi]
add esp, 0x14
test ebx, ebx
jle 0x1023be8d
mov ecx, dword [ebp + 0x14]
sub edi, ecx
mov edx, ebx
mov al, byte [edi + ecx]
xor byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x1023be82
push ebx
push dword [esi + 4]
call fcn.1023be10
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi]
mov edi, ebx
sub edi, eax
add edx, eax
mov dword [ebp + 0x18], edi
test edi, edi
jle 0x1023bec2
mov ecx, dword [ebp + 0x14]
sub edx, ecx
mov al, byte [edx + ecx]
xor byte [ecx], al
lea ecx, [ecx + 1]
dec edi
jne 0x1023beb4
mov edi, dword [ebp + 0x18]
push ebx
push dword [esi + 4]
call fcn.1023be10
push ebx
push dword [esi + 4]
push dword [esi]
call sub.MSVCR110.dll_memcpy
push dword [esi]
push dword [ebp + 0xc]
call dword [ebp + 0x10]
mov edx, dword [esi + 8]
mov ecx, dword [ebp + 0x14]
mov esi, dword [esi]
add esp, 0x1c
add ecx, edi
test edx, edx
jle 0x1023bfbf
sub esi, ecx
mov al, byte [esi + ecx]
xor byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x1023bef5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x1023bf4a
push ebx
push dword [esi + 4]
push dword [esi]
call sub.MSVCR110.dll_memcpy
push dword [esi]
push dword [ebp + 0xc]
call dword [ebp + 0x10]
mov ebx, dword [esi]
add esp, 0x14
test edi, edi
jle 0x1023bfbc
mov ecx, dword [ebp + 0x14]
sub ebx, ecx
mov edx, edi
mov al, byte [ebx + ecx]
xor byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x1023bf35
mov dword [esi + 8], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ebx
sub eax, ecx
cmp eax, edi
mov edx, edi
cmovl edx, eax
mov eax, dword [esi]
add eax, ecx
mov dword [ebp + 0x1c], edx
test edx, edx
jle 0x1023bf78
mov ecx, dword [ebp + 0x14]
mov ebx, eax
sub ebx, ecx
mov al, byte [ebx + ecx]
xor byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x1023bf67
mov ebx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x1c]
add dword [esi + 8], edx
cmp edx, edi
jge 0x1023bfbf
push ebx
push dword [esi + 4]
call fcn.1023be10
push ebx
push dword [esi + 4]
push dword [esi]
call sub.MSVCR110.dll_memcpy
push dword [esi]
push dword [ebp + 0xc]
call dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
sub edi, dword [ebp + 0x1c]
add ecx, dword [ebp + 0x1c]
mov ebx, dword [esi]
add esp, 0x1c
test edi, edi
jle 0x1023bfbc
sub ebx, ecx
mov edx, edi
mov al, byte [ebx + ecx]
xor byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x1023bfb1
mov dword [esi + 8], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1023c8f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 8]
cmp ebx, esi
jne 0x1023c9c2
mov eax, dword [edi + 8]
test eax, eax
jne 0x1023c952
push esi
push dword [edi + 4]
push dword [edi]
call sub.MSVCR110.dll_memcpy
push dword [edi]
push dword [ebp + 0xc]
call dword [ebp + 0x10]
push esi
push dword [edi]
push dword [edi + 4]
call sub.MSVCR110.dll_memcpy
mov edx, dword [edi]
add esp, 0x20
test esi, esi
jle 0x1023ca8e
mov ecx, dword [ebp + 0x14]
sub edx, ecx
nop
mov al, byte [edx + ecx]
xor byte [ecx], al
lea ecx, [ecx + 1]
dec esi
jne 0x1023c940
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [edi]
mov ebx, esi
sub ebx, eax
add edx, eax
mov dword [ebp + 0x18], ebx
test ebx, ebx
jle 0x1023c974
mov ecx, dword [ebp + 0x14]
sub edx, ecx
mov al, byte [edx + ecx]
xor byte [ecx], al
lea ecx, [ecx + 1]
dec ebx
jne 0x1023c966
mov ebx, dword [ebp + 0x18]
push esi
push dword [edi + 4]
push dword [edi]
call sub.MSVCR110.dll_memcpy
push dword [edi]
push dword [ebp + 0xc]
call dword [ebp + 0x10]
push esi
push dword [edi]
push dword [edi + 4]
call sub.MSVCR110.dll_memcpy
mov ecx, dword [ebp + 0x14]
mov edx, dword [edi + 8]
mov esi, dword [edi]
add esp, 0x20
add ecx, ebx
test edx, edx
jle 0x1023ca8e
sub esi, ecx
lea esp, [esp]
mov al, byte [esi + ecx]
xor byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x1023c9b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x1023ca15
push esi
push dword [edi + 4]
push dword [edi]
call sub.MSVCR110.dll_memcpy
push dword [edi]
push dword [ebp + 0xc]
call dword [ebp + 0x10]
push esi
push dword [edi]
push dword [edi + 4]
call sub.MSVCR110.dll_memcpy
mov esi, dword [edi]
add esp, 0x20
test ebx, ebx
jle 0x1023ca8b
mov ecx, dword [ebp + 0x14]
sub esi, ecx
mov edx, ebx
jmp 0x1023ca00
mov al, byte [esi + ecx]
xor byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x1023ca00
mov dword [edi + 8], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
sub eax, ecx
cmp eax, ebx
mov edx, ebx
cmovl edx, eax
mov eax, dword [edi]
add eax, ecx
mov dword [ebp + 0x1c], edx
test edx, edx
jle 0x1023ca43
mov ecx, dword [ebp + 0x14]
mov esi, eax
sub esi, ecx
mov al, byte [esi + ecx]
xor byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x1023ca32
mov esi, dword [ebp + 0x18]
mov edx, dword [ebp + 0x1c]
add dword [edi + 8], edx
cmp edx, ebx
jge 0x1023ca8e
push esi
push dword [edi + 4]
push dword [edi]
call sub.MSVCR110.dll_memcpy
push dword [edi]
push dword [ebp + 0xc]
call dword [ebp + 0x10]
push esi
push dword [edi]
push dword [edi + 4]
call sub.MSVCR110.dll_memcpy
mov ecx, dword [ebp + 0x14]
sub ebx, dword [ebp + 0x1c]
add ecx, dword [ebp + 0x1c]
mov esi, dword [edi + 4]
add esp, 0x20
test ebx, ebx
jle 0x1023ca8b
sub esi, ecx
mov edx, ebx
nop
mov al, byte [esi + ecx]
xor byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x1023ca80
mov dword [edi + 8], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1023e920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 0x1065cd00
push ebx
push esi
push edi
dec eax
mov edi, 0x1065cd00
mov word [0x1065ce00], 0
mov word [0x1065cd00], 0x301
mov byte [0x1065ce03], 1
mov ebx, 2
lea esi, [eax + 2]
sub edi, eax
mov dl, byte [esi]
push edx
call fcn.1023f440
xor al, dl
mov byte [edi + esi], al
movzx eax, al
add esp, 4
mov byte [eax + 0x1065ce00], bl
inc ebx
lea esi, [esi + 1]
