joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc38f34
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x100a1dca
call fcn.00c7fda4
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [edi]
lea ecx, [esi + 0x18]
mov dword [esi], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
lea eax, [edi + 0x18]
push eax
call fcn.00be76ae
and dword [ebp - 4], 0
lea eax, [edi + 0x24]
push eax
lea ecx, [esi + 0x24]
call fcn.00be76ae
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 1
call fcn.00be76ae
mov al, byte [edi + 0x3c]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x3c], al
mov al, byte [edi + 0x3d]
mov byte [esi + 0x3d], al
mov al, byte [edi + 0x3e]
mov byte [esi + 0x3e], al
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0xc3b508
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, ecx
test esi, esi
mov ecx, edx
jbe 0xc3b537
push ebx
push edi
movzx edi, byte [ecx]
movzx edx, ax
shr edx, 8
xor edx, edi
xor ebx, ebx
mov bh, al
mov ax, word [edx*2 + 0x100c1054]
xor ax, bx
inc ecx
dec esi
jne 0xc3b517
pop edi
pop ebx
pop esi
ret 4

Function at 0xc3cf6a
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x100a21a2
call fcn.00c7fda4
push ecx
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
mov ecx, dword [eax]
push edi
mov dword [ebx], ecx
mov ecx, dword [eax + 8]
mov dword [ebx + 8], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebx + 0xc], ecx
mov ecx, dword [eax + 0x10]
mov dword [ebx + 0x10], ecx
mov ecx, dword [eax + 0x14]
lea esi, [eax + 0x18]
lea edi, [ebx + 0x18]
mov dword [ebx + 0x14], ecx
mov dword [ebp - 0x10], ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x24]
lea edi, [ebx + 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov cl, byte [eax + 0x30]
add eax, 0x34
mov byte [ebx + 0x30], cl
lea ecx, [ebx + 0x34]
xor esi, esi
push eax
mov dword [ecx + 4], esi
mov dword [ecx + 8], esi
mov dword [ecx], 0x100a55c4
call fcn.00c36062
mov dword [ebp - 4], esi
mov esi, dword [ebp + 8]
lea ecx, [ebx + 0x40]
lea eax, [esi + 0x40]
push eax
call fcn.00c3d04f
add esi, 0x54
lea ecx, [ebx + 0x54]
push esi
mov byte [ebp - 4], 1
call fcn.00c3d09b
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0xc4233b
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100a29dc
call fcn.00c7fda4
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
push 3
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
call fcn.00be6b91
lea ecx, [esi + 0xc]
push 3
mov dword [ebp - 4], edi
mov dword [ecx], edi
mov dword [ecx + 4], edi
mov dword [ecx + 8], edi
call fcn.00be6b91
mov ecx, dword [ebp - 0xc]
or dword [esi + 0x4c], 0xffffffff
mov dword [esi + 0x30], edi
mov byte [esi + 0x58], 1
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0xc43065
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100a2a7c
call fcn.00c7fda4
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, ecx
push esi
mov dword [ebp - 0x10], ebx
call fcn.00be7dee
and dword [ebp - 4], 0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebx + 0xc]
call fcn.00be7dee
mov eax, dword [esi + 0x18]
push 5
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 8]
add esi, 0x1c
lea edi, [ebx + 0x1c]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x30]
pop edi
mov dword [ebx + 0x30], ecx
mov ecx, dword [eax + 0x34]
mov dword [ebx + 0x34], ecx
mov ecx, dword [eax + 0x38]
mov dword [ebx + 0x38], ecx
mov ecx, dword [eax + 0x3c]
mov dword [ebx + 0x3c], ecx
mov ecx, dword [eax + 0x40]
mov dword [ebx + 0x40], ecx
mov ecx, dword [eax + 0x44]
mov dword [ebx + 0x44], ecx
mov ecx, dword [eax + 0x48]
mov dword [ebx + 0x48], ecx
mov ecx, dword [eax + 0x4c]
mov dword [ebx + 0x4c], ecx
mov ecx, dword [eax + 0x50]
mov dword [ebx + 0x50], ecx
mov ecx, dword [eax + 0x54]
mov dword [ebx + 0x54], ecx
mov al, byte [eax + 0x58]
mov ecx, dword [ebp - 0xc]
mov byte [ebx + 0x58], al
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0xc4ffea
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a3a5c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x100a6b38
mov dword [esi + 4], 0x100a7844
lea ecx, [esi + 0x10]
mov dword [esp + 8], esi
mov dword [esi + 8], edi
call fcn.00be9e4a
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], edi
call fcn.00be9e4a
lea ecx, [esi + 0x50]
mov byte [esp + 0x14], 1
call fcn.00be9e4a
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 2
call fcn.00be9e4a
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x4a0], edi
mov dword [esi + 0x4a4], edi
mov dword [esi + 0x4b4], edi
mov eax, 0x100000
mov dword [esi + 0x4c0], edi
mov dword [esi + 0x4c8], eax
mov dword [esi + 0x4cc], eax
mov dword [esi + 0x4d0], eax
mov dword [esi + 0x4d4], eax
mov dword [esi + 0x4d8], 0x10000
mov dword [esi], 0x100a7834
mov dword [esi + 4], 0x100a7820
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0xc511ba
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a3b9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x100a55e8
mov dword [esi + 4], 0x100a7df8
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esp + 8], esi
mov dword [esi + 0x30], edi
lea ecx, [esi + 0x140]
mov dword [esp + 0x14], edi
call fcn.00be9e4a
mov dword [esi + 0x6fe4], edi
lea ecx, [esi + 0x6ff8]
mov dword [esi + 0x6ff4], edi
call fcn.00c7c634
mov ecx, dword [esp + 0xc]
mov eax, 1
mov dword [esi + 0x7020], edi
mov dword [esi + 0x6fec], edi
mov dword [esi + 0x6ff0], edi
mov dword [esi + 0x7010], eax
mov byte [esi + 0x6fe0], al
mov dword [esi], 0x100a7de0
mov dword [esi + 4], 0x100a7dd0
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0xc54464
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x31
call fcn.00c53b24
push 0x41
mov ecx, esi
call fcn.00c53b24
push 0x59
mov ecx, esi
call fcn.00c53b24
push 0x26
mov ecx, esi
call fcn.00c53b24
push 0x53
mov ecx, esi
call fcn.00c53b24
push 0x59
mov ecx, esi
call fcn.00c53b24
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
xor edi, edi
xor ebp, ebp
mov bl, byte [ecx]
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x1c]
cmp edi, 4
mov cl, byte [edx + ebp]
mov byte [esp + 0x14], cl
jne 0xc544f4
test cl, cl
jbe 0xc544f0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
and edx, 0xff
and ecx, 0xff
mov edi, eax
shr edi, 0x18
xor edi, edx
shl eax, 8
mov edi, dword [edi*4 + 0x100c135c]
xor eax, edi
dec ecx
jne 0xc544da
xor edi, edi
jmp 0xc54523
cmp bl, cl
jne 0xc544fb
inc edi
jmp 0xc54506
mov bl, cl
mov edi, 1
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x18
and edx, 0xff
xor ecx, edx
shl eax, 8
mov ecx, dword [ecx*4 + 0x100c135c]
xor eax, ecx
mov ecx, dword [esp + 0x20]
inc ebp
cmp ebp, ecx
jb 0xc544b2
not eax
mov edi, eax
mov ecx, esi
push edi
call fcn.00c53b64
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.00c53c64
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0xc54734
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x14]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x8ce0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 8
mov byte [esp + 0x1c], bl
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x8cd4], ebx
mov eax, dword [edx + 0x170]
mov edx, dword [esi]
push edi
push eax
push ecx
push edx
mov ecx, esi
call fcn.00c54564
mov ecx, dword [esi + 0x8ce0]
cmp byte [ecx + 0x19c], bl
je 0xc547b0
mov eax, dword [esi + 0x8cd8]
lea edx, [eax + eax*8]
shl edx, 3
sub edx, eax
mov eax, dword [ecx + 0x178]
shl edx, 9
mov ecx, dword [edx + eax + 0x8cf0]
call fcn.00c7c494
mov eax, dword [esi + 0x8cd4]
xor edx, edx
cmp eax, ebx
jbe 0xc547ed
lea edi, [esi + 0x7cd4]
mov eax, dword [esi + 0x8ce0]
add edi, 4
add eax, 0x174
mov ecx, dword [eax]
mov ebp, ecx
add ecx, ecx
shr ebp, 0x1f
or ebp, ecx
mov ecx, dword [edi - 4]
xor ebp, ecx
inc edx
mov dword [eax], ebp
mov eax, dword [esi + 0x8cd4]
cmp edx, eax
jb 0xc547c2
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push edx
mov edx, dword [esi + 8]
lea ecx, [eax*8 + 8]
mov eax, dword [esp + 0x20]
sub ecx, eax
push ecx
mov ecx, dword [esi + 0x8ce0]
push edx
call fcn.00c548c4
mov eax, dword [esi + 0x8ce0]
cmp byte [eax + 0x19c], bl
je 0xc548ab
mov edi, dword [esi + 0x8cd8]
mov ecx, dword [eax + 0x198]
inc edi
cmp edi, ecx
jne 0xc54838
xor edi, edi
cmp dword [eax + 0x1b0], ebx
je 0xc54888
lea ebx, [eax + 0x140]
mov ecx, ebx
call fcn.00beb9ab
mov ebp, dword [ebx + 0x28]
mov ecx, 0xf
sub ecx, ebp
xor ebx, ebx
shr ecx, 3
add eax, ecx
adc edx, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x8ce0]
mov eax, dword [edx + 0x1b0]
lea edx, [esp + 0x10]
push edx
lea edx, [esi + 0x8cf8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x8ce0]
lea ecx, [edi + edi*8]
shl ecx, 3
mov edx, dword [eax + 0x178]
sub ecx, edi
shl ecx, 9
lea ecx, [edx + ecx + 0x8cf0]
call fcn.00c7c4e4
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0xc5fec4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, dword [esp + 0x18]
xor edx, edx
mov ecx, dword [esi + 4]
mov ebx, dword [esi]
mov eax, ecx
push edi
imul eax, dword [esp + 0x18]
div ebp
xor edx, edx
lea edi, [eax + ebx - 1]
mov eax, ecx
imul eax, dword [esp + 0x14]
div ebp
mov ecx, dword [esi + 8]
mov ebp, 0x10000
sub ecx, eax
add ebx, eax
mov dword [esi + 8], ecx
mov dword [esi], ebx
mov eax, dword [esi]
mov ecx, eax
xor ecx, edi
test ch, 0x80
je 0xc5ff27
test ah, 0x40
je 0xc5ff94
test edi, 0x4000
jne 0xc5ff94
and eax, 0x3fff
or edi, 0x4000
mov dword [esi], eax
mov edx, dword [esi]
and edi, 0x7fff
and edx, 0x7fff
shl edx, 1
mov dword [esi], edx
mov eax, dword [esi + 0x10]
shl edi, 1
or edi, 1
cmp eax, ebp
jb 0xc5ff75
mov eax, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
lea ecx, [esi + 0x18]
cmp eax, edx
jb 0xc5ff5d
call fcn.00be9f38
mov byte [esp + 0x18], al
jmp 0xc5ff66
mov dl, byte [eax]
inc eax
mov byte [esp + 0x18], dl
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
and eax, 0xff
or ah, 1
mov dword [esi + 0x10], eax
mov ecx, dword [esi + 0x10]
mov eax, ecx
add ecx, ecx
mov dword [esi + 0x10], ecx
mov edx, dword [esi + 8]
shr eax, 7
and eax, 1
shl edx, 1
or edx, eax
mov dword [esi + 8], edx
jmp 0xc5fefe
sub edi, dword [esi]
inc edi
mov dword [esi + 4], edi
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0xc6059b
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a426b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], esi
mov dword [esi], 0x100a55e8
mov dword [esi + 4], 0x100a5210
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x40]
mov dword [esp + 0x14], ebx
call fcn.00be9e4a
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x88], bl
mov dword [esi], 0x100a83b8
mov dword [esi + 4], 0x100a83a8
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0xc61a6b
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a42eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], esi
mov dword [esi], 0x100a55e8
mov dword [esi + 4], 0x100a5210
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x30], ebx
lea ecx, [esi + 0x40]
mov dword [esp + 0x14], ebx
call fcn.00be9e4a
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x3038], bl
mov dword [esi], 0x100a8510
mov dword [esi + 4], 0x100a8500
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0xc63564
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov ecx, eax
imul ecx, edx
mov edx, dword [esi + 0x14]
add edx, ecx
mov dword [esi + 0x14], edx
mov edx, dword [esi + 0x10]
sub edx, ecx
imul eax, dword [esp + 8]
mov dword [esi + 0x10], edx
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0xc]
lea edx, [eax + ecx]
xor edx, eax
cmp edx, 0x1000000
jb 0xc635ac
cmp ecx, 0x8000
jae 0xc635f6
neg eax
and eax, 0x7fff
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
lea ecx, [esi + 0x20]
cmp eax, edx
jb 0xc635c4
call fcn.00be9f38
mov byte [esp + 8], al
jmp 0xc635cd
mov dl, byte [eax]
inc eax
mov byte [esp + 8], dl
mov dword [ecx], eax
mov eax, dword [esi + 0x10]
mov ecx, dword [esp + 8]
shl eax, 8
and ecx, 0xff
or eax, ecx
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x14]
shl ecx, 8
shl eax, 8
mov dword [esi + 0xc], ecx
mov dword [esi + 0x14], eax
jmp 0xc63587
pop esi
ret 4
Function at 0xc674b4
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
mov eax, 1
xor bl, bl
push edi
mov edi, dword [esp + 0x38]
cmp esi, eax
mov dword [esp + 0x10], ecx
jbe 0xc674dc
mov cl, byte [eax + edi]
xor bl, cl
inc eax
cmp eax, esi
jb 0xc674d2
mov ebp, dword [esp + 0x40]
mov ecx, ebp
call fcn.00be6c2a
mov dword [ebp + 0x14], 0xffffffff
mov al, byte [edi]
cmp bl, al
jne 0xc6751a
xor ebx, ebx
cmp esi, ebx
jbe 0xc6751c
mov edx, esi
mov ecx, edi
call fcn.00c67584
cmp eax, ebx
mov dword [ebp + 0x14], eax
jge 0xc6756d
mov ecx, dword [esp + 0x10]
dec esi
push ebp
inc edi
push esi
push edi
call fcn.00c671a4
jmp 0xc6751c
xor ebx, ebx
mov eax, 3
mov ecx, ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.00be6c53
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
shl edi, 5
add edi, esi
mov ecx, 8
lea esi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
inc edx
mov eax, edx
mov dword [ebp + 8], edx
shl eax, 5
mov dword [eax + ecx - 0x20], 0x16
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0xc
Function at 0xc6ad34
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov ebp, ecx
mov ecx, dword [esp + 0x10]
push edi
xor edi, edi
xor eax, eax
lea edx, [ebp + 0x100]
lea esi, [edi + ecx]
xor ebx, ebx
add edx, 4
mov bl, byte [esi + eax]
mov ebx, dword [ebx*4 + 0x100c3ce0]
xor dword [edx - 4], ebx
inc eax
cmp eax, 4
jl 0xc6ad4b
add edi, 4
cmp edi, 0x10
jl 0xc6ad40
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0xc6b5a4
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov dword [ecx + 0x18], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x1c], eax
ret
Function at 0xc6c904
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
sub esp, 0xa8
and eax, 0xff
mov dl, al
push ebx
mov dh, dl
push esi
mov eax, edx
mov esi, ecx
shl eax, 0x10
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
mov ax, dx
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
xor ecx, ecx
sub esi, eax
mov bl, byte [esp + ecx + 0xc]
lea eax, [esp + ecx + 0xc]
mov dl, byte [esi + eax]
xor bl, dl
inc ecx
cmp ecx, 0x14
mov byte [eax], bl
jb 0xc6c935
lea ecx, [esp + 0x4c]
call fcn.00c6b5a4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x4c]
push 0x40
push eax
mov dword [esp + 0x74], 0
call fcn.00c6bdb4
mov ecx, dword [esp + 0xb8]
push ecx
lea ecx, [esp + 0x50]
call fcn.00c6bf44
pop edi
pop esi
pop ebx
add esp, 0xa8
ret 4

Function at 0xc6e854
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
mov dword [ecx + 0x30], edx
mov dword [ecx + 0x4c], edx
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x2c], 0x20
mov dword [ecx + 0x54], 1
mov dword [ecx + 0x48], 4
mov dword [ecx + 0x58], edx
lea esi, [ecx + 0x70]
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0xc6e87b
pop esi
ret

Function at 0xc74574
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0xc74584
pop edi
pop ebx
ret

Function at 0xc745b4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
sar ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0xc745c4
pop esi
pop ebp
pop ebx
ret 4
Function at 0xc74864
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [esp], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
push ebp
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
xor edx, edx
push edi
cmp edx, dword [esp + 0x1c]
jae 0xc749d5
mov eax, edx
or eax, 8
xor edi, edi
cmp eax, 1
je 0xc748ee
lea ebx, [ebx]
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 4]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0xc748c4
add edi, dword [esp + 8]
mov ecx, dword [esp + 0x20]
mov dword [ecx + edx*4], edi
inc edx
cmp edx, 8
jb 0xc748a8
cmp edx, 0x10
jae 0xc7496f
lea eax, [edx - 8]
mov dword [esp + 8], eax
jmp 0xc74914
cmp edx, dword [esp + 0x1c]
jae 0xc749d5
or eax, 8
xor edi, edi
cmp eax, 1
je 0xc74955
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 0x104]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0xc74928
add edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 8], eax
cmp edx, 0x10
jb 0xc74914
cmp edx, dword [esp + 0x1c]
jae 0xc749d5
lea eax, [edx - 0x10]
mov dword [esp + 0x18], eax
jmp 0xc74984
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0xc749ba
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0xc74994
add edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 0x18], eax
cmp edx, dword [esp + 0x1c]
jb 0xc74984
pop edi
pop ebp
add esp, 0xc
ret 0xc
Function at 0xc76504
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
lea eax, [edi + 0x32550]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jmp 0xc76524
xor edx, edx
lea ecx, [edx + 1]
mov dword [esp + 0xc], 4
lea ecx, [ecx]
movzx ebx, word [edi + ecx*2 + 0x32bf4]
mov eax, esi
and eax, 1
mov ebp, eax
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
xor ebx, ebp
add edx, dword [edi + ebx*4 + 0x30ea0]
add ecx, ecx
shr esi, 1
or ecx, eax
dec dword [esp + 0xc]
jne 0xc76534
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
inc esi
mov dword [eax], edx
add eax, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
cmp esi, 0x10
jb 0xc76524
pop esi
pop ebp
mov dword [edi + 0x32590], 0
pop ebx
add esp, 0xc
ret
Function at 0xc76594
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
mov eax, 4
push edi
mov dword [esp + 0x18], eax
movzx ebp, byte [edx + eax + 0x306a0]
mov ecx, ebp
mov esi, ebp
and esi, 1
shr ecx, 1
dec ecx
or esi, 2
shl esi, cl
mov edi, eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x10], 0
sub edi, esi
mov ebx, 1
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0xc76625
jmp 0xc765e8
mov ebp, dword [esp + 0x1c]
mov ecx, ebx
sub ecx, ebp
mov eax, edi
and eax, 1
add ecx, esi
movzx ecx, word [edx + ecx*2 + 0x32b0e]
mov ebp, eax
neg ebp
sar ebp, 4
shr ecx, 4
and ebp, 0x7f
xor ecx, ebp
mov ecx, dword [edx + ecx*4 + 0x30ea0]
add dword [esp + 0x10], ecx
add ebx, ebx
shr edi, 1
or ebx, eax
dec dword [esp + 0x14]
jne 0xc765e4
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x20], ecx
inc eax
mov dword [esp + 0x18], eax
cmp eax, 0x80
jb 0xc765a7
lea eax, [edx + 0x32910]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
sub eax, edx
lea ebp, [edx + 0x31d58]
sub eax, 0x31d50
lea edi, [edx + 0x31950]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 4
lea ebx, [ebx]
xor ebx, ebx
cmp dword [edx + 0x32594], ebx
jbe 0xc766cf
lea ebx, [ebx]
mov eax, ebx
or eax, 0x40
xor esi, esi
cmp eax, 1
je 0xc766c3
lea esp, [esp]
mov ebp, dword [esp + 0x10]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebp + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add esi, dword [edx + ebp*4 + 0x30ea0]
mov eax, ecx
cmp eax, 1
jne 0xc76694
mov ebp, dword [esp + 0x18]
mov dword [edi + ebx*4], esi
inc ebx
cmp ebx, dword [edx + 0x32594]
jb 0xc76684
mov eax, 0xe
cmp dword [edx + 0x32594], eax
jbe 0xc766f2
mov ecx, eax
shr ecx, 1
sub ecx, 5
shl ecx, 4
add dword [edi + eax*4], ecx
inc eax
cmp eax, dword [edx + 0x32594]
jb 0xc766dc
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov ecx, dword [edi + 4]
mov dword [ebp - 4], ecx
mov eax, dword [edi + 8]
mov dword [ebp], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp + 4], ecx
mov eax, 4
lea ecx, [ebp + 8]
lea ecx, [ecx]
movzx esi, byte [edx + eax + 0x306a0]
mov esi, dword [edi + esi*4]
mov ebx, dword [esp + 0x14]
add esi, dword [ebx + ecx]
inc eax
mov dword [ecx], esi
add ecx, 4
cmp eax, 0x80
jb 0xc76714
sub dword [esp + 0x10], 0xffffff80
sub dword [esp + 0x14], 0x200
add ebp, 0x200
add edi, 0x100
dec dword [esp + 0x1c]
mov dword [esp + 0x18], ebp
jne 0xc76674
pop edi
pop esi
pop ebp
mov dword [edx + 0x3bcf8], 0
pop ebx
add esp, 0x210
ret

Function at 0xc7bbb4
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
ret