joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63ff50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 4
call fcn.0053e710
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp edi, 0x800
jge 0x63ff98
call fcn.0054cc90
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x59
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.0054cd90
push 0
push pe_nt_image_headers32
push 4
call fcn.0054cea0
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push dword [esp + 0x18]
call fcn.00685a90
add esp, 4
test eax, eax
jne 0x63ffd4
call fcn.0054cc90
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x5e
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.0054cd90
push 0
push 0xb2
push 4
call fcn.0054cea0
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.00609960
push esi
call fcn.00609a40
push esi
mov dword [esp + 0x2c], eax
call fcn.00609a40
push esi
mov ebp, eax
call fcn.00609a40
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x640136
test ebp, ebp
je 0x64010d
test ebx, ebx
je 0x640104
push 4
push ebp
call fcn.005a2690
push 4
push ebx
call fcn.005a2690
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi + 0x20], 0
jne 0x64003e
call fcn.005a2a30
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x64004d
call fcn.005a2a30
mov dword [esi + 0x24], eax
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x640100
test eax, eax
je 0x640100
push 4
push ecx
call fcn.005a2690
push 4
push dword [esi + 0x24]
call fcn.005a2690
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebp
push dword [esi + 0x20]
call fcn.00685ce0
add esp, 0x3c
test eax, eax
je 0x640100
nop dword [eax]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push dword [esi + 0x24]
call fcn.00685ce0
add esp, 0x2c
test eax, eax
je 0x640100
push edi
push ebx
push ebp
push dword [esp + 0x2c]
call fcn.00685990
add esp, 0x10
test eax, eax
js 0x640100
je 0x6400a0
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esp + 0x2c]
call fcn.00685990
add esp, 0x10
test eax, eax
js 0x640100
je 0x6400a0
inc dword [esi + 0x78]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x28]
push ebp
call fcn.005a2e90
add esp, 4
test ebx, ebx
je 0x64011a
push ebx
call fcn.005a2e90
add esp, 4
push dword [esp + 0x20]
call fcn.005a2e90
push esi
call fcn.00609b80
mov eax, dword [esp + 0x18]
add esp, 8
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x64010d
jmp 0x640104
Function at 0x650f10
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.0053e710
mov eax, dword [0x7ec540]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x14]
lea edx, [esp]
mov ecx, dword [esp + 0x10]
push esi
push edi
mov esi, dword [eax + 0xc]
mov edi, dword [eax]
push edx
push dword [eax + 8]
push dword [eax + 4]
push ecx
call fcn.006520c0
add esp, 0x10
test eax, eax
jne 0x650f5c
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00541f33
add esp, 0xc
ret
mov cl, byte [edi]
shr cl, 3
not cl
and cl, 0x10
or cl, 0xf
and cl, byte [esp + 8]
xor cl, byte [edi]
mov byte [edi], cl
and cl, 3
add cl, 1
je 0x650f90
lea edx, [esp + 9]
movzx ecx, cl
sub edx, esi
mov al, byte [edx + esi]
lea esi, [esi + 1]
xor byte [esi - 1], al
sub ecx, 1
jne 0x650f82
mov ecx, dword [esp + 0x10]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.00541f33
add esp, 0xc
ret

Function at 0x650fb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.0053e710
mov eax, dword [0x7ec540]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x14]
lea edx, [esp]
mov ecx, dword [esp + 0x10]
push esi
push edi
mov esi, dword [eax + 0xc]
mov edi, dword [eax]
push edx
push dword [eax + 8]
push dword [eax + 4]
push ecx
call fcn.006520c0
add esp, 0x10
test eax, eax
jne 0x650ffc
pop edi
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00541f33
add esp, 0xc
ret
mov al, byte [edi]
and al, 3
add al, 1
je 0x65101e
lea edx, [esp + 9]
movzx ecx, al
sub edx, esi
nop dword [eax]
mov al, byte [edx + esi]
lea esi, [esi + 1]
xor byte [esi - 1], al
sub ecx, 1
jne 0x651010
mov cl, byte [edi]
mov eax, 1
shr cl, 3
not cl
and cl, 0x10
or cl, 0xf
and cl, byte [esp + 8]
xor byte [edi], cl
mov ecx, dword [esp + 0x10]
pop edi
pop esi
xor ecx, esp
call fcn.00541f33
add esp, 0xc
ret
Function at 0x657480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x9c
call fcn.0053e710
mov eax, dword [0x7ec540]
xor eax, esp
mov dword [esp + 0x98], eax
mov ecx, dword [esp + 0xa8]
mov eax, dword [esp + 0xb8]
mov dword [esp + 0x24], eax
push ebx
mov eax, dword [ecx]
mov ebx, dword [esp + 0xa8]
push ebp
push edi
movzx ebp, byte [eax]
mov eax, dword [esp + 0xb8]
mov edi, dword [esp + 0xac]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x24], ecx
cmp eax, 3
ja case.0x6574d4.2
jmp dword [eax*4 + 0x658608]
mov dword [esp + 0x20], 0
jmp 0x6574f7
mov dword [esp + 0x20], 1
jmp 0x6574f7
mov dword [esp + 0x20], 2
cmp dword [ebx + 4], 0
jne 0x65753e
push str.depack_process_frames
push 0x425
push str.sslquicquic_rx_depack.c
push 0
push str.empty_packet_payload
push 0
push 0
push 0
push 0xa
push edi
call fcn.005eaae0
add esp, 0x28
xor eax, eax
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.00541f33
add esp, 0x9c
ret
push esi
nop
cmp dword [edi + 0x2d4], 0
xorps xmm0, xmm0
mov dword [esp + 0x38], 0
movlpd qword [esp + 0x3c], xmm0
je 0x657560
mov eax, dword [ebx]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x30]
push eax
push ebx
call fcn.00655740
add esp, 0xc
test eax, eax
je 0x6585c5
cmp dword [esp + 0x44], 0
je 0x6585a5
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
test ebx, ebx
ja 0x6575a7
jb 0x657599
cmp esi, 0x1d
ja 0x6575a7
movzx eax, byte [esi + 0x658620]
jmp dword [eax*4 + 0x658618]
mov eax, dword [esp + 0x34]
or dword [eax + 0x10], 4
jmp 0x6575b5
test ebx, ebx
ja 0x658587
jb 0x6575c8
cmp esi, 0x1e
ja 0x658587
jmp dword [esi*4 + 0x658640]
push str.depack_process_frames
push 0x567
push str.sslquicquic_rx_depack.c
push 0
push str.Unknown_frame_type_received
push ebx
push esi
push 0
push 7
jmp 0x6585e3
push str.depack_process_frames
push 0x43e
push str.sslquicquic_rx_depack.c
push 0
push str.non_minimal_frame_type_encoding
push dword [esp + 0x44]
push dword [esp + 0x44]
jmp 0x6585df
push str.depack_process_frames
push 0x436
push str.sslquicquic_rx_depack.c
push 0
push str.malformed_frame_header
push 0
push 0
push 0
push 0xa
push edi
call fcn.005eaae0
add esp, 0x28
xor eax, eax
mov ecx, dword [esp + 0xa8]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00541f33
add esp, 0x9c
ret
Function at 0x65c010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x294
call fcn.0053e710
mov eax, dword [0x7ec540]
xor eax, esp
mov dword [esp + 0x290], eax
push ebx
mov ebx, dword [esp + 0x2a4]
push ebp
push esi
mov esi, dword [esp + 0x2a4]
push edi
mov edi, dword [esp + 0x2ac]
push 0
mov eax, dword [edi + 4]
mov ebp, dword [edi]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.00655740
add esp, 0xc
test eax, eax
je 0x65c8f6
cmp dword [esp + 0x1c], 0
ja 0x65c89e
mov eax, dword [esp + 0x18]
jb 0x65c07c
cmp eax, 0x1e
ja 0x65c89e
movzx eax, byte [eax + 0x65c960]
jmp dword [eax*4 + 0x65c910]
push 0x7a9608
push 0x7b2ba0
push esi
call fcn.006534c0
push dword [esp + 0x28]
push dword [esp + 0x28]
push str.frame_type_value
push esi
call fcn.00653520
push 0x79e1d4
push esi
call fcn.00653440
push dword [esp + 0x44]
push ebp
push 0x7bfcd8
push esi
call fcn.00653580
push esi
call fcn.00653470
mov eax, dword [edi + 4]
add esp, 0x38
add dword [edi], eax
mov dword [edi + 4], 0
mov eax, 1
mov ecx, dword [esp + 0x2a0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00541f33
add esp, 0x294
ret
Function at 0x66b460
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x66b529
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x66b481
cmp al, 0x6b
jne 0x66b529
inc ecx
cmp al, 0x6b
jne 0x66b4e2
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x66b4a2
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x66b4a2
cmp dl, 0xbb
jne 0x66b4b6
inc eax
cmp eax, esi
jl 0x66b490
sub esi, eax
test eax, eax
jne 0x66b4e5
call fcn.0054cc90
push str.RSA_padding_check_X931
push 0x56
jmp 0x66b4c2
call fcn.0054cc90
push str.RSA_padding_check_X931
push 0x4e
push str.crypto_rsa_rsa_x931.c
call fcn.0054cd90
push 0
push 0x8a
push 4
call fcn.0054cea0
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x66b517
call fcn.0054cc90
push str.RSA_padding_check_X931
push 0x5f
push str.crypto_rsa_rsa_x931.c
call fcn.0054cd90
push 0
push 0x8b
push 4
call fcn.0054cea0
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call fcn.006fb4d0
add esp, 0xc
mov eax, esi
pop esi
ret
call fcn.0054cc90
push str.RSA_padding_check_X931
push 0x43
push str.crypto_rsa_rsa_x931.c
call fcn.0054cd90
push 0
push 0x89
push 4
call fcn.0054cea0
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
Function at 0x66b5b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.0053e710
mov ecx, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x24]
shr ecx, 3
mov dword [esp + 8], ecx
cmp esi, dword [esp + 0x28]
jb 0x66b7c8
push ebx
push ebp
push edi
nop word [eax + eax]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x66b7a2
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
movzx eax, byte [ecx + 7]
cdq
mov ebp, eax
mov ebx, edx
movzx eax, byte [ecx + 6]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 5]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 4]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 3]
cdq
mov ecx, ebp
shld ebx, ecx, 8
mov edi, edx
mov dword [esp + 0x20], ebp
shl ecx, 8
or edi, ebx
or eax, ecx
and ebp, 0x55555555
mov ecx, dword [esp + 0x2c]
mov ebx, eax
mov dword [esp + 0x18], eax
shld edi, ebx, 8
movzx eax, byte [ecx + 2]
cdq
shl ebx, 8
or edi, edx
or ebx, eax
movzx eax, byte [ecx + 1]
cdq
shld edi, ebx, 8
shl ebx, 8
or edi, edx
or ebx, eax
movzx eax, byte [ecx]
cdq
add ecx, 8
shld edi, ebx, 8
mov dword [esp + 0x2c], ecx
shl ebx, 8
or ebx, eax
mov eax, ebx
and eax, 0x55555555
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
and ecx, 0xff00ff
mov dword [esp + 0x18], ecx
mov ecx, ebp
shr ecx, 1
or ecx, ebp
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ebp, eax
shr ebp, 4
or ebp, eax
and ebx, 0xaaaaaaaa
and ebp, 0xff00ff
lea eax, [ebx + ebx]
or eax, ebx
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
and ecx, 0xf0f0f0f0
mov edi, ecx
shl edi, 4
or edi, ecx
mov ecx, dword [esp + 0x20]
and ecx, 0xaaaaaaaa
and edi, 0xff00ff00
mov ebx, edi
and edi, 0xffff00
shr ebx, 8
or ebx, edi
lea eax, [ecx + ecx]
shr ebx, 8
or eax, ecx
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
and ecx, 0xf0f0f0f0
mov edx, ecx
shl edx, 4
or edx, ecx
mov ecx, ebp
and edx, 0xff00ff00
shl ebp, 8
mov eax, edx
and ecx, 0xffffff00
shl eax, 8
or ecx, ebp
or eax, edx
shl ecx, 8
and eax, 0xffff0000
xor edx, edx
or ebx, eax
mov eax, dword [esp + 0x18]
shr eax, 8
or eax, dword [esp + 0x18]
movzx eax, ax
or ecx, eax
mov eax, dword [esp + 0x10]
or edx, ecx
mov ecx, dword [esp + 0x28]
xor dword [ecx + eax*8], edx
xor dword [ecx + eax*8 + 4], ebx
inc eax
mov dword [esp + 0x10], eax
cmp eax, esi
jb 0x66b5f4
mov esi, dword [esp + 0x30]
jmp 0x66b7a6
mov ecx, dword [esp + 0x28]
push ecx
call fcn.0066c180
sub esi, dword [esp + 0x38]
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], esi
cmp esi, dword [esp + 0x34]
jae 0x66b5e0
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
add esp, 0x14
ret
Function at 0x66e2b0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp ebp, 2
je 0x66e389
mov esi, dword [esp + 0x10]
test esi, esi
je 0x66e33e
push esi
push 0
lea eax, [esp + 0x28]
push eax
push 0
call fcn.00593a10
add esp, 0x10
cmp dword [esp + 0x20], 0xffffffff
je 0x66e312
call fcn.0054cc90
push str.ossl_ecx_key_op
push 0xa9
push str.cryptoececx_backend.c
call fcn.0054cd90
push 0
push 0x66
push 0x10
call fcn.0054cea0
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebp
ret
mov eax, dword [esi]
mov esi, dword [esp + 0x1c]
push eax
call fcn.00558510
add esp, 4
test esi, esi
jne 0x66e329
mov esi, eax
jmp 0x66e342
cmp esi, eax
je 0x66e342
call fcn.0054cc90
push str.ossl_ecx_key_op
push 0xaf
jmp 0x66e2f4
mov esi, dword [esp + 0x1c]
test edi, edi
je 0x66e375
test esi, esi
je 0x66e375
cmp esi, 0x40a
je 0x66e36a
cmp esi, 0x43f
je 0x66e36a
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x66e36f
mov eax, 0x20
cmp dword [esp + 0x18], eax
je 0x66e38d
call fcn.0054cc90
push str.ossl_ecx_key_op
push 0xb5
jmp 0x66e2f4
mov esi, dword [esp + 0x1c]
cmp esi, 0x40a
je 0x66e3b1
cmp esi, 0x43f
je 0x66e3b1
xor eax, eax
cmp esi, 0x40b
setne al
lea eax, [eax*2 + 1]
jmp 0x66e3c1
xor ecx, ecx
mov eax, 2
cmp esi, 0x40a
cmove eax, ecx
push ebx
push dword [esp + 0x2c]
push 1
push eax
push dword [esp + 0x34]
call fcn.005c4700
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x66e40b
call fcn.0054cc90
push str.ossl_ecx_key_op
push 0xbc
push str.cryptoececx_backend.c
call fcn.0054cd90
push ebx
push 0x80010
push 0x10
call fcn.0054cea0
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
test ebp, ebp
jne 0x66e427
push dword [esp + 0x1c]
lea eax, [ebx + 0xc]
push edi
push eax
call fcn.006fb4d0
add esp, 0xc
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
push ebx
call fcn.005c47c0
mov edi, eax
add esp, 4
test edi, edi
jne 0x66e45a
call fcn.0054cc90
push str.ossl_ecx_key_op
push 0xc6
push str.cryptoececx_backend.c
call fcn.0054cd90
push edi
push 0x80010
jmp 0x66e530
cmp ebp, 2
jne 0x66e4cc
test esi, esi
je 0x66e4ff
cmp esi, 0x40a
je 0x66e487
cmp esi, 0x43f
je 0x66e487
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x66e48c
mov eax, 0x20
push 0
push eax
push edi
push dword [esp + 0x34]
call fcn.0058ca40
add esp, 0x10
test eax, eax
jle 0x66e53a
cmp esi, 0x40a
jne 0x66e4bb
mov al, byte [edi + 0x1f]
and byte [edi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [edi + 0x1f], al
jmp 0x66e4ff
cmp esi, 0x40b
jne 0x66e4ff
and byte [edi], 0xfc
or byte [edi + 0x37], 0x80
jmp 0x66e4ff
cmp esi, 0x40a
je 0x66e4ec
cmp esi, 0x43f
je 0x66e4ec
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x66e4f1
mov eax, 0x20
push eax
push dword [esp + 0x1c]
push edi
call fcn.006fb4d0
add esp, 0xc
push ebx
call fcn.0066e550
add esp, 4
test eax, eax
jne 0x66e420
call fcn.0054cc90
push str.ossl_ecx_key_op
push 0xda
push str.cryptoececx_backend.c
call fcn.0054cd90
push 0
push 0xa6
push 0x10
call fcn.0054cea0
add esp, 0x18
push ebx
call fcn.005c47e0
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x6770f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.0053e710
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [eax + 0x64]
push esi
mov esi, dword [esp + 0x28]
push edi
mov ecx, dword [ebp + 0x70]
mov edi, dword [esp + 0x28]
mov dword [esp + 0x10], ebp
test ecx, ecx
je 0x677159
test ebx, ebx
je 0x677139
lea edx, [ebp + 0x30]
add edx, ecx
cmp ecx, 0x40
jae 0x677139
mov al, byte [edx]
inc ecx
xor al, byte [esi]
inc edx
mov byte [edi], al
inc esi
inc edi
sub ebx, 1
jne 0x677125
mov dword [ebp + 0x70], ecx
test ebx, ebx
je 0x677214
cmp ecx, 0x40
jne 0x677159
mov dword [ebp + 0x70], 0
add dword [ebp + 0x20], 1
jne 0x677159
inc dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
mov eax, ebx
and eax, 0x3f
sub ebx, eax
mov dword [esp + 0x1c], eax
lea eax, [ebp + 0x20]
mov dword [esp + 0x24], eax
cmp ebx, 0x40
jb 0x6771c7
push dword [esp + 0x24]
mov ecx, ebx
xor ebp, ebp
shr ecx, 6
lea eax, [ecx + edx]
cmp eax, ecx
cmovae ebp, eax
neg edx
cmp eax, ecx
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x14]
cmovae edx, ecx
shl edx, 6
push ebp
push edx
push esi
push edi
mov dword [esp + 0x28], edx
call fcn.005318c0
mov eax, dword [esp + 0x28]
add esp, 0x14
sub ebx, eax
add esi, eax
add edi, eax
mov eax, dword [esp + 0x18]
mov dword [ebp + 0x20], eax
test eax, eax
jne 0x6771c0
inc dword [ebp + 0x24]
mov edx, eax
cmp ebx, 0x40
jae 0x677173
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x677214
push 0x40
lea eax, [ebp + 0x30]
push 0
push eax
call fcn.006fba50
lea eax, [ebp + 0x20]
push eax
push ebp
lea eax, [ebp + 0x30]
push 0x40
push eax
push eax
call fcn.005318c0
add esp, 0x20
xor edx, edx
test ebx, ebx
je 0x677211
sub esi, edi
nop dword [eax + eax]
mov al, byte [edx + ebp + 0x30]
lea ecx, [edx + edi]
xor al, byte [esi + ecx]
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x677200
mov dword [ebp + 0x70], ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
Function at 0x687670
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.0053e710
mov edx, dword [esp + 0x18]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x34]
or ecx, 0xffffffff
push ebp
mov ebp, dword [esp + 0x34]
cmp ebp, 1
push esi
mov esi, dword [edx]
setne al
add eax, ebx
mov dword [esp + 0x1c], esi
cmp eax, esi
jbe 0x6876a9
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
cmp ebp, 1
je 0x687774
mov ecx, dword [esp + 0x2c]
dec ecx
add ecx, esi
cmp dword [esp + 0x40], 0
mov dword [esp + 0x10], ecx
mov cl, byte [ecx]
mov byte [esp + 0xf], cl
movzx ebp, cl
je 0x6876e0
sub esi, ebp
mov eax, 1
sub esi, ebx
dec esi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
lea ecx, [eax + ebp]
mov ebx, esi
sub ebx, ecx
mov eax, esi
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, 0x100
xor ebx, esi
shr ebx, 0x1f
dec ebx
cmp esi, eax
push edi
cmovb eax, esi
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
je 0x687757
mov esi, dword [esp + 0x14]
mov edx, ebp
shr edx, 0x1f
mov dword [esp + 0x1c], edx
mov ecx, ebp
lea esi, [esi - 1]
sub ecx, edi
mov eax, edi
shr ecx, 0x1f
inc edi
shr eax, 0x1f
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [esp + 0x13]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [esi + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x1c]
cmp edi, dword [esp + 0x18]
jb 0x687717
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
not ebx
lea eax, [ebp + 1]
mov ebp, dword [esp + 0x3c]
movzx ecx, bl
mov ebx, dword [esp + 0x40]
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub esi, eax
mov dword [edx], esi
pop edi
push dword [esp + 0x44]
push ecx
push ebx
push ebp
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x44]
push edx
call fcn.006877a0
add esp, 0x24
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x68c2d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x30
call fcn.0053e710
mov eax, dword [0x7ec540]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push ebp
push esi
push edi
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x50]
movzx ecx, byte [edx]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x1c], eax
mov bl, byte [edx + 3]
mov esi, dword [eax]
movzx eax, byte [edx + 1]
shl eax, 8
or ecx, eax
mov ebp, dword [esp + 0x4c]
movzx eax, byte [edx + 2]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x20], edx
movzx eax, bl
shl eax, 0x18
or ecx, eax
mov byte [esp + 0x37], bl
movzx eax, byte [edx + 5]
shl eax, 8
movzx edi, byte [edx + 4]
mov dl, byte [edx + 7]
or edi, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], ecx
movzx ecx, dl
shl ecx, 8
movzx eax, byte [eax + 6]
or ecx, eax
mov dword [esp + 0x14], 0
mov eax, ecx
mov byte [esp + 0x3a], cl
shl eax, 0x10
or edi, eax
mov byte [esp + 0x3b], dl
mov eax, dword [esp + 0x10]
mov ebx, edi
mov dword [esp + 0x24], eax
mov byte [esp + 0x34], al
shr eax, 8
mov byte [esp + 0x35], al
mov eax, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x36], al
mov eax, ebx
shr eax, 8
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], al
test ebp, ebp
je 0x68c47b
mov edi, dword [esp + 0x44]
sub dword [esp + 0x18], edi
dec ebp
test esi, esi
jne 0x68c420
push 1
push dword [esp + 0x34]
lea eax, [esp + 0x2c]
push eax
call fcn.00526380
mov ecx, dword [esp + 0x30]
add esp, 0xc
mov ebx, dword [esp + 0x28]
mov eax, ecx
shr eax, 8
mov edx, dword [esp + 0x14]
mov byte [esp + 0x35], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x36], al
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x37], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x39], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x3a], al
mov eax, ebx
shr eax, 0x18
inc edx
mov dword [esp + 0x10], ecx
mov byte [esp + 0x34], cl
mov byte [esp + 0x38], bl
mov byte [esp + 0x3b], al
mov dword [esp + 0x14], edx
jmp 0x68c424
mov edx, dword [esp + 0x14]
mov al, byte [esp + esi + 0x34]
inc esi
mov ecx, dword [esp + 0x18]
and esi, 7
xor al, byte [edi]
mov byte [ecx + edi], al
inc edi
mov ecx, dword [esp + 0x10]
test ebp, ebp
jne 0x68c3b3
test edx, edx
je 0x68c47b
mov edx, dword [esp + 0x20]
mov eax, ecx
shr eax, 8
mov byte [edx + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 2], al
mov eax, ebx
shr eax, 8
mov byte [edx + 5], al
mov eax, ebx
mov byte [edx], cl
shr ecx, 0x18
shr eax, 0x10
mov byte [edx + 4], bl
shr ebx, 0x18
mov byte [edx + 3], cl
mov byte [edx + 6], al
mov byte [edx + 7], bl
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x3c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00541f33
add esp, 0x30
ret