joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496c6f
Capabilities:
Encode data using xor

Disassembly:
xchg al, dl
out 0x82, eax
push 0x3fc7d043
mov dh, ah
pop es
out dx, eax
add al, 6
dec eax
test eax, 0x907d2c33
add dword [ebx], ebp
lodsb al, byte [esi]
call 0x1f4ec44a
jb 0x496c0e
jge 0x496bf1
mov dword [0xc6606062], eax
in al, 0x82
les esi, [edi]
insd dword es:[edi], dx
test dl, bh
or eax, 0xd4bb6ee0
pushal
invalid
scasd eax, dword es:[edi]
xchg edi, eax
test byte [ecx + 0xd], al
rol byte [ecx + 0x5c955a80], cl
jne 0x496bc5
fcomi st(2)
loope 0x496c13
sub ah, byte [esp + edi - 3]
fstp xword [ebp - 0x46]
add dword [esi], 0x76ceb662
mov dword [ebx + ebx*8 - 0x2d017457], ecx
mov bh, 0x2a
mov dword [0x666e96af], eax
dec ebp
pop es
sub dword [edi - 0x31], edi
jg 0x496bd3
pop edi
jle 0x496ba0
sub dword [esi - 0x48046d6d], eax
nop
inc esi
in al, 0x44
dec ebp
stosd dword es:[edi], eax
sbb esi, dword [eax]
jno 0x496c94
push esi
and dh, byte [ebx + 0x15f31f08]
invalid
sbb ecx, dword [eax - 0x24544239]
salc
and esi, dword [esp + esi*4 - 0x32]
mov ebp, 0xffd3e4a6
pop eax
rol byte [edi - 0x2de9885a], cl
outsd dx, dword [esi]
sbb dword [ecx - 0x4f47d2], 0x2d479744
imul esi, dword [esi], 0x6c12fec0
or edx, ebx
jns 0x496c2c
sub dword [edi], edx
inc edi
mov edx, 0x226cc012
cmp ch, byte [ecx]
sbb dword [ebx + 0x6a], esp
jb 0x496c02
jb 0x496c33
shl dword [edx - 0x59ef384e], 1
cmpsb byte [esi], byte es:[edi]
pushal
cmp ecx, dword [eax]
jns 0x496c66
xor dl, byte [eax + 0x7f]
cwde
rcr byte [ecx - 0x6559a9f7], 1
jecxz 0x496ce7
aad 8
invalid
push ss
pop esp
or eax, 0x132b9d4c
mov dword [esi + esi*2 - 0xe972e37], ebp
xchg esi, eax
adc dh, byte [eax]
cmp dword [ecx - 0x34d78a7d], edx
pushfd
iretd
fnstcw word [eax - 0x5ca2de59]
jnp 0x496d13
pop ebp
mov dword [0x414287b], eax
adc al, 4
cmp esp, ecx
inc edi
sub dword [edx - 0x32], ebx
inc ebp
xor esi, dword [ecx - 0x1d]
sbb dword [esi], esp
lodsb al, byte [esi]
push edi
xchg esi, eax
shr byte [edx], 1
push es
push cs
mov eax, 0xd9139098
push esi
pop esi
or ecx, dword [ebp + ebx + 0x10]
pop ss
test byte [ecx - 0x29], dh
cwde
mov dl, 0xc9
loope 0x496ce3
iretd
jge 0x496d66
pop eax
jmp 0x496d58
cmp al, 0x58
invalid
xor al, 0xf9
inc edi
mov edx, 0xea585f14
add dword [ecx], esp
aas
pop ebp
aaa
test byte [ebp + 0x18], dl
mov dh, byte [eax]
aas
sbb eax, 0x72d04109
or al, 0x39
mov ch, 0x90
mov ebx, 0xff584c3a
pop eax
and dword [eax], 0xffffff83
cmp esp, esp
jp 0x496d7b
push ebp
sbb byte [edx + 0x91d3f30], cl
inc ecx
sal byte [edx + 0xc], 1
cmp dword [ebp + 0x4c3abb90], esi
pop eax
call [eax - 0x7d]
and byte [ebx + 0x7a67e439], al
stc
pop esi
mov edi, 0x70af14db
sub byte [0xb8888f34], ah
xchg esi, eax
jne 0x496d55
mov ecx, 0x87bbe78
push eax
add ah, bh
push eax
add cl, byte [eax]
div dword [eax + 0x5b]
rcl byte [esi + edi*2 - 0x76], cl
adc byte [edx - 0xebebd60], ch
push ecx
cmpsb byte [esi], byte es:[edi]
mov byte [eax + 0x13], dh
clc
add eax, 0xee9b6d49
cld
xor eax, 0x876a5454
and al, 0x81
and byte [ecx - 7], cl
push esp
cwde
xor edi, 0x44
mov edx, 0xb2fc054c
dec eax
inc ecx
inc eax
stosb byte es:[edi], al
aad 0x5a
invalid
Function at 0x499a94
Capabilities:
Encode data using xor

Disassembly:
adc bl, bh
stc
adc dword [edi], edi
invalid
xchg esp, eax
push esp
mov byte [0xd056fdf0], al
invalid
std
push esi
rol byte [eax], 1
imul esp, dword [esp + edi + 0x49fcde5a], 0x9f10ad17
sub esp, dword [ecx - 0x59c7fb4d]
dec byte [ecx + 8]
sub ebx, ebp
out 0x1f, al
std
push esi
rol byte [eax], 1
imul esp, dword [esp + edi + 0x49fcde5a], 0x9f10ad17
sub esp, dword [ecx - 0x59c7fb4d]
dec byte [ecx + 8]
sub ebx, ebp
out 0x1f, al
je 0x499a39
sub dword [esi - 0x1a], edx
arpl si, bp
mov cl, 0xf6
push esi
out dx, al
sub al, 0xa5
insb byte es:[edi], dx
jecxz 0x499ac0
call [ecx]
lds edi, [ecx]
sbb ebp, eax
cmp dword [eax - 0x1f], eax
std
inc eax
loope 0x499ac4
cdq
jns 0x499a91
push edi
jo fcn.00499a6a
add dword [0x13e20020], 0xffffffee
and byte [eax - 0x38], dl
movsb byte es:[edi], byte [esi]
jno 0x499b23
xchg esp, eax
in al, 0x71
jmp 0xcad9b3e2
bound esi, qword [0x1f675ce4]
sub eax, 0x69794a90
sal edx, cl
aas
or dh, byte [edx + 0x40f93127]
jb 0xb7ea2c99
mov dl, byte [eax + 0x78a670b9]
push 0x24
das
sti
cli
nop
fadd st(1)
dec esp

Function at 0x6291a1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6323a8
cmp edx, dword [eax]
je 0x6291c3
add eax, 8
inc ecx
cmp eax, 0x632438
jl 0x6291b4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6323a8]
jne 0x6292f1
mov eax, dword [0x636d7c]
cmp eax, 1
je 0x6292cb
test eax, eax
jne 0x6291f4
cmp dword [0x6322d4], 1
je 0x6292cb
cmp edx, 0xfc
je 0x6292f1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62922b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629b80
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062a010
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x62926e
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062a010
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ec64
push edi
call fcn.0062bee0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629b80
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629b90
lea eax, [ebp - 0xa0]
push 0x62ec44
push eax
call fcn.00629b90
push dword [esi + 0x6323ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629b90
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062be54
add esp, 0x2c
pop edi
jmp 0x6292f1
lea eax, [ebp + 8]
lea esi, [esi + 0x6323ac]
push 0
push eax
push dword [esi]
call fcn.0062a010
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x5846a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5f000]
lea eax, [edi + 0x918c0]
push dword [eax]
mov dword [eax], 0x45cade7c
push eax
push edi
jmp 0x5846ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5846d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5846c0
mov eax, 1
add ebx, ebx
jne 0x5846e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5846f4
jne 0x584713
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x584713
dec eax
add ebx, ebx
jne 0x584700
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5846d8
add ebx, ebx
jne 0x58470f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x584765
xor ecx, ecx
sub eax, 3
jb 0x58472b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x58479a
sar eax, 1
mov ebp, eax
jmp 0x584736
add ebx, ebx
jne 0x584736
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x584704
inc ecx
add ebx, ebx
jne 0x584744
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x584704
add ebx, ebx
jne 0x584751
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x584746
jne 0x584762
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x584746
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x584784
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x584776
jmp 0x5846c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x584784
add edi, ecx
jmp 0x5846c6
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x1bff
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5847a6
cmp byte [edi], 0x13
jne 0x5847a6
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5847ab
lea edi, [esi + 0x180000]
mov eax, dword [edi]
or eax, eax
je 0x58481a
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18cc90]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18cd64]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5847d8
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x18cd6c]
or eax, eax
je 0x584814
mov dword [ebx], eax
add ebx, 4
jmp 0x5847f5
call dword [esi + 0x18cd68]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x58484b
cmp al, 0xef
ja 0x58483e
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x584820
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x58482d
mov ebp, dword [esi + 0x18cd70]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x247]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x58487f
sub esp, 0xffffff80
jmp 0x45218e
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x1000fee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10010062
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x10010062
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov edi, dword [edi]
push eax
push edi
push esi
mov esi, dword [esi]
mov edi, dword [edi]
test eax, 0x1f
je 0x1000ff18
mov dl, byte [esi + eax - 1]
mov byte [esi + eax], dl
vpxor ymm0, ymm0, ymm0
vpcmpeqb xmm7, xmm7, xmm7
vpsrldq xmm7, xmm7, 0xf
vpand ymm7, ymm7, ymmword [esi]
add eax, 0x1f
and eax, 0xffffffe0
cmp eax, 0x20
ja 0x1000ff50
vpcmpeqb xmm6, xmm6, xmm6
vpslldq xmm6, xmm6, 0xf
vperm2i128 ymm6, ymm6, ymm6, 1
vpand ymm6, ymm6, ymmword [esi]
jmp 0x1000ff60
vmovdqu ymm6, ymmword [esi + 0x20]
vperm2i128 ymm6, ymm0, ymm6, 0x20
vpslldq ymm6, ymm6, 0xf
vmovdqu ymm1, ymmword [esi]
vperm2i128 ymm2, ymm0, ymm1, 0x20
vpalignr ymm2, ymm1, ymm2, 0xf
vperm2i128 ymm4, ymm0, ymm1, 3
vpalignr ymm3, ymm4, ymm1, 1
vpor ymm2, ymm2, ymm7
vpor ymm3, ymm3, ymm6
vpsrldq ymm7, ymm4, 0xf
vpunpckhbw ymm4, ymm1, ymm0
vpunpcklbw ymm5, ymm1, ymm0
vperm2i128 ymm1, ymm5, ymm4, 0x20
vperm2i128 ymm4, ymm5, ymm4, 0x31
vpunpckhbw ymm5, ymm2, ymm0
vpunpcklbw ymm6, ymm2, ymm0
vperm2i128 ymm2, ymm6, ymm5, 0x20
vperm2i128 ymm5, ymm6, ymm5, 0x31
vpunpckhbw ymm6, ymm3, ymm0
vpunpcklbw ymm0, ymm3, ymm0
vperm2i128 ymm3, ymm0, ymm6, 0x20
vperm2i128 ymm6, ymm0, ymm6, 0x31
vpxor ymm0, ymm0, ymm0
vpmullw ymm1, ymm1, ymmword [0x104440a0]
vpmullw ymm4, ymm4, ymmword [0x104440a0]
vpaddw ymm2, ymm2, ymmword [0x10444060]
vpaddw ymm5, ymm5, ymmword [0x10444060]
vpaddw ymm3, ymm3, ymmword [0x10444080]
vpaddw ymm6, ymm6, ymmword [0x10444080]
vpaddw ymm2, ymm2, ymm1
vpaddw ymm5, ymm5, ymm4
vpsrlw ymm2, ymm2, 2
vpsrlw ymm5, ymm5, 2
vpaddw ymm3, ymm3, ymm1
vpaddw ymm6, ymm6, ymm4
vpsrlw ymm3, ymm3, 2
vpsrlw ymm6, ymm6, 2
vpsllw ymm3, ymm3, 8
vpsllw ymm6, ymm6, 8
vpor ymm2, ymm2, ymm3
vpor ymm5, ymm5, ymm6
vmovdqu ymmword [edi], ymm2
vmovdqu ymmword [edi + 0x20], ymm5
sub eax, 0x20
add esi, 0x20
add edi, 0x40
cmp eax, 0x20
ja 0x1000ff50
test eax, eax
jne 0x1000ff34
pop esi
pop edi
pop eax
add esi, 4
add edi, 4
dec ecx
jg 0x1000ff03
vzeroupper
pop edi
pop esi
pop ebp
ret
Function at 0x1001bda0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebp + 0x10], edx
jbe 0x1001bdc3
movzx eax, byte [esi + edx]
xor eax, ecx
imul ecx, eax, 0x1000193
inc edx
cmp edx, dword [ebp + 0x10]
jb 0x1001bdb1
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x1002240b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10022435
mov eax, dword [ebp + 8]
push eax
mov dword [0x1050c648], eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
push eax
push eax
push eax
push 0x100237d3
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
pop ebp
ret 0xc

Function at 0x1002243c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x104fb780]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], edx
push esi
push edi
mov dword [ebp - 8], ebx
mov edi, ebx
mov dword [ebp - 8], ebx
xor eax, eax
push 0x2405
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
call fcn.100296e8
mov esi, eax
mov dword [esp], 0x2405
push edi
mov dword [ebx], esi
push esi
lea eax, [esi + 0x2405]
mov dword [ebx + 8], eax
call fcn.10122460
lea eax, [esi + 0x2405]
add esp, 0xc
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x14], 7
jbe 0x100224a7
mov eax, dword [eax]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
push edi
mov esi, eax
push 0x155a90
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 8]
push eax
push 0x2405
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1011f88a
leave
ret
Function at 0x1002495b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
test esi, esi
jg 0x10024985
jl 0x1002497c
test ebx, ebx
jne 0x10024985
xor eax, eax
xor edx, edx
jmp 0x10024a3d
cmp dword [ecx + 0x38], 0
je 0x10024998
push esi
push ebx
push edx
call fcn.10025556
jmp 0x10024a3d
mov eax, dword [ecx + 0x1c]
push edi
mov edi, ebx
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100249d8
mov eax, dword [ecx + 0x2c]
cmp dword [eax], 0
jbe 0x100249d8
cmp dword [eax], ebx
mov esi, ebx
cmovb esi, dword [eax]
push esi
push dword [ebp - 0xc]
push edx
call fcn.101219d0
mov ecx, dword [ebp - 8]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp + 0x10]
cmp dword [ecx + 0x4c], 0
je 0x10024a33
call fcn.1002710c
mov ecx, dword [ebp - 4]
mov edx, edi
cmp edi, 0xfff
jbe 0x10024a1b
mov eax, dword [ebp - 8]
push dword [eax + 0x4c]
push 0xfff
push 1
push ecx
call fcn.10131509
mov ecx, dword [ebp - 4]
sub edi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, edi
cmp eax, 0xfff
jne 0x10024a33
jmp 0x100249e8
test edx, edx
je 0x10024a33
mov eax, dword [ebp - 8]
push dword [eax + 0x4c]
push edi
push 1
push ecx
call fcn.10131509
add esp, 0x10
sub edi, eax
sub ebx, edi
mov eax, ebx
sbb esi, 0
mov edx, esi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x1002e7b1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, 0x84222325
mov edx, dword [eax]
cmp byte [edx], 0
je 0x1002e7d6
inc edx
mov cl, byte [edx]
movsx eax, cl
xor eax, esi
imul esi, eax, 0x1b3
test cl, cl
jne 0x1002e7c4
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1002fbde
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x1002fbec
pop esi
mov eax, edx
pop ebp
ret 4
Function at 0x10034b8b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x104fb780]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea ebx, [eax - 1]
mov dword [ebp - 0xc], edx
mov edi, ecx
mov dword [ebp - 8], ebx
mov ecx, dword [ebp + 0xc]
sar ebx, 1
mov dword [ebp - 0x14], ecx
mov ecx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], edx
cmp edx, ebx
jge 0x10034bef
lea esi, [ecx + ecx]
push dword [edi + esi*4 + 4]
lea ecx, [ebp + 0x10]
push dword [edi + esi*4 + 8]
call fcn.1002b15a
mov edx, dword [ebp - 0xc]
movzx ecx, al
xor ecx, 1
inc ecx
add ecx, esi
mov dword [ebp - 0xc], ecx
mov eax, dword [edi + ecx*4]
mov dword [edi + edx*4], eax
cmp ecx, ebx
jl 0x10034bc0
mov eax, dword [ebp - 0x18]
mov esi, ecx
cmp ecx, ebx
jne 0x10034c03
test al, 1
jne 0x10034c03
mov eax, dword [edi + eax*4 - 4]
mov esi, dword [ebp - 8]
mov dword [edi + ecx*4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x10], esi
jge 0x10034c34
mov eax, dword [ebp - 0x14]
lea ebx, [esi - 1]
sar ebx, 1
lea ecx, [ebp - 8]
push dword [eax]
push dword [edi + ebx*4]
call fcn.1002b15a
test al, al
je 0x10034c34
mov eax, dword [edi + ebx*4]
mov dword [edi + esi*4], eax
mov esi, ebx
cmp dword [ebp - 0x10], ebx
jl 0x10034c0e
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, dword [eax]
mov dword [edi + esi*4], eax
pop edi
pop esi
pop ebx
call fcn.1011f88a
leave
ret

Function at 0x1003efdb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
push esi
push edi
mov edi, edx
mov dword [ebp - 4], ebx
lea eax, [ecx - 1]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], eax
sar eax, 1
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], eax
cmp edi, eax
jge 0x1003f03c
lea esi, [edx + edx]
lea eax, [esi + 2]
imul ecx, eax, 0x18
add ecx, ebx
lea eax, [ecx - 0x18]
push eax
push ecx
call fcn.10039816
movzx edx, al
mov eax, dword [ebp - 0x10]
xor edx, 1
inc edx
imul edi, edi, 0x18
add edx, esi
imul esi, edx, 0x18
push 6
pop ecx
add edi, ebx
add esi, ebx
rep movsd dword es:[edi], dword [esi]
mov edi, edx
cmp edx, eax
jl 0x1003f003
mov ecx, dword [ebp - 0x14]
mov esi, edx
cmp edx, eax
jne 0x1003f05c
test cl, 1
jne 0x1003f05c
imul esi, ecx, 0x18
imul edi, edx, 0x18
push 6
pop ecx
add esi, 0xffffffe8
add esi, ebx
add edi, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
cmp dword [ebp - 0xc], esi
jge 0x1003f094
push dword [ebp + 0xc]
lea ebx, [esi - 1]
sar ebx, 1
imul eax, ebx, 0x18
add eax, dword [ebp - 4]
push eax
mov dword [ebp - 8], eax
call fcn.10039816
test al, al
je 0x1003f091
imul edi, esi, 0x18
mov esi, dword [ebp - 8]
push 6
pop ecx
add edi, dword [ebp - 4]
rep movsd dword es:[edi], dword [esi]
mov esi, ebx
cmp dword [ebp - 0xc], ebx
jl 0x1003f061
mov ebx, dword [ebp - 4]
imul edi, esi, 0x18
mov esi, dword [ebp + 0xc]
push 6
pop ecx
add edi, ebx
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
leave
ret