joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004210
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push ebx
push ebp
mov eax, dword [ecx]
push esi
mov esi, dword [esp + 0x24]
lea ebp, [ecx + 8]
push edi
mov dword [esp + 0x24], ebp
mov ecx, esi
sub edx, esi
mov edi, 0x10
mov bl, byte [edx + ecx]
mov byte [ecx], bl
inc ecx
dec edi
jne 0x10004235
cdq
sub eax, edx
sar eax, 1
test eax, eax
jle 0x10004313
mov dword [esp + 0x2c], eax
lea edi, [esp + 0x10]
xor ecx, ecx
sub ebp, esi
mov eax, esi
sub edi, esi
xor edx, edx
xor ebx, ebx
mov dl, byte [eax + ebp]
mov bl, byte [eax]
xor edx, ebx
mov ebx, ecx
and ebx, 0x80000003
jns 0x10004275
dec ebx
or ebx, 0xfffffffc
inc ebx
shl ebx, 8
inc ecx
inc eax
mov dl, byte [edx + ebx + 0x10040858]
cmp ecx, 0x10
mov byte [edi + eax - 1], dl
jl 0x1000425b
lea eax, [esp + 0x10]
push esi
push eax
call fcn.10003980
mov ecx, dword [esp + 0x2c]
mov ebp, 2
add ecx, 0x10
add esp, 8
mov dword [esp + 0x24], ecx
sub ecx, esi
mov eax, esi
sub ebp, esi
mov dword [esp + 0x28], 0x10
xor edx, edx
xor ebx, ebx
mov dl, byte [eax + ecx]
mov bl, byte [eax]
xor edx, ebx
lea ebx, [eax + ebp]
and ebx, 0x80000003
jns 0x100042d1
dec ebx
or ebx, 0xfffffffc
inc ebx
shl ebx, 8
inc eax
mov dl, byte [edx + ebx + 0x10040858]
mov byte [eax + edi - 1], dl
mov edx, dword [esp + 0x28]
dec edx
mov dword [esp + 0x28], edx
jne 0x100042b6
lea eax, [esp + 0x10]
push esi
push eax
call fcn.10003980
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
add esp, 8
add ebp, 0x10
dec eax
mov dword [esp + 0x24], ebp
mov dword [esp + 0x2c], eax
jne 0x1000424f
lea ecx, [esp + 0x10]
push ecx
push esi
call fcn.10003980
lea edx, [esp + 0x18]
lea eax, [esp + 0x18]
add esp, 8
xor ecx, ecx
sub ebp, edx
sub esi, eax
mov bl, byte [esp + ecx + 0x10]
lea eax, [esp + ecx + 0x10]
mov dl, byte [eax + ebp]
xor dl, bl
inc ecx
cmp ecx, 0x10
mov byte [esi + eax], dl
jl 0x1000432f
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov cl, byte [esp + 0x10]
mov byte [esp + 0x10], cl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x10005d10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
xor edx, edx
cmp dword [esi + 0x408], edx
lea eax, [ebp + 4]
lea ecx, [edi + 4]
lea ebx, [esi + 4]
jle 0x10005d52
sub ebx, ecx
mov ebp, dword [ebx + ecx]
add eax, 4
xor ebp, dword [ecx]
add ecx, 4
inc edx
mov dword [eax - 4], ebp
mov ebp, dword [esi + 0x408]
cmp edx, ebp
jl 0x10005d35
mov ebp, dword [esp + 0x14]
cmp edx, dword [edi + 0x408]
jge 0x10005d6f
mov esi, dword [ecx]
add ecx, 4
mov dword [eax], esi
mov esi, dword [edi + 0x408]
add eax, 4
inc edx
cmp edx, esi
jl 0x10005d5a
mov ecx, dword [edi + 0x408]
sub eax, 4
mov dword [ebp + 0x408], ecx
cmp dword [eax], 0
jne 0x10005d9d
mov ecx, dword [ebp + 0x408]
cmp ecx, 1
jle 0x10005d9d
dec ecx
sub eax, 4
mov dword [ebp + 0x408], ecx
cmp dword [eax], 0
je 0x10005d83
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100061f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x18]
push edi
xor ecx, ecx
mov edi, dword [esi + 0x408]
mov dword [esp + 0x14], ecx
dec edi
js 0x10006245
mov eax, dword [esp + 0x20]
push ebx
cdq
lea esi, [esi + edi*4 + 4]
push ebp
mov ebx, eax
mov dword [esp + 0x14], edx
inc edi
mov edx, dword [esi]
xor eax, eax
xor eax, edx
mov edx, dword [esp + 0x14]
xor ebp, ebp
push edx
xor ecx, ebp
push ebx
push ecx
push eax
call fcn.10032be0
sub esi, 4
dec edi
mov ecx, eax
mov dword [esp + 0x1c], edx
jne 0x1000621a
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x10
ret
pop edi
mov eax, ecx
pop esi
add esp, 0x10
ret
Function at 0x1000b9a0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x1000b9e2
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1000b9dd
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1000b9c7
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1000b9cf
cmp edx, ebx
jne 0x1000bb1d
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1000b99e
add eax, dword [eax + 4]
jmp 0x1000b98b
mov dword [ebp + 0xc], ebx
jmp 0x1000b9ed
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1000ba05
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1000ba23
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1000ba81
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1000ba68
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1000ba71
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1000ba7b
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1000ba5d
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1000b9e7
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1000bace
dec eax
je 0x1000bac5
sub eax, 3
je 0x1000babc
mov dword [ebp - 4], 0x40
jmp 0x1000baeb
mov dword [ebp - 4], 4
jmp 0x1000bad1
mov dword [ebp - 4], 0x20
jmp 0x1000bad1
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1000bb1d
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1000ba9d
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1000b32e
pushfd
inc ebp
mov esi, 0x1475ffb7
push 1
push esi
call edi
mov eax, esi
jmp 0x1000bb29
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000b9e0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x1000b9e2
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x1000b9dd
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x1000b9c7
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x1000b9cf
cmp edx, ebx
jne 0x1000bb1d
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1000b99e
add eax, dword [eax + 4]
jmp 0x1000b98b
mov dword [ebp + 0xc], ebx
jmp 0x1000b9ed
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x1000ba05
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1000ba23
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x1000ba81
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x1000ba68
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x1000ba71
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1000ba7b
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1000ba5d
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x1000b9e7
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x1000bace
dec eax
je 0x1000bac5
sub eax, 3
je 0x1000babc
mov dword [ebp - 4], 0x40
jmp 0x1000baeb
mov dword [ebp - 4], 4
jmp 0x1000bad1
mov dword [ebp - 4], 0x20
jmp 0x1000bad1
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x1000bb1d
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1000ba9d
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1000b32e
pushfd
inc ebp
mov esi, 0x1475ffb7
push 1
push esi
call edi
mov eax, esi
jmp 0x1000bb29
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000f150
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x84
push ebx
push ebp
push esi
push edi
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
mov ebx, dword [esp + 0x98]
stosw word es:[edi], ax
test ebx, ebx
stosb byte es:[edi], al
je 0x1000f271
mov eax, dword [esp + 0x9c]
test eax, eax
je 0x1000f271
mov esi, dword [esp + 0xa4]
test esi, 0xf00
je 0x1000f1a9
xor esi, 0x100
mov dword [esp + 0xa4], esi
lea edi, [ebx + 0x88]
push esi
push edi
mov dword [ebx], esi
call fcn.1000db10
add esp, 8
test eax, eax
jne 0x1000f276
mov edx, dword [edi]
lea ebp, [ebx + 4]
mov ecx, 0x20
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0x10], edx
cmp ecx, edx
ja 0x1000f200
mov esi, dword [esp + 0x9c]
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0xa4]
jmp 0x1000f224
mov edx, dword [ebx]
mov eax, dword [esp + 0x9c]
push edx
push ecx
lea ecx, [ebx + 0x84]
push eax
push ecx
push ebp
call fcn.1000dd80
add esp, 0x14
test eax, eax
jne 0x1000f276
mov edx, dword [esp + 0x10]
xor eax, eax
mov dword [ebx + 0x84], edx
test edx, edx
jbe 0x1000f23f
mov cl, byte [eax + ebp]
xor cl, 0x36
mov byte [esp + eax + 0x14], cl
inc eax
cmp eax, edx
jb 0x1000f230
add ebx, 0x90
push esi
push ebx
call fcn.1000db90
add esp, 8
test eax, eax
jne 0x1000f276
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push ebx
call fcn.1000dc30
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret
mov eax, 0xfffff63b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret

Function at 0x1000f2c0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc4
push ebp
push esi
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
mov byte [esp + 0x50], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x51]
mov esi, dword [esp + 0xd4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
test esi, esi
stosb byte es:[edi], al
je 0x1000f3a5
mov eax, dword [esp + 0xd8]
test eax, eax
je 0x1000f3a5
mov ebp, dword [esi + 0x88]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
lea edi, [esi + 0x90]
push eax
push ecx
push edi
call fcn.1000dce0
add esp, 0xc
test eax, eax
jne 0x1000f3aa
test ebp, ebp
jbe 0x1000f348
mov dl, byte [esi + eax + 4]
xor dl, 0x5c
mov byte [esp + eax + 0x50], dl
inc eax
cmp eax, ebp
jb 0x1000f338
mov eax, dword [esi]
push eax
push edi
call fcn.1000db90
add esp, 8
test eax, eax
jne 0x1000f3aa
lea ecx, [esp + 0x50]
push ebp
push ecx
push edi
call fcn.1000dc30
add esp, 0xc
test eax, eax
jne 0x1000f3aa
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push edi
call fcn.1000dc30
add esp, 0xc
test eax, eax
jne 0x1000f3aa
mov ecx, dword [esp + 0xdc]
mov edx, dword [esp + 0xd8]
push ecx
push edx
push edi
call fcn.1000dce0
add esp, 0xc
pop edi
pop esi
pop ebp
add esp, 0xc4
ret
mov eax, 0xfffff639
pop edi
pop esi
pop ebp
add esp, 0xc4
ret
Function at 0x100116b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 8
mov edx, dword [eax]
push ebx
push ebp
push esi
lea ecx, [edx - 2]
push edi
cmp ecx, 3
ja case.0x100116ef.2
jmp dword [ecx*4 + 0x100118b0]
mov ebp, 0x14
jmp 0x100116e6
mov ebp, 0x20
jmp 0x100116e6
mov ebp, 0x30
jmp 0x100116e6
mov ebp, 0x40
mov ecx, dword [eax + 4]
dec ecx
cmp ecx, 4
ja case.0x100116ef.2
jmp dword [ecx*4 + 0x100118c0]
mov dword [esp + 0x2c], 2
jmp 0x1001171c
mov dword [esp + 0x2c], 3
jmp 0x1001171c
mov dword [esp + 0x2c], 4
jmp 0x1001171c
mov dword [esp + 0x2c], 5
cmp dword [eax + 8], 1
je 0x1001172f
pop edi
pop esi
pop ebp
mov eax, 0xfffff447
pop ebx
add esp, 8
ret
mov ecx, dword [eax + 0x10]
cmp ecx, 0x8000
jbe 0x10011747
pop edi
pop esi
pop ebp
mov eax, 0xfffff446
pop ebx
add esp, 8
ret
mov ebx, dword [esp + 0x20]
lea esi, [ebp + ebp + 2]
mov edi, esi
mov esi, ebx
sub esi, edi
mov edi, dword [esp + 0x28]
cmp edi, esi
jbe 0x1001176a
pop edi
pop esi
pop ebp
mov eax, 0xfffff446
pop ebx
add esp, 8
ret
mov esi, dword [esp + 0x1c]
mov eax, dword [eax + 0xc]
push edx
push ecx
lea ecx, [esp + 0x18]
lea esi, [esi + ebp + 1]
push eax
sub ebx, ebp
push ecx
push esi
mov dword [esp + 0x28], esi
dec ebx
call fcn.1000dd80
add esp, 0x14
test eax, eax
jne 0x100118a7
mov ecx, ebx
lea edx, [esi + ebp]
sub ecx, ebp
push 1
sub ecx, edi
mov edi, edx
dec ecx
mov dword [esp + 0x14], ecx
mov esi, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
mov esi, dword [esp + 0x28]
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x14]
mov byte [edx + ecx], 1
add edx, ecx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
lea edi, [edx + 1]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10032980
mov esi, eax
add esp, 8
test esi, esi
jne 0x100117f5
mov ebx, 0xbffff445
jmp 0x1001187e
mov edi, dword [esp + 0x1c]
push ebp
mov byte [edi], 0
inc edi
push edi
call fcn.10014320
mov ecx, dword [esp + 0x34]
push ecx
push ebp
push edi
push ebx
push esi
call fcn.100113e0
add esp, 0x1c
mov dword [esp + 0x28], eax
test eax, eax
jne 0x1001187a
test ebx, ebx
jbe 0x1001183e
mov eax, dword [esp + 0x14]
mov ecx, esi
sub ecx, eax
mov dword [esp + 0x28], ebx
mov dl, byte [ecx + eax]
xor byte [eax], dl
mov edx, dword [esp + 0x28]
inc eax
dec edx
mov dword [esp + 0x28], edx
jne 0x1001182d
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
push eax
push ebx
push ecx
push ebp
push esi
call fcn.100113e0
add esp, 0x14
mov dword [esp + 0x28], eax
test eax, eax
jne 0x1001187a
test ebp, ebp
jbe 0x10011872
mov ecx, esi
mov eax, edi
sub ecx, edi
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec ebp
jne 0x10011865
mov dword [esp + 0x28], 0
mov ebx, dword [esp + 0x28]
test esi, esi
je 0x100118a5
mov ecx, dword [esp + 0x20]
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov al, byte [esi]
mov byte [esi], al
push esi
call fcn.10032abd
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x100131e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov al, byte [esi]
xor al, 0x30
inc esi
test al, al
je 0x100131fb
pop edi
pop esi
pop ebp
mov eax, 0xfffff251
pop ebx
ret
mov al, byte [esi]
cmp al, 0x80
jae 0x10013204
inc esi
jmp 0x10013222
and eax, 0xff
xor ecx, ecx
xor eax, 0x80
inc esi
test eax, eax
jle 0x10013222
xor edx, edx
mov dl, byte [esi]
shl ecx, 8
xor ecx, edx
inc esi
dec eax
jne 0x10013215
mov al, byte [esi]
inc esi
cmp al, 2
je 0x10013233
pop edi
pop esi
pop ebp
mov eax, 0xfffff251
pop ebx
ret
mov al, byte [esi]
cmp al, 0x80
jae 0x10013243
and eax, 0xff
inc esi
mov ebp, eax
jmp 0x10013261
and eax, 0xff
xor ebp, ebp
xor eax, 0x80
inc esi
test eax, eax
jle 0x10013261
xor ecx, ecx
mov cl, byte [esi]
shl ebp, 8
xor ebp, ecx
inc esi
dec eax
jne 0x10013254
mov ebx, dword [esp + 0x14]
mov ecx, 0x103
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov dl, byte [ebx]
mov byte [ebx], dl
push ebp
push esi
push ebx
mov dword [ebx + 0x408], 1
call fcn.10011390
add esp, 0xc
add esi, ebp
test eax, eax
jne 0x100132f8
mov al, byte [esi]
inc esi
cmp al, 2
je 0x100132a0
pop edi
pop esi
pop ebp
mov eax, 0xfffff251
pop ebx
ret
mov al, byte [esi]
cmp al, 0x80
jae 0x100132b0
and eax, 0xff
inc esi
mov ebp, eax
jmp 0x100132ce
and eax, 0xff
xor ebp, ebp
xor eax, 0x80
inc esi
test eax, eax
jle 0x100132ce
xor ecx, ecx
mov cl, byte [esi]
shl ebp, 8
xor ebp, ecx
inc esi
dec eax
jne 0x100132c1
lea edx, [ebx + 0x40c]
mov ecx, 0x103
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov al, byte [edx]
mov byte [edx], al
push ebp
push esi
push edx
mov dword [ebx + 0x814], 1
call fcn.10011390
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100143f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x8c
push ebx
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x9c]
push edi
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], eax
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0xa8]
lea eax, [esp + 0x34]
push eax
call fcn.10023540
lea ecx, [esp + 0x18]
push 0x20
lea edx, [esp + 0x3c]
push ecx
push edx
call fcn.10023570
push edi
lea eax, [esp + 0x48]
push ebp
push eax
call fcn.10023570
lea ecx, [esp + 0x2c]
push 4
lea edx, [esp + 0x54]
push ecx
push edx
call fcn.10023570
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x5c]
push eax
push ecx
call fcn.10023640
add esp, 0x30
xor eax, eax
mov edx, dword [esp + 0x10]
shl edx, 5
add edx, eax
mov bl, byte [edx + esi]
lea ecx, [edx + esi]
mov dl, byte [esp + eax + 0x14]
xor bl, dl
inc eax
cmp eax, 0x20
mov byte [ecx], bl
jb 0x1001446c
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 8
mov dword [esp + 0x10], eax
jb 0x10014420
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret

Function at 0x10014550
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x8c
push ebx
push ebp
mov ebp, dword [esp + 0x98]
push esi
push edi
mov dword [esp + 0x10], 0
lea eax, [esp + 0x34]
push eax
call fcn.10023540
add esp, 4
xor esi, esi
mov edi, ebp
cmp dword [esp + 0x10], esi
je 0x10014590
push 0x20
lea ecx, [esp + 0x38]
push edi
push ecx
call fcn.10023570
add esp, 0xc
inc esi
add edi, 0x20
cmp esi, 8
jb 0x1001457a
lea edx, [esp + 0x10]
push 4
lea eax, [esp + 0x38]
push edx
push eax
call fcn.10023570
lea ecx, [esp + 0x20]
lea edx, [esp + 0x40]
push ecx
push edx
call fcn.10023640
add esp, 0x14
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dl, byte [esp + eax + 0x14]
shl ecx, 5
add ecx, eax
add ecx, ebp
mov bl, byte [ecx]
xor bl, dl
inc eax
cmp eax, 0x20
mov byte [ecx], bl
jb 0x100145be
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 8
mov dword [esp + 0x10], eax
jb 0x10014569
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x8c
ret

Function at 0x1001dab0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
ret
Function at 0x10031e20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x3d]
mov byte [esp + 0x3c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x60]
lea edi, [esp + 0x1c]
mov dword [esp + 0x10], 0
mov ecx, dword [eax + 0x40]
lea esi, [eax + 0x20]
mov edx, ecx
mov dword [esp + 0x14], esi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov ebx, dword [eax + 8]
mov ebp, dword [eax + 0x44]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x70]
test ecx, ecx
jbe 0x10031f5f
jmp 0x10031e91
mov eax, dword [esp + 0x60]
push 0
lea ecx, [esp + 0x20]
push ebx
push ecx
lea edx, [esp + 0x24]
lea ecx, [esp + 0x48]
push edx
push ecx
push eax
call fcn.10031a10
add esp, 0x18
test eax, eax
jne 0x10031f83
xor esi, esi
test ebp, ebp
jbe 0x10031edf
mov edi, dword [esp + 0x6c]
mov ecx, dword [esp + 0x64]
lea edx, [esp + 0x3c]
lea eax, [esp + 0x3c]
sub edi, edx
sub ecx, eax
lea eax, [esp + esi + 0x3c]
mov dl, byte [edi + eax]
xor dl, byte [eax]
inc esi
cmp esi, ebp
mov byte [ecx + eax], dl
jb 0x10031ece
mov edi, ebx
xor ecx, ecx
sub edi, ebp
je 0x10031ef5
lea esi, [esp + ecx + 0x1c]
inc ecx
cmp ecx, edi
mov al, byte [esi + ebp]
mov byte [esi], al
jb 0x10031ee7
mov eax, dword [esp + 0x74]
test eax, eax
mov eax, edi
jne 0x10031f1b
cmp eax, ebx
jae 0x10031f35
mov edx, dword [esp + 0x64]
mov ecx, eax
sub ecx, ebx
add ecx, ebp
inc eax
cmp eax, ebx
mov cl, byte [ecx + edx]
mov byte [esp + eax + 0x1b], cl
jb 0x10031f03
jmp 0x10031f35
cmp eax, ebx
jae 0x10031f35
mov ecx, dword [esp + 0x6c]
mov edx, eax
sub edx, ebx
add edx, ebp
inc eax
cmp eax, ebx
mov dl, byte [edx + ecx]
mov byte [esp + eax + 0x1b], dl
jb 0x10031f1f
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x6c]
mov esi, dword [esp + 0x64]
mov ecx, dword [esp + 0x70]
add eax, ebp
add edi, ebp
add esi, ebp
cmp eax, ecx
mov dword [esp + 0x6c], edi
mov dword [esp + 0x64], esi
mov dword [esp + 0x10], eax
jb 0x10031e8d
mov edi, dword [esp + 0x14]
mov ecx, ebx
mov eax, ecx
lea esi, [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x70]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x68]
mov dword [ecx], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
Function at 0x10031f90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x3d]
mov byte [esp + 0x3c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
mov ebx, dword [esp + 0x60]
mov dword [esp + 0x10], 0
stosw word es:[edi], ax
mov ecx, dword [ebx + 0x40]
mov ebp, dword [ebx + 0x44]
stosb byte es:[edi], al
mov eax, dword [ebx + 8]
mov edx, ecx
mov dword [esp + 0x60], eax
lea eax, [ebx + 0x20]
mov esi, eax
lea edi, [esp + 0x3c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [esp + 0x14], eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x70]
test ecx, ecx
jbe 0x1003209f
mov eax, dword [esp + 0x60]
push 0
lea ecx, [esp + 0x40]
push eax
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x28]
push edx
push eax
push ebx
call fcn.10031a10
add esp, 0x18
test eax, eax
jne 0x100320c3
xor ecx, ecx
test ebp, ebp
jbe 0x10032053
mov esi, dword [esp + 0x6c]
mov edi, dword [esp + 0x64]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x1c]
sub esi, edx
sub edi, eax
lea eax, [esp + ecx + 0x1c]
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc ecx
cmp ecx, ebp
mov byte [edi + eax], dl
jb 0x10032042
mov ecx, dword [esp + 0x60]
test ecx, ecx
jbe 0x10032071
mov eax, ecx
lea esi, [esp + 0x1c]
lea edi, [esp + 0x3c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x6c]
mov esi, dword [esp + 0x64]
mov ecx, dword [esp + 0x70]
add eax, ebp
add edi, ebp
add esi, ebp
cmp eax, ecx
mov dword [esp + 0x6c], edi
mov dword [esp + 0x64], esi
mov dword [esp + 0x10], eax
jb 0x10032001
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x60]
lea esi, [esp + 0x3c]
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x68]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x70]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret