joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1016f8e0
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
xor ebp, ebp
push esi
test eax, eax
je 0x1016f8f8
test byte [eax + 0x5c], 2
mov ebx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x1016f8fd
mov ebx, 0x102cfd50
mov esi, dword [esp + 0x1c]
test esi, esi
jle 0x1016f9cd
mov edx, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
inc edi
movzx eax, byte [edi - 1]
cmp esi, 3
jb 0x1016f961
movzx ecx, byte [edi]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 1]
shl eax, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
mov ecx, eax
shr ecx, 6
and ecx, 0x3f
and eax, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 2], cl
mov cl, byte [eax + ebx]
lea eax, [edx + 3]
jmp 0x1016f9ad
shl eax, 0x10
cmp esi, 2
jne 0x1016f971
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
inc edx
and ecx, 0x3f
mov dword [esp + 0x18], edx
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
cmp esi, 1
jne 0x1016f998
mov al, 0x3d
jmp 0x1016f9a1
shr eax, 6
and eax, 0x3f
mov al, byte [eax + ebx]
mov byte [edx + 1], al
mov cl, 0x3d
mov eax, dword [esp + 0x18]
add eax, 2
sub esi, 3
mov byte [eax], cl
add ebp, 4
lea edx, [eax + 1]
add edi, 3
test esi, esi
jg 0x1016f913
pop edi
pop esi
mov eax, ebp
mov byte [edx], 0
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x14]
pop esi
mov byte [eax], 0
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x1019bb50
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x4c
push 0
lea eax, [esi + 0x20]
push eax
call fcn.1026d1f0
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov eax, 1
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x18
pop esi
ret
Function at 0x101a4cf0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0xe4
call fcn.1026b810
mov eax, dword [0x10343c80]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xe8]
push ebx
mov ebx, dword [esp + 0xf0]
push esi
mov esi, dword [esp + 0xf8]
push edi
push eax
push str.SHA512
push ecx
call fcn.1010eb30
mov edi, eax
add esp, 0xc
test edi, edi
je 0x101a4d72
push 0
push edi
push 0
lea eax, [esp + 0xb8]
push eax
push 0x20
push esi
call fcn.1010dd20
push edi
mov esi, eax
call fcn.1010eb60
add esp, 0x1c
test esi, esi
jne 0x101a4d8c
lea eax, [esp + 0xac]
push 0x40
push eax
call fcn.10001320
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xe0]
xor ecx, esp
call fcn.1026af9a
add esp, 0xe4
ret
mov al, byte [esp + 0xcb]
and byte [esp + 0xac], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esp + 0xcb], al
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.101a4440
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.101a43c0
lea eax, [esp + 0xbc]
push 0x40
push eax
call fcn.10001320
mov ecx, dword [esp + 0x104]
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1026af9a
add esp, 0xe4
ret
Function at 0x101ac4f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
lea edx, [eax + 0x3c]
movd xmm0, ebx
pshufd xmm4, xmm0, 0
lea ecx, [esi + 0x3c]
cmp eax, ecx
ja 0x101ac53f
cmp edx, esi
jb 0x101ac53f
push edi
sub esi, eax
mov edi, 0x10
nop dword [eax]
mov edx, dword [eax + esi]
lea eax, [eax + 4]
mov ecx, dword [eax - 4]
xor ecx, edx
and ecx, ebx
xor edx, ecx
mov dword [eax + esi - 4], edx
xor dword [eax - 4], ecx
sub edi, 1
jne 0x101ac520
pop edi
pop esi
pop ebx
ret
sub esi, eax
mov ecx, 4
nop word [eax + eax]
lea eax, [eax + 0x10]
movups xmm1, xmmword [esi + eax - 0x10]
movups xmm3, xmmword [eax - 0x10]
movaps xmm2, xmm1
xorps xmm2, xmm3
andps xmm2, xmm4
movaps xmm0, xmm2
xorps xmm2, xmm3
xorps xmm0, xmm1
movups xmmword [esi + eax - 0x10], xmm0
movups xmmword [eax - 0x10], xmm2
sub ecx, 1
jne 0x101ac550
pop esi
pop ebx
ret
Function at 0x101b0dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 4
call fcn.1026b810
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp edi, 0x800
jge 0x101b0e08
call fcn.10105aa0
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x59
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.10105ba0
push 0
push 0x78
push 4
call fcn.10105cb0
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push dword [esp + 0x18]
call fcn.101dfd90
add esp, 4
test eax, eax
jne 0x101b0e44
call fcn.10105aa0
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x5e
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.10105ba0
push 0
push 0xb2
push 4
call fcn.10105cb0
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.1018a810
push esi
call fcn.1018a620
push esi
mov dword [esp + 0x2c], eax
call fcn.1018a620
push esi
mov ebp, eax
call fcn.1018a620
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x101b0fa6
test ebp, ebp
je 0x101b0f7d
test ebx, ebx
je 0x101b0f74
push 4
push ebp
call fcn.101328e0
push 4
push ebx
call fcn.101328e0
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi + 0x20], 0
jne 0x101b0eae
call fcn.101327d0
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x101b0ebd
call fcn.101327d0
mov dword [esi + 0x24], eax
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x101b0f70
test eax, eax
je 0x101b0f70
push 4
push ecx
call fcn.101328e0
push 4
push dword [esi + 0x24]
call fcn.101328e0
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebp
push dword [esi + 0x20]
call fcn.101e0490
add esp, 0x3c
test eax, eax
je 0x101b0f70
nop dword [eax]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push dword [esi + 0x24]
call fcn.101e0490
add esp, 0x2c
test eax, eax
je 0x101b0f70
push edi
push ebx
push ebp
push dword [esp + 0x2c]
call fcn.101dfd20
add esp, 0x10
test eax, eax
js 0x101b0f70
je 0x101b0f10
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esp + 0x2c]
call fcn.101dfd20
add esp, 0x10
test eax, eax
js 0x101b0f70
je 0x101b0f10
inc dword [esi + 0x78]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x28]
push ebp
call fcn.10132080
add esp, 4
test ebx, ebx
je 0x101b0f8a
push ebx
call fcn.10132080
add esp, 4
push dword [esp + 0x20]
call fcn.10132080
push esi
call fcn.1018a520
mov eax, dword [esp + 0x18]
add esp, 8
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x101b0f7d
jmp 0x101b0f74
Function at 0x101becd0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp ebp, 2
je 0x101beda9
mov esi, dword [esp + 0x10]
test esi, esi
je 0x101bed5e
push esi
push 0
lea eax, [esp + 0x28]
push eax
push 0
call fcn.10161400
add esp, 0x10
cmp dword [esp + 0x20], 0xffffffff
je 0x101bed32
call fcn.10105aa0
push str.ossl_ecx_key_op
push 0xa9
push str.cryptoececx_backend.c
call fcn.10105ba0
push 0
push 0x66
push 0x10
call fcn.10105cb0
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebp
ret
mov eax, dword [esi]
mov esi, dword [esp + 0x1c]
push eax
call fcn.10108960
add esp, 4
test esi, esi
jne 0x101bed49
mov esi, eax
jmp 0x101bed62
cmp esi, eax
je 0x101bed62
call fcn.10105aa0
push str.ossl_ecx_key_op
push 0xaf
jmp 0x101bed14
mov esi, dword [esp + 0x1c]
test edi, edi
je 0x101bed95
test esi, esi
je 0x101bed95
cmp esi, 0x40a
je 0x101bed8a
cmp esi, 0x43f
je 0x101bed8a
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x101bed8f
mov eax, 0x20
cmp dword [esp + 0x18], eax
je 0x101bedad
call fcn.10105aa0
push str.ossl_ecx_key_op
push 0xb5
jmp 0x101bed14
mov esi, dword [esp + 0x1c]
cmp esi, 0x40a
je 0x101bedd1
cmp esi, 0x43f
je 0x101bedd1
xor eax, eax
cmp esi, 0x40b
setne al
lea eax, [eax*2 + 1]
jmp 0x101bede1
xor ecx, ecx
mov eax, 2
cmp esi, 0x40a
cmove eax, ecx
push ebx
push dword [esp + 0x2c]
push 1
push eax
push dword [esp + 0x34]
call fcn.10156940
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x101bee2b
call fcn.10105aa0
push str.ossl_ecx_key_op
push 0xbc
push str.cryptoececx_backend.c
call fcn.10105ba0
push ebx
push 0x80010
push 0x10
call fcn.10105cb0
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
test ebp, ebp
jne 0x101bee47
push dword [esp + 0x1c]
lea eax, [ebx + 0xc]
push edi
push eax
call fcn.1026cc70
add esp, 0xc
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
push ebx
call fcn.101568d0
mov edi, eax
add esp, 4
test edi, edi
jne 0x101bee7a
call fcn.10105aa0
push str.ossl_ecx_key_op
push 0xc6
push str.cryptoececx_backend.c
call fcn.10105ba0
push edi
push 0x80010
jmp 0x101bef50
cmp ebp, 2
jne 0x101beeec
test esi, esi
je 0x101bef1f
cmp esi, 0x40a
je 0x101beea7
cmp esi, 0x43f
je 0x101beea7
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x101beeac
mov eax, 0x20
push 0
push eax
push edi
push dword [esp + 0x34]
call fcn.1011f220
add esp, 0x10
test eax, eax
jle 0x101bef5a
cmp esi, 0x40a
jne 0x101beedb
mov al, byte [edi + 0x1f]
and byte [edi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [edi + 0x1f], al
jmp 0x101bef1f
cmp esi, 0x40b
jne 0x101bef1f
and byte [edi], 0xfc
or byte [edi + 0x37], 0x80
jmp 0x101bef1f
cmp esi, 0x40a
je 0x101bef0c
cmp esi, 0x43f
je 0x101bef0c
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x101bef11
mov eax, 0x20
push eax
push dword [esp + 0x1c]
push edi
call fcn.1026cc70
add esp, 0xc
push ebx
call fcn.101bef70
add esp, 4
test eax, eax
jne 0x101bee40
call fcn.10105aa0
push str.ossl_ecx_key_op
push 0xda
push str.cryptoececx_backend.c
call fcn.10105ba0
push 0
push 0xa6
push 0x10
call fcn.10105cb0
add esp, 0x18
push ebx
call fcn.101568f0
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x101cad60
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.1026b810
push ebx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x30]
mov esi, dword [esi + 0x64]
mov dword [esp + 0x14], esi
mov ecx, dword [esi + 0x70]
test ecx, ecx
je 0x101cadca
test edi, edi
je 0x101cadaa
lea edx, [esi + 0x30]
add edx, ecx
cmp ecx, 0x40
jae 0x101cadaa
mov al, byte [edx]
inc ecx
xor al, byte [ebx]
inc edx
mov byte [ebp], al
inc ebx
inc ebp
sub edi, 1
jne 0x101cad95
mov dword [esi + 0x70], ecx
test edi, edi
je 0x101cae84
cmp ecx, 0x40
jne 0x101cadca
mov dword [esi + 0x70], 0
add dword [esi + 0x20], 1
jne 0x101cadca
inc dword [esi + 0x24]
mov edx, dword [esi + 0x20]
lea ecx, [esi + 0x20]
mov eax, edi
mov dword [esp + 0x10], ecx
and eax, 0x3f
sub edi, eax
mov dword [esp + 0x24], eax
cmp edi, 0x40
jb 0x101cae3c
push dword [esp + 0x10]
mov ecx, edi
xor esi, esi
shr ecx, 6
lea eax, [ecx + edx]
cmp eax, ecx
cmovae esi, eax
neg edx
cmp eax, ecx
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x18]
cmovae edx, ecx
shl edx, 6
push esi
push edx
push ebx
push ebp
mov dword [esp + 0x2c], edx
call fcn.10044080
mov eax, dword [esp + 0x2c]
add esp, 0x14
sub edi, eax
add ebx, eax
add ebp, eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x20], eax
test eax, eax
jne 0x101cae31
inc dword [esi + 0x24]
mov edx, eax
cmp edi, 0x40
jae 0x101cade4
mov eax, dword [esp + 0x24]
test eax, eax
je 0x101cae84
push 0x40
lea edi, [esi + 0x30]
push 0
push edi
call fcn.1026d1f0
lea eax, [esi + 0x20]
push eax
push esi
push 0x40
push edi
push edi
call fcn.10044080
mov edi, dword [esp + 0x44]
add esp, 0x20
xor edx, edx
test edi, edi
je 0x101cae81
sub ebx, ebp
nop word [eax + eax]
mov al, byte [esi + edx + 0x30]
lea ecx, [edx + ebp]
xor al, byte [ebx + ecx]
inc edx
mov byte [ecx], al
cmp edx, edi
jb 0x101cae70
mov dword [esi + 0x70], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
Function at 0x101cc9f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.1026b810
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x20]
push edi
mov ebp, dword [ebp]
mov edi, dword [esp + 0x20]
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x101cca38
mov ecx, dword [esp + 0x30]
nop dword [eax]
test esi, esi
je 0x101cca38
mov al, byte [ecx + ebp]
dec esi
xor al, byte [ebx]
inc ebp
mov byte [edi], al
inc ebx
inc edi
and ebp, 0xf
mov dword [esp + 0x14], ebp
jne 0x101cca20
mov eax, dword [esp + 0x2c]
mov edx, dword [eax + 0xc]
bswap edx
mov dword [esp + 0x24], edx
cmp esi, 0x10
jb 0x101ccad4
mov ebp, eax
mov ecx, esi
shr ecx, 4
push ebp
push dword [esp + 0x2c]
lea eax, [ecx + edx]
neg edx
cmp eax, ecx
cmovae edx, ecx
mov dword [esp + 0x18], edx
xor edx, edx
push dword [esp + 0x18]
cmp eax, ecx
push edi
cmovae edx, eax
push ebx
mov dword [esp + 0x38], edx
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, edx
bswap eax
mov dword [ebp + 0xc], eax
test edx, edx
jne 0x101ccab6
mov edx, 0xc
mov eax, 1
nop dword [eax]
movzx ecx, byte [edx + ebp - 1]
dec edx
add eax, ecx
mov byte [edx + ebp], al
shr eax, 8
test edx, edx
jne 0x101ccaa0
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
shl eax, 4
sub esi, eax
add edi, eax
add ebx, eax
cmp esi, 0x10
jae 0x101cca50
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], edx
test esi, esi
je 0x101ccb32
mov ecx, dword [esp + 0x30]
xorps xmm0, xmm0
push eax
push dword [esp + 0x2c]
push 1
push ecx
push ecx
movups xmmword [ecx], xmm0
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, dword [esp + 0x2c]
add edx, 1
bswap edx
mov dword [eax + 0xc], edx
jne 0x101ccb0d
push eax
call fcn.101ccb70
add esp, 4
mov eax, dword [esp + 0x30]
sub ebx, eax
sub edi, eax
lea ecx, [eax + ebp]
add ebp, esi
nop word [eax + eax]
mov al, byte [ecx + ebx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [edi + ecx - 1], al
sub esi, 1
jne 0x101ccb20
mov eax, dword [esp + 0x34]
pop edi
pop esi
mov dword [eax], ebp
pop ebp
pop ebx
add esp, 8
ret
Function at 0x101d22f0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x101d23b9
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x101d2311
cmp al, 0x6b
jne 0x101d23b9
inc ecx
cmp al, 0x6b
jne 0x101d2372
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x101d2332
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x101d2332
cmp dl, 0xbb
jne 0x101d2346
inc eax
cmp eax, esi
jl 0x101d2320
sub esi, eax
test eax, eax
jne 0x101d2375
call fcn.10105aa0
push str.RSA_padding_check_X931
push 0x56
jmp 0x101d2352
call fcn.10105aa0
push str.RSA_padding_check_X931
push 0x4e
push str.crypto_rsa_rsa_x931.c
call fcn.10105ba0
push 0
push 0x8a
push 4
call fcn.10105cb0
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x101d23a7
call fcn.10105aa0
push str.RSA_padding_check_X931
push 0x5f
push str.crypto_rsa_rsa_x931.c
call fcn.10105ba0
push 0
push 0x8b
push 4
call fcn.10105cb0
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call fcn.1026cc70
add esp, 0xc
mov eax, esi
pop esi
ret
call fcn.10105aa0
push str.RSA_padding_check_X931
push 0x43
push str.crypto_rsa_rsa_x931.c
call fcn.10105ba0
push 0
push 0x89
push 4
call fcn.10105cb0
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
Function at 0x101e1520
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.1026b810
mov ecx, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x24]
shr ecx, 3
mov dword [esp + 8], ecx
cmp esi, dword [esp + 0x28]
jb 0x101e1738
push ebx
push ebp
push edi
nop word [eax + eax]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x101e1712
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
movzx eax, byte [ecx + 7]
cdq
mov ebp, eax
mov ebx, edx
movzx eax, byte [ecx + 6]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 5]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 4]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 3]
cdq
mov ecx, ebp
shld ebx, ecx, 8
mov edi, edx
mov dword [esp + 0x20], ebp
shl ecx, 8
or edi, ebx
or eax, ecx
and ebp, 0x55555555
mov ecx, dword [esp + 0x2c]
mov ebx, eax
mov dword [esp + 0x18], eax
shld edi, ebx, 8
movzx eax, byte [ecx + 2]
cdq
shl ebx, 8
or edi, edx
or ebx, eax
movzx eax, byte [ecx + 1]
cdq
shld edi, ebx, 8
shl ebx, 8
or edi, edx
or ebx, eax
movzx eax, byte [ecx]
cdq
add ecx, 8
shld edi, ebx, 8
mov dword [esp + 0x2c], ecx
shl ebx, 8
or ebx, eax
mov eax, ebx
and eax, 0x55555555
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
and ecx, 0xff00ff
mov dword [esp + 0x18], ecx
mov ecx, ebp
shr ecx, 1
or ecx, ebp
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ebp, eax
shr ebp, 4
or ebp, eax
and ebx, 0xaaaaaaaa
and ebp, 0xff00ff
lea eax, [ebx + ebx]
or eax, ebx
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
and ecx, 0xf0f0f0f0
mov edi, ecx
shl edi, 4
or edi, ecx
mov ecx, dword [esp + 0x20]
and ecx, 0xaaaaaaaa
and edi, 0xff00ff00
mov ebx, edi
and edi, 0xffff00
shr ebx, 8
or ebx, edi
lea eax, [ecx + ecx]
shr ebx, 8
or eax, ecx
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
and ecx, 0xf0f0f0f0
mov edx, ecx
shl edx, 4
or edx, ecx
mov ecx, ebp
and edx, 0xff00ff00
shl ebp, 8
mov eax, edx
and ecx, 0xffffff00
shl eax, 8
or ecx, ebp
or eax, edx
shl ecx, 8
and eax, 0xffff0000
xor edx, edx
or ebx, eax
mov eax, dword [esp + 0x18]
shr eax, 8
or eax, dword [esp + 0x18]
movzx eax, ax
or ecx, eax
mov eax, dword [esp + 0x10]
or edx, ecx
mov ecx, dword [esp + 0x28]
xor dword [ecx + eax*8], edx
xor dword [ecx + eax*8 + 4], ebx
inc eax
mov dword [esp + 0x10], eax
cmp eax, esi
jb 0x101e1564
mov esi, dword [esp + 0x30]
jmp 0x101e1716
mov ecx, dword [esp + 0x28]
push ecx
call fcn.101e0c60
sub esi, dword [esp + 0x38]
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], esi
cmp esi, dword [esp + 0x34]
jae 0x101e1550
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
add esp, 0x14
ret
Function at 0x101e31d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x30
call fcn.1026b810
mov eax, dword [0x10343c80]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push ebp
push esi
push edi
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x50]
movzx ecx, byte [edx]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x1c], eax
mov bl, byte [edx + 3]
mov esi, dword [eax]
movzx eax, byte [edx + 1]
shl eax, 8
or ecx, eax
mov ebp, dword [esp + 0x4c]
movzx eax, byte [edx + 2]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x20], edx
movzx eax, bl
shl eax, 0x18
or ecx, eax
mov byte [esp + 0x37], bl
movzx eax, byte [edx + 5]
shl eax, 8
movzx edi, byte [edx + 4]
mov dl, byte [edx + 7]
or edi, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], ecx
movzx ecx, dl
shl ecx, 8
movzx eax, byte [eax + 6]
or ecx, eax
mov dword [esp + 0x14], 0
mov eax, ecx
mov byte [esp + 0x3a], cl
shl eax, 0x10
or edi, eax
mov byte [esp + 0x3b], dl
mov eax, dword [esp + 0x10]
mov ebx, edi
mov dword [esp + 0x24], eax
mov byte [esp + 0x34], al
shr eax, 8
mov byte [esp + 0x35], al
mov eax, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x36], al
mov eax, ebx
shr eax, 8
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], al
test ebp, ebp
je 0x101e337b
mov edi, dword [esp + 0x44]
sub dword [esp + 0x18], edi
dec ebp
test esi, esi
jne 0x101e3320
push 1
push dword [esp + 0x34]
lea eax, [esp + 0x2c]
push eax
call fcn.1003c280
mov ecx, dword [esp + 0x30]
add esp, 0xc
mov ebx, dword [esp + 0x28]
mov eax, ecx
shr eax, 8
mov edx, dword [esp + 0x14]
mov byte [esp + 0x35], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x36], al
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x37], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x39], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x3a], al
mov eax, ebx
shr eax, 0x18
inc edx
mov dword [esp + 0x10], ecx
mov byte [esp + 0x34], cl
mov byte [esp + 0x38], bl
mov byte [esp + 0x3b], al
mov dword [esp + 0x14], edx
jmp 0x101e3324
mov edx, dword [esp + 0x14]
mov al, byte [esp + esi + 0x34]
inc esi
mov ecx, dword [esp + 0x18]
and esi, 7
xor al, byte [edi]
mov byte [edi + ecx], al
inc edi
mov ecx, dword [esp + 0x10]
test ebp, ebp
jne 0x101e32b3
test edx, edx
je 0x101e337b
mov edx, dword [esp + 0x20]
mov eax, ecx
shr eax, 8
mov byte [edx + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 2], al
mov eax, ebx
shr eax, 8
mov byte [edx + 5], al
mov eax, ebx
mov byte [edx], cl
shr ecx, 0x18
shr eax, 0x10
mov byte [edx + 4], bl
shr ebx, 0x18
mov byte [edx + 3], cl
mov byte [edx + 6], al
mov byte [edx + 7], bl
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x3c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1026af9a
add esp, 0x30
ret
Function at 0x101e3eb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x38
call fcn.1026b810
mov eax, dword [0x10343c80]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x64]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x5c]
movzx ecx, byte [edx]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x1c], eax
mov bl, byte [edx + 3]
mov esi, dword [eax]
movzx eax, byte [edx + 1]
shl eax, 8
or ecx, eax
mov ebp, dword [esp + 0x54]
movzx eax, byte [edx + 2]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x20], edx
movzx eax, bl
shl eax, 0x18
or ecx, eax
mov byte [esp + 0x3f], bl
movzx eax, byte [edx + 5]
shl eax, 8
movzx edi, byte [edx + 4]
mov dl, byte [edx + 7]
or edi, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], ecx
movzx ecx, dl
shl ecx, 8
movzx eax, byte [eax + 6]
or ecx, eax
mov dword [esp + 0x14], 0
mov eax, ecx
mov byte [esp + 0x42], cl
shl eax, 0x10
or edi, eax
mov byte [esp + 0x43], dl
mov eax, dword [esp + 0x10]
mov ebx, edi
mov dword [esp + 0x24], eax
mov byte [esp + 0x3c], al
shr eax, 8
mov byte [esp + 0x3d], al
mov eax, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x3e], al
mov eax, ebx
shr eax, 8
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov byte [esp + 0x40], bl
mov byte [esp + 0x41], al
test ebp, ebp
je 0x101e4071
mov edi, dword [esp + 0x4c]
sub dword [esp + 0x18], edi
dec ebp
test esi, esi
jne 0x101e4016
push dword [esp + 0x30]
lea eax, [esp + 0x28]
push dword [esp + 0x38]
push dword [esp + 0x40]
push eax
call fcn.1003c3e0
mov ecx, dword [esp + 0x34]
add esp, 0x10
mov ebx, dword [esp + 0x28]
mov eax, ecx
shr eax, 8
mov edx, dword [esp + 0x14]
mov byte [esp + 0x3d], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x3e], al
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x3f], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x41], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x42], al
mov eax, ebx
shr eax, 0x18
inc edx
mov dword [esp + 0x10], ecx
mov byte [esp + 0x3c], cl
mov byte [esp + 0x40], bl
mov byte [esp + 0x43], al
mov dword [esp + 0x14], edx
jmp 0x101e401a
mov edx, dword [esp + 0x14]
mov al, byte [esp + esi + 0x3c]
inc esi
mov ecx, dword [esp + 0x18]
and esi, 7
xor al, byte [edi]
mov byte [edi + ecx], al
inc edi
mov ecx, dword [esp + 0x10]
test ebp, ebp
jne 0x101e3fa3
test edx, edx
je 0x101e4071
mov edx, dword [esp + 0x20]
mov eax, ecx
shr eax, 8
mov byte [edx + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 2], al
mov eax, ebx
shr eax, 8
mov byte [edx + 5], al
mov eax, ebx
mov byte [edx], cl
shr ecx, 0x18
shr eax, 0x10
mov byte [edx + 4], bl
shr ebx, 0x18
mov byte [edx + 3], cl
mov byte [edx + 6], al
mov byte [edx + 7], bl
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x44]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1026af9a
add esp, 0x38
ret