joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a740
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
sub esp, 0x24
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], ecx
add eax, 0x13
mov dword [esp + 0x1c], eax
mov eax, dword [0x100951f8]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0x31bd9f95]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, 1
mov dword [esp + 0xc], eax
je 0x1000a908
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov cl, byte [ecx + eax]
mov byte [esp + 6], cl
mov ecx, 0x13
xor edx, edx
div ecx
mov eax, dword [esp + 0x14]
mov ecx, edx
mov dl, byte [esp + 6]
mov cl, byte [eax + ecx]
mov al, dl
xor al, 0xff
and al, 0x6b
mov ch, 0xff
xor ch, 0x6b
mov dh, dl
and dh, ch
mov ah, 0xff
xor ah, 0xff
and ah, 0x6b
and ch, 0xff
or al, dh
or ah, ch
xor al, ah
xor al, 0xff
xor al, 0xc2
and al, 0xc2
mov ch, 0xff
xor ch, 0xc2
and ch, 0xff
mov ah, 0xff
xor ah, 0xff
and ah, 0xc2
or ch, ah
mov ah, ch
xor ah, 0xff
mov bl, dl
xor bl, ah
and bl, dl
mov dl, cl
xor dl, 0xff
and dl, 0xff
mov dh, 0xff
xor dh, 0xff
mov ah, cl
and ah, dh
or dl, ah
mov dh, 0xff
xor dh, 0xc2
mov ah, dl
xor ah, dh
and ah, dl
xor cl, 0xff
xor ch, 0xff
mov dl, 0xff
xor dl, 0x60
or cl, ch
or dl, 0x60
xor cl, 0xff
and cl, dl
mov byte [esp + 7], cl
mov cl, al
xor cl, 0xff
mov ch, bl
xor ch, 0xff
mov dl, 0xff
xor dl, 0x92
mov bh, cl
and bh, 0x92
and al, dl
mov dh, ch
and dh, 0x92
and bl, dl
or bh, al
mov al, byte [esp + 7]
or dh, bl
xor bh, dh
or cl, ch
xor cl, 0xff
or dl, 0x92
and cl, dl
or bh, cl
mov cl, ah
xor cl, 0xff
mov ch, al
xor ch, 0xff
mov dl, 0xff
xor dl, 0xa8
mov bl, cl
and bl, 0xa8
and ah, dl
mov dh, ch
and dh, 0xa8
and al, dl
or bl, ah
or dh, al
mov eax, dword [esp + 8]
xor bl, dh
or cl, ch
xor cl, 0xff
or dl, 0xa8
and cl, dl
or bl, cl
mov dl, bh
xor dl, 0xff
and dl, 0x90
mov cl, 0xff
xor cl, 0x90
and bh, cl
mov dh, bl
xor dh, 0xff
and dh, 0x90
and bl, cl
mov ecx, dword [esp + 0x18]
or dl, bh
or dh, bl
xor dl, dh
mov byte [ecx + eax], dl
sub eax, 0xbd5f4798
sub eax, 0xd9f63169
add eax, 0xbd5f4798
sub eax, 0x14c53885
add eax, 1
add eax, 0x14c53885
add eax, 0x82168f22
add eax, 0xd9f63169
sub eax, 0x82168f22
cmp eax, 0x3559
mov dword [esp + 0xc], eax
jne 0x1000a785
mov eax, dword [0x100951f8]
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax + 0x31bd9f95], 1
jmp 0x1000a908
add esp, 0x24
pop ebx
ret
Function at 0x1000a910
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub esp, 0x20
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
add eax, 0x10
mov dword [esp + 0x18], eax
mov eax, dword [0x100951fc]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp dword [eax + 0x432e7c56], 1
sete al
mov byte [esp + 0xf], al
mov cl, byte [esp + 0xf]
xor eax, eax
test cl, 1
mov dword [esp + 8], eax
jne 0x1000aa9d
jmp 0x1000a95e
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov dword [esp + 4], edx
mov al, byte [eax + edx]
and edx, 0xf
mov dl, byte [ecx + edx]
mov ch, al
xor ch, 0xff
and ch, 8
mov ah, 0xff
xor ah, 8
mov dh, al
and dh, ah
mov cl, 0xff
xor cl, 0xff
and cl, 8
and ah, 0xff
or ch, dh
or cl, ah
xor ch, cl
xor ch, 0xff
xor ch, 0x8e
and ch, 0x8e
mov bh, 0xff
xor bh, 0x8e
and bh, 0xff
mov cl, 0xff
xor cl, 0xff
and cl, 0x8e
or bh, cl
mov cl, bh
xor cl, 0xff
mov dh, al
xor dh, cl
and dh, al
mov bl, dl
xor bl, 0xff
and bl, 0xf1
mov cl, 0xff
xor cl, 0xf1
mov ah, dl
and ah, cl
mov al, 0xff
xor al, 0xff
and al, 0xf1
and cl, 0xff
or bl, ah
or al, cl
xor bl, al
mov al, 0xff
xor al, 0x8e
mov cl, bl
xor cl, al
mov eax, dword [esp + 4]
and cl, bl
xor dl, 0xff
xor bh, 0xff
mov bl, 0xff
xor bl, 0x41
or dl, bh
or bl, 0x41
xor dl, 0xff
and dl, bl
mov bh, ch
and bh, dh
xor ch, dh
or bh, ch
mov bl, cl
and bl, dl
xor cl, dl
or bl, cl
mov dl, bh
xor dl, 0xff
and dl, 0xaf
mov cl, 0xff
xor cl, 0xaf
and bh, cl
mov dh, bl
xor dh, 0xff
and dh, 0xaf
and bl, cl
mov ecx, dword [esp + 0x14]
or dl, bh
or dh, bl
xor dl, dh
mov byte [ecx + eax], dl
mov ecx, 0x86b3835f
add ecx, 0
sub ecx, eax
sub ecx, 0x86b3835f
mov eax, 0xb28dbe7d
add eax, 0
sub eax, 1
sub eax, 0xb28dbe7d
sub ecx, 0xafde087e
add ecx, eax
add ecx, 0xafde087e
xor eax, eax
sub eax, 0x6d7685f6
sub eax, ecx
add eax, 0x6d7685f6
cmp eax, 0x3559
mov dword [esp + 8], eax
jne 0x1000a95e
mov eax, dword [0x100951fc]
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax + 0x432e7c56], 1
jmp 0x1000aa9d
add esp, 0x20
pop ebx
ret
Function at 0x1000aab0
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub esp, 0x20
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
add eax, 0x10
mov dword [esp + 0x18], eax
mov eax, dword [0x10095200]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add eax, 0xdd1d09a1
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp dword [ecx], 1
mov dword [esp + 8], eax
je 0x1000ac34
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], edx
mov cl, byte [ecx + edx]
and edx, 0xf
mov bh, byte [eax + edx]
mov dl, cl
xor dl, 0xff
and dl, 0x3e
mov ah, 0xff
xor ah, 0x3e
mov ch, cl
and ch, ah
mov al, 0xff
xor al, 0xff
and al, 0x3e
and ah, 0xff
or dl, ch
or al, ah
xor dl, al
mov bl, 0xff
xor bl, 0x15
xor dl, 0xff
mov al, 0xff
xor al, 7
or bl, dl
or al, 7
xor bl, 0xff
and bl, al
mov dh, 0xff
xor dh, 0x15
and dh, 0xff
mov al, 0xff
xor al, 0xff
and al, 0x15
or dh, al
xor cl, 0xff
mov dl, dh
xor dl, 0xff
mov al, 0xff
xor al, 0x83
or cl, dl
or al, 0x83
xor cl, 0xff
and cl, al
mov dl, bh
xor dl, 0xff
and dl, 0x1d
mov ah, 0xff
xor ah, 0x1d
mov ch, bh
and ch, ah
mov al, 0xff
xor al, 0xff
and al, 0x1d
and ah, 0xff
or dl, ch
or al, ah
xor dl, al
xor dl, 0xff
mov al, 0xff
xor al, 0x15
mov ch, 0xff
xor ch, 0xb4
or dl, al
mov eax, dword [esp + 4]
or ch, 0xb4
xor dl, 0xff
and dl, ch
xor bh, 0xff
xor dh, 0xff
mov ch, 0xff
xor ch, 0x5a
or bh, dh
or ch, 0x5a
xor bh, 0xff
and bh, ch
mov dh, bl
and dh, cl
xor bl, cl
mov ecx, dword [esp + 0x14]
or dh, bl
mov bl, dl
and bl, bh
xor dl, bh
or bl, dl
mov bh, dh
xor bh, 0xff
mov dl, bl
and dl, bh
xor bl, 0xff
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
sub eax, 0xe5fa848d
sub eax, 0xbcfdb6f3
add eax, 0xe5fa848d
add eax, 0x969094bb
add eax, 1
sub eax, 0x969094bb
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0xbcfdb6f3
add ecx, eax
xor eax, eax
sub eax, ecx
cmp eax, 0x3381
mov dword [esp + 8], eax
jne 0x1000aaf4
mov eax, dword [0x10095200]
add eax, 0xdd1d09a1
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
jmp 0x1000ac34
add esp, 0x20
pop ebx
ret
Function at 0x1000ac40
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
add eax, 0x14
mov dword [esp + 0x18], eax
mov eax, dword [0x10095204]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp dword [ecx - 0x21c19ebc], 1
mov dword [esp + 8], eax
je 0x1000ad53
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov dword [esp + 4], eax
mov bl, byte [edx + eax]
mov esi, 0x14
xor edx, edx
div esi
mov eax, dword [esp + 4]
mov ch, byte [ecx + edx]
mov dl, bl
xor dl, 0xff
and dl, 0xff
mov dh, 0xff
xor dh, 0xff
mov cl, bl
and cl, dh
or dl, cl
mov dh, ch
xor dh, 0xff
xor dl, 0xff
mov cl, 0xff
xor cl, 0x87
or dh, dl
or cl, 0x87
xor dh, 0xff
and dh, cl
mov bh, ch
xor bh, 0xff
and bh, 0x56
mov cl, 0xff
xor cl, 0x56
and ch, cl
mov dl, 0xff
xor dl, 0xff
and dl, 0x56
and cl, 0xff
or bh, ch
or dl, cl
mov ecx, dword [esp + 0x14]
xor bh, dl
xor bl, 0xff
xor bh, 0xff
mov dl, 0xff
xor dl, 0x92
or bl, bh
or dl, 0x92
xor bl, 0xff
and bl, dl
mov dl, dh
and dl, bl
xor dh, bl
or dl, dh
mov byte [ecx + eax], dl
mov ecx, 0x21778259
add ecx, 0
sub ecx, 1
sub ecx, 0x21778259
add eax, 0xe9dd4bc8
sub eax, ecx
sub eax, 0xe9dd4bc8
cmp eax, 0x3559
mov dword [esp + 8], eax
jne 0x1000ac7c
mov eax, dword [0x10095204]
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax - 0x21c19ebc], 1
jmp 0x1000ad53
add esp, 0x1c
pop esi
pop ebx
ret
Function at 0x1000ad60
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x28
mov eax, dword [esp + 0x38]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
add eax, 0x1f
mov dword [esp + 0x20], eax
mov eax, dword [0x10095208]
add eax, 0x7c96f574
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
cmp dword [eax], 1
sete al
mov byte [esp + 0x17], al
mov cl, byte [esp + 0x17]
xor eax, eax
test cl, 1
mov dword [esp + 0x10], eax
jne 0x1000ae8a
jmp 0x1000adb0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov dword [esp + 8], eax
mov dl, byte [edx + eax]
mov byte [esp + 0xf], dl
mov esi, 0x1f
xor edx, edx
div esi
mov eax, dword [esp + 8]
mov esi, edx
mov dl, byte [esp + 0xf]
mov ch, byte [ecx + esi]
mov cl, dl
xor cl, 0xff
and cl, 0xc9
mov bl, 0xff
xor bl, 0xc9
mov bh, dl
and bh, bl
mov dh, 0xff
xor dh, 0xff
and dh, 0xc9
and bl, 0xff
or cl, bh
or dh, bl
xor cl, dh
xor cl, 0xff
mov dh, ch
xor dh, cl
and dh, ch
mov bh, ch
xor bh, 0xff
and bh, 0x9c
mov cl, 0xff
xor cl, 0x9c
and ch, cl
mov bl, 0xff
xor bl, 0xff
and bl, 0x9c
and cl, 0xff
or bh, ch
or bl, cl
mov ecx, dword [esp + 0x1c]
xor bh, bl
xor bh, 0xff
mov bl, dl
xor bl, bh
and bl, dl
mov dl, dh
and dl, bl
xor dh, bl
or dl, dh
mov byte [ecx + eax], dl
mov ecx, 0x833c1a15
add ecx, 0
sub ecx, 1
sub ecx, 0x833c1a15
sub eax, 0xaeb313cd
sub eax, ecx
add eax, 0xaeb313cd
cmp eax, 0x3559
mov dword [esp + 0x10], eax
jne 0x1000adb0
mov eax, dword [0x10095208]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x7c96f574
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
add esp, 0x28
pop esi
pop ebx
ret
Function at 0x1000ae90
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x20
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], ecx
add eax, 0x1d
mov dword [esp + 0x1c], eax
mov eax, dword [0x1009520c]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp dword [ecx - 0x39292f81], 1
mov dword [esp + 0xc], eax
je 0x1000b02d
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov cl, byte [ecx + eax]
mov esi, 0x1d
xor edx, edx
div esi
mov eax, dword [esp + 0x14]
mov ch, byte [eax + edx]
mov ah, cl
xor ah, 0xff
and ah, 0xff
mov dl, 0xff
xor dl, 0xff
mov al, cl
and al, dl
or ah, al
mov al, 0xff
xor al, 0x4f
xor ah, 0xff
mov dl, 0xff
xor dl, 0xf8
or al, ah
or dl, 0xf8
xor al, 0xff
and al, dl
mov dh, 0xff
xor dh, 0x4f
and dh, 0xd9
mov ah, 0xff
xor ah, 0xd9
mov bl, ah
and bl, 0x4f
mov dl, 0xff
xor dl, 0xff
and dl, 0xd9
and ah, 0xff
or dh, bl
or dl, ah
xor dh, dl
mov dl, dh
xor dl, 0xff
mov ah, cl
xor ah, dl
and ah, cl
mov dl, ch
xor dl, 0xff
and dl, 0x2a
mov bl, 0xff
xor bl, 0x2a
mov bh, ch
and bh, bl
mov cl, 0xff
xor cl, 0xff
and cl, 0x2a
and bl, 0xff
or dl, bh
or cl, bl
xor dl, cl
mov bl, 0xff
xor bl, 0x4f
mov cl, dl
xor cl, bl
and cl, dl
xor dh, 0xff
mov dl, ch
xor dl, dh
and dl, ch
mov ch, al
xor ch, 0xff
mov bl, ah
xor bl, 0xff
mov dh, 0xff
xor dh, 0xa6
mov bh, ch
and bh, 0xa6
and al, dh
mov byte [esp + 6], al
mov al, bl
and al, 0xa6
mov byte [esp + 7], al
mov al, byte [esp + 6]
and ah, dh
or bh, al
mov al, byte [esp + 7]
or al, ah
xor bh, al
mov eax, dword [esp + 8]
or ch, bl
xor ch, 0xff
or dh, 0xa6
and ch, dh
or bh, ch
mov bl, cl
and bl, dl
xor cl, dl
or bl, cl
mov dl, bh
xor dl, 0xff
and dl, 0xf4
mov cl, 0xff
xor cl, 0xf4
and bh, cl
mov dh, bl
xor dh, 0xff
and dh, 0xf4
and bl, cl
mov ecx, dword [esp + 0x18]
or dl, bh
or dh, bl
xor dl, dh
mov byte [ecx + eax], dl
mov ecx, 0xaff78db6
add ecx, 0
sub ecx, 1
sub ecx, 0xaff78db6
add eax, 0x4a18e742
sub eax, ecx
sub eax, 0x4a18e742
cmp eax, 0x3559
mov dword [esp + 0xc], eax
jne 0x1000aecc
mov eax, dword [0x1009520c]
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax - 0x39292f81], 1
jmp 0x1000b02d
add esp, 0x20
pop esi
pop ebx
ret
Function at 0x1000b040
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub esp, 0x24
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], ecx
add eax, 0x10
mov dword [esp + 0x1c], eax
mov eax, dword [0x10095210]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
cmp dword [eax - 0x3b60e55c], 1
sete al
mov byte [esp + 0x13], al
mov cl, byte [esp + 0x13]
xor eax, eax
test cl, 1
mov dword [esp + 0xc], eax
jne 0x1000b206
jmp 0x1000b08e
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], edx
mov cl, byte [ecx + edx]
and edx, 0xf
mov dl, byte [eax + edx]
mov ch, cl
xor ch, 0xff
and ch, 0xff
mov ah, 0xff
xor ah, 0xff
mov al, cl
and al, ah
or ch, al
mov al, 0xff
xor al, 0x1b
xor ch, 0xff
mov ah, 0xff
xor ah, 0x1b
or al, ch
or ah, 0x1b
xor al, 0xff
and al, ah
mov ch, 0xff
xor ch, 0x1b
and ch, 0xff
mov ah, 0xff
xor ah, 0xff
and ah, 0x1b
or ch, ah
mov ah, ch
xor ah, 0xff
mov bh, cl
xor bh, ah
and bh, cl
mov ah, dl
xor ah, 0xff
and ah, 3
mov dh, 0xff
xor dh, 3
mov bl, dl
and bl, dh
mov cl, 0xff
xor cl, 0xff
and cl, 3
and dh, 0xff
or ah, bl
or cl, dh
xor ah, cl
xor ah, 0xff
mov dh, 0xff
xor dh, 0x1b
mov cl, 0xff
xor cl, 0xb8
or ah, dh
or cl, 0xb8
xor ah, 0xff
and ah, cl
xor ch, 0xff
mov cl, dl
xor cl, ch
and cl, dl
mov byte [esp + 7], cl
mov cl, al
xor cl, 0xff
mov ch, bh
xor ch, 0xff
mov dl, 0xff
xor dl, 0xbb
mov dh, cl
and dh, 0xbb
and al, dl
mov bl, ch
and bl, 0xbb
and bh, dl
or dh, al
mov al, byte [esp + 7]
or bl, bh
xor dh, bl
or cl, ch
xor cl, 0xff
or dl, 0xbb
and cl, dl
or dh, cl
mov dl, ah
xor dl, 0xff
mov cl, al
xor cl, 0xff
mov bh, 0xff
xor bh, 0x6c
mov bl, dl
and bl, 0x6c
and ah, bh
mov ch, cl
and ch, 0x6c
and al, bh
or bl, ah
or ch, al
mov eax, dword [esp + 8]
xor bl, ch
or dl, cl
mov ecx, dword [esp + 0x18]
xor dl, 0xff
or bh, 0x6c
and dl, bh
or bl, dl
mov bh, dh
xor bh, 0xff
mov dl, bl
and dl, bh
xor bl, 0xff
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
xor ecx, ecx
sub ecx, 0x11af33c3
sub ecx, eax
add ecx, 0x11af33c3
xor edx, edx
sub edx, 1
add edx, 0
xor eax, eax
sub eax, edx
sub ecx, eax
mov eax, 0xf8f8554f
add eax, 0
sub eax, ecx
sub eax, 0xf8f8554f
cmp eax, 0x3559
mov dword [esp + 0xc], eax
jne 0x1000b08e
mov eax, dword [0x10095210]
add eax, 0xc49f1aa4
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
jmp 0x1000b206
add esp, 0x24
pop ebx
ret
Function at 0x1000b210
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
sub esp, 0x20
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x18], ecx
add eax, 0x1f
mov dword [esp + 0x1c], eax
mov eax, dword [0x10095214]
cmp dword [eax + 0xa87d50f], 1
sete al
mov byte [esp + 0x13], al
mov cl, byte [esp + 0x13]
xor eax, eax
test cl, 1
mov dword [esp + 0xc], eax
jne 0x1000b3e1
jmp 0x1000b256
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov bh, byte [ecx + eax]
mov ecx, 0x1f
xor edx, edx
div ecx
mov eax, dword [esp + 0x14]
mov cl, byte [eax + edx]
mov al, bh
xor al, 0xff
and al, 0xc1
mov ah, 0xff
xor ah, 0xc1
mov ch, bh
and ch, ah
mov dl, 0xff
xor dl, 0xff
and dl, 0xc1
and ah, 0xff
or al, ch
or dl, ah
xor al, dl
xor al, 0xff
xor al, 0x7b
and al, 0x7b
mov ch, 0xff
xor ch, 0x7b
and ch, 0xff
mov dl, 0xff
xor dl, 0xff
and dl, 0x7b
or ch, dl
xor bh, 0xff
mov ah, ch
xor ah, 0xff
mov dl, 0xff
xor dl, 8
or bh, ah
or dl, 8
xor bh, 0xff
and bh, dl
mov ah, cl
xor ah, 0xff
and ah, 0x83
mov dh, 0xff
xor dh, 0x83
mov bl, cl
and bl, dh
mov dl, 0xff
xor dl, 0xff
and dl, 0x83
and dh, 0xff
or ah, bl
or dl, dh
xor ah, dl
xor ah, 0xff
mov dh, 0xff
xor dh, 0x7b
mov dl, 0xff
xor dl, 0x6e
or ah, dh
or dl, 0x6e
xor ah, 0xff
and ah, dl
xor cl, 0xff
xor ch, 0xff
mov dl, 0xff
xor dl, 0x6a
or cl, ch
or dl, 0x6a
xor cl, 0xff
and cl, dl
mov byte [esp + 7], cl
mov cl, al
xor cl, 0xff
mov ch, bh
xor ch, 0xff
mov dl, 0xff
xor dl, 0x1e
mov dh, cl
and dh, 0x1e
and al, dl
mov bl, ch
and bl, 0x1e
and bh, dl
or dh, al
mov al, byte [esp + 7]
or bl, bh
xor dh, bl
or cl, ch
xor cl, 0xff
or dl, 0x1e
and cl, dl
or dh, cl
mov dl, ah
xor dl, 0xff
mov cl, al
xor cl, 0xff
mov bh, 0xff
xor bh, 0x2a
mov bl, dl
and bl, 0x2a
and ah, bh
mov ch, cl
and ch, 0x2a
and al, bh
or bl, ah
or ch, al
mov eax, dword [esp + 8]
xor bl, ch
or dl, cl
mov ecx, dword [esp + 0x18]
xor dl, 0xff
or bh, 0x2a
and dl, bh
or bl, dl
mov bh, dh
xor bh, 0xff
mov dl, bl
and dl, bh
xor bl, 0xff
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
sub eax, 0xe4c0f726
sub eax, 0xcdc8292a
add eax, 0xe4c0f726
xor ecx, ecx
sub ecx, 1
sub eax, ecx
sub eax, 0x70c11c8a
add eax, 0xcdc8292a
add eax, 0x70c11c8a
cmp eax, 0x3559
mov dword [esp + 0xc], eax
jne 0x1000b256
mov eax, dword [0x10095214]
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax + 0xa87d50f], 1
jmp 0x1000b3e1
add esp, 0x20
pop ebx
ret
Function at 0x1000b3f0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
sub esp, 0x28
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x1c], ecx
add eax, 0x19
mov dword [esp + 0x20], eax
mov eax, dword [str.jT__r]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x2ea2716]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, 1
mov dword [esp + 0x10], eax
je 0x1000b5b8
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov bh, byte [ecx + eax]
mov ecx, 0x19
xor edx, edx
div ecx
mov eax, dword [esp + 0x18]
mov cl, byte [eax + edx]
mov al, bh
xor al, 0xff
and al, 0xff
mov ah, 0xff
xor ah, 0xff
mov dl, bh
and dl, ah
or al, dl
xor al, 0xff
xor al, 0x67
and al, 0x67
mov ch, 0xff
xor ch, 0x67
and ch, 0x65
mov ah, 0xff
xor ah, 0x65
mov dh, ah
and dh, 0x67
mov dl, 0xff
xor dl, 0xff
and dl, 0x65
and ah, 0xff
or ch, dh
or dl, ah
xor ch, dl
xor bh, 0xff
mov ah, ch
xor ah, 0xff
mov dl, 0xff
xor dl, 0xb6
or bh, ah
or dl, 0xb6
xor bh, 0xff
and bh, dl
mov ah, cl
xor ah, 0xff
and ah, 0xff
mov dh, 0xff
xor dh, 0xff
mov dl, cl
and dl, dh
or ah, dl
xor ah, 0xff
mov dh, 0xff
xor dh, 0x67
mov dl, 0xff
xor dl, 0xf
or ah, dh
or dl, 0xf
xor ah, 0xff
and ah, dl
xor cl, 0xff
xor ch, 0xff
mov dl, 0xff
xor dl, 0x88
or cl, ch
or dl, 0x88
xor cl, 0xff
and cl, dl
mov byte [esp + 0xb], cl
mov cl, al
xor cl, 0xff
mov ch, bh
xor ch, 0xff
mov dl, 0xff
xor dl, 0x5a
mov dh, cl
and dh, 0x5a
and al, dl
mov bl, ch
and bl, 0x5a
and bh, dl
or dh, al
mov al, byte [esp + 0xb]
or bl, bh
xor dh, bl
or cl, ch
xor cl, 0xff
or dl, 0x5a
and cl, dl
or dh, cl
mov dl, ah
xor dl, 0xff
mov cl, al
xor cl, 0xff
mov bh, 0xff
xor bh, 0xe8
mov bl, dl
and bl, 0xe8
and ah, bh
mov ch, cl
and ch, 0xe8
and al, bh
or bl, ah
or ch, al
mov eax, dword [esp + 0xc]
xor bl, ch
or dl, cl
mov ecx, dword [esp + 0x1c]
xor dl, 0xff
or bh, 0xe8
and dl, bh
or bl, dl
mov bh, dh
xor bh, 0xff
mov dl, bl
and dl, bh
xor bl, 0xff
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
sub eax, 0x9da3d86e
sub eax, 0xe096d4dc
add eax, 0x9da3d86e
add eax, 0xcef77a9b
add eax, 1
sub eax, 0xcef77a9b
xor ecx, ecx
sub ecx, 0xe096d4dc
sub eax, ecx
cmp eax, 0x3559
mov dword [esp + 0x10], eax
jne 0x1000b435
mov eax, dword [str.jT__r]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x2ea2716
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
add esp, 0x28
pop ebx
ret
Function at 0x1000b5c0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
sub esp, 0x28
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x1c], ecx
add eax, 0x17
mov dword [esp + 0x20], eax
mov eax, dword [0x1009521c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x2b177e81]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, 1
mov dword [esp + 0x10], eax
je 0x1000b783
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov bh, byte [ecx + eax]
mov ecx, 0x17
xor edx, edx
div ecx
mov eax, dword [esp + 0x18]
mov dl, byte [eax + edx]
mov ah, bh
xor ah, 0xff
and ah, 0xff
mov cl, 0xff
xor cl, 0xff
mov al, bh
and al, cl
or ah, al
mov al, 0xff
xor al, 0xf0
xor ah, 0xff
mov cl, 0xff
xor cl, 0x80
or al, ah
or cl, 0x80
xor al, 0xff
and al, cl
mov ch, 0xff
xor ch, 0xf0
and ch, 0xff
mov cl, 0xff
xor cl, 0xff
and cl, 0xf0
or ch, cl
xor bh, 0xff
mov ah, ch
xor ah, 0xff
mov cl, 0xff
xor cl, 0x9a
or bh, ah
or cl, 0x9a
xor bh, 0xff
and bh, cl
mov ah, dl
xor ah, 0xff
and ah, 0xff
mov dh, 0xff
xor dh, 0xff
mov cl, dl
and cl, dh
or ah, cl
xor ah, 0xff
mov dh, 0xff
xor dh, 0xf0
mov cl, 0xff
xor cl, 0x4e
or ah, dh
or cl, 0x4e
xor ah, 0xff
and ah, cl
xor ch, 0xff
mov cl, dl
xor cl, ch
and cl, dl
mov byte [esp + 0xb], cl
mov cl, al
xor cl, 0xff
mov ch, bh
xor ch, 0xff
mov dl, 0xff
xor dl, 0xc0
mov dh, cl
and dh, 0xc0
and al, dl
mov bl, ch
and bl, 0xc0
and bh, dl
or dh, al
mov al, byte [esp + 0xb]
or bl, bh
xor dh, bl
or cl, ch
xor cl, 0xff
or dl, 0xc0
and cl, dl
or dh, cl
mov dl, ah
xor dl, 0xff
mov cl, al
xor cl, 0xff
mov bh, 0xff
xor bh, 0xfb
mov bl, dl
and bl, 0xfb
and ah, bh
mov ch, cl
and ch, 0xfb
and al, bh
or bl, ah
or ch, al
mov eax, dword [esp + 0xc]
xor bl, ch
or dl, cl
mov ecx, dword [esp + 0x1c]
xor dl, 0xff
or bh, 0xfb
and dl, bh
or bl, dl
mov bh, dh
xor bh, 0xff
mov dl, bl
and dl, bh
xor bl, 0xff
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
add eax, 0x18ba4e77
sub eax, 0x21ddcaee
sub eax, 0x18ba4e77
sub eax, 0xee245b77
add eax, 1
add eax, 0xee245b77
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x21ddcaee
add ecx, eax
xor eax, eax
sub eax, ecx
cmp eax, 0x32ad
mov dword [esp + 0x10], eax
jne 0x1000b605
mov eax, dword [0x1009521c]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x2b177e81
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
add esp, 0x28
pop ebx
ret
Function at 0x1000b790
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x24
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x1c], ecx
add eax, 0x14
mov dword [esp + 0x20], eax
mov eax, dword [0x10095220]
mov eax, dword [eax + 0x1cfb71cd]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, 1
mov dword [esp + 0x10], eax
je 0x1000b8a4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov dword [esp + 8], eax
mov dl, byte [edx + eax]
mov byte [esp + 0xf], dl
mov esi, 0x14
xor edx, edx
div esi
mov eax, dword [esp + 8]
mov esi, edx
mov dl, byte [esp + 0xf]
mov bl, byte [ecx + esi]
mov cl, dl
xor cl, 0xff
and cl, 0x22
mov dh, 0xff
xor dh, 0x22
mov bh, dl
and bh, dh
mov ch, 0xff
xor ch, 0xff
and ch, 0x22
and dh, 0xff
or cl, bh
or ch, dh
xor cl, ch
xor cl, 0xff
mov dh, bl
xor dh, cl
and dh, bl
mov bh, bl
xor bh, 0xff
and bh, 0xff
mov cl, 0xff
xor cl, 0xff
and bl, cl
mov ecx, dword [esp + 0x1c]
or bh, bl
xor bh, 0xff
mov bl, dl
xor bl, bh
and bl, dl
mov dl, dh
and dl, bl
xor dh, bl
or dl, dh
mov byte [ecx + eax], dl
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0x985c579c
add ecx, eax
xor eax, eax
sub eax, ecx
sub eax, 0xb82293de
add eax, 1
add eax, 0xb82293de
xor ecx, ecx
sub ecx, 0x985c579c
add eax, ecx
cmp eax, 0x7ed
mov dword [esp + 0x10], eax
jne 0x1000b7ce
mov eax, dword [0x10095220]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x1cfb71cd
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
add esp, 0x24
pop esi
pop ebx
ret