joyce8/EMBER2024-capa huggingface dataset:
Function at 0x542840
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x54291f
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x5428b5
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00542000
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x54287f
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x5429d6
call 0x5428c7
pop edx
lea ecx, [edx + 0x139]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x542977
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00542420
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x54292c
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x5429d6
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.00542420
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x5429d4
jmp 0x5429d6
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x543810
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
mov eax, dword [eax]
mov dword [esp + 0x14], eax
xor ecx, ecx
mov cl, byte [edx]
shl ecx, 0x18
xor eax, eax
mov al, byte [edx + 1]
shl eax, 0x10
or ecx, eax
xor eax, eax
mov al, byte [edx + 3]
or ecx, eax
xor eax, eax
mov al, byte [edx + 2]
shl eax, 8
or ecx, eax
xor eax, eax
mov al, byte [edx + 4]
shl eax, 0x18
mov bl, byte [edx + 5]
and ebx, 0xff
mov ebp, ebx
shl ebp, 0x10
or eax, ebp
mov bl, byte [edx + 7]
and ebx, 0xff
or eax, ebx
mov bl, byte [edx + 6]
and ebx, 0xff
mov ebp, ebx
shl ebp, 8
or eax, ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], eax
mov ebp, ecx
shr ebp, 0x18
mov ebx, ebp
mov byte [esp + 0x28], bl
mov ebp, ecx
shr ebp, 0x10
mov ebx, ebp
mov byte [esp + 0x29], bl
mov ebp, ecx
shr ebp, 8
mov ebx, ebp
mov byte [esp + 0x2a], bl
mov byte [esp + 0x2b], cl
mov ecx, eax
shr ecx, 0x18
mov byte [esp + 0x2c], cl
mov ecx, eax
shr ecx, 0x10
mov byte [esp + 0x2d], cl
mov ecx, eax
shr ecx, 8
mov byte [esp + 0x2e], cl
mov byte [esp + 0x2f], al
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x5439c3
mov ebp, dword [esp + 0x58]
mov dword [esp + 0x18], 0
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x1c], edx
jmp 0x543901
mov dl, byte [esp + ebx + 0x28]
xor dl, byte [esi]
mov byte [edi], dl
inc edi
inc esi
inc ebx
and ebx, 7
dec ebp
je 0x543970
test ebx, ebx
jne 0x5438f0
mov eax, dword [esp + 0x5c]
mov dword [esp + 4], eax
lea edx, [esp + 0x20]
mov dword [esp], edx
call fcn.00543bf0
mov edx, dword [esp + 0x20]
mov ecx, edx
shr ecx, 0x18
mov byte [esp + 0x28], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esp + 0x29], cl
mov ecx, edx
shr ecx, 8
mov byte [esp + 0x2a], cl
mov byte [esp + 0x2b], dl
mov edx, dword [esp + 0x24]
mov ecx, edx
shr ecx, 0x18
mov byte [esp + 0x2c], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esp + 0x2d], cl
mov ecx, edx
shr ecx, 8
mov byte [esp + 0x2e], cl
mov byte [esp + 0x2f], dl
inc dword [esp + 0x18]
jmp 0x5438f0
mov dword [esp + 0x14], ebx
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x5439c3
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov esi, ecx
shr esi, 0x18
mov ebx, esi
mov byte [edx], bl
mov esi, ecx
shr esi, 0x10
mov ebx, esi
mov byte [edx + 1], bl
mov esi, ecx
shr esi, 8
mov ebx, esi
mov byte [edx + 2], bl
mov byte [edx + 3], cl
mov ecx, eax
shr ecx, 0x18
mov byte [edx + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [edx + 5], cl
mov ecx, eax
shr ecx, 8
mov byte [edx + 6], cl
mov byte [edx + 7], al
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
mov dword [eax], edx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x558990
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
test edi, edi
je 0x558a21
test ebx, ebx
je 0x558a40
test esi, esi
je 0x558a30
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], esi
lea ebp, [esp + 0x14]
mov dword [esp + 4], ebp
mov eax, dword [ebx + 8]
mov dword [esp], eax
call fcn.004ce9e0
test eax, eax
je 0x5589f0
mov eax, dword [eax + 8]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, 0x610a68
mov ecx, 4
repe cmpsb byte [esi], byte es:[edi]
je 0x558a50
mov dword [esp + 0x14], str.default
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov dword [esp + 4], ebp
mov eax, dword [ebx + 8]
mov dword [esp], eax
call fcn.004ce9e0
test eax, eax
jne 0x5589d6
xor eax, eax
jmp 0x5589d9
lea ebp, [esp + 0x14]
jmp 0x5589fe
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
jmp 0x5589d9
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x5589d9
jmp 0x5589fe
Function at 0x55bc30
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xcc
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], ecx
test ecx, ecx
je 0x55be0d
mov ebx, eax
mov esi, edx
mov al, byte [eax + 0xc]
mov byte [esp + 0x1f], al
mov dl, byte [ebx + 0x14]
mov byte [esp + 0x18], dl
lea ecx, [ebx + 0xc]
mov dword [esp + 0x20], ecx
lea edi, [esp + 0x40]
lea eax, [ebx + 0x14]
mov dword [esp + 0x24], eax
nop
xor ecx, ecx
mov cl, byte [esi]
xor edx, edx
mov dl, byte [esi + 1]
shl edx, 8
xor eax, eax
mov al, byte [esi + 2]
shl eax, 0x10
or edx, eax
or edx, ecx
xor eax, eax
mov al, byte [esi + 3]
shl eax, 0x18
or edx, eax
mov dword [esp + 0x38], edx
mov dword [esp + 0x30], edx
xor ecx, ecx
mov cl, byte [esi + 4]
mov al, byte [esi + 5]
and eax, 0xff
mov ebp, eax
shl ebp, 8
xor eax, eax
mov al, byte [esi + 6]
shl eax, 0x10
or ebp, eax
or ebp, ecx
xor eax, eax
mov al, byte [esi + 7]
shl eax, 0x18
or ebp, eax
add esi, 8
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x34], ebp
mov al, byte [esp + 0x1f]
and eax, 0xffffff9f
or eax, 0x40
mov byte [ebx + 0xc], al
mov al, byte [esp + 0x18]
and eax, 0xffffff9f
or eax, 0x20
mov byte [ebx + 0x14], al
mov ecx, dword [esp + 0x20]
mov dword [esp], ecx
mov dword [esp + 0x14], edx
call fcn.0052eac0
mov dword [esp + 4], edi
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call fcn.0052edf0
mov dword [esp + 8], 1
mov dword [esp + 4], edi
lea ecx, [esp + 0x30]
mov dword [esp], ecx
call fcn.005315c0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.0052eac0
mov dword [esp + 4], edi
mov ecx, dword [esp + 0x24]
mov dword [esp], ecx
call fcn.0052edf0
mov dword [esp + 8], 1
mov dword [esp + 4], edi
lea eax, [esp + 0x38]
mov dword [esp], eax
call fcn.005315c0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x38]
xor eax, edx
mov ecx, dword [esp + 0x3c]
xor ecx, ebp
mov dword [esp + 0x18], ecx
xor edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
xor ecx, ebp
mov dword [esp + 0x10], ecx
mov byte [esp + 0x1f], dl
mov byte [ebx + 0xc], dl
mov ebp, edx
shr ebp, 8
mov ecx, ebp
mov byte [ebx + 0xd], cl
mov ebp, edx
shr ebp, 0x10
mov ecx, ebp
mov byte [ebx + 0xe], cl
shr edx, 0x18
mov byte [ebx + 0xf], dl
mov dl, byte [esp + 0x18]
mov byte [ebx + 0x10], dl
mov edx, dword [esp + 0x18]
shr edx, 8
mov byte [ebx + 0x11], dl
mov edx, dword [esp + 0x18]
shr edx, 0x10
mov byte [ebx + 0x12], dl
mov edx, dword [esp + 0x18]
shr edx, 0x18
mov byte [ebx + 0x13], dl
mov byte [esp + 0x18], al
mov byte [ebx + 0x14], al
mov edx, eax
shr edx, 8
mov byte [ebx + 0x15], dl
mov edx, eax
shr edx, 0x10
mov byte [ebx + 0x16], dl
shr eax, 0x18
mov byte [ebx + 0x17], al
mov cl, byte [esp + 0x10]
mov byte [ebx + 0x18], cl
mov eax, dword [esp + 0x10]
shr eax, 8
mov byte [ebx + 0x19], al
mov eax, dword [esp + 0x10]
shr eax, 0x10
mov byte [ebx + 0x1a], al
mov ecx, dword [esp + 0x10]
shr ecx, 0x18
mov byte [ebx + 0x1b], cl
mov eax, esi
sub eax, dword [esp + 0x2c]
cmp dword [esp + 0x28], eax
ja 0x55bc70
add esp, 0xcc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x55f7a0
Capabilities:
Check for software breakpoints

Disassembly:
push edi
push esi
sub esp, 0x24
mov esi, dword [esp + 0x38]
mov eax, dword [esp + 0x40]
cmp eax, dword [esp + 0x3c]
jne 0x55f8b0
mov dl, byte [esi]
lea ecx, [edx - 0x6a]
cmp cl, 1
ja 0x55f8b0
cmp dl, 0x6b
je 0x55f860
inc esi
sub eax, 2
cmp byte [esi + eax], 0xcc
jne 0x55f930
mov edx, eax
mov edi, dword [esp + 0x30]
cmp eax, 4
jae 0x55f830
xor ecx, ecx
test dl, 2
jne 0x55f810
and edx, 1
jne 0x55f800
add esp, 0x24
pop esi
pop edi
ret
mov dl, byte [esi + ecx]
mov byte [edi + ecx], dl
add esp, 0x24
pop esi
pop edi
ret
mov cx, word [esi]
mov word [edi], cx
mov ecx, 2
and edx, 1
je 0x55f7f3
jmp 0x55f800
test edi, 1
jne 0x55f990
test edi, 2
jne 0x55f970
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
test dl, 2
je 0x55f7ee
jmp 0x55f810
sub eax, 3
test eax, eax
jle 0x55f89c
mov dl, byte [esi + 1]
add esi, 2
cmp dl, 0xba
je 0x55f89c
cmp dl, 0xbb
jne 0x55f8f0
xor edx, edx
jmp 0x55f88d
mov cl, byte [esi]
inc esi
cmp cl, 0xba
je 0x55f892
cmp cl, 0xbb
jne 0x55f8f0
inc edx
cmp eax, edx
jne 0x55f880
sub eax, edx
test edx, edx
jne 0x55f7d2
mov dword [esp + 0x10], 0x8a
jmp 0x55f8f8
mov dword [esp + 0x10], 0x72
mov dword [esp + 0xc], 0x611bc0
mov dword [esp + 8], 0x89
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 4
call fcn.004b26a0
mov eax, 0xffffffff
add esp, 0x24
pop esi
pop edi
ret
mov dword [esp + 0x10], 0x81
mov dword [esp + 0xc], 0x611bc0
mov dword [esp + 8], 0x8a
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 4
call fcn.004b26a0
mov eax, 0xffffffff
jmp 0x55f7f3
mov dword [esp + 0x10], 0x93
mov dword [esp + 0xc], 0x611bc0
mov dword [esp + 8], 0x8b
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 4
call fcn.004b26a0
mov eax, 0xffffffff
jmp 0x55f7f3
mov cx, word [esi]
mov word [edi], cx
add edi, 2
add esi, 2
sub edx, 2
jmp 0x55f848
mov dl, byte [esi]
mov byte [edi], dl
inc edi
inc esi
lea edx, [eax - 1]
jmp 0x55f83c
Function at 0x56da10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebp, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
mov ebx, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
mov esi, dword [edx]
test esi, esi
jne 0x56da51
jmp 0x56da70
mov dl, byte [ebx + esi]
xor dl, byte [ebp]
mov byte [eax], dl
inc eax
inc ebp
dec ecx
inc esi
and esi, 0xf
je 0x56da70
test ecx, ecx
jne 0x56da40
mov eax, dword [esp + 0x64]
mov dword [eax], esi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ecx, 0xf
jbe 0x56dc24
mov edi, eax
mov esi, ebp
mov dword [esp + 0x24], ebp
mov ebp, ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov eax, ebx
mov ebx, esi
mov esi, eax
jmp 0x56daa0
mov eax, dword [esp + 0x5c]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], esi
mov edx, dword [esp + 0x68]
call edx
mov ecx, dword [ebx]
xor ecx, dword [esi]
mov dword [edi], ecx
mov ecx, dword [ebx + 4]
xor ecx, dword [esi + 4]
mov dword [edi + 4], ecx
mov ecx, dword [ebx + 8]
xor ecx, dword [esi + 8]
mov dword [edi + 8], ecx
mov ecx, dword [ebx + 0xc]
xor ecx, dword [esi + 0xc]
mov dword [edi + 0xc], ecx
sub ebp, 0x10
add edi, 0x10
add ebx, 0x10
cmp ebp, 0xf
ja 0x56daa0
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov ebx, esi
mov edx, ecx
and edx, 0xf
mov dword [esp + 0x24], edx
sub ecx, 0x10
and ecx, 0xfffffff0
lea edx, [ecx + 0x10]
add eax, edx
add ebp, edx
mov edx, dword [esp + 0x24]
test edx, edx
je 0x56dc10
mov edx, dword [esp + 0x5c]
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], ebx
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x68]
call edx
mov edx, dword [esp + 0x24]
dec edx
mov dword [esp + 0x20], edx
mov edx, ebx
or edx, ebp
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x18]
lea edi, [eax + 4]
mov esi, dword [esp + 0x24]
shr esi, 2
lea ecx, [esi*4]
cmp ebp, edi
setae byte [esp + 0x1f]
lea edx, [ebp + 4]
cmp eax, edx
setae dl
or byte [esp + 0x1f], dl
cmp ebx, edi
setae byte [esp + 0x2c]
lea edi, [ebx + 4]
cmp eax, edi
setae dl
or byte [esp + 0x2c], dl
mov dl, byte [esp + 0x2c]
and byte [esp + 0x1f], dl
cmp dword [esp + 0x24], 6
seta dl
and byte [esp + 0x1f], dl
or dword [esp + 0x28], eax
test byte [esp + 0x28], 3
sete dl
test byte [esp + 0x1f], dl
je 0x56dc20
test ecx, ecx
je 0x56dc20
xor edx, edx
lea esi, [esi]
mov edi, dword [ebx + edx*4]
xor edi, dword [ebp + edx*4]
mov dword [eax + edx*4], edi
inc edx
cmp esi, edx
ja 0x56dbb0
sub dword [esp + 0x20], ecx
cmp dword [esp + 0x24], ecx
je 0x56dbef
mov edx, dword [esp + 0x20]
lea esi, [ecx + edx + 1]
jmp 0x56dbe0
mov dl, byte [ebx + ecx]
xor dl, byte [ebp + ecx]
mov byte [eax + ecx], dl
inc ecx
cmp ecx, esi
jne 0x56dbe0
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x64]
mov dword [eax], esi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
xor esi, esi
mov eax, dword [esp + 0x64]
mov dword [eax], esi
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
xor ecx, ecx
jmp 0x56dbc9
mov dword [esp + 0x24], ecx
jmp 0x56db08
Function at 0x56f640
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x10c
mov esi, dword [esp + 0x120]
mov eax, dword [esp + 0x128]
mov edx, dword [esp + 0x12c]
cmp edx, 0x10
je 0x56f676
cmp edx, 0xc
je 0x56f854
cmp edx, 8
je 0x56f861
mov dword [esp + 8], 0x22
mov edx, 0x10
mov dword [esi], edx
cmp dword [esp + 0x124], 7
jle 0x56f8ad
lea ecx, [esp + 0xc]
mov edx, dword [esp + 0x124]
sub edx, 8
shr edx, 3
inc edx
mov dword [esp + 4], edx
lea edi, [eax + edx*8]
lea esi, [esi]
mov dl, byte [eax]
and edx, 0xff
mov ebp, edx
xor edx, edx
mov dl, byte [eax + 1]
shl edx, 8
xor ebx, ebx
mov bl, byte [eax + 2]
shl ebx, 0x10
or edx, ebx
or edx, ebp
xor ebx, ebx
mov bl, byte [eax + 3]
shl ebx, 0x18
or edx, ebx
mov dword [ecx], edx
mov bl, byte [eax + 4]
and ebx, 0xff
mov ebp, ebx
xor edx, edx
mov dl, byte [eax + 5]
shl edx, 8
xor ebx, ebx
mov bl, byte [eax + 6]
shl ebx, 0x10
or edx, ebx
or edx, ebp
xor ebx, ebx
mov bl, byte [eax + 7]
shl ebx, 0x18
or edx, ebx
add eax, 8
mov dword [ecx + 4], edx
add ecx, 8
cmp edi, eax
jne 0x56f6b0
mov edx, dword [esp + 4]
add edx, edx
mov eax, dword [esp + 4]
shl eax, 3
cmp eax, dword [esp + 0x124]
je case.default.0x56f732
mov eax, dword [esp + 0x124]
and eax, 7
add edi, eax
jmp dword [eax*4 + 0x612120]
lea eax, [edi - 1]
xor ebx, ebx
mov bl, byte [edi - 1]
shl ebx, 0x18
lea edi, [eax - 1]
mov al, byte [eax - 1]
and eax, 0xff
shl eax, 0x10
or eax, ebx
lea ebp, [edi - 1]
mov bl, byte [edi - 1]
and ebx, 0xff
mov edi, ebx
shl edi, 8
or edi, eax
xor eax, eax
mov al, byte [ebp - 1]
or eax, edi
mov dword [esp + edx*4 + 0xc], eax
mov dword [esp + edx*4 + 0x10], ecx
mov eax, dword [esp + 0x124]
add eax, 3
js 0x56f845
sar eax, 2
mov dword [esp], eax
mov dword [esi + 4], 0xb7e15163
mov edx, 0x5618cb1c
mov eax, 1
mov ecx, dword [esp + 8]
lea esi, [esi]
lea edi, [edi]
mov dword [esi + eax*4 + 4], edx
inc eax
sub edx, 0x61c88647
cmp eax, ecx
jl 0x56f7d0
mov eax, dword [esp + 8]
mov edx, dword [esp]
cmp eax, edx
jge 0x56f7ec
mov eax, edx
lea eax, [eax + eax*2]
mov dword [esp + 4], eax
xor ebx, ebx
xor edx, edx
xor ebp, ebp
xor edi, edi
xor eax, eax
lea esi, [esi]
mov ecx, dword [esi + edx*4 + 4]
add ecx, edi
add eax, ecx
mov ecx, 3
rol eax, cl
mov dword [esi + edx*4 + 4], eax
lea ecx, [eax + edi]
mov edi, dword [esp + ebx*4 + 0xc]
add edi, ecx
rol edi, cl
mov dword [esp + ebx*4 + 0xc], edi
inc edx
cmp edx, dword [esp + 8]
jl 0x56f82b
xor edx, edx
inc ebx
cmp dword [esp], ebx
jg 0x56f833
xor ebx, ebx
inc ebp
cmp dword [esp + 4], ebp
jg 0x56f800
add esp, 0x10c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x124]
add eax, 6
jmp 0x56f7aa
mov dword [esp + 8], 0x1a
jmp 0x56f683
mov dword [esp + 8], 0x12
jmp 0x56f683
xor ecx, ecx
jmp 0x56f75d
xor ecx, ecx
xor eax, eax
jmp 0x56f792
mov ebp, edi
xor ecx, ecx
xor edi, edi
jmp 0x56f78b
xor ecx, ecx
xor eax, eax
jmp 0x56f778
mov eax, edi
xor ecx, ecx
xor ebx, ebx
jmp 0x56f768
mov edi, eax
xor edx, edx
xor eax, eax
jmp 0x56f71d
Function at 0x56f8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov edx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
mov ebx, dword [eax]
mov cl, byte [edx]
and ecx, 0xff
mov ebp, ecx
xor eax, eax
mov al, byte [edx + 1]
shl eax, 8
xor ecx, ecx
mov cl, byte [edx + 2]
shl ecx, 0x10
or eax, ecx
or eax, ebp
xor ecx, ecx
mov cl, byte [edx + 3]
shl ecx, 0x18
or eax, ecx
xor ecx, ecx
mov cl, byte [edx + 4]
mov dword [esp + 0x1c], ecx
mov cl, byte [edx + 5]
and ecx, 0xff
mov ebp, ecx
shl ebp, 8
xor ecx, ecx
mov cl, byte [edx + 6]
shl ecx, 0x10
or ebp, ecx
or ebp, dword [esp + 0x1c]
xor ecx, ecx
mov cl, byte [edx + 7]
shl ecx, 0x18
or ebp, ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebp
mov byte [esp + 0x28], al
mov ecx, eax
shr ecx, 8
mov byte [esp + 0x29], cl
mov ecx, eax
shr ecx, 0x10
mov byte [esp + 0x2a], cl
shr eax, 0x18
mov byte [esp + 0x2b], al
mov eax, ebp
mov byte [esp + 0x2c], al
mov eax, ebp
shr eax, 8
mov byte [esp + 0x2d], al
mov eax, ebp
shr eax, 0x10
mov byte [esp + 0x2e], al
mov eax, ebp
shr eax, 0x18
mov byte [esp + 0x2f], al
mov ecx, dword [esp + 0x58]
test ecx, ecx
je 0x56fa6d
mov ebp, dword [esp + 0x58]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], edx
jmp 0x56f9b1
mov dl, byte [esp + ebx + 0x28]
xor dl, byte [esi]
mov byte [edi], dl
inc edi
inc esi
inc ebx
and ebx, 7
dec ebp
je 0x56fa20
test ebx, ebx
jne 0x56f9a0
mov ecx, dword [esp + 0x5c]
mov dword [esp + 4], ecx
lea eax, [esp + 0x20]
mov dword [esp], eax
call fcn.0056fc80
mov edx, dword [esp + 0x20]
mov byte [esp + 0x28], dl
mov ecx, edx
shr ecx, 8
mov byte [esp + 0x29], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esp + 0x2a], cl
shr edx, 0x18
mov byte [esp + 0x2b], dl
mov edx, dword [esp + 0x24]
mov byte [esp + 0x2c], dl
mov ecx, edx
shr ecx, 8
mov byte [esp + 0x2d], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esp + 0x2e], cl
shr edx, 0x18
mov byte [esp + 0x2f], dl
inc dword [esp + 0x18]
jmp 0x56f9a0
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x56fa6d
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov byte [edx], cl
mov esi, ecx
shr esi, 8
mov eax, esi
mov byte [edx + 1], al
mov esi, ecx
shr esi, 0x10
mov eax, esi
mov byte [edx + 2], al
shr ecx, 0x18
mov byte [edx + 3], cl
mov ecx, edi
mov byte [edx + 4], cl
mov ecx, edi
shr ecx, 8
mov byte [edx + 5], cl
mov ecx, edi
shr ecx, 0x10
mov byte [edx + 6], cl
mov eax, edi
shr eax, 0x18
mov byte [edx + 7], al
mov eax, dword [esp + 0x64]
mov dword [eax], ebx
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x56ffc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x57008f
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x57002d
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0056fc80
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x56ffff
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x570136
call 0x57003f
pop edx
lea ecx, [edx + 0x141]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x5700df
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0056fe20
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x57009c
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x570136
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.0056fe20
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x570134
jmp 0x570136
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x57f7b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [ebx + 4]
mov eax, dword [ecx + 4]
cmp edx, eax
jl 0x57f860
mov esi, eax
mov eax, edx
mov edx, esi
mov esi, ecx
mov ecx, dword [esp + 0x30]
cmp dword [ecx + 8], eax
jl 0x57f871
test edx, edx
jle 0x57f89d
mov edx, dword [esp + 0x30]
mov ebp, dword [edx]
mov edi, dword [ebx]
mov ecx, dword [esi]
xor eax, eax
lea esi, [esi]
lea edi, [edi]
mov edx, dword [ecx + eax*4]
xor edx, dword [edi + eax*4]
mov dword [ebp + eax*4], edx
inc eax
cmp dword [esi + 4], eax
jg 0x57f800
mov edx, dword [ebx + 4]
cmp eax, edx
jge 0x57f82e
mov ecx, dword [esp + 0x30]
mov esi, dword [ecx]
mov ecx, dword [ebx]
nop
mov edx, dword [ecx + eax*4]
mov dword [esi + eax*4], edx
inc eax
mov edx, dword [ebx + 4]
cmp edx, eax
jg 0x57f820
mov ecx, dword [esp + 0x30]
mov dword [ecx + 4], edx
test edx, edx
jle 0x57f890
mov eax, dword [ecx]
sub eax, 4
nop
mov ebx, dword [eax + edx*4]
test ebx, ebx
jne 0x57f84a
dec edx
jne 0x57f840
mov ecx, dword [esp + 0x30]
mov dword [ecx + 4], edx
mov eax, 1
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, ebx
mov ebx, ecx
mov ecx, dword [esp + 0x30]
cmp dword [ecx + 8], eax
jge 0x57f7e2
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.004bd100
test eax, eax
jne 0x57f8a4
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 1
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x57f810
mov edx, dword [esi + 4]
jmp 0x57f7e2