joyce8/EMBER2024-capa huggingface dataset:
Function at 0x90a249d
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d3fd3
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090cde60
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0xa0
push eax
call fcn.090c4b80
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x90a2522
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.090c4b80
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09018f87
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x90a2539
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x90a2595
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x90a2588
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x504c4142
push 0x271
push eax
push eax
call fcn.090c4b80
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.090c4b80
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.090067dd
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
sub dword [ebp - 0x13d4], 1
jne 0x90a2631
sub dword [ebp - 0x13d8], 1
jne 0x90a2627
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.090068a7
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xf424
jb 0x90a2571
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.090190fb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x90a2706
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d3fd3
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090cde60
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0xa0
push eax
call fcn.090c4b80
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x90a278b
push 0
push 0x753
push 0xb71b
push dword [esi + 4]
call fcn.090c4b80
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09018f87
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x90a27a2
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x90a27fe
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x90a27f1
mov ecx, dword [ebp - 0x13e4]
mov eax, 0x504c4142
push 0
push eax
push eax
push 0x271
lea eax, [ebp - 0x13d0]
push eax
push eax
call fcn.090c4b80
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x753
push edi
push dword [eax]
call fcn.090c4b80
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.090067dd
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov eax, dword [esi]
mov edx, dword [esi + 4]
shr eax, 0x10
imul eax, eax, 0xff
movzx ecx, dx
add ecx, 0x40
shr ecx, 7
add eax, 0x4000
shr eax, 0xf
cmp ecx, 0xff
mov byte [edi - 2], al
movzx eax, cl
mov ecx, 0xff
cmova eax, ecx
shr edx, 0x10
add edx, 0x40
mov byte [edi - 1], al
shr edx, 7
cmp edx, ecx
movzx eax, dl
cmova eax, ecx
add esi, 8
mov byte [edi], al
add edi, 3
sub dword [ebp - 0x13d4], 1
jne 0x90a2897
sub dword [ebp - 0x13d8], 1
jne 0x90a288d
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.090068a7
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x753
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xb71b
jb 0x90a27da
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.090190fb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x90a2d18
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d3fd3
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x13f0
call fcn.090cde60
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x13e8], edi
mov esi, dword [ebx + 8]
push 0
mov dword [ebp - 0x13e4], esi
mov eax, dword [esi + 4]
add eax, 0xa0
push eax
call fcn.090c4b80
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x90a2d9d
push 0
push 0x9c4
push 0xf424
push dword [esi + 4]
call fcn.090c4b80
add esp, 0x10
mov dword [edi], eax
mov ecx, esi
mov dword [ebp - 0x13ec], esi
call fcn.09018f87
and dword [ebp - 4], 0
lea edi, [ebp - 0x48]
push 0xc
pop ecx
mov eax, ecx
mov dword [ebp - 0x13dc], 0x18
xor edx, edx
add ecx, 0x8000
div dword [ebp - 0x13dc]
mov word [edi], ax
lea edi, [edi + 2]
cmp ecx, 0xc800c
jb 0x90a2db4
and dword [ebp - 0x13e0], 0
lea eax, [ebp - 0x48]
mov dword [ebp - 0x13dc], eax
movzx eax, word [eax]
lea ecx, [ebp - 0x13cc]
xor edx, edx
mov dword [ebp - 0x13d8], eax
mov dword [ebp - 0x13d4], edx
movzx esi, word [ebp + edx*2 - 0x48]
xor edi, edi
mov edx, dword [ebp - 0x13d8]
mov ax, word [ebp + edi*2 - 0x48]
inc edi
mov word [ecx - 2], dx
mov word [ecx], si
mov word [ecx + 2], ax
add ecx, 8
cmp edi, 0x19
jb 0x90a2e10
mov edx, dword [ebp - 0x13d4]
inc edx
mov dword [ebp - 0x13d4], edx
cmp edx, 0x19
jb 0x90a2e03
mov ecx, dword [ebp - 0x13e4]
lea eax, [ebp - 0x13d0]
push 0
push 0x434d594b
push 0x50524742
push 0x271
push eax
push eax
call fcn.090c4b80
mov eax, dword [ebp - 0x13e8]
lea ecx, [ebp - 0x1400]
mov edi, dword [ebp - 0x13e0]
push 1
push 0x9c4
push edi
push dword [eax]
call fcn.090c4b80
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 1
call fcn.090067dd
lea esi, [ebp - 0x13d0]
mov dword [ebp - 0x13d8], 0x19
lea edi, [eax + 2]
mov dword [ebp - 0x13d4], 0x19
mov ecx, dword [esi]
mov edx, dword [esi + 4]
add esi, 8
movzx eax, cx
imul eax, eax, 0xff
shr ecx, 0x10
add eax, 0x4000
shr eax, 0xf
mov byte [edi - 2], al
imul eax, ecx, 0xff
mov ecx, 0x4000
add eax, ecx
shr eax, 0xf
mov byte [edi - 1], al
movzx eax, dx
imul eax, eax, 0xff
shr edx, 0x10
add eax, ecx
shr eax, 0xf
mov byte [edi], al
imul eax, edx, 0xff
add eax, ecx
shr eax, 0xf
mov byte [edi + 1], al
add edi, 4
sub dword [ebp - 0x13d4], 1
jne 0x90a2eac
sub dword [ebp - 0x13d8], 1
jne 0x90a2ea2
lea ecx, [ebp - 0x1400]
mov byte [ebp - 4], 0
call fcn.090068a7
mov edi, dword [ebp - 0x13e0]
mov eax, dword [ebp - 0x13dc]
add edi, 0x9c4
mov esi, dword [ebp - 0x13e4]
add eax, 2
mov dword [ebp - 0x13dc], eax
mov dword [ebp - 0x13e0], edi
cmp edi, 0xf424
jb 0x90a2dec
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.090190fb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
Function at 0x90c4770
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x90d4bd2
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xb20
mov eax, dword [0x91154f8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
mov esi, dword [ebx + 0x18]
push eax
mov dword [ebp - 0xb2c], eax
call fcn.090c4b80
add esp, 4
lea ecx, [ebp - 0xb24]
push eax
call fcn.090c4b80
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push dword [ebp - 0xb24]
mov dword [ebp - 4], 0
push esi
call fcn.09009307
add esp, 0x3c
lea ecx, [ebp - 0xb20]
push eax
call fcn.090c4b80
mov byte [ebp - 4], 1
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
mov byte [ebp + eax - 0x118], al
inc eax
cmp eax, 0x100
jb 0x90c4820
mov ecx, dword [ebp - 0xb20]
lea eax, [ebp - 0x918]
push 0
push 0x5058595a
push 0x67386b30
push 0x100
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.090c4b80
movzx ecx, word [ebp - 0x11c]
movzx edi, word [ebp - 0x914]
mov dword [ebp - 0xb28], ecx
cmp ecx, edi
jbe 0x90c499a
mov edx, ecx
sub edx, edi
xor esi, esi
mov dword [ebp - 0xb1c], edx
movzx eax, word [ebp + esi*8 - 0x914]
cmp eax, edi
ja 0x90c4891
xor eax, eax
jmp 0x90c48be
cmp eax, ecx
jb 0x90c489c
mov eax, 0x8000
jmp 0x90c48be
sub eax, edi
mov ecx, edx
shl eax, 0xf
xor edx, edx
shr ecx, 1
add eax, ecx
mov ecx, dword [ebp - 0xb28]
div dword [ebp - 0xb1c]
mov edx, dword [ebp - 0xb1c]
movzx eax, ax
mov word [ebp + esi*2 - 0xb18], ax
inc esi
cmp esi, 0x100
jb 0x90c4881
lea ecx, [ebp - 0xb20]
mov byte [ebp - 4], 0
call fcn.090198a7
lea ecx, [ebp - 0xb24]
mov dword [ebp - 4], 0xffffffff
call fcn.0901e58a
mov esi, dword [ebp - 0xb2c]
lea eax, [esi + 8]
push eax
push 0x280
mov dword [ebp - 0xb2c], eax
call fcn.090c4b80
add esp, 8
mov dword [ebp - 0xb28], eax
mov dword [ebp - 4], 2
test eax, eax
je 0x90c492a
push esi
mov ecx, eax
call fcn.090c4b80
mov edx, eax
jmp 0x90c492c
xor edx, edx
movsd xmm1, qword [ebx + 0x10]
xorps xmm0, xmm0
mov eax, dword [ebx + 0xc]
mulsd xmm1, qword [0x90e7a70]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
comisd xmm0, xmm1
mov dword [edx + 0x70], ecx
mov dword [edx + 0x74], eax
jbe 0x90c495a
subsd xmm1, qword [0x90dd3d8]
jmp 0x90c4962
addsd xmm1, qword [0x90dd3d8]
cvttsd2si eax, xmm1
lea edi, [edx + 0x7a]
mov ecx, 0x80
lea esi, [ebp - 0xb18]
rep movsd dword es:[edi], dword [esi]
mov word [edx + 0x78], ax
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.09002290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x6250726f
call fcn.090c4b80
int3
Function at 0x90c4b80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x90c4b8f
pop dword [ebp - 0x14]
mov eax, 0x90c4b8f
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x49eaef7c
sub dword [ebp - 0x24], 0xfb98aa31
mov dword [ebp - 0x20], 0xfb6909f3
sub dword [ebp - 0x20], 0xc935bdae
mov dword [ebp - 0x1c], 0x647a7f2a
add dword [ebp - 0x1c], 0xe7d1c504
mov dword [ebp - 0x18], 0x56bab734
sub dword [ebp - 0x18], 0x56bab734
lea eax, [ebp - 0x24]
push eax
mov eax, 0x839a3c11
sub eax, 0x7a8cdb4d
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xe10d886a
add dword [ebp - 0x24], 0x9364e0ec
mov dword [ebp - 0x20], 0x8de6798a
add dword [ebp - 0x20], 0xb385e7eb
mov dword [ebp - 0x1c], 0x77a28ffe
add dword [ebp - 0x1c], 0xebccdc6e
mov dword [ebp - 0x18], 0xd6366c58
add dword [ebp - 0x18], 0x29c993a8
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0xb73b2152
add eax, 0x51d23f6e
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x780ba
push 0
call eax
mov ecx, 0x484e
mov ebx, eax
mov edi, 0x9125c00
add edi, dword [ebp - 0x14]
mov edx, 0xe463f1c
add edx, 0x34fb89d6
mov dword [ebp - 8], 0xd1d0da4b
mov esi, dword [edi]
add dword [ebp - 0xc], eax
sub esi, edx
add dword [ebp - 0xc], 0x72b5c150
mov dword [ebx], esi
xor dword [ebp - 0x10], 0xcc11f07b
add ebx, 0xd91cc5fe
add ebx, 0x26e33a06
add edi, 0x3054883a
sub edi, 0x30548836
loop 0x90c4ca0
add eax, 0x1140b
mov ebx, eax
add eax, 0xfb201e8f
add eax, 0x4dfe176
mov ecx, 0x50bb73ac
add ecx, 0xb8448c54
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x906058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009061a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x90607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90606a
add dl, dl
jne 0x906089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9060dc
xor eax, eax
add dl, dl
jne 0x906096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90617d
add dl, dl
jne 0x9060a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9060d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x906075
mov eax, 1
add dl, dl
jne 0x9060ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9060e1
sub eax, ebx
mov ebx, 1
jne 0x906128
mov ecx, 1
add dl, dl
jne 0x90610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x906119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x906105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x906075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x90613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x90614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x906136
cmp eax, 0x7d00
jae 0x90616d
cmp eax, 0x500
jb 0x906168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x906075
cmp eax, 0x7f
ja 0x906170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x906075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x90619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x906075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x61366a
Capabilities:
Encode data using xor

Disassembly:
and ebp, eax
fdiv qword [edi]
xchg ebx, eax
sub byte [ebp + 0x69d7901b], ah
das
mov al, 0xd0
ret 0x83e3
jns 0x6136ae
loop 0x613621
dec edx
xchg ecx, eax
mov dword [0xae08079d], eax
or cl, byte [esi + 0x53130122]
xor dword [edi + 0x27], eax
push esp
pop ds
jo 0x613677
and bh, bh
mul dh
push edx
leave
lcall 0x73a7, 0xdb37214c
mov word [esi - 0x2baf5efd], fs
cli
invalid
outsb dx, byte [esi]
or dl, byte [ebp - 0x15]
mov ch, 0x8d
and dh, dh
sub eax, 0x78965ec9
cmpsb byte [esi], byte es:[edi]
mov al, byte gs:[0x40d6b6a2]
pop esi
mov byte [0x5e40d6b6], al
and ah, byte [edx - 0x7999fe43]
inc eax
add dl, byte [ecx]
in al, 0x65
not ebx
inc esp
mov bl, 0x12
mov ah, bh
rcl edx, 0xf3
xor al, 0xb3
inc ebx
inc esp
mov dl, 0x11
and byte [edi], 0x85
inc eax
xor al, 0x40
lodsd eax, dword [esi]
jns 0x61370f
scasd eax, dword es:[edi]
push ss
sbb eax, 0xb24ce34f
lodsd eax, dword [esi]
add edi, dword [esi - 0x2d]
xlatb
cdq
pushfd
jecxz 0x61369d
push edx
fiadd dword [ebp - 0x4d]
inc ebp
jp 0x613743
int 0xb
xchg dword [esi + 0x6e], eax
cmpsb byte [esi], byte es:[edi]
sbb al, 0xeb
retf 0x3321
push ebp
in al, dx
or eax, 0x2d6146f0
invalid
fdiv qword [esi - 0x1d82206b]
jb 0x61372a
jecxz 0x6136d8
mov esp, 0xf77a584b
pop eax
jp 0x613724
mov bl, 0x73
les eax, [ecx + 0x53]
ficomp word [ebp + 0x43a81fb7]
xlatb
sub eax, 0x51f4e333
add edx, edx
sbb esp, eax
jno 0x6137b6
jb 0x613787
inc edx
in eax, dx
adc eax, 0xd246e80
mov dword [0xf7caee27], eax
stosd dword es:[edi], eax
out dx, eax
pop edi
adc byte [edi + 0x73], 0x32
add al, 0xf9
test al, 0x42
jbe 0x61371e
adc esp, dword [esi + 0x1d0b2b2f]
shl dword [edx], 1
or al, 0x32
call dword [ebx]
inc ebx
test dword [esi - 0x2d40dfdb], esi
pop edx
aad 0x86
pop edi
invalid
adc byte [ecx + 0x29], 0x23
mov bh, 0xc5
mov dword [edx - 8], esi
pop ecx
push ebx
and dword [ebx + eax], edx
popal
xchg ebx, eax
insd dword es:[edi], dx
mov eax, dword [0x4d904353]
idiv ah
pop ebp
adc dword [ecx], 0xee847c7f
xchg edx, eax
hlt
inc edi
pop ebx
ret 0x8513
Function at 0x401d80
Capabilities:
Encode data using xor
Read .ini file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa2b30
call fcn.0040c800
mov eax, dword [0x414054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
jmp 0x401dab
jmp 0x401dbd
push str..Settings.ini
push 0
push str.EncryptEffect
push str.Encrypt
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x401f67
push 0xa2b20
lea eax, [ebp - 0xa2b28]
push 0
push eax
call fcn.00405330
add esp, 0xc
push 0x452d40
call fcn.00401850
push 0x470208
call fcn.00401b00
push 0x41c0a0
call fcn.004012b0
push 0x415338
call fcn.00401030
push 0x451c08
call fcn.00401560
push 0x750da0
call fcn.00402eb0
call fcn.00402860
push 0x1d4c0
lea ecx, [ebp - 0xa2b28]
push 0x452d44
push ecx
call fcn.00409d70
add esp, 0xc
push 0x35b60
lea edx, [ebp - 0x85668]
push 0x47020c
push edx
call fcn.00409d70
add esp, 0xc
push 0x35b60
lea eax, [ebp - 0x4fb08]
push 0x41c0a4
push eax
call fcn.00409d70
add esp, 0xc
push 0x6d60
lea ecx, [ebp - 0x19fa8]
push 0x41533c
push ecx
call fcn.00409d70
add esp, 0xc
push 0x101d0
mov ecx, 0x2bc
mov esi, 0x451c0c
lea edi, [ebp - 0x13248]
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x12118]
push 0x750da4
mov ecx, 0x190
mov esi, 0x4526fc
lea edi, [ebp - 0x12758]
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.00409d70
add esp, 0xc
push 0x1f40
lea eax, [ebp - 0x1f48]
push 0x7c7268
push eax
call fcn.00409d70
add esp, 0xc
xor eax, eax
nop
mov dl, byte [ebp + eax - 0xa2b28]
mov ecx, eax
xor dl, al
shr ecx, 8
xor cl, 0x85
xor dl, 0xfa
sub dl, cl
mov byte [ebp + eax - 0xa2b28], dl
inc eax
cmp eax, 0xa2b20
jb 0x401ef0
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
push str..._.._Client_Data_Local_EffectTRSData.bmd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401f67
push 0
lea eax, [ebp - 0xa2b2c]
push eax
push 0xa2b20
lea ecx, [ebp - 0xa2b28]
push ecx
push esi
mov dword [ebp - 0xa2b2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x401f79
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040384a
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401f91
jmp 0x401fa8
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040384a
mov esp, ebp
pop ebp
ret
Function at 0x401fd0
Capabilities:
Encode data using xor
Read .ini file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x30fdec
call fcn.0040c800
mov eax, dword [0x414054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
jmp 0x401ffa
jmp 0x40200c
push str..Settings.ini
push 0
push str.EncryptTooltip
push str.Encrypt
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x40218c
push 0x30fde0
lea eax, [ebp - 0x30fde8]
push 0
push eax
call fcn.00405330
add esp, 0xc
push 0
push 0x760f78
mov ecx, str.Data_BuffEffect_eng.txt
call fcn.00403540
push 1
push 0x760f78
mov ecx, str.Data_BuffEffect_spn.txt
call fcn.00403540
push 2
push 0x760f78
mov ecx, str.Data_BuffEffect_por.txt
call fcn.00403540
push 1
push 0x4a63b8
mov ecx, str.Data_JCItemToolTip.txt
call fcn.00402440
push 2
push 0x4a63b8
mov ecx, str.Data_JCTextTooltip.txt
call fcn.00402440
push 0x21c00
lea ecx, [ebp - 0x30fde8]
push 0x760f7c
push ecx
call fcn.00409d70
add esp, 0xc
push 0x21c00
lea edx, [ebp - 0x2ee1e8]
push 0x782b7c
push edx
call fcn.00409d70
add esp, 0xc
push 0x21c00
lea eax, [ebp - 0x2cc5e8]
push 0x7a477c
push eax
call fcn.00409d70
add esp, 0xc
push 0x1ec300
lea ecx, [ebp - 0x2aa9e8]
push 0x4a63bc
push ecx
call fcn.00409d70
add esp, 0xc
push 0xbe6e0
lea edx, [ebp - 0xbe6e8]
push 0x6926bc
push edx
call fcn.00409d70
add esp, 0xc
xor eax, eax
mov dl, byte [ebp + eax - 0x30fde8]
mov ecx, eax
xor dl, al
shr ecx, 8
xor cl, 0x85
xor dl, 0xfa
sub dl, cl
mov byte [ebp + eax - 0x30fde8], dl
inc eax
cmp eax, 0x30fde0
jb 0x402115
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
push str..._.._Client_Data_Local_TooltipTRSData.bmd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40218c
push 0
lea eax, [ebp - 0x30fdec]
push eax
push 0x30fde0
lea ecx, [ebp - 0x30fde8]
push ecx
push esi
mov dword [ebp - 0x30fdec], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x40219d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040384a
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4021b5
jmp 0x4021cc
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040384a
mov esp, ebp
pop ebp
ret
Function at 0x4021e0
Capabilities:
Encode data using xor
Read .ini file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
mov eax, dword [0x414054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
jmp 0x402207
jmp 0x402219
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push str..Settings.ini
push 0
push str.EncryptMakeWorld
push str.Encrypt
call esi
test eax, eax
je 0x4022f7
push 0x1c8
lea eax, [ebp - 0x1d0]
push 0
push eax
call fcn.00405330
add esp, 0xc
push str..Settings.ini
push 0
push str.RenderTooltipS15
push str.Season15
call esi
mov dword [ebp - 0xc], eax
call fcn.00403130
mov ecx, 0x71
mov esi, 0x7c70a0
lea edi, [ebp - 0x1d0]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
nop
mov dl, byte [ebp + eax - 0x1d0]
mov ecx, eax
xor dl, al
shr ecx, 8
xor cl, 0x85
xor dl, 0xfa
sub dl, cl
mov byte [ebp + eax - 0x1d0], dl
inc eax
cmp eax, 0x1c8
jb 0x402280
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
push str..._.._Client_Data_Local_MakeWorldTRSData.bmd
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4022f7
push 0
lea eax, [ebp - 0x1d4]
push eax
push 0x1c8
lea ecx, [ebp - 0x1d0]
push ecx
push esi
mov dword [ebp - 0x1d4], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
test eax, eax
jne 0x402309
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040384a
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402321
jmp 0x402338
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040384a
mov esp, ebp
pop ebp
ret