joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a8cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x6a8d9f
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x6a8d35
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.006a8480
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6a8cff
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x6a8e56
call 0x6a8d47
pop edx
lea ecx, [edx + 0x139]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x6a8df7
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.006a88a0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6a8dac
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x6a8e56
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.006a88a0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x6a8e54
jmp 0x6a8e56
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6a9040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov edi, dword [eax]
movzx eax, byte [edx]
movzx ebp, byte [edx + 1]
movzx ecx, byte [edx + 2]
movzx esi, byte [edx + 3]
mov dword [esp + 0x18], esi
movzx esi, byte [edx + 4]
mov dword [esp + 0x14], esi
movzx ebx, byte [edx + 5]
movzx esi, byte [edx + 6]
mov dword [esp + 0x10], esi
movzx edx, byte [edx + 7]
mov byte [esp], al
mov esi, eax
mov eax, ebp
mov byte [esp + 1], al
shl esi, 0x18
shl ebp, 0x10
or ebp, esi
mov byte [esp + 2], cl
shl ecx, 8
or ecx, ebp
mov eax, dword [esp + 0x18]
or ecx, eax
mov byte [esp + 3], al
mov eax, dword [esp + 0x14]
mov byte [esp + 4], al
mov esi, eax
mov byte [esp + 5], bl
shl esi, 0x18
shl ebx, 0x10
or ebx, esi
mov eax, dword [esp + 0x10]
mov byte [esp + 6], al
shl eax, 8
or eax, ebx
or eax, edx
mov byte [esp + 7], dl
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
cmp dword [esp + 0x38], 0
je 0x6a916f
xor ebp, ebp
xor ebx, ebx
jmp 0x6a910d
movzx edx, byte [esp + edi]
mov esi, dword [esp + 0x30]
xor dl, byte [esi + ebp]
mov esi, dword [esp + 0x34]
mov byte [esi + ebp], dl
inc edi
and edi, 7
inc ebp
cmp dword [esp + 0x38], ebp
je 0x6a913c
test edi, edi
jne 0x6a90f0
push dword [esp + 0x3c]
lea eax, [esp + 0xc]
push eax
call fcn.006a8480
add esp, 8
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov edx, ecx
bswap edx
mov dword [esp], edx
mov edx, eax
bswap edx
mov dword [esp + 4], edx
inc ebx
jmp 0x6a90f0
test ebx, ebx
je 0x6a916f
mov edx, ecx
shr edx, 0x18
mov esi, dword [esp + 0x40]
mov byte [esi], dl
mov edx, ecx
shr edx, 0x10
mov byte [esi + 1], dl
mov byte [esi + 2], ch
mov byte [esi + 3], cl
mov ecx, eax
shr ecx, 0x18
mov byte [esi + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 5], cl
mov byte [esi + 6], ah
mov byte [esi + 7], al
mov eax, dword [esp + 0x44]
mov dword [eax], edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6a9180
Capabilities:
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
push 0x1048
push 0xad1040
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
cmp esi, 0x48
mov eax, 0x48
cmovl eax, esi
add eax, edi
xor ecx, ecx
mov edx, edi
jmp 0x6a91eb
movzx edx, byte [edx]
movzx ebx, byte [ebx]
shl edx, 0x10
shl ebx, 8
or ebx, edx
movzx edx, byte [ebp]
or edx, ebx
shl edx, 8
movzx edi, byte [edi]
or edi, edx
mov ebx, dword [esp + 0x1c]
xor dword [ebx + ecx*4], edi
inc ecx
mov edx, esi
cmp ecx, 0x12
je 0x6a9237
lea ebx, [edx + 1]
cmp ebx, eax
jae 0x6a9210
lea ebp, [ebx + 1]
cmp ebp, eax
jae 0x6a921b
lea edi, [ebp + 1]
cmp edi, eax
jae 0x6a9226
lea esi, [edi + 1]
cmp esi, eax
jb 0x6a91c0
jmp 0x6a9231
mov ebx, dword [esp + 0x24]
lea ebp, [ebx + 1]
cmp ebp, eax
jb 0x6a91f9
mov ebp, dword [esp + 0x24]
lea edi, [ebp + 1]
cmp edi, eax
jb 0x6a9200
mov edi, dword [esp + 0x24]
lea esi, [edi + 1]
cmp esi, eax
jb 0x6a91c0
mov esi, dword [esp + 0x24]
jmp 0x6a91c0
mov dword [esp], 0
mov dword [esp + 4], 0
mov edi, esp
push ebx
push edi
call fcn.006a8480
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx], xmm0
push ebx
push edi
call fcn.006a8480
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 8], xmm0
push ebx
push edi
call fcn.006a8480
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x10], xmm0
push ebx
push edi
call fcn.006a8480
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x18], xmm0
push ebx
push edi
call fcn.006a8480
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x20], xmm0
push ebx
push edi
call fcn.006a8480
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x28], xmm0
push ebx
push edi
call fcn.006a8480
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x30], xmm0
push ebx
push edi
call fcn.006a8480
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x38], xmm0
push ebx
push edi
call fcn.006a8480
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x40], xmm0
mov esi, 0xfffffffe
push ebx
push edi
call fcn.006a8480
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + esi*4 + 0x50], xmm0
add esi, 2
cmp esi, 0x3fe
jb 0x6a9300
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b1df0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov edi, dword [eax]
movzx eax, byte [edx]
movzx ebp, byte [edx + 1]
movzx ecx, byte [edx + 2]
movzx esi, byte [edx + 3]
mov dword [esp + 0x18], esi
movzx esi, byte [edx + 4]
mov dword [esp + 0x14], esi
movzx ebx, byte [edx + 5]
movzx esi, byte [edx + 6]
mov dword [esp + 0x10], esi
movzx edx, byte [edx + 7]
mov byte [esp], al
mov esi, eax
mov eax, ebp
mov byte [esp + 1], al
shl esi, 0x18
shl ebp, 0x10
or ebp, esi
mov byte [esp + 2], cl
shl ecx, 8
or ecx, ebp
mov eax, dword [esp + 0x18]
or ecx, eax
mov byte [esp + 3], al
mov eax, dword [esp + 0x14]
mov byte [esp + 4], al
mov esi, eax
mov byte [esp + 5], bl
shl esi, 0x18
shl ebx, 0x10
or ebx, esi
mov eax, dword [esp + 0x10]
mov byte [esp + 6], al
shl eax, 8
or eax, ebx
or eax, edx
mov byte [esp + 7], dl
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
cmp dword [esp + 0x38], 0
je 0x6b1f1f
xor ebp, ebp
xor ebx, ebx
jmp 0x6b1ebd
movzx edx, byte [esp + edi]
mov esi, dword [esp + 0x30]
xor dl, byte [esi + ebp]
mov esi, dword [esp + 0x34]
mov byte [esi + ebp], dl
inc edi
and edi, 7
inc ebp
cmp dword [esp + 0x38], ebp
je 0x6b1eec
test edi, edi
jne 0x6b1ea0
push dword [esp + 0x3c]
lea eax, [esp + 0xc]
push eax
call fcn.006b2c40
add esp, 8
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov edx, ecx
bswap edx
mov dword [esp], edx
mov edx, eax
bswap edx
mov dword [esp + 4], edx
inc ebx
jmp 0x6b1ea0
test ebx, ebx
je 0x6b1f1f
mov edx, ecx
shr edx, 0x18
mov esi, dword [esp + 0x40]
mov byte [esi], dl
mov edx, ecx
shr edx, 0x10
mov byte [esi + 1], dl
mov byte [esi + 2], ch
mov byte [esi + 3], cl
mov ecx, eax
shr ecx, 0x18
mov byte [esi + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 5], cl
mov byte [esi + 6], ah
mov byte [esi + 7], al
mov eax, dword [esp + 0x44]
mov dword [eax], edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b3570
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x6b364f
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x6b35e5
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.006b2c40
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6b35af
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x6b3706
call 0x6b35f7
pop edx
lea ecx, [edx + 0x149]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x6b36a7
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.006b30e0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6b365c
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x6b3706
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.006b30e0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x6b3704
jmp 0x6b3706
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6b92a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x6b9370
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x6b930e
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.006b8f00
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6b92e0
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x6b9417
call 0x6b9320
pop edx
lea ecx, [edx + 0x120]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x6b93c0
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.006b8f00
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6b937d
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x6b9417
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.006b8f00
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x6b9415
jmp 0x6b9417
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6b9480
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x6b9559
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x6b94f7
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.006b9040
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6b94c9
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x6b9600
call 0x6b9509
pop edx
lea ecx, [edx + 0x137]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x6b95a9
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.006b9170
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6b9566
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x6b9600
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.006b9170
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x6b95fe
jmp 0x6b9600
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6b9f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
mov edi, dword [eax]
movzx esi, byte [edx]
movzx eax, byte [edx + 1]
movzx ecx, byte [edx + 2]
mov dword [esp + 0x1c], ecx
movzx ebx, byte [edx + 3]
movzx ecx, byte [edx + 4]
mov dword [esp + 0x14], ecx
movzx ebp, byte [edx + 5]
movzx ecx, byte [edx + 6]
mov dword [esp + 0x18], ecx
movzx ecx, byte [edx + 7]
mov dword [esp + 0x10], ecx
mov ecx, esi
mov byte [esp], cl
mov byte [esp + 1], al
mov esi, eax
shl esi, 8
or esi, ecx
mov edx, dword [esp + 0x1c]
mov byte [esp + 2], dl
mov byte [esp + 3], bl
mov ecx, dword [esp + 0x14]
mov byte [esp + 4], cl
mov eax, ebp
mov byte [esp + 5], al
shl eax, 8
or eax, ecx
shl edx, 0x10
or edx, esi
mov ecx, ebx
shl ecx, 0x18
or ecx, edx
mov ebx, dword [esp + 0x18]
mov byte [esp + 6], bl
shl ebx, 0x10
or ebx, eax
mov eax, dword [esp + 0x10]
mov byte [esp + 7], al
shl eax, 0x18
or eax, ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
cmp dword [esp + 0x3c], 0
je 0x6ba057
xor ebp, ebp
xor ebx, ebx
jmp 0x6b9fcd
movzx edx, byte [esp + edi]
mov esi, dword [esp + 0x34]
xor dl, byte [esi + ebp]
mov esi, dword [esp + 0x38]
mov byte [esi + ebp], dl
inc edi
and edi, 7
inc ebp
cmp dword [esp + 0x3c], ebp
je 0x6ba028
test edi, edi
jne 0x6b9fb0
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x48]
lea eax, [esp + 0x14]
push eax
call fcn.006b9040
add esp, 0x10
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov byte [esp], cl
mov byte [esp + 1], ch
mov edx, ecx
shr edx, 0x10
mov byte [esp + 2], dl
mov edx, ecx
shr edx, 0x18
mov byte [esp + 3], dl
mov byte [esp + 4], al
mov byte [esp + 5], ah
mov edx, eax
shr edx, 0x10
mov byte [esp + 6], dl
mov edx, eax
shr edx, 0x18
mov byte [esp + 7], dl
inc ebx
jmp 0x6b9fb0
test ebx, ebx
je 0x6ba057
mov esi, dword [esp + 0x4c]
mov byte [esi], cl
mov byte [esi + 1], ch
mov edx, ecx
shr edx, 0x10
mov byte [esi + 2], dl
shr ecx, 0x18
mov byte [esi + 3], cl
mov byte [esi + 4], al
mov byte [esi + 5], ah
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 6], cl
shr eax, 0x18
mov byte [esi + 7], al
mov eax, dword [esp + 0x50]
mov dword [eax], edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6ba070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov edi, dword [eax]
movzx esi, byte [edx]
movzx eax, byte [edx + 1]
movzx ecx, byte [edx + 2]
mov dword [esp + 0x1c], ecx
movzx ebx, byte [edx + 3]
movzx ecx, byte [edx + 4]
mov dword [esp + 0x14], ecx
movzx ebp, byte [edx + 5]
movzx ecx, byte [edx + 6]
mov dword [esp + 0x18], ecx
movzx ecx, byte [edx + 7]
mov dword [esp + 0x10], ecx
mov ecx, esi
mov byte [esp], cl
mov byte [esp + 1], al
mov esi, eax
shl esi, 8
or esi, ecx
mov edx, dword [esp + 0x1c]
mov byte [esp + 2], dl
mov byte [esp + 3], bl
mov ecx, dword [esp + 0x14]
mov byte [esp + 4], cl
mov eax, ebp
mov byte [esp + 5], al
shl eax, 8
or eax, ecx
shl edx, 0x10
or edx, esi
mov ecx, ebx
shl ecx, 0x18
or ecx, edx
mov ebx, dword [esp + 0x18]
mov byte [esp + 6], bl
shl ebx, 0x10
or ebx, eax
mov eax, dword [esp + 0x10]
mov byte [esp + 7], al
shl eax, 0x18
or eax, ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
cmp dword [esp + 0x3c], 0
je 0x6ba195
xor ebp, ebp
xor ebx, ebx
jmp 0x6ba13d
movzx edx, byte [esp + edi]
mov esi, dword [esp + 0x34]
xor dl, byte [esi + ebp]
mov esi, dword [esp + 0x38]
mov byte [esi + ebp], dl
inc edi
and edi, 7
inc ebp
cmp dword [esp + 0x3c], ebp
je 0x6ba166
test edi, edi
jne 0x6ba120
push 1
push dword [esp + 0x44]
lea eax, [esp + 0x10]
push eax
call fcn.006b8f00
add esp, 0xc
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esp], ecx
mov dword [esp + 4], eax
inc ebx
jmp 0x6ba120
test ebx, ebx
je 0x6ba195
mov esi, dword [esp + 0x44]
mov byte [esi], cl
mov byte [esi + 1], ch
mov edx, ecx
shr edx, 0x10
mov byte [esi + 2], dl
shr ecx, 0x18
mov byte [esi + 3], cl
mov byte [esi + 4], al
mov byte [esi + 5], ah
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 6], cl
shr eax, 0x18
mov byte [esi + 7], al
mov eax, dword [esp + 0x48]
mov dword [eax], edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6cad50
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x178
push dword [esp + 0x198]
push str.SHA512
push dword [esp + 0x194]
call fcn.005b9720
add esp, 0xc
test eax, eax
je 0x6cae3c
mov ebx, esp
push 0
push eax
push 0
push ebx
push 0x20
push dword [esp + 0x1a8]
mov edi, eax
call fcn.005b95c0
add esp, 0x18
mov esi, eax
push edi
call fcn.005b81d0
add esp, 4
test esi, esi
je 0x6cae40
and byte [esp], 0xf8
movzx eax, byte [esp + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [esp + 0x1f], al
lea ebp, [esp + 0xd8]
mov edx, esp
mov ecx, ebp
call fcn.006c4c80
lea edx, [esp + 0x128]
mov esi, ebx
lea ebx, [esp + 0xb0]
mov ecx, ebx
call fcn.006cbdd0
lea edi, [esp + 0x88]
mov ecx, edi
mov edx, ebp
push ebx
call fcn.006cc420
add esp, 4
lea edx, [esp + 0x100]
lea ebp, [esp + 0x60]
mov ecx, ebp
push ebx
mov ebx, esi
call fcn.006cc420
add esp, 4
mov esi, dword [esp + 0x190]
mov ecx, esi
mov edx, ebp
call fcn.006cd3e0
lea ecx, [esp + 0x40]
mov edx, edi
call fcn.006cd3e0
movzx eax, byte [esp + 0x40]
shl al, 7
xor byte [esi + 0x1f], al
mov esi, 1
jmp 0x6cae42
xor esi, esi
jmp 0x6cae4d
xor esi, esi
push 0x40
push ebx
call fcn.005e7ed0
add esp, 8
mov eax, esi
add esp, 0x178
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6cbbb0
Capabilities:
Encrypt data using curve25519
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x174
mov eax, dword [esp + 0x18c]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movups xmmword [esp + 0x8c], xmm0
movups xmmword [esp + 0x9c], xmm1
and byte [esp + 0x8c], 0xf8
movzx eax, byte [esp + 0xab]
and al, 0x3f
or al, 0x40
mov byte [esp + 0xab], al
lea ecx, [esp + 0xac]
lea edx, [esp + 0x8c]
call fcn.006c4c80
mov edx, dword [esp + 0xfc]
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0xd8]
mov dword [esp + 0x34], ecx
add eax, edx
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x30], eax
lea eax, [ecx + eax]
mov dword [esp + 0x68], eax
mov ecx, dword [esp + 0x104]
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0xdc]
mov dword [esp + 0x28], eax
lea eax, [eax + ecx]
mov dword [esp + 0x6c], eax
mov ecx, dword [esp + 0x108]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0xe0]
mov dword [esp + 0x20], eax
lea eax, [eax + ecx]
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0x10c]
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xe4]
mov dword [esp + 0x18], eax
lea eax, [eax + ecx]
mov dword [esp + 0x74], eax
mov ebx, dword [esp + 0x110]
mov eax, dword [esp + 0xe8]
mov dword [esp + 0x14], eax
lea eax, [eax + ebx]
mov dword [esp + 0x78], eax
mov edi, dword [esp + 0x114]
mov eax, dword [esp + 0xec]
mov dword [esp + 0x10], eax
lea eax, [eax + edi]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0xf0]
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x118]
lea eax, [eax + edx]
mov dword [esp + 0x80], eax
mov esi, dword [esp + 0x11c]
mov eax, dword [esp + 0xf4]
mov dword [esp + 4], eax
add eax, esi
mov dword [esp + 0x84], eax
mov ecx, dword [esp + 0x120]
mov eax, dword [esp + 0xf8]
mov dword [esp], eax
lea ebp, [eax + ecx]
mov dword [esp + 0x88], ebp
mov ebp, dword [esp + 0x2c]
sub ebp, dword [esp + 0x38]
mov dword [esp + 0x3c], ebp
mov ebp, dword [esp + 0x30]
sub ebp, dword [esp + 0x34]
mov dword [esp + 0x40], ebp
mov ebp, dword [esp + 0x24]
sub ebp, dword [esp + 0x28]
mov dword [esp + 0x44], ebp
mov ebp, dword [esp + 0x1c]
sub ebp, dword [esp + 0x20]
mov dword [esp + 0x48], ebp
mov eax, dword [esp + 8]
sub eax, dword [esp + 0x18]
mov dword [esp + 0x4c], eax
sub ebx, dword [esp + 0x14]
mov dword [esp + 0x50], ebx
sub edi, dword [esp + 0x10]
mov dword [esp + 0x54], edi
sub edx, dword [esp + 0xc]
mov dword [esp + 0x58], edx
sub esi, dword [esp + 4]
mov dword [esp + 0x5c], esi
sub ecx, dword [esp]
mov dword [esp + 0x60], ecx
lea ebx, [esp + 0x14c]
lea edx, [esp + 0x3c]
mov ecx, ebx
call fcn.006cbdd0
lea ebp, [esp + 0x64]
mov ecx, ebp
mov edx, ebp
push ebx
call fcn.006cc420
add esp, 4
mov ecx, dword [esp + 0x188]
mov edx, ebp
call fcn.006cd3e0
push 0x20
lea eax, [esp + 0x90]
push eax
call fcn.005e7ed0
add esp, 0x17c
pop esi
pop edi
pop ebx
pop ebp
ret