joyce8/EMBER2024-capa huggingface dataset:
Function at 0x522618
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x52275b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, dword [eax + 0x30c]
mov dl, 1
mov eax, dword [0x516360]
call fcn.00517564
mov esi, eax
mov edx, 0x46
mov eax, esi
call fcn.00445a70
mov dl, 2
mov eax, esi
call fcn.0046a560
mov dl, 1
mov eax, esi
call fcn.0046a530
mov edx, 0x522774
mov eax, dword [esi + 0x1e0]
call fcn.00559d30
lea eax, [ebp - 4]
push eax
mov edi, ebx
and edi, 0x7f
mov eax, dword [edi*4 + 0x58cc10]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
push 2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.004dcca0
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, dword [ebp - 4]
call fcn.004dd330
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.004462c0
mov eax, dword [ebp - 4]
call fcn.004ddaa0
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
xor ecx, ecx
xor edx, edx
call fcn.004dcdc0
mov ecx, eax
mov edx, 1
mov eax, esi
call fcn.0051a830
lea eax, [ebp - 8]
call fcn.0040ef88
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x314]
mov eax, esi
call fcn.00518dac
mov dword [esi + 0xc], edi
mov dl, 1
mov eax, esi
call fcn.004457a4
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [esi + 0x124], eax
mov dword [esi + 0x120], 0x522828
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [eax + 0x30c]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, esi
call fcn.0052253c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x522762
lea eax, [ebp - 0x10]
call fcn.00406880
lea eax, [ebp - 0xc]
call fcn.00404c38
ret

Function at 0x522780
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30c]
mov edx, 0xff00000c
call fcn.00446430
cmp dword [0x58d2cc], 0
jne 0x5227ca
push 0x4000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x522824
call sub.shell32.dll_SHGetFileInfoA
mov dword [0x58d2cc], eax
cmp dword [0x58d2cc], 0
je 0x5227fa
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov edx, dword [0x58d2cc]
call fcn.00453524
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x314]
mov edx, 0x1fffffff
call fcn.004b19d8
push ebp
xor eax, eax
call fcn.00522618
pop ecx
push ebp
mov al, 1
call fcn.00522618
pop ecx
push ebp
mov al, 0xe
call fcn.00522618
pop ecx
push ebp
mov al, 2
call fcn.00522618
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x53c76c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, ecx
mov esi, edx
mov ebx, eax
mov ebp, 0x58fa74
test esi, esi
jne 0x53c786
xor eax, eax
jmp 0x53c888
cmp dword [ebp], 0
jne 0x53c791
call fcn.0053c6fc
xor ebx, 0xffffffff
cmp edi, 8
jb 0x53c861
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
mov eax, ebx
xor al, byte [esi]
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
sub edi, 8
cmp edi, 8
jae 0x53c79d
test edi, edi
jbe 0x53c883
xor eax, eax
mov al, byte [esi]
xor eax, ebx
and eax, 0xff
mov edx, dword [ebp]
mov eax, dword [edx + eax*4]
shr ebx, 8
xor eax, ebx
mov ebx, eax
inc esi
dec edi
test edi, edi
ja 0x53c865
mov eax, ebx
xor eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x57c974
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov edi, edx
mov ebx, eax
cmp dword [ebx + 0x6c], 0
jne 0x57c98b
mov eax, ebx
call fcn.0057c2f0
cmp dword [ebx + 0x68], 0
jne 0x57c998
mov eax, ebx
call fcn.0057c274
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x57cb26
cmp dword [ebx + 0x68], 0
je 0x57cb26
mov edx, esp
mov eax, esi
call fcn.0054630c
lea edx, [esp + 0x14]
mov eax, ebx
call fcn.0057c140
lea eax, [esp + 0x14]
xor edx, edx
call fcn.005463bc
cmp eax, dword [esp]
je 0x57ca0d
lea eax, [esp + 0x14]
xor edx, edx
call fcn.005463d0
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x57c9e9
adc edx, 0
push edx
lea eax, [esp + 0x18]
xor edx, edx
call fcn.005463bc
mov edx, dword [esp + 4]
sub edx, eax
sar edx, 1
jns 0x57ca02
adc edx, 0
push edx
lea eax, [esp + 0x1c]
push eax
call sub.user32.dll_InflateRect
mov eax, dword [ebx + 0x54]
test eax, eax
je 0x57ca20
mov eax, dword [eax + 0x28]
call fcn.0044cb38
mov esi, eax
jmp 0x57ca23
mov esi, dword [ebx + 0x5c]
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x57ca34
or esi, 0xffffffff
jmp 0x57ca3e
push 3
push esi
call sub.user32.dll_GetWindow
mov esi, eax
mov edx, dword [esp + 0x14]
mov eax, dword [ebx + 0x68]
call fcn.00445a00
mov edx, dword [esp + 0x18]
mov eax, dword [ebx + 0x68]
call fcn.00445a24
mov edx, dword [esp]
mov eax, dword [ebx + 0x68]
call fcn.00445a4c
mov edx, dword [esp + 4]
mov eax, dword [ebx + 0x68]
call fcn.00445a70
lea ecx, [esp + 8]
xor edx, edx
xor eax, eax
call fcn.00546358
mov edx, edi
lea eax, [esp + 0x10]
call fcn.00546a1c
push 0x61b
push 0
push 0
push 0
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.0044cb38
push eax
call sub.user32.dll_SetWindowPos
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.0044cb38
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80000
or eax, 0x8000000
or eax, 0x20
push eax
push 0xffffffffffffffec
mov eax, dword [ebx + 0x68]
call fcn.0044cb38
push eax
call sub.user32.dll_SetWindowLongA
push 2
lea eax, [esp + 0x14]
push eax
push 0x1fffffff
lea eax, [esp + 0x14]
push eax
mov eax, dword [ebx + 0x6c]
call fcn.0042c75c
call fcn.0042814c
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
mov eax, dword [ebx + 0x68]
call fcn.0044cb38
push eax
call dword [0x58ef20]
push 4
mov eax, dword [ebx + 0x68]
call fcn.0044cb38
push eax
call sub.user32.dll_ShowWindow
push esi
push 0
call sub.user32.dll_ReleaseDC
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x57ce64
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffa4
mov ebx, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x10
call fcn.00403664
lea eax, [esp + 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
call sub.user32.dll_GetDesktopWindow
test eax, eax
je 0x57d061
push 0
push 0x57d06c
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x57d061
push 0
push 0x57d07c
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x57d061
push 0
push 0x57d08c
push 0
push eax
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x57d061
push 0
push 0x57d09c
push 0
push eax
call sub.user32.dll_FindWindowExA
mov ebp, eax
test ebp, ebp
je 0x57d061
push 0
push 0
push 0x418
push ebp
call sub.user32.dll_SendMessageA
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
jle 0x57d061
xor eax, eax
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push ebp
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp + 8], 0
je 0x57d061
mov eax, dword [esp + 8]
push eax
push 0
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x57d061
push 0x40
push 0x1000
push 0x1000
push 0
push esi
call sub.kernel32.dll_VirtualAllocEx
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x57d061
or edi, 0xffffffff
cmp edi, dword [esp + 4]
jge 0x57d049
inc edi
mov eax, dword [esp + 0xc]
push eax
push edi
push 0x417
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x57d03f
lea eax, [esp + 0x10]
push eax
push 0x18
lea eax, [esp + 0x50]
push eax
mov eax, dword [esp + 0x18]
push eax
push esi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x57d03f
test byte [esp + 0x51], 0xd
jne 0x57d03f
mov al, byte [esp + 0x50]
and al, 8
cmp al, 8
je 0x57d03f
lea eax, [esp + 0x10]
push eax
push 4
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x60]
push eax
push esi
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x57d03f
cmp dword [esp + 0x10], 0
je 0x57d03f
mov eax, dword [0x58dac8]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
cmp eax, dword [esp]
jne 0x57d03f
mov eax, dword [esp + 0xc]
push eax
push edi
push 0x41d
push ebp
call sub.user32.dll_SendMessageA
test eax, eax
je 0x57d01c
lea eax, [esp + 0x10]
push eax
push 0x10
push ebx
mov eax, dword [esp + 0x18]
push eax
push esi
call sub.kernel32.dll_ReadProcessMemory
cmp dword [esp + 0x10], 0
je 0x57d049
lea eax, [esp + 0x14]
push eax
push ebp
call sub.user32.dll_GetWindowRect
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
call fcn.004070f0
jmp 0x57d049
cmp edi, dword [esp + 4]
jl 0x57cf75
push 0x8000
push 0
mov eax, dword [esp + 0x14]
push eax
push esi
call sub.kernel32.dll_VirtualFreeEx
push esi
call sub.kernel32.dll_CloseHandle_1
add esp, 0x5c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x57f518
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
test ebx, ebx
jbe 0x57f5d9
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x78]
add eax, ebx
mov dword [ebp - 0x14], eax
xor esi, esi
xor edi, edi
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x20]
add eax, ebx
mov edx, esi
shl edx, 2
add eax, edx
mov eax, dword [eax]
add eax, ebx
mov dword [ebp - 8], eax
mov eax, esi
add eax, eax
mov edx, dword [ebp - 0x14]
add eax, dword [edx + 0x24]
add eax, ebx
movzx eax, word [eax]
mov dword [ebp - 0xc], eax
test dword [ebp + 0xc], 0xffff0000
je 0x57f5a1
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
call fcn.0057f4d8
test eax, eax
jne 0x57f5c1
mov eax, dword [ebp - 0xc]
and eax, 0xffff
shl eax, 2
mov edx, dword [ebp - 0x14]
add eax, dword [edx + 0x1c]
add eax, ebx
mov edi, dword [eax]
add edi, ebx
jmp 0x57f5c1
mov eax, dword [ebp - 0xc]
inc eax
cmp eax, dword [ebp + 0xc]
jne 0x57f5c1
mov eax, dword [ebp - 0xc]
and eax, 0xffff
shl eax, 2
mov edx, dword [ebp - 0x14]
add eax, dword [edx + 0x1c]
add eax, ebx
mov edi, dword [eax]
add edi, ebx
inc esi
test edi, edi
jne 0x57f5d2
mov eax, dword [ebp - 0x14]
cmp esi, dword [eax + 0x18]
jne 0x57f548
test edi, edi
je 0x57f5d9
mov dword [ebp - 4], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10005db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x24]
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x1c], 0xffffffff
mov edx, dword [esi + 0x78]
mov dword [esi + 0x3c], ebx
mov byte [esi + 0x40], bl
mov ecx, dword [eax]
add edx, 0x400
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x24], edx
mov edx, dword [eax + 4]
push ecx
push edx
lea ecx, [esp + 0x18]
call fcn.10005b50
mov eax, dword [esi + 0x24]
mov ebp, dword [esi + 0x20]
mov edi, 0x100000
add ebp, eax
sub edi, eax
mov al, byte [esi + 0x43]
cmp al, bl
je 0x10005e29
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
sub eax, ecx
mov ecx, dword [esi + 0x4c]
sbb ecx, edx
xor edx, edx
cmp edx, ecx
jb 0x10005e29
ja 0x10005e23
cmp edi, eax
jb 0x10005e29
cmp eax, ebx
mov edi, eax
je 0x10005e6b
push edi
push ebp
lea ecx, [esp + 0x18]
call fcn.10005ba0
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x24]
sub eax, ebp
add ecx, eax
mov dword [esi + 0x50], ecx
mov ebp, dword [esi + 0x54]
adc ebp, ebx
add edx, eax
cmp eax, edi
mov dword [esi + 0x54], ebp
mov dword [esi + 0x24], edx
jb 0x10005e5d
mov ecx, esi
call fcn.10005d70
cmp eax, ebx
jne 0x10005e8e
cmp dword [esp + 0x18], ebx
jg 0x10005df1
cmp dword [esp + 0x20], ebx
je 0x10005e7f
jmp 0x10005df1
mov cl, byte [esi + 0x42]
xor eax, eax
pop edi
cmp cl, bl
pop esi
pop ebp
setne al
pop ebx
add esp, 0x20
ret 4
mov eax, dword [esp + 0x1c]
mov byte [esi + 0x40], 1
not eax
mov dword [esi + 0x3c], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x10005db9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x24]
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esp + 0x1c], 0xffffffff
mov edx, dword [esi + 0x78]
mov dword [esi + 0x3c], ebx
mov byte [esi + 0x40], bl
mov ecx, dword [eax]
add edx, 0x400
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x24], edx
mov edx, dword [eax + 4]
push ecx
push edx
lea ecx, [esp + 0x18]
call fcn.10005b50
mov eax, dword [esi + 0x24]
mov ebp, dword [esi + 0x20]
mov edi, 0x100000
add ebp, eax
sub edi, eax
mov al, byte [esi + 0x43]
cmp al, bl
je 0x10005e29
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x54]
sub eax, ecx
mov ecx, dword [esi + 0x4c]
sbb ecx, edx
xor edx, edx
cmp edx, ecx
jb 0x10005e29
ja 0x10005e23
cmp edi, eax
jb 0x10005e29
cmp eax, ebx
mov edi, eax
je 0x10005e6b
push edi
push ebp
lea ecx, [esp + 0x18]
call fcn.10005ba0
mov ecx, dword [esi + 0x50]
mov edx, dword [esi + 0x24]
sub eax, ebp
add ecx, eax
mov dword [esi + 0x50], ecx
mov ebp, dword [esi + 0x54]
adc ebp, ebx
add edx, eax
cmp eax, edi
mov dword [esi + 0x54], ebp
mov dword [esi + 0x24], edx
jb 0x10005e5d
mov ecx, esi
call fcn.10005d70
cmp eax, ebx
jne 0x10005e8e
cmp dword [esp + 0x18], ebx
jg 0x10005df1
cmp dword [esp + 0x20], ebx
je 0x10005e7f
jmp 0x10005df1
mov cl, byte [esi + 0x42]
xor eax, eax
pop edi
cmp cl, bl
pop esi
pop ebp
setne al
pop ebx
add esp, 0x20
ret 4
mov eax, dword [esp + 0x1c]
mov byte [esi + 0x40], 1
not eax
mov dword [esi + 0x3c], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x100088e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x31
call fcn.10007f90
push 0x41
mov ecx, esi
call fcn.10007f90
push 0x59
mov ecx, esi
call fcn.10007f90
push 0x26
mov ecx, esi
call fcn.10007f90
push 0x53
mov ecx, esi
call fcn.10007f90
push 0x59
mov ecx, esi
call fcn.10007f90
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
xor edi, edi
xor ebp, ebp
mov bl, byte [ecx]
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x1c]
cmp edi, 4
mov cl, byte [edx + ebp]
mov byte [esp + 0x14], cl
jne 0x10008970
test cl, cl
jbe 0x1000896c
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
and edx, 0xff
and ecx, 0xff
mov edi, eax
shr edi, 0x18
xor edi, edx
shl eax, 8
mov edi, dword [edi*4 + 0x100e2b4c]
xor eax, edi
dec ecx
jne 0x10008956
xor edi, edi
jmp 0x1000899f
cmp bl, cl
jne 0x10008977
inc edi
jmp 0x10008982
mov bl, cl
mov edi, 1
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x18
and edx, 0xff
xor ecx, edx
shl eax, 8
mov ecx, dword [ecx*4 + 0x100e2b4c]
xor eax, ecx
mov ecx, dword [esp + 0x20]
inc ebp
cmp ebp, ecx
jb 0x1000892e
not eax
mov edi, eax
mov ecx, esi
push edi
call fcn.10007fd0
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.100080f0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x10008bb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x14]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x8ce0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 8
mov byte [esp + 0x1c], bl
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x8cd4], ebx
mov eax, dword [edx + 0x174]
mov edx, dword [esi]
push edi
push eax
push ecx
push edx
mov ecx, esi
call fcn.100089e0
mov ecx, dword [esi + 0x8ce0]
cmp byte [ecx + 0x1a0], bl
je 0x10008c2c
mov eax, dword [esi + 0x8cd8]
lea edx, [eax + eax*8]
shl edx, 3
sub edx, eax
mov eax, dword [ecx + 0x17c]
shl edx, 9
mov ecx, dword [edx + eax + 0x8cf0]
call fcn.1003af7f
mov eax, dword [esi + 0x8cd4]
xor edx, edx
cmp eax, ebx
jbe 0x10008c69
lea edi, [esi + 0x7cd4]
mov eax, dword [esi + 0x8ce0]
add edi, 4
add eax, 0x178
mov ecx, dword [eax]
mov ebp, ecx
add ecx, ecx
shr ebp, 0x1f
or ebp, ecx
mov ecx, dword [edi - 4]
xor ebp, ecx
inc edx
mov dword [eax], ebp
mov eax, dword [esi + 0x8cd4]
cmp edx, eax
jb 0x10008c3e
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
push edx
mov edx, dword [esi + 8]
lea ecx, [eax*8 + 8]
sub ecx, edi
push ecx
mov ecx, dword [esi + 0x8ce0]
push edx
call fcn.10008d40
mov edi, dword [esi + 0x8ce0]
cmp byte [edi + 0x1a0], bl
je 0x10008d29
mov ebp, dword [esi + 0x8cd8]
mov eax, dword [edi + 0x19c]
inc ebp
cmp ebp, eax
jne 0x10008cb4
xor ebp, ebp
cmp dword [edi + 0x1b4], ebx
je 0x10008d05
lea ecx, [edi + 0x148]
call fcn.10020b02
mov ebx, dword [edi + 0x140]
mov ecx, 0xf
sub ecx, ebx
xor edi, edi
shr ecx, 3
add eax, ecx
adc edx, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x8ce0]
mov eax, dword [edx + 0x1b4]
lea edx, [esp + 0x10]
push edx
lea edx, [esi + 0x8cf8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x8ce0]
lea ecx, [ebp + ebp*8]
shl ecx, 3
mov edx, dword [eax + 0x17c]
sub ecx, ebp
shl ecx, 9
lea ecx, [edx + ecx + 0x8cf0]
call fcn.1003afbe
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x1001c050
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x50]
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
cmp esi, 0x40
rep stosd dword es:[edi], eax
jbe 0x1001c08e
mov ecx, ebx
call fcn.10039530
mov edx, dword [esp + 0x50]
push esi
mov ecx, ebx
call fcn.10039c70
lea edx, [esp + 0xc]
mov ecx, ebx
call fcn.10039e00
jmp 0x1001c0aa
test esi, esi
jbe 0x1001c0aa
mov ecx, esi
mov esi, dword [esp + 0x50]
mov eax, ecx
lea edi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov cl, byte [esp + eax + 0xc]
xor cl, 0x36
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x40
jb 0x1001c0ac
mov ecx, ebx
call fcn.10039530
push 0x40
lea edx, [esp + 0x10]
mov ecx, ebx
call fcn.10039c70
xor eax, eax
mov cl, byte [esp + eax + 0xc]
xor cl, 0x6a
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x40
jb 0x1001c0d3
lea esi, [ebx + 0x60]
mov ecx, esi
call fcn.10039530
push 0x40
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.10039c70
pop edi
pop esi
pop ebx
add esp, 0x40
ret 8

Function at 0x1001c170
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xb4
xor eax, eax
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0xc8]
cmp edi, 0x40
jbe 0x1001c1eb
lea ecx, [esp + 0x60]
call fcn.10039530
mov edx, dword [esp + 0xc4]
push edi
lea ecx, [esp + 0x64]
call fcn.10039c70
lea edx, [esp + 0xc]
lea ecx, [esp + 0x60]
call fcn.10039e00
xor eax, eax
xor ecx, ecx
xor edx, edx
mov ch, byte [esp + eax + 0xc]
mov dl, byte [esp + eax + 0xe]
mov cl, byte [esp + eax + 0xd]
add eax, 4
shl ecx, 8
or ecx, edx
xor edx, edx
mov dl, byte [esp + eax + 0xb]
shl ecx, 8
or ecx, edx
cmp eax, 0x14
mov dword [esp + eax + 0x1c], ecx
jl 0x1001c1bd
jmp 0x1001c224
xor eax, eax
test edi, edi
jbe 0x1001c224
push ebp
mov ebp, dword [esp + 0xc8]
mov ecx, eax
mov edx, eax
shr ecx, 2
and edx, 3
lea esi, [esp + ecx*4 + 0x24]
mov ecx, 3
sub ecx, edx
xor edx, edx
mov dl, byte [eax + ebp]
shl ecx, 3
shl edx, cl
mov ecx, dword [esi]
or ecx, edx
inc eax
cmp eax, edi
mov dword [esi], ecx
jb 0x1001c1f9
pop ebp
lea eax, [esp + 0x20]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x36363636
dec ecx
mov dword [eax - 4], edi
jne 0x1001c22d
mov ecx, ebx
call fcn.10039530
push 0x10
lea edx, [esp + 0x24]
mov ecx, ebx
call fcn.10039f00
lea eax, [esp + 0x20]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x6a6a6a6a
dec ecx
mov dword [eax - 4], edi
jne 0x1001c25b
lea esi, [ebx + 0x60]
mov ecx, esi
call fcn.10039530
push 0x10
lea edx, [esp + 0x24]
mov ecx, esi
call fcn.10039f00
pop edi
pop esi
pop ebx
add esp, 0xb4
ret 8
Function at 0x1001c2e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x80
lea edx, [esp]
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 5
call fcn.10039eb0
lea ecx, [ebp + 0x60]
push 5
lea edx, [esp + 0x54]
call fcn.10039eb0
mov ebx, dword [esp + 0x94]
mov eax, dword [esp + 0x98]
mov ecx, 5
mov esi, ebx
lea edi, [esp + 0x10]
test eax, eax
rep movsd dword es:[edi], dword [esi]
jbe 0x1001c362
mov esi, eax
lea eax, [esp + 0x50]
lea edx, [esp + 0x10]
push eax
mov ecx, ebp
call fcn.10039560
lea ecx, [esp + 0x10]
lea edx, [esp + 0x50]
push ecx
lea ecx, [ebp + 0x60]
call fcn.10039560
lea ecx, [esp + 0x10]
mov eax, ebx
sub ecx, ebx
mov edx, 5
mov edi, dword [ecx + eax]
xor dword [eax], edi
add eax, 4
dec edx
jne 0x1001c354
dec esi
jne 0x1001c326
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret 8

Function at 0x1001cbe5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
cmp dword [ebp + 8], 0
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], edi
mov ecx, dword [edi + 4]
mov eax, dword [edi]
lea esi, [edi + ecx*4 + 8]
je 0x1001cc67
cmp eax, 0x10
je 0x1001cc13
mov cl, byte [esi + eax]
xor byte [ebx], cl
inc eax
inc ebx
dec dword [ebp + 8]
jne 0x1001cc02
cmp dword [ebp + 8], 0x10
jb 0x1001cc39
mov edi, dword [ebp + 8]
mov edx, ebx
shr edi, 4
push edi
lea ecx, [esi + 0x10]
call dword [0x100e6bb8]
shl edi, 4
add ebx, edi
sub dword [ebp + 8], edi
mov edi, dword [ebp - 4]
push 0x10
pop eax
cmp dword [ebp + 8], 0
je 0x1001cc65
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 1
mov edx, esi
lea ecx, [esi + 0x10]
stosd dword es:[edi], eax
call dword [0x100e6bb8]
xor eax, eax
mov cl, byte [esi + eax]
xor byte [ebx], cl
inc eax
inc ebx
dec dword [ebp + 8]
jne 0x1001cc56
mov edi, dword [ebp - 4]
mov dword [edi], eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1001d020
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
sub esp, 0xa0
and eax, 0xff
mov dl, al
push ebx
mov dh, dl
push esi
mov eax, edx
mov esi, ecx
shl eax, 0x10
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
mov ax, dx
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
xor ecx, ecx
sub esi, eax
mov bl, byte [esp + ecx + 0xc]
lea eax, [esp + ecx + 0xc]
mov dl, byte [esi + eax]
xor bl, dl
inc ecx
cmp ecx, 0x14
mov byte [eax], bl
jb 0x1001d051
lea ecx, [esp + 0x4c]
call fcn.10039530
lea edx, [esp + 0xc]
lea ecx, [esp + 0x4c]
push 0x40
call fcn.10039c70
lea ecx, [esp + 0x4c]
mov edx, dword [esp + 0xb0]
call fcn.10039e00
pop edi
pop esi
pop ebx
add esp, 0xa0
ret 4

Function at 0x10021ec6
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx], edx
dec edx
je 0x10021ee6
sub edx, 3
je 0x10021edd
sub edx, 6
jne 0x10021eea
add ecx, 0x10
jmp fcn.10039fd0
or dword [ecx + 8], 0xffffffff
or dword [ecx + 0xc], 0xffffffff
ret
or dword [ecx + 4], 0xffffffff
ret