joyce8/EMBER2024-capa huggingface dataset:
Function at 0x131b45f0
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x131b460f
add edx, 3
sar edx, 2
test edx, edx
jle 0x131b471d
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x131b4644
je 0x131b4687
sub ecx, 0x2b
je 0x131b467d
sub ecx, 4
je 0x131b4682
dec ecx
sub ecx, 0xa
jb 0x131b466f
jmp 0x131b468a
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x131b4656
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x131b4661
jmp 0x131b468a
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x131b468a
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x131b468a
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x131b468a
mov byte [eax], 0x3e
jmp 0x131b468a
mov byte [eax], 0x3f
jmp 0x131b468a
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x131b4627
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x131b46db
cmp byte [esp + 7], 0xff
jne 0x131b46db
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x131b4712
cmp dl, 0xff
je 0x131b4712
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x131b461e
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x131b68c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x131b68ee
mov ecx, 0x131b6950
mov dl, 1
mov eax, dword [0x131b5ed4]
call fcn.1314d9d0
call fcn.131445bc
mov dword [ebp - 8], edx
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
test eax, eax
jle 0x131b693d
mov dword [ebp - 0xc], eax
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
mov edx, dword [ebx + 0x40]
xor al, byte [edx]
mov byte [esi], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.13143104
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
movzx edx, byte [esi]
mov byte [eax], dl
inc dword [ebp - 8]
inc esi
dec dword [ebp - 0xc]
jne 0x131b68fe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x131b6968
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x131b6992
mov ecx, 0x131b69fc
mov dl, 1
mov eax, dword [0x131b5ed4]
call fcn.1314d9d0
call fcn.131445bc
mov esi, edx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x131b69ea
mov dword [ebp - 0x10], eax
movzx eax, byte [esi]
mov byte [ebp - 9], al
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebx + 0x40]
movzx eax, byte [eax]
xor al, byte [esi]
mov edx, dword [ebp - 8]
mov byte [edx], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.13143104
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
movzx edx, byte [ebp - 9]
mov byte [eax], dl
inc esi
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x131b69a4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x131b6fb8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x131b703a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x131b61f8]
mov eax, 0x14
call fcn.13145d0c
mov edi, eax
mov dword [edi + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.131495f8
mov edx, dword [ebp - 4]
lea eax, [edi + 4]
call fcn.13144c7c
mov eax, esi
call dword [eax + 0x30]
mov dword [edi + 8], eax
mov eax, dword [0x132b20f0]
mov dword [edi], eax
mov byte [edi + 0x10], bl
mov dword [0x132b20f0], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131b7041
lea eax, [ebp - 8]
mov edx, 2
call fcn.13144c4c
ret

Function at 0x131b7048
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x131b70c4
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x131b6220]
mov eax, 0x10
call fcn.13145d0c
mov ebx, eax
mov dword [ebx + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.131495f8
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.13144c7c
mov eax, esi
call dword [eax + 0x30]
mov dword [ebx + 8], eax
mov eax, dword [0x132b20f4]
mov dword [ebx], eax
mov dword [0x132b20f4], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131b70cb
lea eax, [ebp - 8]
mov edx, 2
call fcn.13144c4c
ret

Function at 0x131b7120
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jle 0x131b7141
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x131b712e
pop edi
pop esi
pop ebx
ret
Function at 0x131bc838
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx ebx, dl
dec ebx
test ebx, ebx
jl 0x131bc88c
inc ebx
xor edx, edx
mov ecx, edx
add ecx, ecx
add ecx, ecx
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x1325a660]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x1325aa60]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x1325ae60]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x1325b260]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x131bc846
pop edi
pop esi
pop ebx
ret

Function at 0x131bd6e8
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov dword [esp + 4], ecx
mov dword [esp], eax
mov ebx, dword [esp]
and ebx, 0xff
mov ecx, dword [esp]
shr ecx, 8
and ecx, 0xff
mov eax, dword [esp]
shr eax, 0x10
and eax, 0xff
mov esi, dword [esp]
shr esi, 0x18
mov dword [esp + 8], esi
cmp dword [esp + 4], 0x100
jne 0x131bd779
movzx ebx, byte [ebx + 0x1325b880]
mov esi, dword [edx + 0xc]
mov edi, esi
and edi, 0xff
xor ebx, edi
movzx ecx, byte [ecx + 0x1325b780]
mov edi, esi
shr edi, 8
and edi, 0xff
xor ecx, edi
movzx eax, byte [eax + 0x1325b780]
mov edi, esi
shr edi, 0x10
and edi, 0xff
xor eax, edi
mov edi, dword [esp + 8]
movzx edi, byte [edi + 0x1325b880]
shr esi, 0x18
xor edi, esi
mov dword [esp + 8], edi
cmp dword [esp + 4], 0xc0
jl 0x131bd7d3
movzx ebx, byte [ebx + 0x1325b880]
mov esi, dword [edx + 8]
mov edi, esi
and edi, 0xff
xor ebx, edi
movzx ecx, byte [ecx + 0x1325b880]
mov edi, esi
shr edi, 8
and edi, 0xff
xor ecx, edi
movzx eax, byte [eax + 0x1325b780]
mov edi, esi
shr edi, 0x10
and edi, 0xff
xor eax, edi
mov edi, dword [esp + 8]
movzx edi, byte [edi + 0x1325b780]
shr esi, 0x18
xor edi, esi
mov dword [esp + 8], edi
movzx ebx, byte [ebx + 0x1325b780]
mov esi, dword [edx + 4]
and esi, 0xff
xor ebx, esi
movzx ebx, byte [ebx + 0x1325b780]
mov esi, dword [edx]
and esi, 0xff
xor ebx, esi
mov ebx, dword [ebx*4 + 0x132b2114]
movzx ecx, byte [ecx + 0x1325b880]
mov esi, dword [edx + 4]
shr esi, 8
and esi, 0xff
xor ecx, esi
movzx ecx, byte [ecx + 0x1325b780]
mov esi, dword [edx]
shr esi, 8
and esi, 0xff
xor ecx, esi
xor ebx, dword [ecx*4 + 0x132b2514]
movzx eax, byte [eax + 0x1325b780]
mov ecx, dword [edx + 4]
shr ecx, 0x10
and ecx, 0xff
xor eax, ecx
movzx eax, byte [eax + 0x1325b880]
mov ecx, dword [edx]
shr ecx, 0x10
and ecx, 0xff
xor eax, ecx
xor ebx, dword [eax*4 + 0x132b2914]
mov eax, dword [esp + 8]
movzx eax, byte [eax + 0x1325b880]
mov ecx, dword [edx + 4]
shr ecx, 0x18
xor eax, ecx
movzx eax, byte [eax + 0x1325b880]
mov edx, dword [edx]
shr edx, 0x18
xor eax, edx
xor ebx, dword [eax*4 + 0x132b2d14]
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x131bd890
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor ebx, ebx
movzx ecx, cl
imul ecx, ecx, 0x1010101
mov esi, dword [edx + ebx*4]
xor esi, ecx
mov dword [eax + ebx*4], esi
mov esi, dword [edx + ebx*4 + 4]
xor esi, ecx
mov dword [eax + ebx*4 + 4], esi
mov esi, dword [edx + ebx*4 + 8]
xor esi, ecx
mov dword [eax + ebx*4 + 8], esi
mov esi, dword [edx + ebx*4 + 0xc]
xor esi, ecx
mov dword [eax + ebx*4 + 0xc], esi
add ebx, 4
cmp ebx, 0x40
jl 0x131bd89d
pop esi
pop ebx
ret

Function at 0x131be754
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov dword [esp + 0x18], pe_nt_image_headers32
mov esi, 0x1325b780
mov ebx, 0x132b2114
movzx edi, byte [esi]
mov dword [esp], edi
mov eax, edi
call fcn.131bd5d0
mov dword [esp + 8], eax
mov eax, edi
call fcn.131bd5e0
mov dword [esp + 0x10], eax
movzx edi, byte [esi + 0x100]
mov dword [esp + 4], edi
mov eax, edi
call fcn.131bd5d0
mov dword [esp + 0xc], eax
mov eax, edi
call fcn.131bd5e0
mov ebp, eax
mov dword [esp + 0x14], ebp
mov eax, edi
mov edx, dword [esp + 0xc]
shl edx, 8
or eax, edx
mov edx, ebp
shl edx, 0x10
or eax, edx
mov edx, ebp
shl edx, 0x18
or eax, edx
mov dword [ebx], eax
mov eax, dword [esp + 0x10]
mov edx, eax
mov ecx, eax
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x400], edx
mov edx, dword [esp + 0xc]
shl ebp, 8
or edx, ebp
shl edi, 0x10
or edx, edi
mov ecx, dword [esp + 0x14]
shl ecx, 0x18
or edx, ecx
mov dword [ebx + 0x800], edx
mov edx, dword [esp + 8]
mov ecx, dword [esp]
shl ecx, 8
or edx, ecx
shl eax, 0x10
or edx, eax
mov eax, dword [esp + 8]
shl eax, 0x18
or edx, eax
mov dword [ebx + 0xc00], edx
add ebx, 4
inc esi
dec dword [esp + 0x18]
jne 0x131be76d
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x131beacc
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
movzx ebx, bl
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
movzx edx, dl
movzx eax, al
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax*8 + 0x1325bb10]
movzx eax, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x131beb04
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x131beb1c
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x131beb15
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.13143618
xor edx, edx
mov eax, 0x1325bd10
movzx ebx, byte [eax]
mov ecx, ebx
and cl, 7
movzx ecx, cl
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
movzx ecx, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x131beb83
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x131beb3a
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x131bedc4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x131beddd
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x131bedd6
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x131bedef
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x131bede8
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.131be9bc
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x131bee09
movzx eax, byte [ebp - 0xa]
movzx edx, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 9]
movzx ecx, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
add edx, edx
add edx, edx
movzx eax, byte [ebp - 8]
movzx ecx, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
movzx eax, byte [ebp - 7]
movzx edx, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
movzx eax, byte [ebp - 6]
and al, 0xf
add eax, eax
add eax, eax
movzx edx, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
movzx edx, byte [esi]
call fcn.131beacc
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x131bee91
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x131beeaf
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.131bea4c
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x131beed9
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x131beef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x131bef09
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x131bef02
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
movzx edx, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x131bef1d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.131be8bc
test bl, bl
jne 0x131beff7
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x132b3118
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x131bef55
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x131bef6a
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.131bedc4
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
movzx ebx, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x131bef9d
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x131bef4a
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x131befc1
mov eax, 4
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x131befd3
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x131befe8
jmp 0x131bf0b8
cmp bl, 1
jne 0x131bf0b8
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x132b3172
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x131bf017
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x131bf02c
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.131bedc4
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
movzx ecx, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x131bf05f
sub ebx, 6
inc dword [ebp - 8]
jne 0x131bf00c
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x131bf087
mov eax, 4
mov ebx, dword [ebp + 0xc]
movzx edx, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x131bf099
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x131bf0ae
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.131be93c
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x131c07c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
xor ebx, ebx
cmp ebx, dword [ebp - 0xc]
jge 0x131c083f
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [esi]
mov ecx, dword [eax + 0x10]
dec ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov eax, dword [eax + 0x24]
inc eax
call fcn.13143104
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
mov edx, dword [esi]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + ebx]
mov byte [edx + eax - 1], cl
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx]
mov edx, dword [esi]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + ebx], al
inc ebx
cmp ebx, dword [ebp - 0xc]
jl 0x131c07e3
mov eax, dword [esi]
mov byte [eax + 4], 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x131c084c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
add ebx, 0xfffffffc
xor esi, esi
cmp esi, dword [ebp - 0xc]
jge 0x131c08c8
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebx]
mov edx, dword [eax + 0x24]
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [ebx]
mov ecx, dword [eax + 0x10]
dec ecx
mov eax, dword [ebx]
mov edx, dword [eax + 0x24]
mov eax, dword [ebx]
mov eax, dword [eax + 0x24]
inc eax
call fcn.13143104
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
mov edx, dword [ebx]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0x1c]
movzx ecx, byte [ecx]
mov byte [edx + eax - 1], cl
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi]
mov edx, dword [ebx]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + esi], al
inc esi
cmp esi, dword [ebp - 0xc]
jl 0x131c086b
mov eax, dword [ebx]
mov byte [eax + 4], 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x131c08d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
xor ebx, ebx
cmp ebx, dword [ebp - 0xc]
jge 0x131c0953
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [esi]
mov ecx, dword [eax + 0x10]
dec ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov eax, dword [eax + 0x24]
inc eax
call fcn.13143104
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
mov edx, dword [esi]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + ebx]
xor byte [edx + eax - 1], cl
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx]
mov edx, dword [esi]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + ebx], al
inc ebx
cmp ebx, dword [ebp - 0xc]
jl 0x131c08f7
mov eax, dword [esi]
mov byte [eax + 4], 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x131c13c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x28]
mov ebx, eax
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x18]
shr edx, 1
add ebx, edx
mov ecx, dword [ebp + 8]
mov ecx, edx
mov edx, dword [ebp + 8]
mov edx, ebx
call fcn.13143104
add ebx, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x30]
add edx, edx
add edx, edx
sub edx, 5
test edx, edx
jl 0x131c149c
inc edx
mov eax, dword [ebx]
mov ecx, eax
and ecx, 0xff
mov esi, dword [str.cw]
movzx ecx, byte [esi + ecx]
mov esi, dword [0x132acbd4]
mov ecx, dword [esi + ecx*4 + 0x1000]
mov esi, eax
shr esi, 8
and esi, 0xff
mov edi, dword [str.cw]
movzx esi, byte [edi + esi]
mov edi, dword [0x132acbd4]
xor ecx, dword [edi + esi*4 + 0x1400]
mov esi, eax
shr esi, 0x10
and esi, 0xff
mov edi, dword [str.cw]
movzx esi, byte [edi + esi]
mov edi, dword [0x132acbd4]
xor ecx, dword [edi + esi*4 + 0x1800]
shr eax, 0x18
mov esi, dword [str.cw]
movzx eax, byte [esi + eax]
mov esi, dword [0x132acbd4]
xor ecx, dword [esi + eax*4 + 0x1c00]
mov dword [ebx], ecx
add ebx, 4
dec edx
jne 0x131c1411
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x131c69cc
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov edx, 0x132b4220
xor ebx, ebx
cmp ebx, 0x100
je 0x131c69ff
mov eax, ebx
mov ecx, 8
test eax, 1
je 0x131c69f3
shr eax, 1
xor eax, 0xedb88320
jmp 0x131c69f5
shr eax, 1
loop 0x131c69e3
mov dword [edx], eax
add edx, 4
inc ebx
jmp 0x131c69d4
pop ebx
ret