joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10027bd0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
or eax, 0xffffffff
push ebx
push esi
push edi
mov bl, byte [ecx]
lea esi, [ecx + 1]
or ecx, 0xffffffff
test bl, bl
je 0x10027c15
cmp bl, 0x23
jne 0x10027bf7
cmp byte [esi], bl
jne 0x10027bf7
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x100ef730]
test bl, bl
jne 0x10027be8
mov ebx, dword [0x101132e0]
not eax
mov esi, dword [ebx + 0x19ac]
mov edi, dword [ebx + 0x19b4]
mov ecx, edi
test esi, esi
je 0x10027c54
nop
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x10027c48
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x10027c4a
mov esi, edx
test esi, esi
jne 0x10027c30
mov ecx, dword [ebx + 0x19b4]
mov edx, dword [ebx + 0x19ac]
lea ecx, [ecx + edx*8]
cmp edi, ecx
je 0x10027c6d
cmp dword [edi], eax
jne 0x10027c6d
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x10028f80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0xbc]
mov eax, dword [ecx + 0xc4]
push esi
push edi
lea esi, [ebp + 8]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100ef730]
sub edi, 1
jne 0x10028fa0
mov ecx, dword [0x101132e0]
not eax
pop edi
pop esi
cmp dword [ecx + 0x19f0], eax
jne 0x10028fd2
mov dword [ecx + 0x19f4], eax
cmp dword [ecx + 0x1a1c], eax
jne 0x10028fe1
mov byte [ecx + 0x1a20], 1
pop ebp
ret 4

Function at 0x10028ff0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x101114bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
movss xmm0, dword [edx]
mov edi, 0x10
subss xmm0, dword [esi + 0xc]
mov ecx, dword [esi + 0xbc]
cvttss2si eax, xmm0
movss xmm0, dword [edx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0x14], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
mov dword [ebp - 8], eax
mov eax, dword [esi + 0xc4]
lea esi, [ebp - 0x14]
mov edx, dword [eax + ecx*4 - 4]
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100ef730]
sub edi, 1
jne 0x10029064
mov eax, dword [0x101132e0]
not edx
pop edi
pop esi
cmp dword [eax + 0x19f0], edx
jne 0x10029095
mov dword [eax + 0x19f4], edx
cmp dword [eax + 0x1a1c], edx
jne 0x100290a4
mov byte [eax + 0x1a20], 1
mov ecx, dword [ebp - 4]
mov eax, edx
xor ecx, ebp
call fcn.10085c29
mov esp, ebp
pop ebp
ret 4
Function at 0x1002a0c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x1002a0d2
mov dword [edi], 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1002a1c0
mov esi, eax
add esp, 8
test esi, esi
jne 0x1002a0ea
pop edi
pop esi
pop ebp
ret
push ebx
push 2
push 0
push esi
call fcn.100bd104
add esp, 0xc
test eax, eax
jne 0x1002a1b0
push esi
call fcn.100bd946
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x1002a1b0
push 0
push 0
push esi
call fcn.100bd104
add esp, 0xc
test eax, eax
jne 0x1002a1b0
mov eax, dword [ebp + 0x14]
add eax, ebx
push eax
call fcn.1002d300
add esp, 4
mov dword [ebp + 0x10], eax
test eax, eax
je 0x1002a1b0
push esi
push ebx
push 1
push eax
call fcn.100bbd0e
add esp, 0x10
cmp eax, ebx
je 0x1002a181
push esi
call fcn.100bba1a
mov eax, dword [0x101132e0]
add esp, 4
test eax, eax
je 0x1002a167
dec dword [eax + 0x378]
push dword [0x101132e8]
mov eax, dword [ebp + 0x10]
push eax
call dword [0x101112bc]
add esp, 8
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x1002a199
push eax
mov eax, dword [ebp + 0x10]
add eax, ebx
push 0
push eax
call fcn.10088c20
add esp, 0xc
push esi
call fcn.100bba1a
add esp, 4
test edi, edi
je 0x1002a1a8
mov dword [edi], ebx
mov eax, dword [ebp + 0x10]
pop ebx
pop edi
pop esi
pop ebp
ret
push esi
call fcn.100bba1a
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x1002a410
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
not ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
test edi, edi
je 0x1002a45e
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x1002a441
cmp edi, 2
jb 0x1002a441
cmp byte [esi], cl
jne 0x1002a441
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100ef730]
test edi, edi
jne 0x1002a427
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1002a48d
cmp cl, 0x23
jne 0x1002a474
cmp byte [esi], cl
jne 0x1002a474
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100ef730]
test cl, cl
jne 0x1002a465
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x100318a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x101114bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101132e0]
mov edx, 0x100ef70c
push edi
mov edi, dword [ebp + 8]
mov ecx, str._Inactive
mov eax, dword [eax + 0x1970]
sub eax, 2
cmp dword [edi + 0x20], eax
lea eax, [ebp - 0x104]
cmovge ecx, edx
push ecx
push dword [edi]
push str.TabBar___d_tabs__s
push 0x100
push eax
call fcn.1002a2e0
lea eax, [ebp - 0x104]
push eax
push 0x100ef5f0
push edi
call fcn.100682d0
add esp, 0x20
test al, al
je 0x10031ac3
cmp dword [edi], 0
mov dword [ebp - 0x114], 0
jle 0x10031abe
xor eax, eax
push ebx
mov dword [ebp - 0x118], eax
push esi
nop dword [eax + eax]
mov ecx, dword [edi + 8]
lea edx, [ebp - 0x11c]
add ecx, eax
mov esi, 4
mov eax, dword [0x101132e0]
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x11c], ecx
mov eax, dword [eax + 0x19bc]
mov dword [ebp - 0x108], eax
add eax, 0xbc
mov dword [ebp - 0x10c], eax
mov ecx, dword [eax]
mov eax, dword [eax + 8]
mov dword [ebp - 0x120], ecx
mov ebx, dword [eax + ecx*4 - 4]
not ebx
nop dword [eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100ef730]
sub esi, 1
jne 0x10031980
mov eax, dword [ebp - 0x108]
not ebx
mov edx, dword [ebp - 0x120]
mov ecx, dword [eax + 0xc0]
cmp edx, ecx
jne 0x100319e6
lea esi, [edx + 1]
test ecx, ecx
je 0x100319c4
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x100319c9
mov eax, 8
cmp eax, esi
cmovg esi, eax
push esi
mov esi, dword [ebp - 0x10c]
mov ecx, esi
call fcn.1003ad00
mov edx, dword [esi]
mov eax, dword [ebp - 0x108]
jmp 0x100319ec
mov esi, dword [ebp - 0x10c]
mov eax, dword [eax + 0xc4]
push 0x100f062c
mov dword [eax + edx*4], ebx
inc dword [esi]
call fcn.10065c10
mov esi, dword [ebp - 0x110]
add esp, 4
test al, al
je 0x10031a1a
push 0xffffffffffffffff
push esi
push edi
call fcn.100668c0
add esp, 0xc
sub esp, 8
mov dword [esp + 4], 0x40000000
mov dword [esp], 0
call fcn.10035d40
push 0x100f0630
call fcn.10065c10
add esp, 0xc
test al, al
je 0x10031a4e
push 1
push esi
push edi
call fcn.100668c0
add esp, 0xc
sub esp, 8
mov dword [esp + 4], 0xbf800000
mov dword [esp], 0
call fcn.10035d40
mov eax, dword [esi]
mov ecx, 0x20
cmp eax, dword [edi + 0x10]
mov ebx, dword [ebp - 0x114]
push eax
mov eax, 0x2a
cmove ecx, eax
push ecx
push ebx
push str._02d_c_Tab_0x_08X
call fcn.10067a70
mov eax, dword [0x101132e0]
inc ebx
add esp, 0x18
mov dword [ebp - 0x114], ebx
mov eax, dword [eax + 0x19bc]
dec dword [eax + 0xbc]
mov eax, dword [ebp - 0x118]
add eax, 0x20
mov dword [ebp - 0x118], eax
cmp ebx, dword [edi]
jl 0x10031930
pop esi
pop ebx
call fcn.10068e20
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10085c29
mov esp, ebp
pop ebp
ret
Function at 0x10032de0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x101132e0]
lea edx, [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [eax + 0x19bc]
mov esi, 4
mov ebx, dword [eax + 0xc4]
lea edi, [eax + 0xbc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100ef730]
sub esi, 1
jne 0x10032e20
mov eax, dword [ebp - 4]
not ebx
mov ecx, dword [ebp - 8]
mov esi, dword [eax + 0xc0]
cmp ecx, esi
jne 0x10032e73
inc ecx
test esi, esi
je 0x10032e5c
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x10032e61
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.1003ad00
mov ecx, dword [edi]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc4]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10032fc0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x101132e0]
lea edx, [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [eax + 0x19bc]
mov esi, 4
mov ebx, dword [eax + 0xc4]
lea edi, [eax + 0xbc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x100ef730]
sub esi, 1
jne 0x10033000
mov eax, dword [ebp - 4]
not ebx
mov ecx, dword [ebp - 8]
mov esi, dword [eax + 0xc0]
cmp ecx, esi
jne 0x10033053
inc ecx
test esi, esi
je 0x1003303c
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, esi
jmp 0x10033041
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.1003ad00
mov ecx, dword [edi]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc4]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003b490
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ea3e3
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101114bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x28], 0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x42], 0xffff003f
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov word [ecx + 0x40], ax
mov byte [ecx + 0x58], al
mov dword [ecx + 0x48], 0x3f800000
mov dword [ecx + 0x50], eax
mov dword [ecx + 0x4c], eax
mov dword [ecx + 0x54], eax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x1003b580
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ea426
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x101114bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x3c], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x48], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x50], 0
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0x54], 0
mov byte [ebp - 4], 2
mov byte [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x10], 1
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x58], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1003eca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ea673
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101114bc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x4c], ebx
jle 0x1003ecfe
xor edi, edi
mov eax, dword [esi + 0x54]
mov ecx, dword [edi + eax]
test ecx, ecx
je 0x1003ecf5
cmp byte [edi + eax + 8], 0
je 0x1003ecf5
push ecx
call fcn.1002d330
mov eax, dword [esi + 0x54]
add esp, 4
mov dword [edi + eax], 0
inc ebx
add edi, 0x78
cmp ebx, dword [esi + 0x4c]
jl 0x1003ecd1
xor edx, edx
cmp dword [esi + 0x34], edx
jle 0x1003ed3e
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + edx*4]
mov eax, dword [esi + 0x54]
mov ebx, dword [edi + 0x3c]
cmp ebx, eax
jb 0x1003ed38
mov ecx, dword [esi + 0x4c]
shl ecx, 4
sub ecx, dword [esi + 0x4c]
lea eax, [eax + ecx*8]
cmp ebx, eax
jae 0x1003ed38
mov dword [edi + 0x3c], 0
xor ecx, ecx
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + edx*4]
mov word [eax + 0x40], cx
inc edx
cmp edx, dword [esi + 0x34]
jl 0x1003ed05
mov eax, dword [esi + 0x54]
test eax, eax
je 0x1003ed63
push eax
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0
call fcn.1002d330
add esp, 4
mov dword [esi + 0x54], 0
mov eax, dword [esi + 0x48]
test eax, eax
je 0x1003ed90
push eax
mov dword [esi + 0x44], 0
mov dword [esi + 0x40], 0
call fcn.1002d330
add esp, 4
mov dword [esi + 0x48], 0
nop dword [eax + eax]
mov dword [esi + 0x58], 0xffffffff
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1003eda7
push eax
call fcn.1002d330
add esp, 4
mov eax, dword [esi + 0x18]
test eax, eax
je 0x1003edb7
push eax
call fcn.1002d330
add esp, 4
xor ebx, ebx
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
cmp dword [esi + 0x34], ebx
jle 0x1003ee39
nop dword [eax]
mov eax, dword [esi + 0x3c]
mov edi, dword [eax + ebx*4]
mov dword [ebp - 0x10], edi
test edi, edi
je 0x1003ee33
mov dword [ebp - 4], 2
mov ecx, edi
call fcn.1003f200
mov byte [ebp - 4], 1
mov eax, dword [edi + 0x28]
test eax, eax
je 0x1003edff
push eax
call fcn.1002d330
add esp, 4
mov byte [ebp - 4], 0
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x1003ee13
push eax
call fcn.1002d330
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [edi + 8]
test eax, eax
je 0x1003ee2a
push eax
call fcn.1002d330
add esp, 4
push edi
call fcn.1002d330
add esp, 4
inc ebx
cmp ebx, dword [esi + 0x34]
jl 0x1003edd0
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x1003ee5e
push eax
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
call fcn.1002d330
add esp, 4
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006aea0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax], 0
mov dword [eax + 4], 0
pop ebp
ret
Function at 0x1007b790
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x101114bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], ecx
test edi, edi
jne 0x1007b7cb
cmp esi, 0x20
jb 0x1007b87e
push 1
push str.expand_32_byte_k
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10079c20
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0x24]
push ecx
add eax, 0x10
push eax
push 0
push 0x20
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.1007c040
lea eax, [ebp - 0x44]
mov ecx, esi
push eax
add ecx, 0xffffffe0
mov eax, edi
adc eax, 0xffffffff
push eax
mov eax, dword [ebp - 0x48]
push ecx
add eax, 0x20
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.1007ae50
add esp, 0x40
lea eax, [ebp - 0x14]
push 0x10
push eax
mov eax, dword [ebp - 0x48]
add eax, 0x10
push eax
call fcn.1007d3c0
add esp, 0xc
test eax, eax
jne 0x1007b87e
push 1
push str.expand_32_byte_k
push dword [ebp - 0x50]
lea eax, [ebp - 0x44]
push dword [ebp - 0x4c]
push eax
call fcn.10079c20
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x54]
push edi
push esi
push dword [ebp - 0x48]
push ebx
call fcn.1007c040
add esp, 0x2c
xorps xmm0, xmm0
movups xmmword [ebx], xmm0
xor eax, eax
movups xmmword [ebx + 0x10], xmm0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10085c29
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10085c29
mov esp, ebp
pop ebp
ret
Function at 0x1007c390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
neg eax
mov dword [ebp - 0xc], 4
cdq
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push esi
sub eax, ebx
mov dword [ebp - 0x14], edx
push edi
mov dword [ebp + 0xc], eax
nop dword [eax + eax]
xorps xmm0, xmm0
lea edx, [eax + ebx]
movlpd qword [ebp - 0x1c], xmm0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], edx
nop word [eax + eax]
mov ecx, dword [edx + eax*8]
mov edx, dword [edx + eax*8 + 4]
mov esi, dword [ebx + eax*8 + 4]
xor edx, esi
and edx, dword [ebp - 0x14]
mov edi, dword [ebx + eax*8]
xor esi, edx
xor ecx, edi
mov dword [ebx + eax*8 + 4], esi
and ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 4]
xor edi, ecx
mov dword [ebx + eax*8], edi
xor dword [esi + eax*8 + 4], edx
mov edx, esi
xor dword [esi + eax*8], ecx
add eax, 1
adc dword [ebp - 8], 0
js 0x1007c3e0
jg 0x1007c41f
cmp eax, 0x10
jb 0x1007c3e0
mov eax, dword [ebp + 0xc]
sub ebx, 0xffffff80
sub dword [ebp - 0xc], 1
jne 0x1007c3c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1007cf70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
push ebx
neg eax
movlpd qword [ebp - 0xc], xmm0
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
cdq
push esi
push edi
mov dword [ebp + 0x10], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov esi, dword [eax + ecx*8 + 4]
mov edi, dword [eax + ecx*8]
mov eax, dword [edx + ecx*8]
mov edx, dword [edx + ecx*8 + 4]
xor eax, edi
and eax, dword [ebp + 0x10]
xor edx, esi
and edx, dword [ebp - 4]
xor edi, eax
mov dword [ebp - 8], eax
xor esi, edx
mov eax, dword [ebp + 8]
mov dword [eax + ecx*8], edi
mov edi, eax
mov eax, dword [ebp - 8]
mov dword [edi + ecx*8 + 4], esi
mov esi, dword [ebp + 0xc]
xor dword [esi + ecx*8], eax
xor dword [esi + ecx*8 + 4], edx
add ecx, 1
adc ebx, 0
js 0x1007cf93
jg 0x1007cfe0
cmp ecx, 0x10
jb 0x1007cf93
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007d3c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
push edi
xor edi, edi
test esi, esi
je 0x1007d495
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
cmp esi, 8
jb 0x1007d479
mov edi, esi
lea eax, [edx + 4]
mov esi, ebx
and edi, 0xfffffff8
sub esi, edx
xorps xmm4, xmm4
mov dword [ebp - 4], esi
xorps xmm3, xmm3
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
movd xmm2, dword [ecx + ebx]
lea eax, [eax + 8]
movd xmm1, dword [eax - 0xc]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
add ecx, 8
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [eax - 8]
punpcklbw xmm1, xmm0
por xmm4, xmm2
movd xmm2, dword [edx + eax - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp ecx, edi
jb 0x1007d400
mov edx, dword [ebp + 0xc]
por xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd edi, xmm3
cmp ecx, esi
jae 0x1007d494
sub ebx, edx
lea eax, [ecx + edx]
sub esi, ecx
movzx edx, byte [eax + ebx]
lea eax, [eax + 1]
movzx ecx, byte [eax - 1]
xor edx, ecx
or edi, edx
sub esi, 1
jne 0x1007d480
pop ebx
lea eax, [edi - 1]
shr eax, 8
and eax, 1
pop edi
dec eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1007da30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1007dbe0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1007dafd
mov edx, dword [ebp - 4]
cmp edx, dword [0x101114b0]
jb 0x1007da7a
mov eax, dword [ebp - 4]
cmp eax, dword [0x101114b4]
ja 0x1007da7a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1007da4a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10088c20
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1007daa0
jmp 0x1007dafd
cmp dword [ebp - 0x14], 0x10000
jne 0x1007dae3
cmp dword [ebp - 0x18], 0x10000
jb 0x1007dae3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1007dad6
mov eax, dword [ebp - 8]
jmp 0x1007daff
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1007daf8
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1007dbe0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1007da4a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1007db10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1007dc10
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1007dbd5
mov edx, dword [ebp - 4]
cmp edx, dword [0x101114b0]
jb 0x1007db55
mov eax, dword [ebp - 4]
cmp eax, dword [0x101114b4]
ja 0x1007db55
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1007db25
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10088c20
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1007db7b
jmp 0x1007dbd5
cmp dword [ebp - 0x14], 0x10000
jne 0x1007dbbe
cmp dword [ebp - 0x18], 0x10000
jb 0x1007dbbe
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1007dbb1
mov eax, dword [ebp - 8]
jmp 0x1007dbd7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1007dbd0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1007dc10
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1007db25
xor eax, eax
mov esp, ebp
pop ebp
ret