joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100189c0
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, 8
call fcn.100bff40
push ebx
mov ebx, dword [esp + 0x10]
push esi
push 0x1048
push 0x100c2b18
push ebx
call sub.MSVCR90.dll_memcpy
mov ecx, dword [esp + 0x24]
add esp, 0xc
cmp ecx, 0x48
jle 0x100189f1
mov ecx, 0x48
push edi
mov edi, dword [esp + 0x20]
mov eax, edi
add ecx, edi
lea esi, [ebx + 8]
mov dword [esp + 0x18], 6
push ebp
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x10018a10
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x10018a1f
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x10018a2e
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x10018a3d
mov eax, edi
xor dword [esi - 8], edx
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x10018a4a
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x10018a59
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x10018a68
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x10018a77
mov eax, edi
xor dword [esi - 4], edx
movzx edx, byte [eax]
inc eax
cmp eax, ecx
jb 0x10018a84
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x10018a93
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x10018aa2
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
inc eax
or edx, ebp
cmp eax, ecx
jb 0x10018ab1
mov eax, edi
xor dword [esi], edx
add esi, 0xc
sub dword [esp + 0x1c], 1
jne 0x10018a06
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
xor esi, esi
pop ebp
mov edi, edi
lea eax, [esp + 0xc]
push ebx
push eax
call sym.LIBEAY32.dll_BF_encrypt
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [ebx + esi*4], ecx
mov dword [ebx + esi*4 + 4], edx
add esi, 2
add esp, 8
cmp esi, 0x12
jl 0x10018ad0
xor esi, esi
pop edi
lea eax, [esp + 8]
push ebx
push eax
call sym.LIBEAY32.dll_BF_encrypt
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [ebx + esi*4 + 0x48], ecx
mov dword [ebx + esi*4 + 0x4c], edx
add esi, 2
add esp, 8
cmp esi, 0x400
jl 0x10018af8
pop esi
pop ebx
add esp, 8
ret
Function at 0x10019480
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x1001956a
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x100194fd
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym.LIBEAY32.dll_BF_encrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x100194c3
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x10019633
call 0x1001950f
pop edx
lea ecx, [edx + 0x171]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x100195ca
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym.LIBEAY32.dll_BF_decrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1001957b
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x10019633
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym.LIBEAY32.dll_BF_decrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x1001962e
jmp 0x10019633
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100198c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.100bff40
mov eax, dword [0x10116c70]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x4c]
movzx edx, byte [edi + 1]
mov dword [esp + 0x18], ecx
movzx ecx, byte [edi]
lea eax, [edi + 1]
mov dword [esp + 0x28], eax
inc eax
inc eax
shl edx, 0x10
shl ecx, 0x18
or ecx, edx
movzx edx, byte [eax - 1]
inc eax
movzx ebx, byte [eax + 1]
shl edx, 8
inc eax
or ecx, edx
movzx edx, byte [eax - 2]
or ecx, edx
movzx edx, byte [eax - 1]
inc eax
shl ebx, 0x10
shl edx, 0x18
or edx, ebx
movzx ebx, byte [eax]
movzx eax, byte [eax + 1]
shl ebx, 8
or ebx, eax
mov ebp, dword [esp + 0x40]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x2d], al
or edx, ebx
mov eax, ecx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
cmp dword [esp + 0x44], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov byte [esp + 0x2f], cl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
je 0x10019a8c
mov ebx, dword [esp + 0x3c]
dec dword [esp + 0x18]
test esi, esi
jne 0x10019a04
mov ecx, dword [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
call sym.LIBEAY32.dll_BF_encrypt
mov ecx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x34], al
mov edx, ecx
shr edx, 0x10
mov eax, ecx
shr eax, 8
mov byte [esp + 0x36], al
mov byte [esp + 0x35], dl
mov edx, dword [esp + 0x28]
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x38], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x39], al
mov eax, edx
shr eax, 8
add esp, 8
inc dword [esp + 0x10]
mov byte [esp + 0x2f], cl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
xor al, byte [ebx]
inc esi
mov byte [ebp], al
inc ebp
inc ebx
and esi, 7
cmp dword [esp + 0x18], 0
jne 0x100199a0
cmp dword [esp + 0x10], 0
je 0x10019a73
mov eax, ecx
shr eax, 0x18
mov byte [edi], al
mov eax, dword [esp + 0x28]
mov ebx, ecx
shr ebx, 0x10
mov byte [eax], bl
mov ebx, ecx
inc eax
shr ebx, 8
mov byte [eax], bl
mov byte [eax + 1], cl
inc eax
inc eax
mov ecx, edx
shr ecx, 0x18
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
mov byte [eax], cl
inc eax
mov ecx, edx
shr ecx, 8
mov byte [eax], cl
mov byte [eax + 1], dl
mov edx, dword [esp + 0x14]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100bff70
add esp, 0x28
ret
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100bff70
add esp, 0x28
ret
mov ecx, dword [esp + 0x14]
pop edi
mov dword [ecx], esi
mov ecx, dword [esp + 0x30]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100bff70
add esp, 0x28
ret
Function at 0x1001b890
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x1001b97a
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x1001b90d
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym.LIBEAY32.dll_CAST_encrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1001b8d3
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x1001ba43
call 0x1001b91f
pop edx
lea ecx, [edx + 0x161]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x1001b9da
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym.LIBEAY32.dll_CAST_decrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1001b98b
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x1001ba43
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym.LIBEAY32.dll_CAST_decrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x1001ba3e
jmp 0x1001ba43
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1001bcc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.100bff40
mov eax, dword [0x10116c70]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x4c]
movzx edx, byte [edi + 1]
mov dword [esp + 0x18], ecx
movzx ecx, byte [edi]
lea eax, [edi + 1]
mov dword [esp + 0x28], eax
inc eax
inc eax
shl edx, 0x10
shl ecx, 0x18
or ecx, edx
movzx edx, byte [eax - 1]
inc eax
movzx ebx, byte [eax + 1]
shl edx, 8
inc eax
or ecx, edx
movzx edx, byte [eax - 2]
or ecx, edx
movzx edx, byte [eax - 1]
inc eax
shl ebx, 0x10
shl edx, 0x18
or edx, ebx
movzx ebx, byte [eax]
movzx eax, byte [eax + 1]
shl ebx, 8
or ebx, eax
mov ebp, dword [esp + 0x40]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x2d], al
or edx, ebx
mov eax, ecx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
cmp dword [esp + 0x44], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov byte [esp + 0x2f], cl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
je 0x1001be8c
mov ebx, dword [esp + 0x3c]
dec dword [esp + 0x18]
test esi, esi
jne 0x1001be04
mov ecx, dword [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
call sym.LIBEAY32.dll_CAST_encrypt
mov ecx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x34], al
mov edx, ecx
shr edx, 0x10
mov eax, ecx
shr eax, 8
mov byte [esp + 0x36], al
mov byte [esp + 0x35], dl
mov edx, dword [esp + 0x28]
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x38], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x39], al
mov eax, edx
shr eax, 8
add esp, 8
inc dword [esp + 0x10]
mov byte [esp + 0x2f], cl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
xor al, byte [ebx]
inc esi
mov byte [ebp], al
inc ebp
inc ebx
and esi, 7
cmp dword [esp + 0x18], 0
jne 0x1001bda0
cmp dword [esp + 0x10], 0
je 0x1001be73
mov eax, ecx
shr eax, 0x18
mov byte [edi], al
mov eax, dword [esp + 0x28]
mov ebx, ecx
shr ebx, 0x10
mov byte [eax], bl
mov ebx, ecx
inc eax
shr ebx, 8
mov byte [eax], bl
mov byte [eax + 1], cl
inc eax
inc eax
mov ecx, edx
shr ecx, 0x18
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
mov byte [eax], cl
inc eax
mov ecx, edx
shr ecx, 8
mov byte [eax], cl
mov byte [eax + 1], dl
mov edx, dword [esp + 0x14]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100bff70
add esp, 0x28
ret
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.100bff70
add esp, 0x28
ret
mov ecx, dword [esp + 0x14]
pop edi
mov dword [ecx], esi
mov ecx, dword [esp + 0x30]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100bff70
add esp, 0x28
ret
Function at 0x1001d1e0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x1001d200
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x10027d50
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.100bff40
mov eax, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x24]
push ebp
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x2c]
mov ebp, eax
cmp ebx, 0x10
jb 0x10027dcd
shr ebx, 4
mov dword [esp + 0x10], ebx
lea esp, [esp]
mov ecx, edi
sub ebp, esi
mov eax, esi
sub ecx, esi
mov edx, 4
lea ecx, [ecx]
mov ebx, dword [eax + ebp]
xor ebx, dword [eax]
add eax, 4
sub edx, 1
mov dword [ecx + eax - 4], ebx
jne 0x10027d90
mov eax, dword [esp + 0x34]
push eax
push edi
push edi
call dword [esp + 0x48]
mov ebx, dword [esp + 0x3c]
mov ebp, edi
sub ebx, 0x10
add esp, 0xc
add esi, 0x10
add edi, 0x10
sub dword [esp + 0x10], 1
mov dword [esp + 0x30], ebx
jne 0x10027d80
mov eax, dword [esp + 0x38]
test ebx, ebx
je 0x10027ecc
mov ecx, edi
sub ecx, esi
mov dword [esp + 0x14], ecx
mov ecx, 1
sub ecx, esi
mov dword [esp + 0x18], ecx
mov ecx, 2
sub ecx, esi
mov dword [esp + 0x1c], ecx
mov edx, ebp
sub edx, esi
mov ecx, 3
xor eax, eax
sub ecx, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x20], ecx
jmp 0x10027e14
mov edx, dword [esp + 0x10]
cmp eax, ebx
jae 0x10027e82
mov ebx, dword [esp + 0x14]
lea ecx, [eax + esi]
mov dl, byte [edx + ecx]
xor dl, byte [ecx]
mov byte [ebx + ecx], dl
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x30]
add edx, ecx
cmp edx, ebx
jae 0x10027e77
mov dl, byte [eax + ebp + 1]
xor dl, byte [eax + esi + 1]
mov byte [eax + edi + 1], dl
mov edx, dword [esp + 0x1c]
add edx, ecx
cmp edx, ebx
jae 0x10027e7a
mov dl, byte [eax + esi + 2]
xor dl, byte [eax + ebp + 2]
mov byte [eax + edi + 2], dl
mov edx, dword [esp + 0x20]
add edx, ecx
cmp edx, ebx
jae 0x10027e7f
mov cl, byte [eax + ebp + 3]
xor cl, byte [eax + esi + 3]
add eax, 4
mov byte [eax + edi - 1], cl
cmp eax, 0x10
jb 0x10027e10
jmp 0x10027e9e
inc eax
jmp 0x10027e82
add eax, 2
jmp 0x10027e82
add eax, 3
cmp eax, 0x10
jae 0x10027e9e
mov edx, 0x10
sub ebp, edi
lea ecx, [eax + edi]
sub edx, eax
mov al, byte [ecx + ebp]
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10027e93
mov ecx, dword [esp + 0x34]
push ecx
push edi
push edi
call dword [esp + 0x48]
add esp, 0xc
mov ebp, edi
cmp ebx, 0x10
jbe 0x10027ec8
sub ebx, 0x10
add esi, 0x10
add edi, 0x10
mov dword [esp + 0x30], ebx
test ebx, ebx
jne 0x10027dd5
mov eax, dword [esp + 0x38]
mov edx, dword [ebp]
mov dword [eax], edx
mov ecx, dword [ebp + 4]
mov dword [eax + 4], ecx
mov edx, dword [ebp + 8]
pop edi
mov dword [eax + 8], edx
mov ecx, dword [ebp + 0xc]
pop esi
pop ebp
mov dword [eax + 0xc], ecx
pop ebx
add esp, 0x14
ret
Function at 0x100281b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.100bff40
mov eax, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x2c]
test esi, esi
je 0x100281f5
test ebx, ebx
je 0x100281f5
mov cl, byte [esi + edi]
mov ebp, dword [esp + 0x18]
xor cl, byte [ebp]
mov eax, dword [esp + 0x1c]
mov byte [eax], cl
inc eax
inc ebp
inc esi
dec ebx
and esi, 0xf
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebp
jne 0x100281d0
cmp ebx, 0x10
jb 0x10028289
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, edx
sub eax, edi
mov dword [esp + 0x20], eax
mov eax, ebx
shr eax, 4
mov ebp, ecx
mov dword [esp + 0x10], eax
shl eax, 4
add ecx, eax
sub ebp, edi
add edx, eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
lea ebx, [ebx]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
push edx
push edi
push eax
call dword [esp + 0x40]
mov edx, dword [esp + 0x34]
add esp, 0xc
call fcn.10028190
cmp esi, 0x10
jae 0x10028275
mov ecx, 0xf
sub ecx, esi
shr ecx, 2
lea eax, [esi + edi]
inc ecx
mov edi, edi
mov edx, dword [esp + 0x20]
mov edx, dword [edx + eax]
xor edx, dword [eax]
add eax, 4
sub ecx, 1
mov dword [eax + ebp - 4], edx
jne 0x10028260
add dword [esp + 0x20], 0x10
sub ebx, 0x10
add ebp, 0x10
xor esi, esi
sub dword [esp + 0x10], 1
jne 0x10028230
test ebx, ebx
je 0x100282d1
mov eax, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
push eax
push edi
push ebp
call dword [esp + 0x40]
add esp, 0xc
mov edx, ebp
call fcn.10028190
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
lea eax, [esi + edi]
sub ebp, edi
sub ecx, edi
add esi, ebx
mov dl, byte [eax + ebp]
xor dl, byte [eax]
dec ebx
mov byte [eax + ecx], dl
inc eax
test ebx, ebx
jne 0x100282b7
mov eax, dword [esp + 0x30]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x30]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100282e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.100bff40
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x1002832c
test ebp, ebp
je 0x1002832c
mov ecx, dword [esp + 0x2c]
mov dl, byte [eax + ecx]
mov esi, dword [esp + 0x18]
xor dl, byte [esi]
mov ecx, dword [esp + 0x1c]
mov byte [ecx], dl
inc ecx
inc esi
inc eax
dec ebp
and eax, 0xf
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], eax
jne 0x10028300
mov edi, dword [esp + 0x28]
mov esi, dword [edi + 0xc]
bswap esi
cmp ebp, 0x10
jb 0x1002839d
lea ebx, [ebx]
mov ebx, ebp
shr ebx, 4
add esi, ebx
cmp esi, ebx
jae 0x1002834f
sub ebx, esi
xor esi, esi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push edi
push eax
push ebx
push ecx
push edx
call dword [esp + 0x48]
mov eax, esi
add esp, 0x14
bswap eax
mov dword [edi + 0xc], eax
test esi, esi
jne 0x10028387
mov ecx, 0xc
mov al, byte [ecx + edi - 1]
dec ecx
add al, 1
mov byte [ecx + edi], al
jne 0x10028387
test ecx, ecx
jne 0x10028377
shl ebx, 4
add dword [esp + 0x1c], ebx
add dword [esp + 0x18], ebx
sub ebp, ebx
cmp ebp, 0x10
jae 0x10028340
mov eax, dword [esp + 0x10]
test ebp, ebp
je 0x10028411
mov ebx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
push edi
push ecx
xor eax, eax
mov dword [ebx], eax
push 1
mov dword [ebx + 4], eax
push ebx
mov dword [ebx + 8], eax
push ebx
mov dword [ebx + 0xc], eax
call dword [esp + 0x48]
add esp, 0x14
add esi, 1
bswap esi
mov dword [edi + 0xc], esi
jne 0x100283e2
mov ecx, 0xc
mov al, byte [ecx + edi - 1]
dec ecx
add al, 1
mov byte [ecx + edi], al
jne 0x100283e2
test ecx, ecx
jne 0x100283d2
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
lea eax, [edi + ebx]
sub ecx, ebx
sub esi, ebx
add edi, ebp
mov dl, byte [ecx + eax]
xor dl, byte [eax]
dec ebp
mov byte [esi + eax], dl
inc eax
test ebp, ebp
jne 0x100283f7
mov eax, dword [esp + 0x30]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
pop ebx
pop ecx
ret