joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b8b0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
sub esp, 0x24
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], ecx
add eax, 0x13
mov dword [esp + 0x1c], eax
mov eax, dword [0x10095224]
add eax, 0x6369b6c2
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, 1
mov dword [esp + 0xc], eax
je 0x1000ba63
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov bh, byte [ecx + eax]
mov ecx, 0x13
xor edx, edx
div ecx
mov eax, dword [esp + 0x14]
mov dl, byte [eax + edx]
mov al, bh
xor al, 0xff
and al, 0xff
mov ah, 0xff
xor ah, 0xff
mov cl, bh
and cl, ah
or al, cl
xor al, 0xff
xor al, 0x4e
and al, 0x4e
mov ch, 0xff
xor ch, 0x4e
and ch, 0xf0
mov ah, 0xff
xor ah, 0xf0
mov dh, ah
and dh, 0x4e
mov cl, 0xff
xor cl, 0xff
and cl, 0xf0
and ah, 0xff
or ch, dh
or cl, ah
xor ch, cl
xor bh, 0xff
mov ah, ch
xor ah, 0xff
mov cl, 0xff
xor cl, 0x12
or bh, ah
or cl, 0x12
xor bh, 0xff
and bh, cl
mov cl, dl
xor cl, 0xff
and cl, 0xff
mov dh, 0xff
xor dh, 0xff
mov ah, dl
and ah, dh
or cl, ah
mov dh, 0xff
xor dh, 0x4e
mov ah, cl
xor ah, dh
and ah, cl
xor ch, 0xff
mov cl, dl
xor cl, ch
and cl, dl
mov byte [esp + 7], cl
mov cl, al
xor cl, 0xff
mov ch, bh
xor ch, 0xff
mov dl, 0xff
xor dl, 0x2a
mov dh, cl
and dh, 0x2a
and al, dl
mov bl, ch
and bl, 0x2a
and bh, dl
or dh, al
mov al, byte [esp + 7]
or bl, bh
xor dh, bl
or cl, ch
xor cl, 0xff
or dl, 0x2a
and cl, dl
or dh, cl
mov dl, ah
xor dl, 0xff
mov cl, al
xor cl, 0xff
mov bh, 0xff
xor bh, 0x32
mov bl, dl
and bl, 0x32
and ah, bh
mov ch, cl
and ch, 0x32
and al, bh
or bl, ah
or ch, al
mov eax, dword [esp + 8]
xor bl, ch
or dl, cl
mov ecx, dword [esp + 0x18]
xor dl, 0xff
or bh, 0x32
and dl, bh
or bl, dl
mov bh, dh
xor bh, 0xff
mov dl, bl
and dl, bh
xor bl, 0xff
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
add eax, 0xf6d348a5
sub eax, 0xa7df03ea
sub eax, 0xf6d348a5
sub eax, 0x86e43586
add eax, 1
add eax, 0x86e43586
add eax, 0xaf8a8953
add eax, 0xa7df03ea
sub eax, 0xaf8a8953
cmp eax, 0x3559
mov dword [esp + 0xc], eax
jne 0x1000b8f6
mov eax, dword [0x10095224]
add eax, 0x6369b6c2
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
jmp 0x1000ba63
add esp, 0x24
pop ebx
ret
Function at 0x1000ba70
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x24
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x18], ecx
add eax, 0x1a
mov dword [esp + 0x1c], eax
mov eax, dword [0x10095228]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
add eax, 0x8877fb13
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp dword [ecx], 1
mov dword [esp + 0xc], eax
je 0x1000bbda
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov ch, byte [ecx + eax]
mov esi, 0x1a
xor edx, edx
div esi
mov eax, dword [esp + 0x14]
mov dh, byte [eax + edx]
mov dl, ch
xor dl, 0xff
and dl, 0xa1
mov cl, 0xff
xor cl, 0xa1
mov ah, ch
and ah, cl
mov al, 0xff
xor al, 0xff
and al, 0xa1
and cl, 0xff
or dl, ah
or al, cl
xor dl, al
mov al, dh
xor al, 0xff
xor dl, 0xff
mov cl, 0xff
xor cl, 0xa5
or al, dl
or cl, 0xa5
xor al, 0xff
and al, cl
mov dl, dh
xor dl, 0xff
and dl, 0xb1
mov ah, 0xff
xor ah, 0xb1
and dh, ah
mov cl, 0xff
xor cl, 0xff
and cl, 0xb1
and ah, 0xff
or dl, dh
or cl, ah
xor dl, cl
xor ch, 0xff
xor dl, 0xff
mov cl, 0xff
xor cl, 0xa4
or ch, dl
or cl, 0xa4
xor ch, 0xff
and ch, cl
mov dh, al
xor dh, 0xff
mov bh, ch
xor bh, 0xff
mov bl, 0xff
xor bl, 0x74
mov dl, dh
and dl, 0x74
and al, bl
mov cl, bh
and cl, 0x74
and ch, bl
or dl, al
mov eax, dword [esp + 8]
or cl, ch
xor dl, cl
mov ecx, dword [esp + 0x18]
or dh, bh
xor dh, 0xff
or bl, 0x74
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
xor ecx, ecx
sub ecx, 0xf10d78fe
sub ecx, eax
add ecx, 0xf10d78fe
xor eax, eax
sub eax, 1
add eax, 0
sub ecx, 0x2379f191
add ecx, eax
add ecx, 0x2379f191
mov eax, 0xf37246d0
add eax, 0
sub eax, ecx
sub eax, 0xf37246d0
cmp eax, 0x3559
mov dword [esp + 0xc], eax
jne 0x1000bab5
mov eax, dword [0x10095228]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x8877fb13
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
add esp, 0x24
pop esi
pop ebx
ret
Function at 0x1000bbe0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
add eax, 0x14
mov dword [esp + 0x18], eax
mov eax, dword [0x1009522c]
cmp dword [eax - 0x3a920b9f], 1
sete al
mov byte [esp + 0xf], al
mov cl, byte [esp + 0xf]
xor eax, eax
test cl, 1
mov dword [esp + 8], eax
jne 0x1000bd1e
jmp 0x1000bc27
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov dword [esp + 4], eax
mov bl, byte [edx + eax]
mov esi, 0x14
xor edx, edx
div esi
mov eax, dword [esp + 4]
mov ch, byte [ecx + edx]
mov dl, bl
xor dl, 0xff
and dl, 0x74
mov dh, 0xff
xor dh, 0x74
mov bh, bl
and bh, dh
mov cl, 0xff
xor cl, 0xff
and cl, 0x74
and dh, 0xff
or dl, bh
or cl, dh
xor dl, cl
mov dh, ch
xor dh, 0xff
xor dl, 0xff
mov cl, 0xff
xor cl, 0x1b
or dh, dl
or cl, 0x1b
xor dh, 0xff
and dh, cl
mov bh, ch
xor bh, 0xff
and bh, 0xd6
mov cl, 0xff
xor cl, 0xd6
and ch, cl
mov dl, 0xff
xor dl, 0xff
and dl, 0xd6
and cl, 0xff
or bh, ch
or dl, cl
mov ecx, dword [esp + 0x14]
xor bh, dl
xor bl, 0xff
xor bh, 0xff
mov dl, 0xff
xor dl, 0x58
or bl, bh
or dl, 0x58
xor bl, 0xff
and bl, dl
mov dl, dh
and dl, bl
xor dh, bl
or dl, dh
mov byte [ecx + eax], dl
add eax, 0x41f912
sub eax, 0x5e7f12a5
sub eax, 0x41f912
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
add eax, 0x895df286
add eax, 0x5e7f12a5
sub eax, 0x895df286
cmp eax, 0x3559
mov dword [esp + 8], eax
jne 0x1000bc27
mov eax, dword [0x1009522c]
add eax, 0xc56df461
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
jmp 0x1000bd1e
add esp, 0x1c
pop esi
pop ebx
ret
Function at 0x1000bd30
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
add eax, 0x1c
mov dword [esp + 0x18], eax
mov eax, dword [0x10095230]
mov eax, dword [eax - 0x3f8410a5]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, 1
mov dword [esp + 8], eax
je 0x1000bea7
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], eax
mov cl, byte [ecx + eax]
mov esi, 0x1c
xor edx, edx
div esi
mov eax, dword [esp + 0x10]
mov ch, byte [eax + edx]
mov bl, cl
xor bl, 0xff
and bl, 5
mov dl, 0xff
xor dl, 5
mov ah, cl
and ah, dl
mov al, 0xff
xor al, 0xff
and al, 5
and dl, 0xff
or bl, ah
or al, dl
xor bl, al
xor bl, 0xff
xor bl, 0xc6
and bl, 0xc6
mov dh, 0xff
xor dh, 0xc6
and dh, 0xda
mov dl, 0xff
xor dl, 0xda
mov ah, dl
and ah, 0xc6
mov al, 0xff
xor al, 0xff
and al, 0xda
and dl, 0xff
or dh, ah
or al, dl
xor dh, al
xor cl, 0xff
mov dl, dh
xor dl, 0xff
mov al, 0xff
xor al, 0x5d
or cl, dl
or al, 0x5d
xor cl, 0xff
and cl, al
mov dl, ch
xor dl, 0xff
and dl, 0xe9
mov ah, 0xff
xor ah, 0xe9
mov bh, ch
and bh, ah
mov al, 0xff
xor al, 0xff
and al, 0xe9
and ah, 0xff
or dl, bh
or al, ah
xor dl, al
xor dl, 0xff
mov al, 0xff
xor al, 0xc6
mov bh, 0xff
xor bh, 0x21
or dl, al
mov eax, dword [esp + 4]
or bh, 0x21
xor dl, 0xff
and dl, bh
xor dh, 0xff
mov bh, ch
xor bh, dh
and bh, ch
mov dh, bl
and dh, cl
xor bl, cl
mov ecx, dword [esp + 0x14]
or dh, bl
mov bl, dl
and bl, bh
xor dl, bh
or bl, dl
mov bh, dh
xor bh, 0xff
mov dl, bl
and dl, bh
xor bl, 0xff
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
xor ecx, ecx
sub ecx, 0xadda6682
add eax, ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
sub eax, 0xb54d862c
add eax, 0xadda6682
add eax, 0xb54d862c
cmp eax, 0x3559
mov dword [esp + 8], eax
jne 0x1000bd6e
mov eax, dword [0x10095230]
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax - 0x3f8410a5], 1
jmp 0x1000bea7
add esp, 0x1c
pop esi
pop ebx
ret
Function at 0x1000beb0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x20
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], ecx
add eax, 0x19
mov dword [esp + 0x1c], eax
mov eax, dword [0x10095234]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp dword [ecx - 0x7a78afc5], 1
mov dword [esp + 0xc], eax
je 0x1000c05b
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov dl, byte [edx + eax]
mov byte [esp + 5], dl
mov esi, 0x19
xor edx, edx
div esi
mov ah, byte [esp + 5]
mov ch, byte [ecx + edx]
mov al, ah
xor al, 0xff
and al, 0xe8
mov dl, 0xff
xor dl, 0xe8
mov dh, ah
and dh, dl
mov cl, 0xff
xor cl, 0xff
and cl, 0xe8
and dl, 0xff
or al, dh
or cl, dl
xor al, cl
xor al, 0xff
xor al, 0xbf
and al, 0xbf
mov dh, 0xff
xor dh, 0xbf
and dh, 0xff
mov cl, 0xff
xor cl, 0xff
and cl, 0xbf
or dh, cl
xor ah, 0xff
mov dl, dh
xor dl, 0xff
mov cl, 0xff
xor cl, 0x37
or ah, dl
or cl, 0x37
xor ah, 0xff
and ah, cl
mov cl, ch
xor cl, 0xff
and cl, 0xff
mov bl, 0xff
xor bl, 0xff
mov dl, ch
and dl, bl
or cl, dl
xor cl, 0xff
mov bl, 0xff
xor bl, 0xbf
mov dl, 0xff
xor dl, 0x88
or cl, bl
or dl, 0x88
xor cl, 0xff
and cl, dl
xor dh, 0xff
mov dl, ch
xor dl, dh
and dl, ch
mov ch, al
xor ch, 0xff
mov bl, ah
xor bl, 0xff
mov dh, 0xff
xor dh, 0x81
mov bh, ch
and bh, 0x81
and al, dh
mov byte [esp + 6], al
mov al, bl
and al, 0x81
mov byte [esp + 7], al
mov al, byte [esp + 6]
and ah, dh
or bh, al
mov al, byte [esp + 7]
or al, ah
xor bh, al
mov eax, dword [esp + 8]
or ch, bl
xor ch, 0xff
or dh, 0x81
and ch, dh
or bh, ch
mov bl, cl
and bl, dl
xor cl, dl
or bl, cl
mov dl, bh
xor dl, 0xff
and dl, 0xbf
mov cl, 0xff
xor cl, 0xbf
and bh, cl
mov dh, bl
xor dh, 0xff
and dh, 0xbf
and bl, cl
mov ecx, dword [esp + 0x18]
or dl, bh
or dh, bl
xor dl, dh
mov byte [ecx + eax], dl
add eax, 0xa976008
sub eax, 0x8f508839
sub eax, 0xa976008
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
sub eax, 0x9f1946d9
add eax, 0x8f508839
add eax, 0x9f1946d9
cmp eax, 0x3559
mov dword [esp + 0xc], eax
jne 0x1000beec
mov eax, dword [0x10095234]
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax - 0x7a78afc5], 1
jmp 0x1000c05b
add esp, 0x20
pop esi
pop ebx
ret
Function at 0x1000c070
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x28
mov eax, dword [esp + 0x38]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
add eax, 0x1e
mov dword [esp + 0x20], eax
mov eax, dword [0x10095238]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
cmp dword [eax + 0x491bff80], 1
sete al
mov byte [esp + 0x17], al
mov cl, byte [esp + 0x17]
xor eax, eax
test cl, 1
mov dword [esp + 0x10], eax
jne 0x1000c231
jmp 0x1000c0bf
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov cl, byte [ecx + eax]
mov esi, 0x1e
xor edx, edx
div esi
mov eax, dword [esp + 0x18]
mov bh, byte [eax + edx]
mov ah, cl
xor ah, 0xff
and ah, 0xa6
mov dl, 0xff
xor dl, 0xa6
mov ch, cl
and ch, dl
mov al, 0xff
xor al, 0xff
and al, 0xa6
and dl, 0xff
or ah, ch
or al, dl
xor ah, al
mov al, 0xff
xor al, 0x29
xor ah, 0xff
mov dl, 0xff
xor dl, 0x33
or al, ah
or dl, 0x33
xor al, 0xff
and al, dl
mov ch, 0xff
xor ch, 0x29
and ch, 0x64
mov ah, 0xff
xor ah, 0x64
mov dh, ah
and dh, 0x29
mov dl, 0xff
xor dl, 0xff
and dl, 0x64
and ah, 0xff
or ch, dh
or dl, ah
xor ch, dl
mov dl, ch
xor dl, 0xff
mov ah, cl
xor ah, dl
and ah, cl
mov dl, bh
xor dl, 0xff
and dl, 0xff
mov dh, 0xff
xor dh, 0xff
mov cl, bh
and cl, dh
or dl, cl
xor dl, 0xff
mov dh, 0xff
xor dh, 0x29
mov cl, 0xff
xor cl, 0xee
or dl, dh
or cl, 0xee
xor dl, 0xff
and dl, cl
xor bh, 0xff
xor ch, 0xff
mov cl, 0xff
xor cl, 0x7b
or bh, ch
or cl, 0x7b
xor bh, 0xff
and bh, cl
mov bl, al
xor bl, 0xff
mov ch, ah
xor ch, 0xff
mov cl, 0xff
xor cl, 0x1e
mov dh, bl
and dh, 0x1e
and al, cl
mov byte [esp + 0xa], al
mov al, ch
and al, 0x1e
mov byte [esp + 0xb], al
mov al, byte [esp + 0xa]
and ah, cl
or dh, al
mov al, byte [esp + 0xb]
or al, ah
xor dh, al
mov eax, dword [esp + 0xc]
or bl, ch
xor bl, 0xff
or cl, 0x1e
and bl, cl
mov ecx, dword [esp + 0x1c]
or dh, bl
mov bl, dl
and bl, bh
xor dl, bh
or bl, dl
mov bh, dh
xor bh, 0xff
mov dl, bl
and dl, bh
xor bl, 0xff
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
xor ecx, ecx
sub ecx, eax
add ecx, 0
xor edx, edx
sub edx, 1
add edx, 0
xor eax, eax
sub eax, edx
sub ecx, eax
xor eax, eax
sub eax, 0x77e39123
sub eax, ecx
add eax, 0x77e39123
cmp eax, 0x3559
mov dword [esp + 0x10], eax
jne 0x1000c0bf
mov eax, dword [0x10095238]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x491bff80
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
add esp, 0x28
pop esi
pop ebx
ret
Function at 0x1000c240
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x20
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
add eax, 0x1e
mov dword [esp + 0x18], eax
mov eax, dword [0x1009523c]
add eax, 0xb237a0de
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, 1
mov dword [esp + 8], eax
je 0x1000c373
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], eax
mov cl, byte [ecx + eax]
mov esi, 0x1e
xor edx, edx
div esi
mov eax, dword [esp + 0x10]
mov dh, byte [eax + edx]
mov dl, cl
xor dl, 0xff
and dl, 0xff
mov ah, 0xff
xor ah, 0xff
mov al, cl
and al, ah
or dl, al
xor dl, 0xff
mov al, dh
xor al, dl
and al, dh
mov dl, dh
xor dl, 0xff
and dl, 0x1f
mov ch, 0xff
xor ch, 0x1f
and dh, ch
mov ah, 0xff
xor ah, 0xff
and ah, 0x1f
and ch, 0xff
or dl, dh
or ah, ch
xor dl, ah
xor dl, 0xff
mov ch, cl
xor ch, dl
and ch, cl
mov dh, al
xor dh, 0xff
mov bh, ch
xor bh, 0xff
mov bl, 0xff
xor bl, 0xb3
mov dl, dh
and dl, 0xb3
and al, bl
mov cl, bh
and cl, 0xb3
and ch, bl
or dl, al
mov eax, dword [esp + 4]
or cl, ch
xor dl, cl
mov ecx, dword [esp + 0x14]
or dh, bh
xor dh, 0xff
or bl, 0xb3
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
add eax, 0x75ca4b60
sub eax, 0xc2e5fd2c
sub eax, 0x75ca4b60
xor ecx, ecx
sub ecx, 1
sub eax, ecx
add eax, 0x5f5dc2f4
add eax, 0xc2e5fd2c
sub eax, 0x5f5dc2f4
cmp eax, 0x3559
mov dword [esp + 8], eax
jne 0x1000c287
mov eax, dword [0x1009523c]
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax - 0x4dc85f22], 1
jmp 0x1000c373
add esp, 0x20
pop esi
pop ebx
ret
Function at 0x1000c380
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x24
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x1c], ecx
add eax, 0x1b
mov dword [esp + 0x20], eax
mov eax, dword [0x10095240]
cmp dword [eax - 0x249b2ad8], 1
sete al
mov byte [esp + 0x17], al
mov cl, byte [esp + 0x17]
xor eax, eax
test cl, 1
mov dword [esp + 0x10], eax
jne 0x1000c499
jmp 0x1000c3c7
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov dword [esp + 8], eax
mov dl, byte [edx + eax]
mov byte [esp + 0xf], dl
mov esi, 0x1b
xor edx, edx
div esi
mov eax, dword [esp + 8]
mov esi, edx
mov dl, byte [esp + 0xf]
mov bl, byte [ecx + esi]
mov ch, dl
xor ch, 0xff
and ch, 0xff
mov dh, 0xff
xor dh, 0xff
mov cl, dl
and cl, dh
or ch, cl
mov dh, bl
xor dh, 0xff
xor ch, 0xff
mov cl, 0xff
xor cl, 0x67
or dh, ch
or cl, 0x67
xor dh, 0xff
and dh, cl
mov bh, bl
xor bh, 0xff
and bh, 0xff
mov cl, 0xff
xor cl, 0xff
and bl, cl
mov ecx, dword [esp + 0x1c]
or bh, bl
xor bh, 0xff
mov bl, dl
xor bl, bh
and bl, dl
mov dl, dh
and dl, bl
xor dh, bl
or dl, dh
mov byte [ecx + eax], dl
xor ecx, ecx
sub ecx, 0xc33e0637
sub ecx, eax
add ecx, 0xc33e0637
xor edx, edx
sub edx, 1
add edx, 0
xor eax, eax
sub eax, edx
sub ecx, eax
xor eax, eax
sub eax, ecx
add eax, 0
cmp eax, 0x3559
mov dword [esp + 0x10], eax
jne 0x1000c3c7
mov eax, dword [0x10095240]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0xdb64d528
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
add esp, 0x24
pop esi
pop ebx
ret
Function at 0x1000c4a0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x20
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
add eax, 0x1c
mov dword [esp + 0x18], eax
mov eax, dword [0x10095244]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add eax, 0x81314072
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp dword [ecx], 1
mov dword [esp + 8], eax
je 0x1000c5d9
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], eax
mov ch, byte [ecx + eax]
mov esi, 0x1c
xor edx, edx
div esi
mov eax, dword [esp + 0x10]
mov dh, byte [eax + edx]
mov cl, ch
xor cl, 0xff
and cl, 0xf4
mov dl, 0xff
xor dl, 0xf4
mov ah, ch
and ah, dl
mov al, 0xff
xor al, 0xff
and al, 0xf4
and dl, 0xff
or cl, ah
or al, dl
xor cl, al
xor cl, 0xff
mov al, dh
xor al, cl
and al, dh
mov dl, dh
xor dl, 0xff
and dl, 0xee
mov ah, 0xff
xor ah, 0xee
and dh, ah
mov cl, 0xff
xor cl, 0xff
and cl, 0xee
and ah, 0xff
or dl, dh
or cl, ah
xor dl, cl
xor ch, 0xff
xor dl, 0xff
mov cl, 0xff
xor cl, 0xf5
or ch, dl
or cl, 0xf5
xor ch, 0xff
and ch, cl
mov dh, al
xor dh, 0xff
mov bh, ch
xor bh, 0xff
mov bl, 0xff
xor bl, 0xf7
mov dl, dh
and dl, 0xf7
and al, bl
mov cl, bh
and cl, 0xf7
and ch, bl
or dl, al
mov eax, dword [esp + 4]
or cl, ch
xor dl, cl
mov ecx, dword [esp + 0x14]
or dh, bh
xor dh, 0xff
or bl, 0xf7
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
xor ecx, ecx
sub ecx, 1
add ecx, 0
add eax, 0x1ba06240
sub eax, ecx
sub eax, 0x1ba06240
cmp eax, 0x3559
mov dword [esp + 8], eax
jne 0x1000c4e5
mov eax, dword [0x10095244]
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax - 0x7ecebf8e], 1
jmp 0x1000c5d9
add esp, 0x20
pop esi
pop ebx
ret
Function at 0x1000c5e0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
sub esp, 0x20
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
add eax, 0x1c
mov dword [esp + 0x18], eax
mov eax, dword [0x10095248]
add eax, 0x65a4f916
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp dword [eax], 1
sete al
mov byte [esp + 0xf], al
mov cl, byte [esp + 0xf]
xor eax, eax
test cl, 1
mov dword [esp + 8], eax
jne 0x1000c744
jmp 0x1000c630
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], eax
mov ch, byte [ecx + eax]
mov esi, 0x1c
xor edx, edx
div esi
mov eax, dword [esp + 0x10]
mov dh, byte [eax + edx]
mov dl, ch
xor dl, 0xff
and dl, 0xd5
mov cl, 0xff
xor cl, 0xd5
mov ah, ch
and ah, cl
mov al, 0xff
xor al, 0xff
and al, 0xd5
and cl, 0xff
or dl, ah
or al, cl
xor dl, al
mov al, dh
xor al, 0xff
xor dl, 0xff
mov cl, 0xff
xor cl, 4
or al, dl
or cl, 4
xor al, 0xff
and al, cl
mov dl, dh
xor dl, 0xff
and dl, 0x40
mov ah, 0xff
xor ah, 0x40
and dh, ah
mov cl, 0xff
xor cl, 0xff
and cl, 0x40
and ah, 0xff
or dl, dh
or cl, ah
xor dl, cl
xor ch, 0xff
xor dl, 0xff
mov cl, 0xff
xor cl, 0x33
or ch, dl
or cl, 0x33
xor ch, 0xff
and ch, cl
mov dh, al
xor dh, 0xff
mov bh, ch
xor bh, 0xff
mov bl, 0xff
xor bl, 0x17
mov dl, dh
and dl, 0x17
and al, bl
mov cl, bh
and cl, 0x17
and ch, bl
or dl, al
mov eax, dword [esp + 4]
or cl, ch
xor dl, cl
mov ecx, dword [esp + 0x14]
or dh, bh
xor dh, 0xff
or bl, 0x17
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
xor ecx, ecx
sub ecx, 0x36fa9e7
sub eax, ecx
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, 1
add ecx, eax
xor eax, eax
sub eax, ecx
sub eax, 0xa38656b9
sub eax, 0x36fa9e7
add eax, 0xa38656b9
cmp eax, 0x3559
mov dword [esp + 8], eax
jne 0x1000c630
mov eax, dword [0x10095248]
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax + 0x65a4f916], 1
jmp 0x1000c744
add esp, 0x20
pop esi
pop ebx
ret
Function at 0x1000c750
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebx
sub esp, 0x20
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x18], ecx
add eax, 0x15
mov dword [esp + 0x1c], eax
mov eax, dword [0x1009524c]
add eax, 0x6b3b1032
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp dword [ecx], 1
mov dword [esp + 0xc], eax
je 0x1000c90f
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 8], eax
mov cl, byte [ecx + eax]
mov byte [esp + 6], cl
mov ecx, 0x15
xor edx, edx
div ecx
mov eax, dword [esp + 0x14]
mov ecx, edx
mov dl, byte [esp + 6]
mov cl, byte [eax + ecx]
mov ch, dl
xor ch, 0xff
and ch, 0xff
mov ah, 0xff
xor ah, 0xff
mov al, dl
and al, ah
or ch, al
mov al, 0xff
xor al, 0xa7
xor ch, 0xff
mov ah, 0xff
xor ah, 0x23
or al, ch
or ah, 0x23
xor al, 0xff
and al, ah
mov ch, 0xff
xor ch, 0xa7
and ch, 0xff
mov ah, 0xff
xor ah, 0xff
and ah, 0xa7
or ch, ah
mov ah, ch
xor ah, 0xff
mov bh, dl
xor bh, ah
and bh, dl
mov ah, cl
xor ah, 0xff
and ah, 0xff
mov dh, 0xff
xor dh, 0xff
mov dl, cl
and dl, dh
or ah, dl
xor ah, 0xff
mov dh, 0xff
xor dh, 0xa7
mov dl, 0xff
xor dl, 0xcb
or ah, dh
or dl, 0xcb
xor ah, 0xff
and ah, dl
xor cl, 0xff
xor ch, 0xff
mov dl, 0xff
xor dl, 0xfa
or cl, ch
or dl, 0xfa
xor cl, 0xff
and cl, dl
mov byte [esp + 7], cl
mov cl, al
xor cl, 0xff
mov ch, bh
xor ch, 0xff
mov dl, 0xff
xor dl, 0xa1
mov dh, cl
and dh, 0xa1
and al, dl
mov bl, ch
and bl, 0xa1
and bh, dl
or dh, al
mov al, byte [esp + 7]
or bl, bh
xor dh, bl
or cl, ch
xor cl, 0xff
or dl, 0xa1
and cl, dl
or dh, cl
mov dl, ah
xor dl, 0xff
mov cl, al
xor cl, 0xff
mov bh, 0xff
xor bh, 0x61
mov bl, dl
and bl, 0x61
and ah, bh
mov ch, cl
and ch, 0x61
and al, bh
or bl, ah
or ch, al
mov eax, dword [esp + 8]
xor bl, ch
or dl, cl
mov ecx, dword [esp + 0x18]
xor dl, 0xff
or bh, 0x61
and dl, bh
or bl, dl
mov bh, dh
xor bh, 0xff
mov dl, bl
and dl, bh
xor bl, 0xff
and dh, bl
or dl, dh
mov byte [ecx + eax], dl
sub eax, 0xac74de59
sub eax, 0x478527e3
add eax, 0xac74de59
add eax, 0x452de7f4
add eax, 1
sub eax, 0x452de7f4
add eax, 0x9a4f4441
add eax, 0x478527e3
sub eax, 0x9a4f4441
cmp eax, 0x3559
mov dword [esp + 0xc], eax
jne 0x1000c78c
mov eax, dword [0x1009524c]
add eax, 0x6b3b1032
mov dword [esp], eax
mov eax, dword [esp]
mov dword [eax], 1
jmp 0x1000c90f
add esp, 0x20
pop ebx
ret