joyce8/EMBER2024-capa huggingface dataset:
Function at 0x71595b
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff70
xor eax, eax
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], eax
test esi, esi
je 0x715984
mov dword [ebp - 8], 1
mov dword [ebx], esi
jmp 0x715986
mov esi, dword [ebx]
cmp dword [ebp + 0xc], 0
je 0x715a51
mov dword [ebp - 8], 1
push esi
call fcn.00749a37
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x80
jle 0x7159be
push 0x5d1a59
push 0x54
push 0x5d1a44
call fcn.0070b023
add esp, 0xc
cmp edi, dword [ebp - 4]
jle 0x7159fb
mov eax, dword [ebp + 0x18]
lea edx, [ebx + 4]
push eax
push esi
push edx
call fcn.0074680f
add esp, 0xc
push edi
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebx + 4]
push ecx
call fcn.007468d3
add esp, 0xc
lea eax, [ebx + 0x34]
lea edx, [ebx + 0x38]
lea ecx, [ebx + 4]
push eax
push edx
push ecx
call fcn.00746917
add esp, 0xc
jmp 0x715a2f
test edi, edi
jl 0x715a07
cmp edi, 0x80
jle 0x715a1b
push 0x5d1a89
push 0x5e
push 0x5d1a74
call fcn.0070b023
add esp, 0xc
push edi
mov eax, dword [ebp + 0xc]
push eax
lea edx, [ebx + 0x38]
push edx
call fcn.008423f7
add esp, 0xc
mov dword [ebx + 0x34], edi
mov eax, dword [ebx + 0x34]
cmp eax, 0x80
je 0x715a51
mov edx, 0x80
sub edx, eax
add eax, ebx
push edx
add eax, 0x38
push 0
push eax
call fcn.00842467
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x715af5
xor eax, eax
lea edx, [ebp - 0x90]
mov dword [ebp - 0xc], edx
lea edx, [ebx + 0x38]
mov edi, dword [ebp - 0xc]
mov cl, byte [edx]
xor cl, 0x36
inc edx
mov byte [edi], cl
inc eax
inc dword [ebp - 0xc]
cmp eax, 0x80
jl 0x715a69
mov eax, dword [ebp + 0x18]
lea edi, [ebx + 0x14]
push eax
push esi
push edi
call fcn.0074680f
add esp, 0xc
push esi
call fcn.00749a37
pop ecx
push eax
lea eax, [ebp - 0x90]
push eax
push edi
call fcn.007468d3
lea edx, [ebp - 0x90]
add esp, 0xc
mov dword [ebp - 0x10], edx
lea edx, [ebx + 0x38]
xor eax, eax
mov edi, dword [ebp - 0x10]
mov cl, byte [edx]
xor cl, 0x5c
inc edx
mov byte [edi], cl
inc eax
inc dword [ebp - 0x10]
cmp eax, 0x80
jl 0x715ab6
mov eax, dword [ebp + 0x18]
lea edi, [ebx + 0x24]
push eax
push esi
push edi
call fcn.0074680f
add esp, 0xc
push esi
call fcn.00749a37
pop ecx
push eax
lea eax, [ebp - 0x90]
push eax
push edi
call fcn.007468d3
add esp, 0xc
lea edx, [ebx + 0x14]
push edx
add ebx, 4
push ebx
call fcn.007469ab
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7173a7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
xor ecx, ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 0x24]
xor ebx, ebx
mov esi, dword [eax]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 0x20]
xor edx, edx
mov dl, byte [eax]
inc eax
mov cl, byte [eax]
inc eax
shl ecx, 8
movzx edi, byte [eax]
inc eax
or edx, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl edi, 0x10
shl ecx, 0x18
or edx, edi
or edx, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
mov bl, byte [eax]
inc eax
shl ebx, 8
or ecx, ebx
xor ebx, ebx
mov bl, byte [eax]
inc eax
shl ebx, 0x10
movzx eax, byte [eax]
shl eax, 0x18
or ecx, ebx
or ecx, eax
lea eax, [ebp - 0xc]
mov ebx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
and bl, 0xff
mov byte [eax], bl
mov ebx, edx
inc eax
shr ebx, 8
and bl, 0xff
mov byte [eax], bl
mov ebx, edx
inc eax
shr ebx, 0x10
and bl, 0xff
mov byte [eax], bl
mov ebx, edx
inc eax
shr ebx, 0x18
and bl, 0xff
mov byte [eax], bl
inc eax
mov ebx, ecx
and bl, 0xff
mov byte [eax], bl
mov ebx, ecx
inc eax
shr ebx, 8
and bl, 0xff
mov byte [eax], bl
mov ebx, ecx
inc eax
shr ebx, 0x10
and bl, 0xff
mov byte [eax], bl
mov ebx, ecx
inc eax
shr ebx, 0x18
and bl, 0xff
mov byte [eax], bl
jmp 0x7174f6
test esi, esi
jne 0x7174de
mov eax, dword [ebp + 0x1c]
push eax
mov edx, dword [ebp + 0x18]
push edx
mov ecx, dword [ebp + 0x14]
push ecx
lea edi, [ebp - 0x14]
push edi
call fcn.007194a5
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ebx, edx
mov ecx, dword [ebp - 0x10]
and bl, 0xff
add esp, 0x10
mov byte [eax], bl
mov ebx, edx
inc eax
shr ebx, 8
and bl, 0xff
mov byte [eax], bl
mov ebx, edx
inc eax
shr ebx, 0x10
and bl, 0xff
mov byte [eax], bl
mov ebx, edx
inc eax
shr ebx, 0x18
and bl, 0xff
mov byte [eax], bl
inc eax
mov ebx, ecx
and bl, 0xff
mov byte [eax], bl
mov ebx, ecx
inc eax
shr ebx, 8
and bl, 0xff
mov byte [eax], bl
mov ebx, ecx
inc eax
shr ebx, 0x10
and bl, 0xff
mov byte [eax], bl
mov ebx, ecx
inc eax
shr ebx, 0x18
and bl, 0xff
mov byte [eax], bl
inc dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov al, byte [eax]
xor al, byte [ebp + esi - 0xc]
inc esi
mov byte [ebx], al
inc dword [ebp + 8]
inc dword [ebp + 0xc]
and esi, 7
mov eax, dword [ebp - 4]
add dword [ebp - 4], 0xffffffff
test eax, eax
jne 0x717465
cmp dword [ebp - 0x18], 0
je 0x71755b
mov eax, dword [ebp + 0x20]
mov ebx, edx
and bl, 0xff
mov byte [eax], bl
inc eax
mov ebx, edx
shr ebx, 8
and bl, 0xff
mov byte [eax], bl
inc eax
mov ebx, edx
shr ebx, 0x10
and bl, 0xff
mov byte [eax], bl
inc eax
shr edx, 0x18
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, ecx
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, ecx
shr edx, 8
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, ecx
shr edx, 0x10
and dl, 0xff
mov byte [eax], dl
inc eax
shr ecx, 0x18
and cl, 0xff
mov byte [eax], cl
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov ecx, eax
mov edx, dword [ebp + 0x24]
mov dword [edx], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x717573
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
xor ecx, ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
mov ebx, dword [eax]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 0x18]
xor edx, edx
mov dl, byte [eax]
inc eax
mov cl, byte [eax]
inc eax
shl ecx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl ecx, 0x10
or edx, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl ecx, 0x18
movzx edi, byte [eax]
inc eax
or edx, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl ecx, 8
or edi, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl ecx, 0x10
movzx eax, byte [eax]
shl eax, 0x18
or edi, ecx
or edi, eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], edx
mov ecx, edx
and cl, 0xff
mov dword [ebp - 0x10], edi
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
mov ecx, edi
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, edi
and dl, 0xff
mov byte [eax], dl
mov edx, edi
inc eax
shr edx, 8
and dl, 0xff
mov byte [eax], dl
inc eax
shr ecx, 0x10
mov edx, edi
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
and dl, 0xff
mov byte [eax], dl
jmp 0x7176b4
test ebx, ebx
jne 0x7176a1
push 1
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.0071773b
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, edx
add esp, 0xc
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, dword [ebp - 0x10]
mov ecx, edx
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
and dl, 0xff
mov byte [eax], dl
inc dword [ebp - 0x18]
mov al, byte [esi]
mov edx, dword [ebp + 0xc]
xor al, byte [ebp + ebx - 0xc]
inc esi
mov byte [edx], al
inc ebx
inc dword [ebp + 0xc]
and ebx, 7
mov eax, dword [ebp - 4]
add dword [ebp - 4], 0xffffffff
test eax, eax
jne 0x717632
cmp dword [ebp - 0x18], 0
je 0x717721
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x18]
mov ecx, edx
mov edi, dword [ebp - 0x10]
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
mov ecx, edi
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, edi
and dl, 0xff
mov byte [eax], dl
mov edx, edi
inc eax
shr edx, 8
and dl, 0xff
mov byte [eax], dl
inc eax
shr ecx, 0x10
mov edx, edi
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
and dl, 0xff
mov byte [eax], dl
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov edi, eax
mov edx, eax
mov edx, dword [ebp + 0x1c]
mov dword [edx], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7196f9
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x7197e6
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x71977e
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.0071773b
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x719743
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x7198ae
call fcn.00719793
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x71984a
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.0071773b
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x7197fa
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x7198ae
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.0071773b
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x7198a9
jmp 0x7198ae
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x71993b
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x719a31
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x7199c9
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.007194a5
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x71998e
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x719af9
call fcn.007199de
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x719a95
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.007195cf
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x719a45
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x719af9
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.007195cf
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x719af4
jmp 0x719af9
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x719c57
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, dword [ebp + 8]
mov byte [ebx], 0
cmp dword [ebp + 0xc], 0x80
jle 0x719c75
mov dword [ebp + 0xc], 0x80
cmp dword [ebp + 0x14], 0
jg 0x719c82
mov dword [ebp + 0x14], 0x400
cmp dword [ebp + 0x14], 0x400
jle 0x719c92
mov dword [ebp + 0x14], 0x400
xor eax, eax
mov esi, ebx
mov edx, dword [ebp + 0x10]
cmp eax, dword [ebp + 0xc]
jge 0x719caa
mov cl, byte [edx]
mov byte [esi], cl
inc eax
inc esi
inc edx
cmp eax, dword [ebp + 0xc]
jl 0x719c9e
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ebx + eax - 1]
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebx + eax]
mov dword [ebp - 8], ecx
mov esi, ebx
cmp eax, 0x80
jge 0x719cf1
xor ecx, ecx
mov cl, byte [esi]
add edx, ecx
mov ecx, dword [ebp - 8]
and edx, 0xff
movzx edx, byte [edx + 0x5d2c70]
mov byte [ecx], dl
inc dword [ebp - 8]
inc eax
inc esi
inc dword [ebp - 4]
cmp eax, 0x80
jl 0x719cca
mov eax, dword [ebp + 0x14]
mov edx, 0xff
add eax, 7
sar eax, 3
mov dword [ebp - 4], eax
mov eax, 0x80
mov ecx, dword [ebp + 0x14]
sub eax, dword [ebp - 4]
neg ecx
and ecx, 7
sar edx, cl
xor ecx, ecx
mov cl, byte [ebx + eax]
and edx, ecx
lea ecx, [ebx + eax]
movzx edx, byte [edx + 0x5d2c70]
mov byte [ebx + eax], dl
mov dword [ebp - 0xc], ecx
lea ecx, [ebx + eax]
mov esi, dword [ebp - 4]
lea esi, [ecx + esi]
jmp 0x719d48
xor ecx, ecx
mov cl, byte [esi]
xor edx, ecx
mov ecx, dword [ebp - 0xc]
movzx edx, byte [edx + 0x5d2c70]
mov byte [ecx], dl
dec esi
dec dword [ebp - 0xc]
mov ecx, eax
add eax, 0xffffffff
test ecx, ecx
jne 0x719d36
mov ecx, dword [ebp + 8]
mov eax, 0x7f
add ecx, 0xfc
lea edx, [ebx + 0x7f]
movzx esi, byte [edx - 1]
xor ebx, ebx
sub eax, 2
mov bl, byte [edx]
add edx, 0xfffffffe
shl ebx, 8
or ebx, esi
and ebx, 0xffff
mov dword [ecx], ebx
sub ecx, 4
test eax, eax
jge 0x719d66
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x71a8ab
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
xor ecx, ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
mov ebx, dword [eax]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 0x18]
xor edx, edx
mov dl, byte [eax]
inc eax
mov cl, byte [eax]
inc eax
shl ecx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl ecx, 0x10
or edx, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl ecx, 0x18
movzx edi, byte [eax]
inc eax
or edx, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl ecx, 8
or edi, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl ecx, 0x10
movzx eax, byte [eax]
shl eax, 0x18
or edi, ecx
or edi, eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], edx
mov ecx, edx
and cl, 0xff
mov dword [ebp - 0x10], edi
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
mov ecx, edi
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, edi
and dl, 0xff
mov byte [eax], dl
mov edx, edi
inc eax
shr edx, 8
and dl, 0xff
mov byte [eax], dl
inc eax
shr ecx, 0x10
mov edx, edi
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
and dl, 0xff
mov byte [eax], dl
jmp 0x71a9ea
test ebx, ebx
jne 0x71a9d7
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.0071a343
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, edx
add esp, 8
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, dword [ebp - 0x10]
mov ecx, edx
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
and dl, 0xff
mov byte [eax], dl
inc dword [ebp - 0x18]
mov al, byte [esi]
mov edx, dword [ebp + 0xc]
xor al, byte [ebp + ebx - 0xc]
inc esi
mov byte [edx], al
inc ebx
inc dword [ebp + 0xc]
and ebx, 7
mov eax, dword [ebp - 4]
add dword [ebp - 4], 0xffffffff
test eax, eax
jne 0x71a96a
cmp dword [ebp - 0x18], 0
je 0x71aa57
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x18]
mov ecx, edx
mov edi, dword [ebp - 0x10]
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
mov ecx, edi
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, edi
and dl, 0xff
mov byte [eax], dl
mov edx, edi
inc eax
shr edx, 8
and dl, 0xff
mov byte [eax], dl
inc eax
shr ecx, 0x10
mov edx, edi
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
and dl, 0xff
mov byte [eax], dl
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov edi, eax
mov edx, eax
mov edx, dword [ebp + 0x1c]
mov dword [edx], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x71c013
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
xor ecx, ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
mov ebx, dword [eax]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 0x18]
xor edx, edx
mov dl, byte [eax]
inc eax
shl edx, 0x18
mov cl, byte [eax]
shl ecx, 0x10
inc eax
or edx, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl ecx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
or edx, ecx
xor ecx, ecx
movzx edi, byte [eax]
inc eax
shl edi, 0x18
mov cl, byte [eax]
shl ecx, 0x10
inc eax
or edi, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl ecx, 8
movzx eax, byte [eax]
or edi, ecx
mov ecx, edx
or edi, eax
lea eax, [ebp - 0xc]
shr ecx, 0x18
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edi
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
and dl, 0xff
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
inc eax
mov ecx, edi
shr ecx, 8
mov byte [eax], dl
mov edx, edi
inc eax
shr edx, 0x18
and cl, 0xff
and dl, 0xff
mov byte [eax], dl
mov edx, edi
inc eax
shr edx, 0x10
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, edi
mov byte [eax], cl
inc eax
and dl, 0xff
mov byte [eax], dl
jmp 0x71c152
test ebx, ebx
jne 0x71c13f
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.0071b4c3
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, edx
add esp, 8
shr ecx, 0x18
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
and dl, 0xff
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
inc eax
mov byte [eax], dl
inc eax
mov edx, dword [ebp - 0x10]
mov ecx, edx
shr ecx, 0x18
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
and dl, 0xff
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
inc eax
mov byte [eax], dl
inc dword [ebp - 0x18]
mov al, byte [esi]
mov edx, dword [ebp + 0xc]
xor al, byte [ebp + ebx - 0xc]
inc esi
mov byte [edx], al
inc ebx
inc dword [ebp + 0xc]
and ebx, 7
mov eax, dword [ebp - 4]
add dword [ebp - 4], 0xffffffff
test eax, eax
jne 0x71c0d2
cmp dword [ebp - 0x18], 0
je 0x71c1bf
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x18]
mov ecx, edx
mov edi, dword [ebp - 0x10]
shr ecx, 0x18
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
and dl, 0xff
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
inc eax
mov ecx, edi
shr ecx, 8
mov byte [eax], dl
mov edx, edi
inc eax
shr edx, 0x18
and cl, 0xff
and dl, 0xff
mov byte [eax], dl
mov edx, edi
inc eax
shr edx, 0x10
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, edi
mov byte [eax], cl
inc eax
and dl, 0xff
mov byte [eax], dl
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov edi, eax
mov edx, eax
mov edx, dword [ebp + 0x1c]
mov dword [edx], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x71c60f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0x10], 0
jle 0x71c742
cmp dword [ebp + 0x10], 0x80
jg 0x71c742
push 0x10
mov eax, dword [ebp + 0x18]
push eax
lea edx, [ebp - 0x30]
push edx
call fcn.008423f7
add esp, 0xc
mov ecx, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 0x18]
push ecx
mov eax, dword [ebp + 0x18]
push eax
call fcn.0071cf27
add esp, 0xc
mov edx, dword [ebp + 0x10]
add edx, 7
test edx, edx
jns 0x71c668
add edx, 7
sar edx, 3
mov dword [ebp - 4], edx
cmp dword [ebp + 0x1c], 0
je 0x71c6a3
xor eax, eax
mov edx, esi
mov dword [ebp - 8], edx
lea esi, [ebp - 0x20]
mov edx, dword [ebp + 0x18]
mov ecx, edx
mov edx, ebx
cmp eax, dword [ebp - 4]
jge 0x71c6d0
mov bl, byte [edx]
inc edx
xor bl, byte [ecx]
inc ecx
mov byte [esi], bl
inc esi
mov edi, dword [ebp - 8]
inc eax
mov byte [edi], bl
inc dword [ebp - 8]
cmp eax, dword [ebp - 4]
jl 0x71c68a
jmp 0x71c6d0
mov edx, esi
xor eax, eax
mov dword [ebp - 0xc], edx
mov edx, ebx
mov ecx, dword [ebp + 0x18]
cmp eax, dword [ebp - 4]
mov esi, ecx
lea ecx, [ebp - 0x20]
jge 0x71c6d0
mov bl, byte [edx]
inc edx
mov byte [ecx], bl
inc ecx
mov edi, dword [ebp - 0xc]
inc eax
xor bl, byte [esi]
inc esi
mov byte [edi], bl
inc dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jl 0x71c6b9
mov esi, dword [ebp + 0x10]
and esi, 0x80000007
jns 0x71c6e0
dec esi
or esi, 0xfffffff8
inc esi
mov eax, dword [ebp + 0x10]
test eax, eax
jns 0x71c6ea
add eax, 7
sar eax, 3
test esi, esi
mov dword [ebp - 4], eax
jne 0x71c70b
push 0x10
lea edx, [ebp - 0x30]
add edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.008423f7
add esp, 0xc
jmp 0x71c742
xor eax, eax
mov edx, dword [ebp + 0x18]
mov ecx, edx
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
lea edx, [ebp + edx - 0x30]
mov ecx, esi
mov bl, byte [edx]
shl bl, cl
mov ecx, 8
sub ecx, esi
movzx edi, byte [edx + 1]
sar edi, cl
mov ecx, edi
or bl, cl
mov ecx, dword [ebp - 0x10]
mov byte [ecx], bl
inc eax
inc dword [ebp - 0x10]
inc edx
cmp eax, 0x10
jl 0x71c71c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret