joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000316a
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 1]
push edi
mov byte [ebp - 1], 0
call fcn.1002b26b
lea ecx, [ebp - 1]
mov byte [ebp - 1], 0
call fcn.1002b2e9
mov edi, dword [ebp + 8]
push dword [edi]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1000325e
push 3
xor eax, eax
push eax
push eax
push eax
push eax
push 0xffffffffffffffff
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowPos]
test eax, eax
je 0x1000325e
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
push esi
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 1
push dword [ebp + 8]
mov dword [ebp - 8], eax
push eax
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x1000325d
push dword [edi]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 7
push dword [edi]
call esi
push 0
push 1
push 6
push dword [edi]
call esi
push 1
push 0xd
push 0x100
push dword [edi]
call esi
push 0
push 0xd
push 0x101
push dword [edi]
call esi
push 0
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_AttachThreadInput]
push 0
push 0
push 0x10
push dword [edi]
call esi
push 0
push 0
push 0x10
push dword [edi + 0x214]
call esi
push dword [edi]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x1000325d
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov byte [eax], 1
pop esi
lea ecx, [ebp + 0xb]
mov byte [ebp + 0xb], 1
call fcn.1002b26b
lea ecx, [ebp + 0xb]
mov byte [ebp + 0xb], 1
call fcn.1002b2e9
pop edi
leave
ret 4
Function at 0x1001102b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
test esi, esi
jg 0x10011055
jl 0x1001104c
test ebx, ebx
jne 0x10011055
xor eax, eax
xor edx, edx
jmp 0x1001110d
cmp dword [ecx + 0x38], 0
je 0x10011068
push esi
push ebx
push edx
call fcn.10012374
jmp 0x1001110d
mov eax, dword [ecx + 0x1c]
push edi
mov edi, ebx
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100110a8
mov eax, dword [ecx + 0x2c]
cmp dword [eax], 0
jbe 0x100110a8
cmp dword [eax], ebx
mov esi, ebx
cmovb esi, dword [eax]
push esi
push dword [ebp - 0xc]
push edx
call fcn.100c9030
mov ecx, dword [ebp - 8]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0x10]
cmp dword [ecx + 0x4c], 0
je 0x10011103
call fcn.1001250f
mov ecx, dword [ebp - 4]
mov edx, edi
cmp edi, 0xfff
jbe 0x100110eb
mov eax, dword [ebp - 8]
push dword [eax + 0x4c]
push 0xfff
push 1
push ecx
call fcn.100cd124
mov ecx, dword [ebp - 4]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x10011103
jmp 0x100110b8
test edx, edx
je 0x10011103
mov eax, dword [ebp - 8]
push dword [eax + 0x4c]
push edi
push 1
push ecx
call fcn.100cd124
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb esi, 0
mov edx, esi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10011113
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1001113a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100115b9
jmp 0x10011203
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10011162
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x10011168
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x100111d0
jg 0x1001117f
test esi, esi
je 0x100111d0
test ecx, ecx
jl 0x100111cb
jg 0x10011189
test eax, eax
je 0x100111cb
cmp edi, ecx
jg 0x1001119d
jl 0x10011193
cmp esi, eax
jae 0x1001119d
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call fcn.100c9030
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x100111d3
mov ecx, dword [ebp + 8]
jmp 0x100111dd
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x100111f7
jg 0x100111dd
test esi, esi
je 0x100111f7
cmp dword [ebx + 0x4c], 0
je 0x100111f7
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.100ce375
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001254c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10158f9c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x10012572
xor eax, eax
jmp 0x10012638
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x1001259b
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x1001259b
dec dword [edx]
mov eax, ebx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x10012638
cmp dword [esi + 0x4c], 0
je 0x10012636
mov ecx, esi
call fcn.1001250f
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x100125c7
push dword [esi + 0x4c]
push eax
call fcn.10012532
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x10012636
mov byte [ebp - 0x28], al
mov eax, dword [ecx]
mov edx, dword [eax + 0x1c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x10012605
sub eax, 1
je 0x10012605
dec eax
sub eax, 1
jne 0x10012636
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x100125b9
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x34], eax
je 0x10012628
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.100ce375
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x10012636
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
mov eax, ebx
jne 0x10012638
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c7413
leave
ret 4

Function at 0x1001265b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10158f9c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x38], ebx
je 0x100126b4
cmp byte [esi + 0x3d], bl
je 0x100126b4
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x100126ed
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, ebx
je 0x100126c5
sub eax, 1
je 0x100126c8
dec eax
sub eax, 1
jne 0x100126ed
mov byte [esi + 0x3d], bl
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c7413
leave
ret
mov byte [esi + 0x3d], bl
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100126e5
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100ce375
add esp, 0x10
cmp edi, eax
jne 0x100126ed
cmp byte [esi + 0x3d], bl
sete al
jmp 0x100126b6
xor al, al
jmp 0x100126b6
Function at 0x10013e0f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x10158f9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push 0x44
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x10]
pop edi
mov dword [ebp - 0x6c], eax
xor eax, eax
push edi
push eax
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x59], al
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x64], edx
call fcn.100c95b0
mov cl, byte [esi]
add esp, 0xc
xor esi, esi
mov dword [ebp - 0x48], edi
inc esi
test cl, cl
jne 0x10013e6d
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], 3
jmp 0x10013e70
mov dword [ebp - 0x1c], esi
xor eax, eax
lea edi, [ebp - 0x58]
push 5
test cl, cl
pop edx
cmovne eax, edx
xor edx, edx
mov word [ebp - 0x18], ax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x64]
cmp dword [eax + 0x10], edx
jne 0x10013e95
mov eax, edx
jmp 0x10013eb4
push eax
mov edx, 0x101458f0
lea ecx, [ebp - 0x84]
call fcn.10013dbd
pop ecx
mov dword [ebp - 0x60], esi
cmp dword [eax + 0x14], 0x10
jb 0x10013eb2
mov eax, dword [eax]
xor edx, edx
cmp dword [ebx + 0x10], edx
jne 0x10013ebd
mov ebx, edx
jmp 0x10013ec5
cmp dword [ebx + 0x14], 0x10
jb 0x10013ec5
mov ebx, dword [ebx]
lea ecx, [ebp - 0x58]
push ecx
lea ecx, [ebp - 0x48]
push ecx
push edx
push edx
push edx
push edx
push edx
push edx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, eax
neg ebx
sbb bl, bl
inc bl
test byte [ebp - 0x60], 1
je 0x10013ef4
lea ecx, [ebp - 0x84]
call fcn.10002013
test bl, bl
jne 0x10013f3e
mov eax, dword [ebp - 0x50]
test eax, eax
mov ecx, dword [ebp - 0x68]
setne bl
mov dword [ecx], eax
test eax, eax
je 0x10013f10
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
jmp 0x10013f12
xor eax, eax
push eax
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x54], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x10013f2d
push dword [ebp - 0x54]
call esi
and dword [ebp - 0x54], 0
cmp dword [ebp - 0x58], 0
je 0x10013f41
push dword [ebp - 0x58]
call esi
jmp 0x10013f41
mov bl, byte [ebp - 0x59]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c7413
leave
ret
Function at 0x10013f52
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x10158f9c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x64], edx
lea eax, [esi + 0x10]
mov dword [ebp - 0x5c], eax
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
test eax, eax
jne 0x10013f7e
xor al, al
jmp 0x10014042
push ebx
push edi
push 0x44
pop ebx
push ebx
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.100c95b0
xor eax, eax
mov dword [ebp - 0x48], ebx
lea edi, [ebp - 0x58]
mov dword [ebp - 0x1c], 1
stosd dword es:[edi], eax
xor bl, bl
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x18], ax
mov eax, dword [ebp - 0x60]
inc eax
push eax
call fcn.100c7487
mov edi, eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
inc eax
push eax
push 0
push edi
call fcn.100c95b0
add esp, 0x1c
cmp dword [esi + 0x14], 0x10
jb 0x10013fd0
mov esi, dword [esi]
mov eax, dword [ebp - 0x5c]
push dword [eax]
push esi
push edi
call fcn.100c9030
add esp, 0xc
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x10014013
mov eax, dword [ebp - 0x64]
push dword [eax]
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov bl, 1
test eax, eax
je 0x10014013
xor bl, bl
jmp 0x10014037
cmp dword [ebp - 0x54], 0
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x10014024
push dword [ebp - 0x54]
call esi
and dword [ebp - 0x54], 0
cmp dword [ebp - 0x58], 0
je 0x10014033
push dword [ebp - 0x58]
call esi
and dword [ebp - 0x58], 0
push edi
call fcn.100c7482
pop ecx
pop edi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100c7413
leave
ret
Function at 0x100145e2
Capabilities:
Enumerate processes

Disassembly:
push 0x270
mov eax, 0x101078af
call fcn.100c7e75
mov esi, ecx
mov dword [ebp - 0x244], esi
xor edi, edi
cmp dword [esi + 0x10], edi
je 0x1001470d
push 0x228
lea eax, [ebp - 0x238]
push edi
push eax
call fcn.100c95b0
add esp, 0xc
mov dword [ebp - 0x23c], 0x22c
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
test ebx, ebx
je 0x1001470f
lea eax, [ebp - 0x23c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x100146f6
cmp word [ebp - 0x218], 0
je 0x100146e8
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x240], esi
jb 0x10014667
mov esi, dword [esi]
jmp 0x1001466d
mov esi, dword [ebp - 0x240]
push ecx
push ecx
lea ecx, [ebp - 0x24c]
call fcn.10014342
lea eax, [ebp - 0x218]
mov dword [ebp - 4], edi
push eax
lea ecx, [ebp - 0x264]
call fcn.10014579
push ecx
lea edx, [ebp - 0x264]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x27c]
call fcn.1001404f
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100146ae
mov eax, dword [eax]
push esi
push eax
call fcn.100cdeb1
pop ecx
pop ecx
lea ecx, [ebp - 0x27c]
mov esi, eax
call fcn.10002013
lea ecx, [ebp - 0x264]
call fcn.100145b0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.100143bd
test esi, esi
je 0x10014700
mov esi, dword [ebp - 0x244]
lea eax, [ebp - 0x23c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10014649
jmp 0x10014706
mov edi, dword [ebp - 0x234]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
call fcn.100c7e24
ret
Function at 0x10015da1
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10158f9c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x28], 9
je 0x10015dcc
cmp word [ebp - 0x28], 6
sete al
jmp 0x10015dce
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c7413
leave
ret
Function at 0x10018b80
Capabilities:
Create directory

Disassembly:
push 0x44
mov eax, 0x10107fa4
call fcn.100c7e75
xor ebx, ebx
cmp dword [ecx + 0x10], ebx
jne 0x10018b9a
xor al, al
jmp 0x10018d0a
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.100147f1
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push ebx
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.100ccdb9
pop ecx
pop ecx
test eax, eax
je 0x10018ce4
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
lea edx, [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
cmovae edx, dword [ebp - 0x28]
add ecx, edx
cmp eax, ecx
je 0x10018bf5
cmp byte [eax], 0x2f
jne 0x10018bf2
mov byte [eax], 0x5c
inc eax
jmp 0x10018bd6
mov esi, 0x1014528c
jmp 0x10018c0e
push 1
push 0x10143718
push 2
push eax
lea ecx, [ebp - 0x28]
call fcn.1000e59b
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.1000e47c
cmp eax, 0xffffffff
jne 0x10018bfc
xor eax, eax
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.100ccdb9
pop ecx
pop ecx
test eax, eax
je 0x10018c9c
cmp dword [ebp - 0x18], 0
je 0x10018c9c
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x34]
call fcn.10018501
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x28]
dec ecx
cmp dword [ebp - 0x14], 0x10
push ecx
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], ecx
push ecx
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x28]
call fcn.1001859b
push eax
push ebx
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x28]
call fcn.10018539
push eax
lea ecx, [ebp - 0x28]
call fcn.1000fedd
lea ecx, [ebp - 0x50]
call fcn.10002013
jmp 0x10018c32
push dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
sub eax, ecx
push 0x18
cdq
pop esi
idiv esi
mov edx, dword [ebp - 0x30]
push eax
call fcn.100189f4
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x30]
pop ecx
pop ecx
jmp 0x10018cd8
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x10018cca
mov eax, dword [esi]
push eax
call fcn.100d2149
pop ecx
test eax, eax
jne 0x10018cdc
add esi, 0x18
cmp esi, edi
jne 0x10018cc0
lea ecx, [ebp - 0x34]
call fcn.1001828e
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ebx
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.100ccdb9
mov ebx, eax
neg ebx
pop ecx
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x28]
inc bl
call fcn.10002013
mov al, bl
call fcn.100c7e24
ret
Function at 0x10026eb9
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x10158f9c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x110
mov dword [ebp - 0x128], eax
xor ebx, ebx
lea eax, [ebp - 0x114]
mov dword [ebp - 0x12c], ecx
mov esi, edx
push ebx
push eax
mov dword [ebp - 0x130], esi
call fcn.100c95b0
add esp, 0xc
mov dword [ebp - 0x124], 0x11100
lea eax, [ebp - 0x124]
mov edi, ebx
bt dword [eax], 0xc
push 0x10
pop eax
push 0xc
pop ecx
cmovb eax, ecx
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x124], eax
mov dword [ecx], eax
cmp esi, 8
jl 0x10026f91
mov edi, esi
lea edx, [esi - 8]
mov esi, dword [ebp - 0x128]
and edi, 0xfffffff8
mov dword [ebp - 0x138], edi
lea edi, [ebp - 0x114]
sub edi, esi
mov eax, dword [esi]
mov ecx, ebx
shr ecx, 2
add ebx, 8
mov dword [edi + esi], eax
lea esi, [esi + 8]
mov eax, dword [esi - 4]
mov dword [ebp + ecx*4 - 0x110], eax
cmp ebx, edx
jle 0x10026f4b
mov ecx, dword [ebp - 0x128]
mov edi, dword [ebp - 0x138]
add ecx, edi
mov esi, dword [ebp - 0x130]
shr edx, 2
and edx, 0x3ffffffe
xor ebx, ebx
lea edx, [edx*4 + 8]
jmp 0x10026f99
mov ecx, dword [ebp - 0x128]
mov edx, ebx
cmp edi, esi
je 0x10026fc4
mov dword [ebp - 0x118], ebx
mov eax, esi
and eax, 7
movzx eax, byte [eax + ecx - 1]
mov dword [ebp + edx - 0x114], eax
or edx, 4
mov eax, dword [ebp - 0x118]
mov dword [ebp + edx - 0x114], eax
mov eax, dword [ebp - 0x124]
mov edx, 0x5618cb1c
mov ecx, dword [ebp - 0x12c]
lea edi, [eax*2 + 2]
lea eax, [esi + 3]
mov dword [ecx + 4], 0xb7e15163
sar eax, 0x1f
add esi, 3
shr eax, 0x1e
add eax, esi
mov esi, dword [ebp - 0x124]
sar eax, 2
add ecx, 8
lea esi, [esi*2 + 1]
mov dword [ecx], edx
sub edx, 0x61c88647
lea ecx, [ecx + 4]
sub esi, 1
jne 0x10027004
cmp edi, eax
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x11c], eax
cmovl edi, eax
test edi, edi
jle 0x100270c6
imul eax, edi, 3
mov esi, ebx
mov dword [ebp - 0x124], ebx
mov edx, ebx
mov dword [ebp - 0x128], esi
mov edi, ebx
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x12c]
mov eax, dword [ecx + ebx*4 + 4]
add eax, edx
add eax, esi
lea esi, [ebx + 1]
rol eax, 3
mov dword [ecx + ebx*4 + 4], eax
mov ebx, dword [ebp - 0x128]
mov ecx, dword [ebp + edi*4 - 0x114]
add ecx, eax
mov dword [ebp - 0x130], eax
add ecx, ebx
lea edx, [eax + ebx]
call fcn.10026ea1
mov edx, dword [ebp - 0x130]
lea ecx, [edi + 1]
mov dword [ebp + edi*4 - 0x114], eax
xor edi, edi
cmp ecx, dword [ebp - 0x11c]
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x124]
cmovl edi, ecx
inc eax
xor ebx, ebx
cmp esi, dword [ebp - 0x118]
mov dword [ebp - 0x124], eax
cmovl ebx, esi
mov esi, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x120]
jl 0x10027048
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100c7413
leave
ret
Function at 0x100273a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], ebx
push edi
mov edi, dword [ebp + 0x10]
mov edx, dword [edi]
mov edi, dword [edi + 4]
mov dword [ebp - 0xc], edx
cmp esi, 8
jl 0x1002745b
lea eax, [esi + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], eax
mov eax, esi
not eax
cmp eax, 0xffffffef
push 0xfffffffffffffff0
pop ecx
cmovg ecx, eax
lea eax, [esi + 8]
add eax, ecx
mov ecx, ebx
mov ebx, dword [ebp - 0x10]
and eax, 0xfffffff8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
lea esi, [eax + 4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + esi]
xor eax, edi
mov dword [ebp - 0x10], eax
mov eax, dword [ecx]
lea ecx, [ebp - 0x14]
xor eax, edx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
call fcn.100270d7
mov ecx, dword [ebp - 0xc]
sub ebx, 8
mov edx, dword [ebp - 0x14]
add ecx, 8
mov edi, dword [ebp - 0x10]
mov dword [esi - 4], edx
mov dword [esi], edi
lea esi, [esi + 8]
mov dword [ebp - 0xc], ecx
cmp ebx, 0xf
jg 0x100273fe
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
add ecx, 8
mov ebx, dword [ebp - 0x1c]
add ecx, eax
mov esi, dword [ebp + 8]
add ebx, 8
sub esi, eax
mov dword [ebp - 0xc], edx
add ebx, eax
mov dword [ebp - 4], ecx
sub esi, 8
test esi, esi
je 0x100274f7
xor ecx, ecx
lea eax, [esi - 1]
mov dword [ebp + 8], ecx
lea edx, [ebx + esi]
mov ebx, ecx
sub eax, ecx
je 0x100274cd
sub eax, 1
je 0x100274c1
sub eax, 1
je 0x100274b3
sub eax, 1
je 0x100274a8
sub eax, 1
je 0x100274a2
sub eax, 1
je 0x10027499
sub eax, 1
jne 0x100274d3
dec edx
movzx ecx, byte [edx]
shl ecx, 0x10
dec edx
movzx eax, byte [edx]
shl eax, 8
or ecx, eax
dec edx
movzx eax, byte [edx]
or ecx, eax
dec edx
mov eax, ecx
movzx ecx, byte [edx]
shl ecx, 0x18
jmp 0x100274b5
mov eax, ecx
dec edx
mov dword [ebp + 8], eax
movzx eax, byte [edx]
shl eax, 0x10
or ecx, eax
mov ebx, dword [ebp + 8]
dec edx
movzx eax, byte [edx]
shl eax, 8
or ecx, eax
movzx eax, byte [edx - 1]
or ecx, eax
xor ecx, dword [ebp - 0xc]
xor ebx, edi
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x10], ebx
call fcn.100270d7
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
mov dword [eax], edx
mov dword [eax + 4], edx
mov eax, dword [ebp + 0x10]
mov dword [eax + 4], edi
shr edi, 0x10
mov dword [eax], edx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10027573
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
xor edx, edx
push ebx
push esi
mov ebx, ecx
mov esi, 0x10149518
push edi
mov ecx, 0x100
lea edi, [ebp - 0x400]
rep movsd dword es:[edi], dword [esi]
mov esi, ebx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x1002759a
sub esi, ecx
sar esi, 1
add esi, esi
test esi, esi
jg 0x100275b4
or eax, 0xffffffff
jmp 0x100275d2
mov al, byte [ebx]
inc ebx
movzx ecx, al
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ebp + ecx*4 - 0x400]
sub esi, 1
jne 0x100275b4
not edx
mov eax, edx
pop edi
pop esi
pop ebx
leave
ret