joyce8/EMBER2024-capa huggingface dataset:
Function at 0x16db00
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
push esi
mov esi, dword [esp + 8]
je 0x16db33
mov edx, dword [esi + 0x934]
push edi
mov edi, dword [esi + 0x30]
jmp 0x16db20
mov eax, dword [edx + 0x400b10]
mov ecx, dword [edi]
shl ecx, 2
xor ecx, eax
test cl, 0x7c
jne 0x16db20
pop edi
mov edx, dword [esi + 0x1c20]
mov eax, dword [edx + 0x44]
mov ecx, dword [esi + 0x24]
or eax, 0x80000000
cmp eax, ecx
jb 0x16db4d
cmp eax, dword [esi + 0x28]
jb 0x16db77
mov eax, dword [esi + 0x30]
mov eax, dword [eax]
mov ecx, dword [esi + 0x2c]
add eax, 2
cmp eax, ecx
jne 0x16db62
mov eax, dword [esi]
pop esi
ret 8
call fcn.0016d980
test eax, eax
je 0x16db72
mov eax, dword [eax + 4]
pop esi
ret 8
mov eax, dword [esi]
add eax, 4
pop esi
ret 8
Function at 0x17d211
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x1054]
imul esi, dword [edx + 0x1048]
add esi, ebx
cmp ebx, esi
push edi
mov edi, dword [eax + 0x18]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], esi
jae 0x17d36a
push ebp
mov ebp, 0xffc03fc0
mov eax, dword [edx + 0x1048]
mov edx, dword [edx + 0x1050]
lea edx, [ebx + edx*4]
add eax, ebx
cmp ebx, edx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], edx
jae 0x17d345
mov esi, dword [ebx + 4]
mov edx, dword [eax + 4]
mov edi, dword [eax]
mov eax, dword [ebx]
mov ecx, eax
shr ecx, 2
and ecx, ebp
mov ebx, edi
shr ebx, 2
and ebx, ebp
add ecx, ebx
mov ebx, esi
shr ebx, 2
and ebx, ebp
add ecx, ebx
mov ebx, edx
shr ebx, 2
and ebx, ebp
lea ebx, [ecx + ebx - 0x7fff80]
mov ecx, eax
and ecx, 0xff00ff
mov ebp, edi
and ebp, 0xff00ff
add ecx, ebp
mov ebp, esi
and ebp, 0xff00ff
add ecx, ebp
mov ebp, edx
and ebp, 0xff00ff
lea ecx, [ecx + ebp + 0x20002]
shr eax, 2
shr ecx, 2
xor ebx, ecx
mov ecx, 0x3fc03fc0
and eax, ecx
shr edi, 2
and edi, ecx
add eax, edi
shr esi, 2
and esi, ecx
add eax, esi
shr edx, 2
and ebx, 0xff00ff
and edx, ecx
lea eax, [eax + edx + 0x800080]
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 4
mov dword [eax], ebx
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
add ebx, 8
add eax, 8
cmp ebx, dword [esp + 0x24]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], eax
mov ebp, 0xffc03fc0
jb 0x17d278
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov eax, dword [ecx + 4]
add edi, dword [eax + 0x1048]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1048]
lea ebx, [ebx + eax*2]
cmp ebx, esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], ebx
jb 0x17d24f
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret
Function at 0x17d48e
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
push ebx
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [ecx]
mov ebx, dword [eax + 0x18]
push esi
mov esi, dword [eax + 0x1054]
imul esi, dword [eax + 0x1048]
add esi, ebx
cmp ebx, esi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x2c], esi
jae 0x17d5d7
mov edx, 0xf81f
push edi
mov edi, dword [eax + 0x1048]
mov eax, dword [eax + 0x1050]
lea eax, [ebx + eax*2]
add edi, ebx
cmp ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x28], eax
jae 0x17d5b2
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff07e0
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x1002]
mov ebp, eax
and ebp, 0xffff07e0
add ebp, ecx
mov ecx, edi
and ecx, 0xffff07e0
add ebp, ecx
mov ecx, esi
and ecx, 0xffff07e0
shr ebx, 2
lea ecx, [ecx + ebp + 0x40]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x18]
and esi, edx
and ebx, 0xffff07e0
lea eax, [eax + esi + 0x1002]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x14]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x17d4f5
mov ecx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x30]
mov eax, dword [ecx + 4]
add ebp, dword [eax + 0x1048]
mov eax, dword [ecx]
mov edi, dword [eax + 0x1048]
lea ebx, [ebx + edi*2]
cmp ebx, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebx
jb 0x17d4cc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
Function at 0x17d708
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [edx + 0x18]
push ebp
mov ebp, dword [eax + 0x18]
push esi
mov esi, dword [edx + 0x1054]
imul esi, dword [edx + 0x1048]
add esi, ebx
cmp ebx, esi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x2c], esi
jae 0x17d850
mov eax, 0x83e0
push edi
mov edi, dword [edx + 0x1048]
mov edx, dword [edx + 0x1050]
lea edx, [ebx + edx*2]
add edi, ebx
cmp ebx, edx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x28], edx
jae 0x17d82b
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx edx, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
and ebp, eax
mov ebx, edx
and ebx, eax
add ebx, ebp
mov ebp, edi
and ebp, eax
add ebx, ebp
mov dword [esp + 0x24], ecx
and ecx, 0x7c1f
mov ebp, esi
and ebp, eax
lea ebx, [ebx + ebp + 0x10040]
mov ebp, edx
and ebp, 0x7c1f
add ebp, ecx
mov ecx, edi
and ecx, 0x7c1f
add ebp, ecx
mov ecx, esi
and ecx, 0x7c1f
lea ecx, [ecx + ebp + 0x802]
shr ecx, 2
shr ebx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and ecx, eax
and edx, eax
add edx, ecx
and edi, eax
add edx, edi
mov edi, dword [esp + 0x18]
and esi, eax
and ebx, 0xffff7c1f
lea ecx, [edx + esi + 0x10040]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [ecx], bx
mov ebx, dword [esp + 0x14]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x17d76f
mov ecx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1048]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1048]
lea ebx, [ebx + edi*2]
cmp ebx, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebx
jb 0x17d746
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
Function at 0x17d859
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
push ebx
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [ecx]
mov ebx, dword [eax + 0x18]
push esi
mov esi, dword [eax + 0x1054]
imul esi, dword [eax + 0x1048]
add esi, ebx
cmp ebx, esi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x2c], esi
jae 0x17d9a5
mov edx, 0xf0f0
push edi
mov edi, dword [eax + 0x1048]
mov eax, dword [eax + 0x1050]
lea eax, [ebx + eax*2]
add edi, ebx
cmp ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x28], eax
jae 0x17d980
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff0f0f
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x2020]
mov ebp, eax
and ebp, 0xffff0f0f
add ebp, ecx
mov ecx, edi
and ecx, 0xffff0f0f
add ebp, ecx
mov ecx, esi
and ecx, 0xffff0f0f
shr ebx, 2
lea ecx, [ecx + ebp + 0x202]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x18]
and esi, edx
and ebx, 0xffff0f0f
lea eax, [eax + esi + 0x2020]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x14]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x17d8c0
mov ecx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x30]
mov eax, dword [ecx + 4]
add ebp, dword [eax + 0x1048]
mov eax, dword [ecx]
mov edi, dword [eax + 0x1048]
lea ebx, [ebx + edi*2]
cmp ebx, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebx
jb 0x17d897
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
Function at 0x17da4a
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
push ebx
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [ecx]
mov ebx, dword [eax + 0x18]
push edi
mov edi, dword [eax + 0x1054]
imul edi, dword [eax + 0x1048]
add edi, ebx
cmp ebx, edi
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], edi
jae 0x17db8e
push esi
mov esi, 0xff00
mov edx, dword [eax + 0x1048]
mov eax, dword [eax + 0x1050]
lea eax, [ebx + eax*2]
add edx, ebx
cmp ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x28], eax
jae 0x17db69
movzx eax, word [edx + 2]
movzx ebp, word [edx]
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
mov dword [esp + 0x14], edx
mov ebx, eax
mov ecx, 0xff
and dx, cx
and bx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 2]
mov ebx, dword [esp + 0x14]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x200]
mov ebx, dword [esp + 0x18]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x14]
and ecx, esi
add eax, ecx
add eax, ebp
lea eax, [eax + edi + 0x200]
shr eax, 2
and edx, 0xffff00ff
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], dx
mov edx, dword [esp + 0x1c]
add ebx, 4
add edx, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edx
jb 0x17dab1
mov ecx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov eax, dword [ecx + 4]
add ebp, dword [eax + 0x1048]
mov eax, dword [ecx]
mov edx, dword [eax + 0x1048]
lea ebx, [ebx + edx*2]
cmp ebx, edi
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebx
jb 0x17da88
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret

Function at 0x186a1c
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x186a49
push esi
call fcn.0018cbaf
cmp byte [esi + 0x40], 0
pop ecx
je 0x186a42
mov dword [esi + 0x10], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x186ab6
mov eax, dword [esi + 0x18c]
cmp byte [eax + 0x10], 0
je 0x186aab
mov eax, dword [esi + 8]
test eax, eax
je 0x186a6a
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x18c]
push esi
call dword [eax]
test eax, eax
pop ecx
je 0x186aa7
cmp eax, 2
je 0x186aab
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x186a5f
cmp eax, 3
je 0x186a8e
cmp eax, 1
jne 0x186a5f
inc dword [ecx + 4]
mov eax, dword [esi + 8]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax + 8]
jl 0x186a5f
mov ecx, dword [esi + 0x118]
add dword [eax + 8], ecx
jmp 0x186a5f
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
mov dword [esi + 0x84], eax
jmp 0x186ad4
cmp eax, 0xcc
je 0x186ad4
mov eax, dword [esi]
mov dword [eax + 0x14], 0x12
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.001868ef
pop esi
ret
Function at 0x1b4da1
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x5c]
sub esp, 0x140
mov edx, dword [ebp + 0x68]
cmp edx, 0x40
jbe 0x1b4db7
push 0x40
pop edx
push esi
mov esi, dword [ebp + 0x64]
push edi
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x94]
rep stosd dword es:[edi], eax
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea edi, [ebp - 0x94]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x64]
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
xor dword [ebp + eax - 0x94], 0x36363636
xor dword [ebp + eax - 0x54], 0x5c5c5c5c
add eax, 4
cmp eax, 0x40
jb 0x1b4e01
lea eax, [ebp - 0x14]
push eax
call fcn.001b40c5
push 0x40
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.001b4103
cmp dword [ebp + 0x70], 0
je 0x1b4e4c
push dword [ebp + 0x70]
lea eax, [ebp - 0x14]
push dword [ebp + 0x6c]
push eax
call fcn.001b4103
cmp dword [ebp + 0x78], 0
je 0x1b4e61
push dword [ebp + 0x78]
lea eax, [ebp - 0x14]
push dword [ebp + 0x74]
push eax
call fcn.001b4103
lea eax, [ebp - 0x14]
push eax
call fcn.001b4231
push 0x10
pop ecx
lea esi, [ebp - 0x54]
lea edi, [ebp - 0xe4]
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp + 0x48]
lea edi, [ebp - 0xa4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
movsd dword es:[edi], dword [esi]
call fcn.001b40c5
push 0x50
lea eax, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.001b4103
lea eax, [ebp - 0x14]
push eax
call fcn.001b4231
mov edi, dword [ebp + 0x7c]
lea esi, [ebp + 0x48]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov al, 1
pop esi
add ebp, 0x5c
leave
ret 0x1c
Function at 0x1bf5e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
imul eax, eax, 0xfffffffd
add dword [ebp + 8], eax
sar dword [ebp + 0x14], 2
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov ebx, eax
neg ebx
lea edi, [esi + eax*4]
add edi, eax
pxor mm7, mm7
movq mm6, qword [0x1c3458]
movq mm5, qword [0x1c3450]
movd mm0, dword [esi + ebx]
punpcklbw mm0, mm7
paddw mm0, mm0
movd mm1, dword [esi]
punpcklbw mm1, mm7
pmullw mm1, mm6
psubw mm0, mm1
movd mm1, dword [esi + eax]
punpcklbw mm1, mm7
movq mm2, mm1
pmullw mm1, mm6
paddw mm0, mm1
movd mm1, dword [esi + eax*2]
punpcklbw mm1, mm7
psubw mm0, mm1
psubw mm0, mm1
paddw mm0, mm5
psraw mm0, 3
paddw mm2, mm2
pmullw mm1, mm6
psubw mm2, mm1
movd mm1, dword [edi + ebx*2]
punpcklbw mm1, mm7
movq mm3, mm1
pmullw mm1, mm6
paddw mm1, mm2
movd mm2, dword [edi + ebx]
punpcklbw mm2, mm7
psubw mm1, mm2
psubw mm1, mm2
paddw mm1, mm5
psraw mm1, 3
paddw mm3, mm3
pmullw mm2, mm6
psubw mm3, mm2
movd mm2, dword [edi]
punpcklbw mm2, mm7
pmullw mm2, mm6
paddw mm2, mm3
movd mm3, dword [edi + eax]
punpcklbw mm3, mm7
psubw mm2, mm3
psubw mm2, mm3
paddw mm2, mm5
psraw mm2, 3
movq mm5, mm1
psraw mm5, 0x10
movq mm3, mm0
psraw mm3, 0x10
pxor mm0, mm3
psubw mm0, mm3
movq mm3, mm1
movq mm4, mm1
psraw mm3, 0x10
pxor mm4, mm3
psubw mm4, mm3
movq mm3, mm2
psraw mm3, 0x10
pxor mm2, mm3
psubw mm2, mm3
movq mm3, mm4
pcmpgtw mm3, mm0
pand mm0, mm3
pandn mm3, mm4
por mm0, mm3
movq mm3, mm2
pcmpgtw mm3, mm0
pand mm0, mm3
pandn mm3, mm2
por mm0, mm3
pxor mm0, mm5
psubw mm0, mm5
movd mm5, dword [ebp + 0x10]
punpcklwd mm5, mm5
punpckldq mm5, mm5
movq mm6, mm5
pcmpgtw mm6, mm4
psubw mm0, mm1
pmullw mm0, qword [0x1c3458]
movq mm5, mm0
psraw mm5, 0x10
pxor mm0, mm5
psubw mm0, mm5
psraw mm0, 3
pxor mm0, mm5
psubw mm0, mm5
movd mm3, dword [esi + eax*2]
punpcklbw mm3, mm7
movq mm4, mm3
movd mm2, dword [edi + ebx*2]
punpcklbw mm2, mm7
movq mm7, mm2
psubw mm3, mm2
pxor mm3, mm5
psubw mm3, mm5
psraw mm3, 1
pxor mm3, mm5
psubw mm3, mm5
movq mm5, mm3
psraw mm5, 0x10
pxor mm3, mm5
psubw mm3, mm5
pxor mm0, mm5
psubw mm0, mm5
movq mm2, mm3
pcmpgtw mm2, mm0
pand mm0, mm2
pandn mm2, mm3
por mm0, mm2
pxor mm2, mm2
pcmpgtw mm2, mm0
pandn mm2, mm0
pxor mm2, mm5
psubw mm2, mm5
pand mm2, mm6
psubw mm4, mm2
paddw mm7, mm2
packuswb mm4, mm4
movd dword [esi + eax*2], mm4
packuswb mm7, mm7
movd dword [edi + ebx*2], mm7
add esi, 4
dec ecx
jne 0x1bf601
emms
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x1e6e97
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, edx
cmp byte [esi + 0x11], 3
push edi
jne 0x1e6efb
mov al, 0x20
cmp byte [esi + 0x13], al
jae 0x1e6eb8
mov dl, byte [esi + 0x13]
shr al, 1
cmp al, dl
ja 0x1e6eb2
mov bl, al
shl bl, 1
dec bl
cmp al, bl
mov edi, 0x2ee0
mov byte [ebp - 1], al
ja 0x1e6f07
movzx eax, al
shl eax, 4
lea edx, [eax + ecx + 0x10]
xor eax, eax
mov ax, word [edx - 2]
add ax, word [edx + 2]
add ax, word [edx]
cmp ax, di
jae 0x1e6eee
mov edi, eax
mov al, byte [ebp - 1]
mov byte [ebp - 5], al
inc byte [ebp - 1]
add edx, 0x10
cmp byte [ebp - 1], bl
jbe 0x1e6ed4
jmp 0x1e6f07
mov di, word [ecx + 0x10]
add di, word [ecx + 0xe]
mov byte [ebp - 5], 0
mov ax, word [esi + 0x22]
movzx edi, di
movzx edx, ax
add edx, edi
movzx edi, word [ecx + 0x414]
cmp edx, edi
jle 0x1e6f28
mov eax, 0x80000800
jmp 0x1e706e
mov dl, byte [ebp - 5]
movzx edi, dl
shl edi, 4
lea edi, [edi + ecx + 0xc]
mov byte [esi + 0x12], dl
add word [edi + 2], ax
test dl, dl
jne 0x1e6f47
mov al, 1
mov byte [ebp - 1], al
jmp 0x1e6f58
mov al, dl
shl al, 1
mov byte [ebp - 1], al
mov al, dl
shl al, 1
inc al
cmp al, 0x40
ja 0x1e6f98
cmp byte [ebp - 1], al
ja 0x1e6f8a
movzx edx, byte [ebp - 1]
shl edx, 4
lea edx, [edx + ecx + 0x12]
mov dword [ebp - 0x10], edx
mov dl, al
sub dl, byte [ebp - 1]
inc dl
movzx edx, dl
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 0x10]
mov bx, word [esi + 0x22]
add word [edx], bx
add edx, 0x10
dec dword [ebp - 0xc]
jne 0x1e6f7b
shl byte [ebp - 1], 1
shl al, 1
inc al
cmp al, 0x40
jbe 0x1e6f58
mov dl, byte [ebp - 5]
cmp dl, 1
mov byte [ebp - 1], dl
jbe 0x1e7001
mov al, byte [ebp - 1]
movzx edx, byte [ebp - 1]
xor al, 1
movzx eax, al
shl edx, 4
lea edx, [edx + ecx + 0xc]
shl eax, 4
xor ebx, ebx
mov bx, word [edx + 4]
mov dx, word [edx + 2]
lea eax, [eax + ecx + 0xc]
mov word [ebp - 0xc], dx
movzx edx, word [eax + 4]
movzx eax, word [eax + 2]
add edx, eax
movzx eax, word [ebp - 0xc]
mov dword [ebp - 0x10], ebx
movzx ebx, bx
add eax, ebx
cmp eax, edx
jle 0x1e7001
mov al, byte [ebp - 1]
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
shr al, 1
add edx, ebx
movzx ebx, al
shl ebx, 4
cmp al, 1
mov word [ebx + ecx + 0x10], dx
mov byte [ebp - 1], al
ja 0x1e6fa0
cmp byte [ebp - 1], 1
jne 0x1e7013
mov ax, word [ecx + 0x20]
add ax, word [ecx + 0x1e]
mov word [ecx + 0x10], ax
mov eax, dword [edi + 8]
xor edx, edx
cmp eax, edx
jne 0x1e7052
mov al, byte [ebp - 5]
jmp 0x1e7025
test al, al
je 0x1e7033
shr al, 1
movzx ebx, al
shl ebx, 4
cmp dword [ebx + ecx + 0x14], edx
je 0x1e7021
movzx eax, al
shl eax, 4
mov eax, dword [eax + ecx + 0x14]
cmp eax, edx
je 0x1e7047
mov eax, dword [eax + 0x14]
mov dword [esi + 0xc], eax
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
mov dword [esi + 0x18], edx
jmp 0x1e7061
mov dword [esi + 0x18], eax
mov dword [edi + 8], esi
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 0x14]
mov dword [esi + 0xc], eax
push dword [ebp - 5]
mov edx, dword [esi + 0x14]
call fcn.001e6e20
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1e7073
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ax, word [edx + 0x22]
and dword [ebp - 4], 0
push ebx
mov bl, byte [edx + 0x12]
mov word [ebp - 0x10], ax
movzx eax, bl
push esi
shl eax, 4
mov esi, ecx
push edi
lea edi, [eax + esi + 0xc]
mov eax, dword [edi + 8]
mov dword [ebp - 0x14], edx
mov byte [ebp - 0xc], bl
cmp eax, edx
je 0x1e70ae
mov dword [ebp - 4], eax
mov eax, dword [eax + 0x18]
test eax, eax
jne 0x1e70a0
mov ecx, dword [eax + 0x18]
test ecx, ecx
jne 0x1e70e9
mov ecx, dword [ebp - 4]
xor edx, edx
test bl, bl
mov dword [edi + 0xc], ecx
mov dword [ebp - 8], edx
je 0x1e70f1
mov dl, bl
jmp 0x1e70cc
test dl, dl
je 0x1e70db
shr dl, 1
movzx ecx, dl
shl ecx, 4
cmp dword [ecx + esi + 0x14], 0
je 0x1e70c8
movzx ecx, dl
shl ecx, 4
mov ecx, dword [ecx + esi + 0x14]
test ecx, ecx
je 0x1e70ee
mov edx, dword [ecx + 0x14]
jmp 0x1e70f1
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
test ecx, ecx
mov eax, dword [eax + 0x18]
jne 0x1e710a
push dword [ebp - 0xc]
mov ecx, esi
mov dword [edi + 8], eax
call fcn.001e6e20
jmp 0x1e7110
mov dword [ecx + 0x18], eax
mov dword [ecx + 0xc], edx
mov ax, word [ebp - 0x10]
sub word [edi + 2], ax
test bl, bl
jne 0x1e71e3
mov al, 1
mov cl, al
cmp cl, al
ja 0x1e7150
movzx edx, cl
shl edx, 4
lea edi, [edx + esi + 0x12]
mov dl, al
sub dl, cl
inc dl
movzx edx, dl
mov dword [ebp - 4], edx
mov edx, dword [ebp - 0x14]
mov dx, word [edx + 0x22]
sub word [edi], dx
add edi, 0x10
dec dword [ebp - 4]
jne 0x1e713e
shl al, 1
shl cl, 1
inc al
cmp al, 0x40
jbe 0x1e7124
cmp bl, 1
jbe 0x1e71d0
mov dl, bl
xor dl, 1
movzx ecx, dl
shl ecx, 4
lea ecx, [ecx + esi + 0xc]
movzx edi, word [ecx + 4]
movzx ecx, word [ecx + 2]
add edi, ecx
movzx ecx, bl
shl ecx, 4
mov dword [ebp - 4], edi
lea ecx, [ecx + esi + 0xc]
movzx edi, word [ecx + 4]
movzx ecx, word [ecx + 2]
mov al, bl
add edi, ecx
shr al, 1
cmp edi, dword [ebp - 4]
jg 0x1e71aa
movzx ecx, al
shl ecx, 4
movzx ecx, word [ecx + esi + 0x10]
cmp dword [ebp - 4], ecx
je 0x1e71cd
mov bl, dl
movzx ecx, bl
shl ecx, 4
lea ecx, [ecx + esi + 0xc]
mov dx, word [ecx + 4]
add dx, word [ecx + 2]
movzx ecx, al
shl ecx, 4
cmp al, 1
mov word [ecx + esi + 0x10], dx
mov bl, al
ja 0x1e715f
cmp bl, 1
jne 0x1e71de
mov ax, word [esi + 0x20]
add ax, word [esi + 0x1e]
mov word [esi + 0x10], ax
pop edi
pop esi
pop ebx
leave
ret
mov cl, bl
mov al, bl
jmp 0x1e7150
Function at 0x1e7dbc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
mov ebp, edx
push esi
mov esi, dword [ebp + 0x10]
mov al, byte [esi + 0x25]
movzx ebx, byte [esi + 0x26]
movzx ecx, al
sub ebx, ecx
movzx ecx, byte [esi + 0x24]
add ebx, ecx
test al, al
je 0x1e7e1e
push edi
movzx ecx, byte [esi + 0x24]
mov eax, ebx
xor edx, edx
div ecx
dec byte [esi + 0x25]
push 1
mov ebx, edx
mov edi, ebx
shl edi, 6
add edi, dword [esi + 0x2c]
inc ebx
push dword [edi + 4]
call dword [0x1eb0e4]
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 4]
xor ecx, eax
test ecx, 0xfffff000
je 0x1e7e17
push 1
push eax
call dword [0x1eb0e4]
cmp byte [esi + 0x25], 0
jne 0x1e7ddb
pop edi
movzx eax, byte [esi + 0x24]
dec byte [esi + 0x25]
shl eax, 6
sub esi, eax
mov eax, dword [0x3c70e8]
mov dword [esi], eax
mov dword [0x3c70e8], esi
and dword [ebp + 4], 0
push ebp
call fcn.001e4445
pop esi
pop ebp
pop ebx
ret