joyce8/EMBER2024-capa huggingface dataset:
Function at 0x723298
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov esi, eax
lea edi, [esp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebp, edx
mov edx, ebp
mov eax, 0x7ab02c
add byte [ecx + 0x48], bh
call fcn.004a3cf8
lea edx, [ebp + 0x48]
mov eax, 0x7ab074
mov ecx, 0x1000
call fcn.004a3cf8
xor edi, edi
mov esi, 0x12
mov dword [esp + 8], ebp
xor edx, edx
mov eax, 4
shl edx, 8
movzx ecx, byte [esp + edi + 0xc]
or edx, ecx
inc edi
cmp edi, 0x10
jl 0x7232f2
xor edi, edi
dec eax
jne 0x7232e0
mov eax, dword [esp + 8]
xor dword [eax], edx
add dword [esp + 8], 4
dec esi
jne 0x7232d9
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
xor esi, esi
mov edx, esp
mov eax, ebp
mov cl, 1
call sym.a1runscanner.exe__Lbcipher_TBlowfish_EncryptBF_qqrrx19Lbcipher_TBFContextr27System__StaticArray_ii_i2__o
mov eax, dword [esp]
mov dword [ebp + esi*4], eax
mov eax, dword [esp + 4]
mov dword [ebp + esi*4 + 4], eax
add esi, 2
cmp esi, 0x11
jle 0x723310
mov edi, 4
mov ebx, ebp
xor esi, esi
mov edx, esp
mov eax, ebp
mov cl, 1
call sym.a1runscanner.exe__Lbcipher_TBlowfish_EncryptBF_qqrrx19Lbcipher_TBFContextr27System__StaticArray_ii_i2__o
mov eax, dword [esp]
mov dword [ebx + esi*4 + 0x48], eax
mov eax, dword [esp + 4]
mov dword [ebx + esi*4 + 0x4c], eax
inc esp
mov bl, 0x4c
add esi, 2
cmp esi, 0xff
jle 0x72333b
add ebx, 0x400
dec edi
jne 0x723339
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x723470
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov dword [esp], edx
mov edi, eax
mov ebx, 0x7ae2ac
lea esi, [esp + 4]
lea ecx, [esp + 8]
mov edx, esi
mov eax, dword [esp]
call sym.a1runscanner.exe__Lbcipher_TDES_SplitBlock_qqrrx28System__StaticArray_uci_i8__ruit2
lea edx, [esp + 8]
Function at 0x7237a0
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff74
mov byte [esp + 8], cl
mov dword [esp + 4], edx
mov dword [esp], eax
mov ecx, 0x38
mov esi, str.80_
lea eax, [esp + 0x1c]
movzx edi, byte [esi]
mov edx, edi
and edx, 0x80000007
jns 0x7237d5
dec edx
or edx, 0xfffffff8
inc edx
test edi, edi
jns 0x7237dc
add edi, 7
sar edi, 3
mov ebx, dword [esp]
movzx ebx, byte [ebx + edi]
and bl, byte [edx + 0x7aeb24]
setne dl
mov byte [eax], dl
inc eax
inc esi
dec ecx
jne 0x7237c3
xor eax, eax
mov dword [esp + 0x14], eax
mov esi, 0x7aeb14
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
xor ecx, ecx
lea eax, [esp + 0x54]
movzx edi, byte [esi]
add edi, ecx
cmp edi, 0x1c
jge 0x72382a
movzx edx, byte [esp + edi + 0x1c]
mov byte [eax], dl
movzx edx, byte [esp + edi + 0x38]
mov byte [eax + 0x1c], dl
jmp 0x723838
movzx edx, byte [esp + edi]
mov byte [eax], dl
movzx edx, byte [esp + edi + 0x1c]
mov byte [eax + 0x1c], dl
inc ecx
inc eax
cmp ecx, 0x1c
jne 0x72380f
lea eax, [esp + 9]
xor ecx, ecx
mov edx, 8
call fcn.004a4a64
xor ecx, ecx
mov ebp, 0x7aeae4
movzx eax, byte [ebp]
cmp byte [esp + eax + 0x54], 0
je 0x723885
mov eax, ecx
mov ebx, 6
cdq
idiv ebx
mov edi, eax
mov eax, ecx
mov ebx, 6
cdq
idiv ebx
movzx eax, byte [edx + 0x7aeb24]
shr eax, 2
or byte [esp + edi + 9], al
inc ecx
inc ebp
cmp ecx, 0x30
jne 0x723856
cmp byte [esp + 8], 0
je 0x7238e8
movzx eax, byte [esp + 9]
shl eax, 0x18
movzx edx, byte [esp + 0xb]
shl edx, 0x10
or eax, edx
movzx edx, byte [esp + 0xd]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0xf]
or eax, edx
mov edx, dword [esp + 0x18]
mov dword [edx], eax
movzx eax, byte [esp + 0xa]
shl eax, 0x18
movzx edx, byte [esp + 0xc]
shl edx, 0x10
or eax, edx
movzx edx, byte [esp + 0xe]
shl edx, 8
or eax, edx
movzx edx, byte [esp + 0x10]
or eax, edx
mov edx, dword [esp + 0x18]
mov dword [edx + 4], eax
jmp 0x723953
movzx edx, byte [esp + 9]
shl edx, 0x18
movzx ecx, byte [esp + 0xb]
shl ecx, 0x10
or edx, ecx
movzx ecx, byte [esp + 0xd]
shl ecx, 8
or edx, ecx
movzx ecx, byte [esp + 0xf]
or edx, ecx
mov eax, dword [esp + 0x14]
add eax, eax
mov ecx, eax
inc ecx
mov ebx, 0x1f
sub ebx, ecx
mov ecx, dword [esp + 4]
mov dword [ecx + ebx*4], edx
movzx edx, byte [esp + 0xa]
shl edx, 0x18
movzx ecx, byte [esp + 0xc]
shl ecx, 0x10
or edx, ecx
movzx ecx, byte [esp + 0xe]
shl ecx, 8
or edx, ecx
movzx ecx, byte [esp + 0x10]
or edx, ecx
mov ecx, 0x1f
sub ecx, eax
mov eax, dword [esp + 4]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
add dword [esp + 0x18], 8
inc esi
cmp dword [esp + 0x14], 0x10
jne 0x723809
mov eax, dword [esp + 4]
movzx edx, byte [esp + 8]
mov byte [eax + 0x80], dl
add esp, 0x8c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x723a84
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
push ebx
mov dword [ebp - 0x14], eax
mov eax, 8
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
movzx ebx, byte [edx]
and bl, 0xfe
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x723a9c
lea edx, [ebp - 0x95]
mov eax, 0x7aeb2c
mov cl, 1
call sym.a1runscanner.exe__Lbcipher_TDES_InitEncryptDES_qqrrx28System__StaticArray_uci_i8__r20Lbcipher_TDESContexto
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
lea eax, [ebp - 0x95]
call sym.a1runscanner.exe__Lbcipher_TDES_EncryptDES_qqrrx20Lbcipher_TDESContextr28System__StaticArray_uci_i8__
mov eax, 8
lea edx, [ebp - 8]
lea ecx, [ebp - 0x10]
movzx ebx, byte [edx]
xor byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x723ae0
and dword [ebp - 0x10], 0xf101f101
and dword [ebp - 0xc], 0xf101f101
lea edx, [ebp - 0x95]
mov eax, 0x7aeb34
mov cl, 1
call sym.a1runscanner.exe__Lbcipher_TDES_InitEncryptDES_qqrrx28System__StaticArray_uci_i8__r20Lbcipher_TDESContexto
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x95]
call sym.a1runscanner.exe__Lbcipher_TDES_EncryptDES_qqrrx20Lbcipher_TDESContextr28System__StaticArray_uci_i8__
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [eax], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x723c1c
Capabilities:
Hash data using sha1

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call sym.a1runscanner.exe__Lbcipher_TSHA1_SHA1Clear_qqrr21Lbcipher_TSHA1Context
mov dword [ebx + 0xc], 0x67452301
mov dword [ebx + 0x10], 0xefcdab89
mov dword [ebx + 0x14], 0x98badcfe
mov dword [ebx + 0x18], 0x10325476
mov dword [ebx + 0x1c], 0xc3d2e1f0
pop ebx
ret
Function at 0x723f8c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd0
mov dword [esp], edx
mov ebx, eax
lea edx, [esp + 0x20]
mov eax, dword [esp]
mov ecx, 0x10
call fcn.004a3cf8
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
dec eax
test eax, eax
jl 0x7240e8
inc eax
mov dword [esp + 0x1c], eax
lea eax, [ebx + 8]
mov ebx, eax
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx]
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 4]
add edx, eax
add eax, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shr edi, 0x11
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 9
xor eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, eax
shr edi, 0xf
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 0xb
xor eax, edi
mov edi, edx
mov edx, esi
mov esi, edi
mov edi, ecx
mov ecx, eax
mov eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shr edi, 0x11
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 9
xor eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, eax
shr edi, 0xf
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 0xb
xor eax, edi
xor edx, dword [esp + 0x14]
xor ecx, edx
mov dword [esp + 4], ecx
xor esi, dword [esp + 0x18]
xor eax, esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
add ebx, 8
dec dword [esp + 0x1c]
jne 0x723fde
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov edx, dword [esp]
lea eax, [esp + 0x20]
mov ecx, 0x10
call fcn.004a3cf8
add esp, 0x30
pop edi
pop esi
pop ebx
ret
Function at 0x724168
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd4
mov byte [esp + 4], cl
mov dword [esp], edx
lea edx, [esp + 0x1c]
mov ecx, 0x10
call fcn.004a3cf8
lea edx, [esp + 8]
mov eax, dword [esp]
mov ecx, 8
call fcn.004a3cf8
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 4
mov edx, 0x7aeb3c
mov ecx, dword [esp + 0x10]
movzx eax, byte [esp + 4]
add eax, eax
lea eax, [eax + eax*2]
mov ebx, dword [edx + eax*8]
mov esi, dword [esp + ebx*4 + 0x1c]
mov ebx, dword [edx + eax*8 + 4]
mov ebx, dword [esp + ebx*4 + 0x1c]
mov eax, dword [edx + eax*8 + 8]
mov eax, dword [esp + eax*4 + 0x1c]
add ecx, eax
add eax, ecx
mov edi, ecx
shr edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shl edi, 0xd
xor esi, edi
add ebx, esi
add esi, ebx
mov edi, ebx
shr edi, 0x11
xor ebx, edi
add eax, ebx
add ebx, eax
mov edi, eax
shl edi, 9
xor eax, edi
add ecx, eax
add eax, ecx
mov edi, ecx
shr edi, 3
xor ecx, edi
add esi, ecx
mov ecx, esi
shl ecx, 7
xor esi, ecx
add ebx, esi
mov ecx, eax
shr ecx, 0xf
xor ebx, ecx
add eax, ebx
mov ecx, eax
shl ecx, 0xb
xor eax, ecx
xor eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
add edx, 0xc
dec dword [esp + 0x18]
jne 0x7241b1
mov eax, dword [esp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], eax
mov edx, dword [esp]
lea eax, [esp + 8]
mov ecx, 8
call fcn.004a3cf8
add esp, 0x2c
pop edi
pop esi
pop ebx
ret
Function at 0x7242c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx edx, byte [ebp + 8]
mov byte [eax], dl
cmp ecx, 0x10
jle 0x7242eb
mov eax, 0x10
jmp 0x7242ed
mov eax, ecx
cmp eax, 4
jge 0x7242f7
mov eax, 4
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x24], str.UUUU
mov eax, dword [ebp - 4]
add eax, 8
mov edx, dword [ebp - 8]
mov ecx, dword [edx]
mov edx, dword [ebp - 0x24]
mov esi, dword [edx]
mov ebx, esi
mov edx, dword [ebp - 8]
mov edx, dword [edx + 4]
mov dword [ebp - 0xc], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 0xc]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], esi
mov esi, 8
mov edi, ebx
shl edi, 0xb
xor ecx, edi
add dword [ebp - 0xc], ecx
add ebx, edx
mov edi, edx
shr edi, 2
xor ebx, edi
add dword [ebp - 0x10], ebx
add edx, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
shl edi, 8
xor edx, edi
add dword [ebp - 0x14], edx
mov edi, dword [ebp - 0x10]
add dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
shr edi, 0x10
xor dword [ebp - 0xc], edi
mov edi, dword [ebp - 0xc]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x14]
add dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x14]
shl edi, 0xa
xor dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x10]
add dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x18]
add dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x18]
shr edi, 4
xor dword [ebp - 0x14], edi
add ecx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x1c]
shl edi, 8
xor dword [ebp - 0x18], edi
add ebx, dword [ebp - 0x18]
add dword [ebp - 0x1c], ecx
mov edi, ecx
shr edi, 9
xor dword [ebp - 0x1c], edi
add edx, dword [ebp - 0x1c]
add ecx, ebx
dec esi
jne 0x724343
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov dword [eax + 8], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x14], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x1c], edx
add eax, 0x20
add dword [ebp - 0x24], 4
dec dword [ebp - 0x20]
jne 0x724311
cmp byte [ebp + 8], 0
jne 0x724472
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x724447
inc eax
mov dword [ebp - 0x20], 0
mov ebx, dword [ebp - 4]
add ebx, 8
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
dec edx
sub edx, dword [ebp - 0x20]
mov ecx, dword [ebx]
mov dword [ebp + edx*8 - 0xa4], ecx
mov ecx, dword [ebx + 4]
mov dword [ebp + edx*8 - 0xa0], ecx
inc dword [ebp - 0x20]
add ebx, 8
dec eax
jne 0x724421
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x724472
inc eax
lea ebx, [ebp - 0xa4]
mov edx, dword [ebp - 4]
add edx, 8
mov ecx, dword [ebx]
mov dword [edx], ecx
mov ecx, dword [ebx + 4]
mov dword [edx + 4], ecx
add edx, 8
add ebx, 8
dec eax
jne 0x72445f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x72461c
Capabilities:
Hash data with md5

Disassembly:
push ebx
add esp, 0xffffffa8
mov ebx, eax
mov edx, esp
mov eax, ebx
mov ecx, 0x58
call fcn.004a3cf8
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
mov edx, ebx
mov eax, esp
mov ecx, 0x58
call fcn.004a3cf8
add esp, 0x58
pop ebx
ret

Function at 0x724a00
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x14], edx
mov edx, eax
mov eax, dword [ebp - 0x14]
mov ecx, 0x10
call sym.a1runscanner.exe__Lbcipher_TMISC_XorMemPrim_qqrpvpxvui
xor esi, esi
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
test bl, bl
jne 0x724adb
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x7ad2ac]
movzx edi, byte [eax + 1]
xor ecx, dword [edi*4 + 0x7ad6ac]
movzx edi, byte [eax + 2]
xor ecx, dword [edi*4 + 0x7adaac]
movzx edi, byte [eax + 3]
xor ecx, dword [edi*4 + 0x7adeac]
mov dword [ebp - 0x18], ecx
movzx ecx, byte [ebp - 0x18]
movzx ecx, byte [ecx + 0x7ac174]
lea edi, [esi]
and edi, 0x80000003
jns 0x724a75
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0x10], cl
movzx ecx, byte [ebp - 0x17]
movzx ecx, byte [ecx + 0x7ac174]
lea edi, [esi + 1]
and edi, 0x80000003
jns 0x724a94
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xf], cl
movzx ecx, byte [ebp - 0x16]
movzx ecx, byte [ecx + 0x7ac174]
lea edi, [esi + 2]
and edi, 0x80000003
jns 0x724ab3
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xe], cl
movzx ecx, byte [ebp - 0x15]
movzx ecx, byte [ecx + 0x7ac174]
lea edi, [esi + 3]
and edi, 0x80000003
jns 0x724ad2
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xd], cl
jmp 0x724b60
lea ecx, [esi]
and ecx, 0x80000003
jns 0x724aea
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4]
movzx ecx, byte [ecx + 0x7ac174]
mov byte [edx], cl
lea ecx, [esi + 3]
and ecx, 0x80000003
jns 0x724b0a
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 1]
movzx ecx, byte [ecx + 0x7ac174]
mov byte [edx + 1], cl
lea ecx, [esi + 2]
and ecx, 0x80000003
jns 0x724b2c
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 2]
movzx ecx, byte [ecx + 0x7ac174]
mov byte [edx + 2], cl
lea ecx, [esi + 1]
and ecx, 0x80000003
jns 0x724b4e
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 3]
movzx ecx, byte [ecx + 0x7ac174]
mov byte [edx + 3], cl
inc esi
add edx, 4
add eax, 4
cmp esi, 4
jne 0x724a25
mov edi, dword [ebp - 0x14]
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x724bd4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov byte [ebp - 0x11], cl
mov ebx, edx
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [ebp - 0x10]
cmp byte [ebp - 0x11], 0
jne 0x724c62
lea ecx, [eax]
and ecx, 0x80000003
jns 0x724bff
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4]
mov ecx, dword [ecx*4 + 0x7ac2ac]
lea esi, [eax + 1]
and esi, 0x80000003
jns 0x724c1a
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 1]
xor ecx, dword [esi*4 + 0x7ac6ac]
lea esi, [eax + 2]
and esi, 0x80000003
jns 0x724c36
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 2]
xor ecx, dword [esi*4 + 0x7acaac]
lea esi, [eax + 3]
and esi, 0x80000003
jns 0x724c52
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 3]
xor ecx, dword [esi*4 + 0x7aceac]
mov dword [edx], ecx
jmp 0x724cdb
lea ecx, [eax]
and ecx, 0x80000003
jns 0x724c71
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4]
movzx ecx, byte [ecx + 0x7ac074]
mov byte [edx], cl
lea ecx, [eax + 1]
and ecx, 0x80000003
jns 0x724c8e
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 1]
movzx ecx, byte [ecx + 0x7ac074]
mov byte [edx + 1], cl
lea ecx, [eax + 2]
and ecx, 0x80000003
jns 0x724cad
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 2]
movzx ecx, byte [ecx + 0x7ac074]
mov byte [edx + 2], cl
lea ecx, [eax + 3]
and ecx, 0x80000003
jns 0x724ccc
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 3]
movzx ecx, byte [ecx + 0x7ac074]
mov byte [edx + 3], cl
inc eax
add edx, 4
cmp eax, 4
jne 0x724bea
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov ecx, 0x10
call sym.a1runscanner.exe__Lbcipher_TMISC_XorMemPrim_qqrpvpxvui
mov edi, ebx
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x724d08
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
movzx eax, byte [esp]
movzx eax, byte [eax + 0x7ac074]
mov byte [esp + 4], al
movzx eax, byte [esp + 1]
movzx eax, byte [eax + 0x7ac074]
mov byte [esp + 5], al
movzx eax, byte [esp + 2]
movzx eax, byte [eax + 0x7ac074]
mov byte [esp + 6], al
movzx eax, byte [esp + 3]
movzx eax, byte [eax + 0x7ac074]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
pop ecx
pop edx
ret

Function at 0x724d54
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x724d70
inc esi
mov ebx, edx
mov eax, edi
call sym.a1runscanner.exe__Lbcipher_TMISC_Random32Byte_qqrri
xor byte [ebx], al
inc ebx
dec esi
jne 0x724d63
pop edi
pop esi
pop ebx
ret
Function at 0x724d74
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x724d90
inc esi
mov ebx, edx
mov eax, edi
call sym.a1runscanner.exe__Lbcipher_TMISC_Random64Byte_qqrr15Lbcipher_TInt64
xor byte [ebx], al
inc ebx
dec esi
jne 0x724d83
pop edi
pop esi
pop ebx
ret

Function at 0x724ea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffee8
mov ebx, eax
mov edx, esp
mov eax, ebx
mov ecx, 0x118
call fcn.004a3cf8
xor eax, eax
mov dword [esp], eax
mov esi, 0x7aaf1c
lea edi, [esp + 4]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], 0x55555555
mov dword [esp + 0x10c], 0x55555555
mov dword [esp + 0x110], 0x55555555
mov dword [esp + 0x114], 0x55555555
mov edx, ebx
mov eax, esp
mov ecx, 0x118
call fcn.004a3cf8
add esp, 0x118
pop edi
pop esi
pop ebx
ret

Function at 0x724f30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffee0
mov edi, ecx
mov ebx, edx
mov dword [esp], eax
lea edx, [esp + 8]
mov eax, dword [esp]
mov ecx, 0x118
call fcn.004a3cf8
dec edi
test edi, edi
jl 0x725050
inc edi
mov dword [esp + 4], edi
mov esi, ebx
movzx eax, byte [esi]
mov edx, dword [esp + 8]
xor byte [esp + edx + 0xc], al
inc dword [esp + 8]
cmp dword [esp + 8], 0x100
jne 0x724f81
xor edx, edx
mov dword [esp + 8], edx
mov edx, dword [esp + 0x10c]
xor byte [esp + edx + 0x110], al
inc dword [esp + 0x10c]
cmp dword [esp + 0x10c], 8
jne 0x725045
mov edx, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
mov ebx, dword [esp + 0x114]
mov eax, dword [esp + 0x110]
mov edi, 4
add edx, eax
add eax, edx
mov ebp, edx
shr ebp, 7
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shl ebp, 0xd
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, ebx
shr ebp, 0x11
xor ebx, ebp
add eax, ebx
add ebx, eax
mov ebp, eax
shl ebp, 9
xor eax, ebp
add edx, eax
add eax, edx
mov ebp, edx
shr ebp, 3
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shl ebp, 7
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, eax
shr ebp, 0xf
xor ebx, ebp
add eax, ebx
add ebx, eax
mov ebp, eax
shl ebp, 0xb
xor eax, ebp
dec edi
jne 0x724fc5
mov dword [esp + 0x110], edx
mov dword [esp + 0x114], ecx
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], eax
xor eax, eax
mov dword [esp + 0x10c], eax
inc esi
dec dword [esp + 4]
jne 0x724f62
mov edx, dword [esp]
lea eax, [esp + 8]
mov ecx, 0x118
call fcn.004a3cf8
add esp, 0x120
pop ebp
pop edi
pop esi
pop ebx
ret