cmp ebx, 0x100
jl 0x1023e957
mov byte [0x1065cb00], 0x63
mov byte [0x1065cc63], 0
mov ebx, 1
nop
mov al, bl
push eax
mov dword [ebp - 8], eax
call fcn.1023e820
mov ecx, dword [ebp - 8]
mov byte [ebx + 0x1065cb00], al
movzx eax, al
inc ebx
add esp, 4
mov byte [eax + 0x1065cc00], cl
cmp ebx, 0x100
jl 0x1023e990
mov al, 1
mov byte [ebp - 8], al
mov edx, 0x1065d700
push dword [ebp - 8]
movzx eax, al
mov dword [edx], eax
call fcn.1023f440
add edx, 4
add esp, 4
mov byte [ebp - 8], al
cmp edx, 0x1065d778
jl 0x1023e9c3
mov bl, byte [0x10646fff]
mov bh, byte [0x10646ffe]
xor edi, edi
nop
mov dl, byte [edi + 0x1065cb00]
mov byte [ebp - 8], dl
push dword [ebp - 8]
call fcn.1023f440
mov cl, al
mov byte [ebp - 4], al
lea eax, [ebp - 4]
xor cl, dl
push eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
mov byte [ebp - 3], dl
call fcn.10249c60
mov dword [edi*4 + 0x1065cf00], eax
mov al, byte [edi + 0x1065cc00]
mov byte [ebp - 8], al
mov eax, dword [0x10646ffc]
mov esi, dword [ebp - 8]
movzx eax, al
push esi
push eax
call fcn.1023eaa0
mov byte [ebp - 1], al
mov eax, dword [0x10646ffc]
movzx eax, ah
push esi
push eax
call fcn.1023eaa0
mov byte [ebp - 2], al
movzx eax, bh
push esi
push eax
call fcn.1023eaa0
mov byte [ebp - 3], al
movzx eax, bl
push esi
push eax
call fcn.1023eaa0
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
call fcn.10249c60
mov dword [edi*4 + 0x1065d300], eax
inc edi
add esp, 0x2c
cmp edi, 0x100
jl 0x1023e9f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1023f910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
lea ecx, [eax + 0xb8]
push edi
mov dword [ebp - 4], ecx
lea ebx, [eax + 0xabc]
mov dword [ebp - 8], 0x100
movzx edi, byte [ecx + 0x100]
mov ecx, edi
and ecx, 3
mov eax, edi
movzx esi, byte [ecx + 0x10647000]
shr eax, 2
xor esi, eax
movzx eax, byte [ecx + 0x10647004]
mov edx, edi
shr edx, 1
xor edx, edi
shr edx, 1
xor edx, eax
xor edx, edi
mov eax, edx
imul edx, edx, 0x1000100
imul eax, eax, 0x10100
xor esi, edi
add eax, esi
add edx, esi
shl eax, 8
add eax, edi
mov dword [ebx - 0x800], eax
mov eax, dword [ebp - 4]
shl edi, 0x10
add edi, edx
mov dword [ebx], edi
movzx esi, byte [eax]
mov ecx, esi
and ecx, 3
mov eax, esi
movzx edi, byte [ecx + 0x10647000]
shr eax, 2
xor edi, eax
movzx eax, byte [ecx + 0x10647004]
mov edx, esi
shr edx, 1
xor edx, esi
shr edx, 1
xor edx, eax
xor edx, esi
mov eax, edx
xor edi, esi
imul eax, eax, 0x101
mov ecx, esi
shl ecx, 8
add ecx, edi
imul edi, edi, 0x1000001
shl ecx, 0x10
shl edx, 8
add ecx, eax
add edx, esi
mov dword [ebx - 0x400], ecx
mov ecx, dword [ebp - 4]
shl edx, 8
add edx, edi
inc ecx
dec dword [ebp - 8]
mov dword [ebx + 0x400], edx
lea ebx, [ebx + 4]
mov dword [ebp - 4], ecx
jne 0x1023f932
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10243440
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
push 0x2911
push 0xd
mov eax, esi
xor eax, 0x1fff
push eax
push 0x2911
push 0xd
push eax
push eax
call fcn.10243400
add esp, 0x10
push eax
call fcn.10243400
mov byte [esi + 0x10664360], al
inc esi
add esp, 0x10
cmp esi, 0x2000
jb 0x10243443
xor esi, esi
lea ecx, [ecx]
push 0xaa7
push 0xb
mov eax, esi
xor eax, 0x7ff
push eax
push 0xaa7
push 0xb
push eax
push eax
call fcn.10243400
add esp, 0x10
push eax
call fcn.10243400
mov byte [esi + 0x10663b60], al
inc esi
add esp, 0x10
cmp esi, 0x800
jb 0x10243480
xor eax, eax
pop esi
jmp 0x102434c0
mov edx, eax
and edx, 0xfffffff8
shl edx, 7
mov ecx, eax
and ecx, 4
or edx, ecx
shl edx, 7
mov ecx, eax
and ecx, 2
or edx, ecx
shl edx, 7
mov ecx, eax
and ecx, 1
or edx, ecx
shl edx, 7
mov dword [eax*8 + 0x10663360], edx
mov edx, eax
and edx, 0xffffff80
shl edx, 7
mov ecx, eax
and ecx, 0x40
or edx, ecx
shl edx, 7
mov ecx, eax
and ecx, 0x20
or edx, ecx
mov ecx, eax
shl edx, 7
and ecx, 0x10
or edx, ecx
shl edx, 3
mov dword [eax*8 + 0x10663364], edx
inc eax
cmp eax, 0x100
jb 0x102434c0
ret

Function at 0x10244350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 0x1065d988
push ebx
push esi
push edi
dec eax
mov edi, 0x1065d988
mov word [0x1065da88], 0
mov word [0x1065d988], 0x301
mov byte [0x1065da8b], 1
mov ebx, 2
lea esi, [eax + 2]
sub edi, eax
mov dl, byte [esi]
push edx
call fcn.1023f440
xor al, dl
mov byte [edi + esi], al
movzx eax, al
add esp, 4
mov byte [eax + 0x1065da88], bl
inc ebx
lea esi, [esi + 1]
cmp ebx, 0x100
jl 0x10244387
mov byte [0x1065d788], 0x63
mov byte [0x1065d8eb], 0
mov ebx, 1
nop
mov al, bl
push eax
mov dword [ebp - 8], eax
call fcn.10244250
mov ecx, dword [ebp - 8]
mov byte [ebx + 0x1065d788], al
movzx eax, al
inc ebx
add esp, 4
mov byte [eax + 0x1065d888], cl
cmp ebx, 0x100
jl 0x102443c0
mov al, 1
mov byte [ebp - 8], al
mov edx, 0x1065e388
push dword [ebp - 8]
movzx eax, al
mov dword [edx], eax
call fcn.1023f440
add edx, 4
add esp, 4
mov byte [ebp - 8], al
cmp edx, 0x1065e400
jl 0x102443f3
mov bl, byte [0x106480b3]
mov bh, byte [0x106480b2]
xor edi, edi
nop
mov dl, byte [edi + 0x1065d788]
mov byte [ebp - 8], dl
push dword [ebp - 8]
call fcn.1023f440
mov cl, al
mov byte [ebp - 4], al
lea eax, [ebp - 4]
xor cl, dl
push eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
mov byte [ebp - 3], dl
call fcn.10249c60
mov dword [edi*4 + 0x1065db88], eax
mov al, byte [edi + 0x1065d888]
mov byte [ebp - 8], al
mov eax, dword [0x106480b0]
mov esi, dword [ebp - 8]
movzx eax, al
push esi
push eax
call fcn.102444d0
mov byte [ebp - 1], al
mov eax, dword [0x106480b0]
movzx eax, ah
push esi
push eax
call fcn.102444d0
mov byte [ebp - 2], al
movzx eax, bh
push esi
push eax
call fcn.102444d0
mov byte [ebp - 3], al
movzx eax, bl
push esi
push eax
call fcn.102444d0
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
call fcn.10249c60
mov dword [edi*4 + 0x1065df88], eax
inc edi
add esp, 0x2c
cmp edi, 0x100
jl 0x10244420
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10245aa0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x106499c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
xorps xmm0, xmm0
mov edi, ebx
shr edi, 2
xor ecx, ecx
movq qword [ebp - 0x28], xmm0
movq qword [ebp - 0x20], xmm0
movq qword [ebp - 0x18], xmm0
movq qword [ebp - 0x10], xmm0
mov dword [ebp - 8], 0
test edi, edi
je 0x10245afe
mov edx, dword [ebp + 0xc]
add edx, 0xfffffffc
lea edx, [edx + edi*4]
jmp 0x10245af0
mov eax, dword [edx]
mov dword [ebp + ecx*4 - 0x28], eax
inc ecx
lea edx, [edx - 4]
cmp ecx, edi
jb 0x10245af0
mov dword [esi + 0x210], ebx
xor edi, edi
mov byte [ebp + ebx - 0x28], 0
cmp dword [esi + 0x210], edi
jbe 0x10245b42
mov ebx, esi
lea eax, [ebp - 0x28]
sub ebx, eax
lea ebx, [ebx]
lea edx, [ebp - 0x28]
add edx, edi
lea ecx, [ebp - 0x28]
add ecx, dword [esi + 0x210]
movzx eax, byte [edx]
xor byte [ecx], al
movzx eax, byte [edx]
inc edi
mov byte [ebx + edx], al
cmp edi, dword [esi + 0x210]
jb 0x10245b20
mov edx, dword [esi + 0x210]
xor edi, edi
test edx, edx
je 0x10245c11
lea eax, [esi + 0x10]
lea ebx, [edi + 0x23]
mov dword [ebp - 0x2c], eax
jmp 0x10245b60
xor ecx, ecx
mov al, byte [ebp + ecx - 0x28]
rol al, 3
mov byte [ebp + ecx - 0x28], al
inc ecx
cmp ecx, edx
jbe 0x10245b62
lea eax, [edi + 1]
xor edx, edx
cmp edi, 0x10
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
jae 0x10245bd0
jmp 0x10245b90
lea ecx, [ebx + edx]
and ecx, 0xff
movzx ecx, byte [ecx + 0x106480b8]
mov cl, byte [ecx + 0x106480b8]
add cl, byte [ebp + eax - 0x28]
mov byte [edi + edx], cl
cmp eax, dword [esi + 0x210]
jne 0x10245bb9
xor eax, eax
jmp 0x10245bba
inc eax
inc edx
cmp edx, 0x10
jb 0x10245b90
jmp 0x10245bf9
lea ecx, [ebx + edx]
and ecx, 0xff
mov cl, byte [ecx + 0x106480b8]
add cl, byte [ebp + eax - 0x28]
mov byte [edi + edx], cl
cmp eax, dword [esi + 0x210]
jne 0x10245bf2
xor eax, eax
jmp 0x10245bf3
inc eax
inc edx
cmp edx, 0x10
jb 0x10245bd0
mov edi, dword [ebp - 0x30]
mov edx, dword [esi + 0x210]
add dword [ebp - 0x2c], 0x10
add ebx, 0x11
cmp edi, edx
jb 0x10245b60
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.10311bec
mov esp, ebp
pop ebp
ret
Function at 0x102460c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0xc
cmp dword [ebp + 0x10], 0x20
je 0x102460d6
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
push ebx
mov edx, dword [ecx + 4]
mov ebx, dword [ecx]
push esi
mov esi, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
push edi
mov dword [ebp - 4], esi
mov dword [eax + 8], esi
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov dword [eax], ebx
mov dword [eax + 4], edx
mov dword [eax + 0xc], ecx
mov esi, eax
mov edi, 0xfc
mov edx, dword [esi + 0xc]
add edx, dword [esi]
lea esi, [esi + 4]
mov ecx, edx
and ecx, 7
shr edx, 3
xor edx, dword [ecx*4 + 0x105159ac]
mov dword [esi + 0xc], edx
dec edi
jne 0x10246102
xor edx, edx
mov ecx, dword [eax + edx*4 + 0x164]
add dword [eax + edx*4], ecx
inc edx
cmp edx, 0x17
jb 0x10246121
mov edi, dword [eax + 0xec]
mov edx, dword [eax + 0x84]
and edi, 0xff7fffff
or edi, 0x1000001
xor esi, esi
jmp 0x10246150
mov ecx, dword [eax + esi*4]
and edx, 0xff7fffff
add edx, edi
and ecx, 0xffffff
xor ecx, edx
mov dword [eax + esi*4], ecx
inc esi
cmp esi, 0x100
jb 0x10246150
mov ecx, dword [eax]
and edx, 0xff
mov dword [eax + 0x400], ecx
xor esi, esi
nop
mov ecx, edx
xor ecx, esi
inc esi
mov ecx, dword [eax + ecx*4]
xor edx, ecx
and edx, 0xff
mov ecx, dword [eax + edx*4]
mov dword [eax + esi*4 - 4], ecx
mov ecx, dword [eax + esi*4]
mov dword [eax + edx*4], ecx
cmp esi, 0x100
jb 0x10246180
mov ecx, dword [ebp - 8]
mov dword [eax + 0x408], ecx
mov ecx, dword [ebp - 4]
mov dword [eax + 0x40c], ecx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax + 0x404], ebx
pop esi
mov dword [eax + 0x414], 0
mov dword [eax + 0x410], ecx
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x102461e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push ebx
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
lea ebx, [edi + 0x1044]
mov dword [ebp + 8], 0x10
xor eax, dword [ebx]
lea ebx, [ebx - 4]
mov edx, eax
shr edx, 0x10
and edx, 0xff
mov ecx, eax
mov edx, dword [edi + edx*4 + 0x400]
shr ecx, 0x18
mov esi, eax
add edx, dword [edi + ecx*4]
mov ecx, eax
shr ecx, 8
and ecx, 0xff
movzx eax, al
xor edx, dword [edi + ecx*4 + 0x800]
add edx, dword [edi + eax*4 + 0xc00]
xor edx, dword [ebp - 4]
dec dword [ebp + 8]
mov eax, edx
mov edx, esi
mov dword [ebp - 4], edx
jne 0x10246202
mov ecx, dword [edi + 0x1004]
xor ecx, eax
mov eax, dword [edi + 0x1000]
xor eax, edx
mov edx, dword [ebp + 0xc]
pop edi
pop esi
mov dword [edx], eax
mov dword [edx + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x102493e0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x106499c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x1880
push 0
push ebx
call sub.MSVCR110.dll_memset
push ebx
call fcn.10248e50
mov esi, dword [ebp + 0xc]
add esp, 0x10
xor edx, edx
movsx ecx, byte [edx + 0x10648438]
dec ecx
mov eax, ecx
sar eax, 3
and ecx, 7
movsx eax, byte [eax + esi]
test dword [ecx*4 + 0x106486d0], eax
movsx ecx, byte [edx + 0x10648439]
setne al
mov byte [ebp + edx - 0x3c], al
dec ecx
mov eax, ecx
sar eax, 3
and ecx, 7
movsx eax, byte [eax + esi]
test dword [ecx*4 + 0x106486d0], eax
movsx ecx, byte [edx + 0x1064843a]
setne al
mov byte [ebp + edx - 0x3b], al
dec ecx
mov eax, ecx
sar eax, 3
and ecx, 7
movsx eax, byte [eax + esi]
test dword [ecx*4 + 0x106486d0], eax
movsx ecx, byte [edx + 0x1064843b]
setne al
mov byte [ebp + edx - 0x3a], al
dec ecx
mov eax, ecx
sar eax, 3
and ecx, 7
movsx eax, byte [eax + esi]
test dword [ecx*4 + 0x106486d0], eax
setne al
mov byte [ebp + edx - 0x39], al
add edx, 4
cmp edx, 0x38
jl 0x10249411
xor edi, edi
lea esi, [edi + 0x1c]
lea ebx, [ebx]
movsx ecx, byte [edi + 0x10648470]
xor edx, edx
lea esp, [esp]
cmp edx, 0x1c
mov eax, 0x38
cmovl eax, esi
cmp ecx, eax
mov eax, ecx
jl 0x102494d4
lea eax, [ecx - 0x1c]
mov al, byte [ebp + eax - 0x3c]
mov byte [ebp + edx - 0x74], al
inc edx
inc ecx
cmp edx, 0x38
jl 0x102494c0
xor ecx, ecx
jmp 0x102494f0
movsx eax, byte [ecx + 0x10648480]
cmp byte [ebp + eax - 0x75], 0
je 0x10249521
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
mov eax, ecx
lea esi, [edx + edi*8]
lea edx, [edx + edx*2]
add edx, edx
sub eax, edx
mov eax, dword [eax*4 + 0x106486d0]
sar eax, 2
or byte [esi + ebx], al
inc ecx
cmp ecx, 0x30
jl 0x102494f0
inc edi
mov esi, 0x1c
cmp edi, 0x10
jl 0x102494b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.10311bec
mov esp, ebp
pop ebp
ret

Function at 0x10249620
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x800
add eax, 0x1080
push 0
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
xor edi, edi
mov ebx, 0x210
xor esi, esi
jmp 0x10249650
xor edx, edx
movsx eax, byte [edx + 0x106483f8]
dec eax
mov ecx, eax
sar ecx, 2
cmp ecx, edi
jne 0x1024968b
and eax, 3
test dword [eax*4 + 0x106486f0], esi
je 0x1024968b
mov eax, edx
sar eax, 3
add eax, dword [ebp + 8]
lea ecx, [ebx + esi]
lea ecx, [eax + ecx*8]
mov eax, edx
and eax, 7
mov al, byte [eax*4 + 0x106486d0]
or byte [ecx], al
inc edx
cmp edx, 0x40
jl 0x10249652
inc esi
cmp esi, 0x10
jl 0x10249650
add ebx, 0x10
inc edi
cmp ebx, 0x310
jl 0x10249645
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x102496b0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x800
add eax, 0x880
push 0
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
xor edi, edi
mov ebx, pe_nt_image_headers32
xor esi, esi
jmp 0x102496e0
xor edx, edx
movsx eax, byte [edx + 0x106483b8]
dec eax
mov ecx, eax
sar ecx, 2
cmp ecx, edi
jne 0x1024971b
and eax, 3
test dword [eax*4 + 0x106486f0], esi
je 0x1024971b
mov eax, edx
sar eax, 3
add eax, dword [ebp + 8]
lea ecx, [ebx + esi]
lea ecx, [eax + ecx*8]
mov eax, edx
and eax, 7
mov al, byte [eax*4 + 0x106486d0]
or byte [ecx], al
inc edx
cmp edx, 0x40
jl 0x102496e2
inc esi
cmp esi, 0x10
jl 0x102496e0
add ebx, 0x10
inc edi
cmp ebx, 0x210
jl 0x102496d5
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10249880
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x106499c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor edx, edx
jmp 0x102498a0
xor eax, eax
movsx ecx, byte [eax + 0x106486b0]
dec ecx
cmp ecx, edx
je 0x102498b6
inc eax
cmp eax, 0x20
jl 0x102498a2
jmp 0x102498ba
mov byte [ebp + edx - 0x24], al
inc edx
cmp edx, 0x20
jl 0x102498a0
lea eax, [ebp - 0x23]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0x106484b0
sub edi, 0xffffff80
xor esi, esi
mov ecx, esi
sar ecx, 1
mov eax, esi
and eax, 1
shl eax, 4
and ecx, 0xf
or ecx, eax
mov eax, esi
and eax, 0x20
or ecx, eax
mov eax, dword [ebp - 0x2c]
xor edx, edx
movsx ebx, byte [eax + ecx]
test bl, 8
je 0x1024990d
mov eax, dword [ebp - 0x28]
mov ecx, 0x1f
movsx eax, byte [eax - 1]
sub ecx, eax
mov edx, 1
shl edx, cl
test bl, 4
je 0x10249928
mov eax, dword [ebp - 0x28]
mov ecx, 0x1f
movsx eax, byte [eax]
sub ecx, eax
mov eax, 1
shl eax, cl
or edx, eax
test bl, 2
je 0x10249944
mov eax, dword [ebp - 0x28]
mov ecx, 0x1f
movsx eax, byte [eax + 1]
sub ecx, eax
mov eax, 1
shl eax, cl
or edx, eax
test bl, 1
mov ebx, dword [ebp - 0x28]
je 0x10249960
movsx eax, byte [ebx + 2]
mov ecx, 0x1f
sub ecx, eax
mov eax, 1
shl eax, cl
or edx, eax
mov dword [edi], edx
inc esi
add edi, 4
cmp esi, 0x40
jl 0x102498d2
mov eax, dword [ebp - 0x2c]
add eax, 0x40
add ebx, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], ebx
cmp eax, 0x106486b0
jl 0x102498d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10311bec
mov esp, ebp
pop ebp
ret
Function at 0x10249aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 0x1065e608
push ebx
push esi
push edi
dec eax
mov edi, 0x1065e608
mov word [0x1065e708], 0
mov word [0x1065e608], 0x301
mov byte [0x1065e70b], 1
mov ebx, 2
lea esi, [eax + 2]
sub edi, eax
mov dl, byte [esi]
push edx
call fcn.1023f440
xor al, dl
mov byte [edi + esi], al
movzx eax, al
add esp, 4
mov byte [eax + 0x1065e708], bl
inc ebx
lea esi, [esi + 1]
cmp ebx, 0x100
jl 0x10249ad7
mov byte [0x1065e408], 0x63
mov byte [0x1065e56b], 0
mov ebx, 1
nop
mov al, bl
push eax
mov dword [ebp - 8], eax
call fcn.102499a0
mov ecx, dword [ebp - 8]
mov byte [ebx + 0x1065e408], al
movzx eax, al
inc ebx
add esp, 4
mov byte [eax + 0x1065e508], cl
cmp ebx, 0x100
jl 0x10249b10
mov al, 1
mov byte [ebp - 8], al
mov edx, 0x1065f008
push dword [ebp - 8]
movzx eax, al
mov dword [edx], eax
call fcn.1023f440
add edx, 4
add esp, 4
mov byte [ebp - 8], al
cmp edx, 0x1065f080
jl 0x10249b43
mov bl, byte [0x10648703]
mov bh, byte [0x10648702]
xor edi, edi
nop
mov dl, byte [edi + 0x1065e408]
mov byte [ebp - 8], dl
push dword [ebp - 8]
call fcn.1023f440
mov cl, al
mov byte [ebp - 4], al
lea eax, [ebp - 4]
xor cl, dl
push eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
mov byte [ebp - 3], dl
call fcn.10249c60
mov dword [edi*4 + 0x1065e808], eax
mov al, byte [edi + 0x1065e508]
mov byte [ebp - 8], al
mov eax, dword [0x10648700]
mov esi, dword [ebp - 8]
movzx eax, al
push esi
push eax
call fcn.10249c20
mov byte [ebp - 1], al
mov eax, dword [0x10648700]
movzx eax, ah
push esi
push eax
call fcn.10249c20
mov byte [ebp - 2], al
movzx eax, bh
push esi
push eax
call fcn.10249c20
mov byte [ebp - 3], al
movzx eax, bl
push esi
push eax
call fcn.10249c20
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
call fcn.10249c60
mov dword [edi*4 + 0x1065ec08], eax
inc edi
add esp, 0x2c
cmp edi, 0x100
jl 0x10249b70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret