joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1a55f0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, 0xffffffff
cmp dword [esp + 0x2c], 0
je 0x1a57e4
mov esi, dword [esp + 0x30]
test esi, esi
je 0x1a57e4
mov ecx, dword [esp + 0x34]
test ecx, ecx
je 0x1a57e4
cmp dword [ecx], 0
jne 0x1a57e4
push esi
call fcn.001ac770
add esp, 4
test eax, eax
je 0x1a565a
mov ecx, 0x1505
xor ebx, ebx
nop
nop
nop
nop
movzx edx, byte [esi + ebx]
test edx, edx
je 0x1a5661
mov edi, ecx
shl edi, 5
add edi, ecx
add edi, edx
inc ebx
mov ecx, edi
cmp eax, ebx
jne 0x1a5640
jmp 0x1a5663
mov edi, 0x1505
jmp 0x1a5663
mov edi, ecx
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x20]
lea ebx, [edx - 1]
mov dword [esp + 0xc], edx
sub edx, 1
mov dword [esp + 0x10], edx
jae 0x1a5736
mov ebp, 0xffffffff
mov eax, dword [ecx + 0x18]
cmp eax, dword [ecx + 0x1c]
jb 0x1a56c3
call fcn.001a58d0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
mov esi, dword [esp + 0x30]
jne 0x1a57e4
push esi
call fcn.001ac770
add esp, 4
mov edx, esi
lea esi, [esp + 0x14]
mov ecx, dword [esp + 0x2c]
push esi
push edi
push eax
call fcn.001a57f0
add esp, 0xc
mov ebp, eax
mov esi, dword [esp + 0x30]
push esi
call fcn.001ac770
add esp, 4
mov ebx, eax
inc eax
push eax
call dword [0x1ea008]
add esp, 4
test eax, eax
je 0x1a57df
mov byte [eax + ebx], 0
push ebx
push esi
push eax
mov esi, eax
call fcn.001ac660
add esp, 0xc
mov edx, dword [esp + 0x2c]
mov eax, dword [edx + 0xc]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 4]
mov ecx, dword [edx + 0x18]
mov dword [eax + ebp*4], ecx
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x34]
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x14]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], ebp
mov eax, dword [edx + 8]
mov ecx, dword [edx + 0x18]
mov dword [eax + ecx*4], edi
inc dword [edx + 0x18]
mov eax, dword [edx]
mov dword [esi], eax
xor eax, eax
jmp 0x1a57e4
mov dword [esp + 4], eax
and ebx, edi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
xor esi, esi
mov edx, ebx
mov dword [esp], ebx
jmp 0x1a5765
mov eax, esi
xor eax, 1
and esi, 1
lea esi, [eax + esi*2]
cmp esi, dword [esp + 0xc]
jae 0x1a567e
lea ebp, [esi + edx]
and ebp, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov ebx, dword [eax + ebp*4]
cmp ebx, 0xffffffff
je 0x1a5683
mov eax, dword [ecx + 8]
cmp dword [eax + ebx*4], edi
jne 0x1a5750
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax + ebx*4]
push ebp
call fcn.001ac770
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp + 4]
jne 0x1a5750
push dword [esp + 4]
push ebp
push dword [esp + 0x38]
call fcn.001ac790
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0x1a5750
mov eax, dword [ecx + 0x10]
push dword [eax + ebx*4]
call fcn.001a4670
mov edx, dword [esp + 0x30]
add esp, 4
mov eax, dword [edx + 0x10]
mov esi, dword [esp + 0x34]
mov dword [eax + ebx*4], esi
jmp 0x1a572b
mov eax, 0xffffffff
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1a6870
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x28]
test ebp, ebp
je 0x1a6a16
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
movzx edi, cx
shr ecx, 0x10
test esi, esi
je 0x1a6a0f
mov edx, 0x5e6ea9af
mov eax, esi
mul edx
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, esi
sub edx, eax
jmp 0x1a6905
mov eax, dword [esp]
sub eax, dword [esp + 4]
add ebp, eax
mov esi, dword [esp + 8]
mov eax, edi
mov edx, 0x80078071
mul edx
mov ebx, edx
shr ebx, 0xf
mov eax, ecx
mov edx, 0x80078071
mul edx
imul eax, ebx, 0xfff1
sub edi, eax
shr edx, 0xf
imul eax, edx, 0xfff1
sub ecx, eax
sub esi, dword [esp]
mov edx, 0x15b0
je 0x1a6a0f
xor ebx, ebx
cmp edx, 8
mov dword [esp], edx
mov dword [esp + 8], esi
jb 0x1a697e
mov ebx, edx
and ebx, 0x1ff8
xor eax, eax
nop
nop
nop
mov edx, eax
movzx eax, byte [ebp + eax]
add eax, edi
add ecx, eax
movzx esi, byte [ebp + edx + 1]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 2]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 3]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 4]
add eax, esi
add ecx, eax
movzx esi, byte [ebp + edx + 5]
add esi, eax
add ecx, esi
movzx eax, byte [ebp + edx + 6]
add eax, esi
add ecx, eax
movzx edi, byte [ebp + edx + 7]
add edi, eax
add ecx, edi
lea eax, [edx + 8]
add edx, 0xf
cmp edx, dword [esp]
mov edx, dword [esp]
jb 0x1a6920
add ebp, eax
mov esi, dword [esp + 8]
mov eax, ebx
sub eax, edx
jae 0x1a68cd
mov dword [esp + 0xc], eax
mov eax, edx
and eax, 3
mov dword [esp + 4], ebx
je 0x1a69c0
neg eax
xor ebx, ebx
mov edx, ebp
nop
nop
nop
movzx esi, byte [edx]
inc edx
add edi, esi
add ecx, edi
dec ebx
cmp eax, ebx
jne 0x1a69a0
mov eax, dword [esp + 4]
sub eax, ebx
cmp dword [esp + 0xc], 0xfffffffc
ja 0x1a68c0
jmp 0x1a69cf
mov eax, ebx
mov edx, ebp
cmp dword [esp + 0xc], 0xfffffffc
ja 0x1a68c0
mov ebx, dword [esp]
sub ebx, eax
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [edx + eax]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 1]
add edi, esi
add ecx, edi
movzx esi, byte [edx + eax + 2]
add esi, edi
add ecx, esi
movzx edi, byte [edx + eax + 3]
add edi, esi
add ecx, edi
add eax, 4
cmp ebx, eax
jne 0x1a69e0
jmp 0x1a68c0
shl ecx, 0x10
or ecx, edi
jmp 0x1a6a1b
mov ecx, 1
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1a6a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x1a6a8e
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
test edx, edx
je 0x1a6a90
not eax
xor esi, esi
nop
nop
nop
nop
movzx edi, byte [ecx + esi]
mov ebx, eax
shr ebx, 4
mov ebp, eax
not ebp
or ebp, 0xf
add eax, ebp
inc eax
mov ebp, edi
and ebp, 0xf
xor ebp, eax
xor ebx, dword [ebp*4 + 0x1e7c50]
mov eax, ebx
shr eax, 4
and ebx, 0xf
shr edi, 4
xor edi, ebx
xor eax, dword [edi*4 + 0x1e7c50]
inc esi
cmp edx, esi
jne 0x1a6a50
not eax
jmp 0x1a6a90
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1ac510
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov edi, edx
mov eax, dword [esp + 0x14]
mov edx, dword [edx + 8]
mov esi, 1
cmp edx, eax
jae 0x1ac580
cmp dword [esp + 0x18], 0
je 0x1ac55e
cmp edx, 1
adc edx, 0
cmp edx, eax
jae 0x1ac562
mov ebx, edx
nop
nop
nop
nop
nop
nop
nop
mov ebp, edx
or ebp, 2
and ebx, 2
imul ebp, ebx
and edx, 0xfffffffd
xor ebx, 2
imul ebx, edx
add ebx, ebp
mov edx, ebx
cmp ebx, eax
jb 0x1ac540
jmp 0x1ac564
mov ebx, eax
jmp 0x1ac564
mov ebx, edx
push ebx
push dword [edi + 0xc]
push dword [edi]
push dword [ecx + 0x34]
call dword [ecx + 0x30]
add esp, 0x10
test eax, eax
je 0x1ac57e
mov dword [edi], eax
mov dword [edi + 8], ebx
jmp 0x1ac580
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1b2ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x140
mov word [esp + 0x50], 0xff59
mov dword [esp + 0x52], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x1b2d14
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x50]
mov edx, eax
xor edx, 0x13a51b55
and eax, 0x13a51b55
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0xb8], eax
mov eax, dword [esp + 0xb8]
add al, 0x57
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x50], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 6
jb 0x1b2cd0
lea edi, [esp + 0x50]
push edi
push dword [ebp + 8]
call fcn.001a4420
add esp, 8
mov esi, eax
xor eax, eax
test esi, esi
sete al
jmp dword [eax*4 + 0x1eb77c]
Function at 0x1bb0c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebp, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov edi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + edi + 2], 0
lea edi, [edi + 2]
jne 0x1bb0e0
mov esi, dword [eax + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x1bb100
sar edi, 1
sar eax, 1
lea ecx, [edi + eax]
add ecx, 2
test ecx, ecx
jns 0x1bb120
mov eax, 0xffffffff
jmp 0x1bb129
add eax, edi
lea eax, [eax*2 + 4]
push eax
call fcn.001ac630
add esp, 4
mov ebx, eax
movzx ecx, word [esi]
test cx, cx
je 0x1bb161
add esi, 2
mov eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x1bb150
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [ebp]
test cx, cx
je 0x1bb191
lea edx, [ebp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x1bb180
mov word [eax], 0
lea eax, [esp + 0xc]
push 0x60
push 3
push 0x120089
push eax
push ebx
call fcn.001e5330
add esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x14], ebx
jmp dword [eax*4 + 0x1ebde8]
Function at 0x1bb450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xab0
mov eax, dword [ebp + 0xc]
mov esi, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [eax + esi + 2], 0
lea esi, [esi + 2]
jne 0x1bb470
sar esi, 1
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push esi
push eax
push 0
call dword [0x1f1b9c]
mov ebx, dword [esp + 0x2c]
mov edi, 0xffffffff
test ebx, ebx
jns 0x1bb4a4
mov eax, 0xffffffff
jmp 0x1bb4a7
lea eax, [ebx + ebx]
push eax
call fcn.001ac630
add esp, 4
lea ecx, [esp + 0x2c]
push ecx
push ebx
mov ebx, eax
push eax
push esi
push dword [ebp + 0xc]
push 0
call dword [0x1f1b9c]
mov eax, dword [esp + 0x2c]
mov ecx, eax
add ecx, 0xd
js 0x1bb4d7
lea edi, [eax*2 + 0x1a]
push edi
call fcn.001ac630
add esp, 4
mov esi, eax
mov dword [esp + 0x200], 0xd782c9ac
mov dword [esp + 0x204], 0xd3add5b5
mov dword [esp + 0x208], 0xdffed1ac
mov dword [esp + 0x20c], 0xdbb7dd86
mov dword [esp + 0x210], 0xe799d9a6
mov dword [esp + 0x214], 0xe391e58d
mov dword [esp + 0x218], 0xefeee192
mov dword [esp + 0x48], 0
mov eax, dword [esp + 0x48]
cmp eax, 0x1b
ja 0x1bb59d
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x48]
movzx eax, byte [esp + eax + 0x200]
mov edx, ecx
xor edx, 0xb0dbeb4e
mov edi, ecx
xor edi, 0x4f2414b1
or ecx, 0x30dbeb4e
and ecx, edi
lea ecx, [edx + ecx*2]
mov edx, ecx
and edx, eax
add ecx, eax
add edx, edx
sub ecx, edx
mov dword [esp + 0x6a0], ecx
mov eax, dword [esp + 0x6a0]
add al, 0x7a
mov ecx, dword [esp + 0x48]
mov byte [esp + ecx + 0x200], al
inc dword [esp + 0x48]
mov eax, dword [esp + 0x48]
cmp eax, 0x1c
jb 0x1bb540
movzx ecx, word [ebx]
mov eax, esi
test cx, cx
je 0x1bb5c1
lea edx, [ebx + 2]
mov eax, esi
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x1bb5b0
mov word [eax], 0
movzx ecx, word [esp + 0x200]
test cx, cx
mov dword [esp + 0x1c], ebx
je 0x1bb5f1
lea edx, [esp + 0x202]
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x1bb5e0
mov word [eax], 0
lea eax, [esp + 0x640]
push 0x60
push 3
push 0x120089
push eax
push esi
call fcn.001e5330
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x1ec0c0]
Function at 0x1c1170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x1c1190
cmp eax, 0xffffffdd
jge 0x1c11a7
mov eax, 0xffffffff
jmp 0x1c11aa
add eax, 0x22
push eax
call fcn.001ac630
add esp, 4
mov esi, eax
mov dword [esp + 8], 0xb92fbbe8
mov dword [esp + 0xc], 0xbd2fbf2c
mov dword [esp + 0x10], 0xb1d5b32a
mov dword [esp + 0x14], 0xb52db729
mov dword [esp + 0x18], 0xa9ceabd8
mov dword [esp + 0x1c], 0xad34af33
mov dword [esp + 0x20], 0xa129a3cb
mov dword [esp + 0x24], 0xa532a73c
mov word [esp + 0x28], 0xdba4
mov dword [esp + 0x2a], 0
mov byte [esp + 0x2e], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x26
ja 0x1c126a
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0xc3a7109f
and eax, 0xc3a7109f
lea eax, [edx + eax*2]
lea edx, [eax + ecx]
and eax, ecx
mov ecx, edx
xor ecx, eax
add ecx, eax
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x4c]
add al, 0xe5
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x27
jb 0x1c1220
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x1c1291
add ecx, 2
mov eax, esi
nop
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x1c1280
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x1c12c1
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x1c12b0
mov word [eax], 0
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x5c], eax
mov dword [esp + 8], 0xb92bbb17
mov dword [esp + 0xc], 0xbd6dbf36
mov dword [esp + 0x10], 0xb13ab327
mov dword [esp + 0x14], 0xb52db724
mov dword [esp + 0x18], 0xa93fab26
mov dword [esp + 0x1c], 0xad3faf37
mov dword [esp + 0x20], 0xa17fa33e
mov dword [esp + 0x24], 0xa57ba77d
mov dword [esp + 0x28], 0x59b85b7a
mov dword [esp + 0x2c], 0x5dcb5fd3
mov dword [esp + 0x30], 0x51c453c7
mov dword [esp + 0x34], 0x55c75795
mov dword [esp + 0x38], 0x49de4bc6
mov dword [esp + 0x3c], 0x4dc64fd3
mov dword [esp + 0x40], 0x41bd43d8
mov dword [esp + 0x44], 0x458547a4
mov dword [esp + 0x48], 0x797a7b9a
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x43
ja 0x1c13b1
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x23c3dadf
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0xa5
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x44
jb 0x1c1380
lea eax, [esp + 0x4c]
lea ecx, [esp + 8]
push eax
push 0x1c1650
push ecx
push esi
call fcn.001c1f60
add esp, 0x10
jmp dword [0x1ec4f8]
Function at 0x1c1183
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov ebx, dword [esp + 0x7c]
mov ebp, dword [esp + 0x78]
mov edi, dword [esp + 0x74]
mov ecx, dword [ebx + 4]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
cmp word [ecx + eax + 2], 0
lea eax, [eax + 2]
jne 0x1c1190
cmp eax, 0xffffffdd
jge 0x1c11a7
mov eax, 0xffffffff
jmp 0x1c11aa
add eax, 0x22
push eax
call fcn.001ac630
add esp, 4
mov esi, eax
mov dword [esp + 8], 0xb92fbbe8
mov dword [esp + 0xc], 0xbd2fbf2c
mov dword [esp + 0x10], 0xb1d5b32a
mov dword [esp + 0x14], 0xb52db729
mov dword [esp + 0x18], 0xa9ceabd8
mov dword [esp + 0x1c], 0xad34af33
mov dword [esp + 0x20], 0xa129a3cb
mov dword [esp + 0x24], 0xa532a73c
mov word [esp + 0x28], 0xdba4
mov dword [esp + 0x2a], 0
mov byte [esp + 0x2e], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x26
ja 0x1c126a
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0xc3a7109f
and eax, 0xc3a7109f
lea eax, [edx + eax*2]
lea edx, [eax + ecx]
and eax, ecx
mov ecx, edx
xor ecx, eax
add ecx, eax
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x4c]
add al, 0xe5
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x27
jb 0x1c1220
mov ecx, dword [ebx + 4]
movzx edx, word [ecx]
mov eax, esi
test dx, dx
je 0x1c1291
add ecx, 2
mov eax, esi
nop
nop
nop
nop
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x1c1280
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x1c12c1
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x1c12b0
mov word [eax], 0
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebx
mov eax, dword [esp + 0x80]
mov dword [esp + 0x5c], eax
mov dword [esp + 8], 0xb92bbb17
mov dword [esp + 0xc], 0xbd6dbf36
mov dword [esp + 0x10], 0xb13ab327
mov dword [esp + 0x14], 0xb52db724
mov dword [esp + 0x18], 0xa93fab26
mov dword [esp + 0x1c], 0xad3faf37
mov dword [esp + 0x20], 0xa17fa33e
mov dword [esp + 0x24], 0xa57ba77d
mov dword [esp + 0x28], 0x59b85b7a
mov dword [esp + 0x2c], 0x5dcb5fd3
mov dword [esp + 0x30], 0x51c453c7
mov dword [esp + 0x34], 0x55c75795
mov dword [esp + 0x38], 0x49de4bc6
mov dword [esp + 0x3c], 0x4dc64fd3
mov dword [esp + 0x40], 0x41bd43d8
mov dword [esp + 0x44], 0x458547a4
mov dword [esp + 0x48], 0x797a7b9a
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 0x43
ja 0x1c13b1
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 8]
add eax, 0x23c3dadf
xor eax, ecx
mov dword [esp], eax
mov eax, dword [esp]
add al, 0xa5
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 8], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 0x44
jb 0x1c1380
lea eax, [esp + 0x4c]
lea ecx, [esp + 8]
push eax
push 0x1c1650
push ecx
push esi
call fcn.001c1f60
add esp, 0x10
jmp dword [0x1ec4f8]
Function at 0x1c1500
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x30]
mov eax, 0xfffffffe
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x1c1510
cmp eax, 0xffffffed
jge 0x1c1527
mov eax, 0xffffffff
jmp 0x1c152a
add eax, 0x12
push eax
call fcn.001ac630
add esp, 4
mov esi, eax
mov dword [esp + 4], 0x832981dc
mov dword [esp + 8], 0x873f8521
mov dword [esp + 0xc], 0x8be489fc
mov dword [esp + 0x10], 0x8f2c8d28
mov dword [esp + 0x14], 0x9190
mov byte [esp + 0x18], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 0x14
ja 0x1c15b9
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0xa00efa0
and eax, 0xa00efa0
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add al, 0xe0
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 0x15
jb 0x1c1580
movzx ecx, word [edi]
mov eax, esi
test cx, cx
je 0x1c15e1
add edi, 2
mov eax, esi
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x1c15d0
mov word [eax], 0
movzx ecx, word [esp + 4]
test cx, cx
je 0x1c1611
lea edx, [esp + 6]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x1c1600
mov word [eax], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.001e5500
add esp, 8
mov edi, eax
mov ebx, dword [esp + 4]
jmp dword [0x1ec500]
Function at 0x1c7860
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x850
mov dword [esp + 0xc], 0
xor edi, edi
mov eax, 0x20219
mov ecx, 1
mov dword [esp + 8], 0
jmp dword [ecx*4 + 0x1ed37c]
Function at 0x1cb970
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x90
mov eax, dword [0x1f1b9c]
mov dword [esp + 0x24], 0x4f8f496d
mov dword [esp + 0x28], 0x43d24ddc
mov dword [esp + 0x2c], 0x47a74184
mov dword [esp + 0x30], 0x7b9b45d0
mov dword [esp + 0x34], 0x7f92795d
mov dword [esp + 0x38], 0x73e17d8e
mov dword [esp + 0x3c], 0x779371e4
mov dword [esp + 0x40], 0x6b8b75e4
mov dword [esp + 0x44], 0x6fb1698c
mov dword [esp + 0x48], 0x638e6db3
mov dword [esp + 0x4c], 0x678361f7
mov dword [esp + 0x50], 0x1b8d65f3
mov dword [esp + 0x54], 0x1f8d1981
mov dword [esp + 0x58], 0x13c01d8e
mov dword [esp + 0x5c], 0x178b1198
mov dword [esp + 0x60], 0xb0a1588
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x3f
ja 0x1cba4b
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x24]
mov esi, ecx
xor esi, 0x640a4692
and ecx, 0xe40a4692
lea ecx, [esi + ecx*2]
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x26
mov edx, dword [esp]
mov byte [esp + edx + 0x24], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x40
jb 0x1cba10
lea esi, [esp + 0x8c]
lea ecx, [esp + 0x24]
push esi
push 0
push 0
push 0x1f
push ecx
push 0
call eax
mov ebx, dword [esp + 0x8c]
test ebx, ebx
jns 0x1cba74
mov eax, 0xffffffff
jmp 0x1cba77
lea eax, [ebx + ebx]
push eax
call fcn.001ac630
add esp, 4
mov ebp, eax
mov eax, dword [0x1f1b9c]
mov dword [esp + 0x24], 0x13d3113d
mov dword [esp + 0x28], 0x1f8e1d8c
mov dword [esp + 0x2c], 0x1bfb19d4
mov dword [esp + 0x30], 0x7e70598
mov dword [esp + 0x34], 0x3e6012d
mov dword [esp + 0x38], 0xf990dfa
mov dword [esp + 0x3c], 0xbe70994
mov dword [esp + 0x40], 0x37d735a4
mov dword [esp + 0x44], 0x331931dc
mov dword [esp + 0x48], 0x3fda3d17
mov dword [esp + 0x4c], 0x3bd739ab
mov dword [esp + 0x50], 0x27b525b7
mov dword [esp + 0x54], 0x23b521c9
mov dword [esp + 0x58], 0x2ff82dba
mov dword [esp + 0x5c], 0x2bbf29b0
mov dword [esp + 0x60], 0xd7d6d540
mov word [esp + 0x64], 0
mov byte [esp + 0x66], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 0x42
ja 0x1cbb6b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0x24]
mov edi, ecx
xor edi, 0xfbca32c4
and ecx, 0xfbca32c4
lea ecx, [edi + ecx*2]
xor ecx, edx
mov dword [esp + 4], ecx
mov ecx, dword [esp + 4]
add cl, 0x2c
mov edx, dword [esp]
mov byte [esp + edx + 0x24], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 0x43
jb 0x1cbb30
push esi
push ebx
push ebp
push 0x1f
lea ecx, [esp + 0x34]
push ecx
push 0
call eax
lea eax, [esp + 0x7c]
push 0x60
push 3
push 0x120089
push eax
push ebp
call fcn.001e5330
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x1ed82c]
mov ebx, 0xbba3001c
sbb al, 0
and al, 0xbc
sbb al, 0
retf 0x1cbb
Function at 0x1d43d0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
call fcn.001ae010
sub esp, 0x14
mov esi, esp
push eax
mov edi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 0
setne al
xor ebx, ebx
test al, 1
jne 0x1d4409
jmp 0x1d4539
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [ebp - 0x18], edi
jmp 0x1d4428
sub esp, 4
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
cmp edi, 0
setne al
xor ebx, ebx
test al, 1
jne 0x1d444b
jmp 0x1d4533
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov dword [ebp - 0x1c], eax
mov dword [esp], eax
call fcn.001ac770
add esp, 4
mov edx, eax
cmp edx, 0
setne al
xor ebx, ebx
test al, 1
jne 0x1d447b
jmp 0x1d4527
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov byte [ebp - 0x14], al
mov byte [esi], 0xf3
mov byte [esi + 1], 0xa5
mov byte [esi + 2], 0xab
mov byte [esi + 3], 0xa3
mov byte [esi + 4], 0x8e
mov byte [esi + 5], 0xba
mov byte [esi + 6], 0x8f
mov byte [esi + 7], 0xbd
mov byte [esi + 8], 0xb4
mov byte [esi + 9], 0xff
mov byte [esi + 0xa], 0xa6
mov byte [esi + 0xb], 0xa3
mov byte [esi + 0xc], 0xa8
mov byte [esi + 0xd], 0x25
mov eax, 0xe
mov byte [esi + eax], 0
add eax, 1
cmp eax, 0x13
jne 0x1d44bf
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
cmp eax, 0x13
jae 0x1d4509
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [esi + ecx]
sub esp, 8
mov dword [esp + 4], eax
mov dword [esp], ecx
mov ebx, edx
call fcn.001d84a0
mov edx, ebx
add esp, 8
mov ecx, dword [ebp - 0x10]
mov byte [esi + ecx], al
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
jmp 0x1d44d2
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [esp], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.001ad1b0
mov bl, al
and bl, 1
sub esp, 4
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret