joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb93811
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, dword [ebp + 8]
mov byte [ebx], 0
cmp dword [ebp + 0xc], 0x80
jle 0xb9382f
mov dword [ebp + 0xc], 0x80
cmp dword [ebp + 0x14], 0
jg 0xb9383c
mov dword [ebp + 0x14], 0x400
cmp dword [ebp + 0x14], 0x400
jle 0xb9384c
mov dword [ebp + 0x14], 0x400
xor eax, eax
mov esi, ebx
mov edx, dword [ebp + 0x10]
cmp eax, dword [ebp + 0xc]
jge 0xb93864
mov cl, byte [edx]
mov byte [esi], cl
inc eax
inc esi
inc edx
cmp eax, dword [ebp + 0xc]
jl 0xb93858
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ebx + eax - 1]
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebx + eax]
mov dword [ebp - 8], ecx
mov esi, ebx
cmp eax, 0x80
jge 0xb938ab
xor ecx, ecx
mov cl, byte [esi]
add edx, ecx
mov ecx, dword [ebp - 8]
and edx, 0xff
movzx edx, byte [edx + 0x5d2c70]
mov byte [ecx], dl
inc dword [ebp - 8]
inc eax
inc esi
inc dword [ebp - 4]
cmp eax, 0x80
jl 0xb93884
mov eax, dword [ebp + 0x14]
mov edx, 0xff
add eax, 7
sar eax, 3
mov dword [ebp - 4], eax
mov eax, 0x80
mov ecx, dword [ebp + 0x14]
sub eax, dword [ebp - 4]
neg ecx
and ecx, 7
sar edx, cl
xor ecx, ecx
mov cl, byte [ebx + eax]
and edx, ecx
lea ecx, [ebx + eax]
movzx edx, byte [edx + 0x5d2c70]
mov byte [ebx + eax], dl
mov dword [ebp - 0xc], ecx
lea ecx, [ebx + eax]
mov esi, dword [ebp - 4]
lea esi, [ecx + esi]
jmp 0xb93902
xor ecx, ecx
mov cl, byte [esi]
xor edx, ecx
mov ecx, dword [ebp - 0xc]
movzx edx, byte [edx + 0x5d2c70]
mov byte [ecx], dl
dec esi
dec dword [ebp - 0xc]
mov ecx, eax
add eax, 0xffffffff
test ecx, ecx
jne 0xb938f0
mov ecx, dword [ebp + 8]
mov eax, 0x7f
add ecx, 0xfc
lea edx, [ebx + 0x7f]
movzx esi, byte [edx - 1]
xor ebx, ebx
sub eax, 2
mov bl, byte [edx]
add edx, 0xfffffffe
shl ebx, 8
or ebx, esi
and ebx, 0xffff
mov dword [ecx], ebx
sub ecx, 4
test eax, eax
jge 0xb93920
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xb94465
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
xor ecx, ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
mov ebx, dword [eax]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 0x18]
xor edx, edx
mov dl, byte [eax]
inc eax
mov cl, byte [eax]
inc eax
shl ecx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl ecx, 0x10
or edx, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl ecx, 0x18
movzx edi, byte [eax]
inc eax
or edx, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl ecx, 8
or edi, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl ecx, 0x10
movzx eax, byte [eax]
shl eax, 0x18
or edi, ecx
or edi, eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], edx
mov ecx, edx
and cl, 0xff
mov dword [ebp - 0x10], edi
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
mov ecx, edi
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, edi
and dl, 0xff
mov byte [eax], dl
mov edx, edi
inc eax
shr edx, 8
and dl, 0xff
mov byte [eax], dl
inc eax
shr ecx, 0x10
mov edx, edi
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
and dl, 0xff
mov byte [eax], dl
jmp 0xb945a4
test ebx, ebx
jne 0xb94591
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00b93efd
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, edx
add esp, 8
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, dword [ebp - 0x10]
mov ecx, edx
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
and dl, 0xff
mov byte [eax], dl
inc dword [ebp - 0x18]
mov al, byte [esi]
mov edx, dword [ebp + 0xc]
xor al, byte [ebp + ebx - 0xc]
inc esi
mov byte [edx], al
inc ebx
inc dword [ebp + 0xc]
and ebx, 7
mov eax, dword [ebp - 4]
add dword [ebp - 4], 0xffffffff
test eax, eax
jne 0xb94524
cmp dword [ebp - 0x18], 0
je 0xb94611
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x18]
mov ecx, edx
mov edi, dword [ebp - 0x10]
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
mov ecx, edi
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, edi
and dl, 0xff
mov byte [eax], dl
mov edx, edi
inc eax
shr edx, 8
and dl, 0xff
mov byte [eax], dl
inc eax
shr ecx, 0x10
mov edx, edi
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
and dl, 0xff
mov byte [eax], dl
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov edi, eax
mov edx, eax
mov edx, dword [ebp + 0x1c]
mov dword [edx], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xb95bcd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
xor ecx, ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
mov ebx, dword [eax]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 0x18]
xor edx, edx
mov dl, byte [eax]
inc eax
shl edx, 0x18
mov cl, byte [eax]
shl ecx, 0x10
inc eax
or edx, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl ecx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
or edx, ecx
xor ecx, ecx
movzx edi, byte [eax]
inc eax
shl edi, 0x18
mov cl, byte [eax]
shl ecx, 0x10
inc eax
or edi, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl ecx, 8
movzx eax, byte [eax]
or edi, ecx
mov ecx, edx
or edi, eax
lea eax, [ebp - 0xc]
shr ecx, 0x18
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edi
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
and dl, 0xff
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
inc eax
mov ecx, edi
shr ecx, 8
mov byte [eax], dl
mov edx, edi
inc eax
shr edx, 0x18
and cl, 0xff
and dl, 0xff
mov byte [eax], dl
mov edx, edi
inc eax
shr edx, 0x10
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, edi
mov byte [eax], cl
inc eax
and dl, 0xff
mov byte [eax], dl
jmp 0xb95d0c
test ebx, ebx
jne 0xb95cf9
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00b9507d
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, edx
add esp, 8
shr ecx, 0x18
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
and dl, 0xff
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
inc eax
mov byte [eax], dl
inc eax
mov edx, dword [ebp - 0x10]
mov ecx, edx
shr ecx, 0x18
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
and dl, 0xff
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
inc eax
mov byte [eax], dl
inc dword [ebp - 0x18]
mov al, byte [esi]
mov edx, dword [ebp + 0xc]
xor al, byte [ebp + ebx - 0xc]
inc esi
mov byte [edx], al
inc ebx
inc dword [ebp + 0xc]
and ebx, 7
mov eax, dword [ebp - 4]
add dword [ebp - 4], 0xffffffff
test eax, eax
jne 0xb95c8c
cmp dword [ebp - 0x18], 0
je 0xb95d79
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x18]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
and dl, 0xff
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
inc eax
mov ecx, edi
shr ecx, 8
mov byte [eax], dl
mov edx, edi
inc eax
shr edx, 0x18
and cl, 0xff
and dl, 0xff
mov byte [eax], dl
mov edx, edi
inc eax
shr edx, 0x10
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, edi
mov byte [eax], cl
inc eax
and dl, 0xff
mov byte [eax], dl
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov edi, eax
mov edx, eax
mov edx, dword [ebp + 0x1c]
mov dword [edx], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xb961c9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0x10], 0
jle 0xb962fc
cmp dword [ebp + 0x10], 0x80
jg 0xb962fc
push 0x10
mov eax, dword [ebp + 0x18]
push eax
lea edx, [ebp - 0x30]
push edx
call fcn.00cbbfb1
add esp, 0xc
mov ecx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 0x18]
push ecx
mov eax, dword [ebp + 0x18]
push eax
call fcn.00b96ae1
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, 7
test edx, edx
jns 0xb96222
add edx, 7
sar edx, 3
mov dword [ebp - 4], edx
cmp dword [ebp + 0x1c], 0
je 0xb9625d
xor eax, eax
mov edx, esi
mov dword [ebp - 8], edx
lea esi, [ebp - 0x20]
mov edx, dword [ebp + 0x18]
mov ecx, edx
mov edx, ebx
cmp eax, dword [ebp - 4]
jge 0xb9628a
mov bl, byte [edx]
inc edx
xor bl, byte [ecx]
inc ecx
mov byte [esi], bl
inc esi
mov edi, dword [ebp - 8]
inc eax
mov byte [edi], bl
inc dword [ebp - 8]
cmp eax, dword [ebp - 4]
jl 0xb96244
jmp 0xb9628a
mov edx, esi
xor eax, eax
mov dword [ebp - 0xc], edx
mov edx, ebx
mov ecx, dword [ebp + 0x18]
cmp eax, dword [ebp - 4]
mov esi, ecx
lea ecx, [ebp - 0x20]
jge 0xb9628a
mov bl, byte [edx]
inc edx
mov byte [ecx], bl
inc ecx
mov edi, dword [ebp - 0xc]
inc eax
xor bl, byte [esi]
inc esi
mov byte [edi], bl
inc dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jl 0xb96273
mov esi, dword [ebp + 0x10]
and esi, 0x80000007
jns 0xb9629a
dec esi
or esi, 0xfffffff8
inc esi
mov eax, dword [ebp + 0x10]
test eax, eax
jns 0xb962a4
add eax, 7
sar eax, 3
test esi, esi
mov dword [ebp - 4], eax
jne 0xb962c5
push 0x10
lea edx, [ebp - 0x30]
add edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.00cbbfb1
add esp, 0xc
jmp 0xb962fc
xor eax, eax
mov edx, dword [ebp + 0x18]
mov ecx, edx
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
lea edx, [ebp + edx - 0x30]
mov ecx, esi
mov bl, byte [edx]
shl bl, cl
mov ecx, 8
sub ecx, esi
movzx edi, byte [edx + 1]
sar edi, cl
mov ecx, edi
or bl, cl
mov ecx, dword [ebp - 0x10]
mov byte [ecx], bl
inc eax
inc dword [ebp - 0x10]
inc edx
cmp eax, 0x10
jl 0xb962d6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xba49d1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor eax, eax
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp + 0x10]
jne 0xba4a04
mov ecx, dword [ebp + 0x18]
push ecx
mov eax, dword [ebp + 0x14]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00ba4c11
add esp, 0x10
jmp 0xba4b74
mov eax, dword [ebp + 0x18]
push eax
call fcn.00b9a559
pop ecx
mov edx, dword [ebp + 0x18]
push edx
call fcn.00b9a5e9
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
je 0xba4b67
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov esi, dword [edx + 4]
mov edx, dword [ebp - 0xc]
add esi, dword [eax + 4]
add esi, 4
cmp esi, dword [edx + 8]
jg 0xba4a3f
mov ecx, dword [ebp - 0xc]
jmp 0xba4a4e
push esi
mov eax, dword [ebp - 0xc]
push eax
call fcn.00b99d2d
add esp, 8
mov ecx, eax
test ecx, ecx
je 0xba4b67
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], esi
xor ebx, ebx
cmp esi, ebx
jle 0xba4a71
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
xor ecx, ecx
mov dword [edx + ebx*4], ecx
inc ebx
cmp esi, ebx
jg 0xba4a62
xor eax, eax
mov dword [ebp - 4], eax
jmp 0xba4b0a
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx]
mov edx, dword [ebp - 4]
mov ecx, dword [ecx + edx*4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 4]
inc edx
cmp eax, edx
jne 0xba4a95
xor eax, eax
jmp 0xba4aa1
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov edx, dword [ebp - 4]
mov eax, dword [eax + edx*4 + 4]
mov dword [ebp - 0x10], eax
xor ebx, ebx
jmp 0xba4afc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx + ebx*4]
lea ecx, [ebx + 1]
cmp edx, ecx
jne 0xba4abb
xor edx, edx
jmp 0xba4ac4
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
mov edx, dword [ecx + ebx*4 + 4]
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x10]
push ecx
push eax
push edx
lea eax, [ebp - 0x24]
push eax
call fcn.00ba45a9
add esp, 0x14
xor eax, eax
lea edx, [ebp - 0x24]
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
add ecx, ebx
mov edi, dword [edx]
add ecx, eax
mov esi, dword [esi]
inc eax
add edx, 4
xor dword [esi + ecx*4], edi
cmp eax, 4
jl 0xba4adf
add ebx, 2
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
cmp ebx, edx
jl 0xba4aa8
add dword [ebp - 4], 2
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 4]
cmp eax, dword [ebp - 4]
jg 0xba4a7b
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
test eax, eax
jle 0xba4b48
shl eax, 2
mov edx, dword [ebp - 0xc]
add eax, dword [edx]
add eax, 0xfffffffc
jmp 0xba4b3f
mov ecx, dword [eax]
add eax, 0xfffffffc
test ecx, ecx
jne 0xba4b48
mov edx, dword [ebp - 0xc]
dec dword [edx + 4]
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 4], 0
jg 0xba4b30
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00ba46c1
add esp, 0xc
test eax, eax
je 0xba4b67
mov dword [ebp - 8], 1
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.00b9a5a9
pop ecx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xba89ad
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
dec ebx
mov eax, dword [ebp + 8]
lea edx, [ebx - 0x29]
cmp esi, edx
jle 0xba89e3
push 0x2d
push 0x5d82c4
push 0x6e
push 0x79
push 4
call fcn.00bbd2f1
add esp, 0x14
xor eax, eax
jmp 0xba8b22
cmp ebx, 0x29
jge 0xba8a04
push 0x33
push 0x5d82dc
push 0x78
push 0x79
push 4
call fcn.00bbd2f1
add esp, 0x14
xor eax, eax
jmp 0xba8b22
mov byte [eax], 0
lea edx, [eax + 1]
mov dword [ebp - 8], edx
add eax, 0x15
mov dword [ebp - 4], eax
push 0
call fcn.00bc27bd
push eax
push 0
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.00bc0671
add esp, 0x18
mov edi, ebx
sub edi, esi
mov eax, edi
add eax, 0xffffffd7
push eax
push 0
mov edx, dword [ebp - 4]
add edx, 0x14
push edx
call fcn.00cbc021
add esp, 0xc
mov ecx, dword [ebp - 4]
mov byte [ecx + edi - 0x15], 1
push esi
mov ecx, dword [ebp + 0x10]
push ecx
mov eax, dword [ebp - 4]
add eax, ebx
sub eax, esi
add eax, 0xffffffec
push eax
call fcn.00cbbfb1
add esp, 0xc
push 0x14
mov edx, dword [ebp - 8]
push edx
call fcn.00bbc831
add esp, 8
test eax, eax
jg 0xba8a85
xor eax, eax
jmp 0xba8b22
push 0x48
push 0x5d82f4
lea esi, [ebx - 0x14]
push esi
call fcn.00b8502d
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0xba8aba
push 0x4b
push 0x5d830c
push 0x41
push 0x79
push 4
call fcn.00bbd2f1
add esp, 0x14
xor eax, eax
jmp 0xba8b22
push 0x14
mov edx, dword [ebp - 8]
push edx
push esi
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00ba8de5
mov edx, dword [ebp - 4]
add esp, 0x10
mov esi, edx
mov edx, dword [ebp - 0xc]
xor eax, eax
jmp 0xba8ae0
mov cl, byte [edx]
inc eax
xor byte [esi], cl
inc esi
inc edx
lea ecx, [ebx - 0x14]
cmp eax, ecx
jl 0xba8ad9
add ebx, 0xffffffec
lea edx, [ebp - 0x20]
push ebx
mov eax, dword [ebp - 4]
push eax
push 0x14
push edx
call fcn.00ba8de5
mov edx, dword [ebp - 8]
add esp, 0x10
mov ecx, edx
lea edx, [ebp - 0x20]
xor eax, eax
mov bl, byte [edx]
xor byte [ecx], bl
inc eax
inc ecx
inc edx
cmp eax, 0x14
jl 0xba8b07
mov eax, dword [ebp - 0xc]
push eax
call fcn.00b851ed
pop ecx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xba8b29
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
xor edx, edx
push ebx
push esi
push edi
xor esi, esi
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], edx
dec eax
cmp eax, 0x29
jl 0xba8cc1
mov ecx, eax
sub ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jge 0xba8b63
mov dword [ebp - 0xc], 1
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp + 0x14], eax
lea ebx, [eax - 0x14]
push 0x79
push 0x5d8324
add eax, ebx
push eax
call fcn.00b8502d
add esp, 0xc
mov esi, eax
test esi, esi
jne 0xba8b9b
push 0x7c
push 0x5d833c
push 0x41
push 0x7a
push 4
call fcn.00bbd2f1
add esp, 0x14
or eax, 0xffffffff
jmp 0xba8ce7
lea edi, [ebx + esi]
mov eax, dword [ebp - 8]
push eax
push 0
push edi
call fcn.00cbc021
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 8]
add ecx, edi
push ecx
call fcn.00cbbfb1
add esp, 0xc
lea eax, [edi + 0x14]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x28]
push ebx
mov edx, dword [ebp - 4]
push edx
push 0x14
push ecx
call fcn.00ba8de5
add esp, 0x10
lea edx, [ebp - 0x28]
mov dword [ebp - 0x10], edx
mov edx, edi
xor eax, eax
mov cl, byte [edx]
mov edi, dword [ebp - 0x10]
xor byte [edi], cl
inc eax
inc dword [ebp - 0x10]
inc edx
cmp eax, 0x14
jl 0xba8be6
push 0x14
lea eax, [ebp - 0x28]
push eax
push ebx
push esi
call fcn.00ba8de5
mov edx, esi
add esp, 0x10
mov dword [ebp - 0x14], edx
xor eax, eax
mov ecx, dword [ebp - 4]
cmp ebx, eax
mov edx, ecx
jle 0xba8c27
mov cl, byte [edx]
mov edi, dword [ebp - 0x14]
xor byte [edi], cl
inc eax
inc dword [ebp - 0x14]
inc edx
cmp ebx, eax
jg 0xba8c17
push 0
call fcn.00bc27bd
push eax
lea eax, [ebp - 0x3c]
push 0
push eax
mov edx, dword [ebp + 0x20]
push edx
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.00bc0671
add esp, 0x18
lea ecx, [ebp - 0x3c]
push 0x14
push ecx
push esi
call fcn.00cbc2d1
add esp, 0xc
test eax, eax
jne 0xba8cc1
cmp dword [ebp - 0xc], 0
jne 0xba8cc1
mov eax, 0x14
lea edx, [esi + 0x14]
cmp ebx, eax
jle 0xba8c75
cmp byte [edx], 0
jne 0xba8c75
inc eax
inc edx
cmp ebx, eax
jg 0xba8c6a
cmp ebx, eax
je 0xba8cc1
xor edx, edx
mov dl, byte [esi + eax]
dec edx
jne 0xba8cc1
inc eax
sub ebx, eax
cmp ebx, dword [ebp + 0xc]
jle 0xba8ca6
push 0xa2
push 0x5d8354
push 0x6d
push 0x7a
push 4
call fcn.00bbd2f1
add esp, 0x14
or ebx, 0xffffffff
jmp 0xba8cb6
push ebx
add eax, esi
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00cbbfb1
add esp, 0xc
push esi
call fcn.00b851ed
pop ecx
mov eax, ebx
jmp 0xba8ce7
push 0xaf
push 0x5d836c
push 0x79
push 0x7a
push 4
call fcn.00bbd2f1
add esp, 0x14
test esi, esi
je 0xba8ce4
push esi
call fcn.00b851ed
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xba8e85
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
cmp edx, dword [ebp + 0x18]
jne 0xba8ea3
xor ecx, ecx
mov cl, byte [eax]
cmp ecx, 0x6a
je 0xba8ec6
cmp ecx, 0x6b
je 0xba8ec6
push 0x72
push 0x5d839c
push 0x89
push 0x80
push 4
call fcn.00bbd2f1
add esp, 0x14
or eax, 0xffffffff
jmp 0xba8f8a
mov cl, byte [eax]
inc eax
and ecx, 0xff
cmp ecx, 0x6b
jne 0xba8f47
lea esi, [edx - 3]
xor ecx, ecx
cmp esi, ecx
jle 0xba8f1c
mov dl, byte [eax]
xor ebx, ebx
mov bl, dl
inc eax
cmp ebx, 0xba
je 0xba8f1c
cmp ebx, 0xbb
je 0xba8f17
push 0x81
push 0x5d83b4
push 0x8a
push 0x80
push 4
call fcn.00bbd2f1
add esp, 0x14
or eax, 0xffffffff
jmp 0xba8f8a
inc ecx
cmp esi, ecx
jg 0xba8edd
sub esi, ecx
test ecx, ecx
jne 0xba8f4a
push 0x8a
push 0x5d83cc
push 0x8a
push 0x80
push 4
call fcn.00bbd2f1
add esp, 0x14
or eax, 0xffffffff
jmp 0xba8f8a
lea esi, [edx - 2]
xor edx, edx
mov dl, byte [eax + esi]
cmp edx, 0xcc
je 0xba8f7a
push 0x93
push 0x5d83e4
push 0x8b
push 0x80
push 4
call fcn.00bbd2f1
add esp, 0x14
or eax, 0xffffffff
jmp 0xba8f8a
push esi
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00cbbfb1
add esp, 0xc
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0xbbfddd
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor edx, edx
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jle 0xbbfebd
cmp ecx, 3
jl 0xbbfe57
xor edx, edx
xor ebx, ebx
mov bl, byte [esi + 1]
mov dl, byte [esi]
shl ebx, 8
shl edx, 0x10
or edx, ebx
xor ebx, ebx
mov bl, byte [esi + 2]
or edx, ebx
mov ebx, edx
shr ebx, 0x12
and ebx, 0x3f
mov bl, byte [ebx + 0x5f6748]
mov byte [eax], bl
mov ebx, edx
shr ebx, 0xc
inc eax
and ebx, 0x3f
mov bl, byte [ebx + 0x5f6748]
mov byte [eax], bl
mov ebx, edx
shr ebx, 6
inc eax
and ebx, 0x3f
and edx, 0x3f
mov bl, byte [ebx + 0x5f6748]
mov byte [eax], bl
inc eax
mov dl, byte [edx + 0x5f6748]
mov byte [eax], dl
inc eax
jmp 0xbbfeab
xor edx, edx
mov dl, byte [esi]
shl edx, 0x10
cmp ecx, 2
jne 0xbbfe6d
xor ebx, ebx
mov bl, byte [esi + 1]
shl ebx, 8
or edx, ebx
mov ebx, edx
shr ebx, 0x12
and ebx, 0x3f
mov bl, byte [ebx + 0x5f6748]
mov byte [eax], bl
mov ebx, edx
shr ebx, 0xc
inc eax
and ebx, 0x3f
mov bl, byte [ebx + 0x5f6748]
mov byte [eax], bl
inc eax
cmp ecx, 1
jne 0xbbfe98
mov bl, 0x3d
jmp 0xbbfea4
shr edx, 6
and edx, 0x3f
mov bl, byte [edx + 0x5f6748]
mov byte [eax], bl
inc eax
mov byte [eax], 0x3d
inc eax
add dword [ebp - 4], 4
add esi, 3
sub ecx, 3
test ecx, ecx
jg 0xbbfdf9
mov byte [eax], 0
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0xbc61ad
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor ecx, ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0xbc61c6
cmp dword [esi + 8], 0
jne 0xbc61cd
xor eax, eax
jmp 0xbc62c0
mov edx, dword [esi + 4]
and edx, 0x100
mov dword [ebp - 8], edx
mov eax, dword [esi]
test eax, eax
jne 0xbc61e8
mov dword [ebp - 4], 1
jmp 0xbc6245
mov dword [ebp - 4], eax
xor eax, eax
mov edx, dword [esi + 8]
cmp dword [ebp - 8], 0
mov al, byte [edx]
jne 0xbc6206
cmp eax, 0x7f
jle 0xbc6206
mov ebx, 1
xor ecx, ecx
jmp 0xbc6242
cmp dword [ebp - 8], 0
je 0xbc6242
cmp eax, 0x80
jle 0xbc621c
mov ebx, 1
mov cl, 0xff
jmp 0xbc6242
cmp eax, 0x80
jne 0xbc6242
mov eax, 1
mov edx, dword [esi + 8]
inc edx
jmp 0xbc623e
cmp byte [edx], 0
je 0xbc623c
mov ebx, 1
mov cl, 0xff
jmp 0xbc6242
inc eax
inc edx
cmp eax, dword [esi]
jl 0xbc622e
add dword [ebp - 4], ebx
cmp dword [ebp + 0xc], 0
jne 0xbc6250
mov eax, dword [ebp - 4]
jmp 0xbc62c0
mov edx, dword [ebp + 0xc]
test ebx, ebx
mov edx, dword [edx]
je 0xbc625c
mov byte [edx], cl
inc edx
cmp dword [esi], 0
jne 0xbc6266
mov byte [edx], 0
jmp 0xbc62b5
cmp dword [ebp - 8], 0
jne 0xbc627e
mov eax, dword [esi]
push eax
mov ecx, dword [esi + 8]
push ecx
push edx
call fcn.00cbbfb1
add esp, 0xc
jmp 0xbc62b5
mov eax, dword [esi]
mov ecx, dword [esi + 8]
add ecx, eax
mov ebx, eax
dec ebx
dec ecx
add edx, ebx
jmp 0xbc6293
mov byte [edx], 0
dec edx
dec ecx
dec eax
cmp byte [ecx], 0
je 0xbc628d
mov bl, byte [ecx]
dec ecx
xor bl, 0xff
dec eax
inc ebx
mov byte [edx], bl
dec edx
test eax, eax
jle 0xbc62b5
mov bl, byte [ecx]
dec ecx
xor bl, 0xff
dec eax
mov byte [edx], bl
dec edx
test eax, eax
jg 0xbc62a7
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
add dword [eax], edx
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret