joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100183b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1006a050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1001846c
cmp byte [esi + 0x3d], 0
je 0x1001846c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1001845a
mov ecx, dword [esi + 0x38]
mov eax, dword [ecx]
mov edx, dword [eax + 0x20]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call edx
sub eax, 0
je 0x10018422
sub eax, 1
je 0x10018426
sub eax, 2
jne 0x1001845a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10031b48
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10018443
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.100387c8
add esp, 0x10
cmp edi, eax
jne 0x1001845a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10031b48
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10031b48
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10031b48
mov esp, ebp
pop ebp
ret

Function at 0x100189f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10051590
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1006a050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.10031b56
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.10030706
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019540
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1006a050]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push ecx
push dword [ebp + 8]
mov ecx, 0x100942a0
call fcn.10009d70
push 0x100942a0
push 0x10062a10
push 1
push 0x100929f8
call fcn.10017010
add esp, 0x1c
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHQueryUserNotificationState]
mov eax, dword [ebp - 8]
cmp eax, 2
je 0x100195bc
cmp eax, 3
je 0x100195bc
cmp eax, 4
je 0x100195bc
push 0x41010
push str.CLEO_error
push 0x100942a0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10031b48
mov esp, ebp
pop ebp
ret
push 0
push 0xf020
push 0x112
push 0
call dword [sym.imp.USER32.dll_PostMessageA]
push 6
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x41010
push str.CLEO_error
push 0x100942a0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0xf120
push 0x112
push 0
call dword [sym.imp.USER32.dll_PostMessageA]
push 9
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10031b48
mov esp, ebp
pop ebp
ret

Function at 0x10019e70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1006a050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.Injecting_MenuStatusNotifier...
push 3
call fcn.100197f0
mov esi, dword [0x10092c2c]
add esp, 8
mov eax, dword [esi*4 + 0x1006aaa0]
mov esi, dword [esi*4 + 0x1006ab68]
mov dword [0x1008cee4], eax
inc esi
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [esi]
add esi, 4
add eax, esi
mov esi, dword [0x10092c2c]
mov dword [0x1008cee0], eax
mov esi, dword [esi*4 + 0x1006ab68]
push esi
push str.Replacing_call:_0x_08X
push 3
call fcn.100197f0
lea ecx, [esi + 1]
mov byte [esi], 0xe8
mov eax, 0x10019830
add esp, 0xc
sub eax, ecx
sub eax, 4
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10031b48
mov esp, ebp
pop ebp
ret 4
Function at 0x10021e60
Capabilities:
Access peb ldr_data
Create thread
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005228e
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x1006a050]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebx], eax
mov dword [ebp - 4], 0
push 0xa0
mov dword [ebx + 4], 0
call fcn.10031b56
add esp, 4
mov dword [ebx + 4], eax
lea esi, [eax + 0x10]
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0x14]
mov ecx, esi
mov dword [ebp - 0x18], esi
push dword [eax]
call fcn.1000aee0
lea edi, [esi + 0x18]
mov dword [ebp - 0x20], edi
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov byte [ebp - 4], 4
lea esi, [edi + 0x24]
mov dword [ebp - 0x14], esi
push 0x44
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10031b56
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov dword [edi + 0x2c], 0
lea eax, [edi + 0x3c]
push 2
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
push eax
mov word [edi + 0x38], 1
call fcn.10030e85
push 8
mov byte [ebp - 4], 6
call fcn.10031b56
mov dword [ebp - 0x14], eax
mov dword [eax], edi
mov dword [eax + 4], 0x1001ffc0
lea esi, [edi + 0x70]
mov byte [ebp - 4], 7
push esi
push 0
push eax
push 0x100220d0
push 0
push 0
call fcn.100398bf
add esp, 0x28
mov dword [edi + 0x6c], eax
test eax, eax
je 0x10021fd1
mov ecx, dword [ebx + 4]
mov eax, ebx
mov edx, dword [ebp + 0xc]
mov dword [ecx], edx
mov ecx, dword [ebx + 4]
mov dword [ecx + 4], edx
mov ecx, dword [ebx + 4]
mov dword [ecx + 8], edx
mov ecx, dword [ebx + 4]
mov byte [ecx + 0xc], 0
mov ecx, dword [ebx + 4]
mov byte [ecx + 0xd], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10031b48
mov esp, ebp
pop ebp
ret 0x14
push 6
mov dword [esi], 0
call fcn.10030ada
int3
Function at 0x1002add0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1006a050]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push ecx
push dword [ebp + 8]
mov ecx, 0x100956c8
call fcn.10009d70
push 0x100956c8
push 0x10062a10
push 1
push 0x100929f8
call fcn.10017010
add esp, 0x1c
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHQueryUserNotificationState]
mov eax, dword [ebp - 8]
cmp eax, 2
je 0x1002ae4c
cmp eax, 3
je 0x1002ae4c
cmp eax, 4
je 0x1002ae4c
push 0x41010
push str.CLEO_error
push 0x100956c8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10031b48
mov esp, ebp
pop ebp
ret
push 0
push 0xf020
push 0x112
push 0
call dword [sym.imp.USER32.dll_PostMessageA]
push 6
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x41010
push str.CLEO_error
