joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4da3ef
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004da36b
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4da567
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4da567
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4da516
jg 0x4da448
test eax, eax
je 0x4da50c
push 1
push 0x1000
call fcn.004ceba9
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4da46e
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x4da503
push 0x8000
push ebx
call fcn.004c99ee
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4da49a
jg 0x4da495
cmp ecx, 0x1000
jb 0x4da49a
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.004cce14
add esp, 0x10
cmp eax, 0xffffffff
je 0x4da4df
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4da495
jl 0x4da4c6
test ecx, ecx
jne 0x4da487
push dword [ebp - 0xc]
push ebx
call fcn.004c99ee
push esi
call fcn.004cec06
add esp, 0xc
xor edi, edi
jmp 0x4da578
cmp byte [edi + 0x24], 0
je 0x4da4f6
cmp dword [edi + 0x20], 5
jne 0x4da4f6
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4da501
mov edi, dword [edi + 0x18]
jmp 0x4da503
xor edi, edi
push esi
call fcn.004cec06
pop ecx
jmp 0x4da578
test ecx, ecx
jg 0x4da4d8
jl 0x4da516
test eax, eax
jae 0x4da4d8
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004c74b8
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4da539
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4da4d8
jmp 0x4da570
push ebx
call fcn.004d23b3
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4da4d8
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x4da578
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4da575
mov edi, dword [edi + 0x18]
jmp 0x4da578
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004c74b8
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4deaa0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4deacd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4deacd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219

Function at 0x432000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x12045c75
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x683c50ce
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x417243
Capabilities:
Encode data using xor

Disassembly:
push ebp
invalid
int1
mov dword [edx], ecx
imul byte [esp + ebp*8 - 0x4e5c549a]
xchg ebx, eax
outsd dx, dword [esi]
pop ss
add dword [esi + edi + 0x73e9f6f6], esi
invalid
jae 0x4171f8
iretd
rol byte [edx + 0x2c], cl
xchg byte [ecx + 0x24], ah
lodsb al, byte [esi]
mov esp, 0x542e4ce0
ja 0x4171e4
or eax, 0x7021ae6b
rol dword [esi], 0x96
xor ebx, dword [eax + eax*8 + 0x3b894f81]
fldenv gs:[eax - 0x3e9924c2]
pop esi
pop ebp
in al, 0xf0
je 0x417272
push 0xffffffffffffffd4
mov ch, 0xe9
push eax
dec esp
cmpsd dword [esi], dword es:[edi]
rol ebp, 1
lds esi, [ebx + ebx*2 - 0x68782ab7]
lds esi, [ebx + ebx*2 - 0x68782ab7]
xchg esi, eax
jne 0x417210
cmp eax, 0x6d72fbb7
jb 0x4172bf
fidivr word [ebx + esi + 0x2a]
insd dword es:[edi], dx
mov edi, 0xd27004e9
in eax, dx
add eax, 0xab61eaa
cmp dword [eax - 0x6f], eax
pop edi
loope 0x4171eb
cmc
pop ebp
wait
pop ecx
lodsb al, byte [esi]
test byte [esi - 0x5ccd7a97], dh
adc al, byte [ebx - 0x18bc2486]
outsd dx, dword [esi]
mov dword [0xdb7a8312], eax
inc ebx
out 0x6f, eax
je 0x417250
loope 0x417296
salc
sahf
sub ah, dl
push edi
out dx, al
mov esp, 0xc1edb069
xor eax, 0x5680ab6a
mov esi, 0xaa8d65f4
cmp bl, bh
push esp
leave
mov eax, dword [0xf7f7312a]
out dx, al
bound ebp, qword [ecx + 0x7663cfae]
pop ss
add edi, dword [ebp - 0x1a]
pop es
add byte [edx - 0x5e0d23f5], dh
push cs
popfd
pop ds
sbb al, 0x88
mov cl, 0x11
pop ds
cmp al, dl
cmpsb byte [esi], byte es:[edi]
pushal
stosd dword es:[edi], eax
rcl dword fs:[ebp - 0x65], 0x79
jae 0x4172e6
scasb al, byte es:[edi]
iretd
jns 0x417334
and al, 0x64
jl 0x41729f
jl 0x41729f
pop esi
xor eax, 0x4be08c3f
mov dh, 0x32
xchg esp, eax
movsd dword es:[edi], dword [esi]
cwde
imul eax, dword [ebx + edi*2 + 0xd278b44], 0xffffff8a
mov dword [0xaec06df3], eax
ret 0xdd4a
cmp al, 0x8a
lcall 0xeb1a, 0xb4c55ad9
mov ecx, 0xe695c0b
dec esi
jecxz 0x4172fa
fld xword [esi]
mov edx, dword [edx - 0x10291645]
mov edx, dword [edx - 0x10291645]
sbb esp, dword [edx + 0x18]
pop ecx
mov al, byte [0xfbb69f5f]
add ebp, edx
add byte [esi - 0x12f97f57], 0x92
cli
enter 0x7585, 0x17
pop eax
scasb al, byte es:[edi]
inc eax
jns 0x417361
mov dh, 0x1c
mov cl, 0xf4
and ah, al
aaa
imul ecx, ebx, 0xbf72f72a
pushfd
in eax, dx
pop esp
dec edx
popfd
push ebp
rcl dword [ebp + 0x29], 0xeb
aas
sti
xor al, 0x84
out 0x9f, eax
invalid
inc edi
xor esi, dword [esi - 0x34e8e002]
daa
outsb dx, byte [esi]
and byte [ebp - 0xf], ch
inc ebp
mul dword [eax]
xor dword [edx + 0x60], esi
pop ss
out 0x4f, al
push esp
sub dh, byte [0x5ee012f2]
ja 0x417362
adc ebx, ebx
mov ah, 0x79
insd dword es:[edi], dx
retf

Function at 0x439947
Capabilities:
Encode data using xor

Disassembly:
push ebp
inc ebp
and byte [ebp - 0x48], bh
dec ebx
pop ss
pushfd
or al, 0xae
nop
dec ecx
fisttp qword [ecx - 0x60]
insd dword es:[edi], dx
mov ebp, 0x904dca56
invalid

Function at 0x4561e3
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x526c3a65
xor al, 0x3f
insb byte es:[edi], dx
invalid
Function at 0x46e818
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
pop dword [esp + ebp*4]
xchg byte [ebp + eax*8 - 0x2b2c28ae], ah
xor eax, 0xf7071204
mov ebx, 0xb5cad9bb
mov dword [0x33f66f13], eax
inc edi
std
fxch st(2)
mov ch, 0xa3
adc ebp, dword [edi - 0xa]
xor eax, dword [edi - 3]
mov esi, 0x161220bf
inc edx
cli
inc esi
scasd eax, dword es:[edi]
loop 0x46e82a
sub esi, dword [ebp - 0x17]
sub esp, dword [edi + 0x1214a505]
retf 0x8a7c

Function at 0x472a65
Capabilities:
Encode data using xor

Disassembly:
leave
movsd dword es:[edi], dword [esi]
pop esi
fld qword [esi - 0x23060a08]
movsb byte es:[edi], byte [esi]
cmc
sub byte [eax], ch
jbe 0x472a9e
inc ebx
invalid
cmpsb byte [esi], byte es:[edi]
pop esp
and dword [edx], ebp
sub al, 0x90
pop ds
imul edi, dword cs:[0x9a2ed178], 7
cmp al, 0x68
pop dword [ebx + 0x7de5805]
fsub st(7)
insb byte es:[edi], dx
mov cl, 0x3a
sbb ebx, dword [ecx + 7]
inc edi
pop edx
sub dword [ebp - 0x80], esp
invalid

Function at 0x4a0e80
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0x6c
pushal
cli
and ebp, ebp
xor bh, byte [ebx + 0x481353e3]
push ss
cmp ecx, dword [edi - 0x52f73bf0]
mov byte [0xae20ce87], al
outsb dx, byte [esi]
sub dl, bh
inc ebx
pop es
rcr byte [esi + 0x5e65b876], 0xc3
fimul word [ebp - 0x20]
mov bl, 0x43
adc edi, dword [esi + esi]
lodsd eax, dword [esi]
pushal
and edx, dword cs:[ecx]
insw word es:[edi], dx
pushfd
mov esp, 0xc787373d
sub eax, 0x6f50de07
xchg ecx, eax
mov byte [0xb2bf9abe], al
mov cl, 0x81
mov bh, 0x87
jae 0x4a0e2d
leave
mov bh, 0xfa
mov dword [0x329ff4a3], eax
push es
jl 0x4a0e51
jmp 0x3636da9
Function at 0x4b96e1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c13d8
cmp edx, dword [eax]
je 0x4b9703
add eax, 8
inc ecx
cmp eax, 0x4c1468
jl 0x4b96f4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c13d8]
jne 0x4b9831
mov eax, dword [0x4c5d5c]
cmp eax, 1
je 0x4b980b
test eax, eax
jne 0x4b9734
cmp dword [0x4c1300], 1
je 0x4b980b
cmp edx, 0xfc
je 0x4b9831
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b976b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004ba0c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004ba550
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b97ae
lea eax, [ebp - 0x1a4]
push eax
call fcn.004ba550
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bea04
push edi
call fcn.004bc420
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004ba0c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004ba0d0
lea eax, [ebp - 0xa0]
push 0x4be9e4
push eax
call fcn.004ba0d0
push dword [esi + 0x4c13dc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004ba0d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bc394
add esp, 0x2c
pop edi
jmp 0x4b9831
lea eax, [ebp + 8]
lea esi, [esi + 0x4c13dc]
push 0
push eax
push dword [esi]
call fcn.004ba550
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x568e56
Capabilities:
Parse pe header

Disassembly:
insd dword es:[edi], dx
push 0xfffffffffffffff7
fld qword [ecx - 0x2b19d13b]
sal dword [ecx], 1
out dx, al

Function at 0x568e6d
Capabilities:
Parse pe header

Disassembly:
add esi, 0xe7f3da3
add ecx, esi
pop esi
push dword [esp]
pop ecx
push ebp
mov ebp, esp
add ebp, 4

Function at 0x568e83
Capabilities:
Parse pe header

Disassembly:
add ebp, 4
push 0x7278a539
mov dword [esp], ebp
Function at 0x1001f8f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d1c8b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x3c
push esi
mov eax, dword [0x100ea00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x1015fdb0]
test al, 1
jne 0x1001fa3b
or eax, 1
mov dword [0x1015fdb0], eax
mov dword [ebp - 4], 0
mov eax, 0x10
movaps xmm0, xmmword [0x100df800]
pxor xmm0, xmmword [0x100df930]
mov dword [ebp - 0x1c], 0x69766976
mov dword [ebp - 0x18], 0xf690b71
mov word [ebp - 0x14], 0x4978
movups xmmword [ebp - 0x2c], xmm0
xor byte [ebp + eax - 0x2c], 0x49
inc eax
cmp eax, 0x1a
jb 0x1001f974
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x38], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001f9a0
sub ecx, edx
lea eax, [ebp - 0x2c]
push ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.10024c70
mov byte [ebp - 4], 1
mov edx, dword [0x1015fe5c]
test edx, edx
je 0x1001f9c9
mov edx, dword [edx + 0x50]
jmp 0x1001f9cb
xor edx, edx
mov eax, dword [0x1015fe54]
test eax, eax
je 0x1001f9d9
mov eax, dword [eax + 0x18]
jmp 0x1001f9db
xor eax, eax
lea ecx, [ebp - 0x48]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.1001f4b0
mov eax, dword [ebp - 0x30]
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x34]
mov dword [0x1015fdb4], eax
cmp edx, 0x10
jb 0x1001fa32
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1001fa23
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1001fa23
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100cfec4
mov eax, dword [0x1015fdb4]
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x1001fa40
mov eax, dword [0x1015fdb4]
test eax, eax
je 0x1001fa48
mov ecx, esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10024f60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d1ec5
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100ea00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x10], ecx
push 0x430
call fcn.100cfa65
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], 0
lea edi, [ebx + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 0x18], edi
movq qword [ebx], xmm0
mov dword [ebx + 8], 0
mov dword [ebx + 4], 1
mov dword [ebx + 8], 1
mov dword [ebx], 0x100dd5dc
mov eax, dword [esi]
mov dword [edi + 0xc], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x3b4], 0
mov dword [edi + 0x3b8], 0
mov dword [edi + 0x3bc], 0
mov byte [edi + 0x3c4], 0
mov dword [edi + 0x3c8], 0
mov byte [edi + 0x3cc], 0
mov dword [edi + 0x3d0], 0
mov dword [edi + 0x3d4], 0
mov dword [edi + 0x3d8], 0
mov dword [edi + 0x3dc], 0
mov dword [edi + 0x3e0], 0
mov dword [edi + 0x3e4], 0
mov byte [edi + 0x3f4], 0
mov dword [edi + 0x3f8], 0
mov dword [edi + 0x408], 0
mov dword [edi + 0x40c], 0xf
mov byte [ebp - 4], 1
mov ecx, edi
push eax
mov byte [edi + 0x410], 0
call fcn.1001fa60
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax], edi
mov dword [eax + 4], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002be90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100ea00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1002bf4c
cmp byte [esi + 0x3d], 0
je 0x1002bf4c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1002bf3a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1002bf01
sub eax, 1
je 0x1002bf05
sub eax, 2
jne 0x1002bf3a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100cfa49
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1002bf23
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1002bf3a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100cfa49
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100cfa49
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100cfa49
mov esp, ebp
pop ebp
ret
Function at 0x1002d820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d23fb
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x100ea00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x10164fb8]
mov dword [ebp - 0x34], ecx
test al, 1
jne 0x1002d968
or eax, 1
mov dword [0x10164fb8], eax
mov dword [ebp - 4], 0
mov eax, 0x10
movaps xmm0, xmmword [0x100df800]
pxor xmm0, xmmword [0x100dfc60]
mov dword [ebp - 0x1c], 0x69790a69
mov dword [ebp - 0x18], 0x78690f79
mov dword [ebp - 0x14], 0x7f716978
mov byte [ebp - 0x10], 0x49
movups xmmword [ebp - 0x2c], xmm0
xor byte [ebp + eax - 0x2c], 0x49
inc eax
cmp eax, 0x1d
jb 0x1002d895
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x3c], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x38], 0xf
mov byte [ebp - 0x4c], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002d8c0
sub ecx, edx
lea eax, [ebp - 0x2c]
