joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47ce1c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x47ce39
add esp, 0xfffffff0
call fcn.00403840
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x47cfd5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00473628
test al, al
jne 0x47ce76
mov ecx, 0x47d008
mov dl, 1
mov eax, dword [0x467d24]
call fcn.0040c460
call fcn.00403d6c
xor eax, eax
push ebp
push 0x47cea2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.004720d4
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.00471fc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47cec2
mov eax, dword [ebp - 0x10]
mov edx, 0x47d044
call fcn.00404d00
je 0x47cedf
mov eax, esi
mov edx, 0x47d044
call fcn.00404d00
jne 0x47cf03
mov eax, edi
mov edx, 0x47d054
call fcn.00404d00
je 0x47cf03
mov ecx, 0x47d02c
mov dl, 1
mov eax, dword [0x467fcc]
call fcn.0040c460
call fcn.00403d6c
mov eax, edi
xor edx, edx
call fcn.00404d00
jne 0x47cf30
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00404d00
je 0x47cf30
mov ecx, 0x47d02c
mov dl, 1
mov eax, dword [0x467fcc]
call fcn.0040c460
call fcn.00403d6c
mov eax, dword [ebp - 0x10]
mov edx, 0x47d094
call fcn.00404d00
jne 0x47cf63
mov eax, edi
mov edx, 0x47d0a0
call fcn.00404d00
je 0x47cf63
mov ecx, 0x47d02c
mov dl, 1
mov eax, dword [0x467fcc]
call fcn.0040c460
call fcn.00403d6c
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.0047af0c
lea eax, [ebx + 4]
mov edx, esi
call fcn.00404a94
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.00404a94
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.00404a94
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.00404a94
lea eax, [ebx + 8]
call fcn.00404a58
mov byte [ebx + 0xc], 2
xor eax, eax
mov dword [ebx + 0x30], eax
mov al, byte [ebp + 8]
mov byte [ebx + 0x34], al
mov ax, word [0x47d0ec]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47cfdc
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404a70
ret
Function at 0x47e8d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x47e8ed
add esp, 0xfffffff0
call fcn.00403840
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x47ea88
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00473628
test al, al
jne 0x47e92a
mov ecx, 0x47eabc
mov dl, 1
mov eax, dword [0x467d24]
call fcn.0040c460
call fcn.00403d6c
xor eax, eax
push ebp
push 0x47e956
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.004720d4
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.00471fc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47e976
mov eax, edi
xor edx, edx
call fcn.00404d00
jne 0x47e9a3
mov eax, dword [ebp - 0x10]
xor edx, edx
call fcn.00404d00
je 0x47e9a3
mov ecx, 0x47eae0
mov dl, 1
mov eax, dword [0x467fcc]
call fcn.0040c460
call fcn.00403d6c
mov eax, dword [ebp - 0x10]
mov edx, 0x47eaf8
call fcn.00404d00
jne 0x47e9d6
mov eax, edi
mov edx, 0x47eb04
call fcn.00404d00
je 0x47e9d6
mov ecx, 0x47eae0
mov dl, 1
mov eax, dword [0x467fcc]
call fcn.0040c460
call fcn.00403d6c
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.0047af0c
lea eax, [ebx + 4]
mov edx, esi
call fcn.00404a94
lea eax, [ebx + 0x28]
mov edx, edi
call fcn.00404a94
lea eax, [ebx + 0x2c]
mov edx, dword [ebp - 0x10]
call fcn.00404a94
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 0xc]
call fcn.00404a94
lea eax, [ebx + 8]
call fcn.00404a58
mov byte [ebx + 0xc], 1
mov dl, 1
mov eax, dword [0x419930]
call fcn.004034fc
mov dword [ebx + 0x38], eax
mov dl, 1
mov eax, dword [0x419930]
call fcn.004034fc
mov dword [ebx + 0x30], eax
mov dl, 1
mov eax, dword [0x419930]
call fcn.004034fc
mov dword [ebx + 0x34], eax
push ebx
mov eax, dword [ebx + 0x38]
push eax
mov ax, word [0x47eb50]
push eax
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x46ad48]
call fcn.0047a164
mov dword [ebx + 0x3c], eax
mov ax, word [0x47eb54]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ea8f
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404a70
ret
Function at 0x4814e4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x481506
add esp, 0xfffffff0
call fcn.00403840
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x481671
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00473628
test al, al
jne 0x481543
mov ecx, 0x4816a4
mov dl, 1
mov eax, dword [0x467d24]
call fcn.0040c460
call fcn.00403d6c
push dword [0x4cc64c]
lea edx, [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xbc]
push dword [ebp - 0x10]
push dword [0x4cc64c]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404cb8
mov eax, dword [ebp - 0xc]
call fcn.00474100
test al, al
jne 0x481615
push dword [0x4cc648]
push dword [ebp + 8]
push dword [0x4cc648]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404cb8
mov eax, dword [ebp - 0x14]
call fcn.00474100
test al, al
jne 0x481615
push dword [0x4cc64c]
lea edx, [ebp - 0x1c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xb8]
push dword [ebp - 0x1c]
push dword [0x4cc64c]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404cb8
mov eax, dword [ebp - 0x18]
call fcn.00474218
test al, al
jne 0x481615
push dword [0x4cc648]
push edi
push dword [0x4cc648]
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00404cb8
mov eax, dword [ebp - 0x20]
call fcn.00474218
test al, al
jne 0x481615
mov ecx, 0x4816a4
mov dl, 1
mov eax, dword [0x467d24]
call fcn.0040c460
call fcn.00403d6c
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.0047af0c
lea eax, [ebx + 4]
mov edx, esi
call fcn.00404a94
lea eax, [ebx + 8]
call fcn.00404a58
lea eax, [ebx + 0x30]
mov edx, edi
call fcn.00404a94
lea eax, [ebx + 0x34]
mov edx, dword [ebp + 8]
call fcn.00404a94
mov byte [ebx + 0xc], 0xc
mov ax, word [0x4816c0]
mov word [ebx + 0x21], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481678
lea eax, [ebp - 0x20]
mov edx, 6
call fcn.00404a70
ret

Function at 0x4b6174
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b61ef
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
push 0x59
call sub.kernel32.dll_GetThreadLocale_1
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x4b61d6
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, pe_nt_image_headers32
call fcn.004045bc
mov eax, dword [ebp - 0x104]
mov edx, ebx
call fcn.004088ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b61f6
lea eax, [ebp - 0x104]
call fcn.0040434c
ret
Function at 0x10002600
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov dword [ecx], 0x61707865
mov dword [ecx + 4], 0x3320646e
mov dword [ecx + 8], 0x79622d32
mov dword [ecx + 0xc], 0x6b206574
movzx edx, byte [eax + 3]
shl edx, 8
push esi
movzx esi, byte [eax + 2]
or edx, esi
shl edx, 8
movzx esi, byte [eax + 1]
or edx, esi
shl edx, 8
movzx esi, byte [eax]
or edx, esi
mov dword [ecx + 0x10], edx
movzx edx, byte [eax + 7]
movzx esi, byte [eax + 6]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 5]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 4]
shl edx, 8
or edx, esi
mov dword [ecx + 0x14], edx
movzx edx, byte [eax + 0xb]
movzx esi, byte [eax + 0xa]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 9]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 8]
shl edx, 8
or edx, esi
mov dword [ecx + 0x18], edx
movzx edx, byte [eax + 0xf]
movzx esi, byte [eax + 0xe]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 0xd]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 0xc]
shl edx, 8
or edx, esi
mov dword [ecx + 0x1c], edx
movzx edx, byte [eax + 0x13]
movzx esi, byte [eax + 0x12]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 0x11]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 0x10]
shl edx, 8
or edx, esi
mov dword [ecx + 0x20], edx
movzx edx, byte [eax + 0x17]
movzx esi, byte [eax + 0x16]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 0x15]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 0x14]
shl edx, 8
or edx, esi
mov dword [ecx + 0x24], edx
movzx edx, byte [eax + 0x1b]
movzx esi, byte [eax + 0x1a]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 0x19]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 0x18]
shl edx, 8
or edx, esi
mov dword [ecx + 0x28], edx
movzx edx, byte [eax + 0x1f]
movzx esi, byte [eax + 0x1e]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 0x1d]
movzx eax, byte [eax + 0x1c]
shl edx, 8
or edx, esi
shl edx, 8
or edx, eax
mov dword [ecx + 0x2c], edx
xor eax, eax
pop esi
ret
Function at 0x10002730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 8], ebx
test esi, esi
je 0x10002779
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub edx, eax
mov dword [ebp - 4], edx
jmp 0x10002754
mov edx, dword [ebp - 4]
mov ecx, dword [edi + 0x80]
cmp ecx, 0x40
jae 0x10002773
mov dl, byte [edx + eax]
xor dl, byte [ecx + edi + 0x40]
inc ebx
mov byte [eax], dl
inc dword [edi + 0x80]
inc eax
dec esi
jne 0x10002751
mov dword [ebp - 8], ebx
mov dword [ebp + 8], esi
cmp esi, 0x40
jb 0x1000283d
mov ecx, dword [ebp + 0xc]
mov eax, ecx
sub eax, dword [ebp + 0x10]
shr esi, 6
mov dword [ebp - 4], eax
lea eax, [ebx + ecx + 2]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
lea ebx, [ebx]
lea eax, [edi + 0x40]
push eax
mov ecx, edi
call fcn.100024e0
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp - 0xc]
add esp, 4
inc dword [edi + 0x30]
lea eax, [ebx + edx]
lea ecx, [edi + 0x41]
mov edx, 8
mov ebx, dword [ebp - 4]
movzx ebx, byte [eax + ebx]
xor bl, byte [ecx - 1]
add eax, 8
mov byte [eax - 8], bl
movzx ebx, byte [esi - 1]
xor bl, byte [ecx]
add ecx, 8
mov byte [eax - 7], bl
movzx ebx, byte [ecx - 7]
xor bl, byte [esi]
add esi, 8
mov byte [eax - 6], bl
movzx ebx, byte [ecx - 6]
xor bl, byte [esi - 7]
mov byte [eax - 5], bl
movzx ebx, byte [ecx - 5]
xor bl, byte [esi - 6]
mov byte [eax - 4], bl
movzx ebx, byte [ecx - 4]
xor bl, byte [esi - 5]
mov byte [eax - 3], bl
movzx ebx, byte [ecx - 3]
xor bl, byte [esi - 4]
mov byte [eax - 2], bl
movzx ebx, byte [ecx - 2]
xor bl, byte [esi - 3]
dec edx
mov byte [eax - 1], bl
jne 0x100027c2
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], esi
mov esi, dword [ebp + 8]
add ebx, 0x40
sub esi, 0x40
dec dword [ebp - 0x10]
mov dword [ebp - 8], ebx
mov dword [ebp + 8], esi
jne 0x100027a0
test esi, esi
je 0x1000288c
lea eax, [edi + 0x40]
push eax
mov ecx, edi
call fcn.100024e0
inc dword [edi + 0x30]
add esp, 4
xor eax, eax
test esi, esi
je 0x10002886
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub edx, ecx
add ebx, ecx
mov dword [ebp - 4], edx
mov dword [ebp + 8], ebx
jmp 0x10002873
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, eax
mov dl, byte [edx + ecx]
xor dl, byte [edi + eax + 0x40]
inc eax
mov byte [ecx], dl
cmp eax, esi
jb 0x10002870
mov dword [edi + 0x80], esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003990
Capabilities:
Encrypt data using camellia

Disassembly:
mov ecx, dword [edx]
xor ecx, dword [eax]
mov edx, dword [edx + 4]
xor edx, dword [eax + 4]
push ebx
push edi
mov eax, edx
shr eax, 0x10
and eax, 0xff
movzx eax, byte [eax + 0x100b3a08]
mov edi, edx
shr edi, 0x18
movzx edi, byte [edi + 0x100b3908]
shl edi, 8
or eax, edi
mov edi, edx
shr edi, 8
and edi, 0xff
movzx edi, byte [edi + 0x100b3b08]
shl eax, 8
or eax, edi
mov edi, ecx
mov ebx, ecx
shr edi, 0x10
shr ebx, 0x18
movzx ebx, byte [ebx + 0x100b3808]
and edi, 0xff
movzx edi, byte [edi + 0x100b3908]
shl ebx, 8
or edi, ebx
mov ebx, ecx
and edx, 0xff
movzx edx, byte [edx + 0x100b3808]
shr ebx, 8
and ebx, 0xff
movzx ebx, byte [ebx + 0x100b3a08]
and ecx, 0xff
movzx ecx, byte [ecx + 0x100b3b08]
shl edi, 8
shl eax, 8
or eax, edx
or edi, ebx
shl edi, 8
or edi, ecx
mov edx, eax
rol edx, 8
xor edx, edi
mov ecx, edx
rol ecx, 0x10
xor eax, ecx
mov ecx, eax
ror ecx, 8
xor edx, ecx
xor dword [esi + 4], edx
mov ecx, edx
ror ecx, 8
xor ecx, dword [esi]
pop edi
xor ecx, eax
mov dword [esi], ecx
pop ebx
ret
Function at 0x10005260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [eax]
push edi
mov edi, edx
mov dword [ebp - 4], 0x10
lea esp, [esp]
xor ecx, dword [edi]
add edi, 4
movzx eax, cl
mov dword [ebp - 0xc], eax
mov eax, ecx
shr eax, 8
movzx ebx, al
shr eax, 8
mov dword [ebp - 8], ebx
mov ebx, ecx
mov ecx, eax
shr ecx, 8
and ecx, 0xff
mov ecx, dword [edx + ecx*4 + 0x48]
movzx eax, al
add ecx, dword [edx + eax*4 + 0x448]
movzx eax, word [ebp - 8]
xor ecx, dword [edx + eax*4 + 0x848]
movzx eax, word [ebp - 0xc]
add ecx, dword [edx + eax*4 + 0xc48]
xor ecx, esi
dec dword [ebp - 4]
mov esi, ebx
jne 0x10005280
mov eax, dword [edx + 0x44]
mov esi, dword [ebp + 8]
mov edx, dword [edx + 0x40]
xor eax, ebx
pop edi
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
xor edx, ecx
pop esi
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100052f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [eax]
push edi
lea edi, [edx + 0x44]
mov dword [ebp - 4], 0x10
lea ecx, [ecx]
xor ecx, dword [edi]
sub edi, 4
movzx eax, cl
mov dword [ebp - 0xc], eax
mov eax, ecx
shr eax, 8
movzx ebx, al
shr eax, 8
mov dword [ebp - 8], ebx
mov ebx, ecx
mov ecx, eax
shr ecx, 8
and ecx, 0xff
mov ecx, dword [edx + ecx*4 + 0x48]
movzx eax, al
add ecx, dword [edx + eax*4 + 0x448]
movzx eax, word [ebp - 8]
xor ecx, dword [edx + eax*4 + 0x848]
movzx eax, word [ebp - 0xc]
add ecx, dword [edx + eax*4 + 0xc48]
xor ecx, esi
dec dword [ebp - 4]
mov esi, ebx
jne 0x10005310
mov eax, dword [edx]
mov esi, dword [ebp + 8]
mov edx, dword [edx + 4]
xor eax, ebx
pop edi
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
xor edx, ecx
pop esi
mov dword [eax], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005380
Capabilities:
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, eax
lea eax, [ebx - 0x20]
push edi
mov edi, ecx
cmp eax, 0x1a0
ja 0x100054b5
test bl, 7
jne 0x100054b5
mov ecx, dword [ebp + 8]
shr ebx, 3
mov eax, 0x100b27d8
add ecx, 0x48
mov dword [ebp - 8], 4
push esi
lea esp, [esp]
mov edx, 0x100
mov esi, dword [eax]
mov dword [ecx], esi
add eax, 4
add ecx, 4
dec edx
jne 0x100053c5
dec dword [ebp - 8]
jne 0x100053c0
mov esi, dword [ebp + 8]
mov ecx, 0x100b2790
xor eax, eax
sub ecx, esi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 0x12
lea ecx, [ecx]
movzx ecx, byte [eax + edi]
inc eax
cmp eax, ebx
jb 0x100053fb
xor eax, eax
movzx edx, byte [eax + edi]
shl ecx, 8
inc eax
or edx, ecx
cmp eax, ebx
jb 0x1000540b
xor eax, eax
movzx ecx, byte [eax + edi]
shl edx, 8
inc eax
or ecx, edx
cmp eax, ebx
jb 0x1000541b
xor eax, eax
movzx edx, byte [eax + edi]
shl ecx, 8
inc eax
or edx, ecx
cmp eax, ebx
jb 0x1000542b
xor eax, eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + esi]
xor ecx, edx
mov dword [esi], ecx
add esi, 4
dec dword [ebp - 8]
jne 0x100053f0
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov edi, dword [ebp + 8]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
mov edx, edi
call fcn.10005260
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edi + esi*4], ecx
mov dword [edi + esi*4 + 4], edx
add esi, 2
add esp, 8
cmp esi, 0x12
jb 0x10005445
mov esi, edi
add esi, 0x4c
mov ebx, 4
lea esp, [esp]
mov edi, 0x80
mov edx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
call fcn.10005260
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [esi - 4], edx
mov dword [esi], eax
add esp, 8
add esi, 8
dec edi
jne 0x10005485
dec ebx
jne 0x10005480
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0xffffffea
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0xc
push ebx
mov ebx, dword [eax]
cmp ebx, 8
jb 0x1000596b
mov eax, 0xffffffea
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0xc], 0
je 0x10005a55
mov eax, dword [ebp + 0x14]
sub ecx, eax
mov dword [ebp - 0xc], ecx
lea ecx, [ecx]
dec dword [ebp + 0xc]
test ebx, ebx
jne 0x10005a35
movzx ecx, byte [edi]
movzx edx, byte [edi + 1]
movzx eax, byte [edi + 2]
shl ecx, 8
or ecx, edx
movzx edx, byte [edi + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 4]
shl ecx, 8
or ecx, edx
movzx edx, byte [edi + 6]
shl eax, 8
mov dword [ebp - 4], ecx
movzx ecx, byte [edi + 5]
or eax, ecx
movzx ecx, byte [edi + 7]
shl eax, 8
or eax, edx
shl eax, 8
or eax, ecx
lea edx, [ebp - 8]
mov dword [ebp - 8], eax
push edx
mov edx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.10005260
mov eax, dword [ebp - 4]
mov ecx, eax
shr ecx, 0x18
mov byte [esi], cl
mov edx, eax
shr edx, 0x10
mov ecx, eax
shr ecx, 8
mov byte [esi + 1], dl
mov byte [esi + 3], al
mov eax, dword [ebp - 8]
mov byte [esi + 2], cl
mov edx, eax
shr edx, 0x18
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 4], dl
mov edx, eax
mov byte [esi + 5], cl
shr edx, 8
mov ecx, 1
add esp, 8
mov byte [esi + 7], al
mov byte [esi + 6], dl
lea eax, [edi + 7]
sub ecx, edi
inc byte [eax]
jne 0x10005a32
dec eax
lea edx, [ecx + eax]
test edx, edx
jg 0x10005a26
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xc]
movzx ecx, byte [ecx + eax]
mov dl, byte [ebx + esi]
xor dl, cl
inc ebx
mov byte [eax], dl
inc eax
and ebx, 7
cmp dword [ebp + 0xc], 0
mov dword [ebp + 0x14], eax
jne 0x10005980
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005a70
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100bf358]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ecx, ecx
mov eax, 1
push edi
lea ecx, [ecx]
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
lea esi, [eax + eax]
and edx, 0x1b
mov dword [ebp + ecx*4 - 0x804], eax
mov dword [ebp + eax*4 - 0x404], ecx
xor edx, esi
xor eax, edx
inc ecx
and eax, 0xff
cmp ecx, 0x100
jl 0x10005a90
mov eax, 1
mov ecx, 0x100c2800
lea esp, [esp]
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
mov dword [ecx], eax
add eax, eax
and edx, 0x1b
xor eax, edx
add ecx, 4
and eax, 0xff
cmp ecx, 0x100c2828
jl 0x10005ad0
mov byte [0x100c1f00], 0x63
mov byte [0x100c408b], 0
mov ebx, 1
jmp 0x10005b10
mov ecx, dword [ebp + ebx*4 - 0x404]
add ecx, ecx
add ecx, ecx
lea edx, [ebp - 0x408]
sub edx, ecx
mov eax, dword [edx]
mov ecx, eax
sar ecx, 7
lea edx, [eax + eax]
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
and edx, 0xff
xor eax, edx
mov ecx, edx
add edx, edx
sar ecx, 7
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
xor edx, 0x63
and edx, 0xff
xor eax, edx
mov byte [ebx + 0x100c1f00], al
mov byte [eax + 0x100c4028], bl
inc ebx
cmp ebx, 0x100
jl 0x10005b10
xor ecx, ecx
movzx esi, byte [ecx + 0x100c1f00]
mov edx, esi
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
and edx, 0x1b
lea eax, [esi + esi]
xor edx, eax
and edx, 0xff
mov eax, edx
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, edx
mov dword [ecx*4 + 0x100c3c28], eax
rol eax, 8
mov dword [ecx*4 + 0x100c3828], eax
rol eax, 8
mov dword [ecx*4 + 0x100c3428], eax
rol eax, 8
mov dword [ecx*4 + 0x100c3028], eax
movzx eax, byte [ecx + 0x100c4028]
test eax, eax
je 0x10005c52
mov esi, dword [ebp + eax*4 - 0x404]
mov edx, dword [ebp - 0x3cc]
lea eax, [esi + edx]
cdq
mov edi, 0xff
idiv edi
mov eax, dword [ebp + edx*4 - 0x804]
mov edx, dword [ebp - 0x3e0]
mov dword [ebp - 0x808], eax
lea eax, [esi + edx]
cdq
idiv edi
mov eax, dword [ebp - 0x3d0]
add eax, esi
mov ebx, dword [ebp + edx*4 - 0x804]
cdq
idiv edi
mov edi, dword [ebp + edx*4 - 0x804]
mov edx, dword [ebp - 0x3d8]
lea eax, [esi + edx]
cdq
mov esi, 0xff
idiv esi
mov eax, dword [ebp - 0x808]
mov edx, dword [ebp + edx*4 - 0x804]
jmp 0x10005c5a
xor eax, eax
xor ebx, ebx
xor edi, edi
xor edx, edx
shl edx, 8
xor edx, edi
shl edx, 8
xor edx, ebx
shl edx, 8
xor edx, eax
mov dword [ecx*4 + 0x100c2c28], edx
rol edx, 8
mov dword [ecx*4 + 0x100c2828], edx
rol edx, 8
mov dword [ecx*4 + 0x100c2400], edx
rol edx, 8
mov dword [ecx*4 + 0x100c2000], edx
inc ecx
cmp ecx, 0x100
jl 0x10005b84
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1009625b
mov esp, ebp
pop ebp
ret
Function at 0x10006230
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x100bf358]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
push 0x118
lea eax, [esp + 0x14]
push 0
push eax
mov edi, ecx
mov ebx, edx
call fcn.10096800
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x1c]
push ebx
lea esi, [edi + 8]
push ecx
mov dword [edi + 4], esi
call fcn.10005cb0
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x10006423
mov eax, dword [esp + 0x10]
mov dword [edi], eax
shl eax, 4
add eax, dword [esp + 0x14]
add esi, 0x10
mov edx, dword [eax]
mov dword [esi - 0x10], edx
mov ecx, dword [eax + 4]
mov dword [esi - 0xc], ecx
mov edx, dword [eax + 8]
mov dword [esi - 8], edx
mov ecx, dword [eax + 0xc]
mov dword [esi - 4], ecx
mov ecx, dword [edi]
dec ecx
sub eax, 0x10
test ecx, ecx
jle 0x1000640d
jmp 0x100062c0
movzx edx, byte [eax + 3]
movzx edx, byte [edx + 0x100c1f00]
mov edx, dword [edx*4 + 0x100c2000]
movzx edi, byte [eax + 2]
movzx edi, byte [edi + 0x100c1f00]
xor edx, dword [edi*4 + 0x100c2400]
movzx edi, byte [eax + 1]
movzx edi, byte [edi + 0x100c1f00]
xor edx, dword [edi*4 + 0x100c2828]
mov edi, dword [eax]
and edi, 0xff
movzx edi, byte [edi + 0x100c1f00]
xor edx, dword [edi*4 + 0x100c2c28]
dec ecx
mov dword [esi], edx
mov edx, dword [eax + 4]
movzx edi, byte [eax + 7]
movzx edi, byte [edi + 0x100c1f00]
and edx, 0xff
movzx edx, byte [edx + 0x100c1f00]
mov edx, dword [edx*4 + 0x100c2c28]
xor edx, dword [edi*4 + 0x100c2000]
movzx edi, byte [eax + 6]
movzx edi, byte [edi + 0x100c1f00]
xor edx, dword [edi*4 + 0x100c2400]
movzx edi, byte [eax + 5]
movzx edi, byte [edi + 0x100c1f00]
xor edx, dword [edi*4 + 0x100c2828]
add esi, 0x10
mov dword [esi - 0xc], edx
mov edx, dword [eax + 8]
movzx edi, byte [eax + 0xb]
movzx edi, byte [edi + 0x100c1f00]
and edx, 0xff
movzx edx, byte [edx + 0x100c1f00]
mov edx, dword [edx*4 + 0x100c2c28]
xor edx, dword [edi*4 + 0x100c2000]
movzx edi, byte [eax + 0xa]
movzx edi, byte [edi + 0x100c1f00]
xor edx, dword [edi*4 + 0x100c2400]
movzx edi, byte [eax + 9]
movzx edi, byte [edi + 0x100c1f00]
xor edx, dword [edi*4 + 0x100c2828]
sub eax, 0x10
mov dword [esi - 8], edx
mov edx, dword [eax + 0x1c]
movzx edi, byte [eax + 0x1f]
movzx edi, byte [edi + 0x100c1f00]
and edx, 0xff
movzx edx, byte [edx + 0x100c1f00]
mov edx, dword [edx*4 + 0x100c2c28]
xor edx, dword [edi*4 + 0x100c2000]
movzx edi, byte [eax + 0x1e]
movzx edi, byte [edi + 0x100c1f00]
xor edx, dword [edi*4 + 0x100c2400]
movzx edi, byte [eax + 0x1d]
movzx edi, byte [edi + 0x100c1f00]
xor edx, dword [edi*4 + 0x100c2828]
mov dword [esi - 4], edx
test ecx, ecx
jg 0x100062c0
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
mov ecx, dword [fcn.10096800]
push 0x118
lea eax, [esp + 0x14]
push 0
push eax
call ecx
mov ecx, dword [esp + 0x138]
add esp, 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.1009625b
mov esp, ebp
pop ebp
ret