joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a8d30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1eda328
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x1f236ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x88], ecx
movzx eax, byte [ebp + 0x10]
push eax
lea ecx, [ebp - 0x48]
push ecx
mov ecx, dword [ebp - 0x88]
call fcn.100a8ab0
mov dword [ebp - 4], 0
xor edx, edx
cmp dword [ebp - 0x38], 0
sete dl
movzx eax, dl
test eax, eax
jne 0x100a8e58
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x48]
call fcn.100af940
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x58], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x58]
cmp dword [eax + 0x14], 0x10
jb 0x100a8dc5
mov ecx, dword [ebp - 0x58]
mov edx, dword [ecx]
mov dword [ebp - 0x90], edx
jmp 0x100a8dce
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x90], eax
push 0x1eef49c
mov ecx, dword [ebp - 0x90]
push ecx
call fcn.1013ed6a
add esp, 8
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 2
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10044170
mov byte [ebp - 4], 0
cmp dword [ebp - 0x4c], 0
je 0x100a8e58
mov edx, dword [ebp - 0x4c]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.1013ec91
add esp, 0x10
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x50]
mov dword [eax], ecx
mov edx, dword [ebp - 0x4c]
push edx
call fcn.1013e9d3
add esp, 4
mov byte [ebp - 0x51], 1
mov dword [ebp - 4], 3
mov dword [ebp - 4], 4
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.100732f0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x51]
jmp 0x100a8e80
mov byte [ebp - 0x52], 0
mov dword [ebp - 4], 5
mov dword [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.100732f0
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x52]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1013ad0a
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100ced50
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.100cd160
add esp, 0xc
pop ebp
ret
Function at 0x100ebbe0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x9c0], 0x270
jne 0x100ebc00
mov ecx, dword [ebp - 8]
call fcn.100ebcf0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x9c0]
mov eax, dword [ebp - 8]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x9c0]
add eax, 1
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x9c0], eax
mov edx, dword [ebp - 4]
shr edx, 0xb
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shl eax, 7
and eax, 0x9d2c5680
xor eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shl ecx, 0xf
and ecx, 0xefc60000
xor ecx, dword [ebp - 4]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 0x12
xor edx, dword [ebp - 4]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x100ec2c0
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
movzx eax, byte [0x1f31f08]
test eax, eax
je 0x100ec2d7
jmp 0x100ec386
mov dword [ebp - 8], 0x80000000
mov byte [ebp - 2], 0x80
mov byte [ebp - 1], 0
mov dword [ebp - 0xc], 0
mov byte [ebp - 0xd], 0x80
jmp 0x100ec2fb
mov cl, byte [ebp - 0xd]
shr cl, 1
mov byte [ebp - 0xd], cl
movzx edx, byte [ebp - 0xd]
test edx, edx
je 0x100ec345
movzx eax, byte [ebp - 1]
movzx ecx, byte [ebp - 0xd]
and eax, ecx
je 0x100ec31b
mov edx, dword [ebp - 0xc]
xor edx, 0x80000000
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
and eax, 0x80000000
je 0x100ec33b
mov ecx, dword [ebp - 0xc]
shl ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
xor edx, 0x4c11db7
mov dword [ebp - 0xc], edx
jmp 0x100ec343
mov eax, dword [ebp - 0xc]
shl eax, 1
mov dword [ebp - 0xc], eax
jmp 0x100ec2f3
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.100ec220
add esp, 4
mov esi, eax
movzx edx, byte [ebp - 1]
push edx
call fcn.100ec410
add esp, 4
movzx eax, al
mov dword [eax*4 + 0x1f31b08], esi
mov cl, byte [ebp - 1]
add cl, 1
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
test edx, edx
jne 0x100ec2e6
mov byte [0x1f31f08], 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100ec4d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
call fcn.100de780
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
and ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edx], ecx
mov eax, dword [ebp - 8]
mov dword [eax + 0x9c0], 1
jmp 0x100ec512
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x9c0]
add edx, 1
mov eax, dword [ebp - 8]
mov dword [eax + 0x9c0], edx
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x9c0], 0x270
jae 0x100ec567
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x9c0]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x9c0]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + edx*4 - 4]
shr edx, 0x1e
mov ecx, dword [ebp - 8]
xor edx, dword [ecx + eax*4 - 4]
imul edx, edx, 0x6c078965
mov eax, dword [ebp - 8]
add edx, dword [eax + 0x9c0]
and edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x9c0]
mov ecx, dword [ebp - 8]
mov dword [ecx + eax*4], edx
jmp 0x100ec4fd
mov esp, ebp
pop ebp
ret 4
Function at 0x10137840
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1ee7e30
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x1f236ec]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 0
push 0x1ef38d4
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
mov dword [esi], 0x1ef39bc
call fcn.10074830
mov byte [esp + 0x38], 1
call fcn.10136cbe
lea ecx, [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov byte [esp + 0x38], 0
call fcn.10074940
mov dword [esi], 0x1ef39e0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x10029850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xa4
movzx eax, word [0x10118008]
xorps xmm0, xmm0
push ebx
push esi
mov esi, dword [esp + 0x68]
push edi
mov edi, dword [section..data]
lea ebx, [eax + eax*8]
imul edi, dword [0x10118054]
mov eax, dword [0x1011800c]
sub esi, eax
push 2
push 1
movq qword [esp + 0x1c], xmm0
imul edx, edi, 0x14a08
movq qword [esp + 0x34], xmm0
mov byte [esp + 0x14], 5
mov dword [esp + 0x1c], 0x41
mov dword [esp + 0x20], 0
sub esi, edx
mov byte [esp + 0x28], 1
sub eax, esi
mov byte [esp + 0x2c], 5
sub eax, ebx
mov dword [esp + 0x34], 0x46
mov dword [esp + 0x38], 0
mov byte [esp + 0x40], 1
lea ecx, [eax + 0xfc]
mov al, cl
sub al, dl
sub al, 4
mov byte [0x10118004], al
mov eax, esi
imul eax, edi
imul edx, eax, 0xa978a040
imul eax, ecx, 0x55
mov dword [0x1011800c], edx
sub esi, eax
movzx eax, si
lea ecx, [eax + eax*8]
sub ecx, edx
mov dword [0x10118054], ecx
sub ecx, edx
add ecx, 0xfffffffc
movzx eax, cx
mov dword [section..data], eax
movzx eax, cx
sub ebx, eax
mov word [0x10118008], cx
lea eax, [esp + 0x14]
add ebx, 0x1c959
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x14]
lea eax, [esp + 0x2c]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x44]
push eax
push ecx
lea ecx, [esp + 0x80]
call fcn.10005920
push 0x10006c40
lea eax, [esp + 0x74]
mov byte [esp + 0x88], 1
push 2
mov dword [esp + 0x88], eax
lea eax, [esp + 0x14]
push 0x18
push eax
call fcn.1002b770
xorps xmm0, xmm0
mov byte [esp + 0x3c], 5
movq qword [esp + 0x44], xmm0
lea eax, [esp + 0x3c]
movq qword [esp + 0x5c], xmm0
mov dword [esp + 0x44], 0x22
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], eax
mov byte [esp + 0x50], 1
mov byte [esp + 0x54], 5
mov dword [esp + 0x5c], 0x1e
mov dword [esp + 0x60], 0
push 2
lea eax, [esp + 0x58]
mov byte [esp + 0x6c], 1
mov dword [esp + 0x68], eax
lea ecx, [esp + 0x40]
push 1
lea eax, [esp + 0x74]
push eax
push ecx
lea ecx, [esp + 0x98]
call fcn.10005920
push 0x10006c40
lea eax, [esp + 0x8c]
mov byte [esp + 0xa0], 1
push 2
mov dword [esp + 0xa0], eax
lea eax, [esp + 0x44]
push 0x18
push eax
call fcn.1002b770
push 2
push 1
lea eax, [esp + 0xa8]
lea ecx, [esp + 0x78]
push eax
push ecx
lea ecx, [esp + 0xb0]
call fcn.10005920
push 0x10006c40
push 2
push 0x18
lea eax, [esp + 0x7c]
push eax
call fcn.1002b770
movzx esi, word [0x10118008]
mov edx, dword [0x1011800c]
mov di, dx
imul eax, ebx, 0x55
push dword [esp + 0xa0]
sub esi, eax
mov ax, word [0x10118050]
add ax, word [0x10118008]
movzx eax, ax
imul eax, eax, 0x55
imul ecx, esi, 0xfffffffd
sub di, ax
mov eax, 0x1db3
add di, dx
add di, ax
imul eax, edx, 0x53
add di, di
movzx esi, di
add esi, 0xffffffa6
mov word [0x10118008], di
sub ecx, eax
add ecx, 0xfffffffc
add esi, ecx
mov dword [0x10118050], ecx
mov dword [section..data], ecx
movzx ecx, di
imul ecx, ecx, 0x55
mov dword [0x10118054], esi
sub esi, ecx
lea ecx, [esp + 0xac]
call fcn.10027ba0
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0xa4
ret
Function at 0x10031640
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call fcn.10031220
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1003166c
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
call dword [0x1008d1dc]
call dword [ebp - 8]
jmp 0x10031676
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret

Function at 0x10065180
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
call fcn.10067730
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100651be
cmp dword [ebp + 8], 0
je 0x100651ac
lea eax, [ebp + 8]
push eax
call fcn.10065580
add esp, 4
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x100651be
mov eax, 4
jmp 0x100652ee
call fcn.10067500
movzx edx, al
test edx, edx
jne 0x100651ec
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x100651dd
mov dword [ebp - 0xc], 4
jmp 0x100651e4
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
jmp 0x100652ee
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10065295
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
push 0
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0x100654e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
lea ecx, [ebp - 8]
call fcn.1003dca0
lea ecx, [ebp - 8]
call fcn.100655e0
movzx edx, al
test edx, edx
jne 0x10065257
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
call fcn.100655c0
mov eax, dword [ebp - 0x10]
jmp 0x100652ee
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.1003e210
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x10065282
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 8]
call fcn.100655c0
mov eax, dword [ebp - 0x14]
jmp 0x100652ee
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 8]
call fcn.100655c0
mov eax, dword [ebp - 0x18]
jmp 0x100652ee
call fcn.10067680
movzx ecx, al
test ecx, ecx
jne 0x100652ce
mov edx, dword [ebp + 0x10]
or edx, 0x200000
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.10065480
add esp, 0x10
jmp 0x100652ee
call fcn.10067590
mov dword [ebp - 0x24], eax
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.10065480
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10065300
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
call fcn.10067730
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006533e
cmp dword [ebp + 8], 0
je 0x1006532c
lea eax, [ebp + 8]
push eax
call fcn.100655a0
add esp, 4
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x1006533e
mov eax, 4
jmp 0x1006546e
call fcn.10067500
movzx edx, al
test edx, edx
jne 0x1006536c
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006535d
mov dword [ebp - 0xc], 4
jmp 0x10065364
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
jmp 0x1006546e
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10065415
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
push 0
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0x10065530
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
lea ecx, [ebp - 8]
call fcn.1003dca0
lea ecx, [ebp - 8]
call fcn.100655e0
movzx edx, al
test edx, edx
jne 0x100653d7
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
call fcn.100655c0
mov eax, dword [ebp - 0x10]
jmp 0x1006546e
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.1003e210
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x10065402
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 8]
call fcn.100655c0
mov eax, dword [ebp - 0x14]
jmp 0x1006546e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 8]
call fcn.100655c0
mov eax, dword [ebp - 0x18]
jmp 0x1006546e
call fcn.10067680
movzx ecx, al
test ecx, ecx
jne 0x1006544e
mov edx, dword [ebp + 0x10]
or edx, 0x200000
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.100654b0
add esp, 0x10
jmp 0x1006546e
call fcn.10067590
mov dword [ebp - 0x24], eax
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.100654b0
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x1006ae04
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1006a420

Function at 0x1006ae0f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1006a75b

Function at 0x464190
Capabilities:
Packed with generic packer
Resolve function by parsing pe exports

Disassembly:
pop dword [edi + 0x1b1e9e2c]
sbb eax, dword [ecx + ebp*8 + 0x20666cc5]
pop esi
mov dl, dl
pop es
insb byte es:[edi], dx
and byte [esi - 0x78], bl
rol byte [edi], cl
sub esi, dword [edi + 0x47]
mov eax, 0x7b96b99c
sub ebx, esp
xor al, 0x55
das
bt dword [ebx - 0x63], edx
leave
mov dword [0x35564b8], eax
xchg esi, eax
push 0xd765dfe4
cmp dword [eax + 0x4af94b34], 0xc6951f58
mov byte [0x103c923f], al
jecxz 0x46419a
jmp 0x4641d5
sbb byte [ebp + 0x66474f29], dh
mov ah, 0x96
mov cl, 0x5c
mov dl, 0x48
mov ah, 0xef
invalid
Function at 0x407abb
Capabilities:
Hash data using sha256

Disassembly:
cmp dword [0x44a804], 2
push esi
push edi
mov edi, edx
mov esi, ecx
jl 0x407acf
call fcn.0040674f
call fcn.004080ba
xor edx, edx
mov ecx, dword [esi + 0xf4]
mov eax, dword [edx + 0x442330]
mov dword [edx + ecx], eax
add edx, 4
cmp edx, 0x20
jl 0x407ad6
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov eax, dword [esi + 0xf4]
xor dword [eax + 8], edi
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0xc]
or eax, 0x2000
shl eax, 0x10
xor dword [ecx + 0xc], eax
pop edi
pop esi
ret 4
Function at 0x408d79
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, edx
test esi, esi
je 0x408d9d
movzx edx, byte [edi]
movzx eax, cl
xor edx, eax
shr ecx, 8
xor ecx, dword [edx*4 + 0x44b430]
inc edi
sub esi, 1
jne 0x408d85
pop edi
mov eax, ecx
pop esi
ret 4
Function at 0x40908a
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0x1e0
mov eax, dword [0x449020]
xor eax, esp
mov dword [esp + 0x1dc], eax
push ebx
mov eax, ecx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x1e8]
mov ebx, edx
mov edx, dword [esp + 0x1f8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1f0]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x1fc]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x200]
mov dword [esp + 8], edx
mov dword [esp + 0x14], ecx
push ebp
push esi
push edi
mov edi, dword [esp + 0x200]
mov dword [esp + 0x24], edi
cmp ebx, 0x40
jbe 0x40912a
lea ecx, [esp + 0x100]
call fcn.00415c2f
push ebx
mov edx, eax
call fcn.00415e30
lea edx, [esp + 0x1ac]
lea ecx, [esp + 0x100]
call fcn.00415e99
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1ac]
push 0x20
mov dword [esp + 0x20], eax
pop ebx
xor ebp, ebp
test edi, edi
je 0x409146
cmp byte [edx], 0
je 0x409146
mov esi, edi
lea edi, [esp + 0x30]
push 0x1a
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x24]
jmp 0x4091aa
mov edx, ebp
test ebx, ebx
je 0x40916c
mov esi, eax
lea eax, [esp + 0x168]
sub esi, eax
lea ecx, [esp + 0x168]
add ecx, edx
mov al, byte [esi + ecx]
xor al, 0x36
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x409157
cmp ebx, 0x40
jae 0x40918b
push 0x40
pop eax
sub eax, ebx
lea ecx, [esp + 0x168]
push eax
add ecx, ebx
push 0x36
push ecx
call fcn.00424d90
add esp, 0xc
lea ecx, [esp + 0x30]
call fcn.00415c2f
push 0x40
lea edx, [esp + 0x16c]
call fcn.00415e30
test edi, edi
je 0x4091bb
mov edx, dword [esp + 0x14]
cmp byte [edx], 0
jne 0x4091bb
push 0x1a
pop ecx
lea esi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
mov byte [edx], 1
push dword [esp + 0x1f8]
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x34]
call fcn.00415e30
lea edx, [esp + 0x1cc]
lea ecx, [esp + 0x30]
call fcn.00415e99
mov edi, dword [esp + 0x18]
test edi, edi
je 0x409204
mov eax, dword [esp + 0x20]
cmp byte [eax], 0
je 0x409204
mov esi, edi
lea edi, [esp + 0x98]
push 0x1a
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [esp + 0x18]
jmp 0x40926b
test ebx, ebx
je 0x40922a
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x168]
sub edx, eax
lea ecx, [esp + 0x168]
add ecx, ebp
mov al, byte [edx + ecx]
xor al, 0x5c
inc ebp
mov byte [ecx], al
cmp ebp, ebx
jb 0x409215
cmp ebx, 0x40
jae 0x409249
push 0x40
pop eax
sub eax, ebx
lea ecx, [esp + 0x168]
push eax
add ecx, ebx
push 0x5c
push ecx
call fcn.00424d90
add esp, 0xc
lea ecx, [esp + 0x98]
call fcn.00415c2f
push 0x40
lea edx, [esp + 0x16c]
call fcn.00415e30
test edi, edi
je 0x40927f
mov eax, dword [esp + 0x20]
cmp byte [eax], 0
jne 0x40927f
push 0x1a
pop ecx
lea esi, [esp + 0x98]
rep movsd dword es:[edi], dword [esi]
mov byte [eax], 1
push 0x20
lea edx, [esp + 0x1d0]
lea ecx, [esp + 0x9c]
call fcn.00415e30
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x98]
call fcn.00415e99
mov ecx, dword [esp + 0x1ec]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00423125
add esp, 0x1e0
ret 0x1c
Function at 0x4092bf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1ac
mov eax, dword [0x449020]
xor eax, esp
mov dword [esp + 0x1a8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
push 0x10
push eax
lea eax, [esp + 0x150]
mov dword [esp + 0x1c], edx
push eax
mov dword [esp + 0x24], ecx
call fcn.00424810
mov edx, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 0x158], 0x1000000
push eax
push eax
push eax
push eax
lea eax, [esp + 0x118]
push eax
push 0x14
lea eax, [esp + 0x160]
push eax
call fcn.0040908a
push 0x20
lea eax, [esp + 0x10c]
push eax
lea eax, [esp + 0x130]
push eax
call fcn.00424810
mov eax, dword [ebp + 0x1c]
add esp, 0xc
dec eax
mov dword [esp + 0xfc], esi
mov dword [esp + 0xf0], eax
xor esi, esi
mov dword [esp + 0x104], ebx
push 0x10
pop eax
push 0x20
mov dword [esp + 0xf8], eax
mov dword [esp + 0xfc], eax
mov dword [esp + 0x104], edi
mov byte [esp + 0x17], 0
mov byte [esp + 0x16], 0
mov dword [esp + 0x20], esi
pop ebx
mov edi, dword [esp + esi + 0xf0]
test edi, edi
je 0x40940a
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x12]
push eax
lea eax, [esp + 0x24]
mov edx, esi
push eax
lea eax, [esp + 0x1b]
push eax
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x1a4]
push eax
push ebx
lea eax, [esp + 0x120]
push eax
call fcn.0040908a
push ebx
lea eax, [esp + 0x198]
push eax
lea eax, [esp + 0x110]
push eax
call fcn.00424810
add esp, 0xc
xor ecx, ecx
mov al, byte [esp + ecx + 0x108]
xor byte [esp + ecx + 0x128], al
inc ecx
cmp ecx, ebx
jb 0x4093ee
sub edi, 1
jne 0x4093a0
mov esi, dword [esp + 0x1c]
push ebx
lea eax, [esp + 0x12c]
push eax
push dword [esp + esi + 0x104]
call fcn.00424810
add esi, 4
add esp, 0xc
mov dword [esp + 0x1c], esi
cmp esi, 0xc
jb 0x409391
push 0x44
pop edx
lea ecx, [esp + 0x148]
call fcn.00414ef7
mov edx, ebx
lea ecx, [esp + 0x128]
call fcn.00414ef7
mov edx, ebx
lea ecx, [esp + 0x108]
call fcn.00414ef7
mov edx, ebx
lea ecx, [esp + 0x194]
call fcn.00414ef7
mov ecx, dword [esp + 0x1b4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00423125
mov esp, ebp
pop ebp
ret 0x18
Function at 0x409725
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x449020]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
mov ebx, ecx
mov eax, edx
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], eax
cmp dword [ebx], 2
lea esi, [ebx + 4]
jne 0x409792
mov ecx, dword [esi]
lea edx, [esp + 0xc]
call fcn.004080b7
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x24]
push ecx
push 4
mov ecx, edx
push ecx
push 0x20
pop edx
mov ecx, eax
call fcn.0040908a
xor edx, edx
movzx eax, byte [esp + edx + 0x14]
mov ecx, edx
and ecx, 3
shl ecx, 3
shl eax, cl
xor edi, eax
inc edx
cmp edx, 0x20
jb 0x409773
mov eax, dword [esp + 0x10]
mov dword [esi], edi
xor edi, edi
cmp dword [ebx], 3
jne 0x4097bd
push edi
push edi
push edi
push edi
lea ecx, [esp + 0x24]
push ecx
push 0x20
push esi
push 0x20
pop edx
mov ecx, eax
call fcn.0040908a
push 0x20
lea eax, [esp + 0x18]
push eax
push esi
call fcn.00424810
add esp, 0xc
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00423125
mov esp, ebp
pop ebp
ret