joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001d00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10012aa0], eax
je 0x10001d1c
mov eax, 0x10dd
pop ebp
ret 8
mov eax, dword [0x10012aa4]
test eax, eax
jne 0x10001e12
test ebp, ebp
jne 0x10001d34
lea eax, [ebp + 6]
pop ebp
ret 8
cmp dword [ebp], 0
jne 0x10001d4e
mov eax, 6
mov dword [0x10012aa8], ebp
mov dword [0x10012aa4], eax
pop ebp
ret 8
push ebx
push esi
push edi
push 0x18
call fcn.10002e80
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x10001d69
lea esi, [eax + 8]
jmp 0x10001df4
mov ecx, dword [ebp]
call fcn.10001580
mov ecx, dword [esp + 0x18]
mov edi, eax
call fcn.10001580
movzx ecx, byte [edi + 0x36]
mov esi, dword [edi + 0x40]
sub esi, ecx
test ecx, ecx
je 0x10001de6
cmp ecx, 0x1e
ja 0x10001de6
cmp dword [edi + 0x44], eax
jne 0x10001de6
lea eax, [esp + 0x14]
push eax
push 0x40
push ecx
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10001db8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10001df4
mov edx, dword [0x10012ab0]
mov dword [ebx + 0x10], edi
mov dword [ebx + 8], ebp
mov dword [ebx + 0xc], esi
pop edi
mov dword [ebx + 4], 1
mov ecx, dword [esp + 0x10]
pop esi
mov dword [ebx + 0x14], ecx
mov dword [ebx], edx
mov dword [0x10012ab0], ebx
pop ebx
xor eax, eax
pop ebp
ret 8
cmp dword [0x10012a98], 0
mov esi, 9
jne 0x10001dfa
mov dword [0x10012aa4], esi
test ebx, ebx
je 0x10001e07
push ebx
call fcn.10002e0b
add esp, 4
pop edi
mov eax, esi
pop esi
mov dword [0x10012aa8], ebp
pop ebx
pop ebp
ret 8

Function at 0x10002dfc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10011040]
jne 0x10002e06
repz ret
jmp fcn.100034a3
Function at 0x10007d35
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10003ece
and dword [ebp - 4], 0
cmp dword [0x100129b0], 0
mov ebx, eax
jne 0x10007de6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10007e97
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10007e97
push eax
call fcn.10003e5c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100129b0], eax
call esi
push eax
call fcn.10003e5c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100129b4], eax
call esi
push eax
call fcn.10003e5c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100129b8], eax
call esi
push eax
call fcn.10003e5c
pop ecx
mov dword [0x100129c0], eax
test eax, eax
je 0x10007de6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10003e5c
pop ecx
mov dword [0x100129bc], eax
mov eax, dword [0x100129bc]
cmp eax, ebx
je 0x10007e3e
cmp dword [0x100129c0], ebx
je 0x10007e3e
push eax
call fcn.10003ed7
push dword [0x100129c0]
mov esi, eax
call fcn.10003ed7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10007e3e
test edi, edi
je 0x10007e3e
call esi
test eax, eax
je 0x10007e35
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10007e35
test byte [ebp - 0xc], 1
jne 0x10007e3e
or dword [ebp + 0x10], 0x200000
jmp 0x10007e77
mov eax, dword [0x100129b4]
cmp eax, ebx
je 0x10007e77
push eax
call fcn.10003ed7
pop ecx
test eax, eax
je 0x10007e77
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10007e77
mov eax, dword [0x100129b8]
cmp eax, ebx
je 0x10007e77
push eax
call fcn.10003ed7
pop ecx
test eax, eax
je 0x10007e77
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100129b0]
call fcn.10003ed7
pop ecx
test eax, eax
je 0x10007e97
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10007e99
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x2982cb0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
xorps xmm0, xmm0
movsd qword [esp + 0x18], xmm0
cmp dword [ebp + 8], 0
je 0x2982d23
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x2982d23
push esi
call fcn.02989660
add esp, 4
test eax, eax
je 0x2982d0a
xor ebx, ebx
mov ecx, 0x1505
nop word cs:[eax + eax]
movzx edx, byte [esi + ebx]
test edx, edx
je 0x2982d11
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x2982cf0
jmp 0x2982d13
mov edi, 0x1505
jmp 0x2982d13
mov edi, ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x20]
lea esi, [edx - 1]
mov ebx, edx
sub ebx, 1
jae 0x2982d3b
movsd xmm0, qword [esp + 0x18]
movsd qword [esp + 0x20], xmm0
fld qword [esp + 0x20]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], eax
and esi, edi
mov eax, dword [ecx + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
jmp 0x2982d58
inc esi
dec edx
mov ebx, dword [esp + 0x10]
je 0x2982d23
mov eax, esi
and eax, ebx
mov ebx, dword [esp + 0x14]
mov ebx, dword [ebx + eax*4]
cmp ebx, 0xffffffff
je 0x2982d23
mov eax, dword [ecx + 8]
cmp dword [eax + ebx*4], edi
jne 0x2982d50
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebx*4]
mov dword [esp + 0xc], eax
push eax
mov dword [esp + 0xc], edx
call fcn.02989660
mov edx, dword [esp + 0xc]
mov ecx, dword [ebp + 8]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x2982d50
push dword [esp + 4]
push dword [esp + 0x10]
push dword [ebp + 0xc]
call fcn.02989680
mov edx, dword [esp + 0x14]
mov ecx, dword [ebp + 8]
add esp, 0xc
test eax, eax
jne 0x2982d50
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebx*4]
test eax, eax
je 0x2982d23
cmp dword [eax + 4], 3
jne 0x2982d23
movsd xmm0, qword [eax + 8]
movsd qword [esp + 0x18], xmm0
jmp 0x2982d23
Function at 0x2983d70
Capabilities:
Compute adler32 checksum
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x2983f04
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x2983efd
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov ebx, esi
sub ebx, eax
jmp 0x2983e00
add ebp, dword [esp + 8]
mov esi, dword [esp + 0xc]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov ebx, 0x15b0
je 0x2983efd
xor eax, eax
cmp ebx, 8
jb 0x2983e72
mov eax, ebx
mov ebx, esi
mov edx, eax
and edx, 0x1ff8
mov dword [esp + 4], edx
mov edx, 7
nop dword [eax]
movzx esi, byte [ebp]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + 1]
add edi, esi
add ecx, edi
movzx esi, byte [ebp + 2]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + 3]
add edi, esi
add ecx, edi
movzx esi, byte [ebp + 4]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + 5]
add edi, esi
add ecx, edi
movzx esi, byte [ebp + 6]
add esi, edi
add ecx, esi
movzx edi, byte [ebp + 7]
add edi, esi
add ecx, edi
add ebp, 8
add edx, 8
cmp edx, eax
jb 0x2983e20
mov esi, ebx
mov ebx, eax
mov eax, dword [esp + 4]
mov edx, ebx
sub edx, eax
mov dword [esp], ebx
jbe 0x2983dc8
mov dword [esp + 8], edx
mov edx, eax
or edx, 1
test bl, 1
mov dword [esp + 0xc], esi
jne 0x2983ea0
mov ebx, ebp
cmp dword [esp], edx
je 0x2983dc0
jmp 0x2983ebd
lea ebx, [ebp + 1]
movzx eax, byte [ebp]
mov esi, edi
and esi, eax
xor edi, eax
lea edi, [edi + esi*2]
add ecx, edi
mov eax, edx
cmp dword [esp], edx
je 0x2983dc0
mov edx, dword [esp]
sub edx, eax
mov dword [esp + 4], edx
xor eax, eax
nop dword [eax + eax]
movzx esi, byte [ebx + eax]
mov edx, edi
and edx, esi
xor edi, esi
lea edx, [edi + edx*2]
add ecx, edx
movzx esi, byte [ebx + eax + 1]
mov edi, edx
and edi, esi
xor edx, esi
lea edi, [edx + edi*2]
add ecx, edi
add eax, 2
cmp dword [esp + 4], eax
jne 0x2983ed0
jmp 0x2983dc0
shl ecx, 0x10
or ecx, edi
jmp 0x2983f09
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x2983f20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x2983f82
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x2983f84
not eax
xor esi, esi
nop dword [eax]
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
and eax, 0xf
mov ebp, edi
not ebp
or ebp, 0xf
add ebp, edi
inc ebp
xor ebp, eax
xor ebx, dword [ebp*4 + 0x29bc948]
mov eax, ebx
shr eax, 4
mov ebp, ebx
and ebp, 0xf
shr edi, 4
and ebx, edi
or edi, ebp
xor edi, ebx
xor eax, dword [edi*4 + 0x29bc948]
inc esi
cmp edx, esi
jne 0x2983f40
not eax
jmp 0x2983f84
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x2989cc0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20c
mov dword [esp], ecx
mov edi, dword [esp + 0x220]
movzx edx, word [edi]
test dx, dx
je 0x2989dda
lea eax, [edi + 2]
xor ebx, ebx
mov ecx, 1
nop word [eax + eax]
movzx esi, dx
xor edx, edx
cmp esi, 0x800
setb dl
xor edx, 3
cmp esi, 0x80
cmovb edx, ecx
add ebx, edx
movzx edx, word [eax]
add eax, 2
test dx, dx
jne 0x2989cf0
lea esi, [ebx + 1]
push esi
call fcn.02989550
add esp, 4
mov ebp, eax
test ebx, ebx
jle 0x2989de8
add ebx, ebp
add esi, ebp
mov eax, ebp
mov dword [esp + 8], esi
jmp 0x2989d58
mov byte [eax], dl
mov esi, 1
add edi, 2
add eax, esi
cmp eax, ebx
mov esi, dword [esp + 8]
jae 0x2989dea
movzx edx, word [edi]
test dx, dx
je 0x2989dea
cmp dx, 0x7f
jbe 0x2989d40
mov ecx, eax
not ecx
add ecx, esi
movzx esi, dx
cmp esi, 0x7ff
ja 0x2989da0
xor esi, esi
cmp ecx, 2
jb 0x2989d47
mov ecx, edx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 1], dl
mov esi, 2
jmp 0x2989d47
mov dword [esp + 4], esi
xor esi, esi
cmp ecx, 3
jb 0x2989d47
mov esi, dword [esp + 4]
mov ecx, esi
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, esi
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and dl, 0x3f
or dl, 0x80
mov byte [eax + 2], dl
mov esi, 3
jmp 0x2989d47
push 1
call fcn.02989550
add esp, 4
mov ebp, eax
jmp 0x2989dea
mov eax, ebp
mov edi, dword [esp + 0x228]
mov edx, dword [esp + 0x224]
mov byte [eax], 0
xor ecx, ecx
jmp 0x2989e07
mov eax, ebx
mov byte [esp + ecx + 0xc], al
inc ecx
movzx ebx, byte [ebp + ecx]
mov al, 0x2f
cmp ebx, 0x5c
je 0x2989e02
test ebx, ebx
jne 0x2989e00
mov byte [esp + ecx + 0xc], 0
lea eax, [esp + 0xc]
push 0
push 0
push 0
mov ecx, dword [esp + 0xc]
push dword [ecx + 8]
add ecx, 0x10
push 0
push 0
push edi
push edx
push eax
push ecx
call fcn.02985f70
add esp, 0x28
test eax, eax
setne al
add esp, 0x20c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x298ac50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x298ad3c
mov ebp, dword [esp + 0x14]
xor esi, esi
mov edi, 2
jmp 0x298ac86
mov edx, ebp
nop
lea eax, [edi + 4]
add edi, 2
mov esi, edx
cmp edi, ecx
mov edi, eax
mov ebp, dword [esp + 0x14]
jae 0x298ad3e
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.02990d70
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.02990d70
add esp, 4
mov bl, al
shl bh, 2
xor al, 0xc0
mov ecx, ebx
or cl, 0x30
and cl, al
shr cl, 4
add cl, bh
lea edx, [esi + 1]
mov eax, dword [esp + 0x1c]
mov byte [eax + esi], cl
mov ecx, dword [esp + 0x18]
cmp edi, ecx
jae 0x298ac70
movzx eax, byte [ebp + edi]
push eax
mov ebp, edx
call fcn.02990d70
mov edx, ebp
mov ecx, dword [esp + 0x1c]
add esp, 4
cmp al, 0x40
je 0x298ac70
mov bh, al
shl bl, 4
shr al, 2
and al, 0xf
or al, bl
lea ebp, [esi + 2]
mov edx, dword [esp + 0x1c]
mov byte [edx + esi + 1], al
lea eax, [edi + 1]
cmp eax, ecx
jae 0x298ac6d
mov eax, dword [esp + 0x14]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.02990d70
mov ecx, dword [esp + 0x1c]
add esp, 4
cmp al, 0x40
mov edx, ebp
je 0x298ac70
shl bh, 6
add al, bh
mov edx, dword [esp + 0x1c]
mov byte [edx + esi + 2], al
add esi, 3
mov edx, esi
jmp 0x298ac70
xor edx, edx
mov eax, edx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x299aa30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x98
mov ebx, dword [ebp + 0x10]
movaps xmm0, xmmword [0x29bde30]
wait
add cl, byte [edi]
adc dword [esp + 0x20], eax

Function at 0x299adb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
movaps xmm0, xmmword [str._a_a_b_b_t_t_n_n_v_v_f_f_r_r]
movups xmmword [esp + 8], xmm0
lea eax, [esp + 0x18]
mov word [esp + 0x18], 0x4948
mov dword [esp + 0x1e], 0
mov dword [esp + 0x1a], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x1f
ja 0x299ae52
nop word cs:[eax + eax]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
lea esi, [ecx + edx]
add esi, 0x8efea50c
add ecx, 0x8efea50c
and ecx, edx
add ecx, ecx
sub esi, ecx
mov dword [esp + 0x28], esi
mov ecx, dword [esp + 0x28]
add cl, 0xac
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x20
jb 0x299ae10
mov ebx, dword [ebp + 8]
lea edi, [esp + 0x28]
lea edx, [esp + 8]
mov ecx, 4
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x38]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
mov eax, 0xfffffffe
nop dword [eax + eax]
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x299ae80
lea ecx, [eax + 0x12]
cmp eax, 0xffffffed
mov eax, 0xffffffff
cmovge eax, ecx
push eax
call fcn.02989550
add esp, 4
mov esi, eax
movzx ecx, word [ebx]
test cx, cx
je 0x299aed1
add ebx, 2
mov eax, esi
nop word cs:[eax + eax]
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
add ebx, 2
test cx, cx
jne 0x299aec0
mov word [eax], 0
movzx ecx, word [esp + 0x28]
test cx, cx
je 0x299af01
lea edx, [esp + 0x2a]
nop word cs:[eax + eax]
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x299aef0
mov word [eax], 0
lea eax, [esp + 8]
push eax
push esi
call fcn.029bae20
add esp, 8
not eax
shr eax, 0x1f
mov eax, dword [eax*4 + 0x29c2ec8]
mov ecx, 0x6964906
xor ecx, dword [0x29c2ed0]
add eax, ecx
inc eax
jmp eax
Function at 0x299e9b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
movaps xmm0, xmmword [0x29be090]
movups xmmword [esp + 0x10], xmm0
movaps xmm0, xmmword [0x29be0a0]
movups xmmword [esp + 0x20], xmm0
movaps xmm0, xmmword [0x29be0b0]
movups xmmword [esp + 0x30], xmm0
movsd xmm0, qword [0x29be0c0]
movsd qword [esp + 0x40], xmm0
mov dword [esp + 0x48], 0x3b813d95
lea eax, [esp + 0x4c]
mov dword [esp + 0x4c], 0x393a
mov byte [esp + 0x50], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 0x40
ja 0x299ea68
nop dword [eax + eax]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 0x10]
mov esi, ecx
and esi, 0xe4130861
xor ecx, 0x64130861
lea ecx, [ecx + esi*2]
mov esi, ecx
and esi, edx
add ecx, edx
add esi, esi
sub ecx, esi
mov dword [esp + 0x5c], ecx
mov ecx, dword [esp + 0x5c]
add cl, 0x59
mov edx, dword [esp + 4]
mov byte [esp + edx + 0x10], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 0x41
jb 0x299ea20
lea edi, [esp + 0x5c]
lea edx, [esp + 0x10]
mov ecx, 0xf
mov esi, edi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
lea edi, [esp + 0x98]
mov ecx, 1
xchg esi, eax
rep movsw word es:[edi], word [esi]
xchg esi, eax
lea edi, [esp + 0xc]
push edi
push 0
push 0
push 0x1e
push esi
push 0
call dword [0x29c97f4]
mov ebx, dword [esp + 0xc]
lea eax, [ebx + ebx]
test ebx, ebx
mov ecx, 0xffffffff
cmovns ecx, eax
push ecx
call fcn.02989550
add esp, 4
mov esi, eax
push edi
push ebx
push eax
push 0x1e
lea eax, [esp + 0x6c]
push eax
push 0
call dword [0x29c97f4]
movaps xmm0, xmmword [0x29be0d0]
movups xmmword [esp + 0x10], xmm0
movsd xmm0, qword [0x29be0e0]
movsd qword [esp + 0x20], xmm0
mov word [esp + 0x28], 0
mov byte [esp + 0x2a], 0
mov dword [esp + 8], 0
mov eax, dword [esp + 8]
cmp eax, 0x1a
ja 0x299eb4d
nop word [eax + eax]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 8]
movzx ecx, byte [esp + ecx + 0x10]
lea edx, [eax + 0x7add26c8]
add eax, 0xc8
and eax, ecx
or edx, ecx
sub edx, eax
mov dword [esp + 4], edx
mov eax, dword [esp + 4]
add al, 0x88
mov ecx, dword [esp + 8]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x1b
jb 0x299eb10
push 0
push 0
lea eax, [esp + 0x18]
push eax
push esi
push dword [ebp + 8]
call fcn.02998a50
add esp, 0x14
mov ebx, eax
jmp dword [0x29c3a04]
Function at 0x29a1360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x468
mov dword [esp + 0x4c], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x50], 0
movaps xmm0, xmmword [0x29bea20]
movups xmmword [esp + 0x60], xmm0
mov dword [esp + 0x70], 0x43427dd9
mov dword [esp + 0x74], 0
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x17
ja 0x29a1411
nop word cs:[eax + eax]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x60]
lea edx, [eax - 0x38dabcb2]
lea esi, [eax + 0x4e]
xor esi, edx
and esi, ecx
and edx, ecx
lea edx, [esi + edx*2]
add eax, ecx
enter 0x4e05, 0x43
and eax, 0xf7c189c7
shl dword [ecx], 1
sal edi, 1
shl byte [ecx], cl
ret 0xca29
mov dword [esp + 0x30], edx
mov eax, dword [esp + 0x30]
add al, 0xde
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x60], al
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 0x18
jb 0x29a13c0
lea ebx, [esp + 0x60]
lea ecx, [esp + 0x48]
push ebx
call fcn.029b5fe0
shr eax, 0x1f
xor edx, edx
jmp dword [eax*4 + 0x29c45c0]
Function at 0x29add00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, esp
call fcn.02989c50
push eax
mov ecx, esp
push eax
mov eax, esp
sub esp, 0x3c
mov edi, esp
push eax
mov dword [esi + 0xc], esp
push eax
mov dword [esi + 4], esp
push eax
mov dword [esi + 0x1c], esp
sub esp, 0x18
mov ebx, esp
and ebx, 0xfffffff8
mov esp, ebx
push eax
mov dword [esi + 0x14], esp
mov dword [esi + 0x28], ecx
mov edx, dword [ebp + 8]
mov dword [ecx], edx
mov dword [esi + 0x10], eax
mov byte [eax], 0
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [0x29bfbec]
cmp eax, 0
setne al
test al, 1
jne 0x29add67
jmp 0x29aded2
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], edi
call dword [0x29bfbe8]
sub esp, 4
mov dword [esp], 1
call dword [0x29bfbdc]
mov edi, dword [esi + 0xc]
mov dword [edi], eax
cmp dword [edi], 0
je 0x29adeca
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call dword [0x29bfb9c]
mov ecx, dword [esi + 4]
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.02989660
add esp, 4
mov edx, dword [esi + 0x1c]
mov dword [edx], eax
cmp dword [edx], 0
setne al
test al, 1
jne 0x29addd5
jmp 0x29adeb4
mov eax, dword [esi + 0x28]
mov ecx, dword [eax]
mov edx, dword [edx]
mov eax, dword [esi + 4]
mov eax, dword [eax]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
mov al, byte [eax]
mov byte [esi + 8], al
mov byte [ebx], 0x5b
mov byte [ebx + 1], 0x85
mov byte [ebx + 2], 0x7b
mov byte [ebx + 3], 0x83
mov byte [ebx + 4], 0x70
mov byte [ebx + 5], 0x8c
mov byte [ebx + 6], 0x7f
mov byte [ebx + 7], 0x8d
mov byte [ebx + 8], 0x72
mov byte [ebx + 9], 0x4f
mov byte [ebx + 0xa], 0x84
mov byte [ebx + 0xb], 0x83
mov byte [ebx + 0xc], 0x86
mov byte [ebx + 0xd], 5
mov byte [ebx + 0x12], 0
mov dword [ebx + 0xe], 0
mov dword [esi], 0
mov eax, dword [esi]
cmp eax, 0x13
jae 0x29ade93
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], edx
jmp 0x29ade43
mov ecx, dword [esi]
mov eax, dword [esi]
movzx eax, byte [ebx + eax]
mov edi, ecx
add edi, 0x83
and edi, eax
mov edx, 0x454c37c
sub edx, ecx
or edx, eax
not edx
add edx, eax
sub edx, edi
mov dword [esi + 0x2c], edx
mov eax, dword [esi + 0x2c]
mov ecx, eax
xor ecx, 0x6a
and eax, 0x6a
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esi]
mov byte [ebx + ecx], al
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, 0x13
jb 0x29ade43
mov edi, dword [esi + 0xc]
mov edx, dword [esi + 0x24]
mov ecx, dword [esi + 0x20]
jmp 0x29ade93
sub esp, 0xc
mov dword [esp], ebx
mov eax, dword [esi + 0x18]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.02989e60
and al, 1
mov ecx, dword [esi + 0x10]
mov byte [ecx], al
jmp 0x29adeb2
jmp 0x29adeb4
mov eax, dword [edi]
jmp 0x29adeb8
jmp 0x29adeba
sub esp, 4
mov dword [esp], eax
call dword [0x29bfba0]
jmp 0x29adec8
jmp 0x29adeca
call dword [0x29bfbd8]
jmp 0x29aded2
mov eax, dword [esi + 0x10]
mov al, byte [eax]
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x29b5e10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x10
mov esi, esp
mov eax, dword [ebp + 8]
push eax
sub esp, 0xc
mov ecx, esp
and ecx, 0xfffffff8
mov esp, ecx
mov dword [ecx], 0xaba4a556
mov dword [ecx + 4], 0
mov word [ecx + 8], 0
mov dword [esi], 0
mov edx, dword [esi]
cmp edx, 9
ja 0x29b5e93
nop dword [eax]
mov edx, dword [esi]
mov edi, dword [esi]
movzx ebx, byte [ecx + edi]
mov edi, edx
and edi, 0xc08fc2c5
xor edx, 0x408fc2c5
lea edx, [edx + edi*2]
lea edi, [edx + ebx]
and edx, ebx
add edx, edx
mov ebx, edi
not ebx
and ebx, edx
not edx
and edx, edi
sub edx, ebx
mov dword [esi + 4], edx
mov edx, dword [esi + 4]
add dl, 0x9d
mov edi, dword [esi]
mov byte [ecx + edi], dl
inc dword [esi]
mov edx, dword [esi]
cmp edx, 0xa
jb 0x29b5e50
mov ecx, dword [ecx]
mov ecx, dword fs:[ecx]
mov edx, dword [0x29c7040]
mov edi, 0xbcf63ba1
xor edi, dword [0x29c7044]
add edx, edi
inc edx
nop dword [eax]
jmp edx
Function at 0x29baa30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x40
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop word cs:[eax + eax]
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x29baa50
mov edi, eax
sar edi, 1
lea ecx, [eax + 0xa]
cmp eax, 0xfffffff5
mov eax, 0xffffffff
cmovge eax, ecx
push eax
call fcn.02989550
add esp, 4
mov esi, eax
lea ecx, [eax + 8]
movsd xmm0, qword [0x29bf1e0]
movsd qword [eax], xmm0
lea eax, [edi + 4]
mov word [esi + 8], 0
movzx edx, word [ebx]
test dx, dx
je 0x29baab1
add ebx, 2
nop dword [eax + eax]
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebx]
add ebx, 2
test dx, dx
jne 0x29baaa0
mov word [ecx], 0
mov edx, 3
sub edx, edi
and edx, 2
mov ecx, eax
and ecx, 0xfffd
imul ecx, edx
and edi, 2
or eax, 2
imul eax, edi
lea edx, [eax + ecx]
mov word [esp + 0x18], dx
add eax, ecx
add eax, 2
mov word [esp + 0x1a], ax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], 0x18
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], 0x40
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 8], 0x8a959497
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0xc
ja 0x29bab9e
nop dword [eax + eax]
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
lea edx, [eax + ecx]
add edx, 0x7a1e7fed
add eax, 0x7a1e7fed
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
mov ecx, eax
xor ecx, 0x84
and eax, 4
lea eax, [ecx + eax*2]
inc al
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0xd
jb 0x29bab50
mov edi, dword [esp + 8]
mov eax, dword [0x29ca800]
test eax, eax
je 0x29bac0d
xor ecx, ecx
mov edx, dword [0x29ca804]
nop word cs:[eax + eax]
cmp dword [edx + ecx*8], 0x7a96736e
je 0x29babd0
inc ecx
cmp eax, ecx
jne 0x29babc0
jmp 0x29bac0d
mov eax, dword [edx + ecx*8 + 4]
cmp eax, edi
je 0x29bac0d
lea ecx, [esp + 8]
lea edx, [esp + 0x24]
push 0
push 0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x20]
push 0
push ecx
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xb
push dword [0x29ca808]
push eax
call fcn.029b7d60
add esp, 0x38
mov edi, eax
push esi
call fcn.02989560
add esp, 4
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret