joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b310
Capabilities:
Encrypt data using des

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 0x30
push 0x40d708
push esi
push 0x4126b0
mov edi, ecx
call fcn.0040b5e0
mov eax, dword [esp + 0x20]
push 0x30
push eax
push 0x4126b0
call fcn.0040b6d0
add esp, 0x1c
mov ecx, edi
push 0x4126b0
push esi
call fcn.0040b370
push 0x20
push 0x40d738
push esi
push esi
call fcn.0040b5e0
add esp, 0x10
pop edi
pop esi
ret 8

Function at 0x40b6d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x40b6fe
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x40b6fe
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jbe 0x40b6fa
sub ecx, eax
push ebx
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x40b6ec
pop ebx
mov al, 1
pop esi
ret
xor al, al
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x62d008], 0x8088405
inc edx
mov dword [ebx + 0x62d008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cf00
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cf31
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf19
add dl, dl
jne 0x41cf3c
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cf8d
xor eax, eax
add dl, dl
jne 0x41cf49
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41d02a
add dl, dl
jne 0x41cf58
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf63
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cf79
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cf83
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cf28
mov eax, 1
add dl, dl
jne 0x41cf9b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cfa6
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cf92
sub eax, ebx
mov ebx, 1
jne 0x41cfd9
mov ecx, 1
add dl, dl
jne 0x41cfbf
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cfca
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfb6
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cff0
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cffb
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cfe7
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cf28
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41d04b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cf28
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41f05c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x61154a
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f0ab
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f0ca
mov ecx, edx
add ecx, ebx
jmp 0x41f0ca
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f0ca
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f13c
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f125
test esi, esi
jbe 0x41f13c
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f117
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f13c
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f0f4
jmp 0x41f13c
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f13c
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x611551
ret
Function at 0x420294
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x6128af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202cf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202e8
lea eax, [ebp - 0x10]
mov edx, dword [0x62f54c]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202fb
lea eax, [ebp - 0x10]
mov edx, dword [0x62f54c]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x420307
adc edx, 0
mov edx, dword [edx*4 + 0x62e378]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420481
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420474
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420474
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420412
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420412
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420412
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420412
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420474
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420474
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420474
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420474
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420499
inc ebx
cmp ebx, 0x19
jne 0x4202c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6128b6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x10070c8
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
je 0x1007116
push esi
mov esi, dword [ebp + 8]
add esi, 0x10
dec dword [ebp + 0xc]
test byte [esi - 0xc], 0x10
je 0x100710c
push 0x10070b2
push 4
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push esi
call dword [sym.imp.msvcrt.dll_bsearch]
add esp, 0x14
test eax, eax
je 0x100711a
sub eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
sar eax, 2
mov eax, dword [ecx + eax*4]
mov dword [esi], eax
add esi, 0x58
cmp dword [ebp + 0xc], 0
jne 0x10070da
pop esi
pop ebp
ret 0x14
push 1
call dword [sym.imp.msvcrt.dll_exit]
int3

Function at 0x1067b1c
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1067b26
pushal
call 0x1067b2c
pop ebp
sub ebp, 0x10
sub ebp, 0xc67b1c
jmp 0x1067b42
mov eax, 0xc67b1c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bc
mov edx, 0x7dea2ecd
xor byte [eax], dl
inc eax
dec ecx
jne 0x1067b59
jmp 0x1067b6c
inc esi
add byte [esi + 0x44], al
int1
int 0xcd
int 0x4c
or al, 0x35
int 0xcd
int 0xce
add byte [ebp - 0x38], dh
int 0xcd
int 0x77
in eax, 0xcd
int 0xcd
cmp ch, byte [edi]
into
add eax, 0xcdc14c46
int 0xcd
into
or byte [eax - 0x57], al
jmp 0xeacfbfca
Function at 0x2c7b000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 0x10]
push edi
push dword [ebp + 0x14]
mov byte [ebp - 0x18], 0x42
push 0
push esi
mov byte [ebp - 0x17], 0x43
mov byte [ebp - 0x16], 0x44
mov byte [ebp - 0x15], 0x46
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0x48
mov byte [ebp - 0x12], 0x4a
mov byte [ebp - 0x11], 0x4b
mov byte [ebp - 0x10], 0x4d
mov byte [ebp - 0xf], 0x50
mov byte [ebp - 0xe], 0x51
mov byte [ebp - 0xd], 0x52
mov byte [ebp - 0xc], 0x54
mov byte [ebp - 0xb], 0x56
mov byte [ebp - 0xa], 0x57
mov byte [ebp - 9], 0x58
mov byte [ebp - 8], 0x59
mov byte [ebp - 7], 0x32
mov byte [ebp - 6], 0x33
mov byte [ebp - 5], 0x34
mov byte [ebp - 4], 0x36
mov byte [ebp - 3], 0x37
mov byte [ebp - 2], 0x38
mov byte [ebp - 1], 0x39
call fcn.02c88cfd
xor edi, edi
add esp, 0xc
cmp dword [ebp + 0xc], edi
jle 0x2c7b0c1
mov eax, dword [ebp + 8]
mov al, byte [edi + eax]
cmp al, 0x2d
je 0x2c7b0bb
xor edx, edx
cmp al, byte [ebp + edx - 0x18]
je 0x2c7b098
inc edx
cmp edx, 0x17
jl 0x2c7b08c
cmp edx, 0x18
je 0x2c7b0c7
xor ecx, ecx
cmp dword [ebp + 0x14], ecx
jle 0x2c7b0bb
movzx eax, byte [ecx + esi]
imul eax, eax, 0x18
add eax, edx
mov byte [ecx + esi], al
sar eax, 8
inc ecx
cmp ecx, dword [ebp + 0x14]
mov edx, eax
jl 0x2c7b0a4
inc edi
cmp edi, dword [ebp + 0xc]
jl 0x2c7b080
mov eax, esi
pop edi
pop esi
leave
ret
xor eax, eax
jmp 0x2c7b0c3

Function at 0x2c7b0cb
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
dec edi
mov byte [ebp - 0x1c], 0x42
mov byte [ebp - 0x1b], 0x43
mov byte [ebp - 0x1a], 0x44
mov byte [ebp - 0x19], 0x46
mov byte [ebp - 0x18], 0x47
mov byte [ebp - 0x17], 0x48
mov byte [ebp - 0x16], 0x4a
mov byte [ebp - 0x15], 0x4b
mov byte [ebp - 0x14], 0x4d
mov byte [ebp - 0x13], 0x50
mov byte [ebp - 0x12], 0x51
mov byte [ebp - 0x11], 0x52
mov byte [ebp - 0x10], 0x54
mov byte [ebp - 0xf], 0x56
mov byte [ebp - 0xe], 0x57
mov byte [ebp - 0xd], 0x58
mov byte [ebp - 0xc], 0x59
mov byte [ebp - 0xb], 0x32
mov byte [ebp - 0xa], 0x33
mov byte [ebp - 9], 0x34
mov byte [ebp - 8], 0x36
mov byte [ebp - 7], 0x37
mov byte [ebp - 6], 0x38
mov byte [ebp - 5], 0x39
mov dword [ebp - 4], edi
js 0x2c7b193
mov dword [ebp + 0x14], 1
push ebx
add edi, eax
sub dword [ebp + 0x14], eax
push esi
mov eax, dword [ebp + 0x14]
add eax, edi
push 6
cdq
pop ecx
idiv ecx
test edx, edx
jne 0x2c7b160
mov byte [edi], 0x2d
jmp 0x2c7b187
mov esi, dword [ebp + 0xc]
xor eax, eax
jmp 0x2c7b184
mov ecx, dword [ebp + 8]
add ecx, esi
movzx edx, byte [ecx]
shl eax, 8
or eax, edx
cdq
push 0x18
pop ebx
idiv ebx
mov byte [ecx], al
mov eax, edx
mov cl, byte [ebp + eax - 0x1c]
mov byte [edi], cl
dec esi
jns 0x2c7b167
dec dword [ebp - 4]
dec edi
cmp dword [ebp - 4], 0
jge 0x2c7b14c
pop esi
pop ebx
mov eax, dword [ebp + 0x10]
pop edi
leave
ret
Function at 0x2c7cf1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xa4
push ebx
mov byte [esi + 8], al
and al, 0x80
push edi
mov edi, ecx
mov bl, dl
mov byte [ebp + 0x5c], 0xaa
mov byte [ebp + 0x5d], 0xbb
mov byte [ebp + 0x5e], 0xcc
mov byte [ebp + 0x5f], 0xdd
mov byte [ebp + 0x60], 0xee
mov byte [ebp + 0x61], 0xff
mov byte [ebp + 0x62], 0x11
mov byte [ebp + 0x63], 0x22
mov byte [ebp + 0x64], 0x33
mov byte [ebp + 0x65], 0x44
mov byte [ebp + 0x66], 0x55
mov byte [ebp + 0x67], 0x66
mov byte [ebp + 0x68], 0x77
mov byte [ebp + 0x69], 0x88
mov byte [ebp + 0x6a], 0x99
mov byte [ebp + 0x6b], 0x99
mov byte [esi + 5], al
call fcn.02c807c3
mov dword [esi + 1], eax
test bl, bl
jne 0x2c7cf89
mov byte [esi + 9], bl
jmp 0x2c7d003
test byte [esi + 5], 0x80
movzx eax, bl
je 0x2c7cff0
mov ecx, eax
and ecx, 0x8000000f
mov dword [ebp + 0x6c], eax
jns 0x2c7cfa4
dec ecx
or ecx, 0xfffffff0
inc ecx
je 0x2c7cfae
shr bl, 4
inc bl
shl bl, 4
push eax
push dword [ebp + 0x78]
lea eax, [ebp - 0x34]
push eax
mov byte [esi + 9], bl
call fcn.02c88cd8
movzx ecx, byte [esi + 9]
mov eax, dword [ebp + 0x6c]
sub ecx, eax
push ecx
lea eax, [ebp + eax - 0x34]
push eax
call fcn.02c807a9
lea eax, [ebp + 0x5c]
push eax
movzx eax, byte [esi + 9]
push eax
lea eax, [esi + 0xa]
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0x7c]
call fcn.02c7d7f6
add esp, 0x28
jmp 0x2c7d003
push eax
push dword [ebp + 0x78]
lea eax, [esi + 0xa]
push eax
mov byte [esi + 9], bl
call fcn.02c88cd8
add esp, 0xc
movzx eax, byte [esi + 9]
sub edi, eax
lea eax, [eax + esi + 0xa]
push edi
push eax
call fcn.02c807a9
movzx edi, byte [esi + 9]
xor eax, eax
pop ecx
mov word [esi + 6], ax
pop ecx
lea ecx, [edi + 0xa]
mov eax, ecx
cdq
sub eax, edx
xor ebx, ebx
sar eax, 1
and ecx, 0x80000001
mov dword [ebp + 0x6c], ebx
jns 0x2c7d03c
dec ecx
or ecx, 0xfffffffe
inc ecx
cmp eax, ebx
mov dx, word [ebp + 0x6c]
jle 0x2c7d04d
xor dx, word [esi + ebx*2]
inc ebx
cmp ebx, eax
jl 0x2c7d044
test ecx, ecx
je 0x2c7d05a
movzx ax, byte [edi + esi + 9]
xor dx, ax
pop edi
mov word [esi + 6], dx
pop ebx
add ebp, 0x70
leave
ret

Function at 0x2c7d7af
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
test esi, esi
jle 0x2c7d7c1
sub ecx, eax
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x2c7d7b8
pop esi
ret
Function at 0x2c7e102
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.02c7dbf5
and dword [ebp - 4], 0
mov ebx, eax
shl ebx, 2
add esp, 0xc
mov dword [ebp - 8], eax
test ebx, ebx
jle 0x2c7e174
lea edx, [esi + ebx*4 + 8]
lea ecx, [esi + 8]
mov eax, dword [edx - 8]
mov edi, dword [ecx - 8]
add dword [ebp - 4], 4
mov dword [ecx - 8], eax
mov eax, dword [edx - 4]
mov dword [edx - 8], edi
mov edi, dword [ecx - 4]
mov dword [ecx - 4], eax
mov eax, dword [edx]
mov dword [edx - 4], edi
mov edi, dword [ecx]
mov dword [ecx], eax
mov eax, dword [edx + 4]
mov dword [edx], edi
mov edi, dword [ecx + 4]
mov dword [ecx + 4], eax
mov dword [edx + 4], edi
sub ebx, 4
add ecx, 0x10
sub edx, 0x10
cmp dword [ebp - 4], ebx
jl 0x2c7e133
mov eax, dword [ebp - 8]
cmp eax, 1
jle 0x2c7e2e6
lea ecx, [eax - 1]
mov dword [ebp - 4], ecx
mov ecx, 0xff
movzx ebx, byte [esi + 0x11]
mov ebx, dword [ebx*4 + 0x2c96b68]
add esi, 0x10
mov edx, dword [esi]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + 0x2c96b68]
and edi, ecx
mov edi, dword [edi*4 + 0x2c96f68]
and ebx, ecx
xor edi, dword [ebx*4 + 0x2c97768]
movzx ebx, byte [esi + 2]
mov ebx, dword [ebx*4 + 0x2c96b68]
and ebx, ecx
xor edi, dword [ebx*4 + 0x2c97368]
movzx ebx, byte [esi + 5]
and edx, ecx
mov edx, dword [edx*4 + 0x2c96b68]
and edx, ecx
xor edi, dword [edx*4 + 0x2c97b68]
mov edx, dword [esi + 4]
mov dword [esi], edi
mov ebx, dword [ebx*4 + 0x2c96b68]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + 0x2c96b68]
and edi, ecx
mov edi, dword [edi*4 + 0x2c96f68]
and ebx, ecx
xor edi, dword [ebx*4 + 0x2c97768]
movzx ebx, byte [esi + 6]
mov ebx, dword [ebx*4 + 0x2c96b68]
and ebx, ecx
xor edi, dword [ebx*4 + 0x2c97368]
movzx ebx, byte [esi + 9]
and edx, ecx
mov edx, dword [edx*4 + 0x2c96b68]
and edx, ecx
xor edi, dword [edx*4 + 0x2c97b68]
mov edx, dword [esi + 8]
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + 0x2c96b68]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + 0x2c96b68]
and edi, ecx
mov edi, dword [edi*4 + 0x2c96f68]
and ebx, ecx
xor edi, dword [ebx*4 + 0x2c97768]
movzx ebx, byte [esi + 0xa]
mov ebx, dword [ebx*4 + 0x2c96b68]
and ebx, ecx
xor edi, dword [ebx*4 + 0x2c97368]
movzx ebx, byte [esi + 0xd]
and edx, ecx
mov edx, dword [edx*4 + 0x2c96b68]
and edx, ecx
xor edi, dword [edx*4 + 0x2c97b68]
mov edx, dword [esi + 0xc]
mov dword [esi + 8], edi
mov ebx, dword [ebx*4 + 0x2c96b68]
mov edi, edx
shr edi, 0x18
mov edi, dword [edi*4 + 0x2c96b68]
and edi, ecx
mov edi, dword [edi*4 + 0x2c96f68]
and ebx, ecx
xor edi, dword [ebx*4 + 0x2c97768]
movzx ebx, byte [esi + 0xe]
mov ebx, dword [ebx*4 + 0x2c96b68]
and edx, ecx
mov edx, dword [edx*4 + 0x2c96b68]
and ebx, ecx
xor edi, dword [ebx*4 + 0x2c97368]
and edx, ecx
xor edi, dword [edx*4 + 0x2c97b68]
dec dword [ebp - 4]
mov dword [esi + 0xc], edi
jne 0x2c7e188
pop edi
pop esi
pop ebx
leave
ret
Function at 0x2c80067
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
movzx eax, byte [ecx + 9]
and dword [ebp - 4], 0
push esi
lea esi, [eax + 0xa]
mov eax, esi
cdq
sub eax, edx
mov edx, esi
sar eax, 1
and edx, 0x80000001
push edi
jns 0x2c80091
dec edx
or edx, 0xfffffffe
inc edx
mov si, word [ebp - 4]
xor edi, edi
test eax, eax
jle 0x2c800a4
xor si, word [ecx + edi*2]
inc edi
cmp edi, eax
jl 0x2c8009b
test edx, edx
je 0x2c800b5
movzx eax, byte [ecx + 9]
movzx ax, byte [eax + ecx + 9]
xor si, ax
movzx eax, word [ecx + 6]
mov cx, ax
xor cx, si
xor edx, edx
cmp cx, ax
sete dl
pop edi
pop esi
dec edx
mov eax, edx
leave
ret
Function at 0x2c8136b
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov eax, edx
shr eax, 4
xor eax, ecx
and eax, 0xf0f0f0f
xor ecx, eax
shl eax, 4
xor edx, eax
mov eax, edx
shr eax, 0x10
xor eax, ecx
and eax, 0xffff
xor ecx, eax
shl eax, 0x10
xor edx, eax
mov eax, ecx
shr eax, 2
xor eax, edx
and eax, 0x33333333
xor edx, eax
shl eax, 2
xor ecx, eax
mov eax, ecx
shr eax, 8
xor eax, edx
and eax, 0xff00ff
xor edx, eax
shl eax, 8
xor eax, ecx
rol eax, 1
mov ecx, eax
push ebx
xor ecx, edx
and ecx, 0xaaaaaaaa
push esi
xor eax, ecx
push edi
xor ecx, edx
rol ecx, 1
push 0x3f
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 8
pop edi
mov ecx, dword [ebp + 0xc]
mov esi, eax
ror esi, 4
xor esi, dword [ecx]
add ecx, 4
mov edx, esi
shr edx, 0x18
mov ebx, esi
shr ebx, 0x10
and ebx, edi
and edx, edi
mov edx, dword [edx*4 + 0x2c905e8]
or edx, dword [ebx*4 + 0x2c907e8]
mov ebx, esi
shr ebx, 8
and ebx, edi
or edx, dword [ebx*4 + 0x2c909e8]
and esi, edi
or edx, dword [esi*4 + 0x2c90be8]
mov esi, dword [ecx]
add ecx, 4
mov dword [ebp + 0xc], ecx
xor esi, eax
mov ecx, esi
shr ecx, 0x18
and ecx, edi
mov ecx, dword [ecx*4 + 0x2c906e8]
mov ebx, esi
shr ebx, 0x10
and ebx, edi
or ecx, dword [ebx*4 + 0x2c908e8]
mov ebx, esi
shr ebx, 8
and ebx, edi
or ecx, dword [ebx*4 + 0x2c90ae8]
and esi, edi
or ecx, dword [esi*4 + 0x2c90ce8]
or ecx, edx
xor dword [ebp - 4], ecx
mov esi, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
ror esi, 4
xor esi, dword [ecx]
add ecx, 4
mov edx, esi
shr edx, 0x18
mov ebx, esi
shr ebx, 0x10
and ebx, edi
and edx, edi
mov edx, dword [edx*4 + 0x2c905e8]
or edx, dword [ebx*4 + 0x2c907e8]
mov ebx, esi
shr ebx, 8
and ebx, edi
or edx, dword [ebx*4 + 0x2c909e8]
and esi, edi
or edx, dword [esi*4 + 0x2c90be8]
mov esi, dword [ecx]
xor esi, dword [ebp - 4]
add ecx, 4
mov dword [ebp + 0xc], ecx
mov ecx, esi
shr ecx, 0x18
and ecx, edi
mov ecx, dword [ecx*4 + 0x2c906e8]
mov ebx, esi
shr ebx, 0x10
and ebx, edi
or ecx, dword [ebx*4 + 0x2c908e8]
mov ebx, esi
shr ebx, 8
and ebx, edi
or ecx, dword [ebx*4 + 0x2c90ae8]
and esi, edi
or ecx, dword [esi*4 + 0x2c90ce8]
or ecx, edx
xor eax, ecx
dec dword [ebp - 8]
jne 0x2c813e6
ror eax, 1
mov edx, eax
xor edx, dword [ebp - 4]
pop edi
and edx, 0xaaaaaaaa
xor eax, edx
xor edx, dword [ebp - 4]
ror edx, 1
mov ecx, edx
shr ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor eax, ecx
shl ecx, 8
xor edx, ecx
mov ecx, edx
shr ecx, 2
xor ecx, eax
and ecx, 0x33333333
xor eax, ecx
shl ecx, 2
xor edx, ecx
mov ecx, eax
shr ecx, 0x10
xor ecx, edx
and ecx, 0xffff
xor edx, ecx
shl ecx, 0x10
xor eax, ecx
mov ecx, eax
shr ecx, 4
xor ecx, edx
and ecx, 0xf0f0f0f
mov esi, ecx
shl esi, 4
xor esi, eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
xor ecx, edx
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret
Function at 0x2c817b3
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
push ebx
push esi
xor ebx, ebx
push edi
xor ecx, ecx
movzx eax, byte [ecx + 0x2c90570]
mov esi, dword [ebp + 0xc]
mov edx, eax
sar edx, 3
mov dl, byte [edx + esi]
and eax, 7
test byte [eax*2 + 0x2c90500], dl
setne al
mov byte [ebp + ecx - 0x74], al
inc ecx
cmp ecx, 0x38
jl 0x2c817c3
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 4]
lea eax, [edi + edi]
lea ecx, [ebp + eax*4 - 0xf0]
lea esi, [ebp + eax*4 - 0xf4]
movzx eax, byte [edi + 0x2c905a8]
mov dword [ecx], ebx
mov dword [esi], ebx
xor edx, edx
mov edi, eax
cmp edi, 0x1c
jge 0x2c8181d
mov bl, byte [ebp + edi - 0x74]
jmp 0x2c81824
mov bl, byte [ebp + edi - 0x90]
mov byte [ebp + edx - 0x3c], bl
inc edx
inc edi
cmp edx, 0x1c
jl 0x2c81812
push 0x1c
pop edi
add eax, edi
cmp eax, 0x38
jge 0x2c8183f
mov dl, byte [ebp + eax - 0x74]
jmp 0x2c81846
mov dl, byte [ebp + eax - 0x90]
mov byte [ebp + edi - 0x3c], dl
inc edi
inc eax
cmp edi, 0x38
jl 0x2c81834
xor ebx, ebx
xor eax, eax
lea edx, [eax + 0x2c905d0]
movzx edi, byte [edx - 0x18]
cmp byte [ebp + edi - 0x3c], bl
je 0x2c8186e
mov edi, dword [eax*4 + 0x2c90510]
or dword [esi], edi
movzx edx, byte [edx]
cmp byte [ebp + edx - 0x3c], bl
je 0x2c81880
mov edx, dword [eax*4 + 0x2c90510]
or dword [ecx], edx
inc eax
cmp eax, 0x18
jl 0x2c81855
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
jl 0x2c817ef
push dword [ebp + 0x10]
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xf4]
call fcn.02c812c0
push 0x38
lea eax, [ebp - 0x74]
push ebx
push eax
call fcn.02c8617f
push 0x38
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.02c8617f
push 0x80
lea eax, [ebp - 0xf4]
push ebx
push eax
call fcn.02c8617f
add esp, 0x28
pop edi
pop esi
pop ebx
leave
ret

Function at 0x2c81b92
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.02c88cfd
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
pop esi
ret