push ecx
push eax
lea ecx, [ebp - 0x4c]
call fcn.10024c70
mov byte [ebp - 4], 1
mov edx, dword [0x1015fe5c]
test edx, edx
je 0x1002d8e9
mov edx, dword [edx + 0x50]
jmp 0x1002d8eb
xor edx, edx
mov eax, dword [0x1015fe54]
test eax, eax
je 0x1002d8f9
mov eax, dword [eax + 0x18]
jmp 0x1002d8fb
xor eax, eax
lea ecx, [ebp - 0x4c]
push ecx
push eax
lea ecx, [ebp - 0x30]
call fcn.1001f4b0
mov eax, dword [ebp - 0x30]
add esp, 8
test eax, eax
je 0x1002d922
mov ecx, dword [eax + 1]
test ecx, ecx
jne 0x1002d91d
xor eax, eax
jmp 0x1002d922
add eax, 5
add eax, ecx
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x38]
mov dword [0x10164fc0], eax
cmp edx, 0x10
jb 0x1002d961
mov ecx, dword [ebp - 0x4c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002d957
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1002d957
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100cfec4
add esp, 8
mov dword [ebp - 4], 0xffffffff
cmp dword [0x10164fc0], 0
je 0x1002d986
push 0
mov ecx, dword [ebp - 0x34]
movss xmm1, dword [ebp + 0xc]
movss xmm2, dword [ebp + 8]
call dword [0x10164fc0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002e8f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d25e6
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x48
mov eax, dword [0x100ea00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [0x1016500c]
test al, 1
jne 0x1002ea3b
or eax, 1
mov dword [0x1016500c], eax
mov byte [ebp - 4], 1
mov eax, 0x10
movaps xmm0, xmmword [0x100df800]
pxor xmm0, xmmword [0x100df9e0]
mov dword [ebp - 0x44], 0x700f690b
mov dword [ebp - 0x40], 0x690f0f69
mov word [ebp - 0x3c], 0x7c78
mov byte [ebp - 0x3a], 0x49
movups xmmword [ebp - 0x54], xmm0
nop dword [eax]
xor byte [ebp + eax - 0x54], 0x49
inc eax
cmp eax, 0x1b
jb 0x1002e980
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x28], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002e9b0
sub ecx, edx
lea eax, [ebp - 0x54]
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.10024c70
mov byte [ebp - 4], 2
mov edx, dword [0x1015fe68]
test edx, edx
je 0x1002e9d9
mov edx, dword [edx + 0x50]
jmp 0x1002e9db
xor edx, edx
mov eax, dword [0x1015fe60]
test eax, eax
je 0x1002e9e9
mov eax, dword [eax + 0x18]
jmp 0x1002e9eb
xor eax, eax
lea ecx, [ebp - 0x38]
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.1001f4b0
mov eax, dword [ebp - 0x14]
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x24]
mov dword [0x10165008], eax
cmp edx, 0x10
jb 0x1002ea37
mov ecx, dword [ebp - 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002ea2d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002ea87
push edx
push ecx
call fcn.100cfec4
add esp, 8
mov byte [ebp - 4], 0
cmp dword [ebx + 0x1c], 0x10
lea ecx, [ebx + 8]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x756c6162
cmovae ecx, dword [ebx + 8]
mov dword [ebp - 0x1c], 0x6b6f6f68
mov byte [ebp - 0x18], 0
call dword [0x10165008]
mov edx, dword [ebx + 0x1c]
cmp edx, 0x10
jb 0x1002ea97
mov ecx, dword [ebx + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1002ea8d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1002ea8d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.100cfec4
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x18
Function at 0x1002f4b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10156a8c], 0
push ebx
push esi
push edi
je 0x1002f63e
mov ecx, dword [0x1015fe98]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1002f63e
mov ecx, dword [0x1015ff20]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1002f63e
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [ecx + esi], 0
jne 0x1002f510
xor edx, edx
test ecx, ecx
je 0x1002f539
nop dword [eax]
movsx eax, byte [edx + esi]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1002f520
cmp edi, 0x5ff56dc5
je 0x1002f548
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1002f63e
mov ecx, dword [ebp - 4]
jmp 0x1002f4f4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1002f63e
mov edx, dword [edi + 0x88]
test edx, edx
je 0x1002f63e
movss xmm1, dword [0x100deef8]
xor ebx, ebx
cmp edx, 4
jl 0x1002f60b
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002f5ac
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002f5c7
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002f5e2
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002f5f5
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x1002f591
cmp ebx, edx
jl 0x1002f60f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x1002f63e
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1002f633
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x1002f620
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret