joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012586
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x10042278]
xor eax, ebp
mov dword [ebp + 0x84], eax
push esi
push 0x103
lea eax, [ebp - 0x7f]
push 0
push eax
mov byte [ebp - 0x80], 0
call fcn.10026140
add esp, 0xc
push 0x104
lea esi, [ebp - 0x80]
call fcn.100124fa
mov eax, 0x179b06cc
xor ecx, ecx
movzx edx, byte [ebp + ecx - 0x80]
movzx esi, al
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x10043f60]
inc ecx
cmp ecx, 0x24
jl 0x100125cd
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
not eax
pop esi
call fcn.1001f6e7
add ebp, 0x88
leave
ret

Function at 0x100125ff
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov eax, dword [0x10042278]
xor eax, esp
mov dword [esp + 0x430], eax
mov eax, fcn.1001275b
push esi
test eax, eax
je 0x1001268c
push 0x424
lea eax, [esp + 0x10]
push 0
push eax
call fcn.10026140
add esp, 0xc
push dword [ebp + 8]
mov dword [esp + 0xc], 0x428
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 4], esi
test esi, esi
je 0x10012683
cmp esi, 0xffffffff
je 0x10012683
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
jmp 0x1001267f
push edi
lea eax, [esp + 0xc]
push eax
call fcn.1001275b
test eax, eax
je 0x10012683
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x10012665
lea eax, [esp + 4]
call fcn.100121ed
mov ecx, dword [esp + 0x434]
pop esi
xor ecx, esp
call fcn.1001f6e7
mov esp, ebp
pop ebp
ret 4

Function at 0x100126a1
Capabilities:
Enumerate processes

Disassembly:
push ebp
sub esp, 0x22c
lea ebp, [esp - 4]
mov eax, dword [0x10042278]
xor eax, ebp
mov dword [ebp + 0x22c], eax
push 4
mov eax, 0x100355b0
call fcn.10020ba1
mov eax, fcn.10001850
test eax, eax
je 0x10012738
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x10], esi
and dword [ebp - 4], 0
test esi, esi
je 0x1001272c
cmp esi, 0xffffffff
je 0x1001272c
push 0x228
lea eax, [ebp + 4]
push 0
push eax
mov dword [ebp], 0x22c
call fcn.10026140
add esp, 0xc
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x10012728
push 0
lea eax, [ebp]
push eax
call fcn.10001850
test eax, eax
je 0x1001272c
lea eax, [ebp]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1001270f
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x10]
call fcn.100121ed
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x22c]
xor ecx, ebp
call fcn.1001f6e7
add ebp, 0x230
leave
ret
Function at 0x1001369a
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10036db0
mov eax, dword fs:[0]
push eax
mov eax, 0x2028
call fcn.10030cf0
mov eax, dword [0x10042278]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.100137a4
test al, al
je 0x1001378c
xor eax, eax
mov word [ebp - 0x814], ax
mov word [ebp - 0x1014], ax
push 0x1003baf8
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x1003bb0c
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [ebp - 0x2030]
push eax
call fcn.100135d8
pop ecx
and dword [ebp - 4], 0
cmp dword [eax + 0x18], 8
jb 0x10013727
mov eax, dword [eax + 4]
jmp 0x1001372a
add eax, 4
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x1014]
push 0x400
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
or dword [ebp - 4], 0xffffffff
add esp, 0x14
lea esi, [ebp - 0x2030]
call fcn.10002040
xor eax, eax
mov word [ebp - 0x2014], ax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x1014]
push eax
push 0x800
lea eax, [ebp - 0x2014]
push eax
call dword [sym.imp.SHLWAPI.dll_wvnsprintfW]
lea eax, [ebp - 0x2014]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001f6e7
leave
ret

Function at 0x10013d50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push 0x10001aa0
push esi
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
je 0x10013d87
push dword [ebp + 8]
push dword [ebp - 4]
push str.thread__d_created:__s
call fcn.10013a86
add esp, 0xc
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x1001e096
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
shl eax, 4
pop edx
mov esi, ecx
lea edi, [eax + ecx + 0x3c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, edi
mov bl, byte [ecx]
xor byte [esi + eax], bl
inc eax
add ecx, edx
cmp eax, edx
jl 0x1001e0b0
inc edi
add esi, edx
dec dword [ebp - 4]
jne 0x1001e0ac
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001e14a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10042278]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x10]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
mov al, byte [edi - 4]
mov bl, byte [edi + 4]
call fcn.1001e2d7
push ebx
mov dl, al
call fcn.1001e2b0
xor dl, al
movzx eax, byte [edi + 8]
push eax
call fcn.1001e26b
xor dl, al
movzx eax, byte [edi]
push eax
call fcn.1001e289
xor dl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi - 4], dl
call fcn.1001e26b
push ebx
mov byte [ebp - 0x15], al
call fcn.1001e289
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi + 8]
push eax
mov byte [ebp - 0x15], cl
call fcn.1001e2b0
mov cl, byte [ebp - 0x15]
xor cl, al
mov al, byte [edi]
mov byte [ebp - 0x15], cl
call fcn.1001e2d7
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi], cl
call fcn.1001e2b0
mov bl, al
mov al, byte [edi + 4]
call fcn.1001e2d7
movzx edx, byte [edi + 8]
push edx
xor bl, al
call fcn.1001e289
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.1001e26b
xor bl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi + 4], bl
call fcn.1001e289
mov bl, al
movzx eax, byte [edi + 4]
push eax
call fcn.1001e26b
xor bl, al
mov al, dl
call fcn.1001e2d7
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.1001e2b0
xor bl, al
mov byte [esi + 8], bl
inc esi
inc edi
dec dword [ebp - 0x1c]
jne 0x1001e176
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001f6e7
leave
ret 4
Function at 0x1001e664
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push 0x30
mov eax, 0x10035a7c
call fcn.10020c0a
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor esi, esi
mov eax, edi
mov dword [ebp - 0x3c], esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1001e683
sub eax, ecx
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], 0xf
call fcn.100027a0
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x34], 0
mov dword [ebp - 4], ebx
ja 0x1001e6d2
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.10001f70
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 4], 0
call fcn.10001fa0
mov eax, dword [ebp - 0x38]
call fcn.10020c8d
ret
mov edi, dword [ebp + 0xc]
movsx eax, byte [esi + edi]
mov al, byte [eax + 0x1003ad80]
inc esi
cmp esi, dword [ebp - 0x34]
jae 0x1001e6e6
cmp al, 0xff
je 0x1001e6d2
cmp al, 0xff
je 0x1001e6ab
movsx ecx, byte [esi + edi]
mov cl, byte [ecx + 0x1003ad80]
inc esi
mov byte [ebp - 0x2e], cl
cmp esi, dword [ebp - 0x34]
jae 0x1001e702
cmp cl, 0xff
je 0x1001e6ea
cmp cl, 0xff
je 0x1001e6ab
sar cl, 4
shl al, 2
and cl, 3
or cl, al
movzx eax, cl
push eax
lea edi, [ebp - 0x2c]
call fcn.10012e2b
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x1001e7b3
movsx eax, al
mov al, byte [eax + 0x1003ad80]
mov byte [ebp - 0x2d], al
cmp esi, dword [ebp - 0x34]
jae 0x1001e742
cmp al, 0xff
je 0x1001e71e
cmp al, 0xff
je 0x1001e6ab
mov cl, al
mov al, byte [ebp - 0x2e]
sar cl, 2
shl al, 4
and cl, 0xf
or cl, al
movzx eax, cl
push eax
lea edi, [ebp - 0x2c]
call fcn.10012e2b
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x1001e6ab
movsx eax, al
mov cl, byte [eax + 0x1003ad80]
cmp esi, dword [ebp - 0x34]
jae 0x1001e788
cmp cl, 0xff
je 0x1001e766
cmp cl, 0xff
je 0x1001e6ab
mov al, byte [ebp - 0x2d]
shl al, 6
or al, cl
movzx eax, al
push eax
lea edi, [ebp - 0x2c]
call fcn.10012e2b
cmp esi, dword [ebp - 0x34]
jb 0x1001e6cf
jmp 0x1001e6ab
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.10001f70
jmp 0x1001e6b7

Function at 0x1001f6e7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10042278]
jne 0x1001f6f1
repz ret
jmp fcn.10025728
Function at 0x1002f4c5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10025908
and dword [ebp - 4], 0
cmp dword [0x10045310], 0
mov ebx, eax
jne 0x1002f576
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1002f627
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1002f627
push eax
call fcn.10025896
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10045310], eax
call esi
push eax
call fcn.10025896
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10045314], eax
call esi
push eax
call fcn.10025896
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10045318], eax
call esi
push eax
call fcn.10025896
pop ecx
mov dword [0x10045320], eax
test eax, eax
je 0x1002f576
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10025896
pop ecx
mov dword [0x1004531c], eax
mov eax, dword [0x1004531c]
cmp eax, ebx
je 0x1002f5ce
cmp dword [0x10045320], ebx
je 0x1002f5ce
push eax
call fcn.10025911
push dword [0x10045320]
mov esi, eax
call fcn.10025911
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1002f5ce
test edi, edi
je 0x1002f5ce
call esi
test eax, eax
je 0x1002f5c5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1002f5c5
test byte [ebp - 0xc], 1
jne 0x1002f5ce
or dword [ebp + 0x10], 0x200000
jmp 0x1002f607
mov eax, dword [0x10045314]
cmp eax, ebx
je 0x1002f607
push eax
call fcn.10025911
pop ecx
test eax, eax
je 0x1002f607
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1002f607
mov eax, dword [0x10045318]
cmp eax, ebx
je 0x1002f607
push eax
call fcn.10025911
pop ecx
test eax, eax
je 0x1002f607
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10045310]
call fcn.10025911
pop ecx
test eax, eax
je 0x1002f627
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1002f629
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40213b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x40214a
pop dword [ebp - 8]
mov eax, 0x40214a
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x252271e
sub dword [ebp - 0x18], 0xb3ffe1d3
mov dword [ebp - 0x14], 0x94a38ff4
sub dword [ebp - 0x14], 0x627043af
mov dword [ebp - 0x10], 0x1818750b
add dword [ebp - 0x10], 0x3433cf23
mov dword [ebp - 0xc], 0xfb56d926
add dword [ebp - 0xc], 0x4a926da
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x20181602
add dword [ebp - 0x18], 0x545a5354
mov dword [ebp - 0x14], 0x9b1d6979
add dword [ebp - 0x14], 0xa64ef7fc
mov dword [ebp - 0x10], 0x760298ab
sub dword [ebp - 0x10], 0x12932c3f
mov dword [ebp - 0xc], 0xdf7b089c
add dword [ebp - 0xc], 0x2084f764
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x52ed3e8c
sub eax, 0x52ac9e78
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3aec0
push 0
call eax
mov ecx, 0x506f
mov ebx, eax
mov esi, 0xfde99a36
sub esi, 0xfda5dc36
add esi, dword [ebp - 8]
mov edi, 0xf0899f34
sub edi, 0x2c4d1060
add dword [ebp - 4], 0x582ee6b1
mov edx, dword [esi]
add dword [ebp - 4], edx
xor edx, edi
xor dword [ebp - 4], 0x48210fec
mov dword [ebx], edx
add ebx, 0xb880aaf5
add ebx, 0x477f550f
add esi, 0x791b2a3c
add esi, 0x86e4d5c8
loop 0x40225c
add eax, 0x2b8cc1c3
sub eax, 0x2b8b8d34
mov ebx, eax
add eax, 0xd60c9f53
sub eax, 0xd60c9f4e
mov ecx, 0xeb8fbef
add ecx, 0xf1870411
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x42bd25
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x18
mov al, byte [ecx]
and dword [esp + 0x14], 0
push ebx
push ebp
mov byte [edx], al
lea eax, [edx + 1]
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x14], edx
mov esi, dword [esp + 0x14]
lea eax, [ecx + 1]
xor edi, edi
xor ebp, ebp
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
call fcn.0042bcce
test eax, eax
je 0x42be7e
lea ecx, [esp + 0x18]
call fcn.0042bcce
lea ecx, [esp + 0x18]
test eax, eax
je 0x42bded
call fcn.0042bcce
test eax, eax
je 0x42bdaf
push 4
xor edi, edi
pop ebx
lea ecx, [esp + 0x18]
call fcn.0042bcce
lea edi, [eax + edi*2]
dec ebx
jne 0x42bd85
mov edx, dword [esp + 0x1c]
test edi, edi
je 0x42bda6
mov eax, edx
sub eax, edi
mov al, byte [eax]
mov byte [edx], al
jmp 0x42bda9
mov byte [edx], 0
inc edx
jmp 0x42be90
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
movzx esi, byte [eax]
mov ecx, esi
and ecx, 1
inc eax
add ecx, 2
shr esi, 1
mov dword [esp + 0x18], eax
je 0x42bde5
test ecx, ecx
je 0x42be79
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x42bdd7
jmp 0x42be75
xor ebp, ebp
inc ebp
jmp 0x42be79
call fcn.0042bd04
test edi, edi
jne 0x42be22
cmp eax, 2
jne 0x42be1d
lea ecx, [esp + 0x18]
call fcn.0042bd04
mov edx, dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x42be79
mov ecx, edx
sub ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
dec edi
jne 0x42be12
jmp 0x42be75
sub eax, 3
jmp 0x42be25
sub eax, 2
mov ecx, dword [esp + 0x18]
mov esi, eax
movzx eax, byte [ecx]
shl esi, 8
add esi, eax
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x18]
call fcn.0042bd04
mov ecx, eax
cmp esi, 0x7d00
jb 0x42be4c
inc ecx
cmp esi, 0x500
jb 0x42be55
inc ecx
cmp esi, 0x80
jae 0x42be60
add ecx, 2
mov edx, dword [esp + 0x1c]
test ecx, ecx
je 0x42be79
mov edi, edx
sub edi, esi
mov al, byte [edi]
mov byte [edx], al
inc edx
inc edi
dec ecx
jne 0x42be6c
mov dword [esp + 0x1c], edx
xor edi, edi
inc edi
jmp 0x42be96
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov al, byte [ecx]
mov byte [edx], al
inc edx
inc ecx
mov dword [esp + 0x18], ecx
xor edi, edi
mov dword [esp + 0x1c], edx
test ebp, ebp
je 0x42bd55
sub edx, dword [esp + 0x14]
pop edi
mov eax, edx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42c01b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, edi
shr ebx, 2
and edi, 3
mov esi, ecx
test ebx, ebx
je 0x42c04d
mov al, byte [esp + 0x14]
mov edx, dword [esi]
add al, bl
movzx ecx, al
mov eax, dword [esp + 0x10]
ror edx, cl
xor edx, eax
sub edx, ebx
mov dword [esi], edx
add esi, 4
dec ebx
jne 0x42c02e
jmp 0x42c051
mov eax, dword [esp + 0x10]
test edi, edi
je 0x42c05b
xor byte [esi], al
inc esi
dec edi
jne 0x42c055
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x10001270
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, eax
or eax, 0xffffffff
test cl, 3
je 0x100012a0
jmp 0x10001280
test esi, esi
jbe 0x100012a0
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x100bc5f8]
inc ecx
dec esi
test cl, 3
jne 0x10001280
mov edx, esi
and edx, 0xfffffff0
add edx, ecx
cmp ecx, edx
jae 0x100013e7
push edi
xor eax, dword [ecx]
add ecx, 0x10
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100bc5f8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100bc5f8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100bc5f8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100bc5f8]
xor eax, dword [ecx - 0xc]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100bc5f8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100bc5f8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100bc5f8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100bc5f8]
xor eax, dword [ecx - 8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100bc5f8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100bc5f8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100bc5f8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100bc5f8]
xor eax, dword [ecx - 4]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100bc5f8]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100bc5f8]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100bc5f8]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100bc5f8]
cmp ecx, edx
jb 0x100012b0
pop edi
and esi, 0xf
add esi, ecx
mov edx, esi
cmp ecx, edx
jae 0x1000140c
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x100bc5f8]
inc ecx
cmp ecx, edx
jb 0x100013f2
not eax
pop esi
ret

Function at 0x1000e0b0
Capabilities:
Hash data using murmur3

Disassembly:
mov eax, edi
shr eax, 0x10
xor eax, edi
imul eax, eax, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul ecx, ecx, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
dec edx
xor eax, ecx
and eax, edx
xor ecx, ecx
push esi
mov esi, dword [ebx + eax*4]
test esi, esi
je 0x1000e0f1
cmp esi, edi
je 0x1000e0ed
lea eax, [ecx + eax + 1]
inc ecx
and eax, edx
cmp ecx, edx
jbe 0x1000e0d7
xor al, al
pop esi
ret
mov dword [ebx + eax*4], edi
mov al, 1
pop esi
ret

Function at 0x1000f6e0
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x1000f709
jmp 0x1000f6f0
movsx ecx, cl
add eax, ecx
imul eax, eax, 0x401
mov ecx, eax
shr ecx, 6
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x1000f6f0
lea ecx, [eax + eax*8]
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
ret
Function at 0x1002aae0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1014
call fcn.10084b70
mov eax, dword [0x100a9450]
xor eax, esp
mov dword [esp + 0x100c], eax
mov eax, dword [esp + 0x1018]
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov ebp, eax
test eax, eax
je 0x1002ab8e
jmp 0x1002ab24
mov ecx, dword [esp + 0x14]
mov esi, ebp
cmp ebp, 0x1000
jb 0x1002ab33
mov esi, 0x1000
push esi
lea eax, [esp + 0x1c]
push eax
xor edi, edi
push edi
push ebx
push ecx
mov ecx, dword [ecx + 0x5c]
call ecx
add esp, 0x14
cmp eax, esi
jne 0x1002ab8e
xor eax, eax
test esi, esi
jle 0x1002ab6d
mov cl, bl
add cl, byte [esp + 0x102c]
lea esp, [esp]
mov dl, cl
add dl, al
xor byte [esp + eax + 0x18], dl
inc eax
cmp eax, esi
jl 0x1002ab60
push esi
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x60]
push edi
push ebx
push eax
call ecx
add esp, 0x14
cmp eax, esi
jne 0x1002ab8e
sub ebp, esi
add ebx, esi
test ebp, ebp
jne 0x1002ab20
mov ecx, dword [esp + 0x101c]
pop edi
xor eax, eax
test ebp, ebp
pop esi
pop ebp
sete al
pop ebx
xor ecx, esp
call fcn.10063ade
add esp, 0x1014
ret

Function at 0x1002dea0
Capabilities:
Parse pe header

Disassembly:
push ebp
lea ebp, [ebx - 1]
xor eax, eax
push edi
test ebp, ebp
jbe 0x1002dee5
lea edi, [eax + 0x3c]
mov edi, edi
cmp byte [eax + esi], 0x4d
jne 0x1002dedf
cmp byte [eax + esi + 1], 0x5a
jne 0x1002dedf
lea edx, [ebx - 4]
cmp edi, edx
jae 0x1002dedf
mov ecx, dword [eax + esi + 0x3c]
add ecx, eax
cmp ecx, edx
jbe 0x1002ded2
inc eax
inc edi
jmp 0x1002dedf
cmp byte [ecx + esi], 0x50
jne 0x1002dedf
cmp byte [ecx + esi + 1], 0x45
je 0x1002dee8
inc eax
inc edi
cmp eax, ebp
jb 0x1002deb0
or eax, 0xffffffff
pop edi
pop ebp
ret
Function at 0x1002fa30
Capabilities:
Parse pe header

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov ebx, dword [ebp + 0x20]
push esi
push edi
mov dword [esp + 0x18], 0xfffffff2
mov edi, ebx
test bl, 1
je 0x1002fa50
lea edi, [ebx - 1]
push ebx
call fcn.10063c44
mov esi, eax
add esp, 4
test esi, esi
jne 0x1002fa6a
lea eax, [esi - 0xc]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [ebp + 0x5c]
push ebx
push esi
push 0
push 0
push ebp
call eax
add esp, 0x14
cmp eax, ebx
je 0x1002fa8a
mov eax, 0xfffffff2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
xor eax, eax
mov ecx, 0x5a4d
mov dword [esp + 0x14], eax
cmp word [esi], cx
jne 0x1002fb3d
mov ecx, dword [esi + 0x3c]
add ecx, esi
cmp dword [ecx], 0x4550
jne 0x1002fb3d
sub ecx, esi
add ecx, 0x58
mov dword [esp + 0x10], ecx
xor ecx, ecx
test edi, edi
jbe 0x1002faf4
mov edi, edi
movzx edx, word [ecx + esi]
cmp ecx, dword [esp + 0x10]
je 0x1002fad3
lea ebp, [ecx - 2]
cmp ebp, dword [esp + 0x10]
jne 0x1002fad5
xor edx, edx
movzx edx, dx
add eax, edx
mov edx, eax
shr edx, 0x10
add edx, eax
and edx, 0xffff
add ecx, 2
mov eax, edx
cmp ecx, edi
jb 0x1002fac0
mov ebp, dword [esp + 0x20]
cmp ebx, edi
je 0x1002fb06
movzx ecx, byte [esi + edi]
add ecx, eax
and ecx, 0xffff
mov eax, ecx
mov ecx, dword [ebp + 0x60]
push 4
add eax, ebx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
push 0
push eax
push ebp
call ecx
add esp, 0x14
cmp eax, 4
jne 0x1002fb3d
push esi
xor edi, edi
call fcn.10063aed
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov edi, dword [esp + 0x18]
push esi
call fcn.10063aed
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x1002ff10
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40c
mov eax, dword [0x100a9450]
xor eax, esp
mov dword [esp + 0x408], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push esi
cmp ecx, dword [eax + 0x24]
jb 0x1002ff40
ja 0x1002ff99
cmp edx, dword [eax + 0x20]
ja 0x1002ff99
push 0x400
lea esi, [esp + 0xc]
push esi
push ecx
push edx
push eax
mov eax, dword [eax + 0x5c]
call eax
add esp, 0x14
cmp eax, 0x400
jne 0x1002ff99
mov ecx, 0x5a4d
cmp word [esp + 8], cx
jne 0x1002ff99
mov eax, dword [esp + 0x44]
lea edx, [eax + 4]
cmp edx, 0x400
ja 0x1002ff99
cmp dword [esp + eax + 8], 0x4550
jne 0x1002ff99
mov eax, 1
pop esi
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.10063ade
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x40c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.10063ade
mov esp, ebp
pop ebp
ret

Function at 0x1003a4b0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], al
inc eax
cmp eax, 0x1b8
jl 0x1003a4b2
mov eax, dword [edx + 0x60]
push 0x1b8
push ecx
push 0
push 0
push edx
call eax
add esp, 0x14
ret