joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100117d1
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1006ba68
call fcn.10062ad8
sub esp, 0x32c
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov eax, dword [esi]
mov dword [esi + 4], ebx
mov word [eax], bx
cmp byte [0x10087d58], bl
jne 0x10011852
lea eax, [ebp - 0x12c]
mov byte [ebp - 0x12c], bl
push eax
push 0x105
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
mov edi, eax
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x18]
call fcn.1000468e
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.1000f1b3
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.100026d5
push dword [ebp - 0x24]
call fcn.1000f3a7
push dword [ebp - 0x18]
call fcn.1000f3a7
pop ecx
pop ecx
jmp 0x1001187b
lea eax, [ebp - 0x338]
mov word [ebp - 0x338], bx
push eax
push 0x105
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
mov edi, eax
lea eax, [ebp - 0x338]
push eax
mov ecx, esi
call fcn.10002676
cmp edi, ebx
jbe 0x1001188c
cmp edi, 0x104
ja 0x1001188c
push 1
pop eax
jmp 0x1001188e
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10012252
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1006bb6c
call fcn.10062ad8
sub esp, 0x23c
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [eax + 4], ecx
mov eax, dword [eax]
push edi
xor ebx, ebx
mov word [eax], cx
mov di, word [esi]
cmp di, cx
je 0x10012289
mov eax, esi
inc ebx
inc eax
inc eax
cmp word [eax], cx
jne 0x10012281
cmp ebx, 1
jl 0x100123ae
cmp di, 0x5c
je 0x100123ae
cmp di, 0x2e
jne 0x100122ba
cmp ebx, 1
je 0x100123ae
cmp ebx, 2
jne 0x100122ba
cmp word [esi + 2], di
je 0x100123ae
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
push 3
lea ecx, [ebp - 0x18]
call fcn.10002b44
and dword [ebp - 4], 0
cmp ebx, 3
jle 0x100122fc
cmp word [esi + 2], 0x3a
jne 0x100122fc
cmp word [esi + 4], 0x5c
jne 0x100122fc
cmp di, 0x61
jb 0x100122f0
cmp di, 0x7a
jbe 0x10012350
cmp di, 0x41
jb 0x100122fc
cmp di, 0x5a
jbe 0x10012350
and word [ebp - 0x248], 0
lea eax, [ebp - 0x248]
push eax
push 0x105
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
test eax, eax
je 0x100123c1
cmp eax, 0x104
ja 0x100123c1
lea eax, [ebp - 0x248]
lea ecx, [ebp - 0x18]
push eax
call fcn.10002676
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp word [ecx + eax*2 - 2], 0x5c
je 0x10012350
push 0x5c
lea ecx, [ebp - 0x18]
call fcn.10005d02
push 0x100826b4
lea ecx, [ebp - 0x30]
call fcn.10002615
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.10005e25
push esi
push eax
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 2
push eax
call fcn.10008903
mov ecx, dword [ebp + 0xc]
push eax
mov byte [ebp - 4], 3
call fcn.100026d5
push dword [ebp - 0x3c]
call fcn.1000f3a7
push dword [ebp - 0x24]
call fcn.1000f3a7
push dword [ebp - 0x30]
call fcn.1000f3a7
push dword [ebp - 0x18]
call fcn.1000f3a7
add esp, 0x10
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
push dword [ebp - 0x18]
call fcn.1000f3a7
pop ecx
xor al, al
jmp 0x100123b0
Function at 0x100124e9
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ecx + 4], 0
push esi
je 0x1001250a
cmp byte [ecx + 5], 0
je 0x1001250a
mov eax, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [eax], edx
mov ecx, dword [ecx + 0xc]
mov dword [eax + 4], ecx
jmp 0x10012549
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1001252b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x1001252b
xor al, al
jmp 0x1001254b
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.10062c70
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x10016e00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1006bf1b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [esi], 0x100720a0
mov dword [esi + 4], 0x10072090
mov dword [esi + 8], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x24], edi
mov dword [esp + 8], esi
mov dword [esi + 0x30], edi
lea ecx, [esi + 0x140]
mov dword [esp + 0x14], edi
call fcn.100148ae
lea eax, [esi + 0x6ff8]
mov dword [esi + 0x6fe4], edi
push eax
mov dword [esi + 0x6ff4], edi
call fcn.10062680
mov ecx, dword [esp + 0xc]
mov eax, 1
mov dword [esi + 0x7020], edi
mov dword [esi + 0x6fec], edi
mov dword [esi + 0x6ff0], edi
mov dword [esi + 0x7010], eax
mov byte [esi + 0x6fe0], al
mov dword [esi], 0x10072078
mov dword [esi + 4], 0x10072068
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x10019f40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x31
call fcn.10019600
push 0x41
mov ecx, esi
call fcn.10019600
push 0x59
mov ecx, esi
call fcn.10019600
push 0x26
mov ecx, esi
call fcn.10019600
push 0x53
mov ecx, esi
call fcn.10019600
push 0x59
mov ecx, esi
call fcn.10019600
mov ecx, dword [esp + 0x1c]
or eax, 0xffffffff
xor edi, edi
xor ebp, ebp
mov bl, byte [ecx]
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x1c]
cmp edi, 4
mov cl, byte [edx + ebp]
mov byte [esp + 0x14], cl
jne 0x10019fd0
test cl, cl
jbe 0x10019fcc
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
and edx, 0xff
and ecx, 0xff
mov edi, eax
shr edi, 0x18
xor edi, edx
shl eax, 8
mov edi, dword [edi*4 + 0x10087ef0]
xor eax, edi
dec ecx
jne 0x10019fb6
xor edi, edi
jmp 0x10019fff
cmp bl, cl
jne 0x10019fd7
inc edi
jmp 0x10019fe2
mov bl, cl
mov edi, 1
mov byte [esp + 0x10], bl
mov edx, dword [esp + 0x14]
mov ecx, eax
shr ecx, 0x18
and edx, 0xff
xor ecx, edx
shl eax, 8
mov ecx, dword [ecx*4 + 0x10087ef0]
xor eax, ecx
mov ecx, dword [esp + 0x20]
inc ebp
cmp ebp, ecx
jb 0x10019f8e
not eax
mov edi, eax
mov ecx, esi
push edi
call fcn.10019640
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edx
push eax
mov ecx, esi
call fcn.10019740
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8
Function at 0x1001a210
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x14]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0x8ce0]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 8
mov byte [esp + 0x1c], bl
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x8cd4], ebx
mov eax, dword [edx + 0x16c]
mov edx, dword [esi]
push edi
push eax
push ecx
push edx
mov ecx, esi
call fcn.1001a040
mov ecx, dword [esi + 0x8ce0]
cmp byte [ecx + 0x198], bl
je 0x1001a28d
mov eax, dword [esi + 0x8cd8]
lea edx, [eax + eax*8]
shl edx, 3
sub edx, eax
mov eax, dword [ecx + 0x174]
shl edx, 9
mov ecx, dword [edx + eax + 0x8cf0]
push ecx
call fcn.100624f0
mov eax, dword [esi + 0x8cd4]
xor edx, edx
cmp eax, ebx
jbe 0x1001a2ca
lea edi, [esi + 0x7cd4]
mov eax, dword [esi + 0x8ce0]
add edi, 4
add eax, 0x170
mov ecx, dword [eax]
mov ebp, ecx
add ecx, ecx
shr ebp, 0x1f
or ebp, ecx
mov ecx, dword [edi - 4]
xor ebp, ecx
inc edx
mov dword [eax], ebp
mov eax, dword [esi + 0x8cd4]
cmp edx, eax
jb 0x1001a29f
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
push edx
mov edx, dword [esi + 8]
lea ecx, [eax*8 + 8]
mov eax, dword [esp + 0x20]
sub ecx, eax
push ecx
mov ecx, dword [esi + 0x8ce0]
push edx
call fcn.1001a3a0
mov eax, dword [esi + 0x8ce0]
cmp byte [eax + 0x198], bl
je 0x1001a389
mov edi, dword [esi + 0x8cd8]
mov ecx, dword [eax + 0x194]
inc edi
cmp edi, ecx
jne 0x1001a315
xor edi, edi
cmp dword [eax + 0x1ac], ebx
je 0x1001a365
lea ebx, [eax + 0x138]
mov ecx, ebx
call fcn.10015f15
mov ebp, dword [ebx + 0x28]
mov ecx, 0xf
sub ecx, ebp
xor ebx, ebx
shr ecx, 3
add eax, ecx
adc edx, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov edx, dword [esi + 0x8ce0]
mov eax, dword [edx + 0x1ac]
lea edx, [esp + 0x10]
push edx
lea edx, [esi + 0x8cf8]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
mov ebx, eax
mov eax, dword [esi + 0x8ce0]
lea ecx, [edi + edi*8]
shl ecx, 3
mov edx, dword [eax + 0x174]
sub ecx, edi
shl ecx, 9
lea eax, [edx + ecx + 0x8cf0]
push eax
call fcn.10062560
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x100267da
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x1006cb07
call fcn.10062ad8
push ecx
push esi
mov esi, ecx
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], 4
mov dword [esi], 0x10072a64
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0x10
mov dword [esi + 0x14], 0x10072a5c
lea ecx, [esi + 0x30]
mov dword [esi + 0x28], 1
mov byte [esi + 0x2c], al
push 3
mov byte [ebp - 4], 1
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
call fcn.10002b44
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x10028ec4
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x1006d188
call fcn.10062ad8
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 8
mov dword [esi], 0x100717e0
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x14], 0x10072a7c
push 4
mov ebx, 0x10071594
pop eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.10009d99
mov dword [esi + 0x3c], 0x10072bd8
push 4
mov dword [esi + 0x54], edi
pop eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x50], ebx
lea edi, [esi + 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], al
call fcn.10009d99
mov dword [edi], 0x10072be0
lea edi, [esi + 0x78]
mov byte [ebp - 4], 5
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.100252b6
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 6
call fcn.10027eb8
lea edi, [esi + 0xa0]
mov byte [ebp - 4], 7
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.100252b6
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 8
call fcn.10027eb8
lea edi, [esi + 0xc8]
mov byte [ebp - 4], 9
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.100252b6
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xa
call fcn.10027eb8
mov byte [ebp - 4], 0xb
lea edi, [esi + 0xf0]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.100252b6
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xc
call fcn.10027eb8
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 0xd
call fcn.10027eb8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x100369e9
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x1006e3e7
call fcn.10062ad8
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], 4
mov dword [esi], 0x10072a6c
mov dword [ebp - 4], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], 1
mov dword [esi + 0x20], 0x10072d40
lea ecx, [esi + 0x38]
mov byte [esi + 0x34], bl
push 3
mov byte [ebp - 4], 1
mov dword [ecx], ebx
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
call fcn.1000470d
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x48], ebx
mov byte [esi + 0x50], bl
mov dword [esi + 0x4c], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10045cf8
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x1006f9e3
call fcn.10062ad8
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.10002ade
and dword [ebp - 4], 0
lea eax, [edi + 0xc]
push eax
lea ecx, [esi + 0xc]
call fcn.10002ade
lea eax, [edi + 0x18]
lea ecx, [esi + 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.10002ade
lea eax, [edi + 0x24]
lea ecx, [esi + 0x24]
push eax
mov byte [ebp - 4], 2
call fcn.10002ade
lea eax, [edi + 0x30]
lea ecx, [esi + 0x30]
push eax
mov byte [ebp - 4], 3
call fcn.10002ade
mov al, byte [edi + 0x3c]
lea ecx, [esi + 0x40]
mov byte [esi + 0x3c], al
lea eax, [edi + 0x40]
push eax
mov byte [ebp - 4], 4
call fcn.10002ade
add edi, 0x4c
lea ecx, [esi + 0x4c]
push edi
mov byte [ebp - 4], 5
call fcn.10002ade
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1004895c
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x1006ffbe
call fcn.10062ad8
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov al, byte [edi]
lea ecx, [esi + 0xc]
mov byte [esi], al
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
lea eax, [edi + 0xc]
push eax
call fcn.10002ade
and dword [ebp - 4], 0
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 0x18]
call fcn.100489d3
and dword [esi + 0x30], 0
and dword [esi + 0x34], 0
lea ecx, [esi + 0x2c]
lea eax, [edi + 0x2c]
push eax
mov byte [ebp - 4], 1
mov dword [ecx], 0x10071944
call fcn.10026e8b
mov al, byte [edi + 0x38]
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x38], al
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x1004e0f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x50]
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
cmp esi, 0x40
rep stosd dword es:[edi], eax
jbe 0x1004e137
mov ecx, ebx
call fcn.1004e8b0
mov eax, dword [esp + 0x50]
push esi
push eax
mov ecx, ebx
mov dword [ebx + 0x20], 0
call fcn.1004f0c0
lea ecx, [esp + 0xc]
push ecx
mov ecx, ebx
call fcn.1004f160
jmp 0x1004e153
test esi, esi
jbe 0x1004e153
mov ecx, esi
mov esi, dword [esp + 0x50]
mov edx, ecx
lea edi, [esp + 0xc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
mov cl, byte [esp + eax + 0xc]
xor cl, 0x36
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x40
jb 0x1004e155
mov ecx, ebx
call fcn.1004e8b0
lea eax, [esp + 0xc]
push 0x40
push eax
mov ecx, ebx
mov dword [ebx + 0x20], 0
call fcn.1004f0c0
xor eax, eax
mov cl, byte [esp + eax + 0xc]
xor cl, 0x6a
mov byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x40
jb 0x1004e184
lea esi, [ebx + 0x68]
mov ecx, esi
call fcn.1004e8b0
lea ecx, [esp + 0xc]
push 0x40
push ecx
mov ecx, esi
mov dword [esi + 0x20], 0
call fcn.1004f0c0
pop edi
pop esi
pop ebx
add esp, 0x40
ret 8
Function at 0x1004e220
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xbc
xor eax, eax
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x10
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0xd0]
cmp edi, 0x40
jbe 0x1004e2a8
lea ecx, [esp + 0x60]
call fcn.1004e8b0
mov eax, dword [esp + 0xcc]
push edi
push eax
lea ecx, [esp + 0x68]
mov dword [esp + 0x88], 0
call fcn.1004f0c0
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x64]
call fcn.1004f160
xor eax, eax
xor edx, edx
xor ecx, ecx
mov dh, byte [esp + eax + 0xc]
mov cl, byte [esp + eax + 0xe]
mov dl, byte [esp + eax + 0xd]
add eax, 4
shl edx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [esp + eax + 0xb]
shl edx, 8
or edx, ecx
cmp eax, 0x14
mov dword [esp + eax + 0x1c], edx
jb 0x1004e27a
jmp 0x1004e2e1
xor eax, eax
test edi, edi
jbe 0x1004e2e1
push ebp
mov ebp, dword [esp + 0xd0]
mov edx, eax
mov ecx, 3
shr edx, 2
lea esi, [esp + edx*4 + 0x24]
mov edx, eax
and edx, 3
sub ecx, edx
xor edx, edx
mov dl, byte [eax + ebp]
shl ecx, 3
shl edx, cl
mov ecx, dword [esi]
or ecx, edx
inc eax
cmp eax, edi
mov dword [esi], ecx
jb 0x1004e2b6
pop ebp
lea eax, [esp + 0x20]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x36363636
dec ecx
mov dword [eax - 4], edi
jne 0x1004e2ea
mov ecx, ebx
call fcn.1004e8b0
lea eax, [esp + 0x20]
push 0x10
push eax
mov ecx, ebx
mov dword [ebx + 0x20], 0
call fcn.1004f270
lea eax, [esp + 0x20]
mov ecx, 0x10
mov edi, dword [eax]
add eax, 4
xor edi, 0x6a6a6a6a
dec ecx
mov dword [eax - 4], edi
jne 0x1004e320
lea esi, [ebx + 0x68]
mov ecx, esi
call fcn.1004e8b0
lea ecx, [esp + 0x20]
push 0x10
push ecx
mov ecx, esi
mov dword [esi + 0x20], 0
call fcn.1004f270
pop edi
pop esi
pop ebx
add esp, 0xbc
ret 8

Function at 0x1004e3b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x80
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push 5
mov ebp, ecx
push eax
call fcn.1004f050
lea edx, [esp + 0x50]
push 5
lea ecx, [ebp + 0x68]
push edx
call fcn.1004f050
mov ebx, dword [esp + 0x94]
mov eax, dword [esp + 0x98]
mov ecx, 5
mov esi, ebx
lea edi, [esp + 0x10]
test eax, eax
rep movsd dword es:[edi], dword [esi]
jbe 0x1004e43a
mov esi, eax
lea eax, [esp + 0x50]
push 0
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, ebp
call fcn.1004e8e0
lea edx, [esp + 0x10]
push 0
lea eax, [esp + 0x54]
push edx
push eax
lea ecx, [ebp + 0x68]
call fcn.1004e8e0
lea ecx, [esp + 0x10]
mov eax, ebx
sub ecx, ebx
mov edx, 5
mov edi, dword [ecx + eax]
xor dword [eax], edi
add eax, 4
dec edx
jne 0x1004e42c
dec esi
jne 0x1004e3f8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret 8

Function at 0x1004e8b0
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov dword [ecx + 0x18], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x1c], eax
ret
Function at 0x1004f78a
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov edx, dword [ecx + 0xc]
push esi
push edi
mov eax, edx
movzx edi, byte [esp + 0xc]
mov esi, 0xff
and eax, esi
xor eax, edi
shr edx, 8
mov eax, dword [eax*4 + 0x1008ad00]
xor eax, edx
mov edx, dword [ecx + 0x14]
mov dword [ecx + 0xc], eax
and eax, esi
add eax, dword [ecx + 0x10]
mov edi, edx
and edi, esi
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 0x10], eax
shr eax, 0x18
xor eax, edi
pop edi
shr edx, 8
mov eax, dword [eax*4 + 0x1008ad00]
pop esi
xor eax, edx
mov dword [ecx + 0x14], eax
ret 4

Function at 0x1004f9da
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
movzx eax, byte [ebp + 0xc]
push esi
push 0x40
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10062fe0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x40]
add esp, 0xc
xor esi, esi
sub ecx, eax
lea eax, [ebp + esi - 0x40]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc esi
cmp esi, 0x14
jb 0x1004fa01
lea ecx, [ebp - 0xa8]
call fcn.1004e8b0
and dword [ebp - 0x88], 0
lea eax, [ebp - 0x40]
push 0x40
push eax
lea ecx, [ebp - 0xa8]
call fcn.1004f0c0
push dword [ebp + 0x10]
lea ecx, [ebp - 0xa8]
call fcn.1004f160
pop esi
leave
ret 0xc

Function at 0x1004ff60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
test edx, edx
jbe 0x1004ffab
mov eax, dword [esp + 8]
push ebx
push edi
mov edi, edx
mov edx, dword [esp + 0x14]
mov ebx, eax
xor ecx, ecx
mov cl, byte [esi]
and ebx, 0xff
xor ebx, ecx
mov ecx, 8
call fcn.10062cb0
mov ecx, dword [ebx*8 + 0x1008cd00]
xor ecx, eax
mov ebx, dword [ebx*8 + 0x1008cd04]
mov eax, ecx
xor ebx, edx
inc esi
dec edi
mov edx, ebx
jne 0x1004ff73
pop edi
pop ebx
pop esi
ret 8
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
pop esi
ret 8

Function at 0x100527c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
mov eax, ecx
test edi, edi
mov ecx, edx
jbe 0x100527f4
test cl, 3
je 0x100527f4
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [esi + edx*4]
xor eax, edx
dec edi
inc ecx
test edi, edi
ja 0x100527d3
cmp edi, 4
jb 0x10052842
push ebp
mov ebp, edi
shr ebp, 2
mov edx, dword [ecx]
xor ebx, ebx
xor eax, edx
xor edx, edx
mov dword [esp + 0x14], eax
mov dl, ah
mov bl, byte [esp + 0x16]
sub edi, 4
mov edx, dword [esi + edx*4 + 0x800]
add ecx, 4
xor edx, dword [esi + ebx*4 + 0x400]
mov ebx, eax
and ebx, 0xff
shr eax, 0x18
xor edx, dword [esi + ebx*4 + 0xc00]
mov ebx, dword [esi + eax*4]
xor edx, ebx
dec ebp
mov eax, edx
jne 0x100527ff
pop ebp
test edi, edi
jbe 0x10052860
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [esi + edx*4]
xor eax, edx
inc ecx
dec edi
jne 0x10052846
pop edi
pop esi
pop ebx
ret 8
Function at 0x10052d10
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, ecx
lea eax, [ebx + 0x1c]
push esi
shr ebx, 2
mov ecx, ebx
add ebp, 0x10
shr ecx, 1
add ecx, 3
xor esi, esi
mov dword [ebp - 0x10], ecx
push edi
test ebx, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ebx
jbe 0x10052d51
mov eax, ebp
mov ecx, ebx
mov esi, ebx
mov edi, dword [edx]
add edx, 4
mov dword [eax], edi
add eax, 4
dec ecx
jne 0x10052d44
cmp esi, dword [esp + 0x14]
jae 0x10052e3f
lea edx, [ebx*4]
lea edi, [esi*4]
mov dword [esp + 0x18], edx
mov eax, esi
xor edx, edx
div ebx
mov ecx, dword [edi + ebp - 4]
mov dword [esp + 0x10], ecx
test edx, edx
jne 0x10052dd1
mov eax, ecx
xor ebx, ebx
and eax, 0xff
mov edx, ecx
shr edx, 0x18
mov bh, byte [eax + str.cw]
xor eax, eax
mov bl, byte [edx + str.cw]
mov al, byte [esp + 0x12]
xor edx, edx
mov dl, byte [eax + str.cw]
xor eax, eax
mov al, ch
xor ecx, ecx
shl ebx, 8
mov cl, byte [eax + str.cw]
or ebx, edx
mov eax, esi
xor edx, edx
div dword [esp + 0x20]
xor edx, edx
shl ebx, 8
mov dl, byte [eax + 0x100847b0]
xor ecx, edx
or ecx, ebx
jmp 0x10052e1a
cmp ebx, 6
jbe 0x10052e1e
cmp edx, 4
jne 0x10052e1e
xor eax, eax
xor edx, edx
mov al, byte [esp + 0x12]
xor ebx, ebx
mov dl, byte [eax + str.cw]
mov eax, ecx
shr eax, 0x18
mov dh, byte [eax + str.cw]
xor eax, eax
mov al, ch
and ecx, 0xff
shl edx, 8
mov bl, byte [eax + str.cw]
xor eax, eax
mov al, byte [ecx + str.cw]
or edx, ebx
shl edx, 8
or edx, eax
mov ecx, edx
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov eax, edi
sub eax, edx
add edi, 4
mov edx, dword [eax + ebp]
mov eax, dword [esp + 0x14]
xor edx, ecx
inc esi
mov dword [edi + ebp - 4], edx
cmp esi, eax
jb 0x10052d6d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4

Function at 0x10052f00
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
test ebx, ebx
mov edi, edx
mov esi, ecx
je 0x10052f61
push ebp
lea ebp, [esi + 0x10]
mov eax, dword [edi]
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor ecx, eax
mov eax, dword [esi + 8]
mov dword [esi], ecx
mov ecx, dword [edi + 4]
push esi
xor edx, ecx
push esi
mov dword [esi + 4], edx
mov edx, dword [edi + 8]
xor eax, edx
mov edx, dword [esi + 0xc]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
xor edx, eax
push ebp
mov dword [esi + 0xc], edx
call fcn.10052f70
mov ecx, dword [esi]
mov dword [edi], ecx
mov edx, dword [esi + 4]
mov dword [edi + 4], edx
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov ecx, dword [esi + 0xc]
mov dword [edi + 0xc], ecx
add edi, 0x10
dec ebx
jne 0x10052f13
pop ebp
pop edi
pop esi
pop ebx
ret 4