joyce8/EMBER2024-capa huggingface dataset:
Function at 0x65856c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov byte [esp], cl
mov esi, edx
mov ebx, eax
lea edi, [esp + 1]
mov edx, edi
mov eax, esi
mov ecx, 8
call fcn.00407130
cmp byte [esp], 0
je 0x658610
mov eax, dword [ebx]
xor dword [esi], eax
mov eax, 1
movzx edx, byte [edi + 3]
mov edx, dword [ebx + edx*4 + 0x48]
movzx ecx, byte [edi + 2]
add edx, dword [ebx + ecx*4 + 0x448]
movzx ecx, byte [edi + 1]
xor edx, dword [ebx + ecx*4 + 0x848]
movzx ecx, byte [edi]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi + 4]
xor edx, ecx
mov dword [esi + 4], edx
movzx edx, byte [edi + 7]
mov edx, dword [ebx + edx*4 + 0x48]
movzx ecx, byte [edi + 6]
add edx, dword [ebx + ecx*4 + 0x448]
movzx ecx, byte [edi + 5]
xor edx, dword [ebx + ecx*4 + 0x848]
movzx ecx, byte [edi + 4]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4 + 4]
xor ecx, dword [esi]
xor edx, ecx
mov dword [esi], edx
add eax, 2
cmp eax, 0x10
jle 0x65859a
mov eax, dword [ebx + 0x44]
xor dword [esi + 4], eax
jmp 0x65868d
mov eax, dword [ebx + 0x44]
xor dword [esi + 4], eax
mov eax, 0x10
movzx edx, byte [edi + 7]
mov edx, dword [ebx + edx*4 + 0x48]
movzx ecx, byte [edi + 6]
add edx, dword [ebx + ecx*4 + 0x448]
movzx ecx, byte [edi + 5]
xor edx, dword [ebx + ecx*4 + 0x848]
movzx ecx, byte [edi + 4]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi]
xor edx, ecx
mov dword [esi], edx
movzx edx, byte [edi + 3]
mov edx, dword [ebx + edx*4 + 0x48]
movzx ecx, byte [edi + 2]
add edx, dword [ebx + ecx*4 + 0x448]
movzx ecx, byte [edi + 1]
xor edx, dword [ebx + ecx*4 + 0x848]
movzx ecx, byte [edi]
add edx, dword [ebx + ecx*4 + 0xc48]
mov ecx, dword [ebx + eax*4 - 4]
xor ecx, dword [esi + 4]
xor edx, ecx
mov dword [esi + 4], edx
sub eax, 2
cmp eax, 1
jge 0x65861b
mov eax, dword [ebx]
xor dword [esi], eax
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x658694
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov esi, eax
lea edi, [esp + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebp, edx
mov edx, ebp
mov eax, 0x6cc924
mov ecx, 0x48
call fcn.00407130
lea edx, [ebp + 0x48]
mov eax, 0x6cc96c
mov ecx, 0x1000
call fcn.00407130
xor edi, edi
mov esi, 0x12
mov dword [esp + 8], ebp
xor edx, edx
mov eax, 4
shl edx, 8
movzx ecx, byte [esp + edi + 0xc]
or edx, ecx
inc edi
cmp edi, 0x10
jl 0x6586ee
xor edi, edi
dec eax
jne 0x6586dc
mov eax, dword [esp + 8]
xor dword [eax], edx
add dword [esp + 8], 4
dec esi
jne 0x6586d5
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
xor esi, esi
mov edx, esp
mov eax, ebp
mov cl, 1
call fcn.0065856c
mov eax, dword [esp]
mov dword [ebp + esi*4], eax
mov eax, dword [esp + 4]
mov dword [ebp + esi*4 + 4], eax
add esi, 2
cmp esi, 0x11
jle 0x65870c
mov edi, 4
mov ebx, ebp
xor esi, esi
mov edx, esp
mov eax, ebp
mov cl, 1
call fcn.0065856c
mov eax, dword [esp]
mov dword [ebx + esi*4 + 0x48], eax
mov eax, dword [esp + 4]
mov dword [ebx + esi*4 + 0x4c], eax
add esi, 2
cmp esi, 0xff
jle 0x658737
add ebx, 0x400
dec edi
jne 0x658735
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x658770
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd0
mov dword [esp], edx
mov ebx, eax
lea edx, [esp + 0x20]
mov eax, dword [esp]
mov ecx, 0x10
call fcn.00407130
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
dec eax
test eax, eax
jl 0x6588cc
inc eax
mov dword [esp + 0x1c], eax
lea eax, [ebx + 8]
mov ebx, eax
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx]
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 4]
add edx, eax
add eax, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shr edi, 0x11
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 9
xor eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, eax
shr edi, 0xf
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 0xb
xor eax, edi
mov edi, edx
mov edx, esi
mov esi, edi
mov edi, ecx
mov ecx, eax
mov eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shr edi, 0x11
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 9
xor eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, eax
shr edi, 0xf
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 0xb
xor eax, edi
xor edx, dword [esp + 0x14]
xor ecx, edx
mov dword [esp + 4], ecx
xor esi, dword [esp + 0x18]
xor eax, esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
add ebx, 8
dec dword [esp + 0x1c]
jne 0x6587c2
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov edx, dword [esp]
lea eax, [esp + 0x20]
mov ecx, 0x10
call fcn.00407130
add esp, 0x30
pop edi
pop esi
pop ebx
ret
Function at 0x658904
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx edx, byte [ebp + 8]
mov byte [eax], dl
cmp ecx, 0x10
jle 0x65892b
mov eax, 0x10
jmp 0x65892d
mov eax, ecx
cmp eax, 4
jge 0x658937
mov eax, 4
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x24], str.UUUU
mov eax, dword [ebp - 4]
add eax, 8
mov edx, dword [ebp - 8]
mov ecx, dword [edx]
mov edx, dword [ebp - 0x24]
mov esi, dword [edx]
mov ebx, esi
mov edx, dword [ebp - 8]
mov edx, dword [edx + 4]
mov dword [ebp - 0xc], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 0xc]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], esi
mov esi, 8
mov edi, ebx
shl edi, 0xb
xor ecx, edi
add dword [ebp - 0xc], ecx
add ebx, edx
mov edi, edx
shr edi, 2
xor ebx, edi
add dword [ebp - 0x10], ebx
add edx, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
shl edi, 8
xor edx, edi
add dword [ebp - 0x14], edx
mov edi, dword [ebp - 0x10]
add dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
shr edi, 0x10
xor dword [ebp - 0xc], edi
mov edi, dword [ebp - 0xc]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x14]
add dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x14]
shl edi, 0xa
xor dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x10]
add dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x18]
add dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x18]
shr edi, 4
xor dword [ebp - 0x14], edi
add ecx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x1c]
shl edi, 8
xor dword [ebp - 0x18], edi
add ebx, dword [ebp - 0x18]
add dword [ebp - 0x1c], ecx
mov edi, ecx
shr edi, 9
xor dword [ebp - 0x1c], edi
add edx, dword [ebp - 0x1c]
add ecx, ebx
dec esi
jne 0x658983
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov dword [eax + 8], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x14], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x1c], edx
add eax, 0x20
add dword [ebp - 0x24], 4
dec dword [ebp - 0x20]
jne 0x658951
cmp byte [ebp + 8], 0
jne 0x658ab2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x658a87
inc eax
mov dword [ebp - 0x20], 0
mov ebx, dword [ebp - 4]
add ebx, 8
mov edx, dword [ebp - 4]
mov edx, dword [edx + 4]
dec edx
sub edx, dword [ebp - 0x20]
mov ecx, dword [ebx]
mov dword [ebp + edx*8 - 0xa4], ecx
mov ecx, dword [ebx + 4]
mov dword [ebp + edx*8 - 0xa0], ecx
inc dword [ebp - 0x20]
add ebx, 8
dec eax
jne 0x658a61
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x658ab2
inc eax
lea ebx, [ebp - 0xa4]
mov edx, dword [ebp - 4]
add edx, 8
mov ecx, dword [ebx]
mov dword [edx], ecx
mov ecx, dword [ebx + 4]
mov dword [edx + 4], ecx
add edx, 8
add ebx, 8
dec eax
jne 0x658a9f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x658c2c
Capabilities:
Hash data with md5

Disassembly:
push ebx
add esp, 0xffffffa8
mov ebx, eax
mov edx, esp
mov eax, ebx
mov ecx, 0x58
call fcn.00407130
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
mov edx, ebx
mov eax, esp
mov ecx, 0x58
call fcn.00407130
add esp, 0x58
pop ebx
ret

Function at 0x659010
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x14], edx
mov edx, eax
mov eax, dword [ebp - 0x14]
mov ecx, 0x10
call fcn.00659e34
xor esi, esi
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
test bl, bl
jne 0x6590eb
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x6ceba4]
movzx edi, byte [eax + 1]
xor ecx, dword [edi*4 + 0x6cefa4]
movzx edi, byte [eax + 2]
xor ecx, dword [edi*4 + 0x6cf3a4]
movzx edi, byte [eax + 3]
xor ecx, dword [edi*4 + 0x6cf7a4]
mov dword [ebp - 0x18], ecx
movzx ecx, byte [ebp - 0x18]
movzx ecx, byte [ecx + 0x6cda6c]
lea edi, [esi]
and edi, 0x80000003
jns 0x659085
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0x10], cl
movzx ecx, byte [ebp - 0x17]
movzx ecx, byte [ecx + 0x6cda6c]
lea edi, [esi + 1]
and edi, 0x80000003
jns 0x6590a4
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xf], cl
movzx ecx, byte [ebp - 0x16]
movzx ecx, byte [ecx + 0x6cda6c]
lea edi, [esi + 2]
and edi, 0x80000003
jns 0x6590c3
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xe], cl
movzx ecx, byte [ebp - 0x15]
movzx ecx, byte [ecx + 0x6cda6c]
lea edi, [esi + 3]
and edi, 0x80000003
jns 0x6590e2
dec edi
or edi, 0xfffffffc
inc edi
mov byte [ebp + edi*4 - 0xd], cl
jmp 0x659170
lea ecx, [esi]
and ecx, 0x80000003
jns 0x6590fa
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4]
movzx ecx, byte [ecx + 0x6cda6c]
mov byte [edx], cl
lea ecx, [esi + 3]
and ecx, 0x80000003
jns 0x65911a
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 1]
movzx ecx, byte [ecx + 0x6cda6c]
mov byte [edx + 1], cl
lea ecx, [esi + 2]
and ecx, 0x80000003
jns 0x65913c
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 2]
movzx ecx, byte [ecx + 0x6cda6c]
mov byte [edx + 2], cl
lea ecx, [esi + 1]
and ecx, 0x80000003
jns 0x65915e
dec ecx
or ecx, 0xfffffffc
inc ecx
mov edi, dword [ebp - 0x14]
movzx ecx, byte [edi + ecx*4 + 3]
movzx ecx, byte [ecx + 0x6cda6c]
mov byte [edx + 3], cl
inc esi
add edx, 4
add eax, 4
cmp esi, 4
jne 0x659035
mov edi, dword [ebp - 0x14]
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6591e4
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov byte [ebp - 0x11], cl
mov ebx, edx
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [ebp - 0x10]
cmp byte [ebp - 0x11], 0
jne 0x659272
lea ecx, [eax]
and ecx, 0x80000003
jns 0x65920f
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4]
mov ecx, dword [ecx*4 + 0x6cdba4]
lea esi, [eax + 1]
and esi, 0x80000003
jns 0x65922a
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 1]
xor ecx, dword [esi*4 + 0x6cdfa4]
lea esi, [eax + 2]
and esi, 0x80000003
jns 0x659246
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 2]
xor ecx, dword [esi*4 + 0x6ce3a4]
lea esi, [eax + 3]
and esi, 0x80000003
jns 0x659262
dec esi
or esi, 0xfffffffc
inc esi
movzx esi, byte [ebx + esi*4 + 3]
xor ecx, dword [esi*4 + 0x6ce7a4]
mov dword [edx], ecx
jmp 0x6592eb
lea ecx, [eax]
and ecx, 0x80000003
jns 0x659281
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4]
movzx ecx, byte [ecx + 0x6cd96c]
mov byte [edx], cl
lea ecx, [eax + 1]
and ecx, 0x80000003
jns 0x65929e
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 1]
movzx ecx, byte [ecx + 0x6cd96c]
mov byte [edx + 1], cl
lea ecx, [eax + 2]
and ecx, 0x80000003
jns 0x6592bd
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 2]
movzx ecx, byte [ecx + 0x6cd96c]
mov byte [edx + 2], cl
lea ecx, [eax + 3]
and ecx, 0x80000003
jns 0x6592dc
dec ecx
or ecx, 0xfffffffc
inc ecx
movzx ecx, byte [ebx + ecx*4 + 3]
movzx ecx, byte [ecx + 0x6cd96c]
mov byte [edx + 3], cl
inc eax
add edx, 4
cmp eax, 4
jne 0x6591fa
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov ecx, 0x10
call fcn.00659e34
mov edi, ebx
lea esi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x659318
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
movzx eax, byte [esp]
movzx eax, byte [eax + 0x6cd96c]
mov byte [esp + 4], al
movzx eax, byte [esp + 1]
movzx eax, byte [eax + 0x6cd96c]
mov byte [esp + 5], al
movzx eax, byte [esp + 2]
movzx eax, byte [eax + 0x6cd96c]
mov byte [esp + 6], al
movzx eax, byte [esp + 3]
movzx eax, byte [eax + 0x6cd96c]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
pop ecx
pop edx
ret

Function at 0x659464
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffee8
mov ebx, eax
mov edx, esp
mov eax, ebx
mov ecx, 0x118
call fcn.00407130
xor eax, eax
mov dword [esp], eax
mov esi, 0x6cc814
lea edi, [esp + 4]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], 0x55555555
mov dword [esp + 0x10c], 0x55555555
mov dword [esp + 0x110], 0x55555555
mov dword [esp + 0x114], 0x55555555
mov edx, ebx
mov eax, esp
mov ecx, 0x118
call fcn.00407130
add esp, 0x118
pop edi
pop esi
pop ebx
ret
Function at 0x6594e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffee0
mov edi, ecx
mov ebx, edx
mov dword [esp], eax
lea edx, [esp + 8]
mov eax, dword [esp]
mov ecx, 0x118
call fcn.00407130
dec edi
test edi, edi
jl 0x659600
inc edi
mov dword [esp + 4], edi
mov esi, ebx
movzx eax, byte [esi]
mov edx, dword [esp + 8]
xor byte [esp + edx + 0xc], al
inc dword [esp + 8]
cmp dword [esp + 8], 0x100
jne 0x659531
xor edx, edx
mov dword [esp + 8], edx
mov edx, dword [esp + 0x10c]
xor byte [esp + edx + 0x110], al
inc dword [esp + 0x10c]
cmp dword [esp + 0x10c], 8
jne 0x6595f5
mov edx, dword [esp + 0x11c]
mov ecx, dword [esp + 0x118]
mov ebx, dword [esp + 0x114]
mov eax, dword [esp + 0x110]
mov edi, 4
add edx, eax
add eax, edx
mov ebp, edx
shr ebp, 7
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shl ebp, 0xd
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, ebx
shr ebp, 0x11
xor ebx, ebp
add eax, ebx
add ebx, eax
mov ebp, eax
shl ebp, 9
xor eax, ebp
add edx, eax
add eax, edx
mov ebp, edx
shr ebp, 3
xor edx, ebp
add ecx, edx
add edx, ecx
mov ebp, ecx
shl ebp, 7
xor ecx, ebp
add ebx, ecx
add ecx, ebx
mov ebp, eax
shr ebp, 0xf
xor ebx, ebp
add eax, ebx
add ebx, eax
mov ebp, eax
shl ebp, 0xb
xor eax, ebp
dec edi
jne 0x659575
mov dword [esp + 0x110], edx
mov dword [esp + 0x114], ecx
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], eax
xor eax, eax
mov dword [esp + 0x10c], eax
inc esi
dec dword [esp + 4]
jne 0x659512
mov edx, dword [esp]
lea eax, [esp + 8]
mov ecx, 0x118
call fcn.00407130
add esp, 0x120
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x659e34
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, ecx
shr eax, 2
test eax, eax
jle 0x659e4e
mov ebx, dword [edx]
xor dword [esi], ebx
add esi, 4
add edx, 4
dec eax
jne 0x659e41
mov eax, ecx
and eax, 3
test eax, eax
jle 0x659e61
movzx ecx, byte [edx]
xor byte [esi], cl
inc esi
inc edx
dec eax
jne 0x659e57
pop esi
pop ebx
ret
Function at 0x65abf0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff88
mov dword [esp + 4], edx
mov dword [esp], eax
lea eax, [esp + 0x39]
xor ecx, ecx
mov edx, 0x3f
call fcn.00407e54
lea edx, [esp + 0xc]
mov ecx, 0x2d
mov eax, dword [esp]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x65ad71
mov edi, 1
xor esi, esi
jmp 0x65acb2
movzx eax, byte [esp + edi + 0xb]
movzx edx, al
shr edx, 2
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x39], dl
mov edx, eax
shl edx, 4
movzx eax, byte [esp + edi + 0xc]
shr eax, 4
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3a], al
movzx edx, byte [esp + edi + 0xc]
add edx, edx
add edx, edx
movzx eax, byte [esp + edi + 0xd]
shr eax, 6
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3b], al
movzx edx, byte [esp + edi + 0xd]
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3c], al
add edi, 3
add esi, 4
mov eax, dword [esp + 8]
sub eax, 2
cmp edi, eax
jle 0x65ac36
cmp edi, dword [esp + 8]
jg 0x65ad57
movzx eax, byte [esp + edi + 0xb]
movzx edx, al
shr edx, 2
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x39], dl
cmp edi, dword [esp + 8]
jne 0x65ad0d
mov edx, eax
shl edx, 4
and dl, 0x30
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3a], al
mov byte [esp + esi + 0x3b], 0x3d
jmp 0x65ad4f
mov edx, eax
shl edx, 4
and dl, 0x30
movzx eax, byte [esp + edi + 0xc]
shr eax, 4
and al, 0xf
or dl, al
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3a], al
movzx edx, byte [esp + edi + 0xc]
add edx, edx
add edx, edx
and dl, 0x3c
and dl, 0x3f
movzx eax, dl
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__]
mov byte [esp + esi + 0x3b], al
mov byte [esp + esi + 0x3c], 0x3d
add esi, 4
lea edx, [esp + 0x39]
mov ecx, esi
mov eax, dword [esp + 4]
mov ebx, dword [eax]
call dword [ebx + 0x10]
cmp dword [esp + 8], 0x2d
jge 0x65ac0d
add esp, 0x78
pop edi
pop esi
pop ebx
ret
Function at 0x65c5c8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
mov esi, 1
call fcn.00429fdc
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [esp + 0xe]
push eax
lea ecx, [esp + 0x10]
lea edx, [esp + 0xe]
lea eax, [esp + 0xc]
call fcn.00429cb4
mov ebp, esi
mov dword [ebx + 4], ebp
mov ecx, 0xf
and ecx, esi
mov edi, ebp
shl edi, cl
movzx eax, word [esp]
or ax, word [esp + 4]
movzx eax, ax
shl eax, 0x10
movzx edx, word [esp + 2]
or dx, word [esp + 6]
movzx edx, dx
or eax, edx
xor edi, eax
mov dword [ebx + 4], edi
mov esi, edi
inc esi
test edi, edi
je 0x65c5d6
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x65dd3c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe0
mov esi, edx
lea edi, [esp + 0x11]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, eax
lea edi, [esp + 4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebp, ecx
lea eax, [esp + 4]
call fcn.0065d5c4
lea eax, [esp + 0x11]
call fcn.0065d5c4
mov ecx, ebp
lea edx, [esp + 0x11]
lea eax, [esp + 4]
call fcn.0065d698
mov eax, ebp
xor ecx, ecx
mov edx, 1
call fcn.0065d768
mov ecx, esp
lea edx, [esp + 0x11]
lea eax, [esp + 4]
call fcn.0065d654
mov edi, dword [esp]
test edi, edi
jle 0x65ddcc
mov esi, 1
lea eax, [esp + 4]
mov edx, esi
call fcn.0065d520
mov ebx, eax
lea eax, [esp + 0x11]
mov edx, esi
call fcn.0065d520
xor bl, al
mov eax, ebp
mov ecx, ebx
mov edx, esi
call fcn.0065d768
inc esi
dec edi
jne 0x65dda3
add esp, 0x20
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x661184
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x1010], ebx
mov dword [ebp - 0x100c], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x6612bb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx], 0x1000
jle 0x6611e3
lea edx, [ebp - 0x100c]
mov eax, dword [0x6d2f24]
call fcn.004100a8
mov ecx, dword [ebp - 0x100c]
mov dl, 1
mov eax, dword [0x41e4d0]
call fcn.0042d2ac
call fcn.00409ecc
xor ecx, ecx
mov eax, dword [ebx]
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
mov byte [ebp + ecx - 0x1008], al
inc ecx
cmp dword [ebx], 0x7f
jle 0x66123b
mov eax, dword [ebx]
mov esi, 0xff
cdq
idiv esi
mov esi, eax
test esi, esi
jne 0x661210
mov esi, 1
mov eax, esi
or al, 0x80
mov byte [ebp + ecx - 0x1008], al
add ecx, esi
mov eax, esi
test eax, eax
jle 0x661236
mov edx, dword [ebx]
and dl, 0xff
mov byte [ebp + ecx - 0x1008], dl
shr dword [ebx], 8
dec ecx
dec eax
jne 0x661223
inc esi
add ecx, esi
jmp 0x661245
mov eax, dword [ebx]
mov byte [ebp + ecx - 0x1008], al
inc ecx
mov eax, dword [ebp - 8]
add eax, ecx
mov dword [ebx], eax
cmp dword [ebx], 0x1000
jle 0x66127b
lea edx, [ebp - 0x1010]
mov eax, dword [0x6d2f24]
call fcn.004100a8
mov ecx, dword [ebp - 0x1010]
mov dl, 1
mov eax, dword [0x41e4d0]
call fcn.0042d2ac
call fcn.00409ecc
lea edx, [ebp + ecx - 0x1008]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00407130
mov ecx, dword [ebx]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1008]
call fcn.00407130
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6612c2
lea eax, [ebp - 0x1010]
mov edx, 2
call fcn.0040a830
ret