joyce8/EMBER2024-capa huggingface dataset:
Function at 0x542440
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x54251f
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x5424b5
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00541c00
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x54247f
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x5425d6
call 0x5424c7
pop edx
lea ecx, [edx + 0x139]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x542577
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00542020
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x54252c
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x5425d6
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00542020
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x5425d4
jmp 0x5425d6
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x543410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
mov eax, dword [eax]
mov dword [esp + 0x14], eax
xor ecx, ecx
mov cl, byte [edx]
shl ecx, 0x18
xor eax, eax
mov al, byte [edx + 1]
shl eax, 0x10
or ecx, eax
xor eax, eax
mov al, byte [edx + 3]
or ecx, eax
xor eax, eax
mov al, byte [edx + 2]
shl eax, 8
or ecx, eax
xor eax, eax
mov al, byte [edx + 4]
shl eax, 0x18
mov bl, byte [edx + 5]
and ebx, 0xff
mov ebp, ebx
shl ebp, 0x10
or eax, ebp
mov bl, byte [edx + 7]
and ebx, 0xff
or eax, ebx
mov bl, byte [edx + 6]
and ebx, 0xff
mov ebp, ebx
shl ebp, 8
or eax, ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
mov ebp, ecx
shr ebp, 0x18
mov ebx, ebp
mov byte [esp + 0x28], bl
mov ebp, ecx
shr ebp, 0x10
mov ebx, ebp
mov byte [esp + 0x29], bl
mov ebp, ecx
shr ebp, 8
mov ebx, ebp
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], cl
mov ecx, eax
shr ecx, 0x18
mov byte [esp + 0x2c], cl
mov ecx, eax
shr ecx, 0x10
mov byte [esp + 0x2d], cl
mov ecx, eax
shr ecx, 8
mov byte [esp + 0x2e], cl
mov byte [esp + 0x2f], al
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x5435c3
mov ebp, dword [esp + 0x58]
mov dword [esp + 0x18], 0
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x1c], edx
jmp 0x543501
mov dl, byte [esp + ebx + 0x28]
xor dl, byte [esi]
mov byte [edi], dl
inc edi
inc esi
inc ebx
and ebx, 7
dec ebp
je 0x543570
test ebx, ebx
jne 0x5434f0
mov eax, dword [esp + 0x5c]
mov dword [esp + 4], eax
lea edx, [esp + 0x20]
mov dword [esp], edx
call fcn.005437f0
mov edx, dword [esp + 0x20]
mov ecx, edx
shr ecx, 0x18
mov byte [esp + 0x28], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esp + 0x29], cl
mov ecx, edx
shr ecx, 8
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2b], dl
mov edx, dword [esp + 0x24]
mov ecx, edx
shr ecx, 0x18
mov byte [esp + 0x2c], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esp + 0x2d], cl
mov ecx, edx
shr ecx, 8
mov byte [esp + 0x2e], cl
mov byte [esp + 0x2f], dl
inc dword [esp + 0x18]
jmp 0x5434f0
mov dword [esp + 0x14], ebx
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x5435c3
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov esi, ecx
shr esi, 0x18
mov ebx, esi
mov byte [edx], bl
mov esi, ecx
shr esi, 0x10
mov ebx, esi
mov byte [edx + 1], bl
mov esi, ecx
shr esi, 8
mov ebx, esi
mov byte [edx + 2], bl
mov byte [edx + 3], cl
mov ecx, eax
shr ecx, 0x18
mov byte [edx + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [edx + 5], cl
mov ecx, eax
shr ecx, 8
mov byte [edx + 6], cl
mov byte [edx + 7], al
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
mov dword [eax], edx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x558590
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
test edi, edi
je 0x558621
test ebx, ebx
je 0x558640
test esi, esi
je 0x558630
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], esi
lea ebp, [esp + 0x14]
mov dword [esp + 4], ebp
mov eax, dword [ebx + 8]
mov dword [esp], eax
call fcn.004ce5e0
test eax, eax
je 0x5585f0
mov eax, dword [eax + 8]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, 0x610988
mov ecx, 4
repe cmpsb byte [esi], byte es:[edi]
je 0x558650
mov dword [esp + 0x14], str.default
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 8]
mov dword [esp], eax
call fcn.004ce5e0
test eax, eax
jne 0x5585d6
xor eax, eax
jmp 0x5585d9
lea ebp, [esp + 0x14]
jmp 0x5585fe
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
jmp 0x5585d9
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x5585d9
jmp 0x5585fe
Function at 0x55b830
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xcc
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], ecx
test ecx, ecx
je 0x55ba0d
mov ebx, eax
mov esi, edx
mov al, byte [eax + 0xc]
mov byte [esp + 0x1f], al
mov dl, byte [ebx + 0x14]
mov byte [esp + 0x18], dl
lea ecx, [ebx + 0xc]
mov dword [esp + 0x20], ecx
lea edi, [esp + 0x40]
lea eax, [ebx + 0x14]
mov dword [esp + 0x24], eax
nop
xor ecx, ecx
mov cl, byte [esi]
xor edx, edx
mov dl, byte [esi + 1]
shl edx, 8
xor eax, eax
mov al, byte [esi + 2]
shl eax, 0x10
or edx, eax
or edx, ecx
xor eax, eax
mov al, byte [esi + 3]
shl eax, 0x18
or edx, eax
mov dword [esp + 0x38], edx
mov dword [esp + 0x30], edx
xor ecx, ecx
mov cl, byte [esi + 4]
mov al, byte [esi + 5]
and eax, 0xff
mov ebp, eax
shl ebp, 8
xor eax, eax
mov al, byte [esi + 6]
shl eax, 0x10
or ebp, eax
or ebp, ecx
xor eax, eax
mov al, byte [esi + 7]
shl eax, 0x18
or ebp, eax
add esi, 8
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x34], ebp
mov al, byte [esp + 0x1f]
and eax, 0xffffff9f
or eax, 0x40
mov byte [ebx + 0xc], al
mov al, byte [esp + 0x18]
and eax, 0xffffff9f
or eax, 0x20
mov byte [ebx + 0x14], al
mov ecx, dword [esp + 0x20]
mov dword [esp], ecx
mov dword [esp + 0x14], edx
call fcn.0052e6c0
mov dword [esp + 4], edi
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.0052e9f0
mov dword [esp + 8], 1
mov dword [esp + 4], edi
lea ecx, [esp + 0x30]
mov dword [esp], ecx
call fcn.005311c0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.0052e6c0
mov dword [esp + 4], edi
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
call fcn.0052e9f0
mov dword [esp + 8], 1
mov dword [esp + 4], edi
lea eax, [esp + 0x38]
mov dword [esp], eax
call fcn.005311c0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x38]
xor eax, edx
mov ecx, dword [esp + 0x3c]
xor ecx, ebp
mov dword [esp + 0x18], ecx
xor edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
xor ecx, ebp
mov dword [esp + 0x10], ecx
mov byte [esp + 0x1f], dl
mov byte [ebx + 0xc], dl
mov ebp, edx
shr ebp, 8
mov ecx, ebp
mov byte [ebx + 0xd], cl
mov ebp, edx
shr ebp, 0x10
mov ecx, ebp
mov byte [ebx + 0xe], cl
shr edx, 0x18
mov byte [ebx + 0xf], dl
mov dl, byte [esp + 0x18]
mov byte [ebx + 0x10], dl
mov edx, dword [esp + 0x18]
shr edx, 8
mov byte [ebx + 0x11], dl
mov edx, dword [esp + 0x18]
shr edx, 0x10
mov byte [ebx + 0x12], dl
mov edx, dword [esp + 0x18]
shr edx, 0x18
mov byte [ebx + 0x13], dl
mov byte [esp + 0x18], al
mov byte [ebx + 0x14], al
mov edx, eax
shr edx, 8
mov byte [ebx + 0x15], dl
mov edx, eax
shr edx, 0x10
mov byte [ebx + 0x16], dl
shr eax, 0x18
mov byte [ebx + 0x17], al
mov cl, byte [esp + 0x10]
mov byte [ebx + 0x18], cl
mov eax, dword [esp + 0x10]
shr eax, 8
mov byte [ebx + 0x19], al
mov eax, dword [esp + 0x10]
shr eax, 0x10
mov byte [ebx + 0x1a], al
mov ecx, dword [esp + 0x10]
shr ecx, 0x18
mov byte [ebx + 0x1b], cl
mov eax, esi
sub eax, dword [esp + 0x2c]
cmp dword [esp + 0x28], eax
ja 0x55b870
add esp, 0xcc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x55f3a0
Capabilities:
Check for software breakpoints

Disassembly:
push edi
push esi
sub esp, 0x24
mov esi, dword [esp + 0x38]
mov eax, dword [esp + 0x40]
cmp eax, dword [esp + 0x3c]
jne 0x55f4b0
mov dl, byte [esi]
lea ecx, [edx - 0x6a]
cmp cl, 1
ja 0x55f4b0
cmp dl, 0x6b
je 0x55f460
inc esi
sub eax, 2
cmp byte [esi + eax], 0xcc
jne 0x55f530
mov edx, eax
mov edi, dword [esp + 0x30]
cmp eax, 4
jae 0x55f430
xor ecx, ecx
test dl, 2
jne 0x55f410
and edx, 1
jne 0x55f400
add esp, 0x24
pop esi
pop edi
ret
mov dl, byte [esi + ecx]
mov byte [edi + ecx], dl
add esp, 0x24
pop esi
pop edi
ret
mov cx, word [esi]
mov word [edi], cx
mov ecx, 2
and edx, 1
je 0x55f3f3
jmp 0x55f400
test edi, 1
jne 0x55f590
test edi, 2
jne 0x55f570
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
test dl, 2
je 0x55f3ee
jmp 0x55f410
sub eax, 3
test eax, eax
jle 0x55f49c
mov dl, byte [esi + 1]
add esi, 2
cmp dl, 0xba
je 0x55f49c
cmp dl, 0xbb
jne 0x55f4f0
xor edx, edx
jmp 0x55f48d
mov cl, byte [esi]
inc esi
cmp cl, 0xba
je 0x55f492
cmp cl, 0xbb
jne 0x55f4f0
inc edx
cmp eax, edx
jne 0x55f480
sub eax, edx
test edx, edx
jne 0x55f3d2
mov dword [esp + 0x10], 0x8a
jmp 0x55f4f8
mov dword [esp + 0x10], 0x72
mov dword [esp + 0xc], 0x611ae0
mov dword [esp + 8], 0x89
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 4
call fcn.004b2280
mov eax, 0xffffffff
add esp, 0x24
pop esi
pop edi
ret
mov dword [esp + 0x10], 0x81
mov dword [esp + 0xc], 0x611ae0
mov dword [esp + 8], 0x8a
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 4
call fcn.004b2280
mov eax, 0xffffffff
jmp 0x55f3f3
mov dword [esp + 0x10], 0x93
mov dword [esp + 0xc], 0x611ae0
mov dword [esp + 8], 0x8b
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 4
call fcn.004b2280
mov eax, 0xffffffff
jmp 0x55f3f3
mov cx, word [esi]
mov word [edi], cx
add edi, 2
add esi, 2
sub edx, 2
jmp 0x55f448
mov dl, byte [esi]
mov byte [edi], dl
inc edi
inc esi
lea edx, [eax - 1]
jmp 0x55f43c
Function at 0x56d610
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebp, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov ebx, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov esi, dword [edx]
test esi, esi
jne 0x56d651
jmp 0x56d670
mov dl, byte [ebx + esi]
xor dl, byte [ebp]
mov byte [eax], dl
inc eax
inc ebp
dec ecx
inc esi
and esi, 0xf
je 0x56d670
test ecx, ecx
jne 0x56d640
mov eax, dword [esp + 0x64]
mov dword [eax], esi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ecx, 0xf
jbe 0x56d824
mov edi, eax
mov esi, ebp
mov dword [esp + 0x24], ebp
mov ebp, ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov eax, ebx
mov ebx, esi
mov esi, eax
jmp 0x56d6a0
mov eax, dword [esp + 0x5c]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], esi
mov edx, dword [esp + 0x68]
call edx
mov ecx, dword [ebx]
xor ecx, dword [esi]
mov dword [edi], ecx
mov ecx, dword [ebx + 4]
xor ecx, dword [esi + 4]
mov dword [edi + 4], ecx
mov ecx, dword [ebx + 8]
xor ecx, dword [esi + 8]
mov dword [edi + 8], ecx
mov ecx, dword [ebx + 0xc]
xor ecx, dword [esi + 0xc]
mov dword [edi + 0xc], ecx
sub ebp, 0x10
add edi, 0x10
add ebx, 0x10
cmp ebp, 0xf
ja 0x56d6a0
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov ebx, esi
mov edx, ecx
and edx, 0xf
mov dword [esp + 0x24], edx
sub ecx, 0x10
and ecx, 0xfffffff0
lea edx, [ecx + 0x10]
add eax, edx
add ebp, edx
mov edx, dword [esp + 0x24]
test edx, edx
je 0x56d810
mov edx, dword [esp + 0x5c]
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], ebx
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x68]
call edx
mov edx, dword [esp + 0x24]
dec edx
mov dword [esp + 0x20], edx
mov edx, ebx
or edx, ebp
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x18]
lea edi, [eax + 4]
mov esi, dword [esp + 0x24]
shr esi, 2
lea ecx, [esi*4]
cmp ebp, edi
setae byte [esp + 0x1f]
lea edx, [ebp + 4]
cmp eax, edx
setae dl
or byte [esp + 0x1f], dl
cmp ebx, edi
setae byte [esp + 0x2c]
lea edi, [ebx + 4]
cmp eax, edi
setae dl
or byte [esp + 0x2c], dl
mov dl, byte [esp + 0x2c]
and byte [esp + 0x1f], dl
cmp dword [esp + 0x24], 6
seta dl
and byte [esp + 0x1f], dl
or dword [esp + 0x28], eax
test byte [esp + 0x28], 3
sete dl
test byte [esp + 0x1f], dl
je 0x56d820
test ecx, ecx
je 0x56d820
xor edx, edx
lea esi, [esi]
mov edi, dword [ebx + edx*4]
xor edi, dword [ebp + edx*4]
mov dword [eax + edx*4], edi
inc edx
cmp esi, edx
ja 0x56d7b0
sub dword [esp + 0x20], ecx
cmp dword [esp + 0x24], ecx
je 0x56d7ef
mov edx, dword [esp + 0x20]
lea esi, [ecx + edx + 1]
jmp 0x56d7e0
mov dl, byte [ebx + ecx]
xor dl, byte [ebp + ecx]
mov byte [eax + ecx], dl
inc ecx
cmp ecx, esi
jne 0x56d7e0
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x64]
mov dword [eax], esi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
xor esi, esi
mov eax, dword [esp + 0x64]
mov dword [eax], esi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
xor ecx, ecx
jmp 0x56d7c9
mov dword [esp + 0x24], ecx
jmp 0x56d708
Function at 0x56f240
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x10c
mov esi, dword [esp + 0x120]
mov eax, dword [esp + 0x128]
mov edx, dword [esp + 0x12c]
cmp edx, 0x10
je 0x56f276
cmp edx, 0xc
je 0x56f454
cmp edx, 8
je 0x56f461
mov dword [esp + 8], 0x22
mov edx, 0x10
mov dword [esi], edx
cmp dword [esp + 0x124], 7
jle 0x56f4ad
lea ecx, [esp + 0xc]
mov edx, dword [esp + 0x124]
sub edx, 8
shr edx, 3
inc edx
mov dword [esp + 4], edx
lea edi, [eax + edx*8]
lea esi, [esi]
mov dl, byte [eax]
and edx, 0xff
mov ebp, edx
xor edx, edx
mov dl, byte [eax + 1]
shl edx, 8
xor ebx, ebx
mov bl, byte [eax + 2]
shl ebx, 0x10
or edx, ebx
or edx, ebp
xor ebx, ebx
mov bl, byte [eax + 3]
shl ebx, 0x18
or edx, ebx
mov dword [ecx], edx
mov bl, byte [eax + 4]
and ebx, 0xff
mov ebp, ebx
xor edx, edx
mov dl, byte [eax + 5]
shl edx, 8
xor ebx, ebx
mov bl, byte [eax + 6]
shl ebx, 0x10
or edx, ebx
or edx, ebp
xor ebx, ebx
mov bl, byte [eax + 7]
shl ebx, 0x18
or edx, ebx
add eax, 8
mov dword [ecx + 4], edx
add ecx, 8
cmp edi, eax
jne 0x56f2b0
mov edx, dword [esp + 4]
add edx, edx
mov eax, dword [esp + 4]
shl eax, 3
cmp eax, dword [esp + 0x124]
je case.default.0x56f332
mov eax, dword [esp + 0x124]
and eax, 7
add edi, eax
jmp dword [eax*4 + 0x612040]
lea eax, [edi - 1]
xor ebx, ebx
mov bl, byte [edi - 1]
shl ebx, 0x18
lea edi, [eax - 1]
mov al, byte [eax - 1]
and eax, 0xff
shl eax, 0x10
or eax, ebx
lea ebp, [edi - 1]
mov bl, byte [edi - 1]
and ebx, 0xff
mov edi, ebx
shl edi, 8
or edi, eax
xor eax, eax
mov al, byte [ebp - 1]
or eax, edi
mov dword [esp + edx*4 + 0xc], eax
mov dword [esp + edx*4 + 0x10], ecx
mov eax, dword [esp + 0x124]
add eax, 3
js 0x56f445
sar eax, 2
mov dword [esp], eax
mov dword [esi + 4], 0xb7e15163
mov edx, 0x5618cb1c
mov eax, 1
mov ecx, dword [esp + 8]
lea esi, [esi]
lea edi, [edi]
mov dword [esi + eax*4 + 4], edx
inc eax
sub edx, 0x61c88647
cmp eax, ecx
jl 0x56f3d0
mov eax, dword [esp + 8]
mov edx, dword [esp]
cmp eax, edx
jge 0x56f3ec
mov eax, edx
lea eax, [eax + eax*2]
mov dword [esp + 4], eax
xor ebx, ebx
xor edx, edx
xor ebp, ebp
xor edi, edi
xor eax, eax
lea esi, [esi]
mov ecx, dword [esi + edx*4 + 4]
add ecx, edi
add eax, ecx
mov ecx, 3
rol eax, cl
mov dword [esi + edx*4 + 4], eax
lea ecx, [eax + edi]
mov edi, dword [esp + ebx*4 + 0xc]
add edi, ecx
rol edi, cl
mov dword [esp + ebx*4 + 0xc], edi
inc edx
cmp edx, dword [esp + 8]
jl 0x56f42b
xor edx, edx
inc ebx
cmp dword [esp], ebx
jg 0x56f433
xor ebx, ebx
inc ebp
cmp dword [esp + 4], ebp
jg 0x56f400
add esp, 0x10c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x124]
add eax, 6
jmp 0x56f3aa
mov dword [esp + 8], 0x1a
jmp 0x56f283
mov dword [esp + 8], 0x12
jmp 0x56f283
xor ecx, ecx
jmp 0x56f35d
xor ecx, ecx
xor eax, eax
jmp 0x56f392
mov ebp, edi
xor ecx, ecx
xor edi, edi
jmp 0x56f38b
xor ecx, ecx
xor eax, eax
jmp 0x56f378
mov eax, edi
xor ecx, ecx
xor ebx, ebx
jmp 0x56f368
mov edi, eax
xor edx, edx
xor eax, eax
jmp 0x56f31d
Function at 0x56f4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
mov ebx, dword [eax]
mov cl, byte [edx]
and ecx, 0xff
mov ebp, ecx
xor eax, eax
mov al, byte [edx + 1]
shl eax, 8
xor ecx, ecx
mov cl, byte [edx + 2]
shl ecx, 0x10
or eax, ecx
or eax, ebp
xor ecx, ecx
mov cl, byte [edx + 3]
shl ecx, 0x18
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 4]
mov dword [esp + 0x1c], ecx
mov cl, byte [edx + 5]
and ecx, 0xff
mov ebp, ecx
shl ebp, 8
xor ecx, ecx
mov cl, byte [edx + 6]
shl ecx, 0x10
or ebp, ecx
or ebp, dword [esp + 0x1c]
xor ecx, ecx
mov cl, byte [edx + 7]
shl ecx, 0x18
or ebp, ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebp
mov byte [esp + 0x28], al
mov ecx, eax
shr ecx, 8
mov byte [esp + 0x29], cl
mov ecx, eax
shr ecx, 0x10
mov byte [esp + 0x2a], cl
shr eax, 0x18
mov byte [esp + 0x2b], al
mov eax, ebp
mov byte [esp + 0x2c], al
mov eax, ebp
shr eax, 8
mov byte [esp + 0x2d], al
mov eax, ebp
shr eax, 0x10
mov byte [esp + 0x2e], al
mov eax, ebp
shr eax, 0x18
mov byte [esp + 0x2f], al
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x56f66d
mov ebp, dword [esp + 0x58]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], edx
jmp 0x56f5b1
mov dl, byte [esp + ebx + 0x28]
xor dl, byte [esi]
mov byte [edi], dl
inc edi
inc esi
inc ebx
and ebx, 7
dec ebp
je 0x56f620
test ebx, ebx
jne 0x56f5a0
mov ecx, dword [esp + 0x5c]
mov dword [esp + 4], ecx
lea eax, [esp + 0x20]
mov dword [esp], eax
call fcn.0056f880
mov edx, dword [esp + 0x20]
mov byte [esp + 0x28], dl
mov ecx, edx
shr ecx, 8
mov byte [esp + 0x29], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esp + 0x2a], cl
shr edx, 0x18
mov byte [esp + 0x2b], dl
mov edx, dword [esp + 0x24]
mov byte [esp + 0x2c], dl
mov ecx, edx
shr ecx, 8
mov byte [esp + 0x2d], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esp + 0x2e], cl
shr edx, 0x18
mov byte [esp + 0x2f], dl
inc dword [esp + 0x18]
jmp 0x56f5a0
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x56f66d
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov byte [edx], cl
mov esi, ecx
shr esi, 8
mov eax, esi
mov byte [edx + 1], al
mov esi, ecx
shr esi, 0x10
mov eax, esi
mov byte [edx + 2], al
shr ecx, 0x18
mov byte [edx + 3], cl
mov ecx, edi
mov byte [edx + 4], cl
mov ecx, edi
shr ecx, 8
mov byte [edx + 5], cl
mov ecx, edi
shr ecx, 0x10
mov byte [edx + 6], cl
mov eax, edi
shr eax, 0x18
mov byte [edx + 7], al
mov eax, dword [esp + 0x64]
mov dword [eax], ebx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x56fbc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x56fc8f
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x56fc2d
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0056f880
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x56fbff
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x56fd36
call 0x56fc3f
pop edx
lea ecx, [edx + 0x141]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x56fcdf
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0056fa20
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x56fc9c
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x56fd36
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0056fa20
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x56fd34
jmp 0x56fd36
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x57f3b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [ebx + 4]
mov eax, dword [ecx + 4]
cmp edx, eax
jl 0x57f460
mov esi, eax
mov eax, edx
mov edx, esi
mov esi, ecx
mov ecx, dword [esp + 0x30]
cmp dword [ecx + 8], eax
jl 0x57f471
test edx, edx
jle 0x57f49d
mov edx, dword [esp + 0x30]
mov ebp, dword [edx]
mov edi, dword [ebx]
mov ecx, dword [esi]
xor eax, eax
lea esi, [esi]
lea edi, [edi]
mov edx, dword [ecx + eax*4]
xor edx, dword [edi + eax*4]
mov dword [ebp + eax*4], edx
inc eax
cmp dword [esi + 4], eax
jg 0x57f400
mov edx, dword [ebx + 4]
cmp eax, edx
jge 0x57f42e
mov ecx, dword [esp + 0x30]
mov esi, dword [ecx]
mov ecx, dword [ebx]
nop
mov edx, dword [ecx + eax*4]
mov dword [esi + eax*4], edx
inc eax
mov edx, dword [ebx + 4]
cmp edx, eax
jg 0x57f420
mov ecx, dword [esp + 0x30]
mov dword [ecx + 4], edx
test edx, edx
jle 0x57f490
mov eax, dword [ecx]
sub eax, 4
nop
mov ebx, dword [eax + edx*4]
test ebx, ebx
jne 0x57f44a
dec edx
jne 0x57f440
mov ecx, dword [esp + 0x30]
mov dword [ecx + 4], edx
mov eax, 1
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, ebx
mov ebx, ecx
mov ecx, dword [esp + 0x30]
cmp dword [ecx + 8], eax
jge 0x57f3e2
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.004bcce0
test eax, eax
jne 0x57f4a4
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 1
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x57f410
mov edx, dword [esi + 4]
jmp 0x57f3e2