joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13ddc01
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x41f214]
mov esi, ecx
mov ebx, 0x212
lea edi, [esp + 0x12]
mov dword [esp + 0x224], eax
push ebx
push 0
push edi
call fcn.013e259c
add esp, 0xc
lea eax, [esp + 0xc]
mov dword [esp + 4], ebx
push eax
push 0x414f37
push 0x80000001
call dword [0x4832a4]
test eax, eax
je 0x13ddc85
mov al, byte [0x41dfd0]
test al, al
je 0x13ddc5f
mov ecx, dword [0x41dfd8]
jmp 0x13ddcef
push 0x414f73
call fcn.013d7a20
add esp, 4
test eax, eax
mov dword [0x41dfd4], eax
je 0x13ddce0
push 0x414f7f
push eax
call dword [0x4833a8]
mov ecx, eax
jmp 0x13ddce2
lea eax, [esp + 4]
lea ecx, [esp + 8]
push eax
push edi
push ecx
push 0
push 0x414f66
push dword [esp + 0x20]
call dword [0x4832a8]
test eax, eax
jne 0x13ddcac
cmp dword [esp + 8], 1
je 0x13ddcb1
mov byte [esp + 0x12], 0
push dword [esp + 0xc]
call dword [0x48329c]
cmp byte [esp + 0x12], 0
je 0x13ddc4b
mov eax, esp
lea ecx, [esp + 0x12]
mov edx, esi
push eax
call fcn.013dde98
add esp, 4
test eax, eax
jne 0x13dde30
jmp 0x13ddc4b
xor ecx, ecx
mov dword [0x41dfd8], ecx
mov byte [0x41dfd0], 1
test ecx, ecx
je 0x13ddd8d
xor ebx, ebx
push edi
push ebx
push ebx
push 0x1c
push ebx
call ecx
test eax, eax
js 0x13ddd41
push edi
call fcn.013ef39c
add esp, 4
mov byte [esp + eax + 0x1c], 0
mov word [esp + eax + 0x1a], 0x444e
mov dword [esp + eax + 0x16], 0x522e5954
mov dword [esp + eax + 0x12], 0x5455505c
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.013dde98
add esp, 4
test eax, eax
jne 0x13dde30
push edi
push ebx
push ebx
push 0x1a
push ebx
call dword [0x41dfd8]
test eax, eax
js 0x13ddd8d
push edi
call fcn.013ef39c
add esp, 4
mov byte [esp + eax + 0x1c], 0
mov word [esp + eax + 0x1a], 0x444e
mov dword [esp + eax + 0x16], 0x522e5954
mov dword [esp + eax + 0x12], 0x5455505c
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.013dde98
add esp, 4
test eax, eax
jne 0x13dde30
mov ebp, dword [0x483380]
mov ebx, 0x212
push ebx
push edi
push 0x414f90
call ebp
sub ebx, eax
lea eax, [esp + eax + 0x12]
push ebx
push eax
push 0x414f9a
call ebp
test eax, eax
je 0x13dddec
push edi
call fcn.013ef39c
add esp, 4
mov byte [esp + eax + 0x1c], 0
mov word [esp + eax + 0x1a], 0x444e
mov dword [esp + eax + 0x16], 0x522e5954
mov dword [esp + eax + 0x12], 0x5455505c
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.013dde98
add esp, 4
test eax, eax
jne 0x13dde30
push 0x212
push edi
call dword [0x4833e0]
push edi
call fcn.013ef39c
add esp, 4
mov byte [esp + eax + 0x1c], 0
mov word [esp + eax + 0x1a], 0x444e
mov dword [esp + eax + 0x16], 0x522e5954
mov dword [esp + eax + 0x12], 0x5455505c
mov eax, esp
mov ecx, edi
mov edx, esi
push eax
call fcn.013dde98
add esp, 4
test eax, eax
je 0x13dde4c
mov esi, dword [esp]
mov ecx, dword [esp + 0x224]
call fcn.013df522
mov eax, esi
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
dec esi
jmp 0x13dde33

Function at 0x13f66c6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.013f6545
Function at 0x1427d4d
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
mov esi, ecx
mov edi, edx
mov eax, dword [esi + 4]
test eax, eax
jne 0x1427d67
push esi
call fcn.01427895
add esp, 4
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, 2
je 0x1427d85
cmp eax, 1
jne 0x1427dde
add esi, 8
push ebx
push edi
push esi
call fcn.01428d59
add esp, 0xc
jmp 0x1427dde
mov eax, dword [esi]
test eax, eax
jne 0x1427da1
push 0x2f
push 0x402efe
push 0x402f48
call fcn.01474209
add esp, 0xc
mov eax, dword [esi]
push eax
push ebx
push 1
push edi
call fcn.01475dc9
add esp, 0x10
cmp eax, ebx
jae 0x1427dde
mov eax, dword [esi]
test eax, eax
je 0x1427dc7
push eax
call fcn.01475043
add esp, 4
mov dword [esi], 0
mov dword [esi + 4], 3
push 0x402f5c
push dword [esi + 0x18]
call fcn.0145eb04
add esp, 8
pop esi
pop edi
pop ebx
ret

Function at 0x1428c0a
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edx, dword [0x41f0cc]
mov ebp, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x14], edx
xor edx, edx
dec edx
mov esi, edx
movsx ebx, byte [ecx + esi + 1]
mov eax, ebx
add al, 0xbf
cmp al, 0x19
ja 0x1428c3a
add ebx, 0xffffffbf
jmp 0x1428c77
mov eax, ebx
add al, 0x9f
cmp al, 0x19
ja 0x1428c47
add ebx, 0xffffffb9
jmp 0x1428c77
mov eax, ebx
add al, 0xd0
cmp al, 9
ja 0x1428c54
add ebx, 4
jmp 0x1428c77
cmp bl, 0x2b
je 0x1428c6e
cmp bl, 0x3d
je 0x1428c75
cmp bl, 0x2f
jne 0x1428d09
mov ebx, 0x3f
jmp 0x1428c77
mov ebx, 0x3e
jmp 0x1428c77
mov ebx, edx
mov dword [esp + esi*4 + 8], ebx
inc esi
cmp esi, 3
jl 0x1428c28
mov ebx, dword [esp + 4]
xor esi, esi
cmp ebx, 0xffffffff
je 0x1428d0b
mov edi, dword [esp + 8]
cmp edi, 0xffffffff
je 0x1428d0b
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x1428cf3
xor eax, eax
cmp edx, 0xffffffff
mov ecx, ebp
mov ebp, 3
sete al
and edx, 0x3f
sub ebp, eax
shl ebx, 0x12
shl edi, 0xc
or ebx, edi
shr ebx, 0x10
cmp ebp, 2
mov byte [ecx], bl
jb 0x1428d04
mov eax, dword [esp]
mov esi, 2
shl eax, 6
mov ebx, eax
and eax, 0xf00
or eax, edi
cmp ebp, 3
mov byte [ecx + 1], ah
jne 0x1428d0b
or edx, ebx
mov esi, 3
mov byte [ecx + 2], dl
jmp 0x1428d0b
cmp edx, 0xffffffff
jne 0x1428d0b
mov ecx, ebp
xor ebp, ebp
mov edx, 0x3f
inc ebp
jmp 0x1428cb9
xor esi, esi
inc esi
jmp 0x1428d0b
xor esi, esi
mov ecx, dword [esp + 0x14]
call fcn.01466d40
mov eax, esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x142c2b7
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
cmp dword [esp + 0x18], 0
je 0x142c2ee
test esi, esi
je 0x142c386
push 2
call fcn.0146a693
add esp, 4
push eax
push esi
push 1
push edi
call fcn.01475dc9
add esp, 0x10
jmp 0x142c386
test esi, esi
je 0x142c32f
mov ebx, dword [0x41d060]
test ebx, ebx
je 0x142c32f
mov edi, dword [0x41d064]
cmp ebx, esi
mov ebp, ebx
cmova ebp, esi
push ebp
push dword [esp + 0x20]
push edi
call fcn.01469324
add esp, 0xc
add edi, ebp
sub ebx, ebp
sub esi, ebp
mov dword [0x41d064], edi
mov edi, dword [esp + 0x1c]
mov dword [0x41d060], ebx
add edi, ebp
test esi, esi
je 0x142c386
mov ebx, dword [0x41d06c]
lea eax, [ebx + esi]
cmp dword [0x41d068], eax
jae 0x142c36c
add eax, 0x1000
mov dword [0x41d068], eax
push 1
push eax
push dword [0x41d070]
call fcn.014286af
add esp, 0xc
mov ebx, dword [0x41d06c]
mov dword [0x41d070], eax
jmp 0x142c371
mov eax, dword [0x41d070]
add eax, ebx
push esi
push edi
push eax
call fcn.01469324
add esp, 0xc
add ebx, esi
mov dword [0x41d06c], ebx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x142deae
Capabilities:
Terminate process
Write file on windows

Disassembly:
push esi
push 0x40407b
call fcn.0142913b
add esp, 4
mov esi, eax
push esi
push 0x412268
push 0x404524
call fcn.0142c790
add esp, 0xc
push esi
call fcn.014287a8
add esp, 4
push 0
call fcn.0147287d

Function at 0x142dee1
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x18]
mov edi, 2
push edi
call fcn.0146a693
add esp, 4
xor esi, esi
inc esi
push eax
push esi
push 6
push 0x404531
call fcn.01475dc9
add esp, 0x10
lea ebp, [esp + 0x1c]
mov dword [esp], ebp
push edi
call fcn.0146a693
add esp, 4
push ebp
push ebx
push eax
call 0x142df47
add esp, 0xc
push edi
call fcn.0146a693
add esp, 4
push eax
push esi
push 0x27
push 0x404538
call fcn.01475dc9
add esp, 0x10
push esi
call fcn.0147287d
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
call fcn.014282c5
push ebx
push 0
push edi
push esi
push dword [eax + 4]
push dword [eax]
call fcn.0146d925
add esp, 0x18
pop esi
pop edi
pop ebx
ret

Function at 0x142defd
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x18]
mov edi, 2
push edi
call fcn.0146a693
add esp, 4
xor esi, esi
inc esi
push eax
push esi
push 6
push 0x404531
call fcn.01475dc9
add esp, 0x10
lea ebp, [esp + 0x1c]
mov dword [esp], ebp
push edi
call fcn.0146a693
add esp, 4
push ebp
push ebx
push eax
call 0x142df47
add esp, 0xc
push edi
call fcn.0146a693
add esp, 4
push eax
push esi
push 0x27
push 0x404538
call fcn.01475dc9
add esp, 0x10
push esi
call fcn.0147287d
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
call fcn.014282c5
push ebx
push 0
push edi
push esi
push dword [eax + 4]
push dword [eax]
call fcn.0146d925
add esp, 0x18
pop esi
pop edi
pop ebx
ret
Function at 0x143908b
Capabilities:
Parse credit card information

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
cmp edx, 3
jne 0x14390a0
mov eax, 0x4065a5
cmp esi, 0x3c
je 0x14390eb
cmp edx, 3
jne 0x14390af
mov eax, 0x4065c7
cmp esi, 0x3d
je 0x14390eb
cmp edx, 3
jne 0x14390be
mov eax, 0x4065e6
cmp esi, 0x3f
je 0x14390eb
cmp edx, 3
jne 0x14390cd
mov eax, 0x406611
cmp esi, 0x40
je 0x14390eb
cmp edx, 3
jne 0x14390dc
mov eax, 0x406630
cmp esi, 0x41
je 0x14390eb
cmp edx, 3
jne 0x14390ee
mov eax, 0x406650
cmp esi, 0x42
jne 0x14390ee
pop esi
pop edi
ret
lea edi, [esi - 1]
cmp edi, 5
ja 0x1439109
mov eax, 0x40666d
jmp dword [edi*4 + 0x40ade0]
cmp esi, 0x14
je 0x1439136
cmp esi, 0x15
jne 0x143913d
mov eax, 0x4066f9
jmp 0x14390eb
mov eax, 0x4066e8
jmp 0x14390eb
cmp ecx, 1
jne 0x143914c
mov eax, 0x40670a
cmp esi, 0x1e
je 0x14390eb
cmp ecx, 1
jne 0x143915b
mov eax, 0x40671e
cmp esi, 0x1f
je 0x14390eb
cmp ecx, 2
jne 0x143916a
mov eax, 0x406733
cmp esi, 0x1e
je 0x14390eb
cmp ecx, 2
jne 0x143917d
mov eax, 0x406753
cmp esi, 0x22
je 0x14390eb
cmp ecx, 2
jne 0x1439190
mov eax, 0x40676f
cmp esi, 0x1f
je 0x14390eb
cmp ecx, 2
jne 0x14391a3
mov eax, 0x406789
cmp esi, 0x20
je 0x14390eb
cmp ecx, 2
jne 0x14391b6
mov eax, 0x4067a2
cmp esi, 0x21
je 0x14390eb
cmp ecx, 4
jne 0x14391c9
mov eax, 0x4067bc
cmp esi, 0x1e
je 0x14390eb
cmp ecx, 4
jne 0x14391dc
mov eax, 0x4067d3
cmp esi, 0x1f
je 0x14390eb
cmp ecx, 4
jne 0x14391ef
mov eax, 0x4067ea
cmp esi, 0x20
je 0x14390eb
cmp ecx, 3
jne 0x1439202
mov eax, 0x4067ff
cmp esi, 0x1e
je 0x14390eb
cmp ecx, 3
jne 0x1439215
mov eax, 0x406816
cmp esi, 0x1f
je 0x14390eb
lea eax, [esi - 0x32]
cmp eax, 4
jae 0x1439229
mov eax, dword [esi*4 + 0x406f38]
jmp 0x14390eb
cmp edx, 1
jne 0x143923c
mov eax, 0x406895
cmp esi, 0x3c
je 0x14390eb
cmp edx, 2
jne 0x143924f
mov eax, 0x4068ad
cmp esi, 0x3c
je 0x14390eb
cmp edx, 4
jne 0x1439262
mov eax, 0x4068d0
cmp esi, 0x3c
je 0x14390eb
cmp edx, 4
jne 0x1439275
mov eax, 0x4068ef
cmp esi, 0x3d
je 0x14390eb
lea ecx, [esi - 0x50]
mov eax, 0x402e9b
cmp ecx, 0x15
jae 0x14390eb
mov eax, dword [esi*4 + 0x406ed0]
jmp 0x14390eb
Function at 0x14451cd
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [0x41f0cc]
mov edi, dword [esp + 0x4c]
mov ebx, edx
mov esi, ecx
test bl, 0xf
mov dword [esp + 0x34], eax
je 0x1445201
push 0x41f
push 0x40d22c
push 0x40d29e
call fcn.01474209
add esp, 0xc
lea eax, [edi + 0x3c8]
test ebx, ebx
mov dword [esp], eax
movsd xmm0, qword [edi + 0x3c8]
movsd xmm1, qword [edi + 0x3d0]
movsd qword [esp + 0x2c], xmm1
movsd qword [esp + 0x24], xmm0
jle 0x14452a2
mov ebp, 0x10
xor eax, eax
mov ecx, dword [esi + eax*4]
bswap ecx
mov dword [esp + eax*4 + 4], ecx
mov dword [esp + eax*4 + 0x14], ecx
inc eax
cmp eax, 4
jne 0x1445231
lea eax, [esp + 0x14]
push eax
push edi
call dword [edi + 0x3c4]
add esp, 8
xor eax, eax
mov ecx, dword [esp + eax*4 + 0x14]
xor ecx, dword [esp + eax*4 + 0x24]
shr ecx, 0x18
mov byte [esi + eax*4], cl
mov ecx, dword [esp + eax*4 + 0x14]
xor ecx, dword [esp + eax*4 + 0x24]
shr ecx, 0x10
mov byte [esi + eax*4 + 1], cl
mov ecx, dword [esp + eax*4 + 0x14]
xor ecx, dword [esp + eax*4 + 0x24]
mov byte [esi + eax*4 + 2], ch
mov ecx, dword [esp + eax*4 + 0x14]
xor ecx, dword [esp + eax*4 + 0x24]
mov byte [esi + eax*4 + 3], cl
mov ecx, dword [esp + eax*4 + 4]
mov dword [esp + eax*4 + 0x24], ecx
inc eax
cmp eax, 4
jne 0x1445255
add esi, 0x10
cmp ebx, ebp
lea ebx, [ebx - 0x10]
jg 0x144522f
movsd xmm0, qword [esp + 0x24]
movsd xmm1, qword [esp + 0x2c]
mov eax, dword [esp]
movsd qword [eax + 8], xmm1
movsd qword [eax], xmm0
mov ecx, dword [esp + 0x34]
call fcn.01466d40
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x144a7e3
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x144a80b
mov edx, dword [esp + 0xc]
xor eax, eax
movzx esi, byte [edx]
movzx edi, al
shr eax, 8
inc edx
xor edi, esi
xor eax, dword [edi*4 + 0x40e900]
dec ecx
jne 0x144a7f3
jmp 0x144a80d
xor eax, eax
pop esi
pop edi
ret
Function at 0x144b08a
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x41f0cc]
mov edi, dword [esp + 0x24]
mov ebx, edx
mov esi, ecx
test bl, 7
mov dword [esp + 0xc], eax
je 0x144b0be
push 0x261
push 0x40f934
push 0x40d47a
call fcn.01474209
add esp, 0xc
mov ecx, dword [edi + 0x80]
mov eax, dword [edi + 0x84]
mov edx, edi
test ebx, ebx
je 0x144b139
mov dword [esp], ebx
xor ebp, ebp
mov ebx, edx
mov edx, dword [esi + ebp]
mov edi, dword [esi + ebp + 4]
bswap edx
bswap edi
xor edx, ecx
lea ecx, [esp + 4]
xor edi, eax
push ebx
push edi
call fcn.0144bd07
add esp, 8
mov ecx, dword [esp + 4]
mov eax, dword [esp + 8]
mov edx, ecx
shr edx, 0x18
mov byte [esi + ebp], dl
mov edx, ecx
shr edx, 0x10
mov byte [esi + ebp + 1], dl
mov edx, eax
mov byte [esi + ebp + 2], ch
mov byte [esi + ebp + 3], cl
shr edx, 0x18
mov byte [esi + ebp + 4], dl
mov edx, eax
shr edx, 0x10
mov byte [esi + ebp + 5], dl
mov byte [esi + ebp + 6], ah
mov byte [esi + ebp + 7], al
add ebp, 8
cmp ebp, dword [esp]
jb 0x144b0d7
jmp 0x144b13b
mov ebx, edx
mov dword [ebx + 0x80], ecx
mov dword [ebx + 0x84], eax
mov ecx, dword [esp + 0xc]
call fcn.01466d40
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x144b1ae
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [0x41f0cc]
mov edi, ecx
test dl, 7
mov dword [esp + 0x18], eax
je 0x144b1e0
push 0x279
push 0x40f934
push 0x40d47a
mov esi, edx
call fcn.01474209
mov edx, esi
add esp, 0xc
mov eax, dword [esp + 0x30]
test edx, edx
mov ebx, dword [eax + 0x80]
mov ecx, dword [eax + 0x84]
je 0x144b282
mov dword [esp], edi
xor edi, edi
mov dword [esp + 4], edx
mov esi, dword [esp]
mov dword [esp + 8], ecx
lea ecx, [esp + 0x10]
mov ebp, dword [esi + edi]
mov eax, dword [esi + edi + 4]
bswap ebp
bswap eax
mov dword [esp + 0xc], eax
mov edx, ebp
push dword [esp + 0x30]
push eax
call fcn.0144b366
mov edx, dword [esp + 0xc]
add esp, 8
mov ecx, dword [esp + 8]
xor ebx, dword [esp + 0x10]
mov eax, ebx
xor ecx, dword [esp + 0x14]
shr eax, 0x18
mov byte [esi + edi], al
mov eax, ebx
shr eax, 0x10
mov byte [esi + edi + 1], al
mov eax, ecx
mov byte [esi + edi + 2], bh
mov byte [esi + edi + 3], bl
mov ebx, ebp
shr eax, 0x18
mov byte [esi + edi + 4], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + edi + 5], al
mov byte [esi + edi + 6], ch
mov byte [esi + edi + 7], cl
mov eax, dword [esp + 0x30]
add edi, 8
mov esi, dword [esp + 0xc]
cmp edi, edx
mov ecx, esi
jb 0x144b201
jmp 0x144b286
mov esi, ecx
mov ebp, ebx
mov dword [eax + 0x80], ebp
mov dword [eax + 0x84], esi
mov ecx, dword [esp + 0x18]
call fcn.01466d40
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x145019a
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov ecx, dword [0x41f0cc]
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], ecx
mov eax, dword [eax + 0x10]
call dword [eax]
xor ebx, ebx
mov edi, eax
inc ebx
push 0x1c
push ebx
call fcn.014285db
add esp, 8
mov esi, eax
mov dword [esi], 0
mov dword [esi + 4], edi
cmp dword [edi], ebx
jne 0x145022d
xorps xmm0, xmm0
xor edi, edi
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
call fcn.0145503a
mov byte [esp + edi], al
inc edi
cmp edi, 0x20
jne 0x14501e5
mov edi, esp
mov ebx, 0x20
and byte [edi], 0xf8
mov al, byte [edi + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [edi + 0x1f], al
push ebx
push edi
call fcn.01448a84
add esp, 8
mov dword [esi + 0x18], eax
push ebx
