joyce8/EMBER2024-capa huggingface dataset:
Function at 0x131f4634
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc10
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3f0], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x131f46ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.1314579c
mov eax, dword [0x1329b498]
cmp dword [eax], 2
jne 0x131f46a3
push esi
call sub.user32.dll_GetWindowTextLengthW
mov edx, eax
inc edx
mov eax, ebx
call fcn.131459e4
mov eax, dword [ebx]
call fcn.13145908
push eax
mov eax, dword [ebx]
call fcn.131458f8
push eax
push esi
call sub.user32.dll_GetWindowTextW
mov eax, dword [ebx]
call fcn.13145908
mov edx, eax
dec edx
mov eax, ebx
call fcn.131459e4
jmp 0x131f46d5
lea eax, [ebp - 0x3e9]
push eax
push 0x3e8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea edx, [ebp - 0x3f0]
lea eax, [ebp - 0x3e9]
call fcn.1314a490
mov edx, dword [ebp - 0x3f0]
mov eax, ebx
call fcn.131458e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x131f46f5
lea eax, [ebp - 0x3f0]
call fcn.13145054
ret
Function at 0x131fe714
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x68], 0
jne 0x131fe72c
mov eax, ebx
call fcn.131fe4ac
cmp dword [ebx + 0x60], 0
jne 0x131fe739
mov eax, ebx
call fcn.131fe404
mov esi, dword [ebx + 0x68]
test esi, esi
je 0x131fe8e0
cmp dword [ebx + 0x60], 0
je 0x131fe8e0
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x68]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.131fe388
mov edx, dword [esp + 0x1c]
mov ecx, edx
mov esi, dword [esp + 0x14]
sub ecx, esi
mov eax, dword [esp]
cmp ecx, eax
je 0x131fe7ac
mov ecx, dword [esp + 4]
sub ecx, dword [esp + 0x20]
add ecx, dword [esp + 0x18]
sar ecx, 1
jns 0x131fe795
adc ecx, 0
push ecx
sub eax, edx
add eax, esi
sar eax, 1
jns 0x131fe7a1
adc eax, 0
push eax
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x4c]
mov eax, dword [eax + 0xd8]
test eax, eax
je 0x131fe7c2
call fcn.1318e76c
mov esi, eax
jmp 0x131fe7c5
mov esi, dword [ebx + 0x48]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
and eax, 8
cmp eax, 8
jne 0x131fe7da
or esi, 0xffffffff
jmp 0x131fe7e4
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x60]
call fcn.131875c8
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x60]
call fcn.131875ec
mov edx, dword [esp]
mov eax, dword [ebx + 0x60]
call fcn.13187614
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x60]
call fcn.13187638
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.131474ec
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x60]
call fcn.1318e76c
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x60]
call fcn.1318e76c
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x60]
call fcn.1318e76c
push eax
call sub.user32.dll_SetWindowLongA
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x68]
call fcn.13169eec
call fcn.13165a20
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x60]
call fcn.1318e76c
push eax
mov eax, dword [0x1329ae30]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x60]
call fcn.1318e76c
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1321bc1c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, ecx
mov edi, edx
mov ebx, eax
mov eax, ebx
call fcn.1321bc08
test eax, eax
jne 0x1321bc3d
mov eax, esi
call fcn.13145054
jmp 0x1321bcce
mov eax, ebx
call fcn.1321bd6c
test al, al
je 0x1321bc83
push 0
push 0
push 0xe
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
mov edi, eax
mov eax, esi
mov ecx, edi
xor edx, edx
call fcn.13145144
test edi, edi
je 0x1321bc7a
mov eax, dword [esi]
push eax
inc edi
push edi
push 0xd
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
jmp 0x1321bcce
mov eax, esi
call fcn.13145054
jmp 0x1321bcce
mov ebp, dword [ebx + 0x78]
test ebp, ebp
je 0x1321bcc7
mov eax, dword [ebp + 0x208]
call fcn.1315b7bc
test eax, eax
jle 0x1321bcb5
mov eax, dword [ebx + 0x78]
mov eax, dword [eax + 0x208]
mov edx, edi
call fcn.131785f4
mov edx, dword [eax + 0xc]
mov eax, esi
call fcn.131450a8
jmp 0x1321bcce
mov eax, esi
mov edx, dword [ebx + 0x78]
mov edx, dword [edx + 0x210]
call fcn.131450a8
jmp 0x1321bcce
mov eax, esi
call fcn.13145054
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x1321d9bc
Capabilities:
Capture webcam image

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 1
push esi
mov ecx, 1
xor edx, edx
xor eax, eax
call fcn.131474d0
push esi
push 0
push 0x419
mov eax, dword [ebx + 0x54]
push eax
call sub.user32.dll_SendMessageA
pop esi
pop ebx
ret
Function at 0x132420e4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x13242155
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x132970dc]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x1324213f
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.132420d4
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x13241eac]
call fcn.1324217c
mov dword [0x13297140], eax
mov eax, dword [ebp - 4]
call fcn.13242084
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1324215c
lea eax, [ebp - 8]
call fcn.13146cd8
ret

Function at 0x13242334
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffea0
mov eax, esp
xor ecx, ecx
mov edx, 0x160
call fcn.13143710
push 0x4001
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x132423cc
call sub.shell32.dll_SHGetFileInfoA
mov dword [0x132970d4], eax
cmp dword [0x132970d4], 0
je 0x132423c4
cmp dword [0x132970d8], 0
jne 0x132423c4
xor ecx, ecx
mov dl, 1
mov eax, dword [0x131e7bd0]
call fcn.131e846c
mov dword [0x132970d8], eax
mov edx, dword [0x132970d4]
mov eax, dword [0x132970d8]
call fcn.13195054
mov eax, dword [0x132970d8]
mov byte [eax + 0x42], 1
mov dl, 1
mov eax, dword [0x132970d8]
call fcn.131e9b40
push 0xffffffffffffffff
mov eax, dword [0x132970d8]
call fcn.13195090
push eax
call sub.comctl32.dll_ImageList_SetBkColor
add esp, 0x160
ret

Function at 0x13246a78
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.13149f60
test al, al
je 0x13246aff
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x160
call fcn.13143710
or esi, 0x100
test esi, esi
jns 0x13246ab3
call fcn.13144178
push esi
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, ebx
call fcn.13145514
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x13246aff
mov dl, 1
mov eax, dword [0x13163abc]
call fcn.1316b4b8
mov dword [esp], eax
mov edx, dword [esp + 4]
mov eax, dword [esp]
call fcn.1316b8c4
mov eax, dword [esp]
mov edx, dword [eax]
call dword [edx + 0x1c]
test al, al
je 0x13246aff
mov eax, esp
call fcn.1314fe5c
mov eax, dword [esp]
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x1327a458
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffdc
mov ebp, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x1327a470
mov eax, ebx
call fcn.13279cec
cmp dword [ebx + 0x68], 0
jne 0x1327a47d
mov eax, ebx
call fcn.13279c48
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x1327a630
cmp dword [ebx + 0x68], 0
je 0x1327a630
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x2c]
mov dword [esp], eax
mov eax, dword [ebx + 0x6c]
mov edx, dword [eax]
call dword [edx + 0x20]
mov dword [esp + 4], eax
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.13279ab8
lea eax, [esp + 0x14]
xor edx, edx
call fcn.132460e0
cmp eax, dword [esp]
je 0x1327a4ff
lea eax, [esp + 0x14]
xor edx, edx
call fcn.132460f4
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x1327a4db
adc edx, 0
push edx
lea eax, [esp + 0x18]
xor edx, edx
call fcn.132460e0
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x1327a4f4
adc edx, 0
push edx
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x1327a512
mov eax, dword [eax + 0x18]
call fcn.1318e76c
mov esi, eax
jmp 0x1327a515
mov esi, dword [ebx + 0x50]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
and eax, 8
cmp eax, 8
jne 0x1327a52a
or esi, 0xffffffff
jmp 0x1327a534
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edi, 0x610
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.131875c8
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x68]
call fcn.131875ec
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.13187614
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.13187638
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.131474ec
mov eax, ebp
mov byte [esp + 0x12], al
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov byte [esp + 0x13], 1
or edi, 2
or edi, 1
push edi
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.1318e76c
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.1318e76c
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.1318e76c
push eax
call sub.user32.dll_SetWindowLongA
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.13169eec
call fcn.13165a20
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.1318e76c
push eax
mov eax, dword [0x1329ae30]
mov eax, dword [eax]
call eax
push 4
mov eax, dword [ebx + 0x68]
call fcn.1318e76c
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x1327a898
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov dword [esp], eax
mov eax, dword [esp]
xor ecx, ecx
mov edx, 0x10
call fcn.13143710
lea eax, [esp + 0x38]
push eax
call sub.kernel32.dll_GetSystemInfo
call sub.user32.dll_GetDesktopWindow
test eax, eax
je 0x1327aa84
push 0
push 0x1327aa8c
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x1327aa84
push 0
push 0x1327aa9c
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x1327aa84
push 0
push 0x1327aaac
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x1327aa84
push 0
push 0x1327aabc
push 0
push eax
call sub.user32.dll_FindWindowExA
mov ebp, eax
test ebp, ebp
je 0x1327aa84
push 0
push 0
push 0x418
push ebp
call sub.user32.dll_SendMessageA
mov dword [esp + 4], eax
cmp dword [esp + 4], 1
jl 0x1327aa84
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push ebp
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp + 8], 0
je 0x1327aa84
mov eax, dword [esp + 8]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
je 0x1327aa84
push 0x40
push 0x1000
push 0x1000
push 0
push edi
call sub.kernel32.dll_VirtualAllocEx
mov esi, eax
test esi, esi
je 0x1327aa84
or ebx, 0xffffffff
cmp ebx, dword [esp + 4]
jge 0x1327aa70
inc ebx
push esi
push ebx
push 0x417
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x1327aa66
lea eax, [esp + 0xc]
push eax
push 0x18
lea eax, [esp + 0x1c]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x1327aa66
test byte [esp + 0x1d], 0xd
jne 0x1327aa66
mov al, byte [esp + 0x1c]
and al, 8
cmp al, 8
je 0x1327aa66
lea eax, [esp + 0xc]
push eax
push 4
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
push eax
push edi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x1327aa66
cmp dword [esp + 0xc], 0
je 0x1327aa66
mov eax, dword [0x1329b224]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
cmp eax, dword [esp + 0x10]
jne 0x1327aa66
push esi
push ebx
push 0x41d
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x1327aa42
lea eax, [esp + 0xc]
push eax
push 0x10
mov eax, dword [esp + 8]
push eax
push esi
push edi
call sub.kernel32.dll_ReadProcessMemory
cmp dword [esp + 0xc], 0
je 0x1327aa70
lea eax, [esp + 0x28]
push eax
push ebp
call sub.user32.dll_GetWindowRect
mov eax, dword [esp]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
call fcn.13147530
jmp 0x1327aa70
cmp ebx, dword [esp + 4]
jl 0x1327a9a6
push 0x8000
push 0
push esi
push edi
call sub.kernel32.dll_VirtualFreeEx
push edi
call sub.kernel32.dll_CloseHandle_1
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x132865fc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd0
mov dword [esp], edx
mov ebx, eax
lea edx, [esp + 0x20]
mov eax, dword [esp]
mov ecx, 0x10
call fcn.13142cf0
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
dec eax
test eax, eax
jl 0x13286758
inc eax
mov dword [esp + 0x1c], eax
lea eax, [ebx + 8]
mov ebx, eax
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx]
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 4]
add edx, eax
add eax, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shr edi, 0x11
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 9
xor eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, eax
shr edi, 0xf
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 0xb
xor eax, edi
mov edi, edx
mov edx, esi
mov esi, edi
mov edi, ecx
mov ecx, eax
mov eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shr edi, 0x11
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 9
xor eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, eax
shr edi, 0xf
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 0xb
xor eax, edi
xor edx, dword [esp + 0x14]
xor ecx, edx
mov dword [esp + 4], ecx
xor esi, dword [esp + 0x18]
xor eax, esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
add ebx, 8
dec dword [esp + 0x1c]
jne 0x1328664e
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov edx, dword [esp]
lea eax, [esp + 0x20]
mov ecx, 0x10
call fcn.13142cf0
add esp, 0x30
pop edi
pop esi
pop ebx
ret
Function at 0x13286790
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff74
mov byte [esp + 8], cl
mov dword [esp + 4], edx
mov dword [esp], eax
mov ecx, 0x38
mov esi, 0x1329835c
lea eax, [esp + 0x1c]
movzx edi, byte [esi]
mov edx, edi
and edx, 0x80000007
jns 0x132867c5
dec edx
or edx, 0xfffffff8
inc edx
test edi, edi
jns 0x132867cc
add edi, 7
sar edi, 3
mov ebx, dword [esp]
mov bl, byte [ebx + edi]
and bl, byte [edx + 0x132983d4]
setne dl
mov byte [eax], dl
inc eax
inc esi
dec ecx
jne 0x132867b3
xor eax, eax
mov dword [esp + 0x14], eax
mov esi, 0x132983c4
mov eax, dword [esp + 4]
mov dword [esp + 0x18], eax
xor ecx, ecx
lea eax, [esp + 0x54]
movzx edi, byte [esi]
add edi, ecx
cmp edi, 0x1c
jge 0x13286817
mov dl, byte [esp + edi + 0x1c]
mov byte [eax], dl
mov dl, byte [esp + edi + 0x38]
mov byte [eax + 0x1c], dl
jmp 0x13286823
mov dl, byte [esp + edi]
mov byte [eax], dl
mov dl, byte [esp + edi + 0x1c]
mov byte [eax + 0x1c], dl
inc ecx
inc eax
cmp ecx, 0x1c
jne 0x132867fe
lea eax, [esp + 9]
xor ecx, ecx
mov edx, 8
call fcn.13143710
xor ecx, ecx
mov ebp, 0x13298394
xor eax, eax
mov al, byte [ebp]
cmp byte [esp + eax + 0x54], 0
je 0x13286872
mov eax, ecx
mov ebx, 6
cdq
idiv ebx
mov edi, eax
mov eax, ecx
mov ebx, 6
cdq
idiv ebx
xor eax, eax
mov al, byte [edx + 0x132983d4]
shr eax, 2
or byte [esp + edi + 9], al
inc ecx
inc ebp
cmp ecx, 0x30
jne 0x13286841
cmp byte [esp + 8], 0
je 0x132868dd
xor eax, eax
mov al, byte [esp + 9]
shl eax, 0x18
xor edx, edx
mov dl, byte [esp + 0xb]
shl edx, 0x10
or eax, edx
xor edx, edx
mov dl, byte [esp + 0xd]
shl edx, 8
or eax, edx
xor edx, edx
mov dl, byte [esp + 0xf]
or eax, edx
mov edx, dword [esp + 0x18]
mov dword [edx], eax
xor eax, eax
mov al, byte [esp + 0xa]
shl eax, 0x18
xor edx, edx
mov dl, byte [esp + 0xc]
shl edx, 0x10
or eax, edx
xor edx, edx
mov dl, byte [esp + 0xe]
shl edx, 8
or eax, edx
xor edx, edx
mov dl, byte [esp + 0x10]
or eax, edx
mov edx, dword [esp + 0x18]
mov dword [edx + 4], eax
jmp 0x13286950
xor edx, edx
mov dl, byte [esp + 9]
shl edx, 0x18
xor ecx, ecx
mov cl, byte [esp + 0xb]
shl ecx, 0x10
or edx, ecx
xor ecx, ecx
mov cl, byte [esp + 0xd]
shl ecx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [esp + 0xf]
or edx, ecx
mov eax, dword [esp + 0x14]
add eax, eax
mov ecx, eax
inc ecx
mov ebx, 0x1f
sub ebx, ecx
mov ecx, dword [esp + 4]
mov dword [ecx + ebx*4], edx
xor edx, edx
mov dl, byte [esp + 0xa]
shl edx, 0x18
xor ecx, ecx
mov cl, byte [esp + 0xc]
shl ecx, 0x10
or edx, ecx
xor ecx, ecx
mov cl, byte [esp + 0xe]
shl ecx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [esp + 0x10]
or edx, ecx
mov ecx, 0x1f
sub ecx, eax
mov eax, dword [esp + 4]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
add dword [esp + 0x18], 8
inc esi
cmp dword [esp + 0x14], 0x10
jne 0x132867f8
mov eax, dword [esp + 4]
mov dl, byte [esp + 8]
mov byte [eax + 0x80], dl
add esp, 0x8c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x13286980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dl, byte [ebp + 8]
mov byte [eax], dl
mov edx, ebx
mov eax, 0x10
call fcn.132864e4
mov edx, eax
mov eax, 4
call fcn.132864ec
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x24], 0x13297304
mov eax, dword [ebp - 4]
add eax, 8
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov ecx, dword [ebp - 0x24]
mov esi, dword [ecx]
mov ecx, esi
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx + 4]
mov dword [ebp - 0xc], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 0xc]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], esi
mov esi, 8
mov edi, ecx
shl edi, 0xb
xor edx, edi
add dword [ebp - 0xc], edx
add ecx, ebx
mov edi, ebx
shr edi, 2
xor ecx, edi
add dword [ebp - 0x10], ecx
add ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
shl edi, 8
xor ebx, edi
add dword [ebp - 0x14], ebx
mov edi, dword [ebp - 0x10]
add dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
shr edi, 0x10
xor dword [ebp - 0xc], edi
mov edi, dword [ebp - 0xc]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x14]
add dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x14]
shl edi, 0xa
xor dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x10]
add dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x18]
add dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x18]
shr edi, 4
xor dword [ebp - 0x14], edi
add edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x1c]
shl edi, 8
xor dword [ebp - 0x18], edi
add ecx, dword [ebp - 0x18]
add dword [ebp - 0x1c], edx
mov edi, edx
shr edi, 9
xor dword [ebp - 0x1c], edi
add ebx, dword [ebp - 0x1c]
add edx, ecx
dec esi
jne 0x13286a00
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x14], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x1c], edx
add eax, 0x20
add dword [ebp - 0x24], 4
dec dword [ebp - 0x20]
jne 0x132869ce
cmp byte [ebp + 8], 0
jne 0x13286b2f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x13286b04
inc eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 4]
add edx, 8
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
dec ecx
sub ecx, dword [ebp - 0x20]
mov ebx, dword [edx]
mov dword [ebp + ecx*8 - 0xa4], ebx
mov ebx, dword [edx + 4]
mov dword [ebp + ecx*8 - 0xa0], ebx
inc dword [ebp - 0x20]
add edx, 8
dec eax
jne 0x13286ade
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x13286b2f
inc eax
lea edx, [ebp - 0xa4]
mov ebx, dword [ebp - 4]
add ebx, 8
mov ecx, dword [edx]
mov dword [ebx], ecx
mov ecx, dword [edx + 4]
mov dword [ebx + 4], ecx
add ebx, 8
add edx, 8
dec eax
jne 0x13286b1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4