joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c920
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
sub esp, 0x20
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x18], ecx
add eax, 0x1c
mov dword [esp + 0x1c], eax
mov eax, dword [0x10095250]
add eax, 0x8a5d7ba3
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp dword [ecx], 1
mov dword [esp + 0xc], eax
je 0x1000cab0
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov cl, byte [ecx + eax]
mov byte [esp + 7], cl
mov ecx, 0x1c
xor edx, edx
div ecx
mov eax, dword [esp + 0x14]
mov ecx, edx
mov dl, byte [esp + 7]
mov ch, byte [eax + ecx]
mov cl, dl
xor cl, 0xff
and cl, 0x4a
mov ah, 0xff
xor ah, 0x4a
mov dh, dl
and dh, ah
mov al, 0xff
xor al, 0xff
and al, 0x4a
and ah, 0xff
or cl, dh
or al, ah
xor cl, al
xor cl, 0xff
xor cl, 0xb9
and cl, 0xb9
mov dh, 0xff
xor dh, 0xb9
and dh, 0x17
mov ah, 0xff
xor ah, 0x17
mov bl, ah
and bl, 0xb9
mov al, 0xff
xor al, 0xff
and al, 0x17
and ah, 0xff
or dh, bl
or al, ah
xor dh, al
xor dl, 0xff
mov ah, dh
xor ah, 0xff
mov al, 0xff
xor al, 0x81
or dl, ah
or al, 0x81
xor dl, 0xff
and dl, al
mov al, ch
xor al, 0xff
and al, 0x46
mov bl, 0xff
xor bl, 0x46
mov bh, ch
and bh, bl
mov ah, 0xff
xor ah, 0xff
and ah, 0x46
and bl, 0xff
or al, bh
or ah, bl
xor al, ah
mov bl, 0xff
xor bl, 0xb9
mov ah, al
xor ah, bl
and ah, al
xor dh, 0xff
mov al, ch
xor al, dh
and al, ch
mov dh, cl
and dh, dl
xor cl, dl
or dh, cl
mov dl, ah
xor dl, 0xff
mov cl, al
xor cl, 0xff
mov bh, 0xff
xor bh, 0xbd
mov bl, dl
and bl, 0xbd
and ah, bh
mov ch, cl
and ch, 0xbd
and al, bh
or bl, ah
or ch, al
mov eax, dword [esp + 8]
xor bl, ch
or dl, cl
mov ecx, dword [esp + 0x18]
xor dl, 0xff
or bh, 0xbd
and dl, bh
or bl, dl
mov bh, dh
xor bh, 0xff
mov dl, bl
and dl, bh
xor bl, 0xff
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
mov ecx, 0x7e1a64ac
add ecx, 0
sub ecx, 1
sub ecx, 0x7e1a64ac
add eax, 0x20bf9a04
sub eax, ecx
sub eax, 0x20bf9a04
cmp eax, 0x3559
mov dword [esp + 0xc], eax
jne 0x1000c95c
mov eax, dword [0x10095250]
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax - 0x75a2845d], 1
jmp 0x1000cab0
add esp, 0x20
pop ebx
ret
Function at 0x1000cac0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x28
mov eax, dword [esp + 0x38]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
add eax, 0x1e
mov dword [esp + 0x20], eax
mov eax, dword [0x10095254]
add eax, 0x1f008319
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
xor eax, eax
cmp ecx, 1
mov dword [esp + 0x10], eax
je 0x1000cbef
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov dword [esp + 8], eax
mov dl, byte [edx + eax]
mov byte [esp + 0xf], dl
mov esi, 0x1e
xor edx, edx
div esi
mov eax, dword [esp + 8]
mov esi, edx
mov dl, byte [esp + 0xf]
mov ch, byte [ecx + esi]
mov bl, dl
xor bl, 0xff
and bl, 0x28
mov dh, 0xff
xor dh, 0x28
mov bh, dl
and bh, dh
mov cl, 0xff
xor cl, 0xff
and cl, 0x28
and dh, 0xff
or bl, bh
or cl, dh
xor bl, cl
mov dh, ch
xor dh, 0xff
xor bl, 0xff
mov cl, 0xff
xor cl, 0x8b
or dh, bl
or cl, 0x8b
xor dh, 0xff
and dh, cl
mov bh, ch
xor bh, 0xff
and bh, 0x25
mov cl, 0xff
xor cl, 0x25
and ch, cl
mov bl, 0xff
xor bl, 0xff
and bl, 0x25
and cl, 0xff
or bh, ch
or bl, cl
mov ecx, dword [esp + 0x1c]
xor bh, bl
xor bh, 0xff
mov bl, dl
xor bl, bh
and bl, dl
mov dl, dh
and dl, bl
xor dh, bl
or dl, dh
mov byte [ecx + eax], dl
mov ecx, 0x7237a5c5
add ecx, 0
sub ecx, 1
sub ecx, 0x7237a5c5
sub eax, 0x41fcb125
sub eax, ecx
add eax, 0x41fcb125
cmp eax, 0x3559
mov dword [esp + 0x10], eax
jne 0x1000cb07
mov eax, dword [0x10095254]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x1f008319
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
add esp, 0x28
pop esi
pop ebx
ret
Function at 0x1000cc00
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
add eax, 0x12
mov dword [esp + 0x18], eax
mov eax, dword [0x10095258]
add eax, 0xee3f994
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp dword [ecx], 1
mov dword [esp + 8], eax
je 0x1000cd33
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov dword [esp + 4], eax
mov bl, byte [edx + eax]
mov esi, 0x12
xor edx, edx
div esi
mov eax, dword [esp + 4]
mov ch, byte [ecx + edx]
mov dl, bl
xor dl, 0xff
and dl, 0x4f
mov dh, 0xff
xor dh, 0x4f
mov bh, bl
and bh, dh
mov cl, 0xff
xor cl, 0xff
and cl, 0x4f
and dh, 0xff
or dl, bh
or cl, dh
xor dl, cl
mov dh, ch
xor dh, 0xff
xor dl, 0xff
mov cl, 0xff
xor cl, 0x9e
or dh, dl
or cl, 0x9e
xor dh, 0xff
and dh, cl
mov bh, ch
xor bh, 0xff
and bh, 0xb0
mov cl, 0xff
xor cl, 0xb0
and ch, cl
mov dl, 0xff
xor dl, 0xff
and dl, 0xb0
and cl, 0xff
or bh, ch
or dl, cl
mov ecx, dword [esp + 0x14]
xor bh, dl
xor bl, 0xff
xor bh, 0xff
mov dl, 0xff
xor dl, 0x66
or bl, bh
or dl, 0x66
xor bl, 0xff
and bl, dl
mov dl, dh
and dl, bl
xor dh, bl
or dl, dh
mov byte [ecx + eax], dl
mov ecx, 0x8baf6de4
add ecx, 0
sub ecx, eax
sub ecx, 0x8baf6de4
xor edx, edx
sub edx, 1
add edx, 0
xor eax, eax
sub eax, ecx
xor ecx, ecx
sub ecx, edx
add eax, ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, ecx
add eax, 0
cmp eax, 0x3559
mov dword [esp + 8], eax
jne 0x1000cc3d
mov eax, dword [0x10095258]
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax + 0xee3f994], 1
jmp 0x1000cd33
add esp, 0x1c
pop esi
pop ebx
ret
Function at 0x1000cd40
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
add eax, 0x1b
mov dword [esp + 0x18], eax
mov eax, dword [0x1009525c]
mov eax, dword [eax + 0x463a798f]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, 1
mov dword [esp + 8], eax
je 0x1000ce96
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], eax
mov ch, byte [ecx + eax]
mov esi, 0x1b
xor edx, edx
div esi
mov eax, dword [esp + 0x10]
mov dh, byte [eax + edx]
mov dl, ch
xor dl, 0xff
and dl, 0x56
mov cl, 0xff
xor cl, 0x56
mov ah, ch
and ah, cl
mov al, 0xff
xor al, 0xff
and al, 0x56
and cl, 0xff
or dl, ah
or al, cl
xor dl, al
mov al, dh
xor al, 0xff
xor dl, 0xff
mov cl, 0xff
xor cl, 0x9c
or al, dl
or cl, 0x9c
xor al, 0xff
and al, cl
mov dl, dh
xor dl, 0xff
and dl, 0xc1
mov ah, 0xff
xor ah, 0xc1
and dh, ah
mov cl, 0xff
xor cl, 0xff
and cl, 0xc1
and ah, 0xff
or dl, dh
or cl, ah
xor dl, cl
xor ch, 0xff
xor dl, 0xff
mov cl, 0xff
xor cl, 0x7b
or ch, dl
or cl, 0x7b
xor ch, 0xff
and ch, cl
mov dh, al
xor dh, 0xff
mov bh, ch
xor bh, 0xff
mov bl, 0xff
xor bl, 0xee
mov dl, dh
and dl, 0xee
and al, bl
mov cl, bh
and cl, 0xee
and ch, bl
or dl, al
mov eax, dword [esp + 4]
or cl, ch
xor dl, cl
mov ecx, dword [esp + 0x14]
or dh, bh
xor dh, 0xff
or bl, 0xee
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
sub eax, 0xba5f765f
sub eax, 0x74ea7177
add eax, 0xba5f765f
add eax, 0x785f5f67
add eax, 1
sub eax, 0x785f5f67
sub eax, 0x318e9490
add eax, 0x74ea7177
add eax, 0x318e9490
cmp eax, 0x3559
mov dword [esp + 8], eax
jne 0x1000cd7e
mov eax, dword [0x1009525c]
add eax, 0x463a798f
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
jmp 0x1000ce96
add esp, 0x1c
pop esi
pop ebx
ret
Function at 0x1000cea0
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub esp, 0x20
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
add eax, 0x10
mov dword [esp + 0x18], eax
mov eax, dword [str.0_I]
add eax, 0xd1df5737
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp dword [eax], 1
sete al
mov byte [esp + 0xf], al
mov cl, byte [esp + 0xf]
xor eax, eax
test cl, 1
mov dword [esp + 8], eax
jne 0x1000cfdc
jmp 0x1000ceef
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], edx
mov cl, byte [ecx + edx]
and edx, 0xf
mov ah, byte [eax + edx]
mov dl, cl
xor dl, 0xff
and dl, 0x8d
mov ch, 0xff
xor ch, 0x8d
mov dh, cl
and dh, ch
mov al, 0xff
xor al, 0xff
and al, 0x8d
and ch, 0xff
or dl, dh
or al, ch
xor dl, al
xor dl, 0xff
mov al, ah
xor al, dl
and al, ah
mov dl, ah
xor dl, 0xff
and dl, 0xff
mov ch, 0xff
xor ch, 0xff
and ah, ch
or dl, ah
xor dl, 0xff
mov ch, cl
xor ch, dl
and ch, cl
mov dh, al
xor dh, 0xff
mov bh, ch
xor bh, 0xff
mov bl, 0xff
xor bl, 0x5a
mov dl, dh
and dl, 0x5a
and al, bl
mov cl, bh
and cl, 0x5a
and ch, bl
or dl, al
mov eax, dword [esp + 4]
or cl, ch
xor dl, cl
mov ecx, dword [esp + 0x14]
or dh, bh
xor dh, 0xff
or bl, 0x5a
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 0xc7ce8d2
add ecx, eax
xor eax, eax
sub eax, ecx
sub eax, 0xc9456e60
add eax, 1
add eax, 0xc9456e60
add eax, 0xe65da97c
sub eax, 0xc7ce8d2
sub eax, 0xe65da97c
cmp eax, 0x2c2d
mov dword [esp + 8], eax
jne 0x1000ceef
mov eax, dword [str.0_I]
add eax, 0xd1df5737
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
jmp 0x1000cfdc
add esp, 0x20
pop ebx
ret
Function at 0x1000cff0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x24
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x18], ecx
add eax, 0x1f
mov dword [esp + 0x1c], eax
mov eax, dword [0x10095264]
mov eax, dword [eax - 0x4786d7ed]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
cmp eax, 1
sete al
mov byte [esp + 0x13], al
mov cl, byte [esp + 0x13]
xor eax, eax
test cl, 1
mov dword [esp + 0xc], eax
jne 0x1000d10d
jmp 0x1000d041
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov bl, byte [edx + eax]
mov esi, 0x1f
xor edx, edx
div esi
mov eax, dword [esp + 8]
mov dl, byte [ecx + edx]
mov cl, bl
xor cl, 0xff
and cl, 0xff
mov dh, 0xff
xor dh, 0xff
mov ch, bl
and ch, dh
or cl, ch
xor cl, 0xff
mov dh, dl
xor dh, cl
and dh, dl
mov bh, dl
xor bh, 0xff
and bh, 0xff
mov cl, 0xff
xor cl, 0xff
and dl, cl
mov ecx, dword [esp + 0x18]
or bh, dl
xor bl, 0xff
xor bh, 0xff
mov dl, 0xff
xor dl, 0xff
or bl, bh
or dl, 0xff
xor bl, 0xff
and bl, dl
mov dl, dh
and dl, bl
xor dh, bl
or dl, dh
mov byte [ecx + eax], dl
sub eax, 0x8e14623d
sub eax, 0xeda5bc21
add eax, 0x8e14623d
sub eax, 0x43c203b4
add eax, 1
add eax, 0x43c203b4
sub eax, 0xc7854bd6
add eax, 0xeda5bc21
add eax, 0xc7854bd6
cmp eax, 0x3559
mov dword [esp + 0xc], eax
jne 0x1000d041
mov eax, dword [0x10095264]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0xb8792813
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
add esp, 0x24
pop esi
pop ebx
ret
Function at 0x1000d120
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
sub esp, 0x28
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x1c], ecx
add eax, 0x15
mov dword [esp + 0x20], eax
mov eax, dword [0x10095268]
mov eax, dword [eax + 0x4f4123e6]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
cmp eax, 1
sete al
mov byte [esp + 0x17], al
mov cl, byte [esp + 0x17]
xor eax, eax
test cl, 1
mov dword [esp + 0x10], eax
jne 0x1000d322
jmp 0x1000d170
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov bl, byte [ecx + eax]
mov ecx, 0x15
xor edx, edx
div ecx
mov eax, dword [esp + 0x18]
mov cl, byte [eax + edx]
mov ah, bl
xor ah, 0xff
and ah, 0xff
mov dl, 0xff
xor dl, 0xff
mov al, bl
and al, dl
or ah, al
mov al, 0xff
xor al, 0x5e
xor ah, 0xff
mov dl, 0xff
xor dl, 0xab
or al, ah
or dl, 0xab
xor al, 0xff
and al, dl
mov ch, 0xff
xor ch, 0x5e
and ch, 0x8c
mov ah, 0xff
xor ah, 0x8c
mov dh, ah
and dh, 0x5e
mov dl, 0xff
xor dl, 0xff
and dl, 0x8c
and ah, 0xff
or ch, dh
or dl, ah
xor ch, dl
xor bl, 0xff
mov ah, ch
xor ah, 0xff
mov dl, 0xff
xor dl, 0xf2
or bl, ah
or dl, 0xf2
xor bl, 0xff
and bl, dl
mov ah, cl
xor ah, 0xff
and ah, 0x8a
mov dh, 0xff
xor dh, 0x8a
mov bh, cl
and bh, dh
mov dl, 0xff
xor dl, 0xff
and dl, 0x8a
and dh, 0xff
or ah, bh
or dl, dh
xor ah, dl
xor ah, 0xff
mov dh, 0xff
xor dh, 0x5e
mov dl, 0xff
xor dl, 0x81
or ah, dh
or dl, 0x81
xor ah, 0xff
and ah, dl
xor cl, 0xff
xor ch, 0xff
mov dl, 0xff
xor dl, 0x90
or cl, ch
or dl, 0x90
xor cl, 0xff
and cl, dl
mov byte [esp + 0xb], cl
mov cl, al
xor cl, 0xff
mov ch, bl
xor ch, 0xff
mov dl, 0xff
xor dl, 0xd5
mov bh, cl
and bh, 0xd5
and al, dl
mov dh, ch
and dh, 0xd5
and bl, dl
or bh, al
mov al, byte [esp + 0xb]
or dh, bl
xor bh, dh
or cl, ch
xor cl, 0xff
or dl, 0xd5
and cl, dl
or bh, cl
mov cl, ah
xor cl, 0xff
mov ch, al
xor ch, 0xff
mov dl, 0xff
xor dl, 0x9c
mov bl, cl
and bl, 0x9c
and ah, dl
mov dh, ch
and dh, 0x9c
and al, dl
or bl, ah
or dh, al
mov eax, dword [esp + 0xc]
xor bl, dh
or cl, ch
xor cl, 0xff
or dl, 0x9c
and cl, dl
or bl, cl
mov dl, bh
xor dl, 0xff
and dl, 0x58
mov cl, 0xff
xor cl, 0x58
and bh, cl
mov dh, bl
xor dh, 0xff
and dh, 0x58
and bl, cl
mov ecx, dword [esp + 0x1c]
or dl, bh
or dh, bl
xor dl, dh
mov byte [ecx + eax], dl
add eax, 0x78f6a2fd
sub eax, 0x4f6621de
sub eax, 0x78f6a2fd
add eax, 0x2c9bf18a
add eax, 1
sub eax, 0x2c9bf18a
xor ecx, ecx
sub ecx, 0x4f6621de
sub eax, ecx
cmp eax, 0x1559
mov dword [esp + 0x10], eax
jne 0x1000d170
mov eax, dword [0x10095268]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x4f4123e6
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
add esp, 0x28
pop ebx
ret
Function at 0x1000d330
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x20
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], ecx
add eax, 0x15
mov dword [esp + 0x1c], eax
mov eax, dword [0x1009526c]
mov eax, dword [eax + 0x6f2a3965]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, 1
mov dword [esp + 0xc], eax
je 0x1000d45a
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov cl, byte [ecx + eax]
mov esi, 0x15
xor edx, edx
div esi
mov eax, dword [esp + 0x14]
mov dh, byte [eax + edx]
mov ah, cl
xor ah, 0xff
and ah, 0xff
mov dl, 0xff
xor dl, 0xff
mov al, cl
and al, dl
or ah, al
mov al, dh
xor al, 0xff
xor ah, 0xff
mov dl, 0xff
xor dl, 0xd0
or al, ah
or dl, 0xd0
xor al, 0xff
and al, dl
mov dl, dh
xor dl, 0xff
and dl, 0x2c
mov ch, 0xff
xor ch, 0x2c
and dh, ch
mov ah, 0xff
xor ah, 0xff
and ah, 0x2c
and ch, 0xff
or dl, dh
or ah, ch
xor dl, ah
xor dl, 0xff
mov ch, cl
xor ch, dl
and ch, cl
mov dh, al
xor dh, 0xff
mov bh, ch
xor bh, 0xff
mov bl, 0xff
xor bl, 0x39
mov dl, dh
and dl, 0x39
and al, bl
mov cl, bh
and cl, 0x39
and ch, bl
or dl, al
mov eax, dword [esp + 8]
or cl, ch
xor dl, cl
mov ecx, dword [esp + 0x18]
or dh, bh
xor dh, 0xff
or bl, 0x39
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
mov edx, 0xaeb4c265
add edx, 0
sub edx, 1
sub edx, 0xaeb4c265
xor ecx, ecx
sub ecx, edx
add eax, ecx
cmp eax, 8
mov dword [esp + 0xc], eax
jne 0x1000d36e
mov eax, dword [0x1009526c]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x6f2a3965
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
add esp, 0x20
pop esi
pop ebx
ret
Function at 0x1000d460
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub esp, 0x20
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
add eax, 0x10
mov dword [esp + 0x18], eax
mov eax, dword [0x10095270]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 0x67a6450]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, 1
mov dword [esp + 8], eax
je 0x1000d585
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], edx
mov cl, byte [ecx + edx]
and edx, 0xf
mov ah, byte [eax + edx]
mov ch, cl
xor ch, 0xff
and ch, 0x40
mov dl, 0xff
xor dl, 0x40
mov dh, cl
and dh, dl
mov al, 0xff
xor al, 0xff
and al, 0x40
and dl, 0xff
or ch, dh
or al, dl
xor ch, al
mov al, ah
xor al, 0xff
xor ch, 0xff
mov dl, 0xff
xor dl, 0x8e
or al, ch
or dl, 0x8e
xor al, 0xff
and al, dl
mov dl, ah
xor dl, 0xff
and dl, 0xff
mov ch, 0xff
xor ch, 0xff
and ah, ch
or dl, ah
xor dl, 0xff
mov ch, cl
xor ch, dl
and ch, cl
mov dh, al
xor dh, 0xff
mov bh, ch
xor bh, 0xff
mov bl, 0xff
xor bl, 0x9b
mov dl, dh
and dl, 0x9b
and al, bl
mov cl, bh
and cl, 0x9b
and ch, bl
or dl, al
mov eax, dword [esp + 4]
or cl, ch
xor dl, cl
mov ecx, dword [esp + 0x14]
or dh, bh
xor dh, 0xff
or bl, 0x9b
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
mov edx, 0x4260da30
add edx, 0
sub edx, 1
sub edx, 0x4260da30
xor ecx, ecx
sub ecx, edx
add eax, ecx
cmp eax, 8
mov dword [esp + 8], eax
jne 0x1000d4a5
mov eax, dword [0x10095270]
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax + 0x67a6450], 1
jmp 0x1000d585
add esp, 0x20
pop ebx
ret
Function at 0x1000d590
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x20
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
add eax, 0x17
mov dword [esp + 0x18], eax
mov eax, dword [0x10095274]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add eax, 0xba6d5cb3
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp dword [ecx], 1
mov dword [esp + 8], eax
je 0x1000d6bd
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], eax
mov ch, byte [ecx + eax]
mov esi, 0x17
xor edx, edx
div esi
mov eax, dword [esp + 0x10]
mov cl, byte [eax + edx]
mov dl, ch
xor dl, 0xff
and dl, 0xff
mov ah, 0xff
xor ah, 0xff
mov al, ch
and al, ah
or dl, al
xor dl, 0xff
mov al, cl
xor al, dl
and al, cl
mov dl, cl
xor dl, 0xff
and dl, 0xff
mov ah, 0xff
xor ah, 0xff
and cl, ah
or dl, cl
xor ch, 0xff
xor dl, 0xff
mov cl, 0xff
xor cl, 0x6e
or ch, dl
or cl, 0x6e
xor ch, 0xff
and ch, cl
mov dh, al
xor dh, 0xff
mov bh, ch
xor bh, 0xff
mov bl, 0xff
xor bl, 0xde
mov dl, dh
and dl, 0xde
and al, bl
mov cl, bh
and cl, 0xde
and ch, bl
or dl, al
mov eax, dword [esp + 4]
or cl, ch
xor dl, cl
mov ecx, dword [esp + 0x14]
or dh, bh
xor dh, 0xff
or bl, 0xde
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
add eax, 0xbb8d07b2
add eax, 0x39e71d1b
sub eax, 0xbb8d07b2
xor ecx, ecx
sub ecx, 1
sub eax, ecx
sub eax, 0xab494d90
sub eax, 0x39e71d1b
add eax, 0xab494d90
cmp eax, 2
mov dword [esp + 8], eax
jne 0x1000d5d5
mov eax, dword [0x10095274]
add eax, 0xba6d5cb3
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
jmp 0x1000d6bd
add esp, 0x20
pop esi
pop ebx
ret
Function at 0x1000d6d0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x24
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x18], ecx
add eax, 0x18
mov dword [esp + 0x1c], eax
mov eax, dword [0x10095278]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
cmp dword [eax + 0x6c403687], 1
sete al
mov byte [esp + 0x13], al
mov cl, byte [esp + 0x13]
xor eax, eax
test cl, 1
mov dword [esp + 0xc], eax
jne 0x1000d810
jmp 0x1000d71f
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov dl, byte [edx + eax]
mov byte [esp + 0xb], dl
mov esi, 0x18
xor edx, edx
div esi
mov eax, dword [esp + 4]
mov esi, edx
mov dl, byte [esp + 0xb]
mov ch, byte [ecx + esi]
mov bl, dl
xor bl, 0xff
and bl, 0x40
mov dh, 0xff
xor dh, 0x40
mov bh, dl
and bh, dh
mov cl, 0xff
xor cl, 0xff
and cl, 0x40
and dh, 0xff
or bl, bh
or cl, dh
xor bl, cl
mov dh, ch
xor dh, 0xff
xor bl, 0xff
mov cl, 0xff
xor cl, 0xab
or dh, bl
or cl, 0xab
xor dh, 0xff
and dh, cl
mov bh, ch
xor bh, 0xff
and bh, 0x66
mov cl, 0xff
xor cl, 0x66
and ch, cl
mov bl, 0xff
xor bl, 0xff
and bl, 0x66
and cl, 0xff
or bh, ch
or bl, cl
mov ecx, dword [esp + 0x18]
xor bh, bl
xor bh, 0xff
mov bl, dl
xor bl, bh
and bl, dl
mov dl, dh
and dl, bl
xor dh, bl
or dl, dh
mov byte [ecx + eax], dl
add eax, 0x2f74b9d2
add eax, 0x83341c4
sub eax, 0x2f74b9d2
add eax, 0x5e77cfb8
add eax, 1
sub eax, 0x5e77cfb8
add eax, 0xdf1a86e3
sub eax, 0x83341c4
sub eax, 0xdf1a86e3
cmp eax, 0xe
mov dword [esp + 0xc], eax
jne 0x1000d71f
mov eax, dword [0x10095278]
add eax, 0x6c403687
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
jmp 0x1000d810
add esp, 0x24
pop esi
pop ebx
ret
Function at 0x1000d820
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x28
mov eax, dword [esp + 0x38]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
add eax, 0x14
mov dword [esp + 0x20], eax
mov eax, dword [0x1009527c]
add eax, 0x765391f
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
cmp dword [eax], 1
sete al
mov byte [esp + 0x17], al
mov cl, byte [esp + 0x17]
xor eax, eax
test cl, 1
mov dword [esp + 0x10], eax
jne 0x1000d9e0
jmp 0x1000d870
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov dl, byte [edx + eax]
mov byte [esp + 0xb], dl
mov esi, 0x14
xor edx, edx
div esi
mov al, byte [esp + 0xb]
mov ch, byte [ecx + edx]
mov cl, al
xor cl, 0xff
and cl, 0xe6
mov ah, 0xff
xor ah, 0xe6
mov dh, al
and dh, ah
mov dl, 0xff
xor dl, 0xff
and dl, 0xe6
and ah, 0xff
or cl, dh
or dl, ah
xor cl, dl
xor cl, 0xff
xor cl, 0x81
and cl, 0x81
mov dh, 0xff
xor dh, 0x81
and dh, 0xf2
mov ah, 0xff
xor ah, 0xf2
mov bl, ah
and bl, 0x81
mov dl, 0xff
xor dl, 0xff
and dl, 0xf2
and ah, 0xff
or dh, bl
or dl, ah
xor dh, dl
mov ah, dh
xor ah, 0xff
mov dl, al
xor dl, ah
and dl, al
mov ah, ch
xor ah, 0xff
and ah, 0xee
mov bl, 0xff
xor bl, 0xee
mov bh, ch
and bh, bl
mov al, 0xff
xor al, 0xff
and al, 0xee
and bl, 0xff
or ah, bh
or al, bl
xor ah, al
xor ah, 0xff
mov bl, 0xff
xor bl, 0x81
mov al, 0xff
xor al, 0x19
or ah, bl
or al, 0x19
xor ah, 0xff
and ah, al
xor dh, 0xff
mov al, ch
xor al, dh
and al, ch
mov bh, cl
and bh, dl
xor cl, dl
or bh, cl
mov cl, ah
xor cl, 0xff
mov ch, al
xor ch, 0xff
mov dl, 0xff
xor dl, 0x46
mov bl, cl
and bl, 0x46
and ah, dl
mov dh, ch
and dh, 0x46
and al, dl
or bl, ah
or dh, al
mov eax, dword [esp + 0xc]
xor bl, dh
or cl, ch
xor cl, 0xff
or dl, 0x46
and cl, dl
or bl, cl
mov dl, bh
xor dl, 0xff
and dl, 0xbc
mov cl, 0xff
xor cl, 0xbc
and bh, cl
mov dh, bl
xor dh, 0xff
and dh, 0xbc
and bl, cl
mov ecx, dword [esp + 0x1c]
or dl, bh
or dh, bl
xor dl, dh
mov byte [ecx + eax], dl
sub eax, 0xf7744f2b
sub eax, 0xc4d27a74
add eax, 0xf7744f2b
add eax, 0xaae6586a
add eax, 1
sub eax, 0xaae6586a
xor ecx, ecx
sub ecx, 0xc4d27a74
sub eax, ecx
cmp eax, 0xe
mov dword [esp + 0x10], eax
jne 0x1000d870
mov eax, dword [0x1009527c]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x765391f
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
add esp, 0x28
pop esi
pop ebx
ret