push edi
call fcn.01460482
add esp, 8
mov eax, dword [esi + 0x18]
test eax, eax
je 0x1450282
mov ecx, dword [esi + 4]
add ecx, 0x1c
jmp 0x145024b
push dword [edi + 0x1c]
push dword [0x41f0b4]
call fcn.01448c57
add esp, 8
test eax, eax
mov dword [esi + 0x18], eax
je 0x1450282
mov ecx, dword [esi + 4]
add ecx, 0x20
push eax
push ecx
call fcn.0144dfa7
add esp, 8
test eax, eax
je 0x1450277
mov ecx, dword [eax + 4]
mov dword [esi + 8], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 0
push eax
call fcn.014287a8
add esp, 4
jmp 0x145028d
push dword [esi + 0x18]
call fcn.01446d06
add esp, 4
push esi
call fcn.014287a8
add esp, 4
xor esi, esi
mov ecx, dword [esp + 0x28]
call fcn.01466d40
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1452a2d
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 0x10]
mov eax, dword [0x41f0cc]
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
movaps xmm0, xmmword [0x410660]
test edi, edi
mov dword [esp + 0x48], eax
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
jle 0x1452a8c
mov al, byte [ebx]
xor al, 0x36
cmp edi, 1
mov byte [esp], al
je 0x1452a8c
xor eax, eax
inc eax
mov cl, byte [ebx + eax]
xor byte [esp + eax], cl
lea ecx, [eax + 1]
cmp ecx, edi
jge 0x1452a8c
cmp eax, 0x3f
mov eax, ecx
jl 0x1452a78
movaps xmm0, xmmword [0x410620]
mov esi, esp
xor eax, eax
movups xmmword [edx], xmm0
mov dword [edx + 0x50], eax
mov dword [edx + 0x58], eax
mov dword [edx + 0x54], eax
push 0x40
push esi
push edx
call fcn.0145208a
add esp, 0xc
movaps xmm0, xmmword [0x410670]
test edi, edi
movaps xmmword [esi + 0x30], xmm0
movaps xmmword [esi + 0x20], xmm0
movaps xmmword [esi + 0x10], xmm0
movaps xmmword [esi], xmm0
jle 0x1452aec
mov al, byte [ebx]
xor al, 0x5c
cmp edi, 1
mov byte [esp], al
je 0x1452aec
xor eax, eax
inc eax
mov cl, byte [ebx + eax]
xor byte [esp + eax], cl
lea ecx, [eax + 1]
cmp ecx, edi
jge 0x1452aec
cmp eax, 0x3f
mov eax, ecx
jl 0x1452ad8
mov eax, dword [ebp + 8]
movaps xmm0, xmmword [0x410620]
mov edi, 0x40
xor ecx, ecx
movups xmmword [eax + 0x5c], xmm0
mov dword [eax + 0xac], ecx
mov dword [eax + 0xb4], ecx
mov dword [eax + 0xb0], ecx
lea eax, [eax + 0x5c]
push edi
push esi
push eax
call fcn.0145208a
add esp, 0xc
push edi
push esi
call fcn.01460482
add esp, 8
mov ecx, dword [esp + 0x48]
call fcn.01466d40
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x14547f2
Capabilities:
Read file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x404
mov eax, dword [0x41f0cc]
mov edi, ecx
mov ebx, esp
mov dword [esp + 0x400], eax
push edi
push 0x3ff
push 1
push ebx
call fcn.01475a5b
add esp, 0x10
mov esi, eax
push edi
call fcn.01476879
add esp, 4
test esi, esi
js 0x145483a
xor edi, edi
inc edi
cmp esi, 0x20
jge 0x1454841
mov esi, edi
jmp 0x14549cb
xor esi, esi
jmp 0x14549cb
cmp esi, 0x400
jb 0x1454860
push 0x674
push 0x4109e8
push 0x410d0c
call fcn.01474209
add esp, 0xc
mov byte [esp + esi], 0
push 0x20
push 0x4106f7
push ebx
call fcn.01467ba1
add esp, 0xc
test eax, eax
je 0x14549a3
push 0x1a
push 0x410acf
push ebx
call fcn.01467ba1
add esp, 0xc
test eax, eax
je 0x14549aa
push 0x14
push 0x410aea
push ebx
call fcn.01467ba1
add esp, 0xc
test eax, eax
je 0x14549b1
push 0x1e
push 0x410b20
push ebx
call fcn.01467ba1
add esp, 0xc
test eax, eax
je 0x14549b8
push 0xb
push 0x410b3f
push ebx
call fcn.01467ba1
add esp, 0xc
test eax, eax
je 0x14549bf
push 0x20
push 0x410aff
push ebx
call fcn.01467ba1
add esp, 0xc
test eax, eax
je 0x14549c6
push 0x41072e
push ebx
call fcn.01476ec4
add esp, 8
cmp byte [esp + eax], 0x20
jne 0x1454951
lea esi, [esp + eax]
lea eax, [esi + 1]
push 0x41072e
push eax
call fcn.01476ec4
add esp, 8
cmp byte [esi + eax + 1], 0x20
jne 0x1454951
lea esi, [esi + eax + 1]
lea eax, [esi + 1]
push 0x41072e
push eax
call fcn.01476ec4
add esp, 8
mov al, byte [esi + eax + 1]
mov esi, 8
test al, al
je 0x14549cb
cmp al, 0xa
je 0x14549cb
cmp al, 0x20
je 0x14549cb
push 0x410b7c
push ebx
call fcn.01476ae4
add esp, 8
mov esi, eax
push ebx
push esi
call fcn.014534cb
add esp, 8
test eax, eax
je 0x1454833
lea eax, [esp + esi + 1]
lea ebx, [esp + esi]
push 0x403099
push eax
call fcn.01476ec4
add esp, 8
mov al, byte [eax + ebx + 1]
mov esi, 0xa
test al, al
je 0x14549cb
cmp al, 0xa
je 0x14549cb
cmp al, 0x20
jne 0x1454833
jmp 0x14549cb
mov esi, 2
jmp 0x14549cb
mov esi, 9
jmp 0x14549cb
mov esi, 3
jmp 0x14549cb
mov esi, 6
jmp 0x14549cb
mov esi, 5
jmp 0x14549cb
mov esi, 7
mov ecx, dword [esp + 0x400]
call fcn.01466d40
mov eax, esi
add esp, 0x404
pop esi
pop edi
pop ebx
ret

Function at 0x1455081
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov ebp, 0x258
push 1
push ebp
call fcn.014285db
add esp, 8
mov esi, eax
call fcn.01454d8d
mov eax, 0x41d2bc
add eax, dword [0x41d76c]
push ebp
push eax
push esi
call fcn.01469324
add esp, 0xc
mov dword [ebx], ebp
mov dword [edi], esi
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.01454d8d
Function at 0x1456aa4
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov dword [esp], edx
mov ebp, dword [esp + 0x70]
mov ebx, ecx
mov eax, dword [0x41f0cc]
test ebp, ebp
mov dword [esp + 0x50], eax
jle 0x1456b6d
mov esi, dword [esp + 0x6c]
xor edx, edx
mov eax, dword [ebx + 0x14]
mov dword [esp + 8], ebp
cmp ebp, eax
cmovg ebp, eax
cmp eax, 0x41
jl 0x1456af7
push 0x3ba
push 0x410e40
push 0x410f0e
mov edi, edx
call fcn.01474209
mov edx, edi
add esp, 0xc
mov eax, edx
mov dword [esp + 4], edx
shr eax, 0x18
mov byte [esp + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0xd], al
mov byte [esp + 0xe], dh
mov byte [esp + 0xf], dl
call dword [ebx]
mov edi, ebx
mov ebx, eax
push dword [esp + 0x68]
push dword [esp + 4]
push ebx
call dword [edi + 8]
add esp, 0xc
push 4
lea eax, [esp + 0x10]
push eax
push ebx
call dword [edi + 8]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ebx
mov ebx, edi
call dword [ebx + 0xc]
add esp, 8
test ebp, ebp
jle 0x1456b58
xor eax, eax
mov cl, byte [esp + eax + 0x10]
xor byte [esi + eax], cl
inc eax
cmp eax, ebp
jl 0x1456b4c
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
add esi, ebp
inc edx
sub eax, ebp
mov ebp, eax
jg 0x1456acb
mov ecx, dword [esp + 0x50]
call fcn.01466d40
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret