joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6a9280
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x6a935f
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x6a92f5
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.006a8a40
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6a92bf
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x6a9416
call 0x6a9307
pop edx
lea ecx, [edx + 0x139]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x6a93b7
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.006a8e60
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6a936c
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x6a9416
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.006a8e60
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x6a9414
jmp 0x6a9416
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6a9600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov edi, dword [eax]
movzx eax, byte [edx]
movzx ebp, byte [edx + 1]
movzx ecx, byte [edx + 2]
movzx esi, byte [edx + 3]
mov dword [esp + 0x18], esi
movzx esi, byte [edx + 4]
mov dword [esp + 0x14], esi
movzx ebx, byte [edx + 5]
movzx esi, byte [edx + 6]
mov dword [esp + 0x10], esi
movzx edx, byte [edx + 7]
mov byte [esp], al
mov esi, eax
mov eax, ebp
mov byte [esp + 1], al
shl esi, 0x18
shl ebp, 0x10
or ebp, esi
mov byte [esp + 2], cl
shl ecx, 8
or ecx, ebp
mov eax, dword [esp + 0x18]
or ecx, eax
mov byte [esp + 3], al
mov eax, dword [esp + 0x14]
mov byte [esp + 4], al
mov esi, eax
mov byte [esp + 5], bl
shl esi, 0x18
shl ebx, 0x10
or ebx, esi
mov eax, dword [esp + 0x10]
mov byte [esp + 6], al
shl eax, 8
or eax, ebx
or eax, edx
mov byte [esp + 7], dl
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
cmp dword [esp + 0x38], 0
je 0x6a972f
xor ebp, ebp
xor ebx, ebx
jmp 0x6a96cd
movzx edx, byte [esp + edi]
mov esi, dword [esp + 0x30]
xor dl, byte [esi + ebp]
mov esi, dword [esp + 0x34]
mov byte [esi + ebp], dl
inc edi
and edi, 7
inc ebp
cmp dword [esp + 0x38], ebp
je 0x6a96fc
test edi, edi
jne 0x6a96b0
push dword [esp + 0x3c]
lea eax, [esp + 0xc]
push eax
call fcn.006a8a40
add esp, 8
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov edx, ecx
bswap edx
mov dword [esp], edx
mov edx, eax
bswap edx
mov dword [esp + 4], edx
inc ebx
jmp 0x6a96b0
test ebx, ebx
je 0x6a972f
mov edx, ecx
shr edx, 0x18
mov esi, dword [esp + 0x40]
mov byte [esi], dl
mov edx, ecx
shr edx, 0x10
mov byte [esi + 1], dl
mov byte [esi + 2], ch
mov byte [esi + 3], cl
mov ecx, eax
shr ecx, 0x18
mov byte [esi + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 5], cl
mov byte [esi + 6], ah
mov byte [esi + 7], al
mov eax, dword [esp + 0x44]
mov dword [eax], edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6a9740
Capabilities:
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
push 0x1048
push 0x9af4a0
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
cmp esi, 0x48
mov eax, 0x48
cmovl eax, esi
add eax, edi
xor ecx, ecx
mov edx, edi
jmp 0x6a97ab
movzx edx, byte [edx]
movzx ebx, byte [ebx]
shl edx, 0x10
shl ebx, 8
or ebx, edx
movzx edx, byte [ebp]
or edx, ebx
shl edx, 8
movzx edi, byte [edi]
or edi, edx
mov ebx, dword [esp + 0x1c]
xor dword [ebx + ecx*4], edi
inc ecx
mov edx, esi
cmp ecx, 0x12
je 0x6a97f7
lea ebx, [edx + 1]
cmp ebx, eax
jae 0x6a97d0
lea ebp, [ebx + 1]
cmp ebp, eax
jae 0x6a97db
lea edi, [ebp + 1]
cmp edi, eax
jae 0x6a97e6
lea esi, [edi + 1]
cmp esi, eax
jb 0x6a9780
jmp 0x6a97f1
mov ebx, dword [esp + 0x24]
lea ebp, [ebx + 1]
cmp ebp, eax
jb 0x6a97b9
mov ebp, dword [esp + 0x24]
lea edi, [ebp + 1]
cmp edi, eax
jb 0x6a97c0
mov edi, dword [esp + 0x24]
lea esi, [edi + 1]
cmp esi, eax
jb 0x6a9780
mov esi, dword [esp + 0x24]
jmp 0x6a9780
mov dword [esp], 0
mov dword [esp + 4], 0
mov edi, esp
push ebx
push edi
call fcn.006a8a40
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx], xmm0
push ebx
push edi
call fcn.006a8a40
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 8], xmm0
push ebx
push edi
call fcn.006a8a40
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x10], xmm0
push ebx
push edi
call fcn.006a8a40
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x18], xmm0
push ebx
push edi
call fcn.006a8a40
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x20], xmm0
push ebx
push edi
call fcn.006a8a40
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x28], xmm0
push ebx
push edi
call fcn.006a8a40
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x30], xmm0
push ebx
push edi
call fcn.006a8a40
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x38], xmm0
push ebx
push edi
call fcn.006a8a40
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + 0x40], xmm0
mov esi, 0xfffffffe
push ebx
push edi
call fcn.006a8a40
add esp, 8
movsd xmm0, qword [esp]
movsd qword [ebx + esi*4 + 0x50], xmm0
add esi, 2
cmp esi, 0x3fe
jb 0x6a98c0
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b23b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
mov edi, dword [eax]
movzx eax, byte [edx]
movzx ebp, byte [edx + 1]
movzx ecx, byte [edx + 2]
movzx esi, byte [edx + 3]
mov dword [esp + 0x18], esi
movzx esi, byte [edx + 4]
mov dword [esp + 0x14], esi
movzx ebx, byte [edx + 5]
movzx esi, byte [edx + 6]
mov dword [esp + 0x10], esi
movzx edx, byte [edx + 7]
mov byte [esp], al
mov esi, eax
mov eax, ebp
mov byte [esp + 1], al
shl esi, 0x18
shl ebp, 0x10
or ebp, esi
mov byte [esp + 2], cl
shl ecx, 8
or ecx, ebp
mov eax, dword [esp + 0x18]
or ecx, eax
mov byte [esp + 3], al
mov eax, dword [esp + 0x14]
mov byte [esp + 4], al
mov esi, eax
mov byte [esp + 5], bl
shl esi, 0x18
shl ebx, 0x10
or ebx, esi
mov eax, dword [esp + 0x10]
mov byte [esp + 6], al
shl eax, 8
or eax, ebx
or eax, edx
mov byte [esp + 7], dl
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
cmp dword [esp + 0x38], 0
je 0x6b24df
xor ebp, ebp
xor ebx, ebx
jmp 0x6b247d
movzx edx, byte [esp + edi]
mov esi, dword [esp + 0x30]
xor dl, byte [esi + ebp]
mov esi, dword [esp + 0x34]
mov byte [esi + ebp], dl
inc edi
and edi, 7
inc ebp
cmp dword [esp + 0x38], ebp
je 0x6b24ac
test edi, edi
jne 0x6b2460
push dword [esp + 0x3c]
lea eax, [esp + 0xc]
push eax
call fcn.006b3200
add esp, 8
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov edx, ecx
bswap edx
mov dword [esp], edx
mov edx, eax
bswap edx
mov dword [esp + 4], edx
inc ebx
jmp 0x6b2460
test ebx, ebx
je 0x6b24df
mov edx, ecx
shr edx, 0x18
mov esi, dword [esp + 0x40]
mov byte [esi], dl
mov edx, ecx
shr edx, 0x10
mov byte [esi + 1], dl
mov byte [esi + 2], ch
mov byte [esi + 3], cl
mov ecx, eax
shr ecx, 0x18
mov byte [esi + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 5], cl
mov byte [esi + 6], ah
mov byte [esi + 7], al
mov eax, dword [esp + 0x44]
mov dword [eax], edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6b3b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x6b3c0f
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x6b3ba5
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.006b3200
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6b3b6f
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x6b3cc6
call 0x6b3bb7
pop edx
lea ecx, [edx + 0x149]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x6b3c67
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.006b36a0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6b3c1c
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x6b3cc6
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.006b36a0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x6b3cc4
jmp 0x6b3cc6
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6b9860
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x6b9930
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x6b98ce
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.006b94c0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6b98a0
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x6b99d7
call 0x6b98e0
pop edx
lea ecx, [edx + 0x120]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x6b9980
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.006b94c0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6b993d
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x6b99d7
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.006b94c0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x6b99d5
jmp 0x6b99d7
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6b9a40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x6b9b19
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x6b9ab7
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.006b9600
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6b9a89
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x6b9bc0
call 0x6b9ac9
pop edx
lea ecx, [edx + 0x137]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x6b9b69
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.006b9730
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6b9b26
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x6b9bc0
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.006b9730
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x6b9bbe
jmp 0x6b9bc0
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6ba4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
mov edi, dword [eax]
movzx esi, byte [edx]
movzx eax, byte [edx + 1]
movzx ecx, byte [edx + 2]
mov dword [esp + 0x1c], ecx
movzx ebx, byte [edx + 3]
movzx ecx, byte [edx + 4]
mov dword [esp + 0x14], ecx
movzx ebp, byte [edx + 5]
movzx ecx, byte [edx + 6]
mov dword [esp + 0x18], ecx
movzx ecx, byte [edx + 7]
mov dword [esp + 0x10], ecx
mov ecx, esi
mov byte [esp], cl
mov byte [esp + 1], al
mov esi, eax
shl esi, 8
or esi, ecx
mov edx, dword [esp + 0x1c]
mov byte [esp + 2], dl
mov byte [esp + 3], bl
mov ecx, dword [esp + 0x14]
mov byte [esp + 4], cl
mov eax, ebp
mov byte [esp + 5], al
shl eax, 8
or eax, ecx
shl edx, 0x10
or edx, esi
mov ecx, ebx
shl ecx, 0x18
or ecx, edx
mov ebx, dword [esp + 0x18]
mov byte [esp + 6], bl
shl ebx, 0x10
or ebx, eax
mov eax, dword [esp + 0x10]
mov byte [esp + 7], al
shl eax, 0x18
or eax, ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
cmp dword [esp + 0x3c], 0
je 0x6ba617
xor ebp, ebp
xor ebx, ebx
jmp 0x6ba58d
movzx edx, byte [esp + edi]
mov esi, dword [esp + 0x34]
xor dl, byte [esi + ebp]
mov esi, dword [esp + 0x38]
mov byte [esi + ebp], dl
inc edi
and edi, 7
inc ebp
cmp dword [esp + 0x3c], ebp
je 0x6ba5e8
test edi, edi
jne 0x6ba570
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x48]
lea eax, [esp + 0x14]
push eax
call fcn.006b9600
add esp, 0x10
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov byte [esp], cl
mov byte [esp + 1], ch
mov edx, ecx
shr edx, 0x10
mov byte [esp + 2], dl
mov edx, ecx
shr edx, 0x18
mov byte [esp + 3], dl
mov byte [esp + 4], al
mov byte [esp + 5], ah
mov edx, eax
shr edx, 0x10
mov byte [esp + 6], dl
mov edx, eax
shr edx, 0x18
mov byte [esp + 7], dl
inc ebx
jmp 0x6ba570
test ebx, ebx
je 0x6ba617
mov esi, dword [esp + 0x4c]
mov byte [esi], cl
mov byte [esi + 1], ch
mov edx, ecx
shr edx, 0x10
mov byte [esi + 2], dl
shr ecx, 0x18
mov byte [esi + 3], cl
mov byte [esi + 4], al
mov byte [esi + 5], ah
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 6], cl
shr eax, 0x18
mov byte [esi + 7], al
mov eax, dword [esp + 0x50]
mov dword [eax], edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6ba630
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov edi, dword [eax]
movzx esi, byte [edx]
movzx eax, byte [edx + 1]
movzx ecx, byte [edx + 2]
mov dword [esp + 0x1c], ecx
movzx ebx, byte [edx + 3]
movzx ecx, byte [edx + 4]
mov dword [esp + 0x14], ecx
movzx ebp, byte [edx + 5]
movzx ecx, byte [edx + 6]
mov dword [esp + 0x18], ecx
movzx ecx, byte [edx + 7]
mov dword [esp + 0x10], ecx
mov ecx, esi
mov byte [esp], cl
mov byte [esp + 1], al
mov esi, eax
shl esi, 8
or esi, ecx
mov edx, dword [esp + 0x1c]
mov byte [esp + 2], dl
mov byte [esp + 3], bl
mov ecx, dword [esp + 0x14]
mov byte [esp + 4], cl
mov eax, ebp
mov byte [esp + 5], al
shl eax, 8
or eax, ecx
shl edx, 0x10
or edx, esi
mov ecx, ebx
shl ecx, 0x18
or ecx, edx
mov ebx, dword [esp + 0x18]
mov byte [esp + 6], bl
shl ebx, 0x10
or ebx, eax
mov eax, dword [esp + 0x10]
mov byte [esp + 7], al
shl eax, 0x18
or eax, ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
cmp dword [esp + 0x3c], 0
je 0x6ba755
xor ebp, ebp
xor ebx, ebx
jmp 0x6ba6fd
movzx edx, byte [esp + edi]
mov esi, dword [esp + 0x34]
xor dl, byte [esi + ebp]
mov esi, dword [esp + 0x38]
mov byte [esi + ebp], dl
inc edi
and edi, 7
inc ebp
cmp dword [esp + 0x3c], ebp
je 0x6ba726
test edi, edi
jne 0x6ba6e0
push 1
push dword [esp + 0x44]
lea eax, [esp + 0x10]
push eax
call fcn.006b94c0
add esp, 0xc
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esp], ecx
mov dword [esp + 4], eax
inc ebx
jmp 0x6ba6e0
test ebx, ebx
je 0x6ba755
mov esi, dword [esp + 0x44]
mov byte [esi], cl
mov byte [esi + 1], ch
mov edx, ecx
shr edx, 0x10
mov byte [esi + 2], dl
shr ecx, 0x18
mov byte [esi + 3], cl
mov byte [esi + 4], al
mov byte [esi + 5], ah
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 6], cl
shr eax, 0x18
mov byte [esi + 7], al
mov eax, dword [esp + 0x48]
mov dword [eax], edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6cb310
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x178
push dword [esp + 0x198]
push str.SHA512
push dword [esp + 0x194]
call fcn.005b9cd0
add esp, 0xc
test eax, eax
je 0x6cb3fc
mov ebx, esp
push 0
push eax
push 0
push ebx
push 0x20
push dword [esp + 0x1a8]
mov edi, eax
call fcn.005b9b70
add esp, 0x18
mov esi, eax
push edi
call fcn.005b8780
add esp, 4
test esi, esi
je 0x6cb400
and byte [esp], 0xf8
movzx eax, byte [esp + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [esp + 0x1f], al
lea ebp, [esp + 0xd8]
mov edx, esp
mov ecx, ebp
call fcn.006c5240
lea edx, [esp + 0x128]
mov esi, ebx
lea ebx, [esp + 0xb0]
mov ecx, ebx
call fcn.006cc390
lea edi, [esp + 0x88]
mov ecx, edi
mov edx, ebp
push ebx
call fcn.006cc9e0
add esp, 4
lea edx, [esp + 0x100]
lea ebp, [esp + 0x60]
mov ecx, ebp
push ebx
mov ebx, esi
call fcn.006cc9e0
add esp, 4
mov esi, dword [esp + 0x190]
mov ecx, esi
mov edx, ebp
call fcn.006cd9a0
lea ecx, [esp + 0x40]
mov edx, edi
call fcn.006cd9a0
movzx eax, byte [esp + 0x40]
shl al, 7
xor byte [esi + 0x1f], al
mov esi, 1
jmp 0x6cb402
xor esi, esi
jmp 0x6cb40d
xor esi, esi
push 0x40
push ebx
call fcn.005e8480
add esp, 8
mov eax, esi
add esp, 0x178
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6cc170
Capabilities:
Encrypt data using curve25519
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x174
mov eax, dword [esp + 0x18c]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movups xmmword [esp + 0x8c], xmm0
movups xmmword [esp + 0x9c], xmm1
and byte [esp + 0x8c], 0xf8
movzx eax, byte [esp + 0xab]
and al, 0x3f
or al, 0x40
mov byte [esp + 0xab], al
lea ecx, [esp + 0xac]
lea edx, [esp + 0x8c]
call fcn.006c5240
mov edx, dword [esp + 0xfc]
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0xd8]
mov dword [esp + 0x34], ecx
add eax, edx
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x30], eax
lea eax, [ecx + eax]
mov dword [esp + 0x68], eax
mov ecx, dword [esp + 0x104]
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0xdc]
mov dword [esp + 0x28], eax
lea eax, [eax + ecx]
mov dword [esp + 0x6c], eax
mov ecx, dword [esp + 0x108]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0xe0]
mov dword [esp + 0x20], eax
lea eax, [eax + ecx]
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0x10c]
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xe4]
mov dword [esp + 0x18], eax
lea eax, [eax + ecx]
mov dword [esp + 0x74], eax
mov ebx, dword [esp + 0x110]
mov eax, dword [esp + 0xe8]
mov dword [esp + 0x14], eax
lea eax, [eax + ebx]
mov dword [esp + 0x78], eax
mov edi, dword [esp + 0x114]
mov eax, dword [esp + 0xec]
mov dword [esp + 0x10], eax
lea eax, [eax + edi]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0xf0]
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x118]
lea eax, [eax + edx]
mov dword [esp + 0x80], eax
mov esi, dword [esp + 0x11c]
mov eax, dword [esp + 0xf4]
mov dword [esp + 4], eax
add eax, esi
mov dword [esp + 0x84], eax
mov ecx, dword [esp + 0x120]
mov eax, dword [esp + 0xf8]
mov dword [esp], eax
lea ebp, [eax + ecx]
mov dword [esp + 0x88], ebp
mov ebp, dword [esp + 0x2c]
sub ebp, dword [esp + 0x38]
mov dword [esp + 0x3c], ebp
mov ebp, dword [esp + 0x30]
sub ebp, dword [esp + 0x34]
mov dword [esp + 0x40], ebp
mov ebp, dword [esp + 0x24]
sub ebp, dword [esp + 0x28]
mov dword [esp + 0x44], ebp
mov ebp, dword [esp + 0x1c]
sub ebp, dword [esp + 0x20]
mov dword [esp + 0x48], ebp
mov eax, dword [esp + 8]
sub eax, dword [esp + 0x18]
mov dword [esp + 0x4c], eax
sub ebx, dword [esp + 0x14]
mov dword [esp + 0x50], ebx
sub edi, dword [esp + 0x10]
mov dword [esp + 0x54], edi
sub edx, dword [esp + 0xc]
mov dword [esp + 0x58], edx
sub esi, dword [esp + 4]
mov dword [esp + 0x5c], esi
sub ecx, dword [esp]
mov dword [esp + 0x60], ecx
lea ebx, [esp + 0x14c]
lea edx, [esp + 0x3c]
mov ecx, ebx
call fcn.006cc390
lea ebp, [esp + 0x64]
mov ecx, ebp
mov edx, ebp
push ebx
call fcn.006cc9e0
add esp, 4
mov ecx, dword [esp + 0x188]
mov edx, ebp
call fcn.006cd9a0
push 0x20
lea eax, [esp + 0x90]
push eax
call fcn.005e8480
add esp, 0x17c
pop esi
pop edi
pop ebx
pop ebp
ret