joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10073410
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
sub esp, 0x540
cmp ecx, eax
push ebx
push ebp
push esi
push edi
jg 0x100735a2
mov edi, dword [esp + 0x554]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x150]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x150]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100735a2
and eax, 0x10
test al, al
je 0x100735a2
mov edi, 0x10266008
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x150]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x154]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x100735a2
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor edi, edi
mov al, 1
cmp al, 1
jne 0x10073580
mov esi, 0x10232580
lea eax, [esp + 0x3c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x10073505
test cl, cl
je 0x10073501
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x10073505
add eax, 2
add esi, 2
test cl, cl
jne 0x100734e1
xor eax, eax
jmp 0x1007350a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10073573
mov esi, 0x1023257c
lea eax, [esp + 0x3c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x1007353b
test cl, cl
je 0x10073537
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x1007353b
add eax, 2
add esi, 2
test cl, cl
jne 0x10073517
xor eax, eax
jmp 0x10073540
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10073573
mov eax, dword [esp + 0x10]
or al, 0x10
cmp eax, 0x10
jne 0x10073567
mov eax, dword [esp + 0x560]
test eax, eax
je 0x100735a2
lea ecx, [esp + 0x10]
push ecx
push ebp
call ebx
jmp 0x100734d0
mov eax, dword [esp + 0x55c]
inc edi
cmp edi, eax
jg 0x100735a2
lea ecx, [esp + 0x10]
push ecx
push ebp
call ebx
jmp 0x100734d0
cmp edi, dword [esp + 0x55c]
jg 0x100735a2
cmp edi, dword [esp + 0x558]
jl 0x100735a2
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x540
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x540
ret
Function at 0x1007f540
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x108
test eax, eax
push ebp
push edi
je 0x1007f664
mov ebp, dword [esp + 0x114]
test ebp, ebp
je 0x1007f664
mov eax, dword [esp + 0x118]
test eax, eax
je 0x1007f664
mov edi, dword [esp + 0x120]
test edi, edi
je 0x1007f664
xor eax, eax
mov byte [esp + eax + 0x10], al
inc eax
cmp eax, 0x100
jl 0x1007f583
push ebx
push esi
mov byte [esp + 0x10], 0
mov ecx, 0xff
mov eax, ecx
mov bl, byte [esp + ecx + 0x18]
cdq
idiv edi
mov eax, dword [esp + 0x124]
mov dl, byte [edx + eax]
mov al, byte [esp + 0x10]
add dl, bl
add al, dl
mov byte [esp + 0x10], al
mov eax, dword [esp + 0x10]
and eax, 0xff
dec ecx
mov dl, byte [esp + eax + 0x18]
lea esi, [esp + eax + 0x18]
mov byte [esp + ecx + 0x19], dl
mov byte [esi], bl
jns 0x1007f59b
mov eax, dword [esp + 0x130]
xor dl, dl
cmp eax, 1
jne 0x1007f5e6
mov byte [esp + 0x10], dl
mov ecx, dword [esp + 0x120]
xor eax, eax
test ecx, ecx
jle 0x1007f654
mov bl, byte [esp + 0x12c]
add dl, bl
mov bl, byte [esp + 0x10]
mov byte [esp + 0x14], dl
mov ecx, dword [esp + 0x14]
and ecx, 0xff
lea esi, [esp + ecx + 0x18]
mov cl, byte [esp + ecx + 0x18]
add bl, cl
mov byte [esp + 0x10], bl
mov edi, dword [esp + 0x10]
and edi, 0xff
mov bl, byte [esp + edi + 0x18]
lea edi, [esp + edi + 0x18]
mov byte [esi], bl
mov byte [edi], cl
mov bl, byte [esi]
add ebx, ecx
and ebx, 0xff
mov cl, byte [esp + ebx + 0x18]
mov bl, byte [eax + ebp]
xor bl, cl
mov ecx, dword [esp + 0x120]
mov byte [eax + ebp], bl
inc eax
cmp eax, ecx
jl 0x1007f5f3
pop esi
pop ebx
pop edi
mov eax, 1
pop ebp
add esp, 0x108
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x108
ret
Function at 0x1009c670
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
cmp edx, eax
jle 0x1009c67f
xor eax, eax
ret
xor eax, eax
test edx, edx
jle 0x1009c6a1
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [eax + ecx]
add eax, 4
xor edi, esi
cmp eax, edx
mov dword [eax + ecx - 4], edi
jl 0x1009c68f
pop edi
pop esi
xor ecx, ecx
cmp eax, edx
sete cl
mov eax, ecx
ret

Function at 0x100a1880
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x108
push ebp
mov ebp, dword [esp + 0x118]
test ebp, ebp
push esi
je 0x100a19ef
mov eax, dword [esp + 0x114]
test eax, eax
je 0x100a19ef
mov eax, dword [esp + 0x118]
test eax, eax
je 0x100a19ef
mov esi, dword [esp + 0x120]
test esi, esi
je 0x100a19ef
xor eax, eax
mov byte [esp + eax + 0x10], al
inc eax
cmp eax, 0x100
jl 0x100a18c6
push ebx
push edi
mov byte [esp + 0x10], 0
xor ecx, ecx
mov eax, ecx
mov bl, byte [esp + ecx + 0x18]
cdq
idiv esi
mov al, byte [edx + ebp]
mov dl, byte [esp + 0x10]
add al, bl
add dl, al
mov byte [esp + 0x10], dl
mov edx, dword [esp + 0x10]
and edx, 0xff
inc ecx
cmp ecx, 0x100
mov al, byte [esp + edx + 0x18]
lea edi, [esp + edx + 0x18]
mov byte [esp + ecx + 0x17], al
mov byte [edi], bl
jb 0x100a18db
mov eax, dword [esp + 0x130]
xor dl, dl
cmp eax, 1
jne 0x100a1926
mov byte [esp + 0x10], dl
mov esi, dword [esp + 0x134]
test esi, esi
jle 0x100a1973
mov al, byte [esp + 0x12c]
mov bl, byte [esp + 0x10]
add dl, al
mov byte [esp + 0x14], dl
mov ecx, dword [esp + 0x14]
and ecx, 0xff
lea eax, [esp + ecx + 0x18]
mov cl, byte [esp + ecx + 0x18]
add bl, cl
mov byte [esp + 0x10], bl
mov edi, dword [esp + 0x10]
and edi, 0xff
dec esi
mov bl, byte [esp + edi + 0x18]
lea edi, [esp + edi + 0x18]
mov byte [eax], bl
mov byte [edi], cl
jne 0x100a1931
mov eax, dword [esp + 0x120]
lea esi, [eax - 1]
test esi, esi
jl 0x100a19df
mov al, byte [esp + 0x12c]
mov bl, byte [esp + 0x10]
add dl, al
mov byte [esp + 0x14], dl
mov ecx, dword [esp + 0x14]
and ecx, 0xff
lea eax, [esp + ecx + 0x18]
mov cl, byte [esp + ecx + 0x18]
add bl, cl
mov byte [esp + 0x10], bl
mov edi, dword [esp + 0x10]
and edi, 0xff
mov bl, byte [esp + edi + 0x18]
lea edi, [esp + edi + 0x18]
mov byte [eax], bl
mov byte [edi], cl
mov al, byte [eax]
add eax, ecx
and eax, 0xff
mov cl, byte [esp + eax + 0x18]
mov eax, dword [esp + 0x11c]
mov bl, byte [esi + eax]
xor bl, cl
mov byte [esi + eax], bl
dec esi
jns 0x100a1981
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
add esp, 0x108
ret
pop esi
xor eax, eax
pop ebp
add esp, 0x108
ret
Function at 0x100a50f0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x100a51b2
mov esi, dword [esp + 0x10]
test esi, esi
je 0x100a51b2
mov eax, dword [esp + 0x18]
test eax, eax
je 0x100a51b2
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x100a51b2
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x100a51b2
push ebp
xor ebp, ebp
test eax, eax
jle 0x100a51a9
push ebx
mov eax, ebp
cdq
idiv ecx
mov al, byte [edx + esi]
lea ebx, [edx + esi]
mov dl, byte [edi]
add dl, al
mov al, dl
mov byte [edi], dl
and eax, 0xff
cdq
idiv ecx
mov dl, byte [edx + esi]
mov eax, edx
mov byte [edi], dl
and eax, 0xff
cdq
idiv ecx
xor eax, eax
mov al, byte [edx + esi]
cdq
idiv ecx
mov al, byte [edx + esi]
inc al
and eax, 0xff
cdq
idiv ecx
mov eax, dword [esp + 0x20]
mov dl, byte [edx + esi]
xor byte [eax + ebp], dl
mov al, byte [ebx]
mov byte [esp + 0x14], al
xor eax, eax
mov al, byte [edi]
cdq
idiv ecx
xor eax, eax
mov dl, byte [edx + esi]
mov byte [ebx], dl
mov al, byte [edi]
cdq
idiv ecx
mov al, byte [esp + 0x14]
inc ebp
mov byte [edx + esi], al
mov eax, dword [esp + 0x24]
cmp ebp, eax
jl 0x100a5136
pop ebx
pop ebp
pop edi
mov eax, 1
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x100a51c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x100a523e
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x100a523e
mov eax, dword [esp + 0x18]
test eax, eax
je 0x100a523e
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100a523e
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x100a523e
xor ecx, ecx
push esi
mov cl, byte [ebp]
push edi
xor esi, esi
mov eax, esi
cdq
idiv dword [esp + 0x1c]
mov eax, esi
lea edi, [edx + ebx]
cdq
idiv dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov al, byte [edx + eax]
mov dl, byte [edi]
add al, dl
add al, cl
xor ecx, ecx
mov byte [ebp], al
and eax, 0xff
inc esi
mov cl, byte [eax + ebx]
mov al, byte [edi]
cmp esi, 0x300
mov dl, byte [ecx + ebx]
mov byte [edi], dl
mov byte [ecx + ebx], al
jl 0x100a51f3
pop edi
mov byte [ebp], cl
pop esi
pop ebp
mov eax, 1
pop ebx
ret
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x100b8820
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0x30]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 8], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0xc], edx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x3c]
push esi
push edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x44], 0x80
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov eax, dword [ecx]
mov esi, dword [ecx]
and eax, 0x1f
mov edi, dword [edx]
push eax
mov eax, ebp
shr eax, 0xb
and eax, 3
mov ecx, dword [esp + eax*4 + 0x14]
push ecx
call fcn.10018570
mov edx, esi
mov ebx, eax
shr edx, 5
shl esi, 4
xor edx, esi
mov eax, edi
add ebx, edx
mov edx, dword [esp + 0x3c]
xor eax, ebp
sub ebp, edx
mov ecx, ebp
and edi, 0x1f
and ecx, 3
push edi
add ebx, eax
mov edx, dword [esp + ecx*4 + 0x1c]
push edx
call fcn.10018570
mov edx, dword [esp + 0x38]
mov edi, dword [esp + 0x40]
add esp, 0x10
mov ecx, dword [edx]
mov esi, ecx
shr esi, 5
shl ecx, 4
xor esi, ecx
mov ecx, dword [esp + 0x3c]
sub ecx, esi
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx]
mov dword [edi], esi
mov edi, dword [esp + 0x2c]
mov esi, dword [edx]
mov dword [edi], esi
mov esi, dword [ecx]
mov edi, dword [esp + 0x3c]
xor esi, ebp
sub edi, esi
sub edi, eax
mov eax, dword [esp + 0x40]
sub eax, ebx
mov dword [edx], edi
mov dword [ecx], eax
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov edx, dword [ecx]
mov ecx, dword [eax]
mov eax, dword [esp + 0x44]
dec eax
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], eax
jne 0x100b8862
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x100dba60
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x108
push ebp
mov ebp, dword [esp + 0x118]
test ebp, ebp
push edi
je 0x100dbbd1
mov eax, dword [esp + 0x114]
test eax, eax
je 0x100dbbd1
mov eax, dword [esp + 0x118]
test eax, eax
je 0x100dbbd1
mov edi, dword [esp + 0x120]
test edi, edi
je 0x100dbbd1
xor eax, eax
mov byte [esp + eax + 0x10], al
inc eax
cmp eax, 0x100
jl 0x100dbaa6
push ebx
push esi
mov byte [esp + 0x10], 0
xor ecx, ecx
mov eax, ecx
mov bl, byte [esp + ecx + 0x18]
cdq
idiv edi
mov al, byte [edx + ebp]
mov dl, byte [esp + 0x10]
add al, bl
add dl, al
mov byte [esp + 0x10], dl
mov edx, dword [esp + 0x10]
and edx, 0xff
inc ecx
cmp ecx, 0x100
mov al, byte [esp + edx + 0x18]
lea esi, [esp + edx + 0x18]
mov byte [esp + ecx + 0x17], al
mov byte [esi], bl
jb 0x100dbabb
mov eax, dword [esp + 0x130]
xor dl, dl
cmp eax, 1
jne 0x100dbb06
mov byte [esp + 0x10], dl
mov edi, dword [esp + 0x134]
test edi, edi
jle 0x100dbb53
mov al, byte [esp + 0x12c]
mov bl, byte [esp + 0x10]
add dl, al
mov byte [esp + 0x14], dl
mov ecx, dword [esp + 0x14]
and ecx, 0xff
lea eax, [esp + ecx + 0x18]
mov cl, byte [esp + ecx + 0x18]
add bl, cl
mov byte [esp + 0x10], bl
mov esi, dword [esp + 0x10]
and esi, 0xff
dec edi
mov bl, byte [esp + esi + 0x18]
lea esi, [esp + esi + 0x18]
mov byte [eax], bl
mov byte [esi], cl
jne 0x100dbb11
mov ebp, dword [esp + 0x120]
xor eax, eax
test ebp, ebp
jle 0x100dbbc1
mov bl, byte [esp + 0x12c]
add dl, bl
mov bl, byte [esp + 0x10]
mov byte [esp + 0x14], dl
mov ecx, dword [esp + 0x14]
and ecx, 0xff
lea esi, [esp + ecx + 0x18]
mov cl, byte [esp + ecx + 0x18]
add bl, cl
mov byte [esp + 0x10], bl
mov edi, dword [esp + 0x10]
and edi, 0xff
mov bl, byte [esp + edi + 0x18]
lea edi, [esp + edi + 0x18]
mov byte [esi], bl
mov byte [edi], cl
mov bl, byte [esi]
mov esi, dword [esp + 0x11c]
add ebx, ecx
and ebx, 0xff
mov cl, byte [esp + ebx + 0x18]
mov bl, byte [eax + esi]
xor bl, cl
mov byte [eax + esi], bl
inc eax
cmp eax, ebp
jl 0x100dbb60
pop esi
pop ebx
pop edi
mov eax, 1
pop ebp
add esp, 0x108
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x108
ret

Function at 0x10100bf0
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x10100c57
mov edx, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x1c]
mov eax, dword [esi]
mov ebx, eax
mov ebp, eax
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, ecx
shr ebp, 0xb
and ebp, 3
xor eax, ecx
add ecx, 0x61c88647
add ebx, dword [edi + ebp*4]
mov ebp, dword [edx]
add ebx, eax
sub ebp, ebx
mov eax, ebp
mov dword [edx], ebp
mov ebx, eax
xor eax, ecx
shr ebx, 5
shl ebp, 4
xor ebx, ebp
mov ebp, ecx
and ebp, 3
add ebx, dword [edi + ebp*4]
mov ebp, dword [esi]
add ebx, eax
sub ebp, ebx
test ecx, ecx
mov dword [esi], ebp
jne 0x10100c08
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10109f90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x24]
push ebx
xor eax, eax
add ecx, 0xfffffffc
push ebp
push esi
cmp ecx, eax
push edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
jle 0x1010a06b
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
or edx, 0xffffffff
and edi, 0xff
sub edx, ecx
lea esi, [ecx + 1]
mov dword [esp + 0x34], edx
xor edx, edx
xor ecx, ecx
mov dh, byte [esi - 1]
mov cl, byte [esi + 1]
mov dl, byte [esi]
mov ebx, 4
shl edx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [esi + 2]
shl edx, 8
or edx, ecx
mov ebp, edi
mov ecx, edx
shl ebp, 6
and ecx, 0xff
sub ebp, edi
add ebp, ecx
shl ebp, 0x1a
mov ecx, ebp
shr eax, 6
shr edx, 8
xor eax, ecx
dec ebx
jne 0x10109fea
mov dword [esp + 0x18], eax
and eax, 0xff
mov edx, dword [esp + 0x19]
mov ecx, dword [esp + 0x1b]
and edx, 0xff
mov ebx, dword [esp + 0x34]
shl edx, 8
or edx, eax
mov eax, dword [esp + 0x1a]
and eax, 0xff
and ecx, 0xff
or edx, eax
mov ebp, dword [esp + 0x14]
shl edx, 8
or edx, ecx
mov ecx, dword [esp + 0x10]
mov eax, edx
mov edx, dword [esp + 0x30]
add esi, 4
mov dword [ecx + edx], eax
add ebx, esi
add ecx, 3
cmp ebx, ebp
mov dword [esp + 0x10], ecx
jl 0x10109fca
cmp ecx, 8
jge 0x1010a075
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
lea edi, [ecx - 8]
test edi, edi
jle 0x1010a0a1
mov ebx, dword [esp + 0x2c]
mov esi, 0xfffffffc
lea eax, [edx + 4]
sub esi, edx
mov ebp, dword [esp + 0x28]
xor dword [eax - 4], ebp
mov ebp, dword [eax]
xor ebp, ebx
mov dword [eax], ebp
add eax, 8
lea ebp, [esi + eax]
cmp ebp, edi
jl 0x1010a08a
cmp ecx, 0x100
jl 0x1010a0ae
mov ecx, 0x100
lea edi, [ecx - 0x10]
xor esi, esi
xor eax, eax
test edi, edi
jle 0x1010a143
mov bl, 0xfc
mov ebp, 0xc300
cmp esi, 3
jge 0x1010a14d
mov ecx, esi
sub ecx, 0
je 0x1010a121
dec ecx
je 0x1010a0ff
dec ecx
jne 0x1010a139
cmp word [eax + edx], 0x35ad
jne 0x1010a139
mov ecx, dword [eax + edx + 2]
test ecx, ecx
je 0x1010a139
cmp ecx, 0xffffffff
je 0x1010a139
cmp word [eax + edx + 6], 0xe2ab
jne 0x1010a139
mov esi, 3
jmp 0x1010a139
cmp word [eax + edx], 0x8d5d
jne 0x1010a139
cmp dword [eax + edx + 6], 0xb9f78900
jne 0x1010a139
cmp byte [eax + edx + 0xe], bl
jne 0x1010a139
add eax, 0xd
mov esi, 2
jmp 0x1010a139
cmp dword [eax + edx], 0x1e8
jne 0x1010a139
cmp word [eax + edx + 4], bp
jne 0x1010a139
add eax, 5
mov esi, 1
inc eax
cmp eax, edi
jl 0x1010a0c4
cmp esi, 3
jge 0x1010a14d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
Function at 0x101143e0
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x804
test eax, eax
je 0x10114513
mov eax, dword [esp + 0x808]
test eax, eax
je 0x10114513
mov eax, dword [esp + 0x80c]
test eax, eax
je 0x10114513
mov eax, dword [esp + 0x814]
test eax, eax
je 0x10114513
xor eax, eax
lea ecx, [esp + 4]
mov dword [ecx], eax
inc eax
add ecx, 4
cmp eax, 0x200
jl 0x10114425
push ebx
push ebp
push esi
push edi
xor esi, esi
xor edi, edi
lea ebx, [esp + 0x14]
mov eax, edi
mov ebp, dword [esp + 0x820]
cdq
idiv dword [esp + 0x824]
mov ecx, dword [ebx]
xor eax, eax
add ebx, 4
mov al, byte [edx + ebp]
mov edx, eax
add edx, ecx
and ecx, 0xff
add edx, esi
and edx, 0x1ff
inc edi
mov esi, edx
cmp edi, 0x200
mov eax, dword [esp + esi*4 + 0x14]
mov dword [ebx - 4], eax
mov dword [esp + esi*4 + 0x14], ecx
jl 0x1011443e
mov ecx, dword [esp + 0x81c]
xor edx, edx
mov edi, 2
lea eax, [ecx - 2]
test eax, eax
mov dword [esp + 0x10], eax
jle 0x10114503
mov ebx, dword [esp + 0x818]
mov eax, dword [esp + edi*4 + 0x14]
add edi, 2
add esi, eax
and eax, 0xff
and esi, 0x1ff
mov ecx, dword [esp + esi*4 + 0x14]
mov dword [esp + edi*4 + 0xc], ecx
mov dword [esp + esi*4 + 0x14], eax
mov ecx, dword [esp + edi*4 + 0xc]
and eax, 0x3f
and ecx, 0xff
mov ebp, ecx
and ebp, 0x7f
add ecx, ebp
add eax, ecx
mov cl, byte [edx + ebx]
and eax, 0x1ff
mov eax, dword [esp + eax*4 + 0x14]
xor al, cl
and edi, 0x800001ff
not al
mov byte [edx + ebx], al
jns 0x101144fa
dec edi
or edi, 0xfffffe00
inc edi
mov eax, dword [esp + 0x10]
inc edx
cmp edx, eax
jl 0x101144a1
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x804
ret
xor eax, eax
add esp, 0x804
ret
Function at 0x10117a20
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x78]
mov al, 0xe8
push edi
cmp byte [esi], al
jne 0x10117b78
cmp byte [esi + 5], al
jne 0x10117b78
cmp byte [esi + 0xa], al
jne 0x10117b78
cmp byte [esi + 0xf], al
jne 0x10117b78
cmp byte [esi + 0x14], al
jne 0x10117b78
cmp byte [esi + 0x19], al
jne 0x10117b78
cmp byte [esi + 0x1e], al
jne 0x10117b78
cmp byte [esi + 0x23], al
jne 0x10117b78
cmp byte [esi + 0x28], al
jne 0x10117b78
cmp byte [esi + 0x2d], al
jne 0x10117b78
mov eax, dword [esi + 1]
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x80]
mov ebx, dword [esp + 0x78]
mov ebp, dword [esp + 0x14]
lea edx, [esp + 0x7c]
push 0
push edx
push esi
lea eax, [eax + ecx + 5]
push edi
push 0x100
push eax
mov eax, dword [0x107ab964]
push ebx
push ebp
push eax
call fcn.100253e0
add esp, 0x24
test eax, eax
je 0x10117b78
cmp dword [esp + 0x7c], 0x100
jne 0x10117b78
cmp dword [esi], 0xb860
jne 0x10117b78
cmp dword [esi + 4], 0x158b0000
jne 0x10117b78
cmp dword [esi + 0xa], 0x90310040
jne 0x10117b78
cmp dword [esi + 0x10], 0xc0830040
jne 0x10117b78
cmp dword [esi + 0x14], 0x16d73d04
jne 0x10117b78
cmp dword [esi + 0x18], 0xf07e0000
jne 0x10117b78
cmp byte [esi + 0x1c], 0x61
jne 0x10117b78
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x34]
cmp eax, ecx
jb 0x10117b78
cmp eax, dword [esi + 0xe]
jne 0x10117b78
sub eax, ecx
mov edx, dword [0x107ab964]
lea ecx, [esp + 0x7c]
push 0
push ecx
push esi
push edi
push edi
push eax
push ebx
push ebp
push edx
call fcn.100253e0
add esp, 0x24
test eax, eax
je 0x10117b78
cmp dword [esp + 0x7c], edi
jne 0x10117b78
mov eax, 4
lea ecx, [edi - 0x10]
cmp ecx, eax
jle 0x10117b6e
mov edx, dword [esi]
mov ebx, dword [eax + esi]
xor ebx, edx
mov dword [eax + esi], ebx
add eax, 4
cmp eax, ecx
jl 0x10117b5d
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x101299d0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
push edi
mov edi, dword [esp + 0x114]
test edi, edi
jne 0x101299ec
xor eax, eax
pop edi
add esp, 0x108
ret
xor eax, eax
mov byte [esp + eax + 0xc], al
inc eax
cmp eax, 0x100
jl 0x101299ee
push ebx
push esi
mov esi, dword [esp + 0x118]
xor ecx, ecx
mov eax, ecx
mov bl, byte [esp + ecx + 0x14]
cdq
idiv edi
mov al, byte [edx + esi]
xor bl, al
mov byte [esp + ecx + 0x14], bl
inc ecx
cmp ecx, 0x100
jl 0x10129a05
mov edi, dword [esp + 0x128]
lea ecx, [esp + 0x14]
xor esi, esi
sub edi, ecx
mov dl, byte [esp + esi + 0x14]
lea eax, [esp + esi + 0x14]
xor ecx, ecx
mov cl, byte [edi + eax]
cmp esi, ecx
mov bl, byte [esp + ecx + 0x14]
mov byte [eax], bl
mov byte [esp + ecx + 0x14], dl
jne 0x10129a4d
mov byte [eax], 0
inc esi
cmp esi, 0x100
jl 0x10129a2f
mov ecx, dword [esp + 0x124]
xor eax, eax
xor dl, dl
cmp ecx, eax
mov byte [esp + 0xc], al
jle 0x10129acc
push ebp
mov ebp, dword [esp + 0x124]
inc dl
mov bl, byte [esp + 0x10]
mov byte [esp + 0x14], dl
mov ecx, dword [esp + 0x14]
and ecx, 0xff
lea esi, [esp + ecx + 0x18]
mov cl, byte [esp + ecx + 0x18]
add bl, cl
mov byte [esp + 0x10], bl
mov edi, dword [esp + 0x10]
and edi, 0xff
mov bl, byte [esp + edi + 0x18]
lea edi, [esp + edi + 0x18]
mov byte [esi], bl
mov byte [edi], cl
mov bl, byte [esi]
add ebx, ecx
and ebx, 0xff
mov cl, byte [esp + ebx + 0x18]
mov bl, byte [eax + ebp]
xor bl, cl
mov ecx, dword [esp + 0x128]
mov byte [eax + ebp], bl
inc eax
cmp eax, ecx
jl 0x10129a71
pop ebp
pop esi
pop ebx
mov eax, 1
pop edi
add esp, 0x108
ret
Function at 0x1012c7d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x106c
call fcn.102244a0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1080]
lea eax, [esp + 0x18]
push edi
push eax
mov ecx, esi
call fcn.10002060
test eax, eax
je 0x1012c872
mov eax, dword [esp + 0x1080]
mov ecx, esi
push eax
mov ebp, eax
call fcn.10004950
test eax, eax
je 0x1012c872
mov edx, dword [esp + 0x108c]
lea ecx, [eax - 0xc00]
lea esi, [edx - 0x15]
cmp ecx, esi
jge 0x1012c872
add eax, 0x1300
mov edi, 0xe983ab5a
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1088]
mov dl, 0xe2
cmp ecx, dword [esp + 0x10]
jge 0x1012c872
cmp word [ecx + eax], 0x550
jne 0x1012c86d
cmp dword [ecx + eax + 6], 0xc233c80f
jne 0x1012c86d
cmp dword [ecx + eax + 0xa], edi
jne 0x1012c86d
cmp byte [ecx + eax + 0xf], dl
jne 0x1012c86d
mov ebx, dword [ecx + eax + 2]
test ebx, ebx
je 0x1012c86d
mov bl, byte [ecx + eax + 0x10]
and bl, 0x80
cmp bl, 0x80
je 0x1012c87f
inc ecx
cmp ecx, esi
jl 0x1012c835
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x106c
ret
mov edi, dword [ecx + eax + 2]
test edi, edi
je 0x1012c872
mov esi, dword [esp + 0x38]
lea ecx, [esp + 0x18]
sub ebp, esi
push 0
lea edx, [esp + 0x80]
add ebp, 0x700
push ecx
mov ecx, dword [esp + 0x1098]
push edx
mov edx, dword [0x107ab964]
mov eax, ebp
push 0x1000
push 0x1000
push eax
mov eax, dword [esp + 0x10ac]
push eax
push ecx
push edx
call fcn.100253e0
add esp, 0x24
test eax, eax
je 0x1012c872
cmp dword [esp + 0x18], 0x1000
jne 0x1012c872
xor ecx, ecx
mov al, byte [esp + ecx + 0x7c]
test al, al
je 0x1012c8fe
cmp al, 0x61
jb 0x1012c8ee
cmp al, 0x7a
jbe 0x1012c8fe
mov al, byte [esp + ecx + 0x7d]
test al, al
je 0x1012c8fe
cmp al, 0x61
jb 0x1012c914
cmp al, 0x7a
ja 0x1012c914
inc ecx
cmp ecx, 0xc00
jb 0x1012c8de
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x106c
ret
cmp ecx, 0xffffffff
mov dword [esp + 0x10], ecx
je 0x1012c872
mov esi, dword [esp + ecx + 0x7c]
lea eax, [esp + ecx + 0x7c]
add ecx, 4
mov dword [esp + 0x14], eax
cmp ecx, 0xffc
mov dword [eax], 0x805a4d
jae 0x1012c97b
mov edx, dword [esp + ecx + 0x7c]
add ecx, 4
lea eax, [edx + edi]
mov ebx, eax
mov ebp, eax
and ebx, 0xff0000
shr ebp, 0x10
or ebx, ebp
mov ebp, eax
shl ebp, 0x10
and eax, 0xff00
or ebp, eax
shr ebx, 8
shl ebp, 8
or ebx, ebp
xor ebx, esi
cmp ecx, 0xffc
mov dword [esp + ecx + 0x78], ebx
mov esi, edx
jb 0x1012c93e
mov ebp, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, 0x1000
sub eax, ebp
push eax
push ecx
call fcn.1000ba10
add esp, 8
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x106c
ret