joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001938f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
push esi
push edi
mov edi, eax
lea esi, [edi + 1]
shr esi, 1
cmp esi, 0x80
ja 0x10019484
mov eax, dword [ebp + 0x1c]
add eax, ebx
cmp eax, 0x50
mov dword [ebp - 4], eax
ja 0x10019484
cmp dword [ebp + 0xc], 0xe0
ja 0x10019484
push esi
push dword [ebp + 0x10]
lea eax, [ebp - 0xd8]
push eax
call sub.MSVCRT.dll_memcpy
and edi, 1
mov eax, esi
sub eax, edi
add eax, dword [ebp + 0x10]
add esp, 0xc
push esi
push eax
lea eax, [ebp - 0x158]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push ebx
push dword [ebp + 0x14]
lea eax, [ebp - 0x58]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push dword [ebp + 0x1c]
lea eax, [ebp + ebx - 0x58]
push dword [ebp + 0x18]
push eax
call sub.MSVCRT.dll_memcpy
mov edi, dword [ebp + 0xc]
add esp, 0xc
push dword [ebp - 4]
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x318]
push edi
push eax
xor eax, eax
inc eax
mov ecx, esi
call fcn.10019260
add esp, 0x14
push dword [ebp - 4]
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x158]
push eax
push edi
lea eax, [ebp - 0x238]
push eax
push 2
pop eax
mov ecx, esi
call fcn.10019260
add esp, 0x14
xor eax, eax
test edi, edi
jbe 0x10019484
mov cl, byte [ebp + eax - 0x238]
xor cl, byte [ebp + eax - 0x318]
mov edx, dword [ebp + 8]
mov byte [eax + edx], cl
inc eax
cmp eax, edi
jb 0x1001946b
pop edi
pop esi
leave
ret

Function at 0x1001e60a
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov dword [eax + 0xc], 0x67452301
mov dword [eax + 0x10], 0xefcdab89
mov dword [eax + 0x14], 0x98badcfe
mov dword [eax + 0x18], 0x10325476
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
ret

Function at 0x1001eccd
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esi]
push ebx
push edi
lea edi, [esi + 4]
mov ecx, dword [edi]
lea edx, [eax + ecx]
cmp edx, ecx
mov dword [edi], edx
jae 0x1001ece2
inc dword [esi + 8]
mov byte [eax + esi + 0x1c], 0x80
inc dword [esi]
mov eax, dword [esi]
xor ebx, ebx
cmp eax, 0x38
jbe 0x1001ed15
push 0x40
pop ecx
sub ecx, eax
push ecx
lea eax, [eax + esi + 0x1c]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, esi
mov dword [esi], 0x40
call fcn.1001e631
mov dword [esi], ebx
mov eax, dword [esi]
push 0x38
pop ecx
sub ecx, eax
push ecx
lea eax, [eax + esi + 0x1c]
push ebx
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [edi]
mov ecx, eax
shl eax, 3
lea ebx, [esi + 8]
mov edx, dword [ebx]
push 4
shr ecx, 0x1d
mov dword [edi], eax
lea eax, [esi + 0x54]
lea ecx, [ecx + edx*8]
push edi
push eax
mov dword [ebx], ecx
call sub.MSVCRT.dll_memcpy
push 4
lea eax, [esi + 0x58]
push ebx
push eax
call sub.MSVCRT.dll_memcpy
mov eax, esi
call fcn.1001e631
push 0x10
lea eax, [esi + 0xc]
push eax
push dword [esp + 0x38]
call sub.MSVCRT.dll_memcpy
add esp, 0x30
pop edi
mov eax, esi
pop ebx
jmp fcn.1001e60a
Function at 0x1001ed78
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test eax, eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
lea ecx, [esi + 0xac]
push edi
lea edi, [esi + 0x6c]
mov dword [ebp + 8], ecx
mov byte [esi + 0x10d], 0
mov byte [esi + 0x10c], al
je 0x1001edaf
cmp eax, 1
je 0x1001edaf
cmp eax, 2
je 0x1001edaf
cmp eax, 5
jne 0x1001edd3
sub eax, 0
je 0x1001edcc
dec eax
je 0x1001edc3
dec eax
jne 0x1001edd3
mov eax, esi
call fcn.1002092c
jmp 0x1001edd3
mov eax, esi
call fcn.10020f64
jmp 0x1001edd3
mov eax, esi
call fcn.1001e60a
movzx eax, byte [esi + 0x10c]
sub eax, 0
je 0x1001ee17
dec eax
je 0x1001edfe
dec eax
jne 0x1001ee3c
cmp ebx, 0x40
push ebx
push edx
jbe 0x1001ee1e
call fcn.10020d5a
push edi
call fcn.10020dc2
add esp, 0xc
push 0x20
jmp 0x1001ee3b
cmp ebx, 0x40
push ebx
push edx
jbe 0x1001ee1e
call fcn.1001ff1c
push edi
call fcn.1001ff84
add esp, 0xc
push 0x14
jmp 0x1001ee3b
cmp ebx, 0x40
ja 0x1001ee29
push ebx
push edx
push edi
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x1001ee3c
push edx
mov eax, ebx
call fcn.1001ec75
push edi
call fcn.1001eccd
pop ecx
pop ecx
push 0x10
pop ebx
push 0x40
pop eax
sub eax, ebx
push eax
lea eax, [edi + ebx]
push 0
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
push 0x40
sub eax, edi
pop ecx
mov dl, byte [edi]
xor dl, 0x5c
mov byte [eax + edi], dl
xor byte [edi], 0x36
inc edi
dec ecx
jne 0x1001ee58
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1001ff84
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esi]
push ebx
lea ebx, [esi + 4]
mov ecx, dword [ebx]
lea edx, [eax + ecx]
cmp edx, ecx
push edi
lea edi, [esi + 0x20]
mov dword [ebx], edx
jae 0x1001ff9c
inc dword [esi + 8]
mov byte [eax + edi], 0x80
inc dword [esi]
mov eax, dword [esi]
cmp eax, 0x38
jbe 0x1001ffd4
push 0x40
pop ecx
sub ecx, eax
push ecx
add eax, edi
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x40
pop eax
mov edx, edi
mov ecx, edi
mov dword [esi], eax
call fcn.100208fe
mov eax, esi
call fcn.1001efc1
and dword [esi], 0
mov eax, dword [esi]
push 0x38
pop ecx
sub ecx, eax
push ecx
add eax, edi
push 0
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebx]
mov edx, dword [esi + 8]
mov ecx, eax
shr ecx, 0x1d
lea ecx, [ecx + edx*8]
shl eax, 3
mov dword [esi + 8], ecx
mov dword [ebx], eax
push 0x40
pop eax
mov edx, edi
mov ecx, edi
call fcn.100208fe
push 4
lea eax, [esi + 8]
push eax
lea eax, [edi + 0x38]
push eax
call sub.MSVCRT.dll_memcpy
push 4
push ebx
add edi, 0x3c
push edi
call sub.MSVCRT.dll_memcpy
mov eax, esi
call fcn.1001efc1
lea edi, [esi + 0xc]
push 0x14
pop eax
mov edx, edi
mov ecx, edi
call fcn.100208fe
push 0x14
push edi
push dword [esp + 0x38]
call sub.MSVCRT.dll_memcpy
add esp, 0x30
pop edi
mov eax, esi
pop ebx
jmp fcn.10020f64
Function at 0x1002092c
Capabilities:
Hash data using sha256

Disassembly:
xor ecx, ecx
mov dword [eax + 0xc], 0x6a09e667
mov dword [eax + 0x10], 0xbb67ae85
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0xa54ff53a
mov dword [eax + 0x1c], 0x510e527f
mov dword [eax + 0x20], 0x9b05688c
mov dword [eax + 0x24], 0x1f83d9ab
mov dword [eax + 0x28], 0x5be0cd19
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
ret
Function at 0x10020dc2
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esi]
push ebx
lea ebx, [esi + 4]
mov ecx, dword [ebx]
lea edx, [eax + ecx]
cmp edx, ecx
push edi
lea edi, [esi + 0x2c]
mov dword [ebx], edx
jae 0x10020dda
inc dword [esi + 8]
mov byte [eax + edi], 0x80
inc dword [esi]
mov eax, dword [esi]
cmp eax, 0x38
jbe 0x10020e12
push 0x40
pop ecx
sub ecx, eax
push ecx
add eax, edi
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x40
pop eax
mov edx, edi
mov ecx, edi
mov dword [esi], eax
call fcn.100208fe
mov eax, esi
call fcn.1002096f
and dword [esi], 0
mov eax, dword [esi]
push 0x38
pop ecx
sub ecx, eax
push ecx
add eax, edi
push 0
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebx]
mov edx, dword [esi + 8]
mov ecx, eax
shr ecx, 0x1d
lea ecx, [ecx + edx*8]
shl eax, 3
mov dword [esi + 8], ecx
mov dword [ebx], eax
push 0x40
pop eax
mov edx, edi
mov ecx, edi
call fcn.100208fe
push 4
lea eax, [esi + 8]
push eax
lea eax, [edi + 0x38]
push eax
call sub.MSVCRT.dll_memcpy
push 4
push ebx
add edi, 0x3c
push edi
call sub.MSVCRT.dll_memcpy
mov eax, esi
call fcn.1002096f
lea edi, [esi + 0xc]
push 0x20
pop eax
mov edx, edi
mov ecx, edi
call fcn.100208fe
push 0x20
push edi
push dword [esp + 0x38]
call sub.MSVCRT.dll_memcpy
add esp, 0x30
pop edi
mov eax, esi
pop ebx
jmp fcn.1002092c

Function at 0x10020eeb
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x10], 0
movzx ecx, byte [eax]
movzx edx, byte [eax + 1]
mov dword [ebp - 4], ecx
je 0x10020f5a
push ebx
push esi
push edi
mov esi, 0xff
mov ecx, dword [ebp - 4]
dec dword [ebp + 0x10]
lea ecx, [eax + ecx + 2]
mov dword [ebp - 8], ecx
movzx ecx, byte [ecx]
mov edi, dword [ebp - 8]
add edx, ecx
and edx, esi
movzx ebx, byte [eax + edx + 2]
mov byte [edi], bl
mov edi, dword [ebp - 4]
inc edi
and edi, esi
mov dword [ebp - 4], edi
mov edi, ebx
add edi, ecx
and edi, esi
mov byte [eax + edx + 2], cl
mov cl, byte [edi + eax + 2]
mov edi, dword [ebp + 0xc]
xor cl, byte [edi]
mov edi, dword [ebp + 8]
inc dword [ebp + 8]
inc dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0xc], ebx
mov byte [edi], cl
jne 0x10020f09
pop edi
pop esi
pop ebx
mov cl, byte [ebp - 4]
mov byte [eax], cl
mov byte [eax + 1], dl
leave
ret

Function at 0x10020f64
Capabilities:
Hash data using sha1

Disassembly:
xor ecx, ecx
mov dword [eax + 0xc], 0x67452301
mov dword [eax + 0x10], 0xefcdab89
mov dword [eax + 0x14], 0x98badcfe
mov dword [eax + 0x18], 0x10325476
mov dword [eax + 0x1c], 0xc3d2e1f0
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
ret
Function at 0x1002227d
Capabilities:
Encode data using xor

Disassembly:
mov edx, eax
or edx, ecx
sub ecx, eax
test dl, 3
push esi
jne 0x10022299
push 4
pop edx
mov esi, dword [ecx + eax]
xor dword [eax], esi
add eax, 4
dec edx
jne 0x1002228c
pop esi
ret
push 0x10
pop esi
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec esi
jne 0x1002229c
pop esi
ret
Function at 0x10023555
Capabilities:
Encode data using xor

Disassembly:
mov edx, eax
or edx, ecx
sub ecx, eax
test dl, 3
push esi
jne 0x10023571
push 2
pop edx
mov esi, dword [ecx + eax]
xor dword [eax], esi
add eax, 4
dec edx
jne 0x10023564
pop esi
ret
push 8
pop esi
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec esi
jne 0x10023574
pop esi
ret

Function at 0x10023677
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push ebx
xor ecx, ecx
push edi
movzx eax, byte [ecx + 0x1002b5e0]
mov edi, dword [ebp + 8]
dec eax
mov edx, eax
sar edx, 3
mov dl, byte [edx + edi]
and eax, 7
test byte [eax*4 + 0x1002b658], dl
setne al
mov byte [ebp + ecx - 0x78], al
inc ecx
cmp ecx, 0x38
jl 0x10023681
xor ebx, ebx
push 8
lea eax, [ebp - 8]
push 0
push eax
call sub.MSVCRT.dll_memset
movzx eax, byte [ebx + 0x1002b618]
add esp, 0xc
xor ecx, ecx
xor edx, edx
cmp ecx, 0x1c
setge dl
mov edi, eax
dec edx
and edx, 0xffffffe4
add edx, 0x38
cmp eax, edx
jl 0x100236de
lea edi, [eax - 0x1c]
mov dl, byte [ebp + edi - 0x78]
mov byte [ebp + ecx - 0x40], dl
inc ecx
inc eax
cmp ecx, 0x38
jl 0x100236c6
xor edi, edi
movzx eax, byte [edi + 0x1002b628]
cmp byte [ebp + eax - 0x41], 0
je 0x10023715
mov eax, edi
cdq
push 6
pop ecx
idiv ecx
mov ecx, dword [edx*4 + 0x1002b658]
lea eax, [ebp + eax - 8]
sar ecx, 2
or byte [eax], cl
inc edi
cmp edi, 0x30
jl 0x100236ef
movzx eax, byte [ebp - 8]
movzx ecx, byte [ebp - 6]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 4]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 2]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 5]
mov dword [esi + ebx*8], eax
movzx eax, byte [ebp - 7]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 3]
shl eax, 8
or eax, ecx
movzx ecx, byte [ebp - 1]
shl eax, 8
or eax, ecx
mov dword [esi + ebx*8 + 4], eax
inc ebx
cmp ebx, 0x10
jl 0x100236ad
cmp dword [ebp + 0xc], 1
jne 0x10023798
xor edi, edi
lea eax, [esi + 0x7c]
mov ebx, dword [eax - 4]
lea edx, [esi + edi*4]
mov ecx, dword [edx]
mov dword [edx], ebx
mov dword [eax - 4], ecx
mov ebx, dword [eax]
lea ecx, [esi + edi*4 + 4]
mov edx, dword [ecx]
inc edi
mov dword [ecx], ebx
mov dword [eax], edx
inc edi
sub eax, 8
cmp edi, 0x10
jl 0x10023775
pop edi
pop ebx
leave
ret
Function at 0x10023811
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push edi
push 0x3f
mov dword [ebp - 4], eax
add edx, 8
mov dword [ebp - 8], 8
pop ecx
ror eax, 4
xor eax, dword [edx - 8]
mov edi, eax
shr edi, 0x18
and edi, ecx
mov edi, dword [edi*4 + 0x1002b678]
mov ebx, eax
shr ebx, 0x10
and ebx, ecx
xor edi, dword [ebx*4 + 0x1002b878]
mov ebx, eax
shr ebx, 8
and ebx, ecx
xor edi, dword [ebx*4 + 0x1002ba78]
and eax, ecx
xor edi, dword [eax*4 + 0x1002bc78]
mov eax, dword [edx - 4]
xor eax, dword [ebp - 4]
xor esi, edi
mov edi, eax
shr edi, 0x18
and edi, ecx
mov edi, dword [edi*4 + 0x1002b778]
mov ebx, eax
shr ebx, 0x10
and ebx, ecx
xor edi, dword [ebx*4 + 0x1002b978]
mov ebx, eax
shr ebx, 8
and ebx, ecx
xor edi, dword [ebx*4 + 0x1002bb78]
and eax, ecx
xor edi, dword [eax*4 + 0x1002bd78]
xor esi, edi
mov eax, esi
ror eax, 4
xor eax, dword [edx]
add edx, 0x10
mov edi, eax
shr edi, 0x18
and edi, ecx
mov edi, dword [edi*4 + 0x1002b678]
mov ebx, eax
shr ebx, 0x10
and ebx, ecx
xor edi, dword [ebx*4 + 0x1002b878]
mov ebx, eax
shr ebx, 8
and ebx, ecx
xor edi, dword [ebx*4 + 0x1002ba78]
and eax, ecx
xor edi, dword [eax*4 + 0x1002bc78]
mov eax, dword [edx - 0xc]
xor dword [ebp - 4], edi
xor eax, esi
mov edi, eax
shr edi, 0x18
mov ebx, eax
and edi, ecx
mov edi, dword [edi*4 + 0x1002b778]
shr ebx, 0x10
and ebx, ecx
xor edi, dword [ebx*4 + 0x1002b978]
mov ebx, eax
shr ebx, 8
and ebx, ecx
xor edi, dword [ebx*4 + 0x1002bb78]
and eax, ecx
xor edi, dword [eax*4 + 0x1002bd78]
mov eax, dword [ebp - 4]
xor eax, edi
dec dword [ebp - 8]
mov dword [ebp - 4], eax
jne 0x10023833
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
mov dword [ecx], eax
pop ebx
leave
ret
Function at 0x10025d24
Capabilities:
Hash data using sha256

Disassembly:
mov ecx, dword [esi + 4]
mov eax, dword [esi]
lea edx, [eax + ecx]
cmp edx, ecx
push ebx
push edi
lea edi, [esi + 0x50]
mov dword [esi + 4], edx
jae 0x10025d3b
inc dword [esi + 8]
mov ebx, 0x80
mov byte [eax + edi], bl
inc dword [esi]
mov eax, dword [esi]
cmp eax, 0x70
jbe 0x10025d75
mov ecx, ebx
sub ecx, eax
push ecx
add eax, edi
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push edi
mov eax, ebx
mov edx, edi
mov dword [esi], ebx
call fcn.10023b06
pop ecx
push esi
call fcn.10023bea
and dword [esi], 0
pop ecx
mov eax, dword [esi]
push 0x70
pop ecx
sub ecx, eax
push ecx
xor ebx, ebx
add eax, edi
push ebx
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
add esp, 0xc
mov ecx, eax
shl eax, 3
push edi
shr ecx, 0x1d
lea ecx, [ecx + edx*8]
mov dword [esi + 4], eax
push 0x70
pop eax
mov edx, edi
mov dword [esi + 8], ecx
call fcn.10023b06
mov eax, dword [esi + 8]
pop ecx
mov dword [esi + 0xc0], eax
mov eax, dword [esi + 4]
push esi
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], ebx
call fcn.10023bea
pop ecx
lea edi, [esi + 0x10]
push edi
push 0x40
pop eax
mov edx, edi
call fcn.10023b06
pop ecx
push 0x40
push edi
push dword [esp + 0x14]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, esi
pop edi
pop ebx
jmp fcn.10023b6f

Function at 0x10025dfa
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push edi
push 0xf0000000
push 1
xor edi, edi
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x10025e1f
push 0xffffffffffffff99
pop edi
jmp 0x10025e61
lea eax, [ebp - 0x20]
push eax
push 0x20
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x10025e35
push 0xffffffffffffff98
jmp 0x10025e1c
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [ebp - 0x20]
push 0x20
push eax
lea eax, [esi + 4]
call fcn.10020e8e
push 0x100
lea eax, [ebp - 0x120]
push eax
push esi
call fcn.10025e66
add esp, 0x14
mov eax, edi
pop edi
leave
ret
Function at 0x10025e8f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
lea edx, [eax + 0x20]
mov esi, edx
push 8
pop ebx
mov ecx, ebx
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x40]
mov esi, 0x4d34d34d
add ecx, esi
add dword [edx], ecx
mov edx, dword [edx]
cmp edx, dword [ebp - 0x2c]
mov ecx, 0x2cb2cb2d
sbb edx, edx
neg edx
sub edx, ecx
add dword [eax + 0x24], edx
mov edx, dword [eax + 0x24]
cmp edx, dword [ebp - 0x28]
mov edx, 0x34d34d34
sbb edi, edi
neg edi
add edi, edx
add dword [eax + 0x28], edi
mov edi, dword [eax + 0x28]
cmp edi, dword [ebp - 0x24]
mov dword [ebp - 0xc], ebx
sbb edi, edi
neg edi
add edi, esi
add dword [eax + 0x2c], edi
mov edi, dword [eax + 0x2c]
cmp edi, dword [ebp - 0x20]
sbb edi, edi
neg edi
sub edi, ecx
add dword [eax + 0x30], edi
mov edi, dword [eax + 0x30]
cmp edi, dword [ebp - 0x1c]
sbb edi, edi
neg edi
add edi, edx
add dword [eax + 0x34], edi
mov edx, dword [eax + 0x34]
cmp edx, dword [ebp - 0x18]
sbb edx, edx
neg edx
add edx, esi
add dword [eax + 0x38], edx
mov edx, dword [eax + 0x38]
cmp edx, dword [ebp - 0x14]
mov esi, eax
sbb edx, edx
neg edx
sub edx, ecx
add dword [eax + 0x3c], edx
mov ecx, dword [eax + 0x3c]
cmp ecx, dword [ebp - 0x10]
mov dword [ebp - 8], esi
sbb ecx, ecx
neg ecx
mov dword [eax + 0x40], ecx
lea ecx, [ebp - 0x2c]
sub ecx, eax
mov edx, dword [esi + 0x20]
add edx, dword [esi]
movzx edi, dx
mov esi, edx
shr esi, 0x10
mov dword [ebp - 4], esi
imul esi, edi
mov ebx, edi
imul ebx, edi
shr ebx, 0x11
add ebx, esi
mov esi, dword [ebp - 4]
imul esi, esi
shr ebx, 0xf
add ebx, esi
mov esi, edx
imul esi, edx
xor ebx, esi
mov esi, dword [ebp - 8]
mov dword [ecx + esi], ebx
add esi, 4
dec dword [ebp - 0xc]
mov dword [ebp - 8], esi
jne 0x10025f3f
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x10]
mov esi, ecx
rol esi, 0x10
add esi, edx
rol edi, 0x10
add edi, esi
mov esi, edx
rol esi, 8
add esi, dword [ebp - 0x28]
mov dword [eax], edi
add esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x28]
rol edi, 0x10
mov dword [eax + 4], esi
mov esi, dword [ebp - 0x24]
add edi, esi
rol edx, 0x10
add edx, edi
mov edi, dword [ebp - 0x20]
mov dword [eax + 8], edx
mov edx, esi
rol edx, 8
add edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x28]
rol edi, 0x10
rol esi, 0x10
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x1c]
add edi, edx
add esi, edi
mov dword [eax + 0x10], esi
mov esi, edx
rol esi, 8
add esi, dword [ebp - 0x18]
pop edi
add esi, dword [ebp - 0x20]
mov dword [eax + 0x14], esi
mov esi, dword [ebp - 0x18]
rol esi, 0x10
add esi, ecx
rol edx, 0x10
add edx, esi
rol ecx, 8
add ecx, dword [ebp - 0x18]
pop esi
add ecx, dword [ebp - 0x10]
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], ecx
pop ebx
leave
ret
Function at 0x1002608f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ebx
push edi
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
shl eax, 0x10
mov ebx, edi
shr ebx, 0x10
or eax, ebx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x10
mov ebx, ecx
shl ebx, 0x10
or eax, ebx
mov dword [esi + 0xc], eax
mov eax, edx
shl eax, 0x10
mov ebx, ecx
shr ebx, 0x10
or eax, ebx
mov dword [esi + 0x14], eax
mov ebx, edx
shr ebx, 0x10
mov eax, edi
shl eax, 0x10
or eax, ebx
mov dword [esi + 0x1c], eax
mov eax, edi
rol eax, 0x10
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 4]
rol eax, 0x10
mov dword [esi + 0x28], eax
mov eax, ecx
rol eax, 0x10
mov ebx, edx
mov dword [esi + 0x30], eax
mov eax, edx
xor ebx, ecx
rol eax, 0x10
mov dword [esi + 0x38], eax
mov eax, 0xffff
and ebx, eax
xor ebx, ecx
mov dword [esi + 0x24], ebx
mov dword [esi + 8], edx
mov ebx, edi
xor ebx, edx
and ebx, eax
xor ebx, edx
mov edx, dword [ebp - 4]
xor edx, edi
and edx, eax
xor edx, edi
mov dword [esi + 0x34], edx
mov edx, dword [ebp - 4]
xor edx, ecx
and edx, eax
xor edx, dword [ebp - 4]
and dword [esi + 0x40], 0
push 4
mov dword [esi + 0x10], edi
mov dword [esi], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x3c], edx
pop edi
mov eax, esi
call fcn.10025e8f
dec edi
jne 0x10026145
pop edi
xor ecx, ecx
lea eax, [esi + 0x20]
pop ebx
lea edx, [ecx - 4]
and edx, 7
mov edx, dword [esi + edx*4]
xor dword [eax], edx
inc ecx
add eax, 4
cmp ecx, 8
jb 0x10026156
push 8
lea eax, [esi + 0x20]
pop ecx
mov edx, dword [eax - 0x20]
mov dword [eax + 0x24], edx
mov edx, dword [eax]
mov dword [eax + 0x44], edx
add eax, 4
dec ecx
jne 0x10026170
mov eax, dword [esi + 0x40]
mov dword [esi + 0x84], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x10026198
mov edx, esi
call fcn.10026007
leave
ret
Function at 0x1002619a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0x10
push ebx
push esi
push edi
mov ebx, eax
mov esi, ecx
jb 0x10026224
mov ecx, dword [ebp + 0xc]
shr ecx, 4
lea eax, [esi + 0x44]
mov dword [ebp - 4], ecx
call fcn.10025e8f
movzx edx, word [esi + 0x5a]
mov ecx, dword [esi + 0x50]
shl ecx, 0x10
xor edx, ecx
xor edx, dword [eax]
mov ecx, dword [ebp + 8]
xor edx, dword [ebx]
sub dword [ebp + 0xc], 0x10
mov dword [ecx], edx
movzx edx, word [esi + 0x62]
mov edi, dword [esi + 0x58]
shl edi, 0x10
xor edx, edi
xor edx, dword [ebx + 4]
add ecx, 0x10
xor edx, dword [esi + 0x4c]
add ebx, 0x10
mov dword [ecx - 0xc], edx
movzx edx, word [esi + 0x4a]
mov edi, dword [esi + 0x60]
shl edi, 0x10
xor edx, edi
xor edx, dword [ebx - 8]
mov dword [ebp + 8], ecx
xor edx, dword [esi + 0x54]
mov dword [ecx - 8], edx
movzx edx, word [esi + 0x52]
mov edi, dword [esi + 0x48]
shl edi, 0x10
xor edx, edi
xor edx, dword [ebx - 4]
xor edx, dword [esi + 0x5c]
dec dword [ebp - 4]
mov dword [ecx - 4], edx
jne 0x100261b9
cmp dword [ebp + 0xc], 0
je 0x100262a3
lea eax, [esi + 0x44]
call fcn.10025e8f
mov ecx, dword [esi + 0x58]
mov edx, dword [esi + 0x50]
mov edi, ecx
mov eax, edx
shl eax, 0x10
shr edi, 0x10
xor eax, edi
xor eax, dword [esi + 0x44]
mov edi, dword [esi + 0x60]
mov dword [ebp - 0x14], eax
shl ecx, 0x10
mov eax, edi
shr eax, 0x10
xor eax, ecx
xor eax, dword [esi + 0x4c]
shl edi, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x48]
mov ecx, eax
shr ecx, 0x10
xor ecx, edi
xor ecx, dword [esi + 0x54]
shl eax, 0x10
shr edx, 0x10
xor eax, edx
xor eax, dword [esi + 0x5c]
mov dword [ebp - 0xc], ecx
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
mov dword [ebp - 8], eax
jbe 0x100262a3
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
mov esi, ebx
sub esi, eax
sub edi, eax
lea eax, [ebp + ecx - 0x14]
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc ecx
cmp ecx, dword [ebp + 0xc]
mov byte [edi + eax], dl
jb 0x10026291
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10029766
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10038a30]
jne 0x10029770
repz ret
jmp fcn.100299ae

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1001915e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064e65
call fcn.10064730
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, ecx
push 0x5e87
push 1
push 0x4873
push 0x53a1
push 0xe4c
push eax
push 1
mov dword [ebp - 0x20], eax
call fcn.10017e19
mov dword [ebp - 0x1c], 0x7489
add esp, 0x1c
cmp dword [ebp - 0x1c], 0x74f4
jle 0x100191f3
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x18], 0x1fae
mov dword [ebp - 0x14], ecx
lea eax, [edi + esi]
xor eax, ecx
mov ecx, 0x1060df18
cdq
push edx
push eax
call fcn.1001b196
mov ecx, dword [ebp - 0x14]
add ecx, ebx
dec dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jne 0x100191b9
inc ebx
cmp ebx, 0x1155
jl 0x100191ad
inc edi
cmp edi, 0x6751
jl 0x100191ab
inc esi
cmp esi, 0xa98
jl 0x100191a9
push dword [ebp - 0x20]
call fcn.1004493b
and dword [ebp - 4], 0
mov esi, eax
cmp dword [ebp - 0x1c], 0x73c0
pop ecx
mov dword [ebp - 0x20], esi
jge 0x1001923c
mov edx, 0x10008798
mov ecx, 0x1060df18
call fcn.1001d6a1
jmp 0x1001923c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret