joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10216420
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1035a868
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x105be7d0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
movss dword [esp + 0xc], xmm1
mov esi, ecx
mov dword [esp + 0x10], esi
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
call dword [sym.imp.gdiplus.dll_GdipCreateRegion]
mov dword [esi + 4], eax
mov eax, dword [esp + 8]
mov dword [esi], eax
mov dword [esp + 0x1c], 0
movss xmm0, dword [esp + 0xc]
mov eax, dword [esp + 0x24]
movss dword [esi + 8], xmm0
mov dword [esi + 0xc], 0x3f800000
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x1c], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x64], eax
mov dword [esp + 0x1c], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret 4

Function at 0x10216500
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x1f4
mov eax, dword [0x105be7d0]
xor eax, esp
mov dword [esp + 0x1f0], eax
mov eax, dword [esp + 0x200]
push ebx
mov ebx, dword [esp + 0x1fc]
push esi
mov esi, ecx
mov dword [esi + 0x208], eax
xor eax, eax
mov word [esi], ax
lea eax, [esp + 0xc]
push eax
push 0xf6
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [esp + 8], eax
test eax, eax
je 0x102165a6
cmp eax, 0xf6
jae 0x102165a6
push esi
push 0
push 0x1056929c
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x102165a6
push edi
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x1021659e
push 0
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x210]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [esp + 0x1f8]
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.1033d458
add esp, 0x1f4
ret 0xc

Function at 0x102165d0
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
cmp word [esi], 0
je 0x102165e0
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esi + 0x208]
test ecx, ecx
je 0x102165f1
push 1
call fcn.102165d0
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, esi
pop esi
ret 4
Function at 0x1021d0d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1035a75c
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x105be7d0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
push 0x105e29d0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x105e2364]
inc eax
mov dword [0x105e2364], eax
cmp eax, 1
jne 0x1021d148
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push 0
push eax
push 0x105e2ac0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
push 0x105e29d0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x24
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], 0
test eax, eax
je 0x1021d17c
push dword [ebp + 8]
mov ecx, eax
push edi
push esi
call fcn.10216830
jmp 0x1021d17e
xor eax, eax
mov dword [esp + 0x30], 0xffffffff
mov edx, eax
mov ecx, esi
call fcn.101f22f0
mov ecx, dword [eax + 8]
mov dword [ecx + 0x20], eax
mov dword [eax + 0xc], 0x1021d080
mov dword [eax + 0x20], 0x1021aa10
mov dword [eax + 0x24], 0x1021aa90
mov dword [eax + 0x28], 0x1021ab60
mov dword [eax + 0x2c], 0x1021abb0
mov dword [eax + 0x30], 0x1021c1e0
mov dword [eax + 0x34], 0x1021c250
mov dword [eax + 0x38], 0x1021c380
mov dword [eax + 0x3c], 0x1021c490
mov dword [eax + 0x40], fcn.100caf80
mov dword [eax + 0x44], 0x1021c640
mov dword [eax + 0x48], 0x1021cc30
mov dword [eax + 0x4c], 0x1021ccb0
mov dword [eax + 0x50], 0x1021ceb0
mov dword [eax + 0x54], 0x1021cf20
mov dword [eax + 0x58], 0x1021cf30
mov dword [eax + 0x5c], 0x1021cfc0
mov dword [eax + 0x60], 0x1021cfd0
mov dword [eax + 0x64], 0x1021cf20
mov dword [eax + 0x68], 0x1021d010
mov dword [eax + 0x6c], 0x1021d050
mov dword [eax + 0x70], 0x1021d060
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1021d250
Capabilities:
Hash data with crc32

Disassembly:
test edx, edx
jne 0x1021d257
xor eax, eax
ret
jmp fcn.1021d260
Function at 0x1022e940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, edx
mov ebx, ecx
mov edx, 0x9c
call fcn.101f3100
mov esi, eax
push 0x9c
test esi, esi
je 0x1022eb13
push 0
push esi
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [esi], 1
lea ebp, [esi + 4]
test edi, edi
je 0x1022e9ab
mov ecx, ebp
mov edx, 0x1f
mov al, byte [edi]
lea ecx, [ecx + 1]
inc edi
mov byte [ecx - 1], al
test al, al
je 0x1022e993
dec edx
jne 0x1022e981
jmp 0x1022e997
test edx, edx
jne 0x1022e9d9
mov byte [ecx], 0
lea ebx, [ebx]
mov al, byte [edi]
lea edi, [edi + 1]
test al, al
jne 0x1022e9a0
jmp 0x1022e9d9
mov edx, ebp
mov ecx, str._null_
mov edi, 0x1f
mov al, byte [ecx]
lea edx, [edx + 1]
inc ecx
mov byte [edx - 1], al
test al, al
je 0x1022e9c9
dec edi
jne 0x1022e9b7
jmp 0x1022e9cd
test edi, edi
jne 0x1022e9d9
mov byte [edx], 0
mov al, byte [ecx]
lea ecx, [ecx + 1]
test al, al
jne 0x1022e9d0
mov eax, dword [esp + 0x18]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
movdqu xmm0, xmmword [0x10368ae8]
movdqu xmmword [esi + 0x40], xmm0
movq xmm0, qword [0x10368af8]
movq qword [esi + 0x50], xmm0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x80], 0x3f800000
mov dword [esi + 0x84], 0x3f800000
mov dword [esi + 0x88], eax
test eax, eax
je 0x1022eae3
mov edi, dword [esp + 0x1c]
cmp edi, 0x1000
jg 0x1022eacc
push 0x10
push edi
push ebx
mov dword [esi + 0x8c], edi
call fcn.101f3230
add esp, 0xc
mov dword [esi + 0x90], eax
test edi, edi
jle 0x1022eaf7
xor ecx, ecx
nop
mov eax, dword [esi + 0x90]
lea ecx, [ecx + 0x10]
movdqu xmm0, xmmword [0x10368b00]
movdqu xmmword [eax + ecx - 0x10], xmm0
dec edi
jne 0x1022eab0
jmp 0x1022eaf7
push edi
push ebp
push str.not_building_glyph_bbox_table_for_font__s_with__d_glyphs
push 0x3f
push str...mupdf_source_fitz_font.c
push ebx
call fcn.101df520
add esp, 0x18
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
pop edi
mov dword [esi + 0x94], 0
mov eax, esi
mov dword [esi + 0x98], 0
pop esi
pop ebp
pop ebx
pop ecx
ret
push 1
push str.calloc___d_x__d_bytes__failed
push 1
push 0x7a
push str...mupdf_source_fitzmemory.c
push ebx
call fcn.101df770
int3
Function at 0x102319d0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
lea edx, [ecx + 1]
push esi
lea esi, [eax + 7]
lea esp, [esp]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor ecx, eax
movzx eax, byte [edx - 4]
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor ecx, eax
movzx eax, byte [edx - 3]
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor ecx, eax
movzx eax, byte [edx - 2]
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
dec esi
jne 0x102319e0
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
pop esi
ret
Function at 0x10245ae0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [edx + 0x10]
push ebx
mov ebx, dword [edx]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov dword [esp + 0x10], eax
xor esi, esi
mov eax, dword [edx + 4]
xor edi, edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
test ebx, ebx
jle 0x10245b28
jmp 0x10245b10
movzx eax, byte [edi + ebp]
inc edi
add eax, esi
imul esi, eax, 0x401
mov eax, esi
shr eax, 6
xor esi, eax
cmp edi, ebx
jl 0x10245b10
lea ecx, [esi + esi*8]
xor edx, edx
mov eax, ecx
shr eax, 0xb
xor eax, ecx
mov ecx, dword [esp + 0x10]
imul eax, eax, 0x8001
div dword [esp + 0x14]
mov edi, edx
imul eax, edi, 0x34
add eax, ecx
cmp dword [eax + 0x30], 0
je 0x10245bbd
nop
mov edx, ebx
mov esi, ebp
sub edx, 4
jb 0x10245b71
lea esp, [esp]
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x10245b76
add esi, 4
add eax, 4
sub edx, 4
jae 0x10245b60
cmp edx, 0xfffffffc
je 0x10245bef
mov cl, byte [esi]
cmp cl, byte [eax]
jne 0x10245ba3
cmp edx, 0xfffffffd
je 0x10245bef
mov cl, byte [esi + 1]
cmp cl, byte [eax + 1]
jne 0x10245ba3
cmp edx, 0xfffffffe
je 0x10245bef
mov cl, byte [esi + 2]
cmp cl, byte [eax + 2]
jne 0x10245ba3
cmp edx, 0xffffffff
je 0x10245bef
mov cl, byte [esi + 3]
cmp cl, byte [eax + 3]
je 0x10245bef
lea eax, [edi + 1]
mov ecx, dword [esp + 0x10]
xor edx, edx
div dword [esp + 0x14]
mov edi, edx
imul eax, edi, 0x34
add eax, ecx
cmp dword [eax + 0x30], 0
jne 0x10245b50
imul esi, edi, 0x34
push ebx
push ebp
add esi, ecx
push esi
call sub.MSVCR120.dll_memcpy
mov eax, dword [esp + 0x34]
add esp, 0xc
mov dword [esi + 0x30], eax
mov eax, dword [esp + 0x1c]
inc dword [eax + 8]
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x10245be5
mov dword [eax], edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x10245c0c
mov ecx, dword [esp + 0x10]
mov dword [eax], edi
imul eax, edi, 0x34
pop edi
pop esi
pop ebp
pop ebx
mov eax, dword [eax + ecx + 0x30]
add esp, 0x10
ret
push str.assert:_overwrite_hash_slot
push 0x88
push str...mupdf_source_fitzhash.c
push dword [esp + 0x24]
call fcn.101df520
mov ecx, dword [esp + 0x20]
add esp, 0x10
imul eax, edi, 0x34
pop edi
pop esi
pop ebp
pop ebx
mov eax, dword [eax + ecx + 0x30]
add esp, 0x10
ret
Function at 0x10245e00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [edx]
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [edx + 0x10]
push edi
mov edi, dword [edx + 4]
xor edx, edx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
test ebx, ebx
jle 0x10245e3b
movzx eax, byte [edx + ebp]
inc edx
add eax, ecx
imul ecx, eax, 0x401
mov eax, ecx
shr eax, 6
xor ecx, eax
cmp edx, ebx
jl 0x10245e23
lea ecx, [ecx + ecx*8]
xor edx, edx
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
div edi
mov edi, edx
imul eax, edi, 0x34
add eax, esi
cmp dword [eax + 0x30], 0
je 0x10245ecb
lea esp, [esp]
mov edx, ebx
mov esi, ebp
sub edx, 4
jb 0x10245e81
lea esp, [esp]
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x10245e86
add esi, 4
add eax, 4
sub edx, 4
jae 0x10245e70
cmp edx, 0xfffffffc
je 0x10245ed5
mov cl, byte [esi]
cmp cl, byte [eax]
jne 0x10245eb3
cmp edx, 0xfffffffd
je 0x10245ed5
mov cl, byte [esi + 1]
cmp cl, byte [eax + 1]
jne 0x10245eb3
cmp edx, 0xfffffffe
je 0x10245ed5
mov cl, byte [esi + 2]
cmp cl, byte [eax + 2]
jne 0x10245eb3
cmp edx, 0xffffffff
je 0x10245ed5
mov cl, byte [esi + 3]
cmp cl, byte [eax + 3]
je 0x10245ed5
lea eax, [edi + 1]
xor edx, edx
div dword [esp + 0x14]
mov edi, edx
imul eax, edi, 0x34
add eax, dword [esp + 0x10]
cmp dword [eax + 0x30], 0
jne 0x10245e60
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x10]
imul eax, edi, 0x34
pop edi
pop esi
pop ebp
pop ebx
mov eax, dword [eax + ecx + 0x30]
add esp, 8
ret
Function at 0x10245fb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x18]
mov ecx, edx
imul eax, ebp, 0x34
push esi
push edi
mov edx, dword [ecx + 0x10]
lea esi, [ebp + 1]
mov edi, dword [ecx + 4]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [eax + edx + 0x30], 0
xor eax, eax
cmp esi, edi
cmove esi, eax
imul edi, esi, 0x34
add edi, edx
cmp dword [edi + 0x30], eax
je 0x102460a3
push ebx
mov ebx, dword [ecx]
xor eax, eax
xor edx, edx
test ebx, ebx
jle 0x10246018
lea esp, [esp]
movzx ecx, byte [edi + edx]
inc edx
add ecx, eax
imul eax, ecx, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
cmp edx, ebx
jl 0x10246000
mov ebx, dword [esp + 0x18]
lea ecx, [eax + eax*8]
mov eax, ecx
xor edx, edx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
div ebx
cmp edx, ebp
ja 0x10246038
cmp ebp, esi
jb 0x10246048
cmp esi, edx
jae 0x10246040
cmp edx, ebp
jbe 0x10246048
cmp ebp, esi
jae 0x1024607a
cmp esi, edx
jae 0x1024607a
movdqu xmm0, xmmword [edi]
imul ecx, ebp, 0x34
mov ebp, esi
add ecx, dword [esp + 0x10]
movdqu xmmword [ecx], xmm0
movdqu xmm0, xmmword [edi + 0x10]
movdqu xmmword [ecx + 0x10], xmm0
movdqu xmm0, xmmword [edi + 0x20]
movdqu xmmword [ecx + 0x20], xmm0
mov eax, dword [edi + 0x30]
mov dword [ecx + 0x30], eax
mov dword [edi + 0x30], 0
mov ecx, dword [esp + 0x14]
inc esi
xor eax, eax
cmp esi, ebx
cmove esi, eax
imul edi, esi, 0x34
add edi, dword [esp + 0x10]
cmp dword [edi + 0x30], eax
jne 0x10245ff2
pop ebx
mov eax, ecx
pop edi
pop esi
pop ebp
dec dword [eax + 8]
add esp, 0xc
ret
dec dword [ecx + 8]
pop edi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x102460b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [edx]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
xor esi, esi
mov dword [esp + 0x10], edx
xor edi, edi
mov dword [esp + 0x14], ecx
test ebx, ebx
jle 0x102460e8
lea ecx, [ecx]
movzx eax, byte [edi + ebp]
inc edi
add eax, esi
imul esi, eax, 0x401
mov eax, esi
shr eax, 6
xor esi, eax
cmp edi, ebx
jl 0x102460d0
lea ecx, [esi + esi*8]
xor edx, edx
mov esi, dword [esp + 0x10]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
mov ecx, dword [esi + 0x10]
div dword [esi + 4]
mov edi, edx
imul eax, edi, 0x34
add eax, ecx
cmp dword [eax + 0x30], 0
je 0x1024617e
mov edx, ebx
mov esi, ebp
sub edx, 4
jb 0x10246131
lea ebx, [ebx]
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x10246136
add esi, 4
add eax, 4
sub edx, 4
jae 0x10246120
cmp edx, 0xfffffffc
je 0x102461a1
mov cl, byte [esi]
cmp cl, byte [eax]
jne 0x10246163
cmp edx, 0xfffffffd
je 0x102461a1
mov cl, byte [esi + 1]
cmp cl, byte [eax + 1]
jne 0x10246163
cmp edx, 0xfffffffe
je 0x102461a1
mov cl, byte [esi + 2]
cmp cl, byte [eax + 2]
jne 0x10246163
cmp edx, 0xffffffff
je 0x102461a1
mov cl, byte [esi + 3]
cmp cl, byte [eax + 3]
je 0x102461a1
mov edx, dword [esp + 0x10]
xor eax, eax
inc edi
cmp edi, dword [edx + 4]
mov ecx, dword [edx + 0x10]
cmove edi, eax
imul eax, edi, 0x34
add eax, ecx
cmp dword [eax + 0x30], 0
jne 0x10246111
push str.assert:_remove_non_existent_hash_entry
push 0x127
push str...mupdf_source_fitzhash.c
push dword [esp + 0x20]
call fcn.101df520
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x10]
push edi
push ecx
call fcn.10245fb0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1024a480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
push 0x98
mov edi, edx
mov esi, ecx
push 0
push edi
call sub.MSVCR120.dll_memset
mov ecx, dword [esp + 0x1c]
add esp, 0xc
mov eax, dword [esp + 0x14]
add eax, ecx
mov dword [edi], esi
mov dword [edi + 0xc], eax
mov eax, ecx
mov dword [edi + 4], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0x4c], 1
mov dword [edi + 0x3c], 1
mov dword [edi + 0x48], 1
mov dword [edi + 0x60], 2
mov dword [edi + 0x18], 0xffffffff
mov dword [edi + 0x64], 1
mov dword [edi + 0x50], 1
mov dword [edi + 0x34], 0
mov dword [edi + 0x70], 1
mov dword [edi + 0x74], 2
mov dword [edi + 0x78], 2
mov ebx, dword [edi + 0xc]
mov dword [edi + 0x10], 0x4949
cmp eax, ebx
jae 0x1024a514
mov cl, byte [eax]
inc eax
mov dword [edi + 8], eax
movzx esi, cl
jmp 0x1024a517
or esi, 0xffffffff
mov eax, dword [edi + 8]
cmp eax, ebx
jae 0x1024a529
mov cl, byte [eax]
inc eax
mov dword [edi + 8], eax
movzx edx, cl
jmp 0x1024a52c
or edx, 0xffffffff
shl edx, 8
or edx, esi
mov dword [edi + 0x10], edx
cmp edx, 0x4949
je 0x1024a544
cmp edx, 0x4d4d
jne 0x1024a593
mov eax, dword [edi + 8]
cmp eax, ebx
jae 0x1024a556
mov cl, byte [eax]
inc eax
mov dword [edi + 8], eax
movzx esi, cl
jmp 0x1024a559
or esi, 0xffffffff
mov eax, dword [edi + 8]
cmp eax, ebx
jae 0x1024a56b
mov cl, byte [eax]
inc eax
mov dword [edi + 8], eax
movzx eax, cl
jmp 0x1024a56e
or eax, 0xffffffff
cmp edx, 0x4949
jne 0x1024a57b
shl eax, 8
jmp 0x1024a57e
shl esi, 8
or eax, esi
cmp eax, 0x2a
jne 0x1024a5ab
mov ecx, edi
call fcn.10249e50
mov dword [edi + 0x14], eax
pop edi
pop esi
pop ebx
ret
push str.not_a_TIFF_file__wrong_magic_marker
push 1
push 0x2f8
push str...mupdf_source_fitzload_tiff.c
push dword [edi]
call fcn.101df770
push str.not_a_TIFF_file__wrong_version_marker
push 1
push 0x2fd
push str...mupdf_source_fitzload_tiff.c
push dword [edi]
call fcn.101df770
int3
Function at 0x10253680
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x40], 0
mov dword [ecx], 0xf3bcc908
mov dword [ecx + 4], 0x6a09e667
mov dword [ecx + 8], 0x84caa73b
mov dword [ecx + 0xc], 0xbb67ae85
mov dword [ecx + 0x10], 0xfe94f82b
mov dword [ecx + 0x14], 0x3c6ef372
mov dword [ecx + 0x18], 0x5f1d36f1
mov dword [ecx + 0x1c], 0xa54ff53a
mov dword [ecx + 0x20], 0xade682d1
mov dword [ecx + 0x24], 0x510e527f
mov dword [ecx + 0x28], 0x2b3e6c1f
mov dword [ecx + 0x2c], 0x9b05688c
mov dword [ecx + 0x30], 0xfb41bd6b
mov dword [ecx + 0x34], 0x1f83d9ab
mov dword [ecx + 0x38], 0x137e2179
mov dword [ecx + 0x3c], 0x5be0cd19
ret

Function at 0x10253870
Capabilities:
Hash data using sha224

Disassembly:
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x40], 0
mov dword [ecx], 0xc1059ed8
mov dword [ecx + 4], 0xcbbb9d5d
mov dword [ecx + 8], 0x367cd507
mov dword [ecx + 0xc], 0x629a292a
mov dword [ecx + 0x10], 0x3070dd17
mov dword [ecx + 0x14], 0x9159015a
mov dword [ecx + 0x18], 0xf70e5939
mov dword [ecx + 0x1c], 0x152fecd8
mov dword [ecx + 0x20], 0xffc00b31
mov dword [ecx + 0x24], 0x67332667
mov dword [ecx + 0x28], 0x68581511
mov dword [ecx + 0x2c], 0x8eb44a87
mov dword [ecx + 0x30], 0x64f98fa7
mov dword [ecx + 0x34], 0xdb0c2e0d
mov dword [ecx + 0x38], 0xbefa4fa4
mov dword [ecx + 0x3c], 0x47b5481d
ret
Function at 0x102538f0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
sub esp, 0x808
mov eax, dword [0x105be7d0]
xor eax, esp
mov dword [esp + 0x804], eax
push ebx
push ebp
push esi
push edi
xor esi, esi
mov edx, 1
nop
mov eax, edx
mov dword [esp + esi*4 + 0x414], edx
and al, 0x80
mov dword [esp + edx*4 + 0x14], esi
movsx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor edx, ecx
and edx, 0xff
cmp esi, 0x100
jl 0x10253910
mov esi, 1
mov edx, 0x105e73d0
lea esp, [esp]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movsx ecx, al
neg ecx
sbb ecx, ecx
add esi, esi
and ecx, 0x1b
add edx, 4
xor esi, ecx
and esi, 0xff
cmp edx, 0x105e73f8
jl 0x10253950
mov eax, 1
mov byte [0x105e7c00], 0x63
mov byte [0x105e5b33], 0
mov dword [esp + 0x10], eax
lea esp, [esp]
mov ecx, dword [esp + eax*4 + 0x14]
lea eax, [esp + 0x810]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
and ecx, 0xff
mov edx, ecx
xor ebx, ecx
sar edx, 7
lea eax, [ecx + ecx]
or edx, eax
and edx, 0xff
mov esi, edx
xor ebx, edx
sar esi, 7
lea eax, [edx + edx]
or esi, eax
and esi, 0xff
mov ecx, esi
sar ecx, 7
lea eax, [esi + esi]
or ecx, eax
mov eax, dword [esp + 0x10]
xor ecx, 0x63
and ecx, 0xff
xor ecx, esi
xor ebx, ecx
mov byte [eax + 0x105e7c00], bl
mov byte [ebx + 0x105e5ad0], al
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x100
jl 0x10253990
xor esi, esi
mov ebp, 0xff
movzx edx, byte [esi + 0x105e7c00]
mov eax, edx
and al, 0x80
movsx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
and ecx, 0xff
mov eax, ecx
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, ecx
movzx ecx, byte [esi + 0x105e5ad0]
mov dword [esi*4 + 0x105e5bd0], eax
rol eax, 8
mov dword [esi*4 + 0x105e5fd0], eax
rol eax, 8
mov dword [esi*4 + 0x105e63d0], eax
rol eax, 8
mov dword [esi*4 + 0x105e67d0], eax
test ecx, ecx
je 0x10253abe
mov ecx, dword [esp + ecx*4 + 0x14]
mov eax, dword [esp + 0x4c]
add eax, ecx
cdq
idiv ebp
mov eax, dword [esp + 0x38]
add eax, ecx
mov edi, dword [esp + edx*4 + 0x414]
cdq
idiv ebp
mov eax, dword [esp + 0x48]
add eax, ecx
mov ebx, dword [esp + edx*4 + 0x414]
cdq
idiv ebp
mov eax, dword [esp + 0x40]
add eax, ecx
mov ecx, 0xff
mov ebp, dword [esp + edx*4 + 0x414]
cdq
idiv ecx
mov eax, dword [esp + edx*4 + 0x414]
jmp 0x10253ac6
xor edi, edi
xor ebx, ebx
xor ebp, ebp
xor eax, eax
shl eax, 8
xor eax, ebp
mov ebp, 0xff
shl eax, 8
xor eax, ebx
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x105e6bd0], eax
rol eax, 8
mov dword [esi*4 + 0x105e6fd0], eax
rol eax, 8
mov dword [esi*4 + 0x105e7400], eax
rol eax, 8
mov dword [esi*4 + 0x105e7800], eax
inc esi
cmp esi, 0x100
jl 0x10253a10
mov ecx, dword [esp + 0x814]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1033d458
add esp, 0x808
ret
Function at 0x10254a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x120
mov eax, dword [0x105be7d0]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, ecx
sub eax, 0x80
je 0x10254a5d
sub eax, 0x40
je 0x10254a55
sub eax, 0x40
je 0x10254a4d
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.1033d458
mov esp, ebp
pop ebp
ret
mov dword [edi], 0xe
jmp 0x10254a63
mov dword [edi], 0xc
jmp 0x10254a63
mov dword [edi], 0xa
push ecx
lea esi, [edi + 8]
lea ecx, [esp + 0xc]
mov dword [edi + 4], esi
call fcn.10253b30
add esp, 4
test eax, eax
jne 0x10254c01
mov eax, dword [esp + 8]
shl eax, 4
add eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 0xc]
sub eax, 0x10
mov dword [esi + 0xc], ecx
add esi, 0x10
mov edi, dword [edi]
dec edi
test edi, edi
jle 0x10254be9
movzx ecx, byte [eax + 3]
dec edi
movzx edx, byte [ecx + 0x105e7c00]
movzx ecx, byte [eax + 2]
mov edx, dword [edx*4 + 0x105e7800]
movzx ecx, byte [ecx + 0x105e7c00]
xor edx, dword [ecx*4 + 0x105e7400]
movzx ecx, byte [eax + 1]
movzx ecx, byte [ecx + 0x105e7c00]
xor edx, dword [ecx*4 + 0x105e6fd0]
movzx ecx, byte [eax]
movzx ecx, byte [ecx + 0x105e7c00]
xor edx, dword [ecx*4 + 0x105e6bd0]
mov dword [esi], edx
movzx ecx, byte [eax + 4]
movzx edx, byte [ecx + 0x105e7c00]
movzx ecx, byte [eax + 7]
mov edx, dword [edx*4 + 0x105e6bd0]
movzx ecx, byte [ecx + 0x105e7c00]
xor edx, dword [ecx*4 + 0x105e7800]
movzx ecx, byte [eax + 6]
movzx ecx, byte [ecx + 0x105e7c00]
xor edx, dword [ecx*4 + 0x105e7400]
movzx ecx, byte [eax + 5]
movzx ecx, byte [ecx + 0x105e7c00]
xor edx, dword [ecx*4 + 0x105e6fd0]
mov dword [esi + 4], edx
movzx ecx, byte [eax + 8]
movzx edx, byte [ecx + 0x105e7c00]
movzx ecx, byte [eax + 0xb]
mov edx, dword [edx*4 + 0x105e6bd0]
movzx ecx, byte [ecx + 0x105e7c00]
xor edx, dword [ecx*4 + 0x105e7800]
movzx ecx, byte [eax + 0xa]
movzx ecx, byte [ecx + 0x105e7c00]
xor edx, dword [ecx*4 + 0x105e7400]
movzx ecx, byte [eax + 9]
movzx ecx, byte [ecx + 0x105e7c00]
xor edx, dword [ecx*4 + 0x105e6fd0]
mov dword [esi + 8], edx
movzx ecx, byte [eax + 0xc]
movzx edx, byte [ecx + 0x105e7c00]
movzx ecx, byte [eax + 0xf]
mov edx, dword [edx*4 + 0x105e6bd0]
movzx ecx, byte [ecx + 0x105e7c00]
xor edx, dword [ecx*4 + 0x105e7800]
movzx ecx, byte [eax + 0xe]
movzx ecx, byte [ecx + 0x105e7c00]
xor edx, dword [ecx*4 + 0x105e7400]
movzx ecx, byte [eax + 0xd]
sub eax, 0x10
movzx ecx, byte [ecx + 0x105e7c00]
xor edx, dword [ecx*4 + 0x105e6fd0]
mov dword [esi + 0xc], edx
add esi, 0x10
test edi, edi
jg 0x10254ab0
mov ecx, dword [eax]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [esi + 0xc], eax
xor eax, eax
mov ecx, dword [esp + 0x124]
pop edi
pop esi
xor ecx, esp
call fcn.1033d458
mov esp, ebp
pop ebp
ret