joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100216f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.100d6420
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
test eax, eax
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov dword [esp + 0x10], eax
je 0x10021744
test ebp, ebp
je 0x10021744
mov ecx, dword [esp + 0x2c]
mov dl, byte [eax + ecx]
mov esi, dword [esp + 0x18]
xor dl, byte [esi]
mov ecx, dword [esp + 0x1c]
mov byte [ecx], dl
add ecx, 1
add esi, 1
add eax, 1
sub ebp, 1
and eax, 0xf
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], eax
jne 0x10021710
mov esi, dword [esp + 0x28]
movzx ecx, byte [esi + 0xe]
movzx edx, byte [esi + 0xf]
xor ebx, ebx
mov bh, byte [esi + 0xc]
mov bl, byte [esi + 0xd]
shl ebx, 8
or ebx, ecx
shl ebx, 8
or ebx, edx
cmp ebp, 0x10
jb 0x100217ea
jmp 0x10021770
mov edi, ebp
shr edi, 4
add ebx, edi
cmp ebx, edi
jae 0x1002177f
sub edi, ebx
xor ebx, ebx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push esi
push eax
push edi
push ecx
push edx
call dword [esp + 0x48]
mov eax, ebx
mov ecx, ebx
mov edx, ebx
shr eax, 0x18
shr ecx, 0x10
shr edx, 8
add esp, 0x14
test ebx, ebx
mov byte [esi + 0xc], al
mov byte [esi + 0xd], cl
mov byte [esi + 0xe], dl
mov byte [esi + 0xf], bl
jne 0x100217d4
mov eax, 0xc
mov ecx, 1
movzx edx, byte [eax + esi - 1]
sub eax, 1
add ecx, edx
mov byte [eax + esi], cl
shr ecx, 8
test eax, eax
jne 0x100217c0
shl edi, 4
add dword [esp + 0x1c], edi
add dword [esp + 0x18], edi
sub ebp, edi
cmp ebp, 0x10
jae 0x10021770
mov eax, dword [esp + 0x10]
test ebp, ebp
je 0x10021870
mov edi, dword [esp + 0x2c]
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
push esi
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x28]
push eax
push 1
push edi
push edi
call dword [esp + 0x48]
add ebx, 1
mov ecx, ebx
mov edx, ebx
mov eax, ebx
shr ecx, 0x18
shr edx, 0x10
shr eax, 8
add esp, 0x14
test ebx, ebx
mov byte [esi + 0xc], cl
mov byte [esi + 0xd], dl
mov byte [esi + 0xe], al
mov byte [esi + 0xf], bl
jne 0x1002183d
mov edx, esi
call fcn.100216c0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
lea eax, [edx + edi]
sub ecx, edi
sub esi, edi
add edx, ebp
mov bl, byte [ecx + eax]
xor bl, byte [eax]
sub ebp, 1
mov byte [esi + eax], bl
add eax, 1
test ebp, ebp
jne 0x10021852
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
mov dword [ecx], edx
pop ebx
pop ecx
ret
mov edx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
mov dword [edx], eax
pop ebx
pop ecx
ret
Function at 0x10021880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
cmp ebp, 0x10
ja 0x1002188e
xor eax, eax
pop ebp
ret
push ebx
mov ebx, ebp
and ebx, 0xf
push esi
push edi
jne 0x1002189d
mov ebx, 0x10
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
push eax
push esi
push ecx
sub ebp, ebx
push ebp
push edx
push edi
call sym.LIBEAY32.dll_CRYPTO_cbc128_encrypt
add dword [esp + 0x30], ebp
add esp, 0x18
add edi, ebp
test ebx, ebx
jbe 0x100218de
mov eax, esi
sub edi, esi
mov ecx, ebx
mov dl, byte [edi + eax]
xor byte [eax], dl
add eax, 1
sub ecx, 1
jne 0x100218d1
mov eax, dword [esp + 0x20]
push eax
push esi
push esi
call dword [esp + 0x34]
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
push ebx
add edi, 0xfffffff0
push edi
push ecx
call fcn.100d73f0
mov edx, dword [esi]
mov dword [edi], edx
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
mov edx, dword [esi + 0xc]
add esp, 0x18
mov dword [edi + 0xc], edx
pop edi
pop esi
lea eax, [ebx + ebp]
pop ebx
pop ebp
ret

Function at 0x10021920
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
cmp ebx, 0x10
jae 0x1002192e
xor eax, eax
pop ebx
ret
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x24]
push eax
mov esi, ebx
push edi
push ecx
and esi, 0xf
sub ebx, esi
push ebx
push ebp
push edx
call sym.LIBEAY32.dll_CRYPTO_cbc128_encrypt
add esp, 0x18
test esi, esi
jne 0x10021965
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
mov ecx, dword [esp + 0x14]
add ecx, ebx
add ebp, ebx
test esi, esi
jbe 0x1002198f
mov eax, edi
sub ecx, edi
mov dword [esp + 0x1c], esi
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
add eax, 1
sub dword [esp + 0x1c], 1
jne 0x10021980
mov eax, dword [esp + 0x20]
push eax
push edi
push edi
call dword [esp + 0x34]
mov ecx, dword [edi]
mov dword [esi + ebp - 0x10], ecx
mov edx, dword [edi + 4]
mov dword [esi + ebp - 0xc], edx
mov eax, dword [edi + 8]
mov dword [esi + ebp - 8], eax
mov ecx, dword [edi + 0xc]
add esp, 0xc
pop edi
mov dword [esi + ebp - 4], ecx
lea eax, [esi + ebx]
pop esi
pop ebp
pop ebx
ret
Function at 0x10021b70
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x44
call fcn.100d6420
mov eax, dword [0x10151618]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x50]
cmp eax, 0x10
mov ecx, dword [esp + 0x58]
push ebx
mov ebx, dword [esp + 0x50]
push ebp
mov ebp, dword [esp + 0x64]
push esi
mov esi, dword [esp + 0x60]
push edi
mov edi, dword [esp + 0x58]
mov dword [esp + 0x14], ecx
ja 0x10021bbf
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.100d6528
add esp, 0x44
ret
mov edx, eax
and edx, 0xf
mov dword [esp + 0x18], edx
jne 0x10021bd2
mov dword [esp + 0x18], 0x10
mov edx, 0xfffffff0
sub edx, dword [esp + 0x18]
add eax, edx
mov dword [esp + 0x24], eax
je 0x10021bf9
push ebp
push ecx
push esi
push eax
push ebx
push edi
call sym.LIBEAY32.dll_CRYPTO_cbc128_decrypt
mov eax, dword [esp + 0x3c]
add esp, 0x18
add edi, eax
add ebx, eax
push esi
lea eax, [esp + 0x44]
push eax
push edi
call ebp
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x54]
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x58]
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x24]
mov dword [esp + 0x44], eax
push edx
lea eax, [edi + 0x10]
mov dword [esp + 0x4c], ecx
push eax
lea ecx, [esp + 0x44]
push ecx
call fcn.100d73f0
lea edx, [esp + 0x48]
push esi
push edx
mov eax, edx
push eax
call ebp
mov ecx, dword [esp + 0x38]
lea ebp, [esp + 0x54]
mov edx, edi
sub edx, ebp
mov dword [esp + 0x44], edx
mov edx, ebx
sub edx, ebp
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x38]
sub edx, ebp
mov dword [esp + 0x4c], edx
mov edx, ebx
sub edx, dword [esp + 0x38]
add esp, 0x24
mov dword [esp + 0x2c], edx
mov edx, edi
xor eax, eax
add ecx, 1
sub edx, ebx
lea esi, [ebx + 2]
mov dword [esp + 0x14], edx
nop
mov edx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
add edx, eax
movzx edx, byte [esp + edx + 0x30]
mov byte [esp + 0x13], dl
mov edx, dword [esp + 0x28]
lea ebp, [edx + eax]
movzx edx, byte [esp + eax + 0x30]
xor dl, byte [esp + ebp + 0x30]
add ebx, eax
mov byte [esp + ebx + 0x30], dl
movzx edx, byte [esp + 0x13]
movzx ebx, byte [esp + eax + 0x31]
xor bl, byte [ecx]
lea ebp, [esp + ebp + 0x30]
mov byte [ebp], dl
mov edx, dword [esp + 0x2c]
lea ebp, [edx + ecx]
mov edx, dword [esp + 0x14]
mov dl, byte [edx + ebp]
mov byte [ebp], bl
movzx ebx, byte [esp + eax + 0x32]
xor bl, byte [ecx + 1]
mov byte [ecx], dl
mov edx, dword [esp + 0x14]
mov dl, byte [edx + esi]
mov byte [esi], bl
movzx ebx, byte [esp + eax + 0x33]
xor bl, byte [ecx + 2]
mov byte [ecx + 1], dl
mov dl, byte [edi + eax + 3]
mov byte [esi + 1], bl
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
add esi, 4
cmp eax, 0x10
jb 0x10021c80
mov ecx, dword [esp + 0x18]
add ecx, 0x10
cmp eax, ecx
jae 0x10021d39
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
lea ebx, [ebx]
lea edx, [esi + eax]
mov dl, byte [esp + edx + 0x30]
xor dl, byte [esp + eax + 0x30]
lea ebx, [edi + eax]
add eax, 1
cmp eax, ecx
mov byte [esp + ebx + 0x30], dl
jb 0x10021d20
mov eax, dword [esp + 0x24]
pop edi
pop esi
lea eax, [eax + ecx + 0x10]
mov ecx, dword [esp + 0x48]
pop ebp
pop ebx
xor ecx, esp
call fcn.100d6528
add esp, 0x44
ret
Function at 0x10022450
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x34
call fcn.100d6420
mov eax, dword [0x10151618]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push ebx
push esi
mov esi, dword [esp + 0x44]
mov ebx, edx
lea edx, [esi - 1]
cmp edx, 0x7f
push edi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4c]
ja 0x1002260d
mov edx, dword [edi]
mov dword [esp + 0x18], edx
mov edx, dword [edi + 4]
push ebp
mov dword [esp + 0x20], edx
mov edx, dword [edi + 8]
push eax
mov dword [esp + 0x28], edx
mov edx, dword [edi + 0xc]
push edi
push edi
mov dword [esp + 0x34], edx
call ecx
lea eax, [esi + 7]
cdq
and edx, 7
add eax, edx
mov esi, eax
add esp, 0xc
sar esi, 3
cmp dword [esp + 0x58], 0
je 0x100224f9
test esi, esi
jle 0x10022540
mov eax, dword [esp + 0x14]
mov edx, edi
lea ebp, [esp + 0x2c]
sub edx, ebx
sub ebp, ebx
sub eax, ebx
mov ecx, ebx
mov dword [esp + 0x14], eax
lea ecx, [ecx]
mov al, byte [edx + ecx]
xor al, byte [ecx]
mov ebx, dword [esp + 0x14]
mov byte [ecx + ebp], al
mov byte [ebx + ecx], al
add ecx, 1
sub esi, 1
jne 0x100224e0
jmp 0x10022540
xor ebp, ebp
test esi, esi
jle 0x10022540
lea eax, [esp + 0x2c]
mov ecx, eax
sub ebx, eax
mov eax, dword [esp + 0x14]
mov edx, edi
sub edx, ecx
sub eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
jmp 0x10022524
mov edx, dword [esp + 0x18]
lea ecx, [esp + ebp + 0x2c]
mov al, byte [ebx + ecx]
mov dl, byte [edx + ecx]
xor dl, al
mov byte [ecx], al
mov eax, dword [esp + 0x14]
add ebp, 1
cmp ebp, esi
mov byte [eax + ecx], dl
jl 0x10022520
mov eax, dword [esp + 0x4c]
mov ecx, eax
and ecx, reloc.WS2_32.dll_getsockopt
jns 0x10022553
dec ecx
or ecx, 0xfffffff8
inc ecx
cdq
and edx, 7
add eax, edx
sar eax, 3
test ecx, ecx
mov dword [esp + 0x14], ecx
jne 0x10022594
mov ecx, dword [esp + eax + 0x1c]
mov edx, dword [esp + eax + 0x20]
lea eax, [esp + eax + 0x1c]
mov dword [edi], ecx
mov ecx, dword [eax + 8]
mov dword [edi + 4], edx
mov edx, dword [eax + 0xc]
pop ebp
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100d6528
add esp, 0x34
ret
mov dl, 8
sub dl, cl
mov byte [esp + 0x13], dl
add edi, 1
lea esi, [esp + eax + 0x1d]
mov ebp, 4
movzx edx, byte [esi - 1]
mov al, byte [esi]
shl dl, cl
movzx ecx, byte [esp + 0x13]
mov bl, al
shr bl, cl
mov ecx, dword [esp + 0x14]
shl al, cl
movzx ecx, byte [esp + 0x13]
or dl, bl
mov byte [edi - 1], dl
mov dl, byte [esi + 1]
mov bl, dl
shr bl, cl
mov ecx, dword [esp + 0x14]
shl dl, cl
movzx ecx, byte [esp + 0x13]
or al, bl
mov byte [edi], al
mov al, byte [esi + 2]
mov bl, al
shr bl, cl
movzx ecx, byte [esp + 0x13]
or dl, bl
mov byte [edi + 1], dl
movzx edx, byte [esi + 3]
shr dl, cl
mov ecx, dword [esp + 0x14]
shl al, cl
add esi, 4
add edi, 4
or dl, al
sub ebp, 1
mov byte [edi - 2], dl
jne 0x100225a8
pop ebp
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100d6528
add esp, 0x34
ret
Function at 0x10022720
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.100d6420
mov eax, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [eax]
test esi, esi
push edi
mov edi, dword [esp + 0x28]
je 0x1002276d
test ebx, ebx
je 0x1002276d
mov cl, byte [esi + edi]
mov ebp, dword [esp + 0x18]
xor cl, byte [ebp]
mov eax, dword [esp + 0x1c]
mov byte [eax], cl
add eax, 1
add ebp, 1
add esi, 1
sub ebx, 1
and esi, 0xf
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebp
jne 0x10022740
cmp ebx, 0x10
jb 0x100227ec
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, edx
sub eax, edi
mov dword [esp + 0x20], eax
mov eax, ebx
shr eax, 4
mov ebp, ecx
mov dword [esp + 0x10], eax
shl eax, 4
add ecx, eax
sub ebp, edi
add edx, eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov edi, edi
mov edx, dword [esp + 0x24]
push edx
push edi
push edi
call dword [esp + 0x3c]
add esp, 0xc
cmp esi, 0x10
jae 0x100227d8
mov ecx, 0xf
sub ecx, esi
shr ecx, 2
lea eax, [esi + edi]
add ecx, 1
mov edx, dword [esp + 0x20]
mov edx, dword [edx + eax]
xor edx, dword [eax]
add eax, 4
sub ecx, 1
mov dword [eax + ebp - 4], edx
jne 0x100227c3
add dword [esp + 0x20], 0x10
sub ebx, 0x10
add ebp, 0x10
xor esi, esi
sub dword [esp + 0x10], 1
jne 0x100227a0
test ebx, ebx
je 0x1002282e
mov eax, dword [esp + 0x24]
push eax
push edi
push edi
call dword [esp + 0x3c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
add esp, 0xc
lea eax, [esi + edi]
sub ebp, edi
sub ecx, edi
add esi, ebx
nop
mov dl, byte [eax + ebp]
xor dl, byte [eax]
sub ebx, 1
mov byte [eax + ecx], dl
add eax, 1
test ebx, ebx
jne 0x10022810
mov eax, dword [esp + 0x2c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x2c]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10022fb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.100d6420
xor eax, eax
push ebx
mov ebx, dword [esp + 0x18]
cmp ebx, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x16c], eax
mov dword [esi + 0x168], eax
jne 0x1002301c
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov byte [esi + 0xf], 1
mov ebx, 1
jmp 0x1002314c
cmp ebx, 0x10
mov ecx, ebx
push edi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
jb 0x1002309b
mov edi, dword [esp + 0x1c]
mov eax, ebx
sub edi, esi
shr eax, 4
mov dword [esp + 0x18], eax
push ebp
lea esp, [esp]
mov ecx, dword [esp + 0x20]
add ecx, 2
mov eax, esi
mov ebp, 4
mov edi, edi
movzx edx, byte [edi + eax]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
sub ebp, 1
jne 0x10023050
lea eax, [esi + 0x60]
push eax
push esi
call fcn.10022b80
add dword [esp + 0x28], 0x10
add esp, 8
add edi, 0x10
sub ebx, 0x10
sub dword [esp + 0x1c], 1
jne 0x10023040
mov ecx, dword [esp + 0x10]
xor eax, eax
pop ebp
cmp ebx, eax
je 0x100230ce
jbe 0x100230bd
mov ecx, dword [esp + 0x1c]
mov eax, esi
sub ecx, esi
mov edi, ebx
jmp 0x100230b0
mov dl, byte [eax + ecx]
xor byte [eax], dl
add eax, 1
sub edi, 1
jne 0x100230b0
lea eax, [esi + 0x60]
push eax
push esi
call fcn.10022b80
mov ecx, dword [esp + 0x14]
add esp, 8
mov eax, dword [esp + 0x10]
shld eax, ecx, 3
mov edx, eax
shr edx, 0x18
xor byte [esi + 8], dl
mov edx, eax
shr edx, 0x10
xor byte [esi + 9], dl
mov edx, eax
shr edx, 8
xor byte [esi + 0xa], dl
add ecx, ecx
mov edx, eax
xor byte [esi + 0xb], dl
add ecx, ecx
add ecx, ecx
xor byte [esi + 0xf], cl
mov edi, eax
mov edx, ecx
shrd edx, edi, 0x18
xor byte [esi + 0xc], dl
shr edi, 0x18
mov edi, eax
mov edx, ecx
shrd edx, edi, 0x10
xor byte [esi + 0xd], dl
mov edx, ecx
shrd edx, eax, 8
xor byte [esi + 0xe], dl
shr eax, 8
lea eax, [esi + 0x60]
push eax
push esi
shr edi, 0x10
call fcn.10022b80
movzx ecx, byte [esi + 0xe]
movzx edx, byte [esi + 0xf]
xor ebx, ebx
mov bh, byte [esi + 0xc]
add esp, 8
pop edi
mov bl, byte [esi + 0xd]
shl ebx, 8
or ebx, ecx
shl ebx, 8
or ebx, edx
mov eax, dword [esi + 0x174]
mov edx, dword [esi + 0x170]
push eax
lea ecx, [esi + 0x20]
push ecx
push esi
call edx
add ebx, 1
mov eax, ebx
mov ecx, ebx
add esp, 0xc
mov edx, ebx
shr eax, 0x18
shr ecx, 0x10
shr edx, 8
mov byte [esi + 0xf], bl
mov byte [esi + 0xc], al
mov byte [esi + 0xd], cl
mov byte [esi + 0xe], dl
pop esi
pop ebx
add esp, 8
ret
Function at 0x10023190
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x38]
or eax, dword [esi + 0x3c]
je 0x100231a4
mov eax, 0xfffffffe
pop esi
ret
push ebx
mov ebx, dword [esp + 0x14]
xor eax, eax
mov ecx, ebx
add ecx, dword [esi + 0x30]
adc eax, dword [esi + 0x34]
cmp eax, 0x20000000
ja 0x1002325c
jb 0x100231c8
test ecx, ecx
ja 0x1002325c
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esi + 0x16c]
test edi, edi
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
je 0x1002320f
mov edi, edi
test ebx, ebx
je 0x100231fb
mov cl, byte [ebp]
xor byte [edi + esi + 0x40], cl
add edi, 1
add ebp, 1
sub ebx, 1
and edi, 0xf
jne 0x100231e0
jmp 0x100231ff
test edi, edi
jne 0x1002324f
lea edx, [esi + 0x60]
push edx
lea eax, [esi + 0x40]
push eax
call fcn.10022b80
add esp, 8
mov eax, ebx
and eax, 0xfffffff0
mov dword [esp + 0x14], eax
je 0x10023235
push eax
lea ecx, [esi + 0x60]
push ecx
lea edx, [esi + 0x40]
push edx
mov ecx, ebp
call fcn.10022d00
mov eax, dword [esp + 0x20]
add esp, 0xc
add ebp, eax
sub ebx, eax
test ebx, ebx
je 0x1002324f
xor eax, eax
test ebx, ebx
mov edi, ebx
jbe 0x1002324f
mov cl, byte [eax + ebp]
xor byte [esi + eax + 0x40], cl
add eax, 1
cmp eax, ebx
jb 0x10023241
mov dword [esi + 0x16c], edi
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret
pop ebx
or eax, 0xffffffff
pop esi
ret
Function at 0x100246c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x30
call fcn.100d6420
mov eax, dword [0x10151618]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x44]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
mov bl, byte [esi]
test bl, 0x40
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x28]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x2c]
mov dword [esp + 0x24], edx
mov byte [esp + 0xf], bl
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
jne 0x10024718
push ecx
lea ecx, [esi + 0x10]
push ecx
push esi
call eax
add esp, 0xc
movzx eax, bl
and eax, 7
mov ebx, 0xf
sub ebx, eax
mov byte [esi], al
mov eax, ebx
xor ecx, ecx
cmp eax, 0xf
mov dword [esp + 0x20], ebx
jae 0x10024749
movzx edx, byte [esi + eax]
or ecx, edx
mov byte [esi + eax], 0
add eax, 1
shl ecx, 8
cmp eax, 0xf
jb 0x10024734
movzx eax, byte [esi + 0xf]
mov ebp, dword [esp + 0x4c]
or ecx, eax
cmp ecx, ebp
mov byte [esi + 0xf], 1
je 0x10024770
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100d6528
add esp, 0x30
ret
push edi
mov edi, ebp
shr edi, 4
je 0x100247af
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
lea ecx, [esi + 0x10]
push ecx
mov ecx, dword [esp + 0x20]
push esi
push edx
push edi
push eax
push ecx
call dword [esp + 0x40]
shl edi, 4
mov edx, edi
add dword [esp + 0x34], edx
add dword [esp + 0x30], edx
add esp, 0x18
sub ebp, edx
je 0x1002480c
shr edx, 4
mov ecx, esi
call fcn.10024470
test ebp, ebp
je 0x1002480c
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x30]
push eax
push esi
call dword [esp + 0x2c]
add esp, 0xc
xor eax, eax
test ebp, ebp
jbe 0x100247fb
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
lea ecx, [esp + 0x2c]
mov edx, ecx
sub edi, ecx
sub ebx, edx
lea ecx, [ecx]
lea edx, [esp + eax + 0x2c]
mov cl, byte [edi + edx]
xor cl, byte [edx]
add eax, 1
mov byte [ebx + edx], cl
xor byte [esi + eax + 0xf], cl
cmp eax, ebp
jb 0x100247e0
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
lea eax, [esi + 0x10]
push ecx
push eax
push eax
call dword [esp + 0x2c]
add esp, 0xc
cmp ebx, 0x10
pop edi
jae 0x10024828
mov edx, 0x10
sub edx, ebx
push edx
lea eax, [esi + ebx]
push 0
push eax
call fcn.100d7a80
add esp, 0xc
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
push ecx
push esi
call dword [esp + 0x28]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
xor dword [esi + 0x14], eax
xor dword [esi + 0x10], edx
mov ecx, dword [esp + 0x3c]
xor dword [esi + 0x18], ecx
mov al, byte [esp + 0x1b]
mov edx, dword [esp + 0x40]
xor dword [esi + 0x1c], edx
mov ecx, dword [esp + 0x44]
add esp, 0xc
mov byte [esi], al
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.100d6528
add esp, 0x30
ret
Function at 0x10027d70
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
mov edx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
add ecx, 0xffffffff
push edi
mov edi, dword [esi + 4]
shr ecx, 0x1f
xor edx, edi
sub ecx, 1
and edx, ecx
xor edi, edx
mov dword [esi + 4], edi
xor dword [eax + 4], edx
lea edx, [ebx - 1]
cmp edx, 9
ja case.default.0x10027da6
jmp dword [edx*4 + 0x10027ed0]
mov edi, 0xa
cmp ebx, edi
jle case.0x10027da6.10
push ebp
mov edx, dword [esi]
mov ebx, dword [edx + edi*4]
lea ebp, [edx + edi*4]
mov edx, dword [eax]
mov edx, dword [edx + edi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
xor dword [ebx + edi*4], edx
lea ebx, [ebx + edi*4]
add edi, 1
cmp edi, dword [esp + 0x20]
jl 0x10027db7
pop ebp
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x24]
mov edx, dword [edx + 0x24]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x24], edi
mov edi, dword [eax]
xor dword [edi + 0x24], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x20]
mov edx, dword [edx + 0x20]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x20], edi
mov edi, dword [eax]
xor dword [edi + 0x20], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x1c]
mov edx, dword [edx + 0x1c]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x1c], edi
mov edi, dword [eax]
xor dword [edi + 0x1c], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x18]
mov edx, dword [edx + 0x18]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x18], edi
mov edi, dword [eax]
xor dword [edi + 0x18], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x14]
mov edx, dword [edx + 0x14]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x14], edi
mov edi, dword [eax]
xor dword [edi + 0x14], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x10]
mov edx, dword [edx + 0x10]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x10], edi
mov edi, dword [eax]
xor dword [edi + 0x10], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0xc]
mov edx, dword [edx + 0xc]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0xc], edi
mov edi, dword [eax]
xor dword [edi + 0xc], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 8]
mov edx, dword [edx + 8]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 8], edi
mov edi, dword [eax]
xor dword [edi + 8], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 4]
mov edx, dword [edx + 4]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 4], edi
mov edi, dword [eax]
xor dword [edi + 4], edx
mov esi, dword [esi]
mov edx, dword [eax]
mov edi, dword [esi]
mov edx, dword [edx]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [esi], edi
mov eax, dword [eax]
xor dword [eax], edx
pop edi
pop esi
pop ebx
ret
Function at 0x1002fc90
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x1002fca9
mov esi, ebx
mov ebx, eax
jmp 0x1002fcab
mov esi, eax
mov eax, dword [esi + 4]
mov edi, dword [esp + 0x10]
cmp eax, dword [edi + 8]
jg 0x1002fcbb
mov eax, edi
jmp 0x1002fcc5
push eax
push edi
call sym.LIBEAY32.dll_bn_expand2
add esp, 8
test eax, eax
jne 0x1002fccd
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x1002fceb
mov edx, dword [esi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [edi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [ebx + 4]
jl 0x1002fcd4
cmp eax, dword [esi + 4]
jge 0x1002fd02
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [edi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [esi + 4]
jl 0x1002fcf0
mov eax, dword [esi + 4]
test eax, eax
mov dword [edi + 4], eax
jle 0x1002fd25
mov ecx, dword [edi]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x1002fd22
sub eax, 1
test eax, eax
jg 0x1002fd12
mov dword [edi + 4], eax
cmp dword [edi + 4], 0
jne 0x1002fd32
mov dword [edi + 0xc], 0
pop edi
pop esi
mov eax, 1
pop ebx
ret