joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12761e0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, ecx
cmp edi, ebx
je 0x127630a
cmp dword [ebp + 8], 0x14
jbe 0x127630a
push dword [esi + 0x14]
call fcn.010324e9
push dword [esi + 0xc]
mov dword [esi + 0x14], ebx
call fcn.010324e9
mov eax, dword [esi + 0x20]
pop ecx
pop ecx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
cmp eax, ebx
je 0x127622d
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [esi + 0x20], ebx
mov eax, dword [edi + 0xc]
shr eax, 3
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x10]
lea ebx, [esi + 0x1c]
mov dword [ebx], eax
mov eax, dword [esi + 0x18]
mov ecx, eax
shr ecx, 1
add ecx, 4
imul ecx, ecx, 5
lea eax, [ecx + eax*2]
cmp dword [ebp + 8], eax
jne 0x127630a
push dword [esi + 0x14]
call fcn.010324e9
push dword [esi + 0x18]
and dword [esi + 0x14], 0
call fcn.010324da
pop ecx
pop ecx
mov dword [esi + 0x14], eax
test eax, eax
jne 0x1276280
mov dword [ebp + 0xc], 0x8007000e
jmp 0x1276311
push dword [esi + 0x18]
lea ecx, [edi + 0x14]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push 4
push ebx
mov ecx, esi
call fcn.012756ea
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x1276311
push dword [esi + 0x18]
mov ecx, esi
push dword [esi + 0x14]
call fcn.012756ea
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x1276311
lea ebx, [esi + 0x24]
cmp dword [ebx], eax
jne 0x12762e9
push 0xf0000000
push 0x18
push eax
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x12762e9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x12762e4
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp + 0xc], eax
jmp 0x1276311
lea eax, [esi + 0x20]
push eax
push 0x40
push 0
push dword [ebp + 8]
push edi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x12762d0
mov dword [esi + 8], 4
jmp 0x1276311
mov dword [ebp + 0xc], 0x80070057
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x127715b
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
cmp dword [ebp + 8], ebx
je 0x1277330
cmp dword [ebp + 0xc], ebx
je 0x1277330
push dword [esi + 0x14]
call fcn.010324e9
push dword [esi + 0xc]
mov dword [esi + 0x14], ebx
call fcn.010324e9
mov eax, dword [esi + 0x20]
pop ecx
pop ecx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
cmp eax, ebx
je 0x12771a5
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [esi + 0x20], ebx
lea eax, [esi + 0x24]
cmp dword [eax], ebx
jne 0x12771dc
push 0xf0000000
push 0x18
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x12771dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x12771d4
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp + 0xc], eax
jmp 0x1277337
push dword [esi + 0xc]
call fcn.010324e9
mov eax, dword [ebp + 0xc]
pop ecx
mov dword [esi + 0xc], ebx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x12771ee
sub eax, ecx
sar eax, 1
mov dword [esi + 0x10], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.010324da
pop ecx
mov dword [esi + 0xc], eax
cmp eax, ebx
jne 0x1277228
mov dword [ebp + 0xc], 0x8007000e
jmp 0x127733c
push dword [ebp + 0xc]
mov ecx, dword [esi + 0x10]
inc ecx
push ecx
push eax
call fcn.010399c4
mov dword [ebp + 0xc], eax
cmp eax, ebx
jne 0x1277337
mov eax, dword [ebp + 8]
push 4
mov ecx, 0x1021e20
pop edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1277270
cmp dx, bx
je 0x127726c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1277270
add eax, edi
add ecx, edi
cmp dx, bx
jne 0x127724c
xor eax, eax
jmp 0x1277275
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x127728a
mov eax, 0x660e
mov dword [esi + 8], 1
jmp 0x127730e
mov eax, dword [ebp + 8]
mov ecx, 0x1021dc8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x12772b6
cmp dx, bx
je 0x12772b2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x12772b6
add eax, edi
add ecx, edi
cmp dx, bx
jne 0x1277292
xor eax, eax
jmp 0x12772bb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x12772cd
mov eax, 0x660f
mov dword [esi + 8], 2
jmp 0x127730e
mov eax, dword [ebp + 8]
mov ecx, 0x1021d70
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x12772f9
cmp dx, bx
je 0x12772f5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x12772f9
add eax, edi
add ecx, edi
cmp dx, bx
jne 0x12772d5
xor eax, eax
jmp 0x12772fe
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x1277327
mov eax, 0x6610
mov dword [esi + 8], 3
lea ecx, [esi + 0x20]
push ecx
push 1
push eax
push dword [esi + 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
jne 0x1277337
jmp 0x12771c0
mov dword [ebp + 0xc], 0x80049e2e
jmp 0x127733c
mov dword [ebp + 0xc], 0x80070057
cmp dword [ebp + 0xc], ebx
jge 0x1277357
push dword [esi + 0x14]
call fcn.010324e9
push dword [esi + 0xc]
mov dword [esi + 0x14], ebx
call fcn.010324e9
pop ecx
pop ecx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x127c03d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp eax, edi
jne 0x127c05f
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
leave
ret 0xc
push esi
cmp dword [ebp + 0xc], edi
je 0x127c090
lea ecx, [ebp - 4]
push ecx
push 0x20019
push edi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x127c082
cmp dword [ebp - 4], edi
jne 0x127c093
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
jmp 0x127c05a
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], edi
je 0x127c0b1
push edi
push edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x127c0b4
xor esi, esi
inc esi
cmp dword [ebp + 0xc], edi
je 0x127c084
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x127c084

Function at 0x127c0c4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], esi
cmp eax, esi
jne 0x127c0f2
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x127c15f
cmp dword [ebp + 0xc], esi
je 0x127c117
lea ecx, [ebp - 4]
push ecx
push 0x20019
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x127c114
cmp dword [ebp - 4], esi
jne 0x127c11a
push eax
jmp 0x127c0e8
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, esi
jne 0x127c143
cmp dword [ebp - 0xc], 4
je 0x127c146
push 0xd
pop edi
mov dword [ebp - 8], esi
cmp dword [ebp + 0xc], esi
je 0x127c154
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 0xc
Function at 0x127c517
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
xor esi, esi
xor eax, eax
cmp dword [ebp + 0x1c], esi
push edi
setne al
mov edi, 0x80
inc eax
mov dword [ebp + 0x1c], eax
add edi, edi
test esi, esi
je 0x127c54a
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [edi + edi]
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x127c595
cmp dword [ebp + 0x18], 0
je 0x127c575
push dword [ebp + 8]
push edi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
jmp 0x127c597
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x127c581
mov eax, 0x1006c04
push dword [ebp + 8]
push edi
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x127c597
xor eax, eax
mov ecx, edi
sub ecx, dword [ebp + 0x1c]
cmp eax, ecx
jae 0x127c538
cmp dword [ebp + 0x14], 0
jne 0x127c5bf
test esi, esi
je 0x127c5cc
test eax, eax
jne 0x127c5bf
push esi
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x127c5bf
xor esi, esi
test esi, esi
je 0x127c5cc
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x127c5cc
mov dword [eax], edi
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x1c

Function at 0x128ce9b
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x128cf30
lea eax, [ecx + 0x110]
mov dword [ebp - 0x10], eax
movzx eax, byte [eax]
mov dword [ebp - 4], eax
lea eax, [ecx + 0x111]
mov dword [ebp - 0x14], eax
movzx eax, byte [eax]
add ecx, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov esi, edi
add esi, dword [ebp + 0xc]
push ebp
mov ebp, dword [ebp - 0xc]
add eax, 1
and eax, 0xff
movzx ecx, byte [eax + ebp]
add ebx, ecx
and ebx, 0xff
movzx edx, byte [ebx + ebp]
mov byte [eax + ebp], dl
add edx, ecx
mov byte [ebx + ebp], cl
and edx, 0xff
movzx ecx, byte [edx + ebp]
xor byte [edi], cl
add edi, 1
cmp edi, esi
jb 0x128cee6
pop ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov al, byte [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov byte [ecx], al
mov al, byte [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov byte [ecx], al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x128d5df
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov esi, ecx
push esi
lea ecx, [ebp - 8]
mov edi, 0x80004005
call fcn.0128d19b
mov ecx, dword [esi + 4]
call fcn.0128479d
push eax
call fcn.01284831
mov ebx, eax
mov eax, dword [esi + 8]
sub eax, 0
mov dword [ebp - 4], ebx
je 0x128d6ff
dec eax
jne 0x128d6ed
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
cmp dword [ecx], ebx
jb 0x128d6e0
test eax, eax
je 0x128d6e0
mov edi, dword [esi + 0x30]
jmp 0x128d64d
sub bl, byte [esi + 0x30]
lea ecx, [esi + 0xc]
call fcn.0128d230
mov byte [eax + edi], bl
mov ebx, dword [ebp - 4]
inc edi
cmp edi, ebx
jb 0x128d63b
and dword [ebp - 4], 0
test ebx, ebx
jbe 0x128d67f
lea ecx, [esi + 0xc]
call fcn.0128d230
mov ecx, dword [ebp - 4]
lea edi, [eax + ecx]
lea ecx, [esi + 0x34]
call fcn.0128d2a3
mov ecx, dword [ebp - 4]
mov al, byte [eax + ecx]
xor byte [edi], al
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jb 0x128d659
lea ecx, [esi + 0xc]
call fcn.0128d230
mov edx, eax
lea ecx, [ebp - 0x14]
call fcn.01284414
lea ecx, [ebp - 0x14]
call fcn.0128441b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push ecx
push ecx
mov ecx, esp
and dword [ecx + 4], 0
mov dword [ecx], eax
mov ecx, dword [esi + 4]
push 0x80
call fcn.01253600
xor al, byte [eax]
add byte [eax + 0x1028488a], al
mov edi, eax
test edi, edi
jne 0x128d6ed
and dword [esi + 0x30], eax
push ebx
push eax
lea ecx, [esi + 0x34]
call fcn.0128d2a3
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
jmp 0x128d6ed
neg eax
sbb eax, eax
and eax, 0xc004d107
mov dword [ecx], ebx
mov edi, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
mov edi, dword [esi + 0x30]
neg edi
sbb edi, edi
and edi, 0x80004005
jmp 0x128d6ed
Function at 0x128dd43
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x12d3ad4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x2c], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ecx
mov ecx, dword [esi + 4]
push edi
mov dword [ebp - 0x38], ebx
call fcn.0128479d
push eax
call fcn.01284831
mov edi, eax
mov byte [ebp - 5], 0
test ebx, ebx
jne 0x128dd86
mov eax, 0xc004d104
jmp 0x128df0e
cmp dword [ebp + 8], 0
mov eax, dword [ebx]
mov dword [ebp - 0x40], eax
jne 0x128dd9a
mov dword [ebx], edi
xor eax, eax
jmp 0x128df0e
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x128df09
xor edx, edx
mov eax, ecx
div edi
test edx, edx
jne 0x128df09
lea ebx, [edi + edi]
cmp ecx, ebx
ja 0x128df09
lea ecx, [esi + 0x34]
call fcn.0128d2a3
push ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x34], eax
call fcn.0128dc1b
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x128dde5
mov dword [ebp - 0x2c], 0x8007000e
jmp 0x128defc
xor ebx, ebx
cmp dword [esi + 0x30], ebx
jbe 0x128de8d
mov eax, dword [ebp - 0x30]
lea edx, [eax + ebx]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x3c], edi
call fcn.01284414
lea ecx, [ebp - 0x4c]
call fcn.0128441b
lea ecx, [ebp - 0x3c]
push ecx
push ecx
push ecx
mov ecx, esp
and dword [ecx + 4], 0
mov dword [ecx], eax
lea ecx, [esi + 0xc]
call fcn.0128d230
add eax, ebx
mov edx, eax
lea ecx, [ebp - 0x58]
call fcn.01284414
lea ecx, [ebp - 0x58]
call fcn.0128441b
push edi
push ecx
push ecx
mov ecx, esp
and dword [ecx + 4], 0
mov dword [ecx], eax
mov ecx, dword [esi + 4]
push 0x40
call fcn.01253600
xor al, byte [eax]
add byte [eax - 0x76], ah
dec eax
sub byte [eax - 0x77], dh
inc ebp
aam 0x85
ror byte [edi], 0x85
mov eax, dword [0x33000000]
leave
test edi, edi
jbe 0x128de75
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x34]
mov dl, byte [ecx + edx]
add eax, ebx
add eax, ecx
xor byte [eax], dl
inc ecx
cmp ecx, edi
jb 0x128de61
lea ecx, [esi + 0xc]
call fcn.0128d230
add eax, ebx
add ebx, edi
mov dword [ebp - 0x34], eax
cmp ebx, dword [esi + 0x30]
jb 0x128ddf0
mov eax, dword [esi + 0x30]
mov ecx, dword [ebp - 0x30]
lea ecx, [ecx + eax - 1]
mov bl, byte [ecx]
movzx edx, bl
cmp edx, edi
jbe 0x128dea9
mov dword [ebp - 0x2c], 0xc004d211
jmp 0x128defc
xor edi, edi
test edx, edx
jbe 0x128deb9
cmp byte [ecx], bl
jne 0x128dea0
inc edi
dec ecx
cmp edi, edx
jb 0x128deaf
mov edi, dword [ebp - 0x38]
sub eax, edx
mov dword [edi], eax
mov eax, dword [esi + 0x30]
sub eax, edx
cmp dword [ebp - 0x40], eax
jae 0x128dedb
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, 0xc004d107
mov dword [ebp - 0x2c], eax
jmp 0x128defc
xor esi, esi
cmp dword [edi], esi
jbe 0x128defc
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [eax + esi]
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax + esi]
push eax
call fcn.01284328
inc esi
cmp esi, dword [edi]
jb 0x128dee1
lea ecx, [ebp - 0x28]
call fcn.0128d246
mov eax, dword [ebp - 0x2c]
jmp 0x128df0e
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0128e47a
leave
ret 0xc
Function at 0x1290d8d
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x12d3ad4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea ecx, [ebp - 0x118]
call fcn.0128ce37
xor edi, edi
cmp dword [ebp + 0x10], edi
jne 0x1290dd5
xor esi, esi
lea ecx, [ebp - 0x118]
call fcn.0128ce49
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0128e47a
leave
ret 0xc
cmp dword [ebp + 8], edi
jne 0x1290de1
mov esi, 0xc004d104
jmp 0x1290db8
mov esi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push ebx
lea eax, [ebp - 0x124]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor dword [ebp - 0x120], eax
mov ebx, dword [ebp - 0x124]
xor ebx, dword [ebp - 0x120]
push 1
push 8
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x118]
call fcn.01283beb
cmp dword [ebp + 0x10], edi
jbe 0x1290e9c
lea eax, [ebp - 0x124]
push eax
call esi
mov eax, dword [ebp - 0x124]
xor eax, ebx
mov cl, bl
rol eax, cl
lea ecx, [ebp - 0x118]
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0xc]
add eax, edi
mov dword [ebp - 0x128], eax
call fcn.0128cf51
mov edx, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x12c]
xor al, bl
mov byte [ebp - 0x11c], al
call fcn.012842e3
xor al, byte [ebp - 0x11c]
mov edx, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x12c]
mov byte [ebp - 0x130], al
push dword [ebp - 0x130]
call fcn.01284328
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x1290e24
pop ebx
jmp 0x1290db6
Function at 0x1291554
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x12d3ad4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
mov dword [ebp - 0x88], eax
cmp dword [ebp + 8], ebx
je 0x1291597
cmp eax, ebx
je 0x129159b
mov eax, dword [edi]
dec eax
je 0x12915b3
dec eax
je 0x12915ac
dec eax
je 0x12915a5
mov eax, 0xc004a001
jmp 0x129170b
cmp eax, ebx
je 0x1291582
mov eax, 0xc004d104
jmp 0x129170b
call fcn.01296e3a
jmp 0x12915b8
call fcn.01296e98
jmp 0x12915b8
call fcn.01296ee9
cmp eax, ebx
jl 0x129170b
mov esi, dword [ebp - 0x88]
mov byte [edi + 6], bl
mov byte [edi + 4], 1
cmp esi, ebx
je 0x129170b
cmp esi, 0x40
jbe 0x129162f
push esi
push dword [ebp + 0xc]
mov ecx, edi
push dword [ebp + 8]
call fcn.0129125a
cmp eax, ebx
jl 0x129170b
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x44]
push eax
mov ecx, edi
mov dword [ebp - 0x88], 0x40
call fcn.012912ed
cmp eax, ebx
jl 0x129170b
push ebx
push ecx
push ecx
mov eax, esp
mov ecx, edi
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.01291554
cmp eax, ebx
jl 0x129170b
jmp 0x1291665
mov eax, dword [ebp + 8]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp + 0xc]
lea ebx, [ebp - 0x44]
mov dword [ebp - 0x8c], eax
test esi, esi
jbe 0x129166b
mov edx, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x90]
inc dword [ebp - 0x8c]
call fcn.012842e3
mov byte [ebx], al
inc ebx
dec esi
jne 0x1291648
mov esi, dword [ebp - 0x88]
push esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x84]
push eax
call sub.msvcrt.dll_memcpy
push 0x40
pop ebx
sub ebx, esi
push ebx
lea eax, [ebp + esi - 0x44]
push 0x36
push eax
call sub.msvcrt.dll_memset
push ebx
lea eax, [ebp + esi - 0x84]
push 0x5c
push eax
call sub.msvcrt.dll_memset
xor ebx, ebx
add esp, 0x24
xor eax, eax
cmp esi, ebx
jbe 0x12916bb
xor byte [ebp + eax - 0x44], 0x36
xor byte [ebp + eax - 0x84], 0x5c
inc eax
cmp eax, esi
jb 0x12916a9
push 0x40
lea eax, [ebp - 0x84]
push eax
mov ecx, edi
call fcn.01291218
cmp eax, ebx
jl 0x129170b
push 0x68
lea eax, [edi + 8]
push eax
lea eax, [edi + 0x70]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebx
push ecx
push ecx
mov eax, esp
mov ecx, edi
mov dword [eax], ebx
mov dword [eax + 4], ebx
call fcn.01291554
cmp eax, ebx
jl 0x129170b
push 0x40
lea eax, [ebp - 0x44]
push eax
mov ecx, edi
call fcn.01291218
cmp eax, ebx
jl 0x129170b
mov byte [edi + 5], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0128e47a
leave
ret 0xc
Function at 0x12977b3
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
push edi
mov edi, ecx
cmp byte [edi + 4], 0
jne 0x12977d6
mov eax, 0xc004d101
jmp 0x1297969
mov eax, dword [edi]
mov eax, dword [eax + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ecx, esi
sub ecx, eax
dec ecx
lea edx, [eax + eax]
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ecx
cmp edx, eax
jb 0x1297954
lea eax, [ecx + eax*2]
cmp ecx, eax
ja 0x1297954
push eax
call fcn.0106d011
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x1297820
mov dword [ebp + 0x14], 0x8007000e
jmp 0x129795b
mov ecx, dword [ebp - 4]
add ebx, ecx
lea edx, [ecx + eax]
mov ecx, dword [ebp + 0x18]
add ebx, eax
mov dword [ebp - 8], edx
test ecx, ecx
jne 0x1297836
mov ecx, eax
push dword [ebp + 0x1c]
push ecx
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [edi]
push eax
call fcn.01297472
mov dword [ebp + 0x14], eax
test eax, eax
jl 0x129795b
mov ecx, dword [ebp - 4]
lea eax, [ecx + ecx + 2]
cmp ecx, eax
ja 0x1297954
cmp esi, eax
jb 0x1297954
mov eax, dword [ebp + 0x10]
push ecx
sub esi, ecx
lea edx, [eax + 1]
lea eax, [ecx + eax + 1]
mov ecx, dword [edi]
dec esi
push esi
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
mov dword [ebp + 0x18], edx
mov dword [ebp + 0x1c], esi
call fcn.012974b2
mov dword [ebp + 0x14], eax
test eax, eax
jl 0x129795b
mov ecx, dword [ebp - 0xc]
test ecx, ecx
jbe 0x12978b2
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 0x18]
sub esi, eax
mov dl, byte [esi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x12978a9
push dword [ebp - 0x10]
mov ecx, dword [edi]
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push dword [ebp - 8]
push eax
push ebx
call fcn.012974b2
mov dword [ebp + 0x14], eax
test eax, eax
jl 0x129795b
mov esi, dword [ebp + 0x1c]
test esi, esi
jbe 0x12978e9
mov edi, dword [ebp - 0x18]
mov eax, ebx
sub edi, ebx
mov cl, byte [edi + eax]
xor byte [eax], cl
inc eax
dec esi
jne 0x12978e0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jmp 0x12978fc
cmp byte [ecx + ebx], 0
jne 0x1297901
inc ecx
cmp ecx, eax
mov dword [ebp + 0x18], ecx
jb 0x12978f3
cmp ecx, eax
je 0x129794b
cmp byte [ecx + ebx], 1
jne 0x129794b
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0x14]
mov esi, ebx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x129794b
mov ecx, dword [ebp + 0x10]
cmp byte [ecx], dl
jne 0x129794b
mov esi, dword [ebp - 4]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
sub edx, esi
sub eax, edx
sub eax, esi
dec eax
cmp dword [ecx], eax
mov dword [ecx], eax
jb 0x1297954
push eax
add edx, esi
lea eax, [edx + ebx + 1]
push eax
push dword [ebp + 8]
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x129795b
mov dword [ebp + 0x14], 0xc004d210
jmp 0x129795b
mov dword [ebp + 0x14], 0x8007006f
push dword [ebp - 0x14]
call fcn.0106d020
mov eax, dword [ebp + 0x14]
pop ecx
pop esi
pop ebx
pop edi
leave
ret 0x18