joyce8/EMBER2024-capa huggingface dataset:
Function at 0xc9300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0xc], edx
test esi, esi
je 0xc939e
cmp esi, 8
jb 0xc9382
lea eax, [esi - 1]
push ebx
lea eax, [edx + eax*4]
lea ebx, [esi - 1]
lea ebx, [ecx + ebx*4]
cmp ecx, eax
ja 0xc9332
cmp ebx, edx
jae 0xc9381
mov eax, esi
mov ebx, esi
and eax, 7
mov esi, edx
sub ebx, eax
sub esi, ecx
mov dword [ebp - 4], esi
lea eax, [ecx + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 8], ebx
mov ebx, edx
mov edx, dword [ebp - 4]
movups xmm0, xmmword [ebx]
add edi, 8
lea ebx, [ebx + 0x20]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax - 0x30]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [edx + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp edi, dword [ebp - 8]
jb 0xc9350
mov edx, dword [ebp - 0xc]
pop ebx
cmp edi, esi
jae 0xc939e
sub edx, ecx
lea eax, [ecx + edi*4]
sub esi, edi
nop dword [eax]
mov ecx, dword [eax + edx]
lea eax, [eax + 4]
xor dword [eax - 4], ecx
sub esi, 1
jne 0xc9390
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0xc93b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0xc], edx
mov eax, edi
mov dword [ebp - 0x10], edi
or eax, edx
or eax, esi
test al, 3
jne 0xc93df
shr esi, 2
push esi
call fcn.000c9300
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor ecx, ecx
test esi, esi
je 0xc946e
cmp esi, 0x20
jb 0xc9453
push ebx
lea eax, [edx - 1]
lea ebx, [esi - 1]
add eax, esi
add ebx, edi
cmp edi, eax
ja 0xc9401
cmp ebx, edx
jae 0xc9452
mov eax, esi
mov ebx, esi
and eax, 0x1f
mov esi, edx
sub ebx, eax
sub esi, edi
mov dword [ebp - 4], esi
mov eax, edi
lea esi, [edx + 0x10]
mov edx, dword [ebp - 4]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 8]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [edx + eax - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [edi + ecx]
add ecx, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp ecx, ebx
jb 0xc9422
mov edx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
pop ebx
cmp ecx, esi
jae 0xc946e
sub edx, edi
lea eax, [ecx + edi]
sub esi, ecx
nop
mov cl, byte [eax + edx]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub esi, 1
jne 0xc9460
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0xca5e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
shr eax, 4
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
test eax, eax
je 0xca687
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [ecx + 0xf4]
dec eax
mov dword [ebp + 0xc], eax
mov eax, esi
or eax, edi
test al, 3
jne 0xca622
push 4
mov edx, edi
mov ecx, esi
call fcn.000c9300
add esp, 4
jmp 0xca65d
lea eax, [edi + 0xf]
lea ecx, [esi + 0xf]
cmp esi, eax
ja 0xca650
cmp ecx, edi
jb 0xca650
mov ebx, edi
mov eax, esi
sub ebx, esi
mov edx, 0x10
nop dword [eax + eax]
mov cl, byte [ebx + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0xca640
jmp 0xca65d
movups xmm1, xmmword [esi]
movups xmm0, xmmword [edi]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
mov ecx, dword [ebp - 8]
mov edx, esi
push esi
call fcn.000c9480
mov edx, dword [ebp - 4]
add esp, 4
movups xmm0, xmmword [esi]
mov eax, dword [ebp + 0xc]
add edi, 0x10
movups xmmword [edx], xmm0
add edx, 0x10
mov dword [ebp - 4], edx
test eax, eax
jne 0xca606
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0xca690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
shr eax, 4
mov ebx, ecx
mov dword [ebp - 4], ebx
push esi
mov esi, edx
test eax, eax
je 0xca746
push edi
lea ecx, [ebx + 0x104]
lea edi, [ebx + 0xf4]
dec eax
mov edx, ecx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
push esi
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
mov ecx, ebx
call fcn.000c9a10
mov eax, edi
add esp, 4
or eax, esi
test al, 3
jne 0xca6ea
push 4
mov edx, edi
mov ecx, esi
call fcn.000c9300
add esp, 4
jmp 0xca723
lea eax, [edi + 0xf]
cmp esi, eax
ja 0xca716
lea eax, [esi + 0xf]
cmp eax, edi
jb 0xca716
mov ebx, edi
mov eax, esi
sub ebx, esi
mov edx, 0x10
mov cl, byte [ebx + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0xca703
mov ebx, dword [ebp - 4]
jmp 0xca723
movups xmm1, xmmword [edi]
movups xmm0, xmmword [esi]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
movups xmm0, xmmword [ebx + 0x104]
add dword [ebp + 8], 0x10
lea ecx, [ebx + 0x104]
mov eax, dword [ebp + 0xc]
add esi, 0x10
movups xmmword [edi], xmm0
test eax, eax
jne 0xca6b8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xcaf50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, ecx
mov dword [ebp - 4], 0
push ebx
push esi
push edi
lea ebx, [eax + 1]
mov dword [ebp - 8], 0x20
sub eax, edx
lea esi, [edx + 3]
mov dword [ebp - 0xc], eax
movzx eax, byte [ebx - 1]
lea esi, [esi + 4]
movzx edi, byte [esi - 7]
lea ebx, [ebx + 4]
movzx ecx, byte [esi - 5]
xor edi, eax
movzx eax, byte [ebx - 3]
movzx edx, byte [esi - 6]
xor ecx, eax
mov eax, dword [ebp - 0xc]
or edi, ecx
movzx ecx, byte [eax + esi - 4]
movzx eax, byte [esi - 4]
xor ecx, eax
mov eax, dword [ebp - 4]
or edi, ecx
movzx ecx, byte [ebx - 4]
xor edx, ecx
or edi, edx
or eax, edi
sub dword [ebp - 8], 1
mov dword [ebp - 4], eax
jne 0xcaf74
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xcafd0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x1a700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, 0x1b8
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xa0], eax
mov eax, ecx
ror eax, 8
push ebx
rol ecx, 8
and eax, 0xff00ff00
and ecx, 0xff00ff
mov byte [ebp - 0x91], 1
push esi
or eax, ecx
mov esi, edx
push edi
mov edi, 0x37
mov dword [ebp - 0x98], eax
xor ebx, ebx
push 1
lea edx, [ebp - 0x91]
mov dword [ebp - 0x84], 0x6a09e667
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x80], 0xbb67ae85
mov dword [ebp - 0x7c], 0x3c6ef372
mov dword [ebp - 0x78], 0xa54ff53a
mov dword [ebp - 0x74], 0x510e527f
mov dword [ebp - 0x70], 0x9b05688c
mov dword [ebp - 0x6c], 0x1f83d9ab
mov dword [ebp - 0x68], 0x5be0cd19
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
call fcn.000e5a70
add esp, 4
test eax, eax
jne 0xcb193
push 4
lea edx, [ebp - 0x98]
lea ecx, [ebp - 0x90]
call fcn.000e5a70
add esp, 4
test eax, eax
jne 0xcb193
cmp byte [ebp + 0xc], 4
je 0xcb0de
push 1
lea edx, [ebp + 0xc]
lea ecx, [ebp - 0x90]
call fcn.000e5a70
add esp, 4
test eax, eax
jne 0xcb193
push dword [ebp + 0x14]
mov edx, dword [ebp - 0x9c]
lea ecx, [ebp - 0x90]
call fcn.000e5a70
add esp, 4
test eax, eax
jne 0xcb193
mov eax, dword [ebp - 0xa0]
test eax, eax
je 0xcb123
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
je 0xcb123
push ecx
mov edx, eax
lea ecx, [ebp - 0x90]
call fcn.000e5a70
add esp, 4
test eax, eax
jne 0xcb193
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0x90]
call fcn.000e5b20
test eax, eax
jne 0xcb193
cmp edi, 0x20
jbe 0xcb151
movups xmm0, xmmword [ebp - 0x24]
sub edi, 0x20
movups xmmword [esi], xmm0
movups xmm0, xmmword [ebp - 0x14]
movups xmmword [esi + 0x10], xmm0
add esi, 0x20
jmp 0xcb15f
push edi
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.00153810
add esp, 0xc
inc byte [ebp - 0x91]
inc ebx
cmp ebx, 2
jl 0xcb028
mov eax, 0x20
lea ecx, [ebp - 0x24]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0xcb177
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 2
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
Function at 0xcb270
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
mov eax, dword [0x1a700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, 1
push esi
mov esi, dword [ebp + 0xc]
test ebx, ebx
push edi
cmove ebx, eax
mov dword [ebp - 0xb0], edx
mov edi, ecx
mov dword [ebp - 0xb4], 0
movups xmm0, xmmword [esi]
test bl, 0x1f
mov ecx, 0
mov eax, ebx
setne cl
shr eax, 5
add ecx, eax
mov eax, dword [esi + 0x30]
mov dword [ebp - 0xc], eax
mov ax, word [esi + 0x34]
mov word [ebp - 8], ax
mov al, byte [esi + 0x36]
mov dword [ebp - 0xac], ecx
mov byte [ebp - 6], al
movups xmmword [ebp - 0x3c], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [ebp - 0x2c], xmm0
movups xmm0, xmmword [esi + 0x20]
movups xmmword [ebp - 0x1c], xmm0
test ecx, ecx
jle 0xcb46c
mov esi, ecx
nop word [eax + eax]
push 0x37
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x9c], 0x6a09e667
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x98], 0xbb67ae85
mov dword [ebp - 0x94], 0x3c6ef372
mov dword [ebp - 0x90], 0xa54ff53a
mov dword [ebp - 0x8c], 0x510e527f
mov dword [ebp - 0x88], 0x9b05688c
mov dword [ebp - 0x84], 0x1f83d9ab
mov dword [ebp - 0x80], 0x5be0cd19
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0
call fcn.000e5a70
add esp, 4
test eax, eax
jne 0xcb4a6
lea edx, [ebp - 0xd4]
lea ecx, [ebp - 0xa8]
call fcn.000e5b20
test eax, eax
jne 0xcb4a6
cmp dword [edi], 1
mov eax, dword [ebp - 0xd4]
jbe 0xcb3da
cmp eax, dword [edi + 4]
jne 0xcb3da
cmp byte [edi + 0x76], 1
je 0xcb490
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0xb4], eax
jne 0xcb3ce
inc eax
mov dword [ebp - 0xac], eax
mov esi, dword [ebp - 0xac]
mov byte [edi + 0x76], 1
jmp 0xcb3e1
mov byte [edi + 0x76], 0
mov dword [edi + 4], eax
mov ecx, dword [ebp - 0xb0]
cmp ebx, 0x20
jb 0xcb43c
movups xmm0, xmmword [ebp - 0xd4]
sub ebx, 0x20
mov eax, 0x36
movups xmmword [ecx], xmm0
movups xmm0, xmmword [ebp - 0xc4]
movups xmmword [ecx + 0x10], xmm0
add ecx, 0x20
mov dword [ebp - 0xb0], ecx
add byte [ebp + eax - 0x3c], 1
jne 0xcb457
add byte [ebp + eax - 0x3d], 1
jne 0xcb457
add byte [ebp + eax - 0x3e], 1
jne 0xcb457
add byte [ebp + eax - 0x3f], 1
jne 0xcb457
add byte [ebp + eax - 0x40], 1
jne 0xcb457
sub eax, 5
jns 0xcb412
jmp 0xcb457
test ecx, ecx
je 0xcb457
test ebx, ebx
je 0xcb457
push ebx
lea eax, [ebp - 0xd4]
push eax
push ecx
call fcn.00153810
add esp, 0xc
xor ebx, ebx
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp eax, esi
jl 0xcb300
mov eax, 0x37
lea ecx, [ebp - 0x3c]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0xcb474
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 4
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 2
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00150cb2
mov esp, ebp
pop ebp
ret
Function at 0xe0330
Capabilities:
Hash data with md5

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, dword [edi + 4]
mov ecx, dword [edi]
lea eax, [ecx + esi]
mov dword [edi + 4], eax
cmp eax, esi
jae 0xe0349
inc dword [edi + 8]
mov byte [ecx + edi + 0xc], 0x80
mov ecx, dword [edi]
inc ecx
mov dword [edi], ecx
cmp ecx, 0x38
jbe 0xe0383
mov eax, 0x40
sub eax, ecx
push eax
lea eax, [edi + 0xc]
add eax, ecx
push 0
push eax
call fcn.00153d90
add esp, 0xc
mov dword [edi], 0x40
mov ecx, edi
call 0xdfc00
mov dword [edi], 0
mov eax, 0x38
sub eax, dword [edi]
push eax
lea eax, [edi + 0xc]
add eax, dword [edi]
push 0
push eax
call fcn.00153d90
mov edx, dword [edi + 4]
add esp, 0xc
mov eax, dword [edi + 8]
mov ecx, edx
shr ecx, 0x1d
lea eax, [ecx + eax*8]
mov ecx, edi
mov dword [edi + 8], eax
lea eax, [edx*8]
mov dword [edi + 4], eax
mov dword [edi + 0x44], eax
mov eax, dword [edi + 8]
mov dword [edi + 0x48], eax
call 0xdfc00
movups xmm0, xmmword [edi + 0x4c]
movups xmmword [ebx], xmm0
mov dword [edi + 0x4c], 0x67452301
mov dword [edi + 0x50], 0xefcdab89
mov dword [edi + 0x54], 0x98badcfe
mov dword [edi + 0x58], 0x10325476
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
pop edi
pop esi
pop ebx
ret

Function at 0xe0410
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1a700c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edx
mov edx, ecx
mov dword [ebp - 0x14], 0x67452301
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x10], 0xefcdab89
mov dword [ebp - 0xc], 0x98badcfe
mov dword [ebp - 8], 0x10325476
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
call fcn.000e02b0
add esp, 4
lea ecx, [ebp - 0x60]
mov edx, esi
call fcn.000e0330
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00150cb2
mov esp, ebp
pop ebp
ret

Function at 0xe04f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ecx]
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
movzx edx, byte [ecx + 1]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], eax
test edi, edi
je 0xe0572
sub ebx, dword [ebp + 8]
lea eax, [ecx + 2]
mov ecx, dword [ebp - 4]
push esi
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xc], ebx
nop
movzx ebx, byte [eax + ecx]
mov esi, dword [ebp + 0xc]
lea eax, [ebx + edx]
mov edx, dword [ebp + 0xc]
movzx eax, al
mov dword [ebp - 8], eax
movzx edx, byte [edx + eax]
mov byte [esi + ecx], dl
mov byte [esi + eax], bl
lea eax, [ecx + 1]
movzx ecx, al
lea eax, [edx + ebx]
mov edx, esi
mov esi, dword [ebp + 8]
movzx eax, al
mov al, byte [eax + edx]
mov edx, dword [ebp - 0xc]
xor al, byte [esi]
mov byte [edx + esi], al
inc esi
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], esi
sub edi, 1
jne 0xe0520
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
pop esi
pop edi
mov byte [ecx + 1], dl
mov byte [ecx], al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xe5480
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx + 0xc], 0x6a09e667
xor eax, eax
mov dword [ecx + 0x10], 0xbb67ae85
mov dword [ecx + 0x14], 0x3c6ef372
mov dword [ecx + 0x18], 0xa54ff53a
mov dword [ecx + 0x1c], 0x510e527f
mov dword [ecx + 0x20], 0x9b05688c
mov dword [ecx + 0x24], 0x1f83d9ab
mov dword [ecx + 0x28], 0x5be0cd19
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
ret
Function at 0xe7290
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
lea esi, [edx + 0x3f]
mov dword [ebp - 0xc], 0
shr esi, 6
mov edi, edx
sub edi, esi
mov ebx, ecx
mov esi, dword [ebp + 0xc]
inc edi
xor eax, eax
mov dword [ebp - 0x14], ebx
lea ecx, [edi + edi*2]
shr ecx, 2
cmp ecx, dword [esi]
jbe 0xe72cb
pop edi
pop esi
mov eax, 0xffffff53
pop ebx
mov esp, ebp
pop ebp
ret
cmp edx, 3
jbe 0xe745a
mov dword [ebp - 0x18], 1
xor esi, esi
nop dword [eax]
mov cl, byte [eax + ebx]
xor edi, edi
mov ch, byte [eax + ebx + 3]
mov byte [ebp - 1], cl
mov cl, byte [eax + ebx + 1]
mov byte [ebp - 2], cl
mov cl, byte [eax + ebx + 2]
add eax, 4
cmp byte [ebp - 1], 0
mov byte [ebp - 3], cl
mov byte [ebp - 5], ch
je 0xe745a
cmp cl, 0x3d
mov esi, edi
cmove esi, dword [ebp - 0x18]
cmp ch, 0x3d
mov dword [ebp - 0x10], esi
mov esi, 1
cmove edi, esi
cmp byte [ebp - 1], 0x2b
mov esi, dword [ebp - 0xc]
jb 0xe746b
cmp byte [ebp - 2], 0x2b
jb 0xe746b
cmp cl, 0x2b
jb 0xe746b
cmp ch, 0x2b
jb 0xe746b
cmp byte [ebp - 1], 0x7a
ja 0xe746b
cmp byte [ebp - 2], 0x7a
ja 0xe746b
cmp cl, 0x7a
ja 0xe746b
cmp ch, 0x7a
ja 0xe746b
movzx ecx, byte [ebp - 1]
mov cl, byte [ecx + 0x186e5d]
mov byte [ebp - 1], cl
movzx ecx, byte [ebp - 2]
mov cl, byte [ecx + 0x186e5d]
mov byte [ebp - 4], cl
mov cl, byte [ebp - 3]
cmp cl, 0x3d
jne 0xe7396
xor cl, cl
jmp 0xe739f
movzx ecx, cl
mov cl, byte [ecx + 0x186e5d]
mov byte [ebp - 2], cl
mov cl, byte [ebp - 5]
cmp cl, 0x3d
jne 0xe73b0
mov byte [ebp - 3], 0
jmp 0xe73bc
movzx ecx, cl
mov cl, byte [ecx + 0x186e5d]
mov byte [ebp - 3], cl
mov ch, byte [ebp - 2]
mov ebx, dword [ebp + 8]
mov cl, ch
shl byte [ebp - 1], 2
shl cl, 6
or cl, byte [ebp - 3]
mov byte [ebp - 5], cl
mov cl, byte [ebp - 4]
shr cl, 4
or cl, byte [ebp - 1]
mov byte [esi + ebx], cl
inc esi
cmp dword [ebp - 0x10], 0
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0xc], esi
jne 0xe7402
mov cl, byte [ebp - 4]
mov ebx, dword [ebp + 8]
shr ch, 2
shl cl, 4
or ch, cl
mov byte [esi + ebx], ch
inc esi
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0xc], esi
test edi, edi
jne 0xe745a
mov edi, dword [ebp + 8]
mov cl, byte [ebp - 5]
mov byte [esi + edi], cl
inc esi
mov dword [ebp - 0xc], esi
sub edx, 4
je 0xe7451
mov cl, byte [eax + ebx]
cmp cl, 0x20
je 0xe742a
cmp cl, 0xd
je 0xe742a
cmp cl, 0xa
jne 0xe7451
inc eax
sub edx, 1
je 0xe743e
cmp cl, 0x20
jne 0xe743e
mov cl, byte [eax + ebx]
inc eax
sub edx, 1
jne 0xe7430
cmp cl, 0xd
jne 0xe744c
test edx, edx
je 0xe746b
mov cl, byte [eax + ebx]
inc eax
dec edx
cmp cl, 0xa
jne 0xe746b
cmp edx, 3
ja 0xe72e0
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
mov dword [ecx], eax
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffff66
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xec500
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov ecx, edx
mov dword [ebp - 4], edx
add esi, 0xdeadbeef
add esi, ecx
mov edx, esi
mov dword [ebp + 8], edx
push edi
mov edi, esi
cmp ecx, 0xc
jbe switch.0x000ec603
add ecx, 0xfffffff3
mov eax, 0xaaaaaaab
mul ecx
mov eax, edx
shr eax, 3
inc eax
mov dword [ebp - 8], eax
nop
movzx ecx, byte [ebx + 7]
movzx eax, byte [ebx + 6]
shl ecx, 8
add ecx, eax
movzx edx, byte [ebx + 8]
movzx eax, byte [ebx + 5]
add edx, esi
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 4]
shl ecx, 8
add edi, eax
movzx eax, byte [ebx + 0xa]
add edi, ecx
movzx ecx, byte [ebx + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx + 2]
shl ecx, 8
add edx, ecx
movzx ecx, byte [ebx + 3]
shl ecx, 8
mov esi, edx
add ecx, eax
rol esi, 4
movzx eax, byte [ebx + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [ebx]
shl ecx, 8
add ebx, 0xc
add ecx, eax
sub ecx, edx
add edx, edi
add ecx, dword [ebp + 8]
xor esi, ecx
sub edi, esi
mov eax, esi
add esi, edx
rol eax, 6
xor eax, edi
sub edx, eax
mov ecx, eax
rol ecx, 8
add eax, esi
xor ecx, edx
sub esi, ecx
mov edx, ecx
rol edx, 0x10
add ecx, eax
xor edx, esi
mov edi, edx
sub eax, edx
ror edi, 0xd
add edx, ecx
xor edi, eax
mov dword [ebp + 8], edx
sub ecx, edi
mov esi, edi
rol esi, 4
add edi, edx
xor esi, ecx
mov ecx, dword [ebp - 4]
sub ecx, 0xc
sub dword [ebp - 8], 1
mov dword [ebp - 4], ecx
jne 0xec540
cmp ecx, 0xc
ja 0xec66f
jmp dword [ecx*4 + 0xec6bc]
movzx eax, byte [ebx + 0xb]
shl eax, 0x18
add esi, eax
movzx eax, byte [ebx + 0xa]
shl eax, 0x10
add esi, eax
movzx eax, byte [ebx + 9]
shl eax, 8
add esi, eax
movzx eax, byte [ebx + 8]
add esi, eax
movzx eax, byte [ebx + 7]
shl eax, 0x18
add edi, eax
movzx eax, byte [ebx + 6]
shl eax, 0x10
add edi, eax
movzx eax, byte [ebx + 5]
shl eax, 8
add edi, eax
movzx eax, byte [ebx + 4]
add edi, eax
movzx eax, byte [ebx + 3]
shl eax, 0x18
add edx, eax
movzx eax, byte [ebx + 2]
shl eax, 0x10
add edx, eax
movzx eax, byte [ebx + 1]
shl eax, 8
add edx, eax
movzx eax, byte [ebx]
add edx, eax
mov dword [ebp + 8], edx
xor esi, edi
mov eax, edi
rol eax, 0xe
sub esi, eax
mov eax, esi
mov edx, esi
xor edx, dword [ebp + 8]
rol eax, 0xb
sub edx, eax
xor edi, edx
mov eax, edx
ror eax, 7
sub edi, eax
mov eax, edi
xor esi, edi
rol eax, 0x10
sub esi, eax
mov eax, esi
mov ecx, esi
rol eax, 4
xor ecx, edx
sub ecx, eax
mov eax, ecx
xor edi, ecx
rol eax, 0xe
sub edi, eax
mov eax, edi
xor esi, edi
ror eax, 8
sub esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xee340
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
mov esi, dword [0x1aa224]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0xee37d
push 0xc08
call fcn.0015c8ae
add esp, 4
mov ebx, eax
push 0xc08
push 0
push ebx
call fcn.00153d90
add esp, 0xc
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [ebx]
lea edi, [ebx + 0x806]
test esi, esi
jne 0xee38f
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x400
push 0
push edi
call fcn.00153d90
add esp, 0xc
test esi, 0x1000000
je 0xee3be
and esi, 0xffffff
push dword [esi*4 + 0x18713c]
push 0x17bec4
jmp 0xee49d
test esi, 0x2000000
je 0xee3ed
and esi, 0xffffff
cmp esi, 0xe
jge 0xee3e2
push dword [esi*4 + 0x187104]
push 0x17bec4
jmp 0xee49d
push esi
push str.imgtools_error:__u
jmp 0xee49d
test esi, 0x4000000
je 0xee41c
and esi, 0xffffff
cmp esi, 8
jge 0xee411
push dword [esi*4 + 0x1870e4]
push 0x17bec4
jmp 0xee49d
push esi
push str.mmtools_error:__u
jmp 0xee49d
test esi, 0x8000000
je 0xee445
and esi, 0xffffff
cmp esi, 0x12
jge 0xee43d
push dword [esi*4 + 0x1871b8]
push 0x17bec4
jmp 0xee49d
push esi
push str.fstools_error:__u
jmp 0xee49d
test esi, 0x10000000
je 0xee46e
and esi, 0xffffff
cmp esi, 0xd
jge 0xee466
push dword [esi*4 + 0x187174]
push 0x17bec4
jmp 0xee49d
push esi
push str.hashtools_error:__u
jmp 0xee49d
test esi, 0x20000000
je 0xee497
and esi, 0xffffff
cmp esi, 4
jge 0xee48f
push dword [esi*4 + 0x1871a8]
push 0x17bec4
jmp 0xee49d
push esi
push str.auto_error:__u
jmp 0xee49d
push esi
push str.Unknown_Error:__u
push 0x400
push edi
call fcn.000ea670
mov ecx, edi
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xee4b0
lea eax, [ebx + 4]
sub ecx, edx
cmp byte [eax], 0
mov esi, 0x400
je 0xee4eb
push eax
mov eax, esi
sub eax, ecx
push str.___s_
push eax
lea eax, [edi + ecx]
push eax
call fcn.000ea670
mov ecx, edi
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0xee4e2
sub ecx, edx
add ebx, 0x405
cmp byte [ebx], 0
je 0xee50a
push ebx
sub esi, ecx
add ecx, edi
push str.___s_
push esi
push ecx
call fcn.000ea670
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0xee510
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push edi
mov edi, dword [0x1aa224]
push edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0xee54c
push esi
push 0xc08
call fcn.0015c8ae
push 0xc08
mov esi, eax
push 0
push esi
call fcn.00153d90
add esp, 0x10
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esi]
pop esi
pop edi
ret
mov eax, dword [eax]
pop edi
ret