joyce8/EMBER2024-capa huggingface dataset:
Function at 0xb44d9d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
cmp dword [0x5c5670], 0
je 0xb44f16
xor eax, eax
mov dword [0x5c5670], eax
xor edx, edx
mov dword [ebp - 0x10], edx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
xor edx, edx
mov dl, byte [eax + 0x5c5674]
mov ecx, 0x1f
sub ecx, edx
mov eax, 1
shl eax, cl
or dword [ebp - 0x10], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xe
jl 0xb44dc1
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
xor eax, eax
mov dword [ebp - 0xc], eax
test byte [ebp - 4], 1
je 0xb44e06
mov edx, dword [ebp - 4]
shr edx, 1
xor edx, dword [ebp - 0x10]
jmp 0xb44e0b
mov edx, dword [ebp - 4]
shr edx, 1
mov dword [ebp - 4], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jl 0xb44df6
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax*4 + 0x61e28c], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jl 0xb44deb
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
mov ecx, dword [edx*4 + 0x61e28c]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
shr eax, 0x18
mov edx, dword [ebp - 4]
shr edx, 8
and edx, 0xff00
add eax, edx
mov ecx, dword [ebp - 4]
and ecx, 0xff00
shl ecx, 8
add eax, ecx
mov edx, dword [ebp - 4]
and edx, 0xff
shl edx, 0x18
add eax, edx
mov ecx, dword [ebp - 8]
mov dword [ecx*4 + 0x61f28c], eax
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
and eax, 0xff
mov eax, dword [eax*4 + 0x61e28c]
mov edx, dword [ebp - 4]
shr edx, 8
xor eax, edx
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
shl ecx, 0xa
lea eax, [ecx + 0x61e28c]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax + edx*4], ecx
mov eax, dword [ebp - 4]
shr eax, 0x18
mov edx, dword [ebp - 4]
shr edx, 8
and edx, 0xff00
add eax, edx
mov ecx, dword [ebp - 4]
and ecx, 0xff00
shl ecx, 8
add eax, ecx
mov edx, dword [ebp - 4]
and edx, 0xff
shl edx, 0x18
add eax, edx
mov ecx, dword [ebp - 0xc]
shl ecx, 0xa
lea edx, [ecx + 0x61f28c]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx*4], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0xb44e83
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jl 0xb44e35
xor eax, eax
mov dword [0x5c566c], eax
jmp 0xb44f1f
cmp dword [0x5c566c], 0
jne 0xb44f16
mov esp, ebp
pop ebp
ret
Function at 0xb50021
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov dword [ebp - 8], edx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 8]
shr eax, 1
mov edx, dword [ebp - 8]
and edx, 1
dec edx
not edx
and edx, 0xedb88320
xor eax, edx
mov dword [ebp - 8], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jl 0xb50037
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [ecx*4 + 0x62029c], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x100
jb 0xb5002c
mov esp, ebp
pop ebp
ret

Function at 0xb50076
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
jbe 0xb500b4
mov edx, dword [ebp - 4]
xor ecx, ecx
mov cl, byte [edx]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov eax, dword [ecx*4 + 0x62029c]
mov edx, dword [ebp + 8]
shr edx, 8
xor eax, edx
mov dword [ebp + 8], eax
dec dword [ebp + 0x10]
inc dword [ebp - 4]
cmp dword [ebp + 0x10], 0
ja 0xb50086
mov eax, dword [ebp + 8]
pop ecx
pop ebp
ret
Function at 0xb5f6bd
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
and eax, 1
test al, al
je 0xb5f6ec
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 4], eax
jmp 0xb5f6ef
shr dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0xb5f6d3
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0x6206bc], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0xb5f6c8
mov byte [0x620abc], 1
mov esp, ebp
pop ebp
ret

Function at 0xb5f71d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
cmp byte [0x620abc], 0
jne 0xb5f740
call fcn.00b5f6bd
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0xb5f77f
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
movzx eax, byte [eax + edx]
xor eax, dword [ebp - 0x14]
and eax, 0xff
mov eax, dword [eax*4 + 0x6206bc]
mov edx, dword [ebp - 0x14]
shr edx, 8
xor eax, edx
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x18]
dec dword [ebp - 0x1c]
jne 0xb5f753
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0xb6d706
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push 0x40
push 0
lea eax, [ebp - 0x84]
push eax
call fcn.00cbc021
add esp, 0xc
push 0x40
push 0
lea edx, [ebp - 0x44]
push edx
call fcn.00cbc021
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
add eax, eax
lea eax, [eax + eax*2]
mov edx, dword [ebp + 0x1c]
lea ecx, [edx + eax*8]
mov eax, dword [ebp - 4]
mov dl, byte [ecx + eax]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx*4 + 0x5ce9fc]
mov ecx, dword [ebp + 0x10]
xor dl, byte [ecx + eax - 1]
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x44], dl
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x30
jl 0xb6d737
lea edx, [ebp - 0x84]
push edx
lea ecx, [ebp - 0x44]
push ecx
call fcn.00b6d7c4
add esp, 8
xor eax, eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
mov ecx, dword [edx*4 + 0x5ceabc]
mov al, byte [ebp + ecx - 0x85]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
xor al, byte [edx + ecx]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp - 4]
mov byte [edx + ecx], al
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x20
jl 0xb6d784
push 0x20
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call fcn.00cbbfb1
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0xb6d8dd
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x10], edx
mov ecx, dword [ebp + 8]
mov dword [ecx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], 0x10325476
pop ebp
ret
Function at 0xb82d71
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov byte [ebp - 8], dl
test dl, dl
jle 0xb82d83
call fcn.00cdf42d
mov byte [ebp - 0x2a], cl
mov byte [ebp - 0x29], dl
mov dword [ebp - 4], eax
mov eax, 0x5d01c4
call fcn.00cbc5fd
mov word [ebp - 0x18], 8
mov cl, byte [ebp - 0x2a]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00c2cdad
add dword [ebp - 0xc], 2
mov eax, dword [ebp - 4]
add eax, 0x30
call fcn.00b26de1
inc dword [ebp - 0xc]
mov edx, dword [ebp - 4]
add edx, 0x34
push edx
call fcn.00b5904d
pop ecx
add dword [ebp - 0xc], 8
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [ecx + 0x78], eax
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [edx + 0x80], ecx
mov eax, dword [ebp - 4]
mov byte [eax + 0x84], 0
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov eax, dword [ebp - 4]
cmp byte [ebp - 0x29], 0
je 0xb82e01
call fcn.00cdf43a
mov esp, ebp
pop ebp
ret

Function at 0xb86c6d
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], ecx
xor edx, edx
mov dword [eax + 0x58], edx
mov eax, 1
pop ebp
ret

Function at 0xb87651
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], ecx
xor edx, edx
mov dword [eax + 0x5c], edx
mov eax, 1
pop ebp
ret
Function at 0xb88639
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x20], edx
mov dword [eax + 0x24], ecx
xor edx, edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], 0x1c
mov eax, 1
pop ebp
ret

Function at 0xb88695
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], edx
mov dword [eax + 0x24], ecx
xor edx, edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], 0x20
mov eax, 1
pop ebp
ret

Function at 0xb8adf1
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov ecx, dword [ebp + 8]
mov dword [ecx], 0xc1059ed8
mov dword [ecx + 4], 0xcbbb9d5d
mov dword [ecx + 8], 0x367cd507
mov dword [ecx + 0xc], 0x629a292a
mov dword [ecx + 0x10], 0x3070dd17
mov dword [ecx + 0x14], 0x9159015a
mov dword [ecx + 0x18], 0xf70e5939
mov dword [ecx + 0x1c], 0x152fecd8
mov dword [ecx + 0x20], 0xffc00b31
mov dword [ecx + 0x24], 0x67332667
mov dword [ecx + 0x28], 0x68581511
mov dword [ecx + 0x2c], 0x8eb44a87
mov dword [ecx + 0x30], 0x64f98fa7
mov dword [ecx + 0x34], 0xdb0c2e0d
mov dword [ecx + 0x38], 0xbefa4fa4
mov dword [ecx + 0x3c], 0x47b5481d
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0xd0], eax
mov eax, 1
mov dword [ecx + 0xd4], 0x30
pop ebp
ret

Function at 0xb8ae9d
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
xor eax, eax
mov ecx, dword [ebp + 8]
mov dword [ecx], 0xf3bcc908
mov dword [ecx + 4], 0x6a09e667
mov dword [ecx + 8], 0x84caa73b
mov dword [ecx + 0xc], 0xbb67ae85
mov dword [ecx + 0x10], 0xfe94f82b
mov dword [ecx + 0x14], 0x3c6ef372
mov dword [ecx + 0x18], 0x5f1d36f1
mov dword [ecx + 0x1c], 0xa54ff53a
mov dword [ecx + 0x20], 0xade682d1
mov dword [ecx + 0x24], 0x510e527f
mov dword [ecx + 0x28], 0x2b3e6c1f
mov dword [ecx + 0x2c], 0x9b05688c
mov dword [ecx + 0x30], 0xfb41bd6b
mov dword [ecx + 0x34], 0x1f83d9ab
mov dword [ecx + 0x38], 0x137e2179
mov dword [ecx + 0x3c], 0x5be0cd19
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0xd0], eax
mov eax, 1
mov dword [ecx + 0xd4], 0x40
pop ebp
ret
Function at 0xb8f515
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff70
xor eax, eax
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], eax
test esi, esi
je 0xb8f53e
mov dword [ebp - 8], 1
mov dword [ebx], esi
jmp 0xb8f540
mov esi, dword [ebx]
cmp dword [ebp + 0xc], 0
je 0xb8f60b
mov dword [ebp - 8], 1
push esi
call fcn.00bc35f1
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x80
jle 0xb8f578
push 0x5d1a59
push 0x54
push 0x5d1a44
call fcn.00b84bdd
add esp, 0xc
cmp edi, dword [ebp - 4]
jle 0xb8f5b5
mov eax, dword [ebp + 0x18]
lea edx, [ebx + 4]
push eax
push esi
push edx
call fcn.00bc03c9
add esp, 0xc
push edi
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebx + 4]
push ecx
call fcn.00bc048d
add esp, 0xc
lea eax, [ebx + 0x34]
lea edx, [ebx + 0x38]
lea ecx, [ebx + 4]
push eax
push edx
push ecx
call fcn.00bc04d1
add esp, 0xc
jmp 0xb8f5e9
test edi, edi
jl 0xb8f5c1
cmp edi, 0x80
jle 0xb8f5d5
push 0x5d1a89
push 0x5e
push 0x5d1a74
call fcn.00b84bdd
add esp, 0xc
push edi
mov eax, dword [ebp + 0xc]
push eax
lea edx, [ebx + 0x38]
push edx
call fcn.00cbbfb1
add esp, 0xc
mov dword [ebx + 0x34], edi
mov eax, dword [ebx + 0x34]
cmp eax, 0x80
je 0xb8f60b
mov edx, 0x80
sub edx, eax
add eax, ebx
push edx
add eax, 0x38
push 0
push eax
call fcn.00cbc021
add esp, 0xc
cmp dword [ebp - 8], 0
je 0xb8f6af
xor eax, eax
lea edx, [ebp - 0x90]
mov dword [ebp - 0xc], edx
lea edx, [ebx + 0x38]
mov edi, dword [ebp - 0xc]
mov cl, byte [edx]
xor cl, 0x36
inc edx
mov byte [edi], cl
inc eax
inc dword [ebp - 0xc]
cmp eax, 0x80
jl 0xb8f623
mov eax, dword [ebp + 0x18]
lea edi, [ebx + 0x14]
push eax
push esi
push edi
call fcn.00bc03c9
add esp, 0xc
push esi
call fcn.00bc35f1
pop ecx
push eax
lea eax, [ebp - 0x90]
push eax
push edi
call fcn.00bc048d
lea edx, [ebp - 0x90]
add esp, 0xc
mov dword [ebp - 0x10], edx
lea edx, [ebx + 0x38]
xor eax, eax
mov edi, dword [ebp - 0x10]
mov cl, byte [edx]
xor cl, 0x5c
inc edx
mov byte [edi], cl
inc eax
inc dword [ebp - 0x10]
cmp eax, 0x80
jl 0xb8f670
mov eax, dword [ebp + 0x18]
lea edi, [ebx + 0x24]
push eax
push esi
push edi
call fcn.00bc03c9
add esp, 0xc
push esi
call fcn.00bc35f1
pop ecx
push eax
lea eax, [ebp - 0x90]
push eax
push edi
call fcn.00bc048d
add esp, 0xc
lea edx, [ebx + 0x14]
push edx
add ebx, 4
push ebx
call fcn.00bc0565
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xb90f61
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
xor ecx, ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 0x24]
xor ebx, ebx
mov esi, dword [eax]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 0x20]
xor edx, edx
mov dl, byte [eax]
inc eax
mov cl, byte [eax]
inc eax
shl ecx, 8
movzx edi, byte [eax]
inc eax
or edx, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl edi, 0x10
shl ecx, 0x18
or edx, edi
or edx, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
mov bl, byte [eax]
inc eax
shl ebx, 8
or ecx, ebx
xor ebx, ebx
mov bl, byte [eax]
inc eax
shl ebx, 0x10
movzx eax, byte [eax]
shl eax, 0x18
or ecx, ebx
or ecx, eax
lea eax, [ebp - 0xc]
mov ebx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
and bl, 0xff
mov byte [eax], bl
mov ebx, edx
inc eax
shr ebx, 8
and bl, 0xff
mov byte [eax], bl
mov ebx, edx
inc eax
shr ebx, 0x10
and bl, 0xff
mov byte [eax], bl
mov ebx, edx
inc eax
shr ebx, 0x18
and bl, 0xff
mov byte [eax], bl
inc eax
mov ebx, ecx
and bl, 0xff
mov byte [eax], bl
mov ebx, ecx
inc eax
shr ebx, 8
and bl, 0xff
mov byte [eax], bl
mov ebx, ecx
inc eax
shr ebx, 0x10
and bl, 0xff
mov byte [eax], bl
mov ebx, ecx
inc eax
shr ebx, 0x18
and bl, 0xff
mov byte [eax], bl
jmp 0xb910b0
test esi, esi
jne 0xb91098
mov eax, dword [ebp + 0x1c]
push eax
mov edx, dword [ebp + 0x18]
push edx
mov ecx, dword [ebp + 0x14]
push ecx
lea edi, [ebp - 0x14]
push edi
call fcn.00b9305f
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ebx, edx
mov ecx, dword [ebp - 0x10]
and bl, 0xff
add esp, 0x10
mov byte [eax], bl
mov ebx, edx
inc eax
shr ebx, 8
and bl, 0xff
mov byte [eax], bl
mov ebx, edx
inc eax
shr ebx, 0x10
and bl, 0xff
mov byte [eax], bl
mov ebx, edx
inc eax
shr ebx, 0x18
and bl, 0xff
mov byte [eax], bl
inc eax
mov ebx, ecx
and bl, 0xff
mov byte [eax], bl
mov ebx, ecx
inc eax
shr ebx, 8
and bl, 0xff
mov byte [eax], bl
mov ebx, ecx
inc eax
shr ebx, 0x10
and bl, 0xff
mov byte [eax], bl
mov ebx, ecx
inc eax
shr ebx, 0x18
and bl, 0xff
mov byte [eax], bl
inc dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov al, byte [eax]
xor al, byte [ebp + esi - 0xc]
inc esi
mov byte [ebx], al
inc dword [ebp + 8]
inc dword [ebp + 0xc]
and esi, 7
mov eax, dword [ebp - 4]
add dword [ebp - 4], 0xffffffff
test eax, eax
jne 0xb9101f
cmp dword [ebp - 0x18], 0
je 0xb91115
mov eax, dword [ebp + 0x20]
mov ebx, edx
and bl, 0xff
mov byte [eax], bl
inc eax
mov ebx, edx
shr ebx, 8
and bl, 0xff
mov byte [eax], bl
inc eax
mov ebx, edx
shr ebx, 0x10
and bl, 0xff
mov byte [eax], bl
inc eax
shr edx, 0x18
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, ecx
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, ecx
shr edx, 8
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, ecx
shr edx, 0x10
and dl, 0xff
mov byte [eax], dl
inc eax
shr ecx, 0x18
and cl, 0xff
mov byte [eax], cl
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov ecx, eax
mov edx, dword [ebp + 0x24]
mov dword [edx], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xb9112d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
xor ecx, ecx
push ebx
push esi
push edi
mov eax, dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
mov ebx, dword [eax]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 0x18]
xor edx, edx
mov dl, byte [eax]
inc eax
mov cl, byte [eax]
inc eax
shl ecx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl ecx, 0x10
or edx, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl ecx, 0x18
movzx edi, byte [eax]
inc eax
or edx, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl ecx, 8
or edi, ecx
xor ecx, ecx
mov cl, byte [eax]
inc eax
shl ecx, 0x10
movzx eax, byte [eax]
shl eax, 0x18
or edi, ecx
or edi, eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], edx
mov ecx, edx
and cl, 0xff
mov dword [ebp - 0x10], edi
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
mov ecx, edi
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, edi
and dl, 0xff
mov byte [eax], dl
mov edx, edi
inc eax
shr edx, 8
and dl, 0xff
mov byte [eax], dl
inc eax
shr ecx, 0x10
mov edx, edi
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
and dl, 0xff
mov byte [eax], dl
jmp 0xb9126e
test ebx, ebx
jne 0xb9125b
push 1
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00b912f5
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov ecx, edx
add esp, 0xc
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, dword [ebp - 0x10]
mov ecx, edx
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
and dl, 0xff
mov byte [eax], dl
inc dword [ebp - 0x18]
mov al, byte [esi]
mov edx, dword [ebp + 0xc]
xor al, byte [ebp + ebx - 0xc]
inc esi
mov byte [edx], al
inc ebx
inc dword [ebp + 0xc]
and ebx, 7
mov eax, dword [ebp - 4]
add dword [ebp - 4], 0xffffffff
test eax, eax
jne 0xb911ec
cmp dword [ebp - 0x18], 0
je 0xb912db
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x18]
mov ecx, edx
mov edi, dword [ebp - 0x10]
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 8
and cl, 0xff
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
mov ecx, edi
and dl, 0xff
mov byte [eax], dl
inc eax
mov edx, edi
and dl, 0xff
mov byte [eax], dl
mov edx, edi
inc eax
shr edx, 8
and dl, 0xff
mov byte [eax], dl
inc eax
shr ecx, 0x10
mov edx, edi
and cl, 0xff
mov byte [eax], cl
inc eax
shr edx, 0x18
and dl, 0xff
mov byte [eax], dl
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
mov edi, eax
mov edx, eax
mov edx, dword [ebp + 0x1c]
mov dword [edx], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xb932b3
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0xb933a0
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0xb93338
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00b912f5
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0xb932fd
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0xb93468
call fcn.00b9334d
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0xb93404
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00b912f5
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0xb933b4
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0xb93468
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00b912f5
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0xb93463
jmp 0xb93468
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xb934f5
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0xb935eb
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0xb93583
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00b9305f
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0xb93548
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0xb936b3
call fcn.00b93598
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0xb9364f
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00b93189
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0xb935ff
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0xb936b3
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.00b93189
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0xb936ae
jmp 0xb936b3
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret