joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003396
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov byte [ebp - 0xc], 0x30
mov byte [ebp - 0xb], 0x31
mov byte [ebp - 0xa], 0x32
mov byte [ebp - 9], 0x33
mov byte [ebp - 8], 0x34
mov byte [ebp - 7], 0x35
mov byte [ebp - 6], 0x36
mov byte [ebp - 5], 0x37
mov byte [ebp - 4], 0x38
mov byte [ebp - 3], 0x39
mov esi, edi
test eax, eax
jg 0x100033f8
jl 0x100033dc
test ebx, ebx
jae 0x100033f8
neg ebx
adc eax, 0
mov dword [ebp + 8], 1
neg eax
mov ecx, ebx
or ecx, eax
jne 0x100033fe
mov byte [edi], 0x30
lea esi, [edi + 1]
jmp 0x1000341d
and dword [ebp + 8], 0
jmp 0x100033ea
push 0
push 0xa
push eax
push ebx
call fcn.1003e5c0
mov cl, byte [ebp + ecx - 0xc]
mov dword [ebp + 0x14], ebx
mov ebx, eax
mov byte [esi], cl
mov eax, edx
mov ecx, ebx
inc esi
or ecx, eax
jne 0x100033fe
cmp dword [ebp + 8], 0
je 0x10003427
mov byte [esi], 0x2d
inc esi
mov byte [esi], 0
mov eax, edi
mov cl, byte [eax]
dec esi
mov dl, byte [esi]
mov byte [eax], dl
inc eax
mov byte [esi], cl
cmp esi, eax
ja 0x1000342c
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x10007fc3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x104
test eax, eax
je 0x10007fd8
cmp byte [eax], 0
jne 0x10007ff9
lea eax, [ebp - 0x104]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x10007ff3
push 0xb
pop eax
leave
ret
lea eax, [ebp - 0x104]
push dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
neg eax
sbb eax, eax
and eax, 0xfffffff4
add eax, 0xc
leave
ret

Function at 0x10008144
Capabilities:
Hash data with md5

Disassembly:
xor edx, edx
push 0x40
lea eax, [ecx + 0x18]
push edx
push eax
mov dword [ecx + 0x14], edx
mov dword [ecx + 0x10], edx
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
call fcn.1003e4bd
add esp, 0xc
ret

Function at 0x10008860
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x5c], eax
mov dword [ecx + 0x60], eax
ret

Function at 0x10009955
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
push 0x40
mov dword [ecx + 8], eax
mov dword [ecx + 4], eax
mov dword [ecx + 0x70], 0x6a09e667
mov dword [ecx + 0x74], 0xbb67ae85
mov dword [ecx + 0x78], 0x3c6ef372
mov dword [ecx + 0x7c], 0xa54ff53a
mov dword [ecx + 0x80], 0x510e527f
mov dword [ecx + 0x84], 0x9b05688c
mov dword [ecx + 0x88], 0x1f83d9ab
mov dword [ecx + 0x8c], 0x5be0cd19
push eax
add ecx, 0xc
push ecx
call fcn.1003e4bd
add esp, 0xc
ret
Function at 0x1000b242
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 0x90], eax
mov dword [ecx + 0x98], eax
mov dword [ecx + 0x9c], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x1000b89e
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
push 0x80
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0xe0], 0xf3bcc908
mov dword [ecx + 0xe4], 0x6a09e667
mov dword [ecx + 0xe8], 0x84caa73b
mov dword [ecx + 0xec], 0xbb67ae85
mov dword [ecx + 0xf0], 0xfe94f82b
mov dword [ecx + 0xf4], 0x3c6ef372
mov dword [ecx + 0xf8], 0x5f1d36f1
mov dword [ecx + 0xfc], 0xa54ff53a
mov dword [ecx + 0x100], 0xade682d1
mov dword [ecx + 0x104], 0x510e527f
mov dword [ecx + 0x108], 0x2b3e6c1f
mov dword [ecx + 0x10c], 0x9b05688c
mov dword [ecx + 0x110], 0xfb41bd6b
mov dword [ecx + 0x114], 0x1f83d9ab
mov dword [ecx + 0x118], 0x137e2179
mov dword [ecx + 0x11c], 0x5be0cd19
push eax
add ecx, 0x18
push ecx
call fcn.1003e4bd
add esp, 0xc
ret
Function at 0x100131cd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
mov edx, dword [ebp + 8]
push esi
push edi
push 0xffffffffffffffdc
mov esi, ecx
pop edi
lea eax, [esi + 0x24]
sub edi, esi
push ebx
mov bl, byte [eax]
lea ecx, [edi + eax]
mov cl, byte [ecx + edx]
xor bl, cl
mov byte [eax + 0x10], cl
mov byte [eax + 0x20], bl
inc eax
lea ecx, [edi + eax]
cmp ecx, 0x10
jl 0x100131e5
and dword [ebp + 8], 0
mov edi, dword [ebp - 4]
push 0x30
lea eax, [esi + 0x24]
pop ecx
mov bl, byte [edi*4 + str._.C]
xor byte [eax], bl
movzx edi, byte [eax]
inc eax
dec ecx
jne 0x1001320b
mov eax, dword [ebp + 8]
add edi, eax
and edi, 0xff
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x12
jl 0x10013205
movzx ecx, byte [esi + 0x23]
xor eax, eax
pop ebx
movzx edi, byte [eax + edx]
xor edi, ecx
mov cl, byte [edi*4 + str._.C]
xor byte [esi + eax + 0x14], cl
movzx ecx, byte [esi + eax + 0x14]
inc eax
cmp eax, 0x10
jl 0x10013236
pop edi
pop esi
leave
ret 4

Function at 0x10013d06
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x10013d22
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
sub ecx, eax
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x10013d19
pop esi
ret 0xc

Function at 0x10014530
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0x8000
jge 0x100145ed
cmp eax, 0x80
jge 0x10014596
cmp eax, 8
jge 0x10014573
cmp eax, 2
jge 0x10014564
cmp eax, 1
jge 0x10014560
test eax, eax
jge 0x1001455d
push 0x20
pop eax
ret
xor eax, eax
ret
xor eax, eax
inc eax
ret
xor ecx, ecx
cmp eax, 4
setge cl
inc ecx
inc ecx
jmp 0x10014686
xor ecx, ecx
cmp eax, 0x20
jge 0x10014588
cmp eax, 0x10
setge cl
add ecx, 4
jmp 0x10014686
cmp eax, 0x40
setge cl
add ecx, 6
jmp 0x10014686
xor ecx, ecx
cmp eax, 0x800
jge 0x100145c6
cmp eax, 0x200
jge 0x100145b6
cmp eax, 0x100
setge cl
add ecx, 8
jmp 0x10014686
cmp eax, 0x400
setge cl
add ecx, 0xa
jmp 0x10014686
cmp eax, 0x2000
jge 0x100145dd
cmp eax, 0x1000
setge cl
add ecx, 0xc
jmp 0x10014686
cmp eax, 0x4000
setge cl
add ecx, 0xe
jmp 0x10014686
xor ecx, ecx
cmp eax, 0x800000
jge 0x1001463f
cmp eax, 0x80000
jge 0x1001461e
cmp eax, 0x20000
jge 0x10014611
cmp eax, 0x10000
setge cl
add ecx, 0x10
jmp 0x10014686
cmp eax, 0x40000
setge cl
add ecx, 0x12
jmp 0x10014686
cmp eax, 0x200000
jge 0x10014632
cmp eax, 0x100000
setge cl
add ecx, 0x14
jmp 0x10014686
cmp eax, 0x400000
setge cl
add ecx, 0x16
jmp 0x10014686
cmp eax, 0x8000000
jge 0x10014667
cmp eax, 0x2000000
jge 0x1001465a
cmp eax, 0x1000000
setge cl
add ecx, 0x18
jmp 0x10014686
cmp eax, 0x4000000
setge cl
add ecx, 0x1a
jmp 0x10014686
cmp eax, 0x20000000
jge 0x1001467b
cmp eax, 0x10000000
setge cl
add ecx, 0x1c
jmp 0x10014686
cmp eax, 0x40000000
setge cl
add ecx, 0x1e
mov eax, ecx
ret
Function at 0x10014d98
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.1001488b
and dword [ebp - 4], 0
mov ebx, eax
shl ebx, 2
add esp, 0xc
mov dword [ebp - 8], eax
test ebx, ebx
jle 0x10014e0a
lea edx, [esi + ebx*4 + 8]
lea ecx, [esi + 8]
mov eax, dword [edx - 8]
mov edi, dword [ecx - 8]
add dword [ebp - 4], 4
mov dword [ecx - 8], eax
mov eax, dword [edx - 4]
mov dword [edx - 8], edi
mov edi, dword [ecx - 4]
mov dword [ecx - 4], eax
mov eax, dword [edx]
mov dword [edx - 4], edi
mov edi, dword [ecx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [edx], edi
mov edi, dword [ecx + 4]
mov dword [ecx + 4], eax
mov dword [edx + 4], edi
sub ebx, 4
add ecx, 0x10
sub edx, 0x10
cmp dword [ebp - 4], ebx
jl 0x10014dc9
mov eax, dword [ebp - 8]
cmp eax, 1
jle 0x10014f7c
lea ecx, [eax - 1]
mov dword [ebp - 4], ecx
mov ecx, 0xff
movzx ebx, byte [esi + 0x11]
mov ebx, dword [ebx*4 + str.ccccwwww]
add esi, 0x10
mov edx, dword [esi]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, ecx
mov edi, dword [edi*4 + 0x10042198]
and ebx, ecx
xor edi, dword [ebx*4 + 0x10042998]
movzx ebx, byte [esi + 2]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, ecx
xor edi, dword [ebx*4 + 0x10042598]
movzx ebx, byte [esi + 5]
and edx, ecx
mov edx, dword [edx*4 + str.ccccwwww]
and edx, ecx
xor edi, dword [edx*4 + 0x10042d98]
mov edx, dword [esi + 4]
mov dword [esi], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, ecx
mov edi, dword [edi*4 + 0x10042198]
and ebx, ecx
xor edi, dword [ebx*4 + 0x10042998]
movzx ebx, byte [esi + 6]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, ecx
xor edi, dword [ebx*4 + 0x10042598]
movzx ebx, byte [esi + 9]
and edx, ecx
mov edx, dword [edx*4 + str.ccccwwww]
and edx, ecx
xor edi, dword [edx*4 + 0x10042d98]
mov edx, dword [esi + 8]
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, ecx
mov edi, dword [edi*4 + 0x10042198]
and ebx, ecx
xor edi, dword [ebx*4 + 0x10042998]
movzx ebx, byte [esi + 0xa]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, ecx
xor edi, dword [ebx*4 + 0x10042598]
movzx ebx, byte [esi + 0xd]
and edx, ecx
mov edx, dword [edx*4 + str.ccccwwww]
and edx, ecx
xor edi, dword [edx*4 + 0x10042d98]
mov edx, dword [esi + 0xc]
mov dword [esi + 8], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, ecx
mov edi, dword [edi*4 + 0x10042198]
and ebx, ecx
xor edi, dword [ebx*4 + 0x10042998]
movzx ebx, byte [esi + 0xe]
mov ebx, dword [ebx*4 + str.ccccwwww]
and edx, ecx
mov edx, dword [edx*4 + str.ccccwwww]
and ebx, ecx
xor edi, dword [ebx*4 + 0x10042598]
and edx, ecx
xor edi, dword [edx*4 + 0x10042d98]
dec dword [ebp - 4]
mov dword [esi + 0xc], edi
jne 0x10014e1e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10015a01
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
push ebx
push esi
xor ecx, ecx
push edi
movzx eax, byte [ecx + 0x1004deb0]
mov esi, dword [ebp + 0xc]
dec eax
mov edx, eax
sar edx, 3
mov dl, byte [edx + esi]
and eax, 7
test byte [eax*4 + 0x1004df28], dl
setne al
mov byte [ebp + ecx - 0x44], al
inc ecx
cmp ecx, 0x38
jl 0x10015a0c
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], 0xf
push 8
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.1003e4bd
add esp, 0xc
xor ecx, ecx
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp - 4]
jne 0x10015a5f
mov eax, edi
movzx eax, byte [eax + 0x1004dee8]
xor edx, edx
add eax, ecx
cmp ecx, 0x1c
setge dl
dec edx
and edx, 0xffffffe4
add edx, 0x38
cmp eax, edx
jl 0x10015a7e
add eax, 0xffffffe4
mov al, byte [ebp + eax - 0x44]
mov byte [ebp + ecx - 0x7c], al
inc ecx
cmp ecx, 0x38
jl 0x10015a54
xor ecx, ecx
movzx eax, byte [ecx + 0x1004def8]
cmp byte [ebp + eax - 0x7d], 0
je 0x10015ab4
mov eax, ecx
cdq
push 6
pop ebx
idiv ebx
mov edx, dword [edx*4 + 0x1004df28]
lea eax, [ebp + eax - 0xc]
sar edx, 2
or byte [eax], dl
inc ecx
cmp ecx, 0x30
jl 0x10015a8e
movzx eax, byte [ebp - 0xc]
movzx ecx, byte [ebp - 0xa]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 8]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 6]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 9]
mov dword [esi + edi*8], eax
movzx eax, byte [ebp - 0xb]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 7]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 5]
shl eax, 8
or eax, ecx
mov dword [esi + edi*8 + 4], eax
inc edi
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffff
jg 0x10015a42
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10018914
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov edx, eax
mov esi, eax
movzx ebx, al
shr eax, 0x18
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [eax]
mov dword [ebp + 0xc], edi
mov edi, dword [eax + 4]
mov dword [ebp + 0x10], edi
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp + 8]
shr edx, 8
mov ecx, 0xff
shr esi, 0x10
mov dword [ebp - 8], eax
xor eax, eax
and edi, 3
and edx, ecx
and esi, ecx
sub edi, eax
je 0x100189cf
dec edi
je 0x10018978
dec edi
je 0x10018a54
dec edi
je 0x10018a11
jmp 0x10018af1
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x10046708]
mov edi, dword [ebp + 0xc]
movzx esi, byte [esi + 0x10046708]
movzx edx, byte [edx + 0x10046608]
shr edi, 0x18
xor eax, edi
mov edi, dword [ebp + 0xc]
shr edi, 0x10
xor esi, edi
and eax, ecx
mov eax, dword [eax*4 + str.9g]
and esi, ecx
xor eax, dword [esi*4 + 0x10047008]
mov esi, dword [ebp + 0xc]
shr esi, 8
xor edx, esi
and edx, ecx
xor eax, dword [edx*4 + 0x10046c08]
movzx edx, byte [ebx + 0x10046608]
jmp 0x10018ae5
mov eax, dword [ebp - 8]
movzx edx, byte [edx + 0x10046608]
movzx esi, byte [esi + 0x10046608]
movzx ebx, byte [ebx + 0x10046708]
mov edi, eax
shr edi, 8
xor edx, edi
mov edi, eax
shr edi, 0x10
xor esi, edi
mov edi, dword [ebp - 4]
movzx edi, byte [edi + 0x10046708]
xor ebx, eax
shr eax, 0x18
xor edi, eax
and ebx, ecx
and edx, ecx
and esi, ecx
and edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0xc]
movzx edx, byte [edx + 0x10046708]
movzx esi, byte [esi + 0x10046608]
movzx ebx, byte [ebx + 0x10046708]
mov edi, eax
shr edi, 8
xor edx, edi
mov edi, eax
shr edi, 0x10
xor esi, edi
mov edi, dword [ebp - 4]
movzx edi, byte [edi + 0x10046608]
xor ebx, eax
shr eax, 0x18
xor edi, eax
and ebx, ecx
and edx, ecx
and esi, ecx
and edi, ecx
mov eax, edi
jmp 0x10018a57
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x10046708]
mov edi, dword [ebp + 0x10]
movzx esi, byte [esi + 0x10046608]
movzx edx, byte [edx + 0x10046708]
shr edi, 0x18
xor eax, edi
mov edi, dword [ebp + 0xc]
and eax, ecx
movzx eax, byte [eax + 0x10046708]
shr edi, 0x18
xor eax, edi
mov edi, dword [ebp + 0x10]
shr edi, 0x10
xor esi, edi
mov edi, dword [ebp + 0xc]
and esi, ecx
movzx esi, byte [esi + 0x10046708]
and eax, ecx
mov eax, dword [eax*4 + str.9g]
shr edi, 0x10
xor esi, edi
and esi, ecx
xor eax, dword [esi*4 + 0x10047008]
mov esi, dword [ebp + 0x10]
shr esi, 8
xor edx, esi
mov esi, dword [ebp + 0xc]
and edx, ecx
movzx edx, byte [edx + 0x10046608]
shr esi, 8
xor edx, esi
and edx, ecx
xor eax, dword [edx*4 + 0x10046c08]
movzx edx, byte [ebx + 0x10046608]
xor edx, dword [ebp + 0x10]
and edx, ecx
movzx edx, byte [edx + 0x10046608]
xor edx, dword [ebp + 0xc]
and edx, ecx
xor eax, dword [edx*4 + 0x10046808]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10019042
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
xor eax, eax
mov dword [esi + eax*4], eax
inc eax
cmp eax, 0x100
jl 0x1001904b
xor ebx, ebx
xor edi, edi
mov eax, edi
cdq
idiv dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + edi*4]
movsx eax, byte [edx + eax]
add eax, ecx
add eax, ebx
and eax, 0xff
mov ebx, eax
mov eax, dword [esi + ebx*4]
mov dword [esi + edi*4], eax
inc edi
cmp edi, 0x100
mov dword [esi + ebx*4], ecx
jl 0x1001905a
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x100190f1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0x18]
mov esi, dword [ebp + 0xc]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
call fcn.1001908f
add esp, 0x10
test esi, esi
jle 0x1001911f
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
sub ecx, eax
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x10019116
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10019124
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
and dword [ebp - 0x200], 0
push ebx
push 0x1fc
lea eax, [ebp - 0x1fc]
push 0
push eax
call fcn.1003e4bd
mov ebx, dword [ebp + 0xc]
add esp, 0xc
xor eax, eax
test ebx, ebx
jg 0x1001915a
inc eax
jmp 0x10019256
push esi
push edi
mov edi, 0x80
test ebx, ebx
jle 0x1001917c
cmp eax, edi
jge 0x1001917c
mov ecx, dword [ebp + 8]
movzx ecx, byte [eax + ecx]
mov dword [ebp + eax*4 - 0x200], ecx
inc eax
cmp eax, ebx
jl 0x10019165
lea eax, [ebx*8 + 7]
cdq
and edx, 7
add eax, edx
mov esi, eax
sar esi, 3
mov eax, ebx
sub eax, esi
lea ecx, [eax*8 + 8]
push 2
pop eax
shl eax, cl
mov ecx, eax
mov eax, 0xff
cdq
idiv ecx
cmp ebx, edi
jge 0x100191e1
lea eax, [ebp - 0x200]
mov ecx, dword [ebp + ebx*4 - 0x204]
add ecx, dword [eax]
and ecx, 0x800000ff
jns 0x100191cb
dec ecx
or ecx, 0xffffff00
inc ecx
movzx ecx, byte [ecx + 0x10047808]
mov dword [ebp + ebx*4 - 0x200], ecx
inc ebx
add eax, 4
cmp ebx, edi
jl 0x100191b2
mov ecx, esi
shl ecx, 2
lea eax, [ebp]
sub eax, ecx
mov ecx, dword [eax]
and ecx, edx
movzx ecx, byte [ecx + 0x10047808]
mov dword [eax], ecx
push 0x7f
pop eax
sub eax, esi
js 0x10019228
lea ecx, [esi + eax]
lea ecx, [ebp + ecx*4 - 0x200]
mov edx, dword [ebp + eax*4 - 0x1fc]
xor edx, dword [ecx]
dec eax
movzx edx, byte [edx + 0x10047808]
mov dword [ebp + eax*4 - 0x1fc], edx
sub ecx, 4
test eax, eax
jge 0x10019209
xor eax, eax
mov ecx, 0xff
mov edx, dword [ebp + eax*8 - 0x1fc]
mov esi, dword [ebp + eax*8 - 0x200]
and edx, ecx
and esi, ecx
shl edx, 8
or edx, esi
mov esi, dword [ebp + 0x10]
mov dword [esi + eax*4], edx
inc eax
cmp eax, 0x40
jl 0x1001922f
pop edi
xor eax, eax
pop esi
pop ebx
leave
ret
Function at 0x100194b6
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
add eax, 2
push esi
movsx edx, byte [eax - 2]
movsx esi, byte [eax - 1]
shl edx, 8
xor edx, esi
movsx esi, byte [eax]
shl edx, 8
xor edx, esi
movsx esi, byte [eax + 1]
shl edx, 8
xor edx, esi
mov esi, dword [esp + 0x10]
mov dword [esi + ecx*4], edx
inc ecx
add eax, 4
cmp ecx, 4
jl 0x100194c0
xor eax, eax
pop esi
ret

Function at 0x100194f2
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
movzx edx, byte [eax + 1]
shl ecx, 8
xor ecx, edx
movzx edx, byte [eax + 2]
shl ecx, 8
xor ecx, edx
movzx edx, byte [eax + 3]
shl ecx, 8
xor ecx, edx
movzx edx, byte [eax + 4]
sub esp, 0xc
push esi
movzx esi, byte [eax + 5]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 6]
movzx eax, byte [eax + 7]
shl edx, 8
xor edx, esi
shl edx, 8
push edi
mov edi, dword [ebp + 0x14]
xor edx, eax
xor esi, esi
test edi, edi
jle 0x1001959f
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov ebx, dword [eax]
mov dword [ebp + 0x14], ebx
mov ebx, dword [eax + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], eax
mov dword [ebp + 8], edi
pop ebx
mov eax, edx
shl eax, 4
add eax, dword [ebp + 0x14]
mov edi, edx
shr edi, 5
add edi, dword [ebp - 4]
sub esi, 0x61c88647
xor eax, edi
lea edi, [esi + edx]
xor eax, edi
add ecx, eax
mov eax, ecx
shl eax, 4
add eax, dword [ebp - 8]
mov edi, ecx
shr edi, 5
add edi, dword [ebp - 0xc]
xor eax, edi
lea edi, [esi + ecx]
xor eax, edi
add edx, eax
dec dword [ebp + 8]
jne 0x10019562
mov esi, dword [ebp + 0xc]
mov eax, ecx
shr eax, 0x18
mov byte [esi], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 1], al
mov eax, ecx
shr eax, 8
mov byte [esi + 2], al
mov eax, edx
shr eax, 0x18
mov byte [esi + 4], al
mov eax, edx
shr eax, 0x10
mov byte [esi + 5], al
mov eax, edx
shr eax, 8
mov byte [esi + 6], al
pop edi
mov byte [esi + 3], cl
mov byte [esi + 7], dl
xor eax, eax
pop esi
leave
ret
Function at 0x100195dd
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
shl ecx, 8
xor ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
xor ecx, eax
movzx eax, byte [edx + 3]
shl ecx, 8
xor ecx, eax
movzx eax, byte [edx + 4]
sub esp, 0xc
push esi
movzx esi, byte [edx + 5]
shl eax, 8
xor eax, esi
movzx esi, byte [edx + 6]
movzx edx, byte [edx + 7]
shl eax, 8
xor eax, esi
shl eax, 8
push edi
mov edi, dword [ebp + 0x14]
xor eax, edx
mov edx, edi
imul edx, edx, 0x9e3779b9
test edi, edi
jle 0x10019690
mov esi, dword [ebp + 0x10]
push ebx
mov ebx, dword [esi + 0xc]
mov dword [ebp - 4], ebx
mov ebx, dword [esi + 8]
mov dword [ebp + 0x14], ebx
mov ebx, dword [esi + 4]
mov esi, dword [esi]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp + 8], edi
pop ebx
mov esi, ecx
shl esi, 4
add esi, dword [ebp + 0x14]
mov edi, ecx
shr edi, 5
add edi, dword [ebp - 4]
xor esi, edi
lea edi, [edx + ecx]
xor esi, edi
sub eax, esi
mov esi, eax
shl esi, 4
add esi, dword [ebp - 8]
mov edi, eax
shr edi, 5
add edi, dword [ebp - 0xc]
xor esi, edi
lea edi, [edx + eax]
xor esi, edi
sub ecx, esi
add edx, 0x61c88647
dec dword [ebp + 8]
jne 0x10019653
mov esi, dword [ebp + 0xc]
mov edx, ecx
shr edx, 0x18
mov byte [esi], dl
mov edx, ecx
shr edx, 0x10
mov byte [esi + 3], cl
mov byte [esi + 1], dl
mov edx, ecx
mov ecx, eax
shr ecx, 0x18
mov byte [esi + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 5], cl
mov ecx, eax
shr edx, 8
shr ecx, 8
mov byte [esi + 7], al
pop edi
mov byte [esi + 2], dl
mov byte [esi + 6], cl
xor eax, eax
pop esi
leave
ret

Function at 0x100196ce
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
xor edx, edx
add eax, 2
mov ecx, 0xff
push edi
movsx esi, byte [eax - 1]
movsx edi, byte [eax - 2]
shl edi, 8
and esi, ecx
xor esi, edi
movsx edi, byte [eax]
and edi, ecx
shl esi, 8
xor esi, edi
movsx edi, byte [eax + 1]
and edi, ecx
shl esi, 8
xor esi, edi
mov edi, dword [esp + 0x14]
mov dword [edi + edx*4], esi
inc edx
add eax, 4
cmp edx, 4
jl 0x100196de
pop edi
xor eax, eax
pop esi
ret
Function at 0x10019717
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
movzx ecx, byte [edx + 1]
shl eax, 8
xor eax, ecx
movzx ecx, byte [edx + 2]
shl eax, 8
xor eax, ecx
movzx ecx, byte [edx + 3]
shl eax, 8
xor eax, ecx
movzx ecx, byte [edx + 4]
push ebx
push esi
movzx esi, byte [edx + 5]
shl ecx, 8
xor ecx, esi
movzx esi, byte [edx + 6]
movzx edx, byte [edx + 7]
shl ecx, 8
xor ecx, esi
mov esi, dword [ebp + 0x14]
shl ecx, 8
xor ecx, edx
xor edx, edx
push edi
cmp dword [ebp + 0x18], edx
jne 0x100197bd
cmp esi, edx
jle 0x1001980d
mov dword [ebp + 8], esi
mov esi, dword [ebp + 0x10]
mov edi, edx
and edi, 3
mov edi, dword [esi + edi*4]
add edi, edx
mov ebx, ecx
shr ebx, 5
add ebx, ecx
xor edi, ebx
mov ebx, ecx
shl ebx, 4
xor edi, ebx
add eax, edi
sub edx, 0x61c88647
mov edi, edx
shr edi, 0xb
and edi, 3
mov edi, dword [esi + edi*4]
mov ebx, eax
shr ebx, 5
add ebx, eax
add edi, edx
xor edi, ebx
mov ebx, eax
shl ebx, 4
xor edi, ebx
add ecx, edi
dec dword [ebp + 8]
jne 0x10019775
jmp 0x1001980d
cmp esi, edx
jle 0x1001980d
mov dword [ebp + 8], esi
mov esi, dword [ebp + 0x10]
mov edi, ecx
shr edi, 5
mov ebx, ecx
shl ebx, 4
xor edi, ebx
add edi, ecx
mov ebx, edx
and ebx, 3
mov ebx, dword [esi + ebx*4]
add ebx, edx
xor edi, ebx
add eax, edi
mov edi, eax
shr edi, 5
mov ebx, eax
shl ebx, 4
xor edi, ebx
sub edx, 0x61c88647
mov ebx, edx
shr ebx, 0xb
and ebx, 3
mov ebx, dword [esi + ebx*4]
add edi, eax
add ebx, edx
xor edi, ebx
add ecx, edi
dec dword [ebp + 8]
jne 0x100197c7
mov esi, dword [ebp + 0xc]
mov edx, eax
shr edx, 0x18
mov byte [esi], dl
mov edx, eax
mov byte [esi + 3], al
shr edx, 0x10
mov byte [esi + 1], dl
mov edx, eax
mov eax, ecx
shr eax, 0x18
mov byte [esi + 4], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 5], al
mov eax, ecx
shr edx, 8
shr eax, 8
pop edi
mov byte [esi + 6], al
mov byte [esi + 2], dl
mov byte [esi + 7], cl
pop esi
xor eax, eax
pop ebx
pop ebp
ret