joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006ce00
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov ecx, dword [eax + 0x7c]
push esi
cmp ebp, 0xffffffff
push edi
mov dword [esp + 0x10], ecx
jne 0x1006ceb5
mov edx, dword [esp + 0x1c]
mov ebp, dword [edx]
test ebp, ebp
je 0x1006ce8c
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
push 0x10
mov edi, eax
call esi
push 0x12
mov ebx, eax
call esi
xor ecx, ecx
test edi, 0x8000
je 0x1006ce4c
mov ecx, 2
test bh, 0x80
je 0x1006ce54
or ecx, 1
test ah, 0x80
je 0x1006ce5c
or ecx, 4
mov esi, dword [esp + 0x28]
push ecx
mov ecx, esi
mov eax, dword [esp + 0x14]
shr ecx, 0x10
movsx edx, cx
mov eax, dword [eax + 8]
push edx
mov edx, dword [esp + 0x24]
movsx ecx, si
push ecx
mov ecx, dword [edx + 4]
push ecx
push eax
call ebp
test eax, eax
jne 0x1006ce92
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov esi, dword [esp + 0x28]
jmp 0x1006ce96
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push esi
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 4]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_CallWindowProcW]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
push 0x10
mov edi, eax
call esi
push 0x12
mov ebx, eax
call esi
xor ecx, ecx
test edi, 0x8000
je 0x1006ceda
mov ecx, 2
test bh, 0x80
je 0x1006cee2
or ecx, 1
test ah, 0x80
je 0x1006ceea
or ecx, 4
mov esi, dword [esp + 0x28]
push ecx
mov ecx, esi
mov edi, dword [esp + 0x1c]
shr ecx, 0x10
movsx edx, cx
movsx eax, si
push edx
push eax
push 3
push ebp
push edi
call fcn.1006cd20
add esp, 0x18
test eax, eax
je 0x1006ce84
cmp ebp, 0x18
je 0x1006cf1d
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 0x14]
push esi
push eax
mov eax, dword [edi + 4]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_CallWindowProcW]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x1006d740
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x11239838]
test eax, eax
je 0x1006d756
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x1006d7a3
mov eax, dword [eax]
test eax, eax
jne 0x1006d749
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x1006d7a3
lea ecx, [eax + 0x20]
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov edx, dword [eax + 4]
mov dword [ecx], edx
mov dword [eax + 4], ecx
add ecx, 0x20
mov edx, ecx
sub edx, eax
cmp edx, 0xfe0
jbe 0x1006d77f
mov ecx, dword [0x11239838]
mov dword [eax], ecx
mov dword [0x11239838], eax
ret

Function at 0x1006dbe0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
mov cl, byte [esi]
test cl, cl
je 0x1006dbf9
cmp cl, 0x90
je 0x1006dbf9
cmp cl, 0xcc
je 0x1006dbf9
pop esi
xor eax, eax
ret
mov edx, dword [esp + 0xc]
mov eax, 1
cmp edx, eax
jbe 0x1006dc10
cmp byte [eax + esi], cl
jne 0x1006dbf5
inc eax
cmp eax, edx
jb 0x1006dc06
pop esi
mov eax, 1
ret
Function at 0x10072f30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x112276a4]
xor edx, edx
cmp eax, edx
jne 0x10072f56
xor eax, eax
mov byte [eax + 0x112275a4], al
inc eax
cmp eax, 0x100
jl 0x10072f3e
mov dword [0x112276a4], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x112275a4
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x10072fe7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x10072fba
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x10072f88
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x10073060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x100730b3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x1007309a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10079a70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100a81ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.1007a390
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x111ea4fc
call fcn.1009964b
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x10079b03
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.1009964b
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x10079afc
push 0
mov ecx, eax
call fcn.10070b70
mov dword [esi + 0xc], eax
jmp 0x10079b05
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x10079b05
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x1009bcd8
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1009bd10
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.10099d65
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.10099d3d
jmp 0x1009bd1c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x1009d3ca
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x1009d40c
call fcn.100a2e9c
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x1009d40c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x1009d403
xor eax, eax
jmp 0x1009d414
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.1009d41a
pop edi
pop esi
pop ebx
ret 4
Function at 0xc3b50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0xc3b62
cmp dword [edi + 0x18], ebx
jne 0xc3b6d
pop edi
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x7c], ebx
je 0xc3b77
call fcn.000c3ef0
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
push edi
call fcn.000c3960
add esp, 0x10
test eax, eax
je 0xc3b9e
pop edi
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x6c
call fcn.00159c81
mov esi, eax
add esp, 4
cmp esi, ebx
je case.0xc3c17.7
push 0x4000
call fcn.00159c81
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
add esp, 4
cmp eax, ebx
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
jne 0xc3be8
push esi
call fcn.00159bd6
add esp, 4
pop esi
pop edi
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x54], eax
mov dword [esi + 0x50], ebx
mov ecx, dword [edi + 0x34]
mov dword [esi + 0x64], ecx
mov edx, dword [edi]
mov dword [esi + 0x60], edx
mov eax, dword [edi + 0xc]
mov dword [esi + 0x68], eax
mov dword [esi + 0x18], ebx
mov eax, dword [edi + 0x34]
cmp eax, 8
ja case.0xc3c17.7
movzx ecx, byte [eax + 0xc3c7c]
jmp dword [ecx*4 + 0xc3c70]
push 0x38
push 0x218e64
lea edx, [esi + 4]
push 0xfffffffffffffff1
push edx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.000cd020
add esp, 0x10
test eax, eax
jne case.0xc3c17.0
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov eax, dword [esp + 0x14]
mov dword [esi + 0x5c], ecx
mov edx, dword [edi + 0x78]
lea ecx, [edx + eax + 0x1e]
mov dword [esi + 8], ebx
mov dword [esi + 0x3c], ecx
mov dword [edi + 0x7c], esi
pop esi
pop edi
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0xcce50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0xcce5b
xor eax, eax
ret
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
cmp esi, 8
not eax
jb 0xccf50
push ebx
push edi
mov edi, esi
shr edi, 3
xor edx, edx
mov dl, byte [ecx]
mov ebx, eax
shr ebx, 8
sub esi, 8
xor edx, eax
and edx, 0xff
mov eax, dword [edx*4 + 0x1eb1b8]
xor eax, ebx
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x1eb1b8]
shr eax, 8
xor edx, eax
xor eax, eax
mov al, byte [ecx + 1]
inc ecx
xor eax, edx
and eax, 0xff
mov eax, dword [eax*4 + 0x1eb1b8]
shr edx, 8
xor eax, edx
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x1eb1b8]
shr eax, 8
xor edx, eax
xor eax, eax
mov al, byte [ecx + 1]
inc ecx
xor eax, edx
and eax, 0xff
mov eax, dword [eax*4 + 0x1eb1b8]
shr edx, 8
xor eax, edx
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x1eb1b8]
shr eax, 8
xor edx, eax
xor eax, eax
mov al, byte [ecx + 1]
inc ecx
xor eax, edx
and eax, 0xff
mov eax, dword [eax*4 + 0x1eb1b8]
shr edx, 8
xor eax, edx
xor edx, edx
mov dl, byte [ecx + 1]
inc ecx
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x1eb1b8]
shr eax, 8
xor eax, edx
inc ecx
dec edi
jne 0xcce76
pop edi
pop ebx
test esi, esi
je 0xccf70
xor edx, edx
mov dl, byte [ecx]
xor edx, eax
and edx, 0xff
mov edx, dword [edx*4 + 0x1eb1b8]
shr eax, 8
xor eax, edx
inc ecx
dec esi
jne 0xccf54
not eax
pop esi
ret
Function at 0xd9021
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
cmp dword [ebp + 0xc], 0x40
jbe 0xd9034
mov dword [ebp + 0xc], 0x40
push esi
mov esi, dword [ebp + 8]
push edi
push 0x10
pop ecx
xor eax, eax
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0xc]
mov eax, ecx
shr ecx, 2
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
xor eax, eax
pop esi
xor dword [ebp + eax*4 - 0x40], 0x36363636
inc eax
cmp eax, 0x10
jb 0xd905b
push dword [ebp + 0x10]
call fcn.000f08a0
push 0x40
lea eax, [ebp - 0x40]
push eax
push dword [ebp + 0x10]
call fcn.000f089a
leave
ret 0xc

Function at 0xd9088
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push 0x40
pop eax
cmp dword [ebp + 0x10], eax
jbe 0xd9099
mov dword [ebp + 0x10], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
Function at 0xe163d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov cx, word [ebp + 0x14]
or word [eax + 0x84], 0xffff
push ebx
push esi
push edi
mov word [eax + 0x32], cx
mov cx, word [ebp + 0x10]
xor edx, edx
mov word [eax + 0x20], cx
push 9
pop ecx
mov ebx, 0x1ee2b8
mov esi, ebx
lea edi, [eax + 0x44]
rep movsd dword es:[edi], dword [esi]
movzx ecx, word [ebp + 0x14]
mov esi, dword [ebp + 0xc]
imul ecx, ecx, 0x38
mov byte [eax], 0x47
mov byte [eax + 1], 0x44
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x1c], 3
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], edx
mov dword [eax + 0x6c], edx
mov dword [eax + 0x70], edx
mov dword [eax + 0x68], edx
mov word [eax + 0x22], 0x7fff
mov word [eax + 0x24], 0x7fff
mov word [eax + 0x26], 0x8000
mov word [eax + 0x28], 0x8000
mov word [eax + 0x86], dx
mov dword [eax + 0x88], edx
mov word [eax + 0x2a], dx
mov word [eax + 0x2e], dx
mov dword [eax + 0x34], 2
mov dword [eax + 0x38], edx
mov word [eax + 0x3c], dx
mov word [eax + 0x3e], dx
mov word [eax + 0x40], dx
mov word [eax + 0x42], dx
mov dword [eax + 0x74], edx
mov dword [eax + 0x78], edx
mov dword [eax + 0x7c], edx
mov dword [eax + 0x80], edx
mov esi, dword [esi + 8]
add ecx, esi
push 9
mov dword [eax + 0x8c], ecx
mov word [ecx + 0x28], dx
pop ecx
mov esi, ebx
lea edi, [eax + 0x90]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword [eax + 0xb4], 1
pop ebx
pop ebp
ret 0x10
Function at 0x10cf09
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov al, byte [edi]
xor ebx, ebx
test al, al
mov dword [ebp - 4], ebx
je 0x10cf41
push esi
movsx esi, al
mov eax, ebx
cdq
push 0xf
pop ecx
idiv ecx
mov eax, esi
sub ecx, edx
sar eax, cl
mov ecx, edx
shl esi, cl
xor eax, esi
xor dword [ebp - 4], eax
inc edi
mov al, byte [edi]
inc ebx
test al, al
jne 0x10cf1e
pop esi
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret

Function at 0x132e92
Capabilities:
Inspect section memory permissions

Disassembly:
xor ecx, ecx
inc ecx
test cl, dl
je 0x132eab
push edi
mov edi, dword [eax + 0x6c]
and edi, 0xfffffffd
or edi, ecx
mov dword [eax + 0x6c], edi
mov dword [eax + 0x14], ecx
pop edi
jmp 0x132ebb
mov ecx, dword [eax + 0x6c]
and ecx, 0xfffffffe
or ecx, 2
and dword [eax + 0x14], 0
mov dword [eax + 0x6c], ecx
test dl, dl
jns 0x132ed0
cmp dword [esp + 4], 0
je 0x132ed0
or byte [eax + 0x6c], 0x80
and dword [eax + 0x18], 0
jmp 0x132ed4
and byte [eax + 0x6c], 0x7f
mov ecx, 0x8000
test ecx, edx
je 0x132ee0
or dword [eax + 0x6c], ecx
test edx, 0x80000
jne 0x132eec
and byte [eax + 0x6e], 0xf7
test edx, 0x20000000
jne 0x132ef8
and byte [eax + 0x6f], 0xdf
test edx, edx
js 0x132f00
and byte [eax + 0x6f], 0x7f
test edx, 0x40000000
jne 0x132f0c
and byte [eax + 0x6f], 0xbf
test dl, 0x10
jne 0x132f15
and dword [eax + 0x6c], 0xffffffef
test dl, 0x20
jne 0x132f1e
and dword [eax + 0x6c], 0xffffffdf
test edx, 0x2000000
jne 0x132f2a
and byte [eax + 0x6f], 0xfd
test dl, 4
je 0x132f33
or dword [eax + 0x6c], 4
ret

Function at 0x13f715
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, eax
lea eax, [ebp - 0x10]
xor ecx, ecx
sub esi, eax
lea eax, [ebp + ecx - 0x10]
mov dl, byte [esi + eax]
xor dl, 0xf0
inc ecx
cmp ecx, 0x10
mov byte [eax], dl
jb 0x13f725
push 0x10
lea eax, [ebp - 0x10]
push eax
push 0x24923c
call fcn.0010ced5
lea eax, [ebp - 0x20]
push eax
push 4
lea eax, [ebp - 0x10]
push 0x29dc3c
push eax
call fcn.0014f73a
push 0x10
lea eax, [ebp - 0x20]
push eax
push 0x249248
call fcn.0010ced5
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
add eax, 0x10
push 8
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0014f73a
push 0x10
push dword [ebp + 0xc]
push 0x249254
call fcn.0010ced5
add esp, 0x44
pop esi
leave
ret
Function at 0x14e182
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x10], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x14f46a
Capabilities:
Hash data with md5

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0xc0
push ebx
mov ebx, dword [ebp + 0x7c]
mov eax, ebx
shl eax, 3
cmp ebx, 0x40
push esi
push edi
mov dword [ebp + 0x7c], eax
mov dword [0x2a261c], 0x67452301
mov dword [0x2a2620], 0xefcdab89
mov dword [0x2a2624], 0x98badcfe
mov dword [0x2a2628], 0x10325476
jle 0x14f4dc
lea esi, [ebx - 0x41]
shr esi, 6
inc esi
mov eax, esi
neg eax
shl eax, 6
add ebx, eax
lea eax, [ebp + 0x2c]
push eax
mov eax, dword [ebp + 0x78]
call fcn.0014f420
pop ecx
lea eax, [ebp + 0x2c]
call fcn.0014ee11
add dword [ebp + 0x78], 0x40
dec esi
jne 0x14f4c0
mov esi, dword [ebp + 0x78]
xor eax, eax
push 0x20
pop ecx
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
mov ecx, ebx
mov eax, ecx
shr ecx, 2
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 0x7c]
and ecx, 3
cmp ebx, 0x37
rep movsb byte es:[edi], byte [esi]
mov byte [ebp + ebx - 0x54], 0x80
jg 0x14f51f
lea ecx, [ebp - 0x1c]
call fcn.0014f451
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x54]
call fcn.0014f420
jmp 0x14f548
lea ecx, [ebp + 0x24]
call fcn.0014f451
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x54]
call fcn.0014f420
lea eax, [ebp + 0x2c]
call fcn.0014ee11
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x14]
call fcn.0014f420
pop ecx
lea eax, [ebp + 0x2c]
pop ecx
call fcn.0014ee11
mov esi, dword [ebp + 0x74]
mov eax, dword [0x2a261c]
mov ecx, esi
call fcn.0014f451
mov eax, dword [0x2a2620]
lea ecx, [esi + 4]
call fcn.0014f451
mov eax, dword [0x2a2624]
lea ecx, [esi + 8]
call fcn.0014f451
mov eax, dword [0x2a2628]
lea ecx, [esi + 0xc]
call fcn.0014f451
xor eax, eax
pop edi
pop esi
mov dword [0x2a2628], eax
mov dword [0x2a2624], eax
mov dword [0x2a2620], eax
mov dword [0x2a261c], eax
pop ebx
add ebp, 0x6c
leave
ret
Function at 0x14f5a5
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
cmp dword [ebp + 0xc], 0x40
push ebx
push esi
push edi
push 0x10
pop esi
jle 0x14f5e8
lea eax, [ebp - 0x68]
push eax
call fcn.0014e182
push dword [ebp + 0xc]
lea eax, [ebp - 0x68]
push dword [ebp + 8]
push eax
call fcn.0014ea53
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0014eb07
lea eax, [ebp - 0x10]
add esp, 0x18
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], esi
mov ebx, dword [ebp + 0x10]
mov ecx, esi
xor eax, eax
lea edi, [ebx + 0x58]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ecx, esi
mov esi, dword [ebp + 8]
lea edx, [ebx + 0x99]
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0xc]
stosb byte es:[edi], al
mov eax, ecx
shr ecx, 2
lea edi, [ebx + 0x58]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
mov ecx, eax
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x40
rep movsb byte es:[edi], byte [esi]
pop eax
xor byte [edx - 0x41], 0x36
xor byte [edx], 0x5c
inc edx
dec eax
jne 0x14f631
push ebx
call fcn.0014e182
push 0x40
lea eax, [ebx + 0x58]
push eax
push ebx
call fcn.0014ea53
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret

Function at 0x14f656
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x40
pop eax
cmp dword [ebp + 0xc], eax
jle 0x14f664
mov dword [ebp + 0xc], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov esi, dword [ebp + 8]
push 0x10
xor eax, eax
pop ecx
lea edi, [ebx + 0x58]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x10
lea edx, [ebx + 0x99]
xor eax, eax
pop ecx
mov edi, edx
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0xc]
stosb byte es:[edi], al
mov eax, ecx
shr ecx, 2
lea edi, [ebx + 0x58]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 8]
mov ecx, eax
shr ecx, 2
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x40
rep movsb byte es:[edi], byte [esi]
pop eax
xor byte [edx - 0x41], 0x36
xor byte [edx], 0x5c
inc edx
dec eax
jne 0x14f6b2
push ebx
call fcn.0014e182
push 0x40
lea eax, [ebx + 0x58]
push eax
push ebx
call fcn.0014ea53
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x14ff7d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push 0
push 0
push dword [ebp + 8]
call fcn.001041a2
mov ebx, eax
add esp, 0xc
cmp ebx, 0xffffffff
je 0x150000
push esi
mov esi, 0x3f3
push esi
lea eax, [ebp - 0x404]
push eax
push ebx
call fcn.001612b7
add esp, 0xc
test eax, eax
jle 0x14fff8
push edi
lea edi, [ebp - 0x10]
sub edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0014f46a
mov eax, dword [ebp + 0xc]
add esp, 0xc
push 0x10
pop ecx
mov dl, byte [edi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x14ffd9
push esi
lea eax, [ebp - 0x404]
push eax
push ebx
call fcn.001612b7
add esp, 0xc
test eax, eax
jg 0x14ffbf
pop edi
push ebx
call fcn.00160134
pop ecx
pop esi
pop ebx
leave
ret

Function at 0x150003
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
je 0x150034
cmp eax, 0xffffffff
jne 0x15013c
push ebx
push ebx
push 0x24fa50
call fcn.001041a2
add esp, 0xc
cmp eax, ebx
jge 0x15013c
push esi
push edi
lea eax, [ebp - 0x44]
push eax
push 0x24fa60
call fcn.0014ff7d
pop ecx
pop ecx
lea eax, [ebp - 0x34]
push eax
call fcn.000f98cb
push eax
call fcn.0014ff7d
push 0x24fa6c
push ebx
call fcn.00136e55
mov edi, eax
add esp, 0x10
cmp edi, ebx
je 0x1500a3
mov ecx, dword [edi + 4]
cmp ecx, ebx
je 0x1500a3
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x150075
sub eax, esi
push eax
push ecx
lea eax, [ebp - 0x1c]
push eax
call fcn.0014f46a
add esp, 0xc
xor eax, eax
mov cl, byte [ebp + eax - 0x1c]
xor byte [ebp + eax - 0x3c], cl
inc eax
cmp eax, 0x10
jb 0x15008e
push edi
call fcn.0011cea1
pop ecx
lea eax, [ebp - 0xc]
push eax
call fcn.001258e6
pop ecx
call fcn.0010433d
mov esi, dword [0x2a2844]
mov ecx, dword [ebp - 0xc]
lea edx, [esi + ecx]
add edx, eax
xor byte [ebp - 0x24], dl
inc esi
mov ecx, esi
imul ecx, eax
add ecx, dword [ebp - 8]
mov eax, edx
xor byte [ebp - 0x20], cl
shr eax, 8
xor byte [ebp - 0x23], al
mov eax, edx
shr eax, 0x10
xor byte [ebp - 0x22], al
mov eax, ecx
shr eax, 8
xor byte [ebp - 0x1f], al
mov eax, ecx
shr ecx, 0x18
xor byte [ebp - 0x1d], cl
shr edx, 0x18
xor byte [ebp - 0x21], dl
shr eax, 0x10
xor byte [ebp - 0x1e], al
inc esi
lea ecx, [ebp - 4]
mov dword [0x2a2844], esi
call fcn.0014ff6b
xor eax, eax
cmp dword [ebp - 4], eax
pop edi
pop esi
je 0x150126
mov ecx, eax
and ecx, 3
mov cl, byte [ebp + ecx - 4]
xor byte [ebp + eax - 0x44], cl
inc eax
cmp eax, 0x28
jb 0x150113
push 0x28
lea eax, [ebp - 0x44]
push eax
push 0x2a2638
call fcn.00151c79
add esp, 0xc
or eax, 0xffffffff
pop ebx
leave
ret

Function at 0x151c4b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
or eax, 0xffffffff
test esi, esi
je 0x151c75
xor edx, edx
mov dl, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x1f4bb0]
inc ecx
dec esi
jne 0x151c5b
not eax
pop esi
ret
Function at 0x151cd2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x100]
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
mov byte [ebp + 0xb], cl
mov cl, byte [eax + 0x101]
mov byte [ebp - 1], cl
jbe 0x151d34
push ebx
push esi
push edi
inc byte [ebp + 0xb]
movzx ecx, byte [ebp + 0xb]
mov edi, dword [ebp + 0xc]
lea esi, [ecx + eax]
mov dl, byte [esi]
add byte [ebp - 1], dl
movzx ecx, byte [ebp - 1]
add ecx, eax
mov bl, byte [ecx]
mov byte [esi], bl
mov byte [ecx], dl
mov bl, byte [esi]
mov ecx, dword [ebp - 8]
add bl, dl
movzx edx, bl
mov dl, byte [edx + eax]
add edi, ecx
xor byte [edi], dl
inc ecx
cmp ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
jb 0x151cf9
pop edi
pop esi
pop ebx
mov cl, byte [ebp + 0xb]
mov byte [eax + 0x100], cl
mov cl, byte [ebp - 1]
mov byte [eax + 0x101], cl
leave
ret