joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a3a4e
Capabilities:
Encode data using xor

Disassembly:
invalid
in eax, 0x46
lcall 0x703d, 0x64263019
dec ecx
cwde
dec edi
cmp eax, 0x85168901
sub ch, cl
add al, 0x94
pop ss
movsd dword es:[edi], dword [esi]
enter 0xffffffffffffb7f9, 0xfffffffffffffff8
mov al, 0xd3
xchg esp, eax
pushal
push edx
popfd
rol cl, 1
jae 0x4a3a5c
mov eax, 0x5034d052
sahf
in eax, 0xfa
or dl, byte [ecx - 0x4fab4259]
movsd dword es:[edi], dword [esi]
mov esp, 0xe2a1a5c6
sbb dword [ecx - 0x7d], esi
ja 0x4a39f8
xor byte [ebp - 0x6d], dh
mov bl, 0xcc
and edx, dword [eax + 0x23]
sal byte [ebx - 0x20], 1
test ch, ah
pop esi
ljmp 0xf089
pop esp
in al, 0xa6
xchg edx, eax
jns 0x4a3a14
sbb byte [ebp + 0x5f], ah
or dh, cl
je 0x4a3a6c
pop ecx
into
jb 0x4a39e3
and ebp, 0
sub edx, eax
mov eax, esi
pop ss
xor byte [ebx + 0x62], bh
adc eax, 0x47a0361f
imul ebp, dword [edi], 0x40
mov al, byte ss:[0x402f6b47]
cmpsd dword [esi], dword es:[edi]
xor eax, 0x186c7004
imul dword [ebx]
lds edx, [ebx]
mov dword [edi + ebx + 0x7e3e52f], eax
xlatb
les edx, fs:[eax + 0x25]
scasd eax, dword es:[edi]
test eax, 0x5171458a
jle 0x4a3a6a
add byte [ebx + esi*8], dl
por mm0, mm4
js 0x4a3ad3
pop edi
mov ah, 0xff
dec ebx
jo 0x4a3a52
push eax
sub bl, al
jle 0x4a3a28
mov eax, dword [0x17bfaea0]
add al, 0xea
add byte [eax + 0x5d], cl
sub eax, dword fs:[bp + si]
in eax, dx
inc ebx
xor byte [ecx], bl
test byte [ebp + 0x36de7b94], dl
enter 0xffffffffffffc47f, 0xffffffffffffffd5
invalid

Function at 0x4a5fec
Capabilities:
Encode data using xor

Disassembly:
hlt
push ecx
sal dword [esi - 0x5d4faaeb], 1
aaa
mov byte [ebx + 0x7764fc8c], 0x20
and cl, byte [edi]
invalid
and byte [edx], ah
invalid
mov byte [0x48ca4cf0], al
dec eax
push ecx
add al, 0x32
imul esp, dword [eax], 0x44f6d098
je 0x4a6044
in eax, 0xb7
in al, 0x1b
outsb dx, byte [esi]
aad 0x56
rol byte [edi], cl
fcomp dword [ecx]
jle 0x4a5ff0
in eax, 0xb8
in al, 0x19
mov dl, 0x51
loop 0x4a5fcd
loopne 0x4a5fb2
push edx
xchg esi, eax
loopne 0x4a5fdc
inc ecx
and eax, 0x83e8eb7b
jmp 0x4a6004
add dword [edx], 0x20
and eax, edx
xor al, 0xc0
xlatb
and eax, 0xaf34ee45
test dword fs:[esi - 0xd], esi
xor byte [edx], dh
jae 0x4a60ad
jge 0x4a6096
xchg edi, eax
les eax, [eax + ebx*4 - 0x3b]
call 0x536f722
lcall 0x2bef, 0x4a0e1410
mov byte [0xb0bc3339], al
invalid
sub esp, dword [edx - 0x4f43ccc7]
cdq
pop ebp
mov dh, 0xfd
movsb byte es:[edi], byte [esi]
lea eax, [edx + 0x54418945]
mov al, byte [0xd1322c22]
xchg edi, eax
xor al, 0xb0
loopne 0x4a6038
mov esp, 0x7cae7ef
push ss
pop ebp
stc
stosd dword es:[edi], eax
or dword [ebx], ebp
xchg ebp, eax
mov bh, 0x56
ret
lcall 0x157f, 0xe517af6a
pop ds
and al, 0x20
xor eax, 0x78cd9bef
wait
int 0x78
Function at 0x4dd7c4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.004e67d3
mov dword [esp + 0x28], 0
test esi, esi
jne 0x4dd80a
xor eax, eax
jmp 0x4dd80d
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.004e6e08
lea eax, [edi + 0x7c]
test eax, eax
je 0x4dd828
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.004e716d
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x4dd866
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.004e716d
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.004e64ed
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.004e6e89
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4eba68
Capabilities:
Encode data using xor

Disassembly:
xlatb
and edx, edx
jmp 0x4eba49
and al, 0x46
add al, 0x2a
adc dword [edi + 0x15], esi
movsb byte es:[edi], byte [esi]
salc
les eax, [esi + ecx - 9]
pop ecx
adc ah, byte [0x9fffe928]
cwde
inc edx
or al, 0xd5
js 0x4eba3c
call 0x4b72a293
push 0x7e
jg 0x4eba9e
je 0x4eba90
pushal
jp 0x4eba78
scasb al, byte es:[edi]
cwde
shl dword [ebp - 0x2752c9b3], 0x13
lodsd eax, dword [esi]
fcom dword [ebx]
sub al, 0xe1
iretd
outsd dx, dword [esi]
xchg ebp, eax
lodsb al, byte [esi]
push ss
jae 0x4ebafd
aam 0xd6
aam 0xd6
test eax, esi
invalid

Function at 0x4ef656
Capabilities:
Encode data using xor

Disassembly:
push ecx
pop ebx
mov al, 0x97
cli
pushfd
sbb byte [edi + 0x6042e6f3], dl
out 0x42, al
pushal
mov byte [0x1f78e224], al
xor dl, byte [edx + 0x77]
wait
in al, 0x51
jle 0x4ef6c1
loope 0x4ef6d7
loop 0x4ef6d0
pop ss
jecxz 0x4ef65e
std
mov edx, 0x35787b65
and ah, bh
push cs
ret
invalid
xchg ecx, eax
in eax, dx
cmp ecx, dword [ecx + ebx*4 - 0x5dc403ad]
sub ch, byte [ebx - 0x2a]
Function at 0x525cb0
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x1881e651
xor eax, 0x848ff68b
test byte [esp + edi*4 - 0x51], ah
aam 0xe1
mov byte [0x55202b8d], al
push ebp
fisub word [ebp + 0x5a13e7b]
fistp dword [edi + 0x28]
xor al, 0x11
imul esi, dword [edx - 0x612b9f06], 0xffffffc9
leave
mov bh, 0xd3
cld
sbb al, 0x29
in eax, 4
jecxz 0x525c9d
cmpsb byte [esi], byte es:[edi]
sub eax, 0x45521024
mov byte [eax], al
jno 0x525c89
push esp
cmp dword [ecx + 0x7ee5804b], 0xffffffc7
clc
loopne 0x525cff
mov eax, 0xef5195af
mov eax, dword [0x37151a2b]
mov edi, 0xc91cee11
sbb al, 0xc9
mov byte [eax - 0x5b27b4ce], bh
mov eax, 0xa4d84b32
mov cl, 0xd2
adc cl, byte [edi - 9]
mov dh, 0xff
lodsd eax, dword [esi]
rcl byte [ecx + 0x574a78df], cl
jno 0x525caf
lcall 0x817a, 0xacfb9a04
adc eax, 0xdc9f7992
lodsb al, byte [esi]
cld
call 0x95271da8
fsubr qword [esp + edi*8 - 0x2b3f5e18]
xchg esp, eax
push esp
dec edi
xor bh, byte [edx - 0x28]
sub dword [edi + 0x3346d93f], edx
cmp eax, 0xc3b66176
sub dword [eax + 0x7d46e2e9], esp
in eax, 0x38
loopne 0x525cdc
cmp esi, edi
or dh, ch
outsd dx, dword [esi]
imul ecx, esi, 2
inc ebp
inc esp
mov dh, 0xbe
xor eax, 0x570e0b38
pop esp
mov ah, byte [edx - 0xb]
outsb dx, byte [esi]
add edi, dword [ebx]
sub esi, dword [edx - 0x6124af04]
rol dword [edx - 0x18fe2a3a], cl
cmp dword [ecx - 0x5f], esp
dec edi
jmp 0x525cdf

Function at 0x530c66
Capabilities:
Encode data using xor

Disassembly:
cmp al, 0x17
and al, 6
push es
push es
mov ecx, 0x6a11bc26
imul edx, dword [ebx - 0x5e], 0xe236fc09
mov esp, 0x5430fee
xor esi, edx
mov dh, 0x43
sbb eax, 0x8ae58fcb
movsb byte es:[edi], byte [esi]
insb byte es:[edi], dx
jno 0x530c63
inc eax
xor ebx, ebx
in al, dx
sub esi, dword fs:[ebx]
adc al, 0x99
push es
outsb dx, byte [esi]
or dword [edx - 0x5c], esi
js 0x530cfc
idiv dh
imul byte [eax + edi]
test dword [esi - 0x2e], esi
rcr dh, cl
daa
push esp
retf 0x3f11
Function at 0x532b7e
Capabilities:
Encode data using xor

Disassembly:
mov esi, ebx
xor byte es:[ecx + 0x64], ch
push es
lodsb al, byte [esi]
dec esp
rcl byte [edi], cl
in eax, 0xc7
mov al, 0x4d
jo 0x532bfd
mov al, byte [0xd4377528]
xchg byte [esi - 0xfcc042e], cl
xor dh, ch
ror byte [ecx + ebp*8 - 0x30], 1
pop edi
xchg ecx, eax
in al, dx
cdq
lea esp, [ebx]
int 0x1e
cmp esi, esp
jnp 0x532bdc
cmp eax, 0xa56124d3
adc dh, ch
add al, byte [ebx]
pop ecx
out 0xde, al
shr bl, 1
xchg esi, eax
mov ecx, 0xf638c295
clc
clc
xor cl, byte [esp + edi + 0x5851964a]
cmp al, 0x4a
xchg esi, eax
push ecx
pop eax
outsb dx, byte [esi]
pop esi
and byte [ebx], dh
xor al, 0xf6
add dword [ebx], eax
mov dl, byte [0x4f2c68be]
adc eax, 0x4f2c68be
out dx, al
jle 0x532bc4
test al, 0x84
xchg esp, eax
clc
xor ah, byte [edx - 0x20983ccf]
push edi
in al, dx
pop esi
sbb dh, byte [esp]
pushal
pop ss
adc dh, byte [edi]
daa
mov ah, 0xec
sbb byte [ebx + 4], dh
dec byte [ebx + 0x4ed9c6e5]
fist dword [ebx - 0x67]
cdq
pop ecx
mul byte [eax]
cmpsb byte [esi], byte es:[edi]
pop ebx
mov dh, byte [esp + edi*2 - 0x4f9acef4]
pop eax
push ebx
pop ss
jae 0x532c2b
or byte [ecx + 0x4d5086b1], 0x77
mov dword [0x879d9b50], eax
fild qword [eax - 0x7c]
test al, 0x26
cmp al, 0xd2
sbb dh, ah
push edx
cmp eax, 0x360570a5
push ss
push ss
test byte [eax - 0x75], al
bnd je 0x532c5d
sbb bh, byte [edx]
sahf
jb 0x532bd2
invalid
nop
stosb byte es:[edi], al
and ah, byte [esi - 0x7a]
sub dword [edi - 0x3baab360], ebp
in eax, 0x64
and eax, dword [edi - 0x4b]
pop ecx
ret 0x647

Function at 0x60fa35
Capabilities:
Encode data using xor

Disassembly:
test byte [ebx + 0x541d3e09], bh
sub ch, cl
sub esp, ebx
popfd
sub ebx, dword [ebp + 0x3a]
int 0xc6
stc
or dword [edx], ecx
cmpsb byte [esi], byte es:[edi]
ret 0xe254
mov ebp, 0x6f281878
inc edi
cmp eax, 0xef887cf0
mov ebx, 0x9da3ccf2
push ss
mov ah, 3
add edx, dword [ebx]
dec edi
add dword [ebp - 0x7c], edi
add edx, dword [ebx]
dec edi
add dword [ebp - 0x7c], edi
or ebp, ebx
inc ebp
pushal
mov ebp, cs
addps xmm3, xmmword [esp + ebx]
dec ebp
xor ebp, dword [edi]
or byte [edi + ecx*2 + 0x78], cl
and eax, dword [0xea78eaad]
xchg edi, edx
jbe 0x60fa23
invalid
Function at 0x616caa
Capabilities:
Encode data using xor

Disassembly:
pushfd
fnstenv [edx - 0x42ca6276]
sub eax, 0xb2acce20
xor bh, byte [ecx + eax*4]
cmp ecx, dword [ebp + 0xb91ba4d]
mov edi, 0xb8a2d114
lea esi, [edx + 0x5e34d396]
invalid
push 0x9e44f894
jo 0x616c99
sbb eax, 0x2cc58d3a
pop edx
xor al, 0x7b
push cs
push 0xa
dec edx
loopne 0x616d2c
fsubp st(0)
mov dword [0xcb40bcc8], eax
mov ah, 0xd3
jge 0x616d37
into
shl dword [ecx - 0xb], 0x58
add al, 0x7e
mul dword [edx - 0x7145dc4e]
xor ch, dl
lodsd eax, dword [esi]
cmp esp, dword [ecx*8 - 0x1153e2c]
sub ch, byte [ebp + edi*8 - 0x76]
out dx, al
test dl, 0x57
fadd qword [ebx - 0x476132a6]
adc esp, dword [ebp + 0x45]
sub byte [eax + 0x31], ch
cmp al, 0x19
push esi
cli
and dh, byte [eax + 0x1a]
sbb al, 0xec
aaa
fcmovnu st(0), st(4)
sbb eax, 0x7708cee8
xchg ecx, eax
insd dword es:[edi], dx
or eax, 0x89dd89a7
and al, 0x59
insb byte es:[edi], dx
mov cl, 0x6c
sbb cl, byte [edi + eax]
add dword [ecx], esi
mov bh, 8
mov eax, dword [0x1cf5ccc8]
or byte [ecx + 0x1cf5ccc8], ah
les ebp, [esi]
jmp 0x616cbe
invalid
Function at 0x1000154f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x20]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [esi], eax
mov ecx, dword [ecx]
cmp ecx, dword [ebp + 0x10]
je 0x100016ad
mov eax, ecx
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x1c]
xor ebx, ebx
inc ebx
mov edi, 0x3ff
mov ecx, eax
cmp dword [esi], edx
je 0x100016ad
mov edx, dword [ebp + 8]
movzx ecx, word [eax]
mov eax, ecx
mov byte [ebp + 0x23], 0
movzx edx, word [edx]
cmp bx, dx
jae 0x100015cd
lea eax, [ecx + 0x2400]
cmp ax, di
ja 0x100016bc
mov eax, edx
lea ebx, [ecx - 0xdc00]
shl eax, 0xa
or ebx, eax
mov cl, byte [ebp + 0x23]
cmp ebx, 0x80
jae 0x100015ea
mov dl, bl
xor edi, edi
jmp 0x1000161a
mov ebx, eax
lea eax, [ecx + 0x2800]
cmp ax, di
ja 0x100015bc
add ebx, 0xffff2840
mov cl, 1
shl ebx, 0xa
mov byte [ebp + 0x23], cl
jmp 0x100015bf
mov edx, ebx
cmp ebx, 0x800
jae 0x100015ff
shr edx, 6
xor edi, edi
or dl, 0xc0
inc edi
jmp 0x1000161a
cmp ebx, 0x10000
jae 0x10001611
shr edx, 0xc
or dl, 0xe0
push 2
jmp 0x10001619
shr edx, 0x12
or dl, 0xf0
push 3
pop edi
movzx eax, cl
mov ecx, dword [ebp - 4]
xor eax, 1
add eax, eax
cmp edi, 3
cmovb eax, edi
mov dword [ebp - 8], eax
inc eax
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x1c]
sub eax, dword [esi]
cmp eax, dword [ebp + 0x18]
jl 0x100016ad
mov eax, ecx
mov ecx, dword [ebp + 0x14]
add eax, 2
cmp byte [ebp + 0x23], 0
mov dword [ecx], eax
jne 0x10001651
cmp edi, 3
jae 0x1000165c
mov eax, dword [esi]
mov byte [eax], dl
inc dword [esi]
mov eax, dword [ebp - 8]
jmp 0x1000165f
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x10001684
imul ecx, edi, 6
sub ecx, 6
mov edx, ebx
dec eax
shr edx, cl
mov dword [ebp + 0x18], eax
and dl, 0x3f
mov eax, dword [esi]
or dl, 0x80
mov byte [eax], dl
inc dword [esi]
mov eax, dword [ebp + 0x18]
test eax, eax
jg 0x10001666
xor ecx, ecx
shr ebx, 0xa
inc ecx
movzx eax, bx
cmp byte [ebp + 0x23], 0
cmovne ecx, eax
mov eax, dword [ebp + 8]
mov word [eax], cx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, ecx
mov dword [ebp - 4], eax
cmp ecx, dword [ebp + 0x10]
jne 0x10001577
xor eax, eax
cmp dword [ebp + 0xc], ecx
sete al
pop edi
pop esi
pop ebx
leave
ret 0x1c
push 2
pop eax
jmp 0x100016b5
Function at 0x10009064
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx]
and dword [ebp - 4], 0
push esi
mov dword [ecx + 4], eax
lea esi, [ecx + 0x1c]
lea eax, [ebp - 4]
push eax
lea eax, [ecx + 0xc]
push esi
push eax
call fcn.10002c25
push 0x20
push 0x100a64c8
push esi
call fcn.1007b280
add esp, 0x18
pop esi
leave
ret

Function at 0x10009e31
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], edx
push esi
mov esi, ecx
mov dword [ebp - 8], esi
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x10009e5c
jl 0x10009e53
test edi, edi
jne 0x10009e5c
xor eax, eax
xor edx, edx
jmp 0x10009f0c
cmp dword [esi + 0x38], 0
je 0x10009e6f
push eax
push edi
push edx
call fcn.10009f16
jmp 0x10009f0c
mov eax, dword [esi + 0x1c]
push ebx
mov ebx, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10009ea9
mov eax, dword [esi + 0x2c]
cmp dword [eax], 0
jbe 0x10009ea9
cmp dword [eax], edi
mov esi, edi
cmovb esi, dword [eax]
push esi
push ecx
push edx
call fcn.1007b280
mov ecx, dword [ebp - 8]
sub ebx, esi
add dword [ebp - 4], esi
add esp, 0xc
mov eax, dword [ecx + 0x2c]
sub dword [eax], esi
mov eax, dword [ecx + 0x1c]
add dword [eax], esi
mov esi, ecx
cmp dword [esi + 0x4c], 0
mov ecx, ebx
je 0x10009f01
mov ecx, esi
call fcn.10007eb5
mov edx, dword [ebp - 4]
mov ecx, ebx
jmp 0x10009ee1
push dword [esi + 0x4c]
push eax
push 1
push edx
call fcn.1007e382
mov edx, dword [ebp - 4]
sub ebx, eax
add edx, eax
add esp, 0x10
mov dword [ebp - 4], edx
mov ecx, ebx
cmp eax, 0xfff
jne 0x10009f12
mov eax, 0xfff
cmp ebx, eax
ja 0x10009ebf
test ecx, ecx
je 0x10009f01
push dword [esi + 0x4c]
push ebx
push 1
push edx
call fcn.1007e382
mov ecx, ebx
add esp, 0x10
sub ecx, eax
sub edi, ecx
mov edx, dword [ebp + 0x10]
mov eax, edi
sbb edx, 0
pop ebx
pop edi
pop esi
leave
ret 0xc
sub edi, ebx
jmp 0x10009f03
Function at 0x10012df2
Capabilities:
Authenticate hmac

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x10012e10
call fcn.100138eb
test al, al
jne 0x10012e10
mov dword [esi + 0x40], str.invalid_BOM__must_be_0xEF_0xBB_0xBF_if_given
push 0xe
pop eax
pop esi
ret
mov ecx, esi
call fcn.10012366
mov eax, dword [esi + 8]
cmp eax, 0x20
je 0x10012e10
cmp eax, 9
je 0x10012e10
cmp eax, 0xa
je 0x10012e10
cmp eax, 0xd
je 0x10012e10
cmp eax, 0x36
jg 0x10012e89
je 0x10012e58
cmp eax, 0x30
jg 0x10012e70
je 0x10012e58
cmp eax, 0xffffffff
je 0x10012e6c
test eax, eax
je 0x10012e6c
cmp eax, 0x22
je 0x10012e64
cmp eax, 0x2c
je 0x10012e60
cmp eax, 0x2d
jne 0x10012ed8
mov ecx, esi
pop esi
jmp fcn.10012f58
push 0xd
jmp 0x10012e0d
mov ecx, esi
pop esi
jmp fcn.1001329e
push 0xf
jmp 0x10012e0d
sub eax, 0x31
je 0x10012e58
sub eax, 1
je 0x10012e58
sub eax, 1
je 0x10012e58
sub eax, 1
je 0x10012e58
sub eax, 1
jmp 0x10012e52
cmp eax, 0x5d
jg 0x10012ebe
je 0x10012eb7
sub eax, 0x37
je 0x10012e58
sub eax, 1
je 0x10012e58
sub eax, 1
je 0x10012e58
sub eax, 1
je 0x10012eb0
sub eax, 0x21
jne 0x10012ed8
push 8
jmp 0x10012e0d
push 0xc
jmp 0x10012e0d
push 0xa
jmp 0x10012e0d
sub eax, 0x66
je 0x10012f08
sub eax, 8
je 0x10012efd
sub eax, 6
je 0x10012ef2
sub eax, 7
je 0x10012eeb
dec eax
sub eax, 1
je 0x10012ee4
mov dword [esi + 0x40], str.invalid_literal
jmp 0x10012e0b
push 0xb
jmp 0x10012e0d
push 9
jmp 0x10012e0d
push 1
push 4
push str.true
jmp 0x10012f11
push 3
push 4
push str.null
jmp 0x10012f11
push 2
push 5
push str.false
mov ecx, esi
call fcn.10012f1a
pop esi
ret
Function at 0x10020150
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
sub esp, 0x18
mov eax, dword [0x100ca1f4]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x1002021b
lea eax, [esp + 4]
push eax
push esi
push 2
call fcn.1003b590
add esp, 0xc
test eax, eax
jne 0x1002021b
lea eax, [esp + 8]
push eax
push esi
push 0x17
call fcn.1003b590
add esp, 0xc
test eax, eax
jne 0x1002021b
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x100201a4
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.1003b560
add esp, 0xc
test eax, eax
je 0x100201d8
sub eax, esi
push eax
push 0x2e
push esi
call fcn.1003b560
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x100201da
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x10020206
mov al, byte [esi]
push eax
call fcn.1002e840
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x100201e8
pop edi
movzx eax, bl
pop ebx
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10078caf
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
xor eax, eax
pop esi
xor ecx, esp
call fcn.10078caf
add esp, 0x18
ret
Function at 0x1002aa90
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov eax, dword [0x100ca1f4]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x118]
mov edx, dword [esp + 0x114]
push ebx
mov ebx, dword [esp + 0x114]
mov dword [esp + 8], eax
xor eax, eax
push ebp
mov ebp, dword [esp + 0x128]
mov ecx, dword [ebx + 0x424]
cmp edx, ecx
push esi
sete al
mov esi, 0x448
push edi
lea eax, [eax*4 + 0x420]
mov eax, dword [eax + ebx]
mov dword [esp + 0x10], eax
mov eax, 0x458
cmove esi, eax
mov eax, dword [ebx + 0x548]
add esi, ebx
mov edi, dword [esi + 4]
sub edi, dword [esi + 8]
test byte [eax + 0x40], 3
je 0x1002ab9e
xor eax, eax
cmp edx, ecx
sete al
lea eax, [eax*4 + 0x438]
cmp dword [eax + ebx], 0x1002a650
jne 0x1002ab9e
cmp dword [esi], 0
je 0x1002ab28
test edi, edi
je 0x1002ab9e
push 0
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [esp + 0x20]
call fcn.10039d30
add esp, 0x14
cmp eax, 0xffffffff
je 0x1002ab9e
test al, 1
je 0x1002ab9e
mov ecx, dword [esi]
test ecx, ecx
jne 0x1002ab7b
mov eax, dword [ebx]
mov eax, dword [eax + 0x90c]
add eax, eax
push eax
mov dword [esi + 4], eax
call dword [0x100ca090]
mov edi, dword [esi + 4]
mov ecx, eax
add esp, 4
mov dword [esi], ecx
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
test ecx, ecx
je 0x1002ab97
mov eax, dword [esi + 8]
push 0
push edi
add eax, ecx
push eax
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1002ab9e
add dword [esi + 8], eax
jmp 0x1002ab9e
mov dword [esi + 4], 0
push 0
push dword [esp + 0x130]
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1002ac07
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x1002abd8
mov dword [ebp], 0
lea eax, [edi + 0x52]
jmp 0x1002ac0c
push 0x100
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.10017800
push eax
push str.Send_failure:__s
push dword [ebx]
call fcn.1002a390
mov eax, dword [ebx]
add esp, 0x18
mov dword [eax + 0xd44], esi
mov eax, 0x37
jmp 0x1002ac09
xor eax, eax
mov dword [ebp], edi
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10078caf
add esp, 0x10c
ret

Function at 0x1002b030
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
cmp byte [eax + 0x474], 0
je 0x1002b04d
push eax
call fcn.10024870
add esp, 4
test eax, eax
jne 0x1002b06c
xor al, al
ret
mov eax, dword [eax + 0x420]
cmp eax, 0xffffffff
je 0x1002b04a
push 2
push 1
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x1002b04a
mov al, 1
ret
Function at 0x1002cdf0
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push 0x100ab2dc
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x1002ce0a
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x100ab2f8
push esi
call fcn.100891f0
add esp, 8
test eax, eax
je 0x1002ce52
test ebp, ebp
je 0x1002ce43
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x1002ce78
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002ce78
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x1002cf2f
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002ce95
sub ecx, ebx
lea eax, [edx + 1]
add eax, ecx
push eax
call dword [0x100ca090]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1002cf25
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1002cf25
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002cec7
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002cee0
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x1002cef0
test ebp, ebp
je 0x1002cf1c
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x100ca094]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x100ca094]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret
Function at 0x10032440
Capabilities:
Create udp socket

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x10032454
mov eax, dword [eax]
mov eax, dword [eax + 0x78]
mov al, byte [eax + 0xe7]
ret
push 0
push 2
push 0x17
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x10032468
xor al, al
ret
push eax
push 0
call fcn.1002af60
add esp, 8
mov al, 1
ret