joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011a10
Capabilities:
Create process on windows

Disassembly:
mov ecx, 0x10087250
call fcn.100168c0
mov ecx, 0x10087094
call fcn.10011420
mov ecx, 0x10095608
call fcn.10015ab0
mov ecx, 0x1008ea10
call fcn.10001890
mov ecx, 0x1008ec10
call fcn.10003a00
mov ecx, 0x10094c28
call fcn.10013270
mov ecx, 0x1008ebb0
call fcn.10002ef0
mov ecx, section..data
call fcn.10003760
mov ecx, 0x10094b70
call fcn.10012a90
mov ecx, 0x100902c8
call fcn.1000c3a0
mov ecx, 0x10094790
call fcn.10012040
mov ecx, 0x10091208
call fcn.1000d3a0
mov ecx, 0x1009569c
call fcn.10017970
call fcn.10012640
call fcn.10015f90
push str..DataLocalItemOptionSystem_Exc.bmd
mov ecx, 0x100935d8
call fcn.1000f470
mov ecx, 0x100934e0
call fcn.1000e190
cmp byte [0x100872fb], 1
jne 0x10011ac8
mov ecx, 0x100969d4
call fcn.10018e30
cmp byte [0x10087330], 1
jne 0x10011adb
mov ecx, 0x100969d4
jmp 0x10018d60
ret
sub esp, 0x70
mov eax, dword [0x10087700]
xor eax, esp
mov dword [esp + 0x6c], eax
push esi
push edi
push 0x44
lea eax, [esp + 0x1c]
mov esi, ecx
push 0
push eax
call fcn.10045000
add esp, 0xc
lea ecx, [esp + 0x5c]
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
push 0x10087334
call fcn.100052b0
cmp dword [esp + 0x70], 0x10
lea ecx, [esp + 8]
push ecx
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x7c]
cmovae eax, dword [esp + 0x7c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, dword [esp + 0x70]
mov edi, eax
cmp edx, 0x10
jb 0x10018dfa
mov ecx, dword [esp + 0x5c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10018df0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10018e1d
push edx
push ecx
call fcn.10043123
add esp, 8
test edi, edi
je 0x10018e0c
mov eax, dword [esp + 8]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x20], eax
mov ecx, dword [esp + 0x74]
pop edi
pop esi
xor ecx, esp
call fcn.1004344b
add esp, 0x70
ret
call fcn.10049147
int3

Function at 0x10011ae0
Capabilities:
Create thread

Disassembly:
push ecx
push 0
push 1
lea eax, [esp + 0xb]
push eax
push 0x1b674b8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [esp + 3], 0x32
je 0x10011b18
push 0
push 0
push 0
push 0x10011b20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ecx
ret

Function at 0x10011d30
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
mov ebx, ecx
test edi, edi
jle 0x10011d65
push ebp
mov ebp, dword [esp + 0x14]
mov eax, 0xaaaaaaab
mov ecx, 0xc
mul esi
shr edx, 1
sub ecx, edx
lea eax, [esi + ecx*2]
add eax, ecx
mov al, byte [eax + ebx]
xor byte [esi + ebp], al
inc esi
cmp esi, edi
jl 0x10011d44
pop ebp
pop edi
pop esi
pop ebx
ret 8
Function at 0x10011d70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebp, ecx
sub esi, 1
js 0x10011db0
mov edx, dword [esp + 0xc]
push ebx
mov bl, byte [esi + edx]
lea eax, [esi + edx]
push edi
mov edi, dword [esp + 0x18]
sub edi, edx
nop
mov dl, byte [eax - 1]
lea ecx, [edi + eax]
and ecx, 0x1f
lea eax, [eax - 1]
mov cl, byte [ecx + ebp + 4]
xor cl, dl
xor cl, bl
sub esi, 1
mov byte [eax + 1], cl
mov bl, dl
jns 0x10011d90
pop edi
pop ebx
pop esi
pop ebp
ret 0xc

Function at 0x10011dc0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0xc]
push edi
mov edi, ecx
test edx, edx
jle 0x10011def
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
lea ecx, [esi + eax]
and ecx, 0x1f
lea eax, [eax + 1]
mov cl, byte [ecx + edi + 4]
xor cl, byte [eax - 2]
xor byte [eax - 1], cl
sub edx, 1
jne 0x10011dd6
pop esi
pop edi
ret 0xc
Function at 0x100134d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x10]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push dword [esp + 0x18]
push edi
call fcn.10044a80
add esp, 0xc
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
pop ecx
ret

Function at 0x10013510
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x10]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push dword [esp + 0x18]
push edi
call fcn.10045000
add esp, 0xc
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
pop ecx
ret

Function at 0x10013550
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x40
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [esp + 0x10]
mov byte [edi], al
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ecx
ret

Function at 0x10013590
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
push 0x40
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, byte [esp + 0xc]
cmp al, 0xff
je 0x100135b0
mov byte [esi], al
mov eax, dword [esp + 0x14]
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 5
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop esi
pop ecx
ret

Function at 0x100135e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x40
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movsd xmm0, qword [esp + 0x10]
lea eax, [esp + 4]
push eax
push dword [esp + 8]
movsd qword [edi], xmm0
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ecx
ret

Function at 0x10013620
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esp + 0x10]
mov dword [edi], eax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ecx
ret

Function at 0x10013660
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
push dword [esp + 8]
movss dword [edi], xmm0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ecx
ret
Function at 0x100136a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x40
push 2
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ax, word [esp + 0x10]
mov word [edi], ax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 2
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ecx
ret
Function at 0x10014f20
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push 0
push 0
push 0
imul eax, dword [eax + 4], 0x3e8
push 0x10012670
push 0
push 0
mov dword [0x10094b6c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret 4

Function at 0x10015500
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, 5
cmp byte [esi + 4], bl
jbe 0x1001556e
push ebp
mov ebp, 0x100
nop dword [eax]
movzx eax, byte [edi + esi + 0x17]
mov dl, byte [edi + esi]
add eax, 0x2800
push eax
mov al, dl
xor al, 0x80
test dl, dl
movzx ecx, al
movzx eax, dl
cmovns ecx, eax
movzx eax, byte [edi + esi + 1]
movzx ecx, cl
imul ecx, ebp
add cx, ax
movzx eax, cx
mov ecx, 0x10095710
push eax
call fcn.10018c90
movzx eax, byte [edi + esi + 0x43]
inc ebx
lea edi, [edi + eax*8]
movzx eax, byte [esi + 4]
lea edi, [edi + 0x44]
cmp ebx, eax
jl 0x10015520
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x10016840
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10087700]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], ecx
call dword [sym.imp.SecureEngineSDK32.dll_Ordinal_132]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10005350
push 0
push str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890__
lea ecx, [ebp - 0x1c]
call fcn.10017200
cmp eax, 0xffffffff
je 0x10016895
push 0x10
push 0x10065e54
push str.Window_title_is_invalid__alphanumerical_characters__space_and______are_allowed_only
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.SecureEngineSDK32.dll_Ordinal_532]
lea ecx, [ebp - 0x1c]
call fcn.10003bc0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004344b
mov esp, ebp
pop ebp
ret 4
Function at 0x10018960
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push edi
push 0
push 0
push 0xffffffffffffffff
push ebx
push 8
push 0
call ebp
mov edi, eax
test edi, edi
js 0x100189ae
lea ecx, [edi + edi]
push ecx
call fcn.1004a6ad
mov esi, eax
add esp, 4
test esi, esi
je 0x100189ae
push edi
push esi
push 0xffffffffffffffff
push ebx
push 8
push 0
call ebp
test eax, eax
jns 0x100189b8
push esi
call fcn.1004a692
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push esi
mov ebp, eax
call fcn.1004a692
add esp, 4
test ebp, ebp
je 0x100189ae
mov ecx, dword [esp + 0x10]
xor edi, edi
lea esi, [ecx*4]
test ecx, ecx
jle 0x10018a24
nop dword [eax]
nop dword [eax + eax]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp + edi*4]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
js 0x10018abe
inc edi
add esi, eax
cmp edi, dword [esp + 0x10]
jl 0x100189f0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, eax
mov dword [esp + 0x18], edx
test edx, edx
je 0x10018abe
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], 0
lea eax, [ecx*4]
sub esi, eax
lea ebx, [eax + edx]
test ecx, ecx
jle 0x10018aa1
mov eax, ebp
mov edi, edx
sub eax, edx
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push ecx
push 0
push esi
push ebx
push 0xffffffffffffffff
push dword [eax + edi]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
js 0x10018acf
mov dword [edi], ebx
sub esi, eax
add ebx, eax
add edi, 4
mov eax, dword [esp + 0x14]
inc eax
cmp eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
jl 0x10018a61
push ebp
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
mov eax, dword [esp + 0xc]
pop ebx
add esp, 0x14
ret
push ebp
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
push dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
Function at 0x10018e30
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
sub esp, 0x34
mov eax, dword [0x10087700]
xor eax, esp
mov dword [esp + 0x30], eax
push ebp
push esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x12]
movzx esi, word [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_GetCommandLineA]
imul esi, eax
movzx eax, word [esp + 0x16]
imul esi, eax
xor esi, 0x22894375
cmp byte [0x100872fb], 0
je 0x10018f99
call ebp
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
call ebp
push eax
call fcn.10018960
add esp, 8
mov dword [esp + 0xc], eax
cmp dword [esp + 8], 2
jge 0x10018ece
lea eax, [esp + 0x20]
mov ecx, 0x10087250
push eax
call fcn.10018d20
push 5
mov ecx, eax
call fcn.10019150
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp + 0x20]
call fcn.10003bc0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
mov edi, dword [eax + 4]
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10018ed7
sub ecx, edx
xor eax, eax
push ebx
mov bl, 1
test ecx, ecx
jle 0x10018f04
nop dword [eax]
mov dl, byte [edi + eax]
cmp dl, 0x30
jl 0x10018efd
cmp dl, 0x39
jle 0x10018eff
xor bl, bl
inc eax
cmp eax, ecx
jl 0x10018ef0
xor eax, eax
test bl, bl
pop ebx
je 0x10018f14
push edi
call fcn.1004ac4d
add esp, 4
pop edi
cmp esi, eax
je 0x10018f49
lea eax, [esp + 0x20]
mov ecx, 0x10087250
push eax
call fcn.10018d20
push 5
mov ecx, eax
call fcn.10019150
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp + 0x20]
call fcn.10003bc0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [esp + 8], 5
jne 0x10018f99
mov ecx, dword [esp + 0xc]
mov eax, dword [ecx + 8]
movq xmm0, qword [eax]
movq qword [0x1009565d], xmm0
mov ax, word [eax + 8]
mov word [0x10095665], ax
mov eax, dword [ecx + 0xc]
movups xmm0, xmmword [eax]
movups xmmword [0x10095667], xmm0
mov eax, dword [eax + 0x10]
mov dword [0x10095677], eax
push dword [ecx + 0x10]
call fcn.1004ac4d
add esp, 4
mov dword [0x10095658], eax
mov byte [0x10095687], 1
cmp byte [0x10087314], 0
je 0x10019029
call ebp
lea eax, [esp + 8]
mov dword [esp + 8], 0
push eax
call ebp
push eax
call fcn.10018960
add esp, 8
mov esi, eax
cmp dword [esp + 8], 2
jl 0x1001903a
push str.mnrn3r
push dword [esi + 4]
call fcn.10050954
add esp, 8
test eax, eax
jne 0x1001903a
cmp dword [esp + 8], 5
jne 0x10019029
mov eax, dword [esi + 8]
movq xmm0, qword [eax]
movq qword [0x1009565d], xmm0
mov ax, word [eax + 8]
mov word [0x10095665], ax
mov eax, dword [esi + 0xc]
movups xmm0, xmmword [eax]
movups xmmword [0x10095667], xmm0
mov eax, dword [eax + 0x10]
mov dword [0x10095677], eax
push dword [esi + 0x10]
call fcn.1004ac4d
add esp, 4
mov dword [0x10095658], eax
mov byte [0x10095687], 1
mov ecx, dword [esp + 0x38]
pop esi
pop ebp
xor ecx, esp
call fcn.1004344b
add esp, 0x34
ret
lea eax, [esp + 0x20]
mov ecx, 0x10087250
push eax
call fcn.10018d40
push 5
mov ecx, eax
call fcn.10019150
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp + 0x20]
call fcn.10003bc0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x10020f10
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x10097a38], 0
jne 0x10020f1e
call fcn.1002f640
cmp byte [0x10097a42], 0
je 0x10020f3c
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.1003ca70
add esp, 0x10
ret
jmp fcn.1001c720
Function at 0x10025d00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
push ebx
push ebp
xor ebp, ebp
mov dword [esp + 0x18], ecx
push edi
test eax, eax
je 0x10025d16
mov ebp, dword [eax]
xor ebx, ebx
bswap ebp
add eax, 4
je 0x10025d21
mov ebx, dword [eax]
xor edi, edi
bswap ebx
add eax, 4
je 0x10025d2c
mov edi, dword [eax]
mov eax, dword [ecx + 8]
mov edx, 0xb0b
mov dword [esp + 0x24], edx
mov dword [esp + 0xc], eax
push esi
bswap edi
test eax, eax
je 0x10025e1a
mov eax, dword [ecx + 0x24]
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], eax
nop
mov eax, edx
xor ebx, esi
shl eax, 0x10
xor eax, ecx
xor ebp, eax
mov eax, dword [esp + 0x14]
xor eax, edx
mov esi, ebp
xor edi, eax
shr esi, 0x10
mov eax, edi
xor esi, edi
xor eax, ebx
shr esi, 8
xor eax, ebp
mov edx, ebx
mov ecx, eax
shl edx, 0x10
rol eax, 8
xor edx, edi
rol ecx, 0x10
xor ecx, eax
shl edx, 8
mov eax, ebp
shl eax, 0x10
xor eax, ebx
shl eax, 8
xor esi, eax
mov eax, ebx
shr eax, 0x10
xor eax, ebp
shr eax, 8
xor edx, eax
mov eax, edx
shl edx, 0x10
xor eax, ecx
xor ebx, eax
mov eax, esi
shr eax, 0x10
xor esi, ecx
xor edx, eax
xor esi, ebp
xor edx, ecx
ror esi, 0xa
xor edx, edi
mov edi, ebx
rol edx, 1
not edi
mov ebp, edx
or edi, esi
not ebp
xor edi, edx
or ebp, ebx
ror edi, 0xa
xor ebp, esi
not esi
or esi, edx
rol ebp, 1
mov edx, dword [esp + 0x28]
xor ebx, esi
mov esi, dword [esp + 0x1c]
add edx, edx
mov ecx, edx
mov eax, edx
xor edx, 0x11011
and eax, 0x10000
cmove edx, ecx
sub dword [esp + 0x10], 1
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
jne 0x10025d60
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x24]
mov eax, edx
shl eax, 0x10
xor eax, dword [ecx]
xor ebx, dword [ecx + 4]
xor ebp, eax
mov eax, dword [ecx + 8]
mov esi, ebp
xor eax, edx
shr esi, 0x10
xor edi, eax
mov ecx, ebx
mov eax, edi
shl ecx, 0x10
xor eax, ebx
xor esi, edi
xor eax, ebp
shr esi, 8
mov edx, eax
xor ecx, edi
rol eax, 8
rol edx, 0x10
xor edx, eax
shl ecx, 8
mov eax, ebp
shl eax, 0x10
xor eax, ebx
shl eax, 8
xor esi, eax
mov eax, ebx
shr eax, 0x10
xor eax, ebp
shr eax, 8
xor ecx, eax
mov eax, ecx
shl ecx, 0x10
xor eax, edx
xor ebx, eax
mov eax, esi
shr eax, 0x10
xor esi, edx
xor ecx, eax
xor esi, ebp
xor ecx, edx
xor edi, ecx
mov ecx, dword [esp + 0x2c]
bswap esi
test ecx, ecx
je 0x10025e90
xor esi, dword [ecx]
mov eax, dword [esp + 0x30]
test eax, eax
je 0x10025e9a
mov dword [eax], esi
lea edx, [eax + 4]
test ecx, ecx
lea eax, [ecx + 4]
cmove eax, ecx
bswap ebx
pop esi
test eax, eax
je 0x10025eae
xor ebx, dword [eax]
test edx, edx
je 0x10025eb4
mov dword [edx], ebx
add edx, 4
lea ecx, [eax + 4]
test eax, eax
bswap edi
cmove ecx, eax
test ecx, ecx
je 0x10025ec7
xor edi, dword [ecx]
test edx, edx
je 0x10025ecd
mov dword [edx], edi
pop edi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x10026d00
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push esi
xor esi, esi
push edi
mov edi, dword [ecx + 0x34]
test eax, eax
je 0x10026d19
mov esi, dword [eax]
xor edx, edx
bswap esi
add eax, 4
je 0x10026d24
mov edx, dword [eax]
bswap edx
test edi, edi
je 0x10026d8f
mov eax, dword [ecx + 0x2c]
push ebp
mov ecx, dword [eax + 0xc]
mov ebp, dword [eax + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
nop dword [eax]
mov ecx, esi
mov eax, esi
shr ecx, 5
shl eax, 4
add ecx, ebx
add eax, ebp
xor ecx, eax
lea eax, [esi + edi]
xor ecx, eax
sub edx, ecx
mov ecx, edx
mov eax, edx
shr ecx, 5
add ecx, dword [esp + 0x10]
shl eax, 4
add eax, dword [esp + 0x14]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
sub esi, ecx
add edi, 0x61c88647
jne 0x10026d50
mov ebx, dword [esp + 0x20]
pop ebp
bswap esi
test ebx, ebx
je 0x10026d97
xor esi, dword [ebx]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10026da1
mov dword [eax], esi
test ebx, ebx
lea ecx, [eax + 4]
lea eax, [ebx + 4]
pop edi
cmove eax, ebx
pop esi
bswap edx
pop ebx
test eax, eax
je 0x10026db7
xor edx, dword [eax]
test ecx, ecx
je 0x10026dbd
mov dword [ecx], edx
add esp, 8
ret 0xc

Function at 0x10026dd0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
xor edi, edi
xor esi, esi
test eax, eax
je 0x10026de8
mov esi, dword [eax]
xor edx, edx
bswap esi
add eax, 4
je 0x10026df3
mov edx, dword [eax]
push ebp
mov ebp, dword [ecx + 0x34]
bswap edx
test ebp, ebp
je 0x10026e62
mov eax, dword [ecx + 0x2c]
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
nop
mov ecx, edx
mov eax, edx
shr ecx, 5
sub edi, 0x61c88647
shl eax, 4
add ecx, ebx
add eax, dword [esp + 0x10]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
add esi, ecx
mov ecx, esi
mov eax, esi
shr ecx, 5
add ecx, dword [esp + 0x14]
shl eax, 4
add eax, dword [esp + 0x18]
xor ecx, eax
lea eax, [esi + edi]
xor ecx, eax
add edx, ecx
cmp edi, ebp
jne 0x10026e20
mov ebx, dword [esp + 0x24]
bswap esi
pop ebp
test ebx, ebx
je 0x10026e6b
xor esi, dword [ebx]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10026e75
mov dword [eax], esi
test ebx, ebx
lea ecx, [eax + 4]
lea eax, [ebx + 4]
pop edi
cmove eax, ebx
pop esi
bswap edx
pop ebx
test eax, eax
je 0x10026e8b
xor edx, dword [eax]
test ecx, ecx
je 0x10026e91
mov dword [ecx], edx
add esp, 0xc
ret 0xc
Function at 0x10026f40
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov edi, ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [edi + 0x14]
mov ebp, dword [edi + 0x18]
lea eax, [eax*4]
add eax, ebp
test ecx, ecx
je 0x10026f65
mov ebx, dword [ecx]
xor edx, edx
add ecx, 4
je 0x10026f6e
mov edx, dword [ecx]
mov edi, dword [edi + 8]
test edi, edi
je 0x10026f96
sub edx, dword [eax - 4]
lea eax, [eax - 8]
movzx ecx, bl
and ecx, 0x1f
ror edx, cl
xor edx, ebx
sub ebx, dword [eax]
movzx ecx, dl
and ecx, 0x1f
ror ebx, cl
xor ebx, edx
sub edi, 1
jne 0x10026f75
sub edx, dword [ebp + 4]
sub ebx, dword [ebp]
test esi, esi
je 0x10026fa2
xor ebx, dword [esi]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10026fac
mov dword [eax], ebx
test esi, esi
lea ecx, [eax + 4]
lea eax, [esi + 4]
pop edi
cmove eax, esi
pop esi
pop ebp
pop ebx
test eax, eax
je 0x10026fc3
mov eax, dword [eax]
xor edx, eax
test ecx, ecx
je 0x10026fc9
mov dword [ecx], edx
ret 0xc

Function at 0x10026fd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x18]
test eax, eax
je 0x10026fe9
mov edx, dword [eax]
xor ecx, ecx
add eax, 4
je 0x10026ff2
mov ecx, dword [eax]
mov ebx, dword [esi]
mov eax, dword [edi + 8]
add ebx, edx
mov edx, dword [esi + 4]
xor edi, edi
add edx, ecx
test eax, eax
je 0x1002702b
mov ebp, eax
movzx ecx, dl
xor ebx, edx
and ecx, 0x1f
rol ebx, cl
add ebx, dword [esi + edi*8 + 8]
movzx ecx, bl
xor edx, ebx
and ecx, 0x1f
rol edx, cl
add edx, dword [esi + edi*8 + 0xc]
inc edi
cmp edi, ebp
jb 0x10027006
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x10027032
xor ebx, dword [ebp]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1002703c
mov dword [eax], ebx
test ebp, ebp
lea ecx, [eax + 4]
pop edi
lea eax, [ebp + 4]
pop esi
cmove eax, ebp
pop ebp
pop ebx
test eax, eax
je 0x10027053
mov eax, dword [eax]
xor edx, eax
test ecx, ecx
je 0x10027059
mov dword [ecx], edx
ret 0xc