joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a8fc680
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.2a8b8f90
mov edx, dword [esp + 0x1c]
xor ecx, ecx
test edx, edx
je 0x2a8fc774
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, dword [esp + 0x20]
cmp edx, 0x20
jb 0x2a8fc754
push ebp
lea eax, [ebx - 1]
lea ebp, [esi - 1]
add eax, edx
add ebp, edx
cmp esi, eax
ja 0x2a8fc6c7
cmp ebp, ebx
jae 0x2a8fc753
lea eax, [edi - 1]
add eax, edx
cmp esi, eax
ja 0x2a8fc6d4
cmp ebp, edi
jae 0x2a8fc753
mov eax, edx
mov ebp, edx
mov edx, esi
and eax, 0x1f
sub edx, edi
sub ebp, eax
mov dword [esp + 0x10], edx
mov eax, edi
mov edx, ebx
mov dword [esp + 0x1c], ebp
sub edx, edi
lea ebp, [ebx + 0x10]
mov dword [esp + 0x14], edx
mov edx, esi
mov esi, dword [esp + 0x10]
sub edx, ebx
mov edi, dword [esp + 0x14]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x18]
mov edi, edi
movdqu xmm0, xmmword [eax]
add ecx, 0x20
lea eax, [eax + 0x20]
lea ebp, [ebp + 0x20]
movdqu xmm1, xmmword [edi + eax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [esi + eax - 0x20], xmm1
movdqu xmm1, xmmword [eax - 0x10]
movdqu xmm0, xmmword [ebp - 0x20]
pxor xmm1, xmm0
movdqu xmmword [ebx + ebp - 0x20], xmm1
cmp ecx, dword [esp + 0x1c]
jb 0x2a8fc710
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
pop ebp
cmp ecx, edx
jae 0x2a8fc771
sub edi, ebx
lea eax, [ecx + ebx]
sub esi, ebx
sub edx, ecx
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [eax + esi - 1], cl
dec edx
jne 0x2a8fc761
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x2a8ff090
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x2a8ff0a4
mov dword [esp + 0x18], fcn.2a8fd870
jmp fcn.2a8f8810
mov dword [esp + 0x18], fcn.2a8fcaf0
jmp fcn.2a8f8550
Function at 0x2a902a70
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
test esi, esi
jle 0x2a902b5c
push edi
mov edi, dword [esp + 0x14]
inc edi
lea ebx, [ebx]
movzx edx, byte [edi - 1]
cmp esi, 3
jl 0x2a902aee
movzx ecx, byte [edi]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
mov ecx, edx
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
mov ecx, edx
shr ecx, 6
and ecx, 0x3f
and edx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 3], cl
jmp 0x2a902b3f
shl edx, 0x10
cmp esi, 2
jne 0x2a902afe
movzx ecx, byte [edi]
shl ecx, 8
or edx, ecx
mov ecx, edx
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
cmp esi, 1
jne 0x2a902b2b
lea ecx, [esi + 0x3c]
jmp 0x2a902b38
shr edx, 6
and edx, 0x3f
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
mov byte [eax + 3], 0x3d
sub esi, 3
add eax, 4
add ebx, 4
add edi, 3
test esi, esi
jg 0x2a902a90
pop edi
mov byte [eax], 0
mov eax, ebx
pop esi
pop ebx
ret
mov byte [eax], bl
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x2a907cb0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
cmp ebx, 2
je 0x2a907d0c
mov eax, dword [esp + 0x10]
test eax, eax
je 0x2a907cfd
push eax
push 0
lea eax, [esp + 0x24]
push eax
push 0
call fcn.2a8e8050
add esp, 0x10
cmp dword [esp + 0x1c], 0xffffffff
je 0x2a907cfd
push 0x2f
push str.cryptoececx_meth.c
push 0x66
push 0x10a
push 0x10
call fcn.2a8bdb20
add esp, 0x14
xor eax, eax
pop edi
pop ebx
ret
test edi, edi
je 0x2a907d08
cmp dword [esp + 0x18], 0x20
je 0x2a907d0c
push 0x35
jmp 0x2a907ce2
push esi
push 0x3a
push str.cryptoececx_meth.c
push 0x24
call fcn.2a8baa80
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x2a907d42
push 0x3c
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.2a8bdb20
add esp, 0x14
xor eax, eax
pop esi
pop edi
pop ebx
ret
test ebx, ebx
jne 0x2a907d59
push dword [esp + 0x1c]
push edi
push esi
call sub.MSVCR120.dll_memcpy
add esp, 0xc
jmp 0x2a907e09
push 0x43
push str.cryptoececx_meth.c
push 0x20
call fcn.2a8e19b0
add esp, 0xc
mov dword [esi + 0x20], eax
test eax, eax
jne 0x2a907d9c
push 0x45
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.2a8bdb20
push 0x46
push str.cryptoececx_meth.c
push esi
call fcn.2a8ba840
add esp, 0x20
xor eax, eax
pop esi
pop edi
pop ebx
ret
cmp ebx, 2
jne 0x2a907deb
push 0x20
push eax
call fcn.2a8c6bc0
add esp, 8
test eax, eax
jg 0x2a907dd5
push 0x4b
push str.cryptoececx_meth.c
push dword [esi + 0x20]
call fcn.2a8e19a0
push 0x4c
push str.cryptoececx_meth.c
push esi
call fcn.2a8ba840
add esp, 0x18
xor eax, eax
pop esi
pop edi
pop ebx
ret
mov eax, dword [esi + 0x20]
and byte [eax], 0xf8
mov eax, dword [esi + 0x20]
and byte [eax + 0x1f], 0x7f
mov eax, dword [esi + 0x20]
or byte [eax + 0x1f], 0x40
jmp 0x2a907dfd
movdqu xmm0, xmmword [edi]
movdqu xmmword [eax], xmm0
movdqu xmm0, xmmword [edi + 0x10]
movdqu xmmword [eax + 0x10], xmm0
push dword [esi + 0x20]
push esi
call fcn.2a926cc0
add esp, 8
push esi
push 0x40a
push dword [esp + 0x18]
call fcn.2a8c0890
add esp, 0xc
mov eax, 1
pop esi
pop edi
pop ebx
ret
Function at 0x2a9110f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.2a914e10
add esp, 4
cmp eax, 0x72
jne 0x2a91123a
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
push ebp
push edi
push esi
push dword [esp + 0x28]
mov edi, eax
and eax, 1
push dword [esp + 0x28]
shr edi, 1
push dword [esp + 0x28]
lea ebp, [eax + edi]
push ebp
push dword [esp + 0x28]
call fcn.2a8c7e60
push eax
call fcn.2a910e80
add esp, 0x1c
test eax, eax
jne 0x2a911143
pop edi
pop ebp
pop esi
ret
push ebx
push 0xf8
push 0x2a982b3c
push esi
call fcn.2a8ba810
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x2a911195
mov eax, dword [esp + 0x18]
push esi
push ebx
push dword [esp + 0x2c]
add eax, edi
push dword [esp + 0x2c]
push ebp
push eax
call fcn.2a8c8370
push eax
call fcn.2a910e80
add esp, 0x1c
test eax, eax
jne 0x2a91119c
push 0xfd
push 0x2a982b3c
push esi
push ebx
call fcn.2a8ba910
add esp, 0x10
pop ebx
pop edi
pop ebp
xor eax, eax
pop esi
ret
xor edi, edi
test esi, esi
je 0x2a91121c
mov edx, dword [esp + 0x28]
cmp esi, 0x20
jb 0x2a911201
lea eax, [esi - 1]
lea ecx, [edx - 1]
add eax, ebx
add ecx, esi
cmp edx, eax
ja 0x2a9111bd
cmp ecx, ebx
jae 0x2a911201
mov eax, esi
mov ecx, esi
and eax, 0x1f
mov ebp, ebx
sub ecx, eax
mov eax, edx
sub ebp, edx
lea esp, [esp]
movdqu xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movdqu xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x20], xmm1
movdqu xmm1, xmmword [ebx + edi + 0x10]
add edi, 0x20
movdqu xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x10], xmm1
cmp edi, ecx
jb 0x2a9111d0
cmp edi, esi
jae 0x2a91121c
mov ebp, ebx
lea ecx, [edi + edx]
sub ebp, edx
mov edx, esi
sub edx, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
dec edx
jne 0x2a911210
push 0x102
push 0x2a982b3c
push esi
push ebx
call fcn.2a8ba910
add esp, 0x10
mov eax, 1
pop ebx
pop edi
pop ebp
pop esi
ret
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push esi
call fcn.2a910e80
add esp, 0x1c
neg eax
sbb eax, eax
neg eax
pop esi
ret
Function at 0x2a919a50
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x2a919a75
push 0x11f
push str.cryptoengineeng_list.c
push 0x43
push 0x6a
push 0x26
call fcn.2a8bdb20
add esp, 0x14
xor eax, eax
pop ebx
ret
push 0x2a8f11d0
push 0x2a9b9744
call fcn.2a8b9ee0
add esp, 8
neg eax
sbb eax, eax
test dword [0x2a9b9748], eax
jne 0x2a919aaf
push 0x123
push str.cryptoengineeng_list.c
push 0x41
push 0x6a
push 0x26
call fcn.2a8bdb20
add esp, 0x14
xor eax, eax
pop ebx
ret
push esi
push edi
push dword [0x2a9b99ec]
call fcn.2a8b9f60
mov esi, dword [0x2a9b98e0]
add esp, 4
test esi, esi
je 0x2a919b2c
lea esp, [esp]
mov ecx, dword [esi]
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x2a919af4
test dl, dl
je 0x2a919af0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x2a919af4
add eax, 2
add ecx, 2
test dl, dl
jne 0x2a919ad4
xor eax, eax
jmp 0x2a919af9
sbb eax, eax
or eax, 1
test eax, eax
je 0x2a919b06
mov esi, dword [esi + 0x60]
test esi, esi
jne 0x2a919ad0
jmp 0x2a919b2c
test byte [esi + 0x4c], 4
je 0x2a919b29
call fcn.2a8f0ff0
mov edi, eax
test edi, edi
jne 0x2a919b1b
xor esi, esi
jmp 0x2a919b2c
push esi
push edi
call fcn.2a919d20
add esp, 8
mov esi, edi
jmp 0x2a919b2c
inc dword [esi + 0x50]
push dword [0x2a9b99ec]
call fcn.2a8b9f50
add esp, 4
test esi, esi
jne 0x2a919c16
mov ecx, str.dynamic
mov eax, ebx
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x2a919b70
test dl, dl
je 0x2a919b6c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x2a919b70
add eax, 2
add ecx, 2
test dl, dl
jne 0x2a919b50
xor eax, eax
jmp 0x2a919b75
sbb eax, eax
or eax, 1
test eax, eax
je 0x2a919c1c
push str.OPENSSL_ENGINES
call sub.MSVCR120.dll_getenv
test eax, eax
mov edi, str.C:openssllibengines_1_1
push str.dynamic
cmovne edi, eax
call fcn.2a919a50
mov esi, eax
add esp, 8
test esi, esi
je 0x2a919c1c
push 0
push ebx
push 0x2a97e5a0
push esi
call fcn.2a936c30
add esp, 0x10
test eax, eax
je 0x2a919c1c
push 0
push 0x2a985ef8
push str.DIR_LOAD
push esi
call fcn.2a936c30
add esp, 0x10
test eax, eax
je 0x2a919c1c
push 0
push edi
push str.DIR_ADD
push esi
call fcn.2a936c30
add esp, 0x10
test eax, eax
je 0x2a919c1c
push 0
push 0x2a9550fc
push str.LIST_ADD
push esi
call fcn.2a936c30
add esp, 0x10
test eax, eax
je 0x2a919c1c
push 0
push 0
push str.LOAD
push esi
call fcn.2a936c30
add esp, 0x10
test eax, eax
je 0x2a919c1c
pop edi
mov eax, esi
pop esi
pop ebx
ret
push esi
call fcn.2a8f0f60
push 0x153
push str.cryptoengineeng_list.c
push 0x74
push 0x6a
push 0x26
call fcn.2a8bdb20
push ebx
push 0x2a985efc
push 2
call fcn.2a8bd340
add esp, 0x24
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x2a920ca0
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
mov eax, 0x6c
call fcn.2a8b8f90
mov eax, dword [0x2a9b0720]
xor eax, esp
mov dword [esp + 0x68], eax
push 0xf0000040
push 1
push 0
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x2a920d16
lea eax, [esp + 0x28]
push eax
push 0x40
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x2a920d0a
mov eax, 8
call fcn.2a8b8f90
movsd xmm0, qword [0x2a987820]
lea eax, [esp + 0x30]
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.2a8c6b80
add esp, 0x10
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x2a920d7a
lea eax, [esp + 0x28]
push eax
push 0x40
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x2a920d6e
mov eax, 8
call fcn.2a8b8f90
movsd xmm0, qword [0x2a987820]
lea eax, [esp + 0x30]
movsd qword [esp], xmm0
push 0x40
push eax
call fcn.2a8c6b80
add esp, 0x10
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call fcn.2a920e00
lea eax, [esp + 8]
push eax
call dword [sym.imp.kernel32.dll_GlobalMemoryStatus]
mov eax, 8
call fcn.2a8b8f90
movsd xmm0, qword [0x2a956fc0]
lea eax, [esp + 0x10]
movsd qword [esp], xmm0
push 0x20
push eax
call fcn.2a8c6b80
add esp, 0x10
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov dword [esp + 4], eax
mov eax, 8
call fcn.2a8b8f90
movsd xmm0, qword [0x2a956fc0]
lea eax, [esp + 0xc]
movsd qword [esp], xmm0
push 4
push eax
call fcn.2a8c6b80
mov ecx, dword [esp + 0x78]
add esp, 0x10
xor ecx, esp
mov eax, 1
call fcn.2a84c0e0
add esp, 0x6c
ret
Function at 0x2a924730
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x84], 0xffffffff
jne 0x2a924742
xor eax, eax
pop edi
ret
push ebp
push esi
push dword [edi]
call fcn.2a8bee90
mov ecx, dword [esp + 0x1c]
add esp, 4
mov ebp, dword [esp + 0x14]
mov esi, eax
mov dword [ecx], esi
test ebp, ebp
je 0x2a9247f4
mov ecx, dword [edi + 0x84]
push ebx
cmp ecx, esi
jne 0x2a924794
test esi, esi
jle 0x2a9247d2
mov edx, ebp
lea ecx, [edi + 4]
mov ebx, esi
jmp 0x2a924780
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
dec ebx
jne 0x2a924780
jmp 0x2a9247d2
sub eax, ecx
mov byte [ecx + edi + 0x64], 0x80
cmp eax, 1
jle 0x2a9247b2
dec eax
push eax
lea eax, [edi + 0x65]
add eax, ecx
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
test esi, esi
jle 0x2a9247d2
mov edx, ebp
lea ecx, [edi + 0x24]
mov ebx, esi
lea ecx, [ecx]
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
dec ebx
jne 0x2a9247c0
push esi
push ebp
push ebp
push dword [edi]
call fcn.2a8bf310
add esp, 0x10
pop ebx
test eax, eax
jne 0x2a9247f4
push esi
push ebp
call fcn.2a801360
add esp, 8
xor eax, eax
pop esi
pop ebp
pop edi
ret
pop esi
pop ebp
mov eax, 1
pop edi
ret
Function at 0x2a926cc0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x140
call fcn.2a8b8f90
mov eax, dword [0x2a9b0720]
xor eax, esp
mov dword [esp + 0x13c], eax
mov eax, dword [esp + 0x144]
mov dword [esp], eax
mov eax, dword [esp + 0x148]
push ebx
push ebp
push esi
movdqu xmm0, xmmword [eax]
push edi
movdqu xmm1, xmmword [eax + 0x10]
movd eax, xmm0
movdqu xmmword [esp + 0x13c], xmm1
and al, 0xf8
psrldq xmm1, 0xc
movdqu xmmword [esp + 0x12c], xmm0
mov byte [esp + 0x12c], al
movd eax, xmm1
shr eax, 0x18
and al, 0x3f
or al, 0x40
mov byte [esp + 0x14b], al
lea eax, [esp + 0x12c]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.2a92ac20
mov eax, dword [esp + 0x6c]
add eax, dword [esp + 0x94]
mov dword [esp + 0xe4], eax
mov eax, dword [esp + 0x70]
add eax, dword [esp + 0x98]
mov dword [esp + 0xe8], eax
mov eax, dword [esp + 0x74]
add eax, dword [esp + 0x9c]
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x78]
add eax, dword [esp + 0xa0]
mov dword [esp + 0xf0], eax
mov eax, dword [esp + 0x7c]
add eax, dword [esp + 0xa4]
mov ebx, dword [esp + 0x88]
mov ebp, dword [esp + 0xb0]
mov esi, dword [esp + 0x8c]
mov edi, dword [esp + 0xb4]
mov dword [esp + 0xf4], eax
mov eax, dword [esp + 0x80]
add eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0xb8]
mov dword [esp + 0xf8], eax
mov eax, dword [esp + 0x84]
add eax, dword [esp + 0xac]
mov dword [esp + 0xfc], eax
lea eax, [ebx + ebp]
mov dword [esp + 0x100], eax
lea eax, [esi + edi]
mov dword [esp + 0x104], eax
lea eax, [ecx + edx]
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x94]
sub eax, dword [esp + 0x6c]
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x98]
sub eax, dword [esp + 0x70]
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x9c]
sub eax, dword [esp + 0x74]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0xa0]
sub eax, dword [esp + 0x78]
mov dword [esp + 0x118], eax
mov eax, dword [esp + 0xa4]
sub eax, dword [esp + 0x7c]
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0xa8]
sub eax, dword [esp + 0x80]
mov dword [esp + 0x120], eax
mov eax, dword [esp + 0xac]
sub eax, dword [esp + 0x84]
sub ebp, ebx
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], ebp
lea eax, [esp + 0x10c]
sub edx, ecx
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x134], edx
sub edi, esi
push eax
mov dword [esp + 0x134], edi
call fcn.2a9274d0
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0xf0]
push eax
push eax
call fcn.2a927730
lea eax, [esp + 0xf8]
push eax
push dword [esp + 0x30]
call fcn.2a92a3e0
lea eax, [esp + 0x150]
push 0x20
push eax
call fcn.2a801360
mov ecx, dword [esp + 0x178]
add esp, 0x2c
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.2a84c0e0
add esp, 0x140
ret
Function at 0x2a9394b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.2a8b8f90
mov eax, dword [0x2a9b0720]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
push ebx
push ebp
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
shl ebx, 0x18
push esi
push edi
mov edi, dword [esp + 0x50]
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov esi, dword [edi]
movzx eax, byte [edx + 2]
or ebx, eax
mov dword [esp + 0x14], edi
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x28], ebp
movzx eax, byte [edx + 6]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x2c]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x18], ebx
mov eax, ebx
mov byte [esp + 0x2f], bl
shr eax, 0x18
or edx, ecx
mov byte [esp + 0x2c], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x32], al
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], edx
mov byte [esp + 0x33], dl
test eax, eax
je 0x2a939675
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
lea esp, [esp]
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x2a939605
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
call fcn.2a847540
mov ebx, dword [esp + 0x20]
add esp, 8
mov edx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x2a9395a0
test ebp, ebp
mov ebp, dword [esp + 0x28]
je 0x2a93965c
mov ecx, dword [esp + 0x24]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.2a84c0e0
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.2a84c0e0
add esp, 0x28
ret
Function at 0x2a93b990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.2a8b8f90
mov eax, dword [0x2a9b0720]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
push ebx
push ebp
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
shl ebx, 0x18
push esi
push edi
mov edi, dword [esp + 0x50]
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov esi, dword [edi]
movzx eax, byte [edx + 2]
or ebx, eax
mov dword [esp + 0x14], edi
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x28], ebp
movzx eax, byte [edx + 6]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x2c]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x18], ebx
mov eax, ebx
mov byte [esp + 0x2f], bl
shr eax, 0x18
or edx, ecx
mov byte [esp + 0x2c], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x32], al
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], edx
mov byte [esp + 0x33], dl
test eax, eax
je 0x2a93bb55
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
lea esp, [esp]
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x2a93bae5
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
call fcn.2a93b300
mov ebx, dword [esp + 0x20]
add esp, 8
mov edx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x2a93ba80
test ebp, ebp
mov ebp, dword [esp + 0x28]
je 0x2a93bb3c
mov ecx, dword [esp + 0x24]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.2a84c0e0
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.2a84c0e0
add esp, 0x28
ret