joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410810
Capabilities:
Enumerate devices by category

Disassembly:
sub esp, 0x128
push esi
push edi
xor esi, esi
push 2
mov edi, ecx
push esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [esp + 0xc]
push eax
push 0x42f874
push 1
push esi
push 0x430af4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
je 0x41084e
pop edi
xor al, al
pop esi
add esp, 0x128
ret 4
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push esi
push edx
mov ecx, dword [eax]
push 0x430ad4
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x41087e
mov eax, dword [esp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
xor al, al
pop esi
add esp, 0x128
ret 4
mov eax, dword [esp + 0xc]
push ebx
push ebp
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x14]
mov dword [edi], esi
mov edx, dword [eax]
push ecx
push 1
push eax
call dword [edx + 0xc]
test eax, eax
jne 0x4109cc
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [edi], esi
jne 0x4109cc
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push ecx
push 0x432508
mov edx, dword [eax]
push esi
push esi
push eax
call dword [edx + 0x24]
test eax, eax
jl 0x41099c
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push esi
mov word [esp + 0x2c], 8
mov edx, dword [eax]
push ecx
push str.FriendlyName
push eax
call dword [edx + 0xc]
test eax, eax
jne 0x410928
mov eax, dword [esp + 0x30]
push esi
push esi
lea edx, [esp + 0x40]
push 0x104
push edx
push 0xffffffffffffffff
push eax
push esi
push esi
call ebx
mov ecx, dword [esp + 0x30]
push ecx
call ebp
mov eax, dword [esp + 0x1c]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [esp + 0x13c]
lea eax, [esp + 0x38]
push 0x16
push eax
push ecx
mov dword [esp + 0x28], esi
call fcn.0041d9c0
add esp, 0xc
test eax, eax
jne 0x41099c
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
push 0x42f804
mov edx, dword [eax]
push esi
push esi
push eax
call dword [edx + 0x20]
test eax, eax
jne 0x41099c
mov eax, dword [esp + 0x10]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], esi
cmp eax, esi
je 0x4109ae
mov ecx, dword [eax]
push edi
push 0x42f474
push eax
call dword [ecx]
test eax, eax
jge 0x410992
mov dword [edi], esi
mov eax, dword [esp + 0x20]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x4109ae
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x14]
mov edx, dword [eax]
push ecx
push 1
push eax
call dword [edx + 0xc]
test eax, eax
je 0x4108c4
mov eax, dword [esp + 0x18]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [edi]
pop ebp
cmp eax, esi
pop ebx
pop edi
pop esi
setne al
add esp, 0x128
ret 4
Function at 0x415840
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0xa8
push ebx
push ebp
push esi
mov esi, dword [esp + 0xb8]
lea eax, [esp + 0xc]
push edi
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
lea ecx, [esp + 0x38]
push 0x80
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
push 0xf
mov edi, eax
call ebx
mov esi, dword [esp + 0xc0]
push eax
push esi
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0x12
call ebx
push eax
push esi
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [0x43fee4]
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push edx
push esi
call ebp
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
inc eax
dec ecx
inc edx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], edx
push 0
lea ecx, [esp + 0x3c]
push edi
lea edx, [esp + 0x30]
push ecx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x28]
push edx
push 2
push 1
dec eax
push 4
push esi
mov dword [esp + 0x54], eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x10]
mov eax, dword [0x43feec]
mov edx, dword [esp + 0x14]
sub edi, ebx
mov ebx, dword [esp + 0x1c]
push eax
push esi
sub ebx, edx
call ebp
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov ebp, dword [sym.imp.GDI32.dll_PatBlt]
push 0xf00021
push ebx
push 1
push ecx
push edx
push esi
mov dword [esp + 0x3c], eax
call ebp
mov eax, dword [esp + 0x14]
push 0xf00021
push 1
push edi
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push esi
call ebp
mov edx, dword [0x43fee8]
push edx
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
dec ebx
push 0xf00021
push ebx
inc eax
push 1
dec ecx
push eax
push ecx
push esi
call ebp
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
push 0xf00021
dec edi
push 1
dec edx
push edi
inc eax
push edx
push eax
push esi
call ebp
mov eax, dword [esp + 0x20]
test eax, eax
je 0x415986
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x415996
push eax
push esi
call dword [sym.imp.GDI32.dll_SelectObject]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa8
ret
Function at 0x417160
Capabilities:
Delete file

Disassembly:
mov eax, dword [ecx]
sub esp, 0x600
test eax, eax
push ebx
push esi
push edi
je 0x41719f
mov ecx, 0x43ff28
call fcn.00410710
mov edi, 0x440038
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x610]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x4171c4
lea edi, [ecx + 0x108]
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x610]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, dword [esp + 0x614]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test eax, eax
je 0x417241
lea eax, [esp + 0xc]
push ebx
push eax
call esi
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
test eax, eax
je 0x4171fa
inc eax
push 0x438858
push eax
call esi
lea edx, [esp + 0x20c]
push 0x200
push edx
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x20c]
push eax
push ecx
push str.image_jpeg
call fcn.004190c0
add esp, 0xc
test eax, eax
jne 0x417241
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [esp + 0xc]
push edx
push ebx
call esi
mov eax, dword [esp + 0x618]
test eax, eax
je 0x417287
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push ebx
call edi
push eax
lea eax, [esp + 0x210]
push eax
call esi
lea ecx, [esp + 0xc]
push ebx
push ecx
call esi
lea edx, [esp + 0xc]
push edx
call edi
mov byte [eax], 0
lea eax, [esp + 0x20c]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.00418b90
add esp, 8
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x600
ret 0xc

Function at 0x417b70
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x38
xor eax, eax
push ebx
mov dword [esp + 4], eax
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 8], eax
push ebp
mov ebp, dword [esp + 0x54]
push esi
mov esi, dword [esp + 0x48]
mov dword [esp + 0x14], eax
push edi
lea edx, [esp + 0x5c]
mov word [esp + 0x1c], ax
mov dword [esp + 0x5c], eax
push eax
push edx
lea eax, [esp + 0x18]
push 0xe
lea ecx, [ebp + 0x36]
push eax
push esi
mov word [esp + 0x24], 0x4d42
mov dword [esp + 0x26], ecx
mov dword [esp + 0x2e], 0x36
call ebx
mov edx, dword [esp + 0x54]
mov ecx, 0xa
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x50]
mov ax, word [esp + 0x58]
mov dword [esp + 0x24], ecx
xor edi, edi
lea ecx, [esp + 0x5c]
mov dword [esp + 0x28], edx
push edi
push ecx
lea edx, [esp + 0x28]
push 0x28
push edx
push esi
mov dword [esp + 0x34], 0x28
mov word [esp + 0x40], 1
mov word [esp + 0x42], ax
mov dword [esp + 0x70], edi
call ebx
mov ecx, dword [esp + 0x60]
lea eax, [esp + 0x5c]
push edi
push eax
push ebp
push ecx
push esi
mov dword [esp + 0x70], edi
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
Function at 0x4195d0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x28
push esi
push edi
mov edi, dword [esp + 0x38]
xor esi, esi
push str.AMCapIcon
push edi
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 0x419370
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 4
mov dword [esp + 0x24], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [esp + 0x24], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0x439fb4
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x41973f
push ebx
push ebp
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ebx, eax
push 8
push ebx
call ebp
push 0xa
push ebx
mov esi, eax
call ebp
pop ebp
cmp esi, 0x320
pop ebx
jg 0x41967c
mov ecx, 0x140
mov edx, 0xf0
mov dword [0x440428], ecx
jmp 0x41968c
mov ecx, 0x1e0
mov edx, 0x168
mov dword [0x440428], ecx
sub esi, ecx
sub eax, edx
sub esi, 3
sub eax, 0x28
add ecx, esi
push 0
mov dword [0x440558], ecx
mov dword [0x440548], ecx
mov ecx, dword [0x439fb0]
mov dword [0x440538], edx
push 0
add edx, eax
push ecx
push 0x440550
mov dword [0x440550], esi
mov dword [0x440554], eax
mov dword [0x44055c], edx
mov dword [0x440540], esi
mov dword [0x440544], eax
mov dword [0x44054c], edx
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov edx, dword [0x44055c]
mov eax, dword [0x440554]
mov ecx, dword [0x440550]
push 0
push edi
push 0
sub edx, eax
push 0
push edx
mov edx, dword [0x440558]
sub edx, ecx
push edx
push eax
mov eax, dword [0x439fb0]
push ecx
push eax
push 0x43fd84
push 0x439fb4
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
test eax, eax
mov dword [0x4405b8], eax
je 0x41973f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, 1
pop esi
add esp, 0x28
ret
pop edi
xor eax, eax
pop esi
add esp, 0x28
ret
Function at 0x4198a0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebp, ebp
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, ebp
mov dword [esp + 0x10], ebp
je 0x4198bb
call fcn.00419870
mov eax, dword [esp + 0x18]
push ebp
push 0x80
push 3
push ebp
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41992f
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
call fcn.0041d1ae
add esp, 4
lea ecx, [esp + 0x18]
mov ebp, eax
push 0
push ecx
push edi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jle 0x41991b
push edi
push ebp
mov ecx, esi
call fcn.00419990
test eax, eax
je 0x41991b
mov dword [esp + 0x10], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call fcn.0041d1bc
mov ebp, dword [esp + 0x14]
add esp, 4
mov eax, dword [esi + 4]
xor ecx, ecx
cmp eax, ecx
mov dword [esi + 0x10], edi
je 0x41997e
mov edx, dword [eax]
lea edi, [esi + 0xc]
push edi
push eax
call dword [edx + 0x1c]
mov eax, dword [esi + 4]
add esi, 0x14
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_MulDiv]
push 0x9ec
push 0x60
push edx
call ebx
mov dword [edi], eax
mov eax, dword [esi]
push 0x9ec
push 0x60
push eax
call ebx
mov dword [esi], eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
pop ecx
ret 4
mov dword [esi + 0xc], ecx
mov dword [esi + 0x14], ecx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4

Function at 0x419f00
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x118
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
xor esi, esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov dword [esp + 0x18], esi
push esi
lea eax, [esp + 0x28]
push str.SYSTEMCurrentControlSetControlClass6BDD1FC6_810F_11D0_BEC7_08002BE2092F_04d
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 0x24]
push ecx
push 0xf003f
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x419fac
lea eax, [esp + 0x20]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
push edx
push 0
push str.UVCFlags
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x419f7a
cmp dword [esp + 0x10], 0x10
je 0x419fa1
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push 4
push ecx
push 4
push 0
push str.UVCFlags
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x28], 0x10
call ebp
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
cmp esi, 0x270f
jl 0x419f22
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
test eax, eax
pop ebx
je 0x419fca
call fcn.00419d70
add esp, 0x118
ret
Function at 0x40168a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x409ab8]
push ebx
push esi
push edi
test eax, eax
jne 0x4016b4
push 0x10
push str.TTS_Engine_Error_
push str.TTS_system_not_found_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40174e
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.bstCreate
push eax
call esi
push str.TtsWav
mov dword [0x409ad4], eax
push dword [0x409ab8]
call esi
push str.bstRelBuf
mov dword [0x409ad8], eax
push dword [0x409ab8]
call esi
push str.bstShutup
mov dword [0x409ad0], eax
push dword [0x409ab8]
call esi
push str.bstDestroy
mov dword [0x409acc], eax
push dword [0x409ab8]
call esi
push str.bstClose
mov dword [0x409ac8], eax
push dword [0x409ab8]
call esi
push str.bstSetParams
mov dword [0x409ac4], eax
push dword [0x409ab8]
call esi
push str.bstGetParams
mov dword [0x409ac0], eax
push dword [0x409ab8]
call esi
mov dword [0x409abc], eax
call fcn.004014cf
test eax, eax
jne 0x401756
push 1
pop eax
jmp 0x4018a6
push 0
call fcn.00401127
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
pop ecx
mov edi, 0x409a94
push 0x14
push edi
push 0x67
push dword [ebp + 8]
call esi
mov ebx, 0x409a80
push 0x14
push ebx
push 0x6d
push dword [ebp + 8]
call esi
mov esi, dword [ebp + 8]
push esi
call fcn.004018ad
mov dword [0x409aa8], esi
pop ecx
xor esi, esi
mov eax, 0x80000000
push esi
push dword [ebp + 8]
push esi
push esi
push esi
push eax
push esi
push eax
push 0xcf0000
push edi
push ebx
push esi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebx, eax
cmp ebx, esi
jne 0x4017be
xor eax, eax
jmp 0x4018a6
push dword [ebp + 0x14]
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_RegisterHotKey]
mov edi, 0x4000
push 0x1b
push edi
push 0x69
push ebx
call esi
push 0x70
push edi
push 0x8024
push ebx
call esi
push 0x71
push edi
push 0x68
push ebx
call esi
push 0x72
push edi
push 0x8004
push ebx
call esi
push 0x73
push edi
push 0x8003
push ebx
call esi
push 0x74
push edi
push 0x801d
push ebx
call esi
push 0x75
push edi
push 0x801a
push ebx
call esi
push 0x76
push edi
push 0x8009
push ebx
call esi
push 0x77
push edi
push 0x8006
push ebx
call esi
push 0x78
push edi
push 0x8005
push ebx
call esi
push 0x79
push edi
push 0x8021
push ebx
call esi
push 0x7a
push edi
push 0x8020
push ebx
call esi
add edi, 2
push 0x7a
push edi
push 0x1f5
push ebx
call esi
push 0x7b
push edi
push 0x1f4
push ebx
call esi
xor edi, edi
push edi
push edi
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
lea eax, [ebp - 0x1c]
push edi
push eax
call esi
test eax, eax
je 0x4018a3
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push edi
push edi
lea eax, [ebp - 0x1c]
push edi
push eax
jmp 0x401880
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x1003316b
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
add ebp, 0x10
mov dword [esp + 0x10], 5
mov esi, dword [ebp - 8]
mov ecx, esi
mov edx, dword [ebp - 4]
not ecx
and ecx, dword [ebp]
mov eax, edx
mov ebx, dword [ebp - 0x10]
not eax
and eax, dword [ebp + 4]
xor ecx, ebx
mov edi, dword [ebp - 0xc]
xor eax, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp]
mov dword [ebp - 0xc], eax
not ecx
and ecx, dword [ebp + 8]
mov eax, dword [ebp + 4]
xor ecx, esi
not eax
mov dword [ebp - 8], ecx
and eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor eax, edx
mov dword [ebp - 4], eax
not ecx
mov eax, dword [ebp + 0xc]
and ecx, dword [ebp + 0x10]
not eax
and eax, dword [ebp + 0x14]
xor dword [ebp], ecx
lea ebp, [ebp + 0x28]
xor dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
not ecx
and ecx, ebx
not eax
xor dword [ebp - 0x20], ecx
and eax, edi
xor dword [ebp - 0x1c], eax
not ebx
not edi
and ebx, esi
xor dword [ebp - 0x18], ebx
and edi, edx
xor dword [ebp - 0x14], edi
dec dword [esp + 0x10]
jne 0x1003317f
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10033397
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x50
push ebx
push ebp
push esi
xor esi, esi
add edx, 0x78
push edi
mov ecx, dword [edx - 0x78]
xor ecx, dword [edx - 0x50]
mov eax, dword [edx - 0x74]
xor eax, dword [edx - 0x4c]
xor ecx, dword [edx - 0x28]
xor eax, dword [edx - 0x24]
xor ecx, dword [edx + 0x28]
xor eax, dword [edx + 0x2c]
xor ecx, dword [edx]
lea edx, [edx + 8]
xor eax, dword [edx - 4]
mov dword [esp + esi*8 + 0x10], ecx
mov dword [esp + esi*8 + 0x14], eax
inc esi
cmp esi, 5
jb 0x100333a7
mov eax, dword [esp + 0x18]
xor edx, edx
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x34]
shld ecx, eax, 1
mov edi, dword [esp + 0x14]
xor edx, ecx
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
add eax, eax
shr esi, 0x1f
xor edx, ebp
xor esi, eax
mov dword [esp + 0x3c], edx
xor esi, dword [esp + 0x30]
xor edx, edx
mov eax, dword [esp + 0x20]
shld ecx, eax, 1
mov dword [esp + 0x38], esi
mov esi, dword [esp + 0x24]
xor edx, ecx
mov ecx, dword [esp + 0x2c]
add eax, eax
xor edx, edi
shr esi, 0x1f
xor esi, eax
mov dword [esp + 0x44], edx
mov eax, dword [esp + 0x28]
xor edx, edx
shld ecx, eax, 1
xor esi, ebx
xor edx, ecx
mov dword [esp + 0x40], esi
xor edx, dword [esp + 0x1c]
add eax, eax
mov esi, dword [esp + 0x2c]
mov ecx, ebp
mov dword [esp + 0x4c], edx
mov edx, dword [esp + 0x30]
shld ebp, edx, 1
shr ecx, 0x1f
add edx, edx
shr esi, 0x1f
xor ecx, edx
xor esi, eax
xor ecx, dword [esp + 0x20]
xor eax, eax
xor esi, dword [esp + 0x18]
xor eax, ebp
xor eax, dword [esp + 0x24]
mov edx, dword [esp + 0x64]
mov dword [esp + 0x50], ecx
add edx, 0x50
mov ecx, edi
mov dword [esp + 0x54], eax
shld edi, ebx, 1
shr ecx, 0x1f
xor eax, eax
add ebx, ebx
mov dword [esp + 0x48], esi
xor ecx, ebx
xor eax, edi
xor ecx, dword [esp + 0x28]
xor eax, dword [esp + 0x2c]
xor ebx, ebx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], eax
mov eax, dword [esp + ebx*8 + 0x38]
mov ecx, dword [esp + ebx*8 + 0x3c]
xor dword [edx - 0x50], eax
xor dword [edx - 0x4c], ecx
xor dword [edx - 0x28], eax
xor dword [edx - 0x24], ecx
xor dword [edx], eax
lea edx, [edx + 8]
xor dword [edx - 4], ecx
xor dword [edx + 0x20], eax
xor dword [edx + 0x24], ecx
xor dword [edx + 0x48], eax
xor dword [edx + 0x4c], ecx
inc ebx
cmp ebx, 5
jb 0x100334ab
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x10033cc1
Capabilities:
Hash data using sha384

Disassembly:
mov eax, dword [esp + 4]
push 0x40
push 0x1003b2e8
and dword [eax + 0x80], 0
and dword [eax + 0x84], 0
mov dword [eax + 0xc8], 0x30
add eax, 0x88
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
ret

Function at 0x10033dc7
Capabilities:
Hash data using sha512

Disassembly:
mov eax, dword [esp + 4]
push 0x40
pop ecx
push ecx
and dword [eax + 0x80], 0
and dword [eax + 0x84], 0
mov dword [eax + 0xc8], ecx
add eax, 0x88
push 0x1003b2a8
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
ret
Function at 0x10037483
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
push 0x20
pop ecx
push ecx
and dword [eax + 0x40], 0
and dword [eax + 0x44], 0
mov dword [eax + 0x68], ecx
add eax, 0x48
push 0x1003b428
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
ret
Function at 0x10038cc3
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
mov eax, ebx
push ebp
or eax, edx
push esi
mov esi, dword [esp + 0x18]
or eax, esi
push edi
mov edi, dword [esp + 0x20]
or eax, edi
test al, 3
jne 0x10038d2a
lea ecx, [esi + edi]
mov eax, ecx
lea edi, [ebx + edx]
sub eax, esi
xor ebx, ebx
add eax, 3
shr eax, 2
cmp ecx, esi
sbb ebp, ebp
not ebp
and ebp, eax
jbe 0x10038d42
sub edi, esi
mov ecx, dword [esi]
mov edx, ecx
shr edx, 8
mov eax, ecx
shl eax, 8
xor edx, eax
shl ecx, 8
and edx, 0xff00ff
xor edx, ecx
rol edx, 0x10
inc ebx
mov dword [edi + esi], edx
lea esi, [esi + 4]
cmp ebx, ebp
jb 0x10038d01
jmp 0x10038d42
add edi, edx
cmp edx, edi
jae 0x10038d42
sub esi, edx
mov al, byte [esi + edx]
mov ecx, edx
xor ecx, 3
inc edx
mov byte [ecx + ebx], al
cmp edx, edi
jb 0x10038d32
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10038d47
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
mov eax, ebx
push ebp
or eax, edx
push esi
mov esi, dword [esp + 0x18]
or eax, esi
push edi
mov edi, dword [esp + 0x20]
or eax, edi
test al, 7
jne 0x10038da2
lea ecx, [esi + edi]
mov eax, ecx
lea edi, [ebx + edx]
sub eax, esi
xor ebx, ebx
add eax, 7
shr eax, 3
cmp ecx, esi
sbb ebp, ebp
not ebp
and ebp, eax
jbe 0x10038dba
sub edi, esi
push dword [esi + 4]
push dword [esi]
call fcn.10038c83
inc ebx
mov dword [edi + esi], eax
mov dword [edi + esi + 4], edx
lea esi, [esi + 8]
pop ecx
pop ecx
cmp ebx, ebp
jb 0x10038d85
jmp 0x10038dba
add edi, edx
cmp edx, edi
jae 0x10038dba
sub esi, edx
mov al, byte [esi + edx]
mov ecx, edx
xor ecx, 7
inc edx
mov byte [ecx + ebx], al
cmp edx, edi
jb 0x10038daa
pop edi
pop esi
pop ebp
pop ebx
ret