joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014520
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x40
push 4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword ds:[eax], edx
lea eax, [esp]
push eax
push dword [esp + 4]
push 4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret

Function at 0x10014560
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x10]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push dword [esp + 0x18]
push edi
call fcn.10048580
add esp, 0xc
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
pop ecx
ret

Function at 0x100145a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x10]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push dword [esp + 0x18]
push edi
call fcn.10048ce0
add esp, 0xc
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
pop ecx
ret

Function at 0x100145e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x40
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [esp + 0x10]
mov byte [edi], al
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ecx
ret

Function at 0x10014620
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [esp + 0xc]
cmp al, 0xff
je 0x10014640
mov byte [esi], al
mov eax, dword [esp + 0x14]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ecx
ret

Function at 0x10014670
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x40
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 4]
push eax
push dword [esp + 8]
movsd qword [edi], xmm0
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ecx
ret

Function at 0x100146b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x10]
mov dword [edi], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ecx
ret
Function at 0x100146f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
push dword [esp + 8]
movss dword [edi], xmm0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ecx
ret

Function at 0x10014730
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x40
push 2
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ax, word [esp + 0x10]
mov word [edi], ax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 2
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ecx
ret

Function at 0x10014770
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x18]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x14]
push eax
push 0x40
push esi
push edi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x100147a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
add esp, 8
ret
push esi
push dword [esp + 0x1c]
push edi
call fcn.10048580
add esp, 0xc
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10014798
pop edi
xor eax, eax
pop esi
add esp, 8
ret
Function at 0x100177b0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push 0
push 0
push 0
imul eax, dword [eax + 4], 0x3e8
push 0x10013ac0
push 0
push 0
mov dword [0x10098d1c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret 4

Function at 0x10017c60
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, 5
cmp byte [esi + 4], bl
jbe 0x10017cce
push ebp
mov ebp, 0x100
nop dword [eax]
movzx eax, byte [edi + esi + 0x17]
mov dl, byte [edi + esi]
add eax, 0x2800
push eax
mov al, dl
xor al, 0x80
test dl, dl
movzx ecx, al
movzx eax, dl
cmovns ecx, eax
movzx eax, byte [edi + esi + 1]
movzx ecx, cl
imul ecx, ebp
add cx, ax
movzx eax, cx
mov ecx, 0x1009d388
push eax
call fcn.1001bba0
movzx eax, byte [edi + esi + 0x43]
inc ebx
lea edi, [edi + eax*8]
movzx eax, byte [esi + 4]
lea edi, [edi + 0x44]
cmp ebx, eax
jl 0x10017c80
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x10018b40
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library

Disassembly:
sub esp, 0x2a4
mov eax, dword [0x1008b880]
xor eax, esp
mov dword [esp + 0x2a0], eax
mov eax, dword [0x1008b6ec]
push esi
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
push edi
push dword [eax]
mov edi, dword [esp + 0x2b4]
call esi
lea eax, [esp + 0x18]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [0x1008b6ec]
mov dword [ecx], eax
mov eax, dword [0x1008b6ec]
cmp dword [eax], 0xffffffff
jne 0x10018bde
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x1b0]
push str.Error_msg:__d__d
push eax
call fcn.10002150
add esp, 0x10
lea eax, [esp + 0x1a8]
push 0
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
jmp 0x10018c7b
mov eax, 2
push edi
mov word [esp + 0xc], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push dword [esp + 0x2b4]
mov dword [esp + 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xa], ax
lea eax, [esp + 8]
push 0x10
push eax
mov eax, dword [0x1008b6ec]
push dword [eax]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
mov eax, dword [0x1008b6ec]
je 0x10018c42
push 3
push 0x400
push dword [0x1009e6c8]
push dword [eax]
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
cmp eax, 0xffffffff
jne 0x10018c50
mov eax, dword [0x1008b6ec]
push dword [eax]
call esi
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
jmp 0x10018c7b
mov word [0x6e2be9c], 0
mov ecx, 0x1009d35c
push dword [0x1c3249c]
call fcn.1001b240
push dword [0x1c3249c]
mov ecx, 0x1009d338
call fcn.1001b240
mov al, 1
mov ecx, dword [esp + 0x2a8]
pop edi
pop esi
xor ecx, esp
call fcn.10045eb8
add esp, 0x2a4
ret 8
Function at 0x10019460
Capabilities:
Convert ip address from string
Resolve dns

Disassembly:
sub esp, 0x30
mov eax, dword [0x1008b880]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x24]
push eax
push ebx
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jne 0x100195db
push ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x100195db
mov eax, dword [eax + 0xc]
push ebp
push esi
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov ebp, eax
mov dword [esp + 0x10], 0
mov esi, ebp
mov dword [esp + 0xc], ebp
mov dword [esp + 0x24], 0xf
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x100194c2
sub esi, ecx
push edi
cmp esi, 0xf
ja 0x100194f3
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x28], esi
push ebp
push eax
call fcn.10048580
mov byte [esp + esi + 0x20], 0
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x20]
jmp 0x10019572
cmp esi, 0x7fffffff
ja 0x100195ed
mov edi, esi
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x10019523
mov eax, connect
mov edi, closesocket
push eax
call fcn.100017f0
add esp, 4
mov ebp, eax
jmp 0x10019557
mov eax, 0x16
cmp edi, eax
cmovb edi, eax
lea eax, [edi + 1]
cmp eax, 0x1000
jb 0x10019544
push eax
call fcn.100017f0
add esp, 4
mov ebp, eax
jmp 0x10019557
test eax, eax
je 0x10019555
push eax
call fcn.10045b60
add esp, 4
mov ebp, eax
jmp 0x10019557
xor ebp, ebp
push esi
push dword [esp + 0x14]
mov dword [esp + 0x2c], esi
push ebp
mov dword [esp + 0x34], edi
call fcn.10048580
mov byte [esi + ebp], 0
mov dword [esp + 0x20], ebp
add esp, 0xc
mov dword [ebx], 0
cmp edi, 0x10
lea ecx, [esp + 0x14]
cmovae ecx, ebp
sub ebx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ebx + ecx - 1], al
test al, al
jne 0x10019587
lea esi, [esp + 0x14]
cmp edi, 0x10
jb 0x100195c6
inc edi
mov esi, ebp
mov ecx, esi
cmp edi, 0x1000
jb 0x100195bc
mov ecx, dword [ebp - 4]
mov eax, esi
sub eax, ecx
add edi, 0x23
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100195f2
push edi
push ecx
call fcn.10045b90
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10045eb8
add esp, 0x30
ret
mov ecx, dword [esp + 0x30]
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.10045eb8
add esp, 0x30
ret
call fcn.10002100
call fcn.1004aaaf
int3

Function at 0x100197c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1008b880]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100052e0
push 0
push str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890__
lea ecx, [ebp - 0x1c]
call fcn.1001a150
cmp eax, 0xffffffff
je 0x1001980f
push 0x10
push 0x1006b1fc
push str.Window_title_is_invalid__alphanumerical_characters__space_and______are_allowed_only
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x1c]
call fcn.10006850
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10045eb8
mov esp, ebp
pop ebp
ret 4
Function at 0x1001b8b0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
call esi
mov ebx, dword [esp + 0x10]
sub eax, edi
cmp eax, ebx
jae 0x1001b8e0
push ebp
mov ebp, dword [esp + 0x18]
nop
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
sub eax, edi
cmp eax, ebx
jb 0x1001b8d0
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret

Function at 0x1001b950
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x1001b99b
mov ebx, dword [edi + 0x3c]
cmp dword [ebx + edi], 0x4550
jne 0x1001b99b
mov ebx, dword [ebx + edi + 0x78]
xor esi, esi
add ebx, edi
mov ebp, dword [ebx + 0x20]
add ebp, edi
cmp dword [ebx + 0x14], esi
jbe 0x1001b99b
mov eax, dword [ebp + esi*4]
push dword [esp + 0x18]
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1001b9a2
inc esi
cmp esi, dword [ebx + 0x14]
jb 0x1001b980
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
movzx eax, si
cmp ax, 0xffff
je 0x1001b99b
movsx ecx, ax
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movsx ecx, word [eax + edi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edi]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10023a40
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x1009f9f8], 0
jne 0x10023a4e
call fcn.1003f0d0
cmp byte [0x1009fa02], 0
je 0x10023a6c
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.1003f4d0
add esp, 0x10
ret
jmp fcn.1001f250
Function at 0x10028830
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
push ebx
push ebp
xor ebp, ebp
mov dword [esp + 0x18], ecx
push edi
test eax, eax
je 0x10028846
mov ebp, dword [eax]
xor ebx, ebx
bswap ebp
add eax, 4
je 0x10028851
mov ebx, dword [eax]
xor edi, edi
bswap ebx
add eax, 4
je 0x1002885c
mov edi, dword [eax]
mov eax, dword [ecx + 8]
mov edx, 0xb0b
mov dword [esp + 0x24], edx
mov dword [esp + 0xc], eax
push esi
bswap edi
test eax, eax
je 0x1002894a
mov eax, dword [ecx + 0x24]
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], eax
nop
mov eax, edx
xor ebx, esi
shl eax, 0x10
xor eax, ecx
xor ebp, eax
mov eax, dword [esp + 0x14]
xor eax, edx
mov esi, ebp
xor edi, eax
shr esi, 0x10
mov eax, edi
xor esi, edi
xor eax, ebx
shr esi, 8
xor eax, ebp
mov edx, ebx
mov ecx, eax
shl edx, 0x10
rol eax, 8
xor edx, edi
rol ecx, 0x10
xor ecx, eax
shl edx, 8
mov eax, ebp
shl eax, 0x10
xor eax, ebx
shl eax, 8
xor esi, eax
mov eax, ebx
shr eax, 0x10
xor eax, ebp
shr eax, 8
xor edx, eax
mov eax, edx
shl edx, 0x10
xor eax, ecx
xor ebx, eax
mov eax, esi
shr eax, 0x10
xor esi, ecx
xor edx, eax
xor esi, ebp
xor edx, ecx
ror esi, 0xa
xor edx, edi
mov edi, ebx
rol edx, 1
not edi
mov ebp, edx
or edi, esi
not ebp
xor edi, edx
or ebp, ebx
ror edi, 0xa
xor ebp, esi
not esi
or esi, edx
rol ebp, 1
mov edx, dword [esp + 0x28]
xor ebx, esi
mov esi, dword [esp + 0x1c]
add edx, edx
mov ecx, edx
mov eax, edx
xor edx, 0x11011
and eax, 0x10000
cmove edx, ecx
sub dword [esp + 0x10], 1
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
jne 0x10028890
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x24]
mov eax, edx
shl eax, 0x10
xor eax, dword [ecx]
xor ebx, dword [ecx + 4]
xor ebp, eax
mov eax, dword [ecx + 8]
mov esi, ebp
xor eax, edx
shr esi, 0x10
xor edi, eax
mov ecx, ebx
mov eax, edi
shl ecx, 0x10
xor eax, ebx
xor esi, edi
xor eax, ebp
shr esi, 8
mov edx, eax
xor ecx, edi
rol eax, 8
rol edx, 0x10
xor edx, eax
shl ecx, 8
mov eax, ebp
shl eax, 0x10
xor eax, ebx
shl eax, 8
xor esi, eax
mov eax, ebx
shr eax, 0x10
xor eax, ebp
shr eax, 8
xor ecx, eax
mov eax, ecx
shl ecx, 0x10
xor eax, edx
xor ebx, eax
mov eax, esi
shr eax, 0x10
xor esi, edx
xor ecx, eax
xor esi, ebp
xor ecx, edx
xor edi, ecx
mov ecx, dword [esp + 0x2c]
bswap esi
test ecx, ecx
je 0x100289c0
xor esi, dword [ecx]
mov eax, dword [esp + 0x30]
test eax, eax
je 0x100289ca
mov dword [eax], esi
lea edx, [eax + 4]
test ecx, ecx
lea eax, [ecx + 4]
cmove eax, ecx
bswap ebx
pop esi
test eax, eax
je 0x100289de
xor ebx, dword [eax]
test edx, edx
je 0x100289e4
mov dword [edx], ebx
add edx, 4
lea ecx, [eax + 4]
test eax, eax
bswap edi
cmove ecx, eax
test ecx, ecx
je 0x100289f7
xor edi, dword [ecx]
test edx, edx
je 0x100289fd
mov dword [edx], edi
pop edi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x10029830
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push esi
xor esi, esi
push edi
mov edi, dword [ecx + 0x34]
test eax, eax
je 0x10029849
mov esi, dword [eax]
xor edx, edx
bswap esi
add eax, 4
je 0x10029854
mov edx, dword [eax]
bswap edx
test edi, edi
je 0x100298bf
mov eax, dword [ecx + 0x2c]
push ebp
mov ecx, dword [eax + 0xc]
mov ebp, dword [eax + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
nop dword [eax]
mov ecx, esi
mov eax, esi
shr ecx, 5
shl eax, 4
add ecx, ebx
add eax, ebp
xor ecx, eax
lea eax, [esi + edi]
xor ecx, eax
sub edx, ecx
mov ecx, edx
mov eax, edx
shr ecx, 5
add ecx, dword [esp + 0x10]
shl eax, 4
add eax, dword [esp + 0x14]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
sub esi, ecx
add edi, 0x61c88647
jne 0x10029880
mov ebx, dword [esp + 0x20]
pop ebp
bswap esi
test ebx, ebx
je 0x100298c7
xor esi, dword [ebx]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x100298d1
mov dword [eax], esi
test ebx, ebx
lea ecx, [eax + 4]
lea eax, [ebx + 4]
pop edi
cmove eax, ebx
pop esi
bswap edx
pop ebx
test eax, eax
je 0x100298e7
xor edx, dword [eax]
test ecx, ecx
je 0x100298ed
mov dword [ecx], edx
add esp, 8
ret 0xc

Function at 0x10029900
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
xor edi, edi
xor esi, esi
test eax, eax
je 0x10029918
mov esi, dword [eax]
xor edx, edx
bswap esi
add eax, 4
je 0x10029923
mov edx, dword [eax]
push ebp
mov ebp, dword [ecx + 0x34]
bswap edx
test ebp, ebp
je 0x10029992
mov eax, dword [ecx + 0x2c]
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
nop
mov ecx, edx
mov eax, edx
shr ecx, 5
sub edi, 0x61c88647
shl eax, 4
add ecx, ebx
add eax, dword [esp + 0x10]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
add esi, ecx
mov ecx, esi
mov eax, esi
shr ecx, 5
add ecx, dword [esp + 0x14]
shl eax, 4
add eax, dword [esp + 0x18]
xor ecx, eax
lea eax, [esi + edi]
xor ecx, eax
add edx, ecx
cmp edi, ebp
jne 0x10029950
mov ebx, dword [esp + 0x24]
bswap esi
pop ebp
test ebx, ebx
je 0x1002999b
xor esi, dword [ebx]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x100299a5
mov dword [eax], esi
test ebx, ebx
lea ecx, [eax + 4]
lea eax, [ebx + 4]
pop edi
cmove eax, ebx
pop esi
bswap edx
pop ebx
test eax, eax
je 0x100299bb
xor edx, dword [eax]
test ecx, ecx
je 0x100299c1
mov dword [ecx], edx
add esp, 0xc
ret 0xc
Function at 0x10029a70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov edi, ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [edi + 0x14]
mov ebp, dword [edi + 0x18]
lea eax, [eax*4]
add eax, ebp
test ecx, ecx
je 0x10029a95
mov ebx, dword [ecx]
xor edx, edx
add ecx, 4
je 0x10029a9e
mov edx, dword [ecx]
mov edi, dword [edi + 8]
test edi, edi
je 0x10029ac6
sub edx, dword [eax - 4]
lea eax, [eax - 8]
movzx ecx, bl
and ecx, 0x1f
ror edx, cl
xor edx, ebx
sub ebx, dword [eax]
movzx ecx, dl
and ecx, 0x1f
ror ebx, cl
xor ebx, edx
sub edi, 1
jne 0x10029aa5
sub edx, dword [ebp + 4]
sub ebx, dword [ebp]
test esi, esi
je 0x10029ad2
xor ebx, dword [esi]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10029adc
mov dword [eax], ebx
test esi, esi
lea ecx, [eax + 4]
lea eax, [esi + 4]
pop edi
cmove eax, esi
pop esi
pop ebp
pop ebx
test eax, eax
je 0x10029af3
mov eax, dword [eax]
xor edx, eax
test ecx, ecx
je 0x10029af9
mov dword [ecx], edx
ret 0xc

Function at 0x10029b00
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x18]
test eax, eax
je 0x10029b19
mov edx, dword [eax]
xor ecx, ecx
add eax, 4
je 0x10029b22
mov ecx, dword [eax]
mov ebx, dword [esi]
mov eax, dword [edi + 8]
add ebx, edx
mov edx, dword [esi + 4]
xor edi, edi
add edx, ecx
test eax, eax
je 0x10029b5b
mov ebp, eax
movzx ecx, dl
xor ebx, edx
and ecx, 0x1f
rol ebx, cl
add ebx, dword [esi + edi*8 + 8]
movzx ecx, bl
xor edx, ebx
and ecx, 0x1f
rol edx, cl
add edx, dword [esi + edi*8 + 0xc]
inc edi
cmp edi, ebp
jb 0x10029b36
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x10029b62
xor ebx, dword [ebp]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10029b6c
mov dword [eax], ebx
test ebp, ebp
lea ecx, [eax + 4]
pop edi
lea eax, [ebp + 4]
pop esi
cmove eax, ebp
pop ebp
pop ebx
test eax, eax
je 0x10029b83
mov eax, dword [eax]
xor edx, eax
test ecx, ecx
je 0x10029b89
mov dword [ecx], edx
ret 0xc
Function at 0x10029e10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
mov ebx, ecx
push ebp
push esi
xor esi, esi
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x14], ecx
push edi
lea eax, [ecx + eax*4]
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x10029e32
mov esi, dword [ecx]
lea edx, [ecx + 4]
xor ecx, ecx
mov dword [esp + 0x20], ecx
test edx, edx
je 0x10029e45
mov ecx, dword [edx]
mov dword [esp + 0x20], ecx
xor edi, edi
add edx, 4
je 0x10029e4e
mov edi, dword [edx]
xor ebp, ebp
add edx, 4
je 0x10029e57
mov ebp, dword [edx]
mov edx, dword [ebx + 8]
sub eax, 8
mov dword [esp + 0x10], edx
sub edi, dword [eax + 4]
sub esi, dword [eax]
test edx, edx
je 0x10029ec7
nop word [eax + eax]
sub eax, 8
mov dword [esp + 0x14], eax
mov eax, esi
mov esi, ebp
mov ebp, edi
mov edi, ecx
mov ecx, eax
mov dword [esp + 0x20], ecx
lea ebx, [eax*2 + 1]
imul ebx, eax
lea edx, [ebp*2 + 1]
mov eax, dword [esp + 0x14]
imul edx, ebp
sub edi, dword [eax + 4]
sub esi, dword [eax]
rol ebx, 5
movzx ecx, bl
and ecx, 0x1f
rol edx, 5
ror edi, cl
movzx ecx, dl
xor edi, edx
and ecx, 0x1f
ror esi, cl
mov ecx, dword [esp + 0x20]
xor esi, ebx
sub dword [esp + 0x10], 1
jne 0x10029e70
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
sub ebp, dword [eax + 4]
sub ecx, dword [eax]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10029ee4
mov eax, dword [eax]
xor esi, eax
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
test edx, edx
je 0x10029eee
mov dword [edx], esi
lea esi, [edx + 4]
test eax, eax
lea edx, [eax + 4]
cmove edx, eax
test edx, edx
je 0x10029eff
xor ecx, dword [edx]
test esi, esi
je 0x10029f05
mov dword [esi], ecx
add esi, 4
lea ecx, [edx + 4]
test edx, edx
cmove ecx, edx
test ecx, ecx
je 0x10029f16
xor edi, dword [ecx]
test esi, esi
je 0x10029f1c
mov dword [esi], edi
add esi, 4
lea eax, [ecx + 4]
test ecx, ecx
cmove eax, ecx
test eax, eax
je 0x10029f2f
mov eax, dword [eax]
xor ebp, eax
test esi, esi
je 0x10029f35
mov dword [esi], ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x10029f40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp], 0
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, dword [esi + 0x18]
test eax, eax
je 0x10029f60
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
xor ebx, ebx
add eax, 4
je 0x10029f69
mov ebx, dword [eax]
lea ecx, [eax + 4]
xor eax, eax
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10029f7c
mov eax, dword [ecx]
mov dword [esp + 0x18], eax
xor edx, edx
add ecx, 4
je 0x10029f85
mov edx, dword [ecx]
mov ecx, dword [esi + 8]
push edi
mov edi, dword [ebp]
add edi, ebx
mov dword [esp + 0x14], ecx
mov ebx, dword [ebp + 4]
add ebp, 8
add ebx, edx
test ecx, ecx
je 0x10029ff2
nop
lea edx, [edi*2 + 1]
imul edx, edi
lea eax, [ebx*2 + 1]
imul eax, ebx
rol edx, 5
rol eax, 5
mov esi, edx
xor esi, dword [esp + 0x10]
movzx ecx, al
and ecx, 0x1f
mov dword [esp + 0x10], edi
rol esi, cl
mov edi, eax
xor edi, dword [esp + 0x1c]
mov eax, ebx
mov ebx, dword [ebp]
movzx ecx, dl
add ebx, esi
and ecx, 0x1f
mov dword [esp + 0x1c], eax
rol edi, cl
add edi, dword [ebp + 4]
add ebp, 8
sub dword [esp + 0x14], 1
jne 0x10029fa0
add eax, dword [ebp + 4]
mov ecx, dword [ebp]
add ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1002a010
mov eax, dword [eax]
xor ecx, eax
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
test edx, edx
je 0x1002a01a
mov dword [edx], ecx
lea esi, [edx + 4]
test eax, eax
lea edx, [eax + 4]
cmove edx, eax
test edx, edx
je 0x1002a02b
xor edi, dword [edx]
test esi, esi
je 0x1002a031
mov dword [esi], edi
add esi, 4
lea ecx, [edx + 4]
test edx, edx
pop edi
cmove ecx, edx
mov edx, dword [esp + 0x18]
test ecx, ecx
je 0x1002a047
xor edx, dword [ecx]
test esi, esi
je 0x1002a04d
mov dword [esi], edx
add esi, 4
lea eax, [ecx + 4]
test ecx, ecx
cmove eax, ecx
test eax, eax
je 0x1002a060
mov eax, dword [eax]
xor ebx, eax
test esi, esi
je 0x1002a066
mov dword [esi], ebx
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc