joyce8/EMBER2024-capa huggingface dataset:
Function at 0x67b1a1
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov eax, 0x105c
push edi
push esi
push ebx
call fcn.00a51dc8
mov dword [esp + 0x4c], 0
mov eax, dword [esp + 0x1080]
mov edi, dword [esp + 0x1074]
cmp dword [esp + 0x4c], eax
mov esi, dword [esp + 0x1078]
jge 0x67b24f
xor ebp, ebp
xor ebx, ebx
movzx edx, byte [ebx + esi]
movzx eax, byte [ebx + edi]
lea ecx, [ebp + ebx]
sub eax, edx
shl eax, 4
mov dword [esp + ecx*4 + 0x50], eax
movzx edx, byte [esi + ebx + 1]
movzx eax, byte [edi + ebx + 1]
sub eax, edx
shl eax, 4
mov dword [esp + ecx*4 + 0x54], eax
movzx edx, byte [esi + ebx + 2]
movzx eax, byte [edi + ebx + 2]
sub eax, edx
shl eax, 4
mov dword [esp + ecx*4 + 0x58], eax
movzx eax, byte [edi + ebx + 3]
movzx edx, byte [esi + ebx + 3]
add ebx, 4
sub eax, edx
shl eax, 4
cmp ebx, 0x20
mov dword [esp + ecx*4 + 0x5c], eax
jl 0x67b1d6
add dword [esp + 0x4c], 1
mov ebx, dword [esp + 0x1080]
add edi, dword [esp + 0x107c]
add esi, dword [esp + 0x107c]
add ebp, 0x20
cmp dword [esp + 0x4c], ebx
jl 0x67b1d4
mov edi, dword [esp + 0x1080]
lea esi, [esp + 0x50]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], edi
mov dword [esp + 4], 0x20
mov dword [esp], esi
xor ebp, ebp
call fcn.00798c2d
mov dword [esp + 0x48], 0
xor ecx, ecx
cmp dword [esp + 0x48], 0
setne cl
cmp ecx, 3
mov dword [esp + 0x44], ecx
jg 0x67b367
mov ecx, 4
mov eax, dword [esp + 0x48]
mov edi, 0x20
sub ecx, dword [esp + 0x48]
mov dword [esp + 0x34], 0x20
add eax, 0x10
sar edi, cl
shl dword [esp + 0x34], cl
mov dword [esp + 0x30], eax
xor edx, edx
mov eax, dword [esp + 0x34]
test byte [esp + 0x44], 1
mov ecx, edx
mov dword [esp + 0x2c], 0
cmovne ecx, edi
sar eax, 1
test byte [esp + 0x44], 2
cmove eax, edx
cmp edx, edi
jge 0x67b357
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x44]
add eax, ecx
lea esi, [ebx + edx*4]
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], esi
xor ebx, ebx
cmp ebx, edi
jge 0x67b344
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
add eax, dword [esp + 0x38]
mov esi, dword [ecx*4 + 0xc96480]
lea ecx, [esp + eax*4 + 0x50]
mov eax, dword [ecx]
add ebx, 1
add ecx, 4
imul eax, esi
cdq
xor eax, edx
sub eax, edx
add ebp, eax
cmp ebx, edi
jl 0x67b32e
add dword [esp + 0x2c], 1
mov esi, dword [esp + 0x34]
add dword [esp + 0x38], esi
cmp dword [esp + 0x2c], edi
jl 0x67b311
add dword [esp + 0x44], 1
cmp dword [esp + 0x44], 3
jle 0x67b2ce
add dword [esp + 0x48], 1
cmp dword [esp + 0x48], 4
jl 0x67b290
add esp, 0x105c
sar ebp, 9
pop ebx
mov eax, ebp
pop esi
pop edi
pop ebp
ret
Function at 0x8a70a6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x4c
mov dword [esp + 0x44], edi
mov edi, dword [esp + 0x88]
mov dword [esp + 0x48], ebp
mov ebp, edi
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x84]
and ebp, 1
mov dword [esp + 0x40], esi
mov ecx, eax
mov esi, ebp
and ecx, 1
mov dword [esp + 0x3c], ebx
add esi, esi
sar eax, 1
mov ebx, dword [esp + 0x64]
or esi, ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0x2c], ebp
add eax, dword [esp + 0x5c]
mov ebp, edi
mov dword [esp], ebx
mov edx, 0xfffffff0
mov dword [esp + 0x28], ecx
sar ebp, 1
mov ebx, esi
mov dword [esp + 0x30], 0
call fcn.008a6930
add ebp, dword [esp + 0x60]
and ebx, 0xfffffffe
mov edx, dword [esp + 0x68]
cmp eax, dword [esp + 0x64]
mov edi, eax
mov dword [esp], edx
cmovne ebx, esi
mov edx, 0xfffffff0
mov eax, ebp
call fcn.008a6930
mov esi, ebx
mov ecx, dword [esp + 0x6c]
and esi, 0xfffffffd
cmp eax, dword [esp + 0x68]
mov edx, eax
cmove ebx, esi
imul ecx, eax
mov esi, dword [esp + 0x38]
add ecx, edi
mov ebp, dword [esp + 0x50]
mov eax, dword [esi + 0xadc]
add ebp, ecx
test eax, eax
je 0x8a7160
test byte [esi + 0x3d], 0x40
jne 0x8a71b0
mov esi, dword [esp + 0x58]
test esi, esi
je 0x8a7172
mov edi, dword [esp + 0x38]
add ebp, dword [edi + 0xb8]
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x34]
mov dword [esp + 0xc], eax
mov dword [esp + 4], ebp
mov dword [esp + 8], ecx
mov ebp, dword [esp + 0x80]
mov dword [esp], edx
call dword [ebp + ebx*4]
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x3c]
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
add esp, 0x4c
ret
mov eax, dword [esp + 0x70]
sub eax, dword [esp + 0x28]
sub eax, dword [esp + 0x78]
cmp edi, eax
ja 0x8a71d6
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x7c]
sub dword [esp + 0x74], ecx
sub dword [esp + 0x74], esi
cmp edx, dword [esp + 0x74]
jbe 0x8a7160
mov esi, dword [esp + 0x38]
mov ecx, dword [esp + 0x70]
mov eax, dword [esi + 0xb0]
mov dword [esp + 0x1c], ecx
movzx ecx, byte [esp + 0x54]
mov dword [esp + 0x20], eax
mov eax, edx
mov edx, dword [esp + 0x7c]
shl eax, cl
add edx, 1
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x78]
shl edx, cl
add eax, 1
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov edi, dword [esi + 0xb8]
mov dword [esp + 4], ebp
mov dword [esp + 8], edi
mov edx, dword [esi + 0xa80]
mov dword [esp], edx
call fcn.0067b4e3
mov ebp, dword [esi + 0xa80]
mov dword [esp + 0x30], 1
jmp 0x8a7160
Function at 0x95fba5
Capabilities:
Hash data with md5

Disassembly:
push ebp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x7c
mov esi, dword [esp + 0x98]
mov dword [esp + 0x10], 0
mov ebp, dword [esp + 0x94]
mov edx, dword [esp + 0x10]
mov eax, esi
lea edi, [esp + 0x10]
sar eax, 0x1f
and edx, 0x3f
cmp ebx, esi
mov dword [esp + 0x58], 0x10325476
mov dword [esp + 0x5c], 0x98badcfe
mov dword [esp + 0x60], 0xefcdab89
mov dword [esp + 0x64], 0x67452301
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jge 0x95fc1b
movzx ecx, byte [ebx + ebp]
mov byte [edx + edi + 8], cl
add edx, 1
cmp edx, 0x40
je 0x95fd1e
add ebx, 1
cmp ebx, esi
jl 0x95fc00
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
mov ecx, ebp
mov eax, esi
and ebx, 0x3f
shld eax, ebp, 3
shl ecx, 3
add ebp, 1
adc esi, 0
movzx edx, byte [0xd691b0]
cmp ebx, 0x3f
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], esi
mov byte [ebx + edi + 8], dl
jmp 0x95fc8e
mov ebx, dword [edi]
xor ebp, ebp
mov esi, dword [edi + 4]
mov eax, ebx
and eax, 0x3f
mov ecx, eax
xor ecx, 0x38
or ecx, ebp
je 0x95fcb0
mov edx, dword [edi]
and edx, 0x3f
add ebx, 1
adc esi, 0
mov dword [edi], ebx
movzx ebx, byte [0xd691b2]
mov dword [edi + 4], esi
mov byte [edx + edi + 8], bl
cmp edx, 0x3f
jne 0x95fc5b
lea eax, [edi + 0x48]
lea edx, [edi + 8]
xor ebp, ebp
call fcn.0095f16c
mov ebx, dword [edi]
mov esi, dword [edi + 4]
mov eax, ebx
and eax, 0x3f
mov ecx, eax
xor ecx, 0x38
or ecx, ebp
jne 0x95fc70
mov edx, dword [edi]
lea ebp, [esp + 8]
and edx, 0x3f
add ebx, 8
adc esi, 0
mov dword [edi], ebx
xor ebx, ebx
mov dword [edi + 4], esi
jmp 0x95fcd0
add ebx, 1
cmp ebx, 8
jge 0x95fcf5
movzx ecx, byte [ebx + ebp]
mov byte [edx + edi + 8], cl
add edx, 1
cmp edx, 0x40
jne 0x95fcc8
lea edx, [edi + 8]
lea eax, [edi + 0x48]
add ebx, 1
call fcn.0095f16c
xor edx, edx
cmp ebx, 8
jl 0x95fcd0
xor edx, edx
mov ecx, 3
mov ebp, ecx
mov esi, dword [esp + 0x90]
sub ebp, edx
mov ebx, dword [edi + ebp*4 + 0x48]
mov dword [esi + edx*4], ebx
add edx, 1
cmp edx, 3
jle 0x95fcfc
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
ret
lea edx, [edi + 8]
lea eax, [edi + 0x48]
add ebx, 1
call fcn.0095f16c
xor edx, edx
jmp 0x95fc17
Function at 0x961d0d
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x28]
shl eax, 8
add eax, dword [esp + 0x28]
lea ebp, [eax*4 + 0x1244a00]
mov ecx, dword [ebp + 0x400]
test ecx, ecx
jne 0x961ddb
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x28]
movzx esi, byte [edi*8 + 0xb4f060]
movzx edi, byte [ebx*8 + 0xb4f061]
lea edx, [edi - 8]
mov dword [esp + 0xc], esi
mov esi, dword [ebx*8 + 0xb4f064]
cmp edx, 0x18
ja 0x961df5
mov ecx, edi
mov eax, 1
xor edx, edx
shld edx, eax, cl
xor ebx, ebx
shl eax, cl
and cl, 0x20
mov dword [esp + 4], 0
mov dword [esp], esi
cmovne edx, eax
cmovne eax, ebx
cmp dword [esp + 4], edx
jg 0x961df5
jl 0x961d94
cmp dword [esp], eax
jae 0x961df5
mov ecx, 0x20
xor ebx, ebx
sub ecx, edi
mov edi, esi
shl edi, cl
mov eax, dword [esp + 0xc]
test eax, eax
je 0x961dff
mov edx, ebx
mov ecx, 7
mov eax, edx
and edx, 1
neg edx
shr eax, 1
and edx, esi
xor edx, eax
sub ecx, 1
jns 0x961db0
mov dword [ebp + ebx*4], edx
add ebx, 1
cmp ebx, 0xff
jle 0x961da1
mov dword [ebp + 0x400], 1
mov ebp, dword [esp + 0x28]
shl ebp, 8
add ebp, dword [esp + 0x28]
add esp, 0x14
pop ebx
lea eax, [ebp*4 + 0x1244a00]
pop esi
pop edi
pop ebp
ret
add esp, 0x14
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, ebx
mov ecx, 7
shl edx, 0x18
lea eax, [edx + edx]
sar edx, 0x1f
and edx, edi
xor edx, eax
sub ecx, 1
jns 0x961e09
bswap edx
mov dword [ebp + ebx*4], edx
add ebx, 1
cmp ebx, 0xff
jle 0x961da1
jmp 0x961dd1
Function at 0x9972b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 8], ebx
test esi, esi
je 0x99740a
mov ebx, dword [esi + 0x1c]
test ebx, ebx
je 0x99740a
mov eax, dword [esi + 0x20]
test eax, eax
je 0x99740a
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x99740a
mov dword [esi + 0x2c], 2
mov edx, dword [ebx + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [ebx + 0x10], edx
mov edx, dword [ebx + 0x18]
mov dword [esi + 0x18], 0
mov dword [ebx + 0x14], 0
test edx, edx
js 0x997436
cmp edx, 1
sbb eax, eax
and eax, 0x47
add eax, 0x2a
cmp edx, 2
mov dword [ebx + 4], eax
je 0x997419
mov dword [esp], 0
xor ecx, ecx
xor eax, eax
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call fcn.00999ed8
mov dword [esi + 0x30], eax
mov dword [ebx + 0x28], 0
mov dword [esp], ebx
call fcn.0099a288
mov edx, dword [ebx + 0x2c]
xor ecx, ecx
mov eax, dword [ebx + 0x4c]
add edx, edx
lea esi, [eax + eax - 2]
mov dword [ebx + 0x3c], edx
mov edx, dword [ebx + 0x44]
mov word [edx + eax*2 - 2], 0
mov dword [esp + 8], esi
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.00a5b648
mov dword [ebx + 0x6c], 0
mov eax, dword [ebx + 0x84]
mov dword [ebx + 0x5c], 0
mov dword [ebx + 0x74], 0
lea eax, [eax + eax*2]
shl eax, 2
movzx esi, word [eax + 0xd6e442]
movzx ecx, word [eax + 0xd6e440]
movzx edx, word [eax + 0xd6e444]
mov dword [ebx + 0x78], 2
mov dword [ebx + 0x80], esi
movzx esi, word [eax + 0xd6e446]
xor eax, eax
mov dword [ebx + 0x8c], ecx
mov dword [ebx + 0x90], edx
mov dword [ebx + 0x7c], esi
mov dword [ebx + 0x60], 2
mov dword [ebx + 0x68], 0
mov dword [ebx + 0x48], 0
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 8]
mov eax, 0xfffffffe
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], 0
xor edx, edx
xor ecx, ecx
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
call fcn.00999158
jmp 0x997353
neg edx
mov dword [ebx + 0x18], edx
jmp 0x997324
Function at 0x997e38
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x1c
mov eax, dword [eax + 0x2c]
mov edx, dword [edi + 0x74]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], edx
jmp 0x997f11
mov ebx, dword [edi]
mov edx, dword [ebx + 4]
mov dword [ebp - 0x18], ebx
test edx, edx
je 0x997fc8
mov eax, dword [edi + 0x38]
mov ebx, edx
add esi, eax
mov eax, dword [edi + 0x74]
add esi, eax
cmp edx, dword [ebp - 0x10]
jbe 0x997e7c
mov ebx, dword [ebp - 0x10]
xor ecx, ecx
test ebx, ebx
je 0x997ec6
mov eax, dword [ebp - 0x18]
sub edx, ebx
mov ecx, dword [eax + 0x1c]
mov dword [eax + 4], edx
mov edx, eax
mov eax, dword [ecx + 0x18]
cmp eax, 1
je 0x997fd0
cmp eax, 2
je 0x997ff0
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov dword [esp], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
call fcn.00a5b5c0
mov esi, dword [ebp - 0x18]
mov ecx, ebx
mov eax, dword [edi + 0x74]
add dword [esi], ebx
add dword [esi + 8], ebx
lea esi, [eax + ecx]
cmp esi, 2
mov dword [ebp - 0x1c], esi
mov dword [edi + 0x74], esi
jbe 0x997ef5
mov ebx, dword [edi + 0x6c]
mov edx, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx eax, byte [ebx + edx]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + ebx + 1]
mov ebx, dword [edi + 0x54]
xor eax, ecx
and eax, ebx
mov dword [edi + 0x48], eax
cmp esi, 0x105
ja 0x997fc8
mov eax, dword [edi]
mov esi, dword [eax + 4]
test esi, esi
je 0x997fc8
mov eax, dword [edi + 0x2c]
mov ecx, dword [edi + 0x3c]
mov ebx, dword [ebp - 0x1c]
mov esi, dword [edi + 0x6c]
sub ecx, ebx
sub ecx, esi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x14]
lea eax, [eax + ecx - 0x106]
cmp esi, eax
jb 0x997e58
mov dword [esp + 8], ecx
mov esi, dword [edi + 0x38]
mov ebx, ecx
mov dword [esp], esi
add ebx, esi
mov dword [esp + 4], ebx
call fcn.00a5b5c0
mov eax, dword [ebp - 0x14]
mov esi, dword [edi + 0x6c]
mov ecx, dword [edi + 0x4c]
sub dword [edi + 0x70], eax
mov edx, dword [edi + 0x44]
sub esi, eax
sub dword [edi + 0x5c], eax
mov dword [edi + 0x6c], esi
lea eax, [edx + ecx*2]
lea esi, [esi]
sub eax, 2
xor ebx, ebx
movzx edx, word [eax]
cmp edx, dword [ebp - 0x14]
jb 0x997f7c
mov ebx, edx
mov edx, dword [ebp - 0x14]
sub ebx, edx
mov word [eax], bx
dec ecx
jne 0x997f68
mov ecx, dword [ebp - 0x14]
mov eax, dword [edi + 0x40]
lea eax, [eax + ecx*2]
lea esi, [esi]
lea edi, [edi]
sub eax, 2
xor ebx, ebx
movzx edx, word [eax]
cmp edx, dword [ebp - 0x14]
jb 0x997fac
mov ebx, edx
mov edx, dword [ebp - 0x14]
sub ebx, edx
mov word [eax], bx
dec ecx
jne 0x997f98
mov ebx, dword [edi]
mov ecx, dword [ebp - 0x14]
add dword [ebp - 0x10], ecx
mov edx, dword [ebx + 4]
mov dword [ebp - 0x18], ebx
test edx, edx
jne 0x997e68
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov eax, dword [edx]
mov dword [esp + 4], eax
mov ecx, dword [edx + 0x30]
mov dword [esp], ecx
call fcn.00999ed8
mov ecx, dword [ebp - 0x18]
mov dword [ecx + 0x30], eax
jmp 0x997ea4
mov dword [esp + 8], ebx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
mov dword [esp + 4], eax
mov ecx, dword [edx + 0x30]
mov dword [esp], ecx
call fcn.00999158
jmp 0x997fe5
Function at 0xa1a1e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
test ecx, ecx
push esi
push ebx
jle 0xa1a328
mov ecx, dword [ebp + 0xc]
mov ebx, dword [edi]
mov edx, dword [ebp + 0x10]
movzx eax, byte [ecx]
mov ecx, ebx
lea esi, [edx - 1]
sar ecx, 8
and esi, 3
xor eax, ebx
and eax, 0xff
mov ebx, 1
mov edx, dword [eax*4 + 0xb58720]
xor ecx, edx
mov dword [edi], ecx
cmp ebx, dword [ebp + 0x10]
jge 0xa1a328
test esi, esi
je 0xa1a2a8
cmp esi, 1
je 0xa1a27f
cmp esi, 2
je 0xa1a261
mov ebx, dword [ebp + 0xc]
movzx eax, byte [ebx + 1]
mov ebx, 2
xor eax, ecx
and eax, 0xff
sar ecx, 8
mov esi, dword [eax*4 + 0xb58720]
xor ecx, esi
mov dword [edi], ecx
mov eax, dword [ebp + 0xc]
movzx esi, byte [ebx + eax]
inc ebx
xor esi, ecx
and esi, 0xff
sar ecx, 8
mov edx, dword [esi*4 + 0xb58720]
xor ecx, edx
mov dword [edi], ecx
mov eax, dword [ebp + 0xc]
movzx esi, byte [ebx + eax]
inc ebx
xor esi, ecx
and esi, 0xff
sar ecx, 8
mov edx, dword [esi*4 + 0xb58720]
xor ecx, edx
mov dword [edi], ecx
cmp ebx, dword [ebp + 0x10]
jge 0xa1a328
nop
mov eax, dword [ebp + 0xc]
movzx esi, byte [ebx + eax]
mov eax, ecx
sar eax, 8
xor esi, ecx
and esi, 0xff
mov ecx, dword [esi*4 + 0xb58720]
xor eax, ecx
mov ecx, dword [ebp + 0xc]
mov dword [edi], eax
movzx edx, byte [ecx + ebx + 1]
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0xb58720]
sar eax, 8
xor eax, esi
mov dword [edi], eax
movzx edx, byte [ecx + ebx + 2]
xor edx, eax
and edx, 0xff
mov esi, dword [edx*4 + 0xb58720]
sar eax, 8
xor eax, esi
mov dword [edi], eax
movzx edx, byte [ecx + ebx + 3]
add ebx, 4
xor edx, eax
and edx, 0xff
sar eax, 8
mov ecx, dword [edx*4 + 0xb58720]
xor eax, ecx
mov ecx, eax
mov dword [edi], eax
cmp ebx, dword [ebp + 0x10]
jl 0xa1a2a8
lea esi, [esi]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0xa1d0f8
Capabilities:
Encrypt data using chaskey

Disassembly:
push ebp
mov edx, 0xffff
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
add edx, edx
push esi
push ebx
movzx ecx, byte [edi + 2]
shl ecx, 8
lea eax, [ecx + ecx]
xor eax, edx
test eax, 0x10000
je 0xa1d121
xor edx, 0x8005
add edx, edx
lea eax, [ecx*4]
xor eax, edx
test eax, 0x10000
je 0xa1d139
xor edx, 0x8005
add edx, edx
lea eax, [ecx*8]
xor eax, edx
test eax, 0x10000
je 0xa1d151
xor edx, 0x8005
mov eax, ecx
add edx, edx
shl eax, 4
xor eax, edx
test eax, 0x10000
je 0xa1d167
xor edx, 0x8005
mov eax, ecx
add edx, edx
shl eax, 5
xor eax, edx
test eax, 0x10000
je 0xa1d17d
xor edx, 0x8005
mov eax, ecx
add edx, edx
shl eax, 6
xor eax, edx
test eax, 0x10000
je 0xa1d193
xor edx, 0x8005
add edx, edx
shl ecx, 7
mov eax, edx
xor eax, ecx
test eax, 0x10000
je 0xa1d1a9
xor edx, 0x8005
add edx, edx
lea eax, [ecx + ecx]
xor eax, edx
test eax, 0x10000
je 0xa1d1bd
xor edx, 0x8005
movzx ecx, byte [edi + 3]
add edx, edx
mov eax, ecx
shl eax, 9
xor eax, edx
test eax, 0x10000
je 0xa1d1d7
xor edx, 0x8005
mov eax, ecx
add edx, edx
shl eax, 0xa
xor eax, edx
test eax, 0x10000
je 0xa1d1ed
xor edx, 0x8005
mov eax, ecx
add edx, edx
shl eax, 0xb
xor eax, edx
test eax, 0x10000
je 0xa1d203
xor edx, 0x8005
mov eax, ecx
add edx, edx
shl eax, 0xc
xor eax, edx
test eax, 0x10000
je 0xa1d219
xor edx, 0x8005
mov eax, ecx
add edx, edx
shl eax, 0xd
xor eax, edx
test eax, 0x10000
je 0xa1d22f
xor edx, 0x8005
mov eax, ecx
add edx, edx
shl eax, 0xe
xor eax, edx
test eax, 0x10000
je 0xa1d245
xor edx, 0x8005
add edx, edx
shl ecx, 0xf
mov eax, edx
xor eax, ecx
test eax, 0x10000
je 0xa1d25b
xor edx, 0x8005
add edx, edx
lea eax, [ecx + ecx]
xor eax, edx
test eax, 0x10000
je 0xa1d26f
xor edx, 0x8005
mov ecx, dword [ebp + 8]
mov ebx, 6
mov esi, dword [ecx + 0xdc00]
cmp esi, 6
jle 0xa1d343
nop
movzx ecx, byte [ebx + edi]
add edx, edx
mov eax, ecx
shl eax, 9
xor eax, edx
test eax, 0x10000
je 0xa1d2a2
xor edx, 0x8005
mov eax, ecx
add edx, edx
shl eax, 0xa
xor eax, edx
test eax, 0x10000
je 0xa1d2b8
xor edx, 0x8005
mov eax, ecx
add edx, edx
shl eax, 0xb
xor eax, edx
test eax, 0x10000
je 0xa1d2ce
xor edx, 0x8005
mov eax, ecx
add edx, edx
shl eax, 0xc
xor eax, edx
test eax, 0x10000
je 0xa1d2e4
xor edx, 0x8005
mov eax, ecx
add edx, edx
shl eax, 0xd
xor eax, edx
test eax, 0x10000
je 0xa1d2fa
xor edx, 0x8005
mov eax, ecx
add edx, edx
shl eax, 0xe
xor eax, edx
test eax, 0x10000
je 0xa1d310
xor edx, 0x8005
add edx, edx
shl ecx, 0xf
mov eax, edx
xor eax, ecx
test eax, 0x10000
je 0xa1d326
xor edx, 0x8005
add edx, edx
lea eax, [ecx + ecx]
xor eax, edx
test eax, 0x10000
je 0xa1d33a
xor edx, 0x8005
inc ebx
cmp esi, ebx
jg 0xa1d288
mov byte [edi + 5], dl
mov ebx, edx
sar ebx, 8
mov byte [edi + 4], bl
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0xab62c8
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
push esi
mov esi, ecx
xor eax, eax
mov cl, byte [esi + eax + 0x8b]
mov bl, byte [eax + edx]
xor bl, cl
mov byte [eax + edx], bl
inc eax
cmp eax, 4
jl 0xab62d2
pop esi
pop ebx
ret 4

Function at 0xab65d8
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
dec eax
mov dword [esp + 8], ecx
push ebp
push esi
lea edx, [eax + eax*2 + 6]
lea eax, [eax + eax*2]
push edi
xor ebp, ebp
lea edx, [ecx + edx*2]
lea ecx, [ecx + eax*2]
mov dword [esp + 0x10], edx
mov dword [esp + 0x28], ecx
test ebp, ebp
jne 0xab6609
xor esi, esi
xor edi, edi
jmp 0xab6613
mov esi, 4
mov edi, 3
mov edx, dword [esp + 0x10]
mov bl, byte [esp + esi + 0x18]
mov al, byte [edx + edi]
mov dl, byte [esp + esi + 0x18]
mov cl, al
and al, 3
shr cl, 2
xor dl, cl
mov ecx, dword [esp + 0x28]
and dl, 0x3f
xor bl, dl
mov dl, byte [ecx + edi + 0xd]
mov byte [esp + esi + 0x18], bl
mov cl, byte [esp + esi + 0x19]
mov bl, dl
and cl, 0xc0
shr bl, 4
shl al, 4
and bl, 0xf
and dl, 0xf
or al, bl
or al, cl
mov byte [esp + esi + 0x19], al
mov eax, dword [esp + 0x28]
mov bl, byte [esp + esi + 0x1a]
mov al, byte [eax + edi + 0xe]
and bl, 0xc0
mov cl, al
shr cl, 6
shl dl, 2
or dl, bl
and cl, 3
or dl, cl
mov byte [esp + esi + 0x1a], dl
mov cl, byte [esp + esi + 0x1b]
lea esi, [esp + esi + 0x1b]
mov dl, cl
xor dl, al
and dl, 0x20
xor dl, cl
mov bl, dl
xor bl, al
and bl, 0x10
xor bl, dl
mov dl, bl
xor dl, al
and dl, 8
xor dl, bl
mov bl, dl
xor bl, al
and bl, 4
xor bl, dl
mov dl, bl
xor dl, al
and dl, 2
xor dl, bl
mov cl, dl
xor cl, al
and cl, 1
xor cl, dl
inc ebp
cmp ebp, 2
mov byte [esi], cl
jl 0xab65ff
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
mov ebp, 0xffffff85
lea ebx, [esp + 0x18]
sub ebp, eax
lea edi, [eax + 0x7b]
sub ebx, esi
mov cl, byte [esi]
mov dl, byte [esi + ebx]
mov al, cl
xor al, byte [edi]
xor al, dl
and al, 1
xor al, cl
mov byte [esi], al
mov cl, byte [edi]
xor cl, al
xor cl, dl
and cl, 2
xor cl, al
mov al, cl
mov byte [esi], cl
xor al, byte [edi]
xor al, dl
and al, 4
xor al, cl
mov cl, al
mov byte [esi], al
xor cl, byte [edi]
xor cl, dl
and cl, 8
xor cl, al
mov al, cl
mov byte [esi], cl
xor al, byte [edi]
xor al, dl
and al, 0x10
xor al, cl
mov cl, al
mov byte [esi], al
xor cl, byte [edi]
xor cl, dl
and cl, 0x20
xor cl, al
inc edi
mov byte [esi], cl
inc esi
lea edx, [edi + ebp]
cmp edx, 8
jl 0xab66dd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0xab6748
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
lea eax, [esp + 1]
push ebx
push ebp
push esi
mov ebp, ecx
mov esi, 0xffffff71
lea edx, [ebp + 0x8f]
sub esi, ebp
mov bl, byte [edx]
mov byte [eax - 1], bl
mov byte [eax], bl
add eax, 2
inc edx
lea ecx, [esi + edx]
cmp ecx, 4
jl 0xab6761
lea eax, [esp + 0xd]
mov edx, 4
mov cl, byte [eax - 1]
add eax, 2
shr cl, 1
and cl, 0x7c
mov byte [eax - 3], cl
mov bl, byte [eax - 2]
shl bl, 3
mov byte [eax - 2], bl
dec edx
jne 0xab677d
mov ecx, 2
lea edx, [esp + 0xd]
push edi
mov edi, 1
sub ecx, edx
lea esi, [esp + edi + 0x10]
lea eax, [ecx + esi]
cmp eax, 7
jle 0xab67b6
xor eax, eax
mov bl, byte [esi]
lea edx, [esp + eax + 0x10]
and bl, 0xfb
add edi, 2
mov al, byte [edx]
shr al, 4
and al, 4
or al, bl
mov byte [esi], al
mov bl, byte [edx]
and al, 0xf8
and bl, 0x7f
shl al, 4
or al, bl
cmp edi, 7
mov byte [edx], al
jle 0xab67a8
xor eax, eax
pop edi
mov dl, byte [esp + eax + 0xc]
mov bl, byte [eax + ebp + 0x7b]
shr dl, 2
xor dl, bl
and dl, 0x3f
xor bl, dl
mov byte [eax + ebp + 0x7b], bl
inc eax
cmp eax, 8
jl 0xab67e3
pop esi
pop ebp
pop ebx
add esp, 8
ret