joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10046b30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10046b63
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
pop esi
mov eax, ebx
pop ebx
pop ebp
ret

Function at 0x10046b70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10046b8e
test al, 0x10
je 0x10046b8e
mov esi, 1
jmp 0x10046b90
xor esi, esi
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
add edi, 0xfffffff0
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10046bad
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x10046c10
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, edi
lea ecx, [edx + 2]
mov edi, edi
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10046c20
sub edx, ecx
sar edx, 1
lea eax, [edx*2 + 2]
push eax
call fcn.10104809
lea ecx, [edi + 2]
mov dword [ebp - 4], eax
push 0x5c
push ecx
xor ebx, ebx
call fcn.101033a1
mov esi, eax
add esp, 0xc
test esi, esi
je 0x10046ca1
sub esi, edi
sar esi, 1
test ebx, ebx
jle 0x10046c8b
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10046c62
sub eax, edx
push esi
sar eax, 1
push edi
inc eax
push eax
push dword [ebp - 4]
call fcn.1010500a
add esp, 0x10
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
inc esi
inc ebx
push 0x5c
lea eax, [edi + esi*2]
push eax
call fcn.101033a1
mov esi, eax
add esp, 8
test esi, esi
jne 0x10046c55
push dword [ebp - 4]
call fcn.10103713
add esp, 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
pop edi
setne cl
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100475f0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011ea08
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1016e750]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
mov dword [ebp - 4], 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.10024750
lea esi, [eax + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
add esi, 0xfffffff0
or edi, 0xffffffff
mov dword [ebp - 0x10], ecx
mov eax, edi
lea ecx, [esi + 0xc]
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x1004766d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor ebx, ebx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], ebx
mov esi, dword [ebp + 8]
sete bl
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x10047696
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10048ea0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101216d6
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1016e750]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x101759b4]
mov dword [ebp - 0x14], 0
test al, 1
jne 0x10048f0b
or eax, 1
mov dword [0x101759b4], eax
push 0x1012ec60
mov ecx, 0x101759b8
mov dword [ebp - 4], 0
call fcn.10023fc0
push 0x10127620
call fcn.10103a78
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x101759b8]
cmp dword [eax - 0xc], 0
jne 0x10049019
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, 0x514
or ecx, edx
jge 0x10048f43
push 0x514
mov ecx, 0x101759b8
call fcn.100249c0
mov eax, dword [0x101759b8]
push 0x514
push eax
push str._USERPROFILE_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, dword [0x101759b8]
mov edi, eax
push dword [ecx - 8]
push ecx
call fcn.1010374b
mov edx, eax
add esp, 8
test edx, edx
js 0x10049039
mov ecx, dword [0x101759b8]
cmp edx, dword [ecx - 8]
jg 0x10049039
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [0x101759b8]
mov word [eax + edx*2], cx
test edi, edi
je 0x10048fc6
mov eax, dword [0x101759b8]
cmp dword [eax - 0xc], ecx
jle 0x10048fcb
push 0x7e
push eax
call fcn.101033a1
mov edx, eax
add esp, 8
test edx, edx
je 0x10048fc6
mov eax, dword [0x101759b8]
sub edx, eax
sar edx, 1
cmp edx, 0xffffffff
je 0x10048fcb
mov ecx, 0x101759b8
call fcn.10046cd0
mov eax, dword [0x101759b8]
push eax
lea eax, [ebp - 0x10]
push str.ReplaceUserProfile:_CurProfile_s
push eax
call fcn.10044f30
add esp, 0xc
mov dword [ebp - 4], 1
mov ecx, str.DynamicPaths_Initialize
mov edx, dword [eax]
call fcn.10043b30
mov dword [ebp - 4], 0xffffffff
or ecx, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x10049014
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x101759b8]
lea ecx, [eax - 0x10]
call fcn.10024750
add eax, 0x10
mov dword [esi], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.100223c0
int3
Function at 0x10049050
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011ea40
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1016e750]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
call fcn.10022690
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x100490a6
push 0x80004005
call fcn.100223c0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 1
test edi, edi
jns 0x100490c3
push 0x80070057
call fcn.100223c0
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x100490e0
push edi
lea ecx, [ebp - 0x10]
call fcn.100249c0
mov esi, dword [ebp - 0x10]
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push dword [esi - 8]
mov edi, eax
push esi
call fcn.1010374b
add esp, 8
test eax, eax
js 0x100490b9
cmp eax, dword [esi - 8]
jg 0x100490b9
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
test edi, edi
jne 0x10049170
push 0x1012ec60
mov ecx, ebx
call fcn.10023fc0
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0
or esi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x1004913b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x1004915c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edi, [esi - 0x10]
mov ecx, edi
call fcn.10024750
add eax, 0x10
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov dword [ebx], eax
lea ecx, [edi + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x1004913b
mov ecx, dword [edi]
push edi
jmp 0x10049136
Function at 0x1004bf50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
push 0x40
mov ecx, dword [edi]
lea esi, [edi + 4]
push esi
push ebx
call fcn.1004d4e0
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x1004bffa
mov eax, dword [edi + 0x40]
lea esi, [edi + 0x44]
mov ecx, dword [edi]
add eax, ebx
push 0xf8
push esi
push eax
mov dword [edi + 0x13c], eax
call fcn.1004d4e0
cmp dword [esi], 0x4550
je 0x1004bfa7
mov dword [ebp + 8], str.Error_while_setting_image_base_address:_no_NT_signature_found
jmp 0x1004c001
mov eax, 0x2000
test word [edi + 0x5a], ax
je 0x1004bfbb
mov dword [ebp + 8], str.Error_while_setting_image_base_address:_not_the_image_base_of_an_executable
jmp 0x1004c001
mov ecx, dword [edi + 0xc4]
test ecx, ecx
jne 0x1004bfce
mov dword [ebp + 8], str.Error_while_setting_image_base_address:_no_import_directory_existing
jmp 0x1004c001
push ecx
lea eax, [ecx + ebx]
mov dword [edi + 0x140], eax
mov eax, esp
push ecx
push str.dwImportTableVA___.8lx
push eax
call fcn.10044f30
add esp, 0xc
call fcn.1004bee0
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp + 8], str.Error_while_setting_image_base_address:_no_DOS_signature_found
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0xc]
call fcn.10104c3e
push 0x1016b9e8
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], vtable.std::runtime_error.0
push eax
call fcn.1010805b
int3
Function at 0x1004f870
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x44]
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 0x268]
mov ebx, dword [esi + 0x20]
mov ecx, dword [esi + 0x30]
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
cmp edi, 0x2710
jge 0x1004f8a3
push eax
push edi
push edx
jmp 0x1004f978
lea eax, [edi + 0x22]
test al, 1
je 0x1004f8ab
inc eax
add eax, dword [esi + 0x24]
mov dword [ebp - 0x10], eax
cmp ecx, 1
jge 0x1004f8bd
mov ecx, 1
jmp 0x1004f8c7
mov eax, 0x64
cmp ecx, eax
cmovg ecx, eax
dec ecx
mov eax, 0x55555556
imul ecx
mov ecx, ebx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [esi + 0x24]
imul eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push edi
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.1004f020
mov eax, dword [ebp - 4]
add esp, 0x14
mov edx, dword [ebp - 8]
cmp eax, 3
jl 0x1004f951
mov ecx, dword [ebp - 0x14]
mov eax, edi
sub ecx, edx
mov edx, 1
test edi, edi
cmove eax, edx
sub esp, 8
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm1, xmm0
cvtps2pd xmm0, xmm1
movsd qword [esp], xmm0
push edi
push ecx
push str._______d_work___d_block__ratio__5.2f_n
call fcn.10105b27
add eax, 0x40
push eax
call fcn.10105c03
mov eax, dword [ebp - 4]
add esp, 0x18
mov edx, dword [ebp - 8]
test edx, edx
jns 0x1004f986
cmp eax, 2
jl 0x1004f973
push str.____too_repetitive__using_fallback_sorting_algorithm_n
call fcn.10105b27
add eax, 0x40
push eax
call fcn.10105c03
mov eax, dword [ebp - 4]
add esp, 8
push eax
push edi
push dword [ebp - 0xc]
mov edx, dword [esi + 0x14]
mov ecx, dword [esi + 0x10]
call fcn.1004e210
add esp, 0xc
mov ecx, dword [esi + 0x44]
xor eax, eax
mov dword [esi + 0x1c], 0xffffffff
test ecx, ecx
jle 0x1004f9a6
cmp dword [ebx + eax*4], 0
je 0x1004f9a3
inc eax
cmp eax, ecx
jl 0x1004f996
jmp 0x1004f9a6
mov dword [esi + 0x1c], eax
cmp dword [esi + 0x1c], 0xffffffff
je 0x1004f9b3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.1.0.6__6_Sept_2010
push 0x3eb
push str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to_me_at:_jseward_bzip.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks.__Julian_Seward__10_December_2007._n_n
call fcn.10105b27
add eax, 0x40
push eax
call fcn.10105c03
add esp, 0x10
push 3
call fcn.1010696e
int3
Function at 0x1004f9e0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
push str.1.0.6__6_Sept_2010
push esi
push str._n_nbzip2_libbzip2:_internal_error_number__d._nThis_is_a_bug_in_bzip2_libbzip2___s._nPlease_report_it_to_me_at:_jseward_bzip.org.__If_this_happened_nwhen_you_were_using_some_program_which_uses_libbzip2_as_a_ncomponent__you_should_also_report_this_bug_to_the_author_s__nof_that_program.__Please_make_an_effort_to_report_this_bug__ntimely_and_accurate_bug_reports_eventually_lead_to_higher_nquality_software.__Thanks.__Julian_Seward__10_December_2007._n_n
call fcn.10105b27
add eax, 0x40
push eax
call fcn.10105c03
add esp, 0x10
cmp esi, 0x3ef
jne 0x1004fa1d
push str._n_A_special_note_about_internal_error_number_1007__n_nExperience_suggests_that_a_common_cause_of_i.e._1007_nis_unreliable_memory_or_other_hardware.__The_1007_assertion_njust_happens_to_cross_check_the_results_of_huge_numbers_of_nmemory_reads_writes__and_so_acts__unintendedly__as_a_stress_ntest_of_your_memory_system._n_nI_suggest_the_following:_try_compressing_the_file_again__npossibly_monitoring_progress_in_detail_with_the__vv_flag._n_n_If_the_error_cannot_be_reproduced__and_or_happens_at_different_n__points_in_compression__you_may_have_a_flaky_memory_system._n__Try_a_memory_test_program.__I_have_used_Memtest86_n___www.memtest86.com_.__At_the_time_of_writing_it_is_free__GPLd_._n__Memtest86_tests_memory_much_more_thorougly_than_your_BIOSs_n__power_on_test__and_may_find_failures_that_the_BIOS_doesnt._n_n_If_the_error_can_be_repeatably_reproduced__this_is_a_bug_in_n__bzip2__and_I_would_very_much_like_to_hear_about_it.__Please_n__let_me_know__and__ideally__save_a_copy_of_the_file_causing_the_n__problem____without_which_I_will_be_unable_to_investigate_it._n_n
call fcn.10105b27
add eax, 0x40
push eax
call fcn.10105c03
add esp, 8
push 3
call fcn.1010696e
int3
Function at 0x1004fc90
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov bl, byte [ecx + 0x34]
push esi
mov esi, dword [ecx + 0x38]
test esi, esi
jle 0x1004fcc1
mov edx, dword [ecx + 0x260]
push edi
movzx edi, bl
mov eax, edx
shl edx, 8
shr eax, 0x18
xor eax, edi
xor edx, dword [eax*4 + 0x1012ff00]
dec esi
jne 0x1004fca6
mov dword [ecx + 0x260], edx
pop edi
mov eax, dword [ecx + 0x34]
mov byte [ecx + eax + 0x58], 1
mov edx, dword [ecx + 0x38]
mov eax, edx
dec eax
je 0x1004fd12
dec eax
je 0x1004fd48
dec eax
je 0x1004fd21
mov byte [edx + ecx + 0x54], 1
mov edx, dword [ecx + 0x24]
mov eax, dword [ecx + 0x44]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov bl, byte [ecx + 0x38]
sub bl, 4
mov eax, dword [ecx + 0x44]
mov edx, dword [ecx + 0x24]
pop esi
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
pop ebx
ret
mov eax, dword [ecx + 0x44]
mov edx, dword [ecx + 0x24]
pop esi
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
pop ebx
ret
mov eax, dword [ecx + 0x44]
mov edx, dword [ecx + 0x24]
pop esi
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
pop ebx
ret
Function at 0x10057040
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10121ce8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1016e750]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x1016e750]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.10024fe0
push dword [ebp + 0xc]
lea eax, [esp + 0x2c]
push dword [ebp + 8]
push eax
call fcn.10056f60
add esp, 0x24
mov dword [esp + 0x38], 0
cmp dword [eax + 0x14], 0x10
jb 0x100570bd
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, esi
lea eax, [esp + 0xc]
push eax
call fcn.10104c3e
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x100570e6
push dword [esp + 0x10]
call fcn.1010338d
add esp, 4
mov ecx, dword [ebp + 8]
mov eax, esi
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi], vtable.std::_System_error.0
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10103392
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10058e60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10122098
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1016e750]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
mov eax, dword [0x1016e750]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov byte [esp + 0x20], 0
lea eax, [esp + 0xc]
mov dword [esp + 0x38], 0
push eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], 0
call fcn.10058010
test al, al
je 0x10058f09
mov ecx, dword [esp + 0xc]
cmp ecx, 0xffffffff
ja 0x10058f09
mov eax, dword [esi + 4]
add eax, ecx
lea ecx, [esp + 0x10]
push esi
mov dword [esi + 8], eax
call fcn.100590c0
cmp byte [esp + 0x20], 0
je 0x10058f09
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
jne 0x10058f09
mov bl, 1
jmp 0x10058f0b
xor bl, bl
mov dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x10]
push dword [esp + 0x1c]
mov edx, dword [ecx]
call dword [edx + 0xc]
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10103392
mov esp, ebp
pop ebp
ret
Function at 0x1005a680
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
test edi, edi
je 0x1005a81d
mov esi, dword [ebp + 8]
test esi, esi
je 0x1005a81d
mov dword [esi + 0xf0], 0xa
mov ecx, dword [edi]
mov eax, ecx
rol ecx, 8
and ecx, 0xff00ff
ror eax, 8
and eax, 0xff00ff00
or eax, ecx
mov dword [esi], eax
lea eax, [esi + 4]
mov edx, dword [edi + 4]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov dword [eax], ecx
mov edx, dword [edi + 8]
mov ecx, edx
ror ecx, 8
and ecx, 0xff00ff00
rol edx, 8
and edx, 0xff00ff
or ecx, edx
mov dword [esi + 8], ecx
mov ecx, dword [edi + 0xc]
mov edi, 0x10131574
push ebx
mov ebx, ecx
rol ecx, 8
and ecx, 0xff00ff
ror ebx, 8
and ebx, 0xff00ff00
or ebx, ecx
mov ecx, ebx
mov dword [esi + 0xc], ebx
shr ecx, 0x10
and ecx, 0xff
mov edx, dword [ecx*4 + str.cc]
mov ecx, ebx
shr ecx, 8
xor edx, 0x1000000
and ecx, 0xff
and edx, 0xff000000
mov ecx, dword [ecx*4 + 0x101319e0]
and ecx, 0xff0000
xor edx, ecx
mov ecx, ebx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + 0x10130d70]
xor edx, ecx
movzx ecx, bl
mov ecx, dword [ecx*4 + 0x10131170]
and ecx, 0xff00
xor edx, ecx
mov ecx, dword [eax]
xor edx, dword [esi]
xor ecx, edx
mov dword [esi + 0x10], edx
mov edx, dword [esi + 8]
xor edx, ecx
mov dword [esi + 0x14], ecx
mov ecx, ebx
mov dword [esi + 0x18], edx
xor ecx, edx
mov dword [esi + 0x1c], ecx
pop ebx
mov edi, edi
mov edx, dword [eax + 0x18]
lea eax, [eax + 0x10]
mov ecx, edx
shr ecx, 8
and ecx, 0xff
mov esi, dword [ecx*4 + 0x101319e0]
mov ecx, edx
shr ecx, 0x10
and esi, 0xff0000
and ecx, 0xff
mov ecx, dword [ecx*4 + str.cc]
and ecx, 0xff000000
xor esi, ecx
mov ecx, edx
shr ecx, 0x18
movzx ecx, byte [ecx*4 + 0x10130d70]
xor esi, ecx
movzx ecx, dl
mov ecx, dword [ecx*4 + 0x10131170]
and ecx, 0xff00
xor esi, ecx
xor esi, dword [eax - 4]
xor esi, dword [edi]
add edi, 4
mov dword [eax + 0xc], esi
mov ecx, dword [eax]
xor ecx, esi
mov dword [eax + 0x10], ecx
mov edx, dword [eax + 4]
xor edx, ecx
mov dword [eax + 0x14], edx
mov ecx, dword [eax + 8]
xor ecx, edx
mov dword [eax + 0x18], ecx
cmp edi, 0x10131598
jne 0x1005a790
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x1005add0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov ebx, edx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ebx
mov esi, dword [esi]
mov dword [ebp - 8], ecx
test esi, esi
je 0x1005ae0a
mov edx, dword [ebp + 0x14]
test edi, edi
je 0x1005ae0a
mov al, byte [esi + edx]
dec edi
xor al, byte [ecx]
inc esi
mov byte [ebx], al
inc ecx
inc ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
and esi, 0xf
jne 0x1005adf0
cmp edi, 0x10
jb 0x1005ae99
sub ebx, dword [ebp + 0x14]
mov eax, ecx
sub eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov dword [ebp + 8], eax
mov eax, edi
shr eax, 4
mov dword [ebp - 0xc], eax
shl eax, 4
add dword [ebp - 4], eax
add ecx, eax
mov dword [ebp - 8], ecx
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push edx
call fcn.1005a830
mov edx, dword [ebp + 0x10]
add esp, 0xc
mov ecx, 0x10
jmp 0x1005ae50
dec ecx
inc byte [ecx + edx]
jne 0x1005ae5a
test ecx, ecx
jne 0x1005ae50
cmp esi, 0x10
jae 0x1005ae85
mov eax, dword [ebp + 0x14]
mov edx, 0xf
sub edx, esi
add eax, esi
mov esi, dword [ebp + 8]
shr edx, 2
inc edx
mov ecx, dword [esi + eax]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [ebx + eax - 4], ecx
dec edx
jne 0x1005ae72
mov edx, dword [ebp + 0x10]
add dword [ebp + 8], 0x10
sub edi, 0x10
add ebx, 0x10
xor esi, esi
dec dword [ebp - 0xc]
jne 0x1005ae34
mov ebx, dword [ebp - 4]
test edi, edi
je 0x1005aee0
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.1005a830
mov edx, dword [ebp + 0x10]
add esp, 0xc
mov ecx, 0x10
dec ecx
inc byte [ecx + edx]
jne 0x1005aec0
test ecx, ecx
jne 0x1005aeb6
mov eax, dword [ebp + 0x14]
sub ebx, eax
mov edx, dword [ebp - 8]
sub edx, eax
lea ecx, [esi + eax]
add esi, edi
nop
mov al, byte [ecx + edx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
dec edi
jne 0x1005aed0
mov eax, dword [ebp + 0x18]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret