joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e8590
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
mov ebp, ecx
push edi
mov dword [esp + 0x1c], ebp
call fcn.004dc8d0
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
jns 0x4e85c2
mov dword [esp + 0x2c], 0
jmp 0x4e85dd
mov ecx, ebp
call fcn.004dc8d0
xor ecx, ecx
xor edx, edx
mov cx, word [esi + 2]
mov dx, word [esi + 6]
sub eax, ecx
sub eax, edx
mov dword [esp + 0x2c], eax
mov ecx, ebp
call fcn.004dc8d0
xor edi, edi
mov ebx, eax
mov di, word [esi]
xor ecx, ecx
mov cx, word [esi + 4]
xor edx, edx
xor eax, eax
mov dx, di
mov ax, word [esi + 2]
sub ebx, eax
lea esi, [ecx + edx]
mov ecx, ebp
mov dword [esp + 0x20], ebx
call fcn.004dc8e0
cmp eax, esi
jae 0x4e861d
mov ecx, ebp
call fcn.004dc8e0
mov dword [esp + 0x10], eax
jmp 0x4e8621
mov dword [esp + 0x10], esi
mov ecx, dword [esp + 0x28]
call fcn.004dc700
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
cmp ebp, ebx
jge 0x4e868d
mov eax, dword [esp + 0x10]
mov esi, edi
cmp edi, eax
jge 0x4e8688
mov eax, dword [esp + 0x2c]
mov ebx, ebp
sub ebx, eax
mov ecx, dword [esp + 0x28]
mov eax, esi
sub eax, edi
push ebx
push eax
call fcn.004dccb0
mov edx, dword [esp + 0x18]
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x14]
mov ecx, eax
and ecx, 0xff
cmp ecx, edx
je 0x4e867b
mov ecx, dword [esp + 0x1c]
push eax
push ebp
push esi
call fcn.004dd120
mov eax, dword [esp + 0x10]
inc esi
cmp esi, eax
jl 0x4e8648
mov ebx, dword [esp + 0x20]
inc ebp
cmp ebp, ebx
jl 0x4e8636
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x4fc434
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4fc454
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004ff97e
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4fc477
test byte [esp + 8], 2
je 0x4fc477
call fcn.004ff9f1
mov dword [eax], 0xd
call fcn.004ff9fa
mov dword [eax], 5
jmp 0x4fc450
xor eax, eax
ret
Function at 0x5142d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.004fc4a0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x51439b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x51439b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x51434e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x514359
or bh, 8
and edi, 0x8000000
je 0x514374
mov eax, dword [0x6616dc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x51439b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x514770
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x51479b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x5147bf
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x5147da
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x516690
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x5166aa
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x5166aa
mov edx, dword [esp + 8]
push edx
push ecx
call eax
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x518280
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 8], esi
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
push eax
push ecx
push 1
call fcn.00519c70
add esp, 0xc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, esi
jne 0x5182b3
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
mov eax, 0xf4240
mov dword [edx + 0x258], eax
mov ecx, dword [ebp - 4]
push 0x40
mov dword [ecx + 0x25c], eax
push fcn.004ff1f4
mov edx, dword [ebp - 4]
push edx
call fcn.00516630
push esi
push eax
call fcn.004ff270
add esp, 0x14
test eax, eax
je 0x5182ef
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x18]
push eax
push ecx
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00519e90
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.005166f0
mov edi, dword [ebp + 8]
add esp, 0x20
cmp edi, esi
mov ebx, 0x20000
je 0x518359
push 0
call fcn.00516e20
mov dl, byte [esi + edi]
mov cl, byte [eax + esi]
add esp, 4
cmp dl, cl
je 0x518347
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x70]
or ecx, ebx
mov dword [eax + 0x70], ecx
push 0
call fcn.00516e20
mov al, byte [eax + esi]
add esp, 4
inc esi
test al, al
jne 0x518328
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x70]
test ebx, eax
je 0x5183d1
test edi, edi
je 0x5183ca
mov bl, byte [edi]
push 0
call fcn.00516e20
mov cl, byte [eax]
add esp, 4
cmp bl, cl
jne 0x51839d
cmp bl, 0x31
jne 0x518392
push 0
call fcn.00516e20
mov dl, byte [edi + 2]
mov cl, byte [eax + 2]
add esp, 4
cmp dl, cl
jne 0x51839d
cmp byte [edi], 0x30
jne 0x5183d1
cmp byte [edi + 2], 0x39
jge 0x5183d1
test edi, edi
je 0x5183ca
push 0
call fcn.00516e20
push eax
push edi
push str.Application_built_with_libpng__.20s_but_running_with__.20s
lea eax, [ebp - 0x58]
push 0x50
push eax
call fcn.004ff558
lea ecx, [ebp - 0x58]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00516450
add esp, 0x20
mov dword [ebp - 8], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 8]
test eax, eax
jne 0x51841f
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xb4]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00519e60
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xb0]
test eax, eax
jne 0x518418
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
test eax, eax
je 0x51845c
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xb0]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00519e10
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x20]
push ecx
mov dword [eax + 0xb0], 0
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00519d10
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.00519bf0
mov edx, dword [ebp - 4]
push edx
call fcn.00518980
add esp, 0x14
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x525540
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x525570
push esi
call fcn.00525a40
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x525569
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x5255f3
mov eax, dword [esi + 0x1a0]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x5255df
mov eax, dword [esi + 8]
test eax, eax
je 0x525594
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1a0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x5255db
cmp eax, 2
je 0x5255df
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x525587
cmp eax, 3
je 0x5255ba
cmp eax, 1
jne 0x525587
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x525587
mov edx, dword [esi + 0x120]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x525587
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.00525620
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x525613
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.00525620
add esp, 4
pop esi
ret
Function at 0x5541cd
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x554205
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00552c9f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00552c76
jmp 0x554211
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x554215
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x65ddd8
mov ecx, edi
call fcn.00552978
cmp dword [esi + 0x34], 0
push dword [esp + 0xc]
jne 0x554268
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x55427b
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.00552c9f
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, edi
call fcn.00552c76
jmp 0x55427b
mov ecx, esi
call fcn.005563d9
test eax, eax
je 0x55427b
push edi
mov ecx, eax
call fcn.005541cd
mov eax, dword [edi]
pop edi
pop esi
mov eax, dword [eax - 8]
ret 8

Function at 0x555b50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x555b92
call fcn.00566f78
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x555b92
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x555b89
xor eax, eax
jmp 0x555b9a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00555ba0
pop edi
pop esi
pop ebx
ret 4

Function at 0x557403
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x557425
cmp dword [edi + 0x3c], 0
jne 0x557425
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.00566f78
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.00557452
pop edi
pop esi
pop ebx
ret 8
Function at 0x567bce
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.00566f78
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x567c0b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x567c0b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x567c0f
xor eax, eax
jmp 0x567c8d
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.00552dd0
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x567c47
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x567c31
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.00567d7e
push ebx
mov edi, eax
call fcn.00552df9
test edi, edi
pop ecx
je 0x567c89
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.00567b47
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.00567c92
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4
Function at 0x1000152f
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
cmp ecx, eax
je 0x1000154d
cmp dword [esp + 8], eax
jbe 0x1000154d
mov dl, byte [esp + 0xc]
xor byte [eax + ecx], dl
inc eax
cmp eax, dword [esp + 8]
jb 0x1000153f
ret

Function at 0x10001765
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push edi
test al, 3
jne 0x100017b0
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x100017b0
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x100017b0
mov ecx, dword [ebp + 0x10]
mov dword [edi], ecx
test eax, eax
jbe 0x100017ac
push esi
lea esi, [eax - 1]
shr esi, 2
inc esi
push 4
lea eax, [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.msvcrt.dll_memmove]
mov eax, dword [ebp + 0xc]
xor dword [edi], eax
add esp, 0xc
add ebx, 0x10
dec esi
jne 0x10001790
pop esi
xor eax, eax
jmp 0x100017b3
or eax, 0xffffffff
pop edi
pop ebx
pop ebp
ret

Function at 0x10001fbf
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x1000806c]
xor eax, ebp
mov dword [ebp + 0x8c], eax
push ebx
mov ebx, dword [ebp + 0xa0]
push esi
mov esi, dword [ebp + 0x9c]
push edi
xor edi, edi
push 0x100
lea eax, [ebp - 0x74]
push edi
push eax
mov dword [ebp - 0x7c], edi
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x30
pop ecx
lea eax, [ebp - 0x74]
push 0xa
sub eax, ecx
pop edx
mov byte [eax + ecx], cl
inc ecx
dec edx
jne 0x1000200b
push 0x41
pop ecx
lea eax, [ebp - 0x6a]
push 0x1a
sub eax, ecx
pop edx
mov byte [eax + ecx], cl
inc ecx
dec edx
jne 0x1000201d
push 0x61
pop ecx
lea eax, [ebp - 0x50]
push 0x1a
sub eax, ecx
pop edx
mov byte [eax + ecx], cl
inc ecx
dec edx
jne 0x1000202f
cmp dword [ebp + 0xa4], edi
mov dword [ebp - 0x78], edi
jle 0x1000209e
mov edi, dword [ebp + 0x98]
mov dword [ebp - 0x80], ebx
sub edi, esi
sub dword [ebp - 0x80], esi
inc dword [ebp - 0x7c]
call fcn.100017ca
cdq
push 0x3e
pop ecx
idiv ecx
mov bl, byte [ebp + edx - 0x74]
call fcn.100017ca
cdq
push 0x3e
pop ecx
idiv ecx
movzx eax, byte [ebp + 0xa8]
movzx ecx, bl
imul ecx, eax
mov dl, byte [ebp + edx - 0x74]
movzx eax, dl
xor ecx, eax
cmp cl, byte [edi + esi]
jne 0x1000204f
mov eax, dword [ebp - 0x80]
inc dword [ebp - 0x78]
mov byte [esi], bl
mov byte [eax + esi], dl
mov eax, dword [ebp - 0x78]
inc esi
cmp eax, dword [ebp + 0xa4]
jl 0x1000204f
mov ecx, dword [ebp + 0x8c]
mov eax, dword [ebp - 0x7c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10005820
add ebp, 0x90
leave
ret
Function at 0x100030a5
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov cl, byte [edx]
xor eax, eax
movzx ecx, cl
or ecx, 0x20
rol eax, 5
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x100030ad
ret

Function at 0x100030c0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x1000806c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0x40
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x70], edi
jbe 0x10003115
lea eax, [ebp - 0x6c]
push eax
call sym.trfo_2.dll_TfMd5Init
push dword [ebp + 0x10]
lea eax, [ebp - 0x6c]
push edi
push eax
call sym.trfo_2.dll_TfMd5Update
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x6c]
push eax
call sym.trfo_2.dll_TfMd5Final
lea eax, [ebp - 0x14]
add esp, 0x18
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x10], 0x10
push 0x41
lea ebx, [esi + 0x58]
push 0
push ebx
call sub.msvcrt.dll_memset
push 0x41
lea edi, [esi + 0x99]
push 0
push edi
call sub.msvcrt.dll_memset
push dword [ebp + 0x10]
push dword [ebp - 0x70]
push ebx
call sub.msvcrt.dll_memcpy
push dword [ebp + 0x10]
push dword [ebp - 0x70]
push edi
call sub.msvcrt.dll_memcpy
add esp, 0x30
push 0x40
pop eax
xor byte [edi - 0x41], 0x36
xor byte [edi], 0x5c
inc edi
dec eax
jne 0x10003150
push esi
call sym.trfo_2.dll_TfMd5Init
push 0x40
push ebx
push esi
call sym.trfo_2.dll_TfMd5Update
mov ecx, dword [ebp - 4]
add esp, 0x10
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10005820
leave
ret

Function at 0x100031c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0x100073a8
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_fopen]
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1000326e
push ebx
mov ebx, dword [sym.imp.msvcrt.dll_fseek]
push 2
push 0
push edi
call ebx
add esp, 0xc
test eax, eax
je 0x10003200
push edi
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
xor eax, eax
jmp 0x1000326d
push esi
push edi
call dword [sym.imp.msvcrt.dll_ftell]
mov esi, dword [ebp + 0xc]
pop ecx
mov dword [esi], eax
cmp eax, 0xffffffff
je 0x10003221
push 0
push 0
push edi
call ebx
add esp, 0xc
test eax, eax
je 0x10003224
push edi
jmp 0x10003238
push 1
push dword [esi]
call dword [sym.imp.msvcrt.dll_calloc]
pop ecx
pop ecx
mov dword [ebp - 4], eax
push edi
test eax, eax
jne 0x10003240
call dword [sym.imp.msvcrt.dll_fclose]
jmp 0x10003264
push dword [esi]
push 1
push eax
call dword [sym.imp.msvcrt.dll_fread]
push edi
mov ebx, eax
call dword [sym.imp.msvcrt.dll_fclose]
add esp, 0x14
cmp ebx, dword [esi]
je 0x10003269
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
xor eax, eax
jmp 0x1000326c
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop edi
leave
ret
Function at 0x10003271
Capabilities:
Write file on windows

Disassembly:
push edi
push 0x100073ac
push dword [esp + 0xc]
call dword [sym.imp.msvcrt.dll_fopen]
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x1000328b
pop edi
ret
push esi
push edi
push dword [esp + 0x18]
push 1
push dword [esp + 0x1c]
call dword [sym.imp.msvcrt.dll_fwrite]
push edi
mov esi, eax
call dword [sym.imp.msvcrt.dll_fclose]
mov eax, esi
sub eax, dword [esp + 0x28]
add esp, 0x14
neg eax
sbb eax, eax
not eax
and eax, esi
pop esi
pop edi
ret
Function at 0x10003435
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 0x14]
xor eax, eax
inc eax
push esi
mov ecx, ebx
shl eax, cl
push edi
push 0x10
pop ecx
mov dword [ebp - 0x28], eax
xor eax, eax
sub ecx, ebx
inc eax
shl eax, cl
xor dl, dl
xor esi, esi
mov dword [ebp - 0x24], eax
test ebx, ebx
jle 0x1000346d
mov ecx, esi
mov al, 1
shl al, cl
xor dl, al
inc esi
cmp esi, ebx
jl 0x10003460
mov eax, dword [ebp + 0xc]
xor edi, edi
cmp dword [ebp + 0x10], edi
mov byte [eax], bl
push 3
mov byte [eax + 1], dl
mov dword [ebp - 8], edi
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], 2
mov byte [eax + 2], 0
pop esi
mov dword [ebp - 0x10], edi
jle 0x10003599
and dword [ebp - 0xc], 0
or dword [ebp - 0x20], 0xffffffff
mov ecx, edi
sub ecx, dword [ebp - 0x24]
inc ecx
cmp ecx, edi
jge 0x10003530
mov edx, dword [ebp + 8]
add edx, edi
mov dword [ebp - 0x1c], edx
test ecx, ecx
jge 0x100034bc
xor ecx, ecx
mov edx, dword [ebp + 8]
mov ebx, dword [ebp - 0x1c]
mov bl, byte [ebx]
add edx, ecx
cmp byte [edx], bl
jne 0x10003528
mov edx, dword [ebp + 8]
mov dl, byte [ecx + edx + 1]
mov ebx, dword [ebp - 0x1c]
mov dword [ebp + 0xc], 1
cmp dl, byte [ebx + 1]
jne 0x1000351a
mov dword [ebp - 0x14], ecx
sub dword [ebp - 0x14], edi
lea edx, [edi + 1]
mov ebx, dword [ebp - 0x14]
add ebx, edx
cmp ebx, edi
jge 0x1000351a
cmp edx, dword [ebp + 0x10]
jge 0x1000351a
mov ebx, dword [ebp - 0x28]
dec ebx
cmp dword [ebp + 0xc], ebx
jge 0x1000351a
inc dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
add edi, ecx
mov bl, byte [edi + ebx]
mov edi, dword [ebp + 8]
inc edx
cmp bl, byte [edx + edi]
mov edi, dword [ebp - 0x10]
je 0x100034e9
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jl 0x10003528
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x20], ecx
inc ecx
cmp ecx, edi
jl 0x100034b6
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0x18]
jl 0x10003560
mov ecx, dword [ebp - 8]
mov dl, 1
shl dl, cl
mov ecx, ebx
xor byte [ebp - 1], dl
mov edx, edi
sub edx, dword [ebp - 0x20]
shl edx, cl
xor edx, dword [ebp - 0xc]
mov ecx, edx
shr ecx, 8
mov byte [esi + eax], cl
inc esi
mov byte [esi + eax], dl
inc esi
add edi, dword [ebp - 0xc]
jmp 0x1000356b
mov ecx, dword [ebp + 8]
mov cl, byte [edi + ecx]
mov byte [esi + eax], cl
inc esi
inc edi
inc dword [ebp - 8]
cmp dword [ebp - 8], 8
mov dword [ebp - 0x10], edi
jne 0x10003590
mov cl, byte [ebp - 1]
mov edx, dword [ebp - 0x18]
and dword [ebp - 8], 0
mov byte [edx + eax], cl
mov dword [ebp - 0x18], esi
mov byte [esi + eax], 0
inc esi
mov byte [ebp - 1], 0
cmp edi, dword [ebp + 0x10]
jl 0x10003498
mov ecx, dword [ebp - 8]
mov dl, 1
mov byte [esi + eax], 0
shl dl, cl
mov ecx, dword [ebp - 0x18]
inc esi
mov byte [esi + eax], 0
xor dl, byte [ebp - 1]
pop edi
mov byte [ecx + eax], dl
lea eax, [esi + 1]
pop esi
pop ebx
leave
ret