joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005b5a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
and esi, 1
shr edx, 1
mov eax, 0x9e3779b9
je 0x1005b5d7
push ebx
push edi
movzx edi, word [ecx]
add eax, edi
movzx edi, word [ecx + 2]
mov ebx, eax
shl ebx, 5
xor edi, ebx
shl edi, 0xb
xor eax, edi
mov edi, eax
shr edi, 0xb
add ecx, 4
add eax, edi
sub edx, 1
jne 0x1005b5b1
pop edi
pop ebx
test esi, esi
pop esi
je 0x1005b5ef
movzx ecx, word [ecx]
add eax, ecx
mov edx, eax
shl edx, 0xb
xor eax, edx
mov ecx, eax
shr ecx, 0x11
add eax, ecx
lea edx, [eax*8]
xor eax, edx
mov ecx, eax
shr ecx, 5
add eax, ecx
lea edx, [eax*4]
xor eax, edx
mov ecx, eax
shr ecx, 0xf
add eax, ecx
mov edx, eax
shl edx, 0xa
xor eax, edx
jne 0x1005b61d
mov eax, 0x80000000
ret

Function at 0x1005b620
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
push esi
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1005b626
sub eax, esi
mov ecx, eax
mov esi, ecx
and esi, 1
shr ecx, 1
mov eax, 0x9e3779b9
je 0x1005b669
push ebx
push edi
movzx edi, byte [edx]
add eax, edi
movzx edi, byte [edx + 1]
mov ebx, eax
shl ebx, 5
xor edi, ebx
shl edi, 0xb
xor eax, edi
mov edi, eax
shr edi, 0xb
add edx, 2
add eax, edi
sub ecx, 1
jne 0x1005b643
pop edi
pop ebx
test esi, esi
pop esi
je 0x1005b681
movzx ecx, byte [edx]
add eax, ecx
mov edx, eax
shl edx, 0xb
xor eax, edx
mov ecx, eax
shr ecx, 0x11
add eax, ecx
lea edx, [eax*8]
xor eax, edx
mov ecx, eax
shr ecx, 5
add eax, ecx
lea edx, [eax*4]
xor eax, edx
mov ecx, eax
shr ecx, 0xf
add eax, ecx
mov edx, eax
shl edx, 0xa
xor eax, edx
jne 0x1005b6af
mov eax, 0x80000000
ret
Function at 0x10093000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
mov ebp, dword [esp + 0x34]
push esi
push edi
mov edi, eax
mov eax, dword [ebp]
mov ecx, dword [eax + 8]
mov eax, dword [ecx + 0x2c]
mov byte [eax + 0xc], 0
mov eax, dword [eax + 8]
mov edx, dword [eax]
mov edx, dword [edx + 0x48]
push edi
lea ecx, [esp + 0x34]
push ecx
mov ecx, eax
call edx
push 0x88
call fcn.102f361c
mov esi, eax
add esp, 4
test esi, esi
je 0x1009315a
movzx eax, byte [edi + 0x1f]
mov cl, byte [edi + 0x1c]
mov dl, byte [edi + 0x1e]
mov ebp, dword [ebp]
mov byte [esp + 0x48], al
movzx eax, byte [edi + 0x1d]
mov byte [esp + 0x18], al
mov eax, dword [edi + 0xc]
mov byte [esp + 0x3c], cl
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
test eax, eax
mov byte [esp + 0x14], dl
mov edx, dword [esp + 0x30]
mov dword [esp + 0x1c], ecx
mov ecx, dword [edi + 8]
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], ecx
je 0x10093092
mov eax, dword [eax + 0x30]
jmp 0x10093094
xor eax, eax
mov edi, dword [eax + 0x44]
test edi, edi
jne 0x1009309f
xor eax, eax
jmp 0x100930a4
call fcn.1006c4a0
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x3c]
push 0
push edx
mov edx, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x60]
push ecx
push 0
mov edi, 1
push edi
push edx
call fcn.10196650
xor eax, eax
cmp ebx, eax
mov dword [esi], 0x10c22590
mov word [esi + 0x78], ax
mov byte [esi + 0x7a], 1
mov dword [esi + 0x7c], eax
mov dword [esi + 0x80], ebx
je 0x10093100
add dword [ebx + 4], edi
add dword [esi + 8], edi
mov ecx, dword [esp + 0x44]
push edi
lea eax, [esp + 0x30]
add ecx, 0x2c
test esi, esi
push eax
push ecx
mov eax, esp
mov dword [esp + 0x38], 0
mov dword [eax], esi
je 0x10093124
add dword [esi + 8], edi
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
mov cl, byte [esi + 0x12]
mov edx, dword [esp + 0x4c]
mov byte [edx], cl
mov bl, byte [esi + 0x13]
add dword [esi + 8], 0xffffffff
cmp dword [esi + 8], 0
jg 0x1009314e
mov ecx, esi
test ecx, ecx
je 0x1009314e
mov eax, dword [ecx]
mov edx, dword [eax]
push edi
call edx
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x28
ret 0x14
xor esi, esi
mov edi, 1
jmp 0x10093103
Function at 0x100a59d0
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, 0x18
cmp byte [ecx + 3], 0xff
push ebx
push ebp
push esi
push edi
jae 0x100a59f5
mov edx, dword [ecx]
mov eax, dword [esp + 0x2c]
mov ecx, dword [ecx + 4]
mov dword [eax], edx
mov dword [eax + 4], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
mov eax, dword [ecx]
fld qword [0x10c55438]
and eax, 0xff
sub eax, 0x66
mov dword [esp + 0x18], eax
movzx eax, byte [ecx + 1]
sub eax, 0x66
mov dword [esp + 0x14], eax
movzx eax, byte [ecx + 2]
mov edi, 0x99
sub eax, 0x66
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
fild dword [esp + 0x1c]
fdiv st(1)
fstp dword [esp + 0x1c]
fild dword [esp + 0x10]
fld dword [esp + 0x1c]
fld st(0)
fdivp st(2)
fxch st(1)
call fcn.102f89d0
fild dword [esp + 0x14]
mov esi, eax
fdiv st(1)
call fcn.102f89d0
fidivr dword [esp + 0x18]
mov ebp, eax
call fcn.102f89d0
push edi
mov ebx, eax
push ebx
push ebp
push esi
call fcn.100a5210
or byte [esp + 0x34], 1
add esp, 0x10
test esi, esi
jl 0x100a5a7c
test ebp, ebp
jl 0x100a5a7c
test ebx, ebx
jge 0x100a5a9b
mov ecx, 0x11
add dword [esp + 0x10], ecx
add dword [esp + 0x14], ecx
add dword [esp + 0x18], ecx
add edi, ecx
cmp edi, 0xcc
mov dword [esp + 0x1c], edi
jle 0x100a5a28
mov ecx, dword [esp + 0x2c]
fstp st(0)
mov edx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov eax, ecx
pop ebx
add esp, 0x18
ret 4
Function at 0x100b4890
Capabilities:
Encode data using xor

Disassembly:
push esi
mov edx, 2
mov eax, 0x9e3779b9
push edi
lea esp, [esp]
movzx esi, word [ecx]
add eax, esi
movzx esi, word [ecx + 2]
mov edi, eax
shl edi, 5
xor esi, edi
shl esi, 0xb
xor eax, esi
mov esi, eax
shr esi, 0xb
add ecx, 4
add eax, esi
sub edx, 1
jne 0x100b48a0
lea ecx, [eax*8]
xor eax, ecx
mov edx, eax
shr edx, 5
add eax, edx
lea ecx, [eax*4]
xor eax, ecx
mov edx, eax
shr edx, 0xf
add eax, edx
mov ecx, eax
shl ecx, 0xa
xor eax, ecx
pop edi
pop esi
jne 0x100b48f4
mov eax, 0x80000000
ret

Function at 0x100c2dd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov edx, 3
mov eax, 0x9e3779b9
push edi
lea esp, [esp]
movzx esi, word [ecx]
add eax, esi
movzx esi, word [ecx + 2]
mov edi, eax
shl edi, 5
xor esi, edi
shl esi, 0xb
xor eax, esi
mov esi, eax
shr esi, 0xb
add ecx, 4
add eax, esi
sub edx, 1
jne 0x100c2de0
lea ecx, [eax*8]
xor eax, ecx
mov edx, eax
shr edx, 5
add eax, edx
lea ecx, [eax*4]
xor eax, ecx
mov edx, eax
shr edx, 0xf
add eax, edx
mov ecx, eax
shl ecx, 0xa
xor eax, ecx
pop edi
pop esi
jne 0x100c2e34
mov eax, 0x80000000
ret

Function at 0x100c3920
Capabilities:
Decompress data using quicklz

Disassembly:
mov dword [eax], 0x10c15d30
and byte [eax + 0xe], 0xfc
test al, 3
mov dword [eax + 4], 0
mov dword [eax + 0x10], 3
mov dword [eax], 0x10c15d30
jne 0x100c3978
mov ecx, eax
shr ecx, 5
push esi
and ecx, 0x7ff
mov edx, eax
and edx, 0xffff0000
mov esi, ecx
shr esi, 5
add edx, 0xfee8
lea edx, [edx + esi*4]
and ecx, 0x1f
mov esi, 1
shl esi, cl
or dword [edx], esi
add dword [0x10c880c4], 1
pop esi
ret
Function at 0x100d8a20
Capabilities:
Parse credit card information

Disassembly:
mov edx, dword [eax]
test edx, edx
push esi
jne 0x100d8a2b
xor esi, esi
jmp 0x100d8a2e
mov esi, dword [edx + 4]
xor ecx, ecx
test esi, esi
jbe 0x100d8acd
test edx, edx
je 0x100d8ad1
cmp ecx, dword [edx + 4]
jae 0x100d8ad1
mov eax, dword [edx + 8]
movzx eax, word [eax + ecx*2]
cmp ax, 0x7f
jae 0x100d8ad1
cmp ax, 0x20
jbe 0x100d8ad1
cmp ax, 0x28
je 0x100d8ad1
cmp ax, 0x29
je 0x100d8ad1
cmp ax, 0x3c
je 0x100d8ad1
cmp ax, 0x3e
je 0x100d8ad1
cmp ax, 0x40
je 0x100d8ad1
cmp ax, 0x2c
je 0x100d8ad1
cmp ax, 0x3b
je 0x100d8ad1
cmp ax, 0x3a
je 0x100d8ad1
cmp ax, 0x5c
je 0x100d8ad1
cmp ax, 0x22
je 0x100d8ad1
cmp ax, 0x2f
je 0x100d8ad1
cmp ax, 0x5b
je 0x100d8ad1
cmp ax, 0x5d
je 0x100d8ad1
cmp ax, 0x3f
je 0x100d8ad1
cmp ax, 0x3d
je 0x100d8ad1
cmp ax, 0x7b
je 0x100d8ad1
cmp ax, 0x7d
je 0x100d8ad1
add ecx, 1
cmp ecx, esi
jb 0x100d8a38
mov al, 1
pop esi
ret
xor al, al
pop esi
ret
Function at 0x10138520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
mov bl, byte [esp + 0x38]
push ebp
mov ebp, dword [esp + 0x44]
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 0x20]
neg eax
sbb eax, eax
test eax, 0x10100260
push edi
mov di, word [esp + 0x48]
jne 0x101385ec
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push eax
push ecx
push edx
call fcn.101457b0
mov eax, dword [esp + 0x28]
mov dl, byte [esi + 0x40]
mov ecx, dword [esp + 0x2c]
and bl, 1
mov dword [esi + 0x48], eax
mov al, byte [esp + 0x40]
add bl, bl
and al, 1
or bl, al
mov al, byte [esp + 0x3c]
add bl, bl
and al, 1
or bl, al
mov al, byte [esp + 0x38]
add bl, bl
and dl, 0xf0
or bl, dl
and al, 1
or bl, al
cmp di, 0xffff
mov dword [esi + 0x4c], ecx
mov byte [esi + 0x40], bl
jne 0x101385a3
xor eax, eax
jmp 0x101385a6
movzx eax, di
cmp di, 0xffff
mov word [esi + 0x78], ax
setne al
test ebp, ebp
mov byte [esi + 0x7a], al
je 0x101385bd
add dword [ebp + 4], 1
mov ecx, dword [esi + 0x7c]
test ecx, ecx
mov dword [esi + 0x7c], ebp
je 0x101385de
add dword [ecx + 4], 0xffffffff
cmp dword [ecx + 4], 0
jg 0x101385de
cmp dword [ecx + 8], 0
jne 0x101385de
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
push ecx
call fcn.10196720
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x38
Function at 0x1016f320
Capabilities:
Encode data using base64

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov dword [esi], 0
mov ecx, dword [eax]
test ecx, ecx
mov dword [esp + 8], ecx
je 0x1016f4a1
cmp ecx, 0xbd81a98a
ja 0x1016f4a1
push ebx
push ebp
mov ebp, dword [eax + 4]
lea edx, [ecx + 2]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
push edi
xor ebx, ebx
xor edi, edi
add edx, edx
add edx, edx
mov dword [esp + 0x10], edx
je 0x1016f379
cmp edx, dword [esi + 8]
jbe 0x1016f379
push edx
call fcn.100019c0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
cmp ecx, 1
mov dword [esi], edx
jbe 0x1016f419
lea eax, [ecx - 2]
test eax, eax
jbe 0x1016f419
nop
movzx eax, byte [ebx + ebp]
mov edx, dword [esi + 4]
shr eax, 2
movzx eax, byte [eax + 0x10c0b560]
mov byte [edi + edx], al
movzx edx, byte [ebx + ebp + 1]
movsx eax, byte [ebx + ebp]
shr edx, 4
shl eax, 4
or edx, eax
mov eax, dword [esi + 4]
and edx, 0x3f
movzx edx, byte [edx + 0x10c0b560]
mov byte [edi + eax + 1], dl
movsx edx, byte [ebx + ebp + 1]
movzx eax, byte [ebx + ebp + 2]
add edi, 1
add edx, edx
shr eax, 6
add edx, edx
or eax, edx
mov edx, dword [esi + 4]
and eax, 0x3f
movzx eax, byte [eax + 0x10c0b560]
mov byte [edi + edx + 1], al
movzx edx, byte [ebx + ebp + 2]
mov eax, dword [esi + 4]
add edi, 1
and edx, 0x3f
movzx edx, byte [edx + 0x10c0b560]
add edi, 1
mov byte [edi + eax], dl
add ebx, 3
lea eax, [ecx - 2]
add edi, 1
cmp ebx, eax
jb 0x1016f390
cmp ebx, ecx
jae 0x1016f48b
movzx eax, byte [ebx + ebp]
mov edx, dword [esi + 4]
shr eax, 2
mov al, byte [eax + 0x10c0b560]
mov byte [edi + edx], al
add ecx, 0xffffffff
add edi, 1
cmp ebx, ecx
jae 0x1016f472
movzx ecx, byte [ebx + ebp + 1]
movsx edx, byte [ebx + ebp]
lea eax, [ebx + ebp + 1]
shr ecx, 4
shl edx, 4
or ecx, edx
mov edx, dword [esi + 4]
and ecx, 0x3f
movzx ecx, byte [ecx + 0x10c0b560]
mov byte [edi + edx], cl
movzx edx, byte [eax]
add edi, 1
and edx, 0xf
movzx ecx, byte [edx*4 + 0x10c0b560]
jmp 0x1016f482
movzx edx, byte [ebx + ebp]
and edx, 3
shl edx, 4
mov cl, byte [edx + 0x10c0b560]
mov eax, dword [esi + 4]
mov byte [edi + eax], cl
add edi, 1
cmp edi, dword [esi]
jae 0x1016f49e
nop
mov edx, dword [esi + 4]
mov byte [edi + edx], 0x3d
add edi, 1
cmp edi, dword [esi]
jb 0x1016f490
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
Function at 0x1016f4b0
Capabilities:
Encode data using base64

Disassembly:
push ecx
push esi
mov esi, ecx
push edi
mov dword [esi], 0
mov edi, dword [eax]
test edi, edi
jne 0x1016f4c7
pop edi
mov al, 1
pop esi
pop ecx
ret
cmp edi, 0xffffffff
jbe 0x1016f4d2
pop edi
xor al, al
pop esi
pop ecx
ret
push ebx
push ebp
mov ebp, dword [eax + 4]
mov bl, 0x3d
lea esp, [esp]
cmp byte [edi + ebp - 1], bl
jne 0x1016f4eb
sub edi, 1
jne 0x1016f4e0
test edi, edi
jbe 0x1016f4fa
cmp edi, dword [esi + 8]
jbe 0x1016f4fa
push edi
call fcn.100019c0
xor ecx, ecx
test edi, edi
mov dword [esi], edi
jbe 0x1016f543
mov al, byte [ecx + ebp]
cmp al, 0x2f
jbe 0x1016f50d
cmp al, 0x3a
jb 0x1016f52d
cmp al, 0x40
jbe 0x1016f515
cmp al, 0x5b
jb 0x1016f52d
cmp al, 0x60
jbe 0x1016f51d
cmp al, 0x7b
jb 0x1016f52d
cmp al, 0x2b
je 0x1016f52d
cmp al, 0x2f
je 0x1016f52d
cmp al, bl
jne 0x1016f629
mov edx, dword [esi + 4]
movzx eax, al
mov al, byte [eax + 0x10c0b5a0]
mov byte [ecx + edx], al
add ecx, 1
cmp ecx, edi
jb 0x1016f502
lea ecx, [edi + 3]
shr ecx, 2
mov ebp, edi
sub ebp, ecx
mov dword [esp + 0x10], ebp
je 0x1016f629
lea edx, [ebp + 2]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
add edx, edx
add edx, edx
cmp edx, edi
jb 0x1016f629
xor eax, eax
xor edi, edi
cmp ebp, 1
jbe 0x1016f5de
lea ecx, [ebp - 2]
test ecx, ecx
jbe 0x1016f5de
nop
mov ebp, dword [esi + 4]
movzx edx, byte [eax + ebp + 1]
movzx ebx, byte [eax + ebp]
sar dl, 4
and dl, 3
add bl, bl
add bl, bl
or dl, bl
mov byte [edi + ebp], dl
mov ebp, dword [esi + 4]
movzx edx, byte [eax + ebp + 2]
movzx ebx, byte [eax + ebp + 1]
sar dl, 2
and dl, 0xf
shl bl, 4
or dl, bl
mov byte [edi + ebp + 1], dl
mov ebp, dword [esi + 4]
movzx edx, byte [eax + ebp + 3]
movzx ebx, byte [eax + ebp + 2]
and dl, 0x3f
shl bl, 6
or dl, bl
mov byte [edi + ebp + 2], dl
add edi, 3
add eax, 4
cmp edi, ecx
jb 0x1016f580
mov ebp, dword [esp + 0x10]
cmp edi, ebp
jae 0x1016f5fb
mov ecx, dword [esi + 4]
mov dl, byte [ecx + eax + 1]
mov bl, byte [ecx + eax]
sar dl, 4
add bl, bl
and dl, 3
add bl, bl
or dl, bl
mov byte [ecx + edi], dl
add edi, 1
cmp edi, ebp
jae 0x1016f61b
mov ecx, dword [esi + 4]
mov dl, byte [ecx + eax + 2]
mov al, byte [ecx + eax + 1]
sar dl, 2
and dl, 0xf
shl al, 4
or dl, al
mov byte [ecx + edi], dl
cmp ebp, dword [esi]
jae 0x1016f621
mov dword [esi], ebp
pop ebp
pop ebx
pop edi
mov al, 1
pop esi
pop ecx
ret
pop ebp
pop ebx
pop edi
xor al, al
pop esi
pop ecx
ret
Function at 0x101741f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [eax + 0x78]
sub esp, 0x3c
test eax, eax
push ebx
push ebp
push esi
push edi
je 0x10174399
mov dword [esp + 0x14], eax
mov ecx, dword [eax]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 0x14]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], 0
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x10174229
lea edx, [esp + 0x14]
mov dword [ecx + 0xc], edx
lea ecx, [esp + 0x14]
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x1017436a
mov ebp, dword [ecx]
test ebp, ebp
je 0x1017436a
test byte [ebp + 0x18], 1
jne 0x1017435a
mov eax, dword [ebp]
test byte [eax + 0x1b], 0x20
jne 0x1017435a
mov dl, byte [esp + 0x5c]
mov esi, dword [esp + 0x50]
neg dl
mov ecx, 9
lea edi, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
sbb edx, edx
and edx, 8
mov dword [esp + 0x38], edx
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x18c]
call eax
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp]
add edi, dword [esp + 0x54]
mov edx, dword [ecx]
sub edi, eax
mov eax, dword [edx + 0x224]
call eax
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov esi, eax
mov eax, dword [edx + 0x190]
add esi, edi
call eax
mov ebx, dword [ebp + 4]
mov ecx, dword [ebp]
add ebx, dword [esp + 0x58]
mov edx, dword [ecx]
sub ebx, eax
mov eax, dword [edx + 0x21c]
call eax
mov ecx, dword [ebp]
mov edx, dword [ecx]
mov edx, dword [edx + 0x134]
mov edi, eax
add edi, ebx
push edi
push esi
lea eax, [esp + 0x2c]
push eax
call edx
cmp byte [esp + 0x5c], 0
jne 0x10174356
mov ecx, dword [ebp]
push edi
mov dword [esp + 0x3c], 2
mov eax, dword [ecx]
mov eax, dword [eax + 0x134]
push esi
lea edx, [esp + 0x2c]
push edx
call eax
mov ecx, dword [ebp]
push edi
mov dword [esp + 0x3c], 3
mov edx, dword [ecx]
mov edx, dword [edx + 0x134]
push esi
lea eax, [esp + 0x2c]
push eax
call edx
mov ecx, dword [ebp]
push edi
mov dword [esp + 0x3c], 4
mov eax, dword [ecx]
mov eax, dword [eax + 0x134]
push esi
lea edx, [esp + 0x2c]
push edx
call eax
mov ebp, dword [ebp]
push edi
mov dword [esp + 0x3c], 5
mov edx, dword [ebp]
mov edx, dword [edx + 0x134]
push esi
lea eax, [esp + 0x2c]
push eax
mov ecx, ebp
call edx
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x1017436a
mov ecx, dword [ecx + 4]
mov dword [esp + 0x18], ecx
jmp 0x10174234
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x10174399
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x10174383
mov eax, dword [esp + 0x1c]
mov dword [ecx + 0x14], eax
jmp 0x1017438a
mov ecx, dword [esp + 0x1c]
mov dword [eax + 8], ecx
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10174399
mov edx, dword [esp + 0x20]
mov dword [eax + 0xc], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0x10
Function at 0x10176660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x34
push ebx
mov ebx, dword [esp + 0x3c]
mov eax, dword [ebx + 0x78]
push ebp
mov ebp, dword [esp + 0x44]
push esi
push edi
xor ecx, ecx
xor edx, edx
xor esi, esi
xor edi, edi
test eax, eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], edi
je 0x10176795
test byte [ebx + 0x1b], 0x40
jne 0x10176795
mov dword [esp + 0x10], eax
mov ecx, dword [eax]
mov dword [esp + 0x14], ecx
mov edx, dword [eax + 0x14]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], esi
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x101766bf
lea edx, [esp + 0x10]
mov dword [ecx + 0xc], edx
lea ecx, [esp + 0x10]
mov dword [eax + 0x14], ecx
mov eax, dword [esp + 0x14]
mov bl, 0x20
lea esp, [esp]
test eax, eax
je 0x1017673e
mov esi, dword [eax]
test esi, esi
je 0x1017673e
test byte [esi + 0x18], 1
jne 0x10176731
mov ecx, dword [esi]
test byte [ecx + 0x1b], bl
jne 0x10176731
mov edx, dword [ecx]
mov edx, dword [edx + 0x1bc]
push 0
lea eax, [esp + 0x34]
push eax
call edx
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 0x21c]
call edx
mov ecx, dword [esi]
mov edi, eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x224]
add edi, dword [esi + 4]
call edx
add eax, dword [esi + 0xc]
add dword [esp + 0x34], edi
add dword [esp + 0x30], eax
lea ecx, [esp + 0x30]
lea eax, [esp + 0x20]
call fcn.100a9b70
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1017673e
mov eax, dword [eax + 4]
mov dword [esp + 0x14], eax
jmp 0x101766d0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov dword [ebp], eax
mov eax, dword [esp + 0x2c]
mov dword [ebp + 4], ecx
mov ecx, dword [esp + 0x10]
test ecx, ecx
mov dword [ebp + 8], edx
mov dword [ebp + 0xc], eax
je 0x101767a1
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x10176773
mov edx, dword [esp + 0x18]
mov dword [ecx + 0x14], edx
jmp 0x1017677a
mov ecx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x101767a1
mov edx, dword [esp + 0x1c]
mov dword [eax + 0xc], edx
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 8
mov dword [ebp], ecx
mov dword [ebp + 4], edx
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], edi
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x34
ret 8
Function at 0x10209450
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x48
mov eax, dword [0x10c67840]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
push esi
lea eax, [ecx - 1]
cmp eax, 0xf9e
mov esi, edx
push edi
mov dword [esp + 0x18], esi
ja 0x102095eb
xor ebp, ebp
cmp byte [esp + 0x5c], 0
mov dword [esp + 0x10], ebp
mov word [esp + 0x1c], 0x69
mov word [esp + 0x1e], 0x76
mov word [esp + 0x20], 0x78
mov word [esp + 0x22], 0x6c
mov word [esp + 0x24], 0x63
mov word [esp + 0x26], 0x64
mov word [esp + 0x28], 0x6d
mov word [esp + 0x2c], 0x49
mov word [esp + 0x2e], 0x56
mov word [esp + 0x30], 0x58
mov word [esp + 0x32], 0x4c
mov word [esp + 0x34], 0x43
mov word [esp + 0x36], 0x44
mov word [esp + 0x38], 0x4d
lea ebx, [esp + 0x2c]
jne 0x102094ed
lea ebx, [esp + 0x1c]
mov dword [esp + 0x14], ebx
mov eax, 0x66666667
imul ecx
sar edx, 2
mov esi, edx
shr esi, 0x1f
add esi, edx
lea edx, [esi + esi*4]
add edx, edx
sub ecx, edx
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*4]
mov edi, ecx
sub edi, eax
cmp edi, 4
jge 0x10209555
mov edx, edi
test edx, edx
jle 0x10209555
movzx ebx, word [ebx]
lea eax, [ebp + ebp]
mov ebp, eax
lea eax, [esp + 0x54]
sub eax, ebp
mov ebp, dword [esp + 0x10]
add ebp, edx
mov dword [esp + 0x10], ebp
sub eax, 2
sub edx, 1
test edx, edx
mov word [eax], bx
jg 0x10209544
mov ebx, dword [esp + 0x14]
lea edx, [ecx - 4]
cmp edx, 4
ja 0x10209575
add ebp, 1
lea eax, [ebp + ebp]
lea edx, [esp + 0x54]
sub edx, eax
mov ax, word [ebx + 2]
mov dword [esp + 0x10], ebp
mov word [edx], ax
cmp ecx, 9
jne 0x10209592
mov ax, word [ebx + 4]
add ebp, 1
lea ecx, [ebp + ebp]
lea edx, [esp + 0x54]
sub edx, ecx
mov dword [esp + 0x10], ebp
mov word [edx], ax
cmp edi, 4
jne 0x102095ae
mov ax, word [ebx]
add ebp, 1
lea ecx, [ebp + ebp]
lea edx, [esp + 0x54]
sub edx, ecx
mov dword [esp + 0x10], ebp
mov word [edx], ax
mov ecx, esi
add ebx, 4
test ecx, ecx
mov dword [esp + 0x14], ebx
jne 0x102094f1
mov esi, dword [esp + 0x18]
lea ecx, [ebp + ebp]
lea edx, [esp + 0x54]
push ebp
sub edx, ecx
push edx
mov eax, esi
call fcn.1005ba00
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.102f2d37
add esp, 0x48
ret
push ecx
push 0x10c14368
push esi
call fcn.1005c060
mov ecx, dword [esp + 0x60]
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.102f2d37
add esp, 0x48
ret
Function at 0x102449d0
Capabilities:
Hash data using djb2

Disassembly:
push esi
mov esi, eax
test esi, esi
mov dword [ecx + 0x24], esi
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov eax, 0x1505
je 0x10244a0d
push edi
mov dl, byte [esi]
test dl, dl
je 0x10244a0c
mov edi, eax
shl edi, 5
add edi, eax
movsx eax, dl
add eax, edi
add esi, 1
jne 0x102449f5
pop edi
mov dword [ecx], eax
pop esi
ret

Function at 0x10244d20
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Hash data using fnv

Disassembly:
mov ecx, dword [esp + 4]
push ebx
mov dword [eax + 0x20], ecx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov dword [eax + 4], 0
lea ebx, [eax + 0x28]
mov ecx, 0xc
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x1c]
lea ebp, [eax + 0x58]
mov ecx, 0xc
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [edx]
mov dword [eax + 0x88], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 0x8c], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 0x90], ecx
mov edx, dword [edx + 0xc]
mov dword [eax + 0x94], edx
mov ecx, 0x811c9dc5
mov edx, 0x30
nop
movzx esi, byte [ebx]
imul ecx, ecx, 0x1000193
sub edx, 1
xor ecx, esi
add ebx, 1
test edx, edx
jne 0x10244d80
mov edx, 0x20
mov esi, ebp
lea esp, [esp]
movzx edi, byte [esi]
imul ecx, ecx, 0x1000193
sub edx, 1
xor ecx, edi
add esi, 1
test edx, edx
jne 0x10244da0
mov edx, dword [eax + 0x94]
shl edx, 8
or edx, dword [eax + 0x90]
pop edi
shl edx, 4
or edx, dword [eax + 0x8c]
pop esi
shl edx, 4
or edx, dword [eax + 0x88]
pop ebp
xor edx, ecx
xor edx, dword [esp + 8]
pop ebx
mov dword [eax], edx
ret
Function at 0x1025f6f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
test ebx, ebx
jle 0x1025f76c
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
sub edi, esi
mov eax, dword [edi + esi]
movzx edx, byte [esi + 3]
mov ecx, eax
and ecx, 0xff00ff
imul ecx, edx
shr eax, 8
and eax, 0xff00ff
imul eax, edx
add ecx, 0x800080
mov ebp, ecx
shr ebp, 8
add eax, 0x800080
and ebp, 0xff00ff
add ebp, ecx
mov edx, eax
shr edx, 8
mov ecx, edx
shr ebp, 8
and ecx, 0xffff00ff
add ecx, eax
xor ebp, ecx
and edx, 0xff00ff
and ebp, 0xff00ff
add edx, eax
xor ebp, edx
mov dword [esi], ebp
add esi, 4
sub ebx, 1
jne 0x1025f706
pop edi
pop esi
pop ebp
pop ebx
ret