joyce8/EMBER2024-capa huggingface dataset:
Function at 0x971dc
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x9720a
mov eax, ebx
call fcn.00097c80
cmp dword [ebx + 0x3c], 0
je 0x97203
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x9727b
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x9726d
cmp dword [ebx + 8], 0
je 0x9722c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x9723e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x9726d
cmp dword [ebx + 8], 0
je 0x9721f
cmp eax, 3
je 0x97251
dec eax
jne 0x9721f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x9721f
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x9721f
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x97299
cmp dword [ebx + 0x10], 0xcc
je 0x97299
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.000972a4
pop ebx
ret

Function at 0xb7724
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
test edx, edx
jne 0xb772d
xor eax, eax
pop ebx
ret
xor eax, 0xffffffff
cmp ecx, 8
jb 0xb781d
xor ebx, ebx
sub ecx, 8
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x1e2d5c]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x1e2d5c]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x1e2d5c]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x1e2d5c]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x1e2d5c]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x1e2d5c]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x1e2d5c]
xor ebx, eax
mov eax, ebx
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x1e2d5c]
xor ebx, eax
cmp ecx, 8
mov eax, ebx
jae 0xb7739
test ecx, ecx
je 0xb783f
xor ebx, ebx
mov bl, byte [edx]
inc edx
xor ebx, eax
and ebx, 0xff
shr eax, 8
mov ebx, dword [ebx*4 + 0x1e2d5c]
xor ebx, eax
dec ecx
mov eax, ebx
jne 0xb7821
xor eax, 0xffffffff
pop ebx
ret
Function at 0xcafe4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
mov eax, dword [ebx + 0x44]
cdq
xor eax, edx
sub eax, edx
call fcn.0001278c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xcb09e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, dword [ebx + 0x40]
sar edi, 1
jns 0xcb015
adc edi, 0
dec edi
test edi, edi
jl 0xcb088
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00091dbc
push eax
mov eax, dword [ebx + 0x44]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 4]
pop edx
call fcn.00018030
mov edx, dword [ebx + 0x40]
dec edx
sub edx, esi
mov eax, ebx
call fcn.00091dbc
push eax
mov edx, esi
mov eax, ebx
call fcn.00091dbc
push eax
mov eax, dword [ebx + 0x44]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
pop eax
pop edx
call fcn.00018030
mov edx, dword [ebx + 0x40]
dec edx
sub edx, esi
mov eax, ebx
call fcn.00091dbc
push eax
mov eax, dword [ebx + 0x44]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
mov edx, dword [ebp - 4]
pop eax
call fcn.00018030
inc esi
dec edi
jne 0xcb01d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xcb0a5
mov eax, dword [ebp - 4]
call fcn.000127a4
ret
Function at 0xcf224
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], edx
mov ebx, eax
mov eax, dword [esp]
lea esi, [eax + 0x490]
lea edi, [ebx + 0x490]
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp]
call fcn.000cf644
push eax
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x40]
mov eax, dword [esp + 4]
mov edx, dword [eax + 0x7c]
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x68]
mov eax, dword [esp]
lea esi, [eax + 0x90]
lea edi, [ebx + 0x90]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
call fcn.00092b68
mov edi, dword [ebx + 0x40]
dec edi
test edi, edi
jl 0xcf2b4
inc edi
xor esi, esi
mov edx, esi
mov eax, dword [esp]
call fcn.00091dbc
push eax
mov edx, esi
mov eax, ebx
call fcn.00091dbc
push eax
mov eax, dword [ebx + 0x44]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
pop eax
pop edx
call fcn.00018030
inc esi
dec edi
jne 0xcf28a
mov eax, ebx
mov edx, dword [0xc590c]
call fcn.00013200
test al, al
je 0xcf360
mov eax, dword [esp]
mov edx, dword [0xc590c]
call fcn.00013200
test al, al
jne 0xcf2f0
mov eax, dword [ebx + 0x4d0]
call fcn.00013088
xor eax, eax
mov dword [ebx + 0x4d0], eax
jmp 0xcf360
mov esi, dword [esp]
cmp dword [esi + 0x4d0], 0
jne 0xcf311
mov eax, dword [ebx + 0x4d0]
call fcn.00013088
xor eax, eax
mov dword [ebx + 0x4d0], eax
jmp 0xcf360
mov eax, ebx
call fcn.000d3128
mov eax, dword [esi + 0x4d0]
mov edi, dword [eax + 0x40]
dec edi
test edi, edi
jl 0xcf360
inc edi
xor ebp, ebp
mov eax, dword [esi + 0x4d0]
mov edx, ebp
call fcn.00091dbc
push eax
mov eax, dword [ebx + 0x4d0]
mov edx, ebp
call fcn.00091dbc
push eax
mov eax, dword [esi + 0x4d0]
mov eax, dword [eax + 0x44]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
pop eax
pop edx
call fcn.00018030
inc ebp
dec edi
jne 0xcf329
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xcf368
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.000cf660
push eax
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x7c]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x68]
push esi
lea edi, [esi + 0x90]
lea esi, [ebx + 0x90]
mov ecx, pe_nt_image_headers32
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, esi
call fcn.00092b68
push ebx
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.000c8f98
cmp dword [ebx + 0x4d0], 0
jne 0xcf3cb
mov eax, dword [esi + 0x4d0]
call fcn.00013088
xor eax, eax
mov dword [esi + 0x4d0], eax
jmp 0xcf41a
mov eax, esi
call fcn.000d3128
mov eax, dword [ebx + 0x4d0]
mov ebp, dword [eax + 0x40]
dec ebp
test ebp, ebp
jl 0xcf41a
inc ebp
xor edi, edi
mov edx, edi
mov eax, dword [ebx + 0x4d0]
call fcn.00091dbc
push eax
mov edx, edi
mov eax, dword [esi + 0x4d0]
call fcn.00091dbc
push eax
mov eax, dword [ebx + 0x4d0]
mov eax, dword [eax + 0x44]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
pop eax
pop edx
call fcn.00018030
inc edi
dec ebp
jne 0xcf3e3
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xcf9ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.000bd724
call fcn.00032154
dec eax
sub al, 3
jae 0xcfade
mov eax, dword [ebp - 8]
call fcn.000bd724
call fcn.00032154
dec al
je 0xcf9eb
dec al
je 0xcf9f2
jmp 0xcf9f9
mov ebx, 1
jmp 0xcf9fe
mov ebx, 4
jmp 0xcf9fe
mov ebx, 8
push ebx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, eax
mov eax, dword [ebp - 4]
pop ecx
mov esi, dword [eax]
call dword [esi + 0x68]
lea eax, [ebp - 0x40c]
push eax
mov ecx, ebx
mov edi, 1
shl edi, cl
push edi
push 0
mov eax, dword [ebp - 8]
call fcn.000bd724
mov edx, dword [eax]
call dword [edx + 0x24]
push eax
call fcn.0001782c
mov esi, eax
mov eax, dword [ebp - 4]
add eax, 0x90
mov edx, 0x400
call fcn.00018044
mov edx, edi
mov eax, esi
call fcn.000357ec
dec eax
test eax, eax
jl 0xcfa8f
inc eax
mov ebx, eax
xor esi, esi
lea eax, [ebp - 0x40c]
mov edx, dword [ebp - 4]
lea edx, [edx + esi*4 + 0x90]
mov cl, byte [eax]
mov byte [edx + 2], cl
mov cl, byte [eax + 1]
mov byte [edx + 1], cl
mov cl, byte [eax + 2]
mov byte [edx], cl
inc esi
add eax, 4
dec ebx
jne 0xcfa6e
mov eax, dword [ebp - 4]
call fcn.00092b68
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
dec ebx
test ebx, ebx
jl 0xcfb2e
inc ebx
xor esi, esi
mov eax, dword [ebp - 8]
call fcn.000bd724
mov edx, esi
call fcn.000321d8
push eax
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.00091dbc
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
pop eax
pop edx
call fcn.00018030
inc esi
dec ebx
jne 0xcfaa9
jmp 0xcfb2e
mov dl, 1
mov eax, dword [0x2b494]
call fcn.00031b04
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0xcfb27
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xcfb2e
mov eax, dword [ebp - 0xc]
call fcn.00013088
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xd3194
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov esi, eax
mov eax, esi
call fcn.000d3128
mov eax, dword [esi + 0x4d0]
mov edi, dword [eax + 0x40]
dec edi
test edi, edi
jl 0xd31e7
inc edi
xor ebx, ebx
mov edx, ebx
mov eax, ebp
call fcn.00091dbc
push eax
mov edx, ebx
mov eax, dword [esi + 0x4d0]
call fcn.00091dbc
push eax
mov eax, dword [esi + 0x4d0]
mov eax, dword [eax + 0x44]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
pop eax
pop edx
call fcn.00018030
inc ebx
dec edi
jne 0xd31b4
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xd3244
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, edx
mov ebp, eax
mov eax, dword [ebp + 0x4d0]
test eax, eax
jne 0xd3283
mov esi, dword [edi + 0x40]
dec esi
test esi, esi
jl 0xd32c1
inc esi
xor ebx, ebx
mov edx, ebx
mov eax, edi
call fcn.00091dbc
push eax
mov eax, dword [edi + 0x44]
cdq
xor eax, edx
sub eax, edx
mov edx, eax
mov cl, 0xff
pop eax
call fcn.00018038
inc ebx
dec esi
jne 0xd3261
jmp 0xd32c1
mov esi, dword [eax + 0x40]
dec esi
test esi, esi
jl 0xd32c1
inc esi
xor ebx, ebx
mov eax, dword [ebp + 0x4d0]
mov edx, ebx
call fcn.00091dbc
push eax
mov edx, ebx
mov eax, edi
call fcn.00091dbc
push eax
mov eax, dword [ebp + 0x4d0]
mov eax, dword [eax + 0x44]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
pop eax
pop edx
call fcn.00018030
inc ebx
dec esi
jne 0xd328e
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0xd3348
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
cmp dword [ebx + 0x4d0], 0
je 0xd338b
mov esi, dword [ebx + 0x40]
dec esi
test esi, esi
jl 0xd338b
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [ebx + 0x4d0]
call fcn.00091dbc
push eax
mov eax, dword [ebx + 0x4d0]
mov eax, dword [eax + 0x44]
cdq
xor eax, edx
sub eax, edx
mov edx, eax
xor ecx, ecx
pop eax
call fcn.00018038
inc edi
dec esi
jne 0xd3361
pop edi
pop esi
pop ebx
ret

Function at 0xd3390
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
cmp dword [ebx + 0x4d0], 0
je 0xd33d3
mov esi, dword [ebx + 0x40]
dec esi
test esi, esi
jl 0xd33d3
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [ebx + 0x4d0]
call fcn.00091dbc
push eax
mov eax, dword [ebx + 0x4d0]
mov eax, dword [eax + 0x44]
cdq
xor eax, edx
sub eax, edx
mov edx, eax
mov cl, 0xff
pop eax
call fcn.00018038
inc edi
dec esi
jne 0xd33a9
pop edi
pop esi
pop ebx
ret
Function at 0xd3bec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xd3da5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
cdq
xor eax, edx
sub eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
dec eax
je 0xd3c38
sub eax, 3
je 0xd3c79
sub eax, 4
je 0xd3d10
jmp 0xd3d89
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
dec eax
test eax, eax
jl 0xd3d89
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00091dbc
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0xd3c6c
inc esi
not byte [eax]
inc eax
dec esi
jne 0xd3c66
inc dword [ebp - 8]
dec dword [ebp - 0x14]
jne 0xd3c52
jmp 0xd3d89
push 0x10
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0xd3bd4]
call fcn.00015bbc
add esp, 4
xor eax, eax
mov edx, dword [ebp - 0x10]
mov dword [edx + eax*4], eax
inc eax
cmp eax, 0x10
jne 0xd3c93
mov eax, dword [ebp - 0x10]
mov dword [eax + ebx*4], esi
mov eax, dword [ebp - 0x10]
mov dword [eax + esi*4], ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
dec eax
test eax, eax
jl 0xd3d89
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00091dbc
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0xd3d06
inc esi
mov dl, byte [eax]
mov ecx, edx
and cl, 0xf
and ecx, 0xff
mov ebx, dword [ebp - 0x10]
mov cl, byte [ebx + ecx*4]
and edx, 0xff
shr edx, 4
mov ebx, dword [ebp - 0x10]
mov dl, byte [ebx + edx*4]
shl edx, 4
or cl, dl
mov byte [eax], cl
inc eax
dec esi
jne 0xd3cd9
inc dword [ebp - 8]
dec dword [ebp - 0x14]
jne 0xd3cc5
jmp 0xd3d89
push pe_nt_image_headers32
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, dword [0xd3bd4]
call fcn.00015bbc
add esp, 4
xor eax, eax
mov edx, dword [ebp - 0x10]
mov dword [edx + eax*4], eax
inc eax
cmp eax, 0x100
jne 0xd3d2d
mov eax, dword [ebp - 0x10]
mov dword [eax + ebx*4], esi
mov eax, dword [ebp - 0x10]
mov dword [eax + esi*4], ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
dec eax
test eax, eax
jl 0xd3d89
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], 0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00091dbc
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0xd3d81
inc esi
xor edx, edx
mov dl, byte [eax]
mov ecx, dword [ebp - 0x10]
mov dl, byte [ecx + edx*4]
mov byte [eax], dl
inc eax
dec esi
jne 0xd3d71
inc dword [ebp - 8]
dec dword [ebp - 0x14]
jne 0xd3d5d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xd3dac
lea eax, [ebp - 0x10]
mov edx, dword [0xd3bd4]
call fcn.00015bc8
ret
Function at 0x127c04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x127c29
inc ecx
xor esi, esi
mov bl, byte [eax + esi]
xor bl, byte [edx + esi]
mov edi, dword [ebp - 4]
mov byte [edi + esi], bl
inc esi
dec ecx
jne 0x127c19
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x127e90
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, eax
lea edi, [esp + 8]
mov edx, edi
mov eax, dword [esp]
mov ecx, 8
call fcn.000129b8
mov ebx, 4
mov eax, edi
mov dx, word [eax]
mov ecx, edx
shl ecx, 8
movzx edx, dx
shr edx, 8
or cx, dx
mov word [eax], cx
add eax, 2
dec ebx
jne 0x127eba
xor ebx, ebx
mov ebp, ebx
add ebp, ebp
lea ebp, [ebp + ebp*2]
mov dx, word [esi + ebp*2 + 0x50]
mov eax, edi
call fcn.00127da8
mov ax, word [esi + ebp*2 + 0x52]
add word [edi + 2], ax
mov ax, word [esi + ebp*2 + 0x54]
add word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x56]
lea eax, [edi + 6]
call fcn.00127da8
mov ax, word [edi + 4]
mov word [esp + 0x10], ax
mov ax, word [edi]
xor word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0x58]
lea eax, [edi + 4]
call fcn.00127da8
mov ax, word [edi + 2]
mov word [esp + 0x12], ax
mov ax, word [edi + 6]
xor word [edi + 2], ax
mov ax, word [edi + 4]
add word [edi + 2], ax
mov dx, word [esi + ebp*2 + 0x5a]
lea eax, [edi + 2]
call fcn.00127da8
mov ax, word [edi + 2]
add word [edi + 4], ax
mov ax, word [edi + 2]
xor word [edi], ax
mov ax, word [edi + 4]
xor word [edi + 6], ax
mov ax, word [esp + 0x10]
xor word [edi + 2], ax
mov ax, word [esp + 0x12]
xor word [edi + 4], ax
inc ebx
cmp ebx, 8
jne 0x127ed6
mov dx, word [esi + 0xb0]
mov eax, edi
call fcn.00127da8
mov ax, word [esi + 0xb2]
add word [edi + 4], ax
mov ax, word [esi + 0xb4]
add word [edi + 2], ax
mov dx, word [esi + 0xb6]
lea eax, [edi + 6]
call fcn.00127da8
mov ax, word [edi]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi], dx
mov ax, word [edi + 4]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [esp + 0x12], dx
mov ax, word [edi + 2]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 4], dx
mov ax, word [edi + 6]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 6], dx
mov ax, word [esp + 0x12]
mov word [edi + 2], ax
mov edx, dword [esp + 4]
mov eax, edi
mov ecx, 8
call fcn.000129b8
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x12802c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, eax
lea edi, [esp + 8]
mov edx, edi
mov eax, dword [esp]
mov ecx, 8
call fcn.000129b8
mov ebx, 4
mov eax, edi
mov dx, word [eax]
mov ecx, edx
shl ecx, 8
movzx edx, dx
shr edx, 8
or cx, dx
mov word [eax], cx
add eax, 2
dec ebx
jne 0x128056
xor ebx, ebx
mov ebp, ebx
add ebp, ebp
lea ebp, [ebp + ebp*2]
mov dx, word [esi + ebp*2 + 0xb8]
mov eax, edi
call fcn.00127da8
mov ax, word [esi + ebp*2 + 0xba]
add word [edi + 2], ax
mov ax, word [esi + ebp*2 + 0xbc]
add word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0xbe]
lea eax, [edi + 6]
call fcn.00127da8
mov ax, word [edi + 4]
mov word [esp + 0x10], ax
mov ax, word [edi]
xor word [edi + 4], ax
mov dx, word [esi + ebp*2 + 0xc0]
lea eax, [edi + 4]
call fcn.00127da8
mov ax, word [edi + 2]
mov word [esp + 0x12], ax
mov ax, word [edi + 6]
xor word [edi + 2], ax
mov ax, word [edi + 4]
add word [edi + 2], ax
mov dx, word [esi + ebp*2 + 0xc2]
lea eax, [edi + 2]
call fcn.00127da8
mov ax, word [edi + 2]
add word [edi + 4], ax
mov ax, word [edi + 2]
xor word [edi], ax
mov ax, word [edi + 4]
xor word [edi + 6], ax
mov ax, word [esp + 0x10]
xor word [edi + 2], ax
mov ax, word [esp + 0x12]
xor word [edi + 4], ax
inc ebx
cmp ebx, 8
jne 0x128072
mov dx, word [esi + 0x118]
mov eax, edi
call fcn.00127da8
mov ax, word [esi + 0x11a]
add word [edi + 4], ax
mov ax, word [esi + 0x11c]
add word [edi + 2], ax
mov dx, word [esi + 0x11e]
lea eax, [edi + 6]
call fcn.00127da8
mov ax, word [edi]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi], dx
mov ax, word [edi + 4]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [esp + 0x12], dx
mov ax, word [edi + 2]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 4], dx
mov ax, word [edi + 6]
mov edx, eax
shl edx, 8
movzx eax, ax
shr eax, 8
or dx, ax
mov word [edi + 6], dx
mov ax, word [esp + 0x12]
mov word [edi + 2], ax
mov edx, dword [esp + 4]
mov eax, edi
mov ecx, 8
call fcn.000129b8
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x150ab8
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, edx
mov esi, eax
mov eax, ebp
call fcn.00013e0c
mov eax, esi
call fcn.0001409c
add eax, 2
mov ecx, 3
cdq
idiv ecx
mov edx, eax
shl edx, 2
mov eax, ebp
call fcn.000143d0
mov eax, esi
call fcn.0001409c
add eax, 2
mov ecx, 3
cdq
idiv ecx
mov edi, eax
test edi, edi
jle 0x150bfd
mov ebx, 1
mov eax, esi
call fcn.0001409c
lea edx, [ebx + ebx*2]
cmp eax, edx
jge 0x150b3a
mov eax, esi
call fcn.0001409c
mov ecx, eax
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
sub ecx, eax
mov edx, esp
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
lea eax, [esi + eax]
call fcn.000129b8
jmp 0x150b4f
mov edx, esp
mov eax, ebx
dec eax
lea eax, [eax + eax*2]
lea eax, [esi + eax]
mov ecx, 3
call fcn.000129b8
mov al, byte [esp]
mov edx, eax
and dl, 0xfc
and edx, 0xff
shr edx, 2
mov ecx, 0x150c78
mov dl, byte [ecx + edx]
mov byte [esp + 3], dl
and al, 3
and eax, 0xff
shl eax, 4
mov dl, byte [esp + 1]
and dl, 0xf0
and edx, 0xff
shr edx, 4
or eax, edx
mov edx, 0x150c78
mov al, byte [edx + eax]
mov byte [esp + 4], al
mov dl, byte [esp + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov al, byte [esp + 2]
mov ecx, eax
and cl, 0xc0
and ecx, 0xff
shr ecx, 6
or edx, ecx
mov ecx, 0x150c78
mov dl, byte [ecx + edx]
mov byte [esp + 5], dl
and al, 0x3f
and eax, 0xff
mov edx, 0x150c78
mov al, byte [edx + eax]
mov byte [esp + 6], al
mov eax, ebp
call fcn.0001426c
mov edx, ebx
dec edx
shl edx, 2
lea edx, [eax + edx]
lea eax, [esp + 3]
mov ecx, 4
call fcn.000129b8
inc ebx
dec edi
jne 0x150b09
mov eax, esi
call fcn.0001409c
mov ecx, 3
cdq
idiv ecx
dec edx
jne 0x150c3d
mov eax, dword [ebp]
call fcn.0001409c
mov ebx, eax
mov eax, ebp
call fcn.0001426c
mov byte [eax + ebx - 2], 0x3d
mov eax, dword [ebp]
call fcn.0001409c
mov ebx, eax
mov eax, ebp
call fcn.0001426c
mov byte [eax + ebx - 1], 0x3d
jmp 0x150c67
mov eax, esi
call fcn.0001409c
mov ecx, 3
cdq
idiv ecx
cmp edx, 2
jne 0x150c67
mov eax, dword [ebp]
call fcn.0001409c
mov ebx, eax
mov eax, ebp
call fcn.0001426c
mov byte [eax + ebx - 1], 0x3d
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1b79a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x20]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov ebx, eax
lea esi, [ebp - 0x20]
cmp dword [esi], 0
jge 0x1b79ce
xor eax, eax
mov dword [esi], eax
mov eax, ebx
call fcn.001b73b4
cmp eax, dword [esi + 8]
jge 0x1b79e4
mov eax, ebx
call fcn.001b73b4
mov dword [esi + 8], eax
cmp dword [esi + 4], 0
jge 0x1b79ef
xor eax, eax
mov dword [esi + 4], eax
mov eax, ebx
call fcn.001b73c8
cmp eax, dword [esi + 0xc]
jge 0x1b7a05
mov eax, ebx
call fcn.001b73c8
mov dword [esi + 0xc], eax
mov eax, dword [esi]
cmp eax, dword [esi + 8]
jge 0x1b7aa7
mov eax, dword [esi + 4]
cmp eax, dword [esi + 0xc]
jge 0x1b7aa7
mov edx, dword [esi + 4]
mov eax, dword [ebp - 4]
call fcn.00091dbc
mov edx, dword [esi]
test edx, edx
jns 0x1b7a30
add edx, 7
sar edx, 3
add eax, edx
mov dword [ebp - 0xc], eax
mov edx, dword [esi + 4]
mov eax, dword [ebp + 8]
call fcn.00091dbc
mov ebx, dword [esi]
test ebx, ebx
jns 0x1b7a4c
add ebx, 7
sar ebx, 3
add eax, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 8]
add eax, 7
test eax, eax
jns 0x1b7a61
add eax, 7
sar eax, 3
sub eax, ebx
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
mov edx, dword [esi + 0xc]
dec edx
sub edx, eax
jl 0x1b7aa7
inc edx
mov esi, edx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x1b7a92
inc eax
mov bl, byte [ecx]
xor bl, 0xff
and byte [edx], bl
inc edx
inc ecx
dec eax
jne 0x1b7a86
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44]
add dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x44]
add dword [ebp - 0x10], eax
dec esi
jne 0x1b7a77
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4