joyce8/EMBER2024-capa huggingface dataset:
Function at 0x515680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x5157a1
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x515785
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x5156d7
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x5156b5
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18

Function at 0x5161e9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x516240
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x516240
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x516240
xor eax, eax
inc eax
jmp 0x516242
xor eax, eax
leave
ret 0x10
Function at 0x51626b
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x5162d9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x5acf54
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5162d0
cmp dword [ebp - 0xc], 4
jne 0x5162d0
cmp dword [ebp - 0x10], edi
je 0x5162d0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x5dd000], edi
xor eax, eax
jmp 0x516318
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x5dd000], edi
jge 0x516313
lea eax, [ebp - 0x34]
push eax
mov dword [0x5dd000], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x516313
cmp word [ebp - 0x14], 5
jb 0x516313
call fcn.00516246
test eax, eax
je 0x516313
emms
mov dword [0x5dd000], 1
mov eax, dword [0x5dd000]
pop edi
leave
ret

Function at 0x54161e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x541656
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0053f630
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0053f608
jmp 0x541662
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x542f9f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x542fe1
call fcn.00549b30
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x542fe1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x542fd8
xor eax, eax
jmp 0x542fe9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00542fef
pop edi
pop esi
pop ebx
ret 4

Function at 0x54a060
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x54a08e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x54a0ac
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00549fc6
jmp 0x54a0ac
mov eax, dword [esi + 0x14]
test eax, eax
je 0x54a0ac
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00549fc6
test edi, edi
mov eax, edi
jne 0x54a096
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x54ce33
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x54ce5b
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x54ce6c
push 2
call edi
test ax, ax
jge 0x54ce6c
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.00540c54
cmp dword [esi + 0x30], ebx
jne 0x54cf46
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.00540c54
cmp eax, dword [esp + 0x34]
jne 0x54cf46
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x54cee2
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x54cf27
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x54cf46
cmp eax, 0x205
je 0x54cf46
cmp eax, 0x201
je 0x54cf46
cmp eax, 0x204
je 0x54cf46
cmp eax, ebx
jne 0x54cf0d
cmp dword [esp + 0x1c], 0x1b
je 0x54cf46
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x641b7c]
jbe 0x54cf3c
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x54ce9f
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x1000116d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x1000f088
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000121c
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
push 0
lea edx, [ebp - 0xc]
push edx
push 0
push 0x1000f09c
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1000f0a4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
push 0x20
push 0
push str.nobody
call fcn.10003c40
add esp, 0xc
mov edx, dword [ebp - 0x10]
push edx
lea eax, [ebp - 0x74]
push eax
push str.nobody
call fcn.10003900
add esp, 0xc
push str.nobody
call fcn.10001130
mov dword [0x1000f084], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x1000122a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x1000f0ac
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001285
push str.nobody
call fcn.10001130
mov dword [0x1000f084], eax
mov ecx, dword [0x1000f084]
push ecx
push str.nobody
push 3
push 0
push str.lastU
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x10001293
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x1000f0c8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100012e9
mov dword [ebp - 0xc], 0
mov ecx, dword [0x10012128]
mov dword [ebp - 0xc], ecx
push 4
lea edx, [ebp - 0xc]
push edx
push 4
push 0
push 0x1000f0dc
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x100012f7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [0x10012128], 0
lea eax, [ebp - 8]
push eax
push 0x1000f0e4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10001369
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x14], 4
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push str.lastF
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x10]
mov dword [0x10012128], edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x10001377
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push esi
push edi
mov dword [ebp - 0x70], 0
mov ecx, 5
mov esi, 0x1000f100
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x13
xor eax, eax
lea edi, [ebp - 0x53]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.nobody
lea eax, [ebp - 0x68]
push eax
call fcn.10003cb0
add esp, 8
lea ecx, [ebp - 0x70]
push ecx
lea edx, [ebp - 0x68]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [0x1001211c]
mov dword [ebp - 0x6c], eax
push 4
lea ecx, [ebp - 0x6c]
push ecx
push 4
push 0
push 0x1000f118
mov edx, dword [ebp - 0x70]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [0x10012120]
mov dword [ebp - 0x6c], eax
push 4
lea ecx, [ebp - 0x6c]
push ecx
push 4
push 0
push 0x1000f120
mov edx, dword [ebp - 0x70]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [0x10012110]
mov dword [ebp - 0x6c], eax
push 4
lea ecx, [ebp - 0x6c]
push ecx
push 4
push 0
push 0x1000f128
mov edx, dword [ebp - 0x70]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [0x10012114]
mov dword [ebp - 0x6c], eax
push 4
lea ecx, [ebp - 0x6c]
push ecx
push 4
push 0
push 0x1000f130
mov edx, dword [ebp - 0x70]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10001473
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push esi
push edi
mov dword [ebp - 0x6c], 0
mov ecx, 5
mov esi, str.SoftwareMyuinConf_
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x13
xor eax, eax
lea edi, [ebp - 0x53]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.nobody
lea eax, [ebp - 0x68]
push eax
call fcn.10003cb0
add esp, 8
lea ecx, [ebp - 0x6c]
push ecx
lea edx, [ebp - 0x68]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000158a
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 4
mov dword [ebp - 0x78], 4
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x74]
push ecx
lea edx, [ebp - 0x70]
push edx
push 0
push str.first
mov eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x74]
mov dword [0x1001211c], ecx
lea edx, [ebp - 0x78]
push edx
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x70]
push ecx
push 0
push str.second
mov edx, dword [ebp - 0x6c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x74]
mov dword [0x10012120], eax
lea ecx, [ebp - 0x78]
push ecx
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0x70]
push eax
push 0
push str.third
mov ecx, dword [ebp - 0x6c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x74]
mov dword [0x10012110], edx
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x74]
push ecx
lea edx, [ebp - 0x70]
push edx
push 0
push str.fourth
mov eax, dword [ebp - 0x6c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x74]
mov dword [0x10012114], ecx
mov edx, dword [ebp - 0x6c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000159a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x1000f170
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100015e7
mov dword [ebp - 0xc], 0
push 4
lea ecx, [ebp - 0xc]
push ecx
push 4
push 0
push 0x1000f184
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x100015f5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x1000f190
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 4], eax
mov dword [0x1001213c], 0
cmp dword [ebp - 4], 0
jne 0x10001667
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x14], 4
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1000f1a4
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x10]
mov dword [0x1001213c], edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret

Function at 0x10001675
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x1000f1b0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100016c2
mov dword [ebp - 0xc], 1
push 4
lea ecx, [ebp - 0xc]
push ecx
push 4
push 0
push 0x1000f1c4
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x10006000
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x18
movzx ecx, word [eax]
mov edi, dword [eax + 0x4804]
shr cx, 4
mov dword [esp + 4], edi
movzx ebx, cx
xor ecx, 0x7f
mov dword [eax + edx*4 + 0x4808], edi
movzx ebx, byte [ebx + 0x1011abe0]
movzx ecx, cx
mov dword [esp + 0x10], ebx
movzx ebx, byte [ecx + 0x1011abe0]
movzx ecx, word [eax + 2]
shr cx, 4
movzx esi, cx
xor ecx, 0x7f
movzx ecx, cx
movzx esi, byte [esi + 0x1011abe0]
movzx ecx, byte [ecx + 0x1011abe0]
add esi, ebx
add ebx, ecx
imul ecx, edx, 0x440
mov dword [esp + 8], esi
mov dword [esp + 0xc], ebx
lea ebx, [eax + ecx + 0x404]
mov dword [esp], ebx
test edi, edi
je 0x10006190
shl edx, 4
xor edi, edi
mov dword [esp + 0x14], edx
lea ebp, [edx + 4]
lea esi, [esi]
lea ebx, [edi + 8]
xor esi, esi
mov ecx, ebx
shr ebx, 1
and ecx, 1
lea edx, [eax + ebx*2]
movzx edx, word [edx + ebp]
neg ecx
and ecx, 0x7ff
xor edx, ecx
shr edx, 4
movzx edx, byte [edx + 0x1011abe0]
add esi, edx
cmp ebx, 1
jne 0x10006095
mov ebx, dword [esp]
add esi, dword [esp + 0x10]
mov dword [ebx + edi*4], esi
add edi, 1
cmp dword [esp + 4], edi
jbe 0x100060d6
cmp edi, 7
jbe 0x10006090
cmp dword [esp + 4], edi
jbe 0x10006190
mov ebx, dword [esp + 0x14]
add ebx, 0x104
lea esi, [esi]
mov esi, edi
xor ebp, ebp
mov ecx, esi
shr esi, 1
and ecx, 1
lea edx, [eax + esi*2]
movzx edx, word [edx + ebx]
neg ecx
and ecx, 0x7ff
xor edx, ecx
shr edx, 4
movzx edx, byte [edx + 0x1011abe0]
add ebp, edx
cmp esi, 1
jne 0x100060f4
mov esi, dword [esp]
add ebp, dword [esp + 8]
mov dword [esi + edi*4], ebp
add edi, 1
cmp dword [esp + 4], edi
jbe 0x10006135
cmp edi, 0xf
jbe 0x100060f0
mov esi, dword [esp + 4]
cmp esi, edi
jbe 0x10006190
add esi, 0xf0
lea ebx, [eax + 0x204]
add edi, 0xf0
mov ebp, esi
mov ecx, edi
xor esi, esi
mov edx, ecx
shr ecx, 1
and edx, 1
movzx eax, word [ebx + ecx*2]
neg edx
and edx, 0x7ff
xor eax, edx
shr eax, 4
movzx eax, byte [eax + 0x1011abe0]
add esi, eax
cmp ecx, 1
jne 0x10006155
mov eax, dword [esp]
add esi, dword [esp + 0xc]
mov dword [eax + edi*4 - 0x3c0], esi
add edi, 1
cmp ebp, edi
jne 0x10006151
add esp, 0x18
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x1000e1b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, 0x1011cec0
not eax
mov esi, esi
lea edi, [edi]
cmp edi, 0x10
jb 0x1000e2c5
test esi, 7
je 0x1000e1f4
movzx ebp, byte [esi]
inc esi
movzx ecx, al
xor ebp, ecx
shr eax, 8
xor eax, dword [ebx + ebp*4]
dec edi
jmp 0x1000e1d0
mov dword [esp + 0x18], edi
and edi, 0xfffffff8
sub dword [esp + 0x18], edi
add edi, esi
sub edi, 8
xor eax, dword [esi]
mov ecx, dword [esi + 4]
movzx ebp, cl
mov edx, dword [ebx + ebp*4 + 0xc00]
movzx ebp, ch
xor edx, dword [ebx + ebp*4 + 0x800]
shr ecx, 0x10
xor edx, dword [esi + 8]
movzx ebp, cl
xor edx, dword [ebx + ebp*4 + 0x400]
movzx ebp, ch
xor edx, dword [ebx + ebp*4]
movzx ebp, al
mov ecx, dword [esi + 0xc]
xor edx, dword [ebx + ebp*4 + 0x1c00]
movzx ebp, ah
shr eax, 0x10
xor edx, dword [ebx + ebp*4 + 0x1800]
movzx ebp, ah
movzx eax, al
mov eax, dword [ebx + eax*4 + 0x1400]
add esi, 8
xor eax, edx
xor eax, dword [ebx + ebp*4 + 0x1000]
cmp esi, edi
movzx ebp, cl
jne 0x1000e20c
mov edx, dword [ebx + ebp*4 + 0xc00]
movzx ebp, ch
xor edx, dword [ebx + ebp*4 + 0x800]
shr ecx, 0x10
movzx ebp, cl
xor edx, dword [ebx + ebp*4 + 0x400]
movzx ebp, ch
xor edx, dword [ebx + ebp*4]
movzx ebp, al
xor edx, dword [ebx + ebp*4 + 0x1c00]
movzx ebp, ah
shr eax, 0x10
xor edx, dword [ebx + ebp*4 + 0x1800]
movzx ebp, ah
movzx eax, al
mov eax, dword [ebx + eax*4 + 0x1400]
add esi, 8
xor eax, edx
xor eax, dword [ebx + ebp*4 + 0x1000]
mov edi, dword [esp + 0x18]
test edi, edi
je 0x1000e2db
movzx ebp, byte [esi]
inc esi
movzx ecx, al
xor ebp, ecx
shr eax, 8
xor eax, dword [ebx + ebp*4]
dec edi
jmp 0x1000e2c5
not eax
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x1000ebf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, 8
push esi
mov esi, ecx
push ebx
mov ecx, dword [eax + 0xaa4]
and edx, dword [eax + 0xaa8]
mov ebx, dword [esp + 0x18]
sub edi, ecx
shl edx, cl
mov ecx, edi
shr esi, cl
lea ecx, [edx + esi]
lea edx, [ecx + ecx*2]
shl edx, 9
cmp byte [esp + 0x14], 0
lea edi, [eax + edx + 0xaac]
mov eax, dword [esp + 0x1c]
lea edx, [eax + 0x100]
jne 0x1000ec70
xor eax, eax
lea esi, [esi]
lea edi, [edi]
mov ebx, edx
shr edx, 1
and ebx, 1
movzx ecx, word [edi + edx*2]
neg ebx
and ebx, 0x7ff
xor ecx, ebx
shr ecx, 4
movzx ecx, byte [ecx + 0x1011abe0]
add eax, ecx
cmp edx, 1
jne 0x1000ec40
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, 0x100
xor eax, eax
mov esi, esi
lea edi, [edi]
mov ecx, edx
add ebx, ebx
mov ebp, esi
shr ecx, 8
and ebp, ebx
add ecx, esi
add ecx, ebp
mov ebp, edx
add edx, edx
shl ebp, 0x18
movzx ecx, word [edi + ecx*2]
sar ebp, 0x1f
and ebp, 0x7ff
xor ecx, ebp
shr ecx, 4
movzx ecx, byte [ecx + 0x1011abe0]
add eax, ecx
mov ecx, ebx
xor ecx, edx
not ecx
and esi, ecx
cmp edx, 0xffff
jbe 0x1000ec80
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10013c80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov ebx, 0x1011eee0
not eax
not edx
cmp edi, 8
jb 0x10013d72
test esi, 3
je 0x10013cc8
movzx ebp, byte [esi]
inc esi
movzx ecx, al
xor ebp, ecx
shrd eax, edx, 8
xor eax, dword [ebx + ebp*8]
shr edx, 8
xor edx, dword [ebx + ebp*8 + 4]
dec edi
jmp 0x10013c9d
mov dword [esp + 0x18], edi
and edi, 0xfffffffc
sub dword [esp + 0x18], edi
add edi, esi
sub edi, 4
mov ecx, dword [esi]
xor ecx, eax
movzx ebp, cl
mov eax, dword [ebx + ebp*8 + 0x1800]
xor eax, edx
mov edx, dword [ebx + ebp*8 + 0x1804]
movzx ebp, ch
xor eax, dword [ebx + ebp*8 + 0x1000]
xor edx, dword [ebx + ebp*8 + 0x1004]
shr ecx, 0x10
movzx ebp, cl
xor eax, dword [ebx + ebp*8 + 0x800]
xor edx, dword [ebx + ebp*8 + 0x804]
movzx ebp, ch
add esi, 4
xor eax, dword [ebx + ebp*8]
xor edx, dword [ebx + ebp*8 + 4]
cmp esi, edi
mov ecx, dword [esi]
jb 0x10013cda
xor ecx, eax
movzx ebp, cl
mov eax, dword [ebx + ebp*8 + 0x1800]
xor eax, edx
mov edx, dword [ebx + ebp*8 + 0x1804]
movzx ebp, ch
xor eax, dword [ebx + ebp*8 + 0x1000]
xor edx, dword [ebx + ebp*8 + 0x1004]
shr ecx, 0x10
movzx ebp, cl
xor eax, dword [ebx + ebp*8 + 0x800]
xor edx, dword [ebx + ebp*8 + 0x804]
movzx ebp, ch
add esi, 4
xor eax, dword [ebx + ebp*8]
xor edx, dword [ebx + ebp*8 + 4]
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10013d90
movzx ebp, byte [esi]
inc esi
movzx ecx, al
xor ebp, ecx
shrd eax, edx, 8
xor eax, dword [ebx + ebp*8]
shr edx, 8
xor edx, dword [ebx + ebp*8 + 4]
dec edi
jmp 0x10013d72
not eax
not edx
pop ebp
pop edi
pop esi
pop ebx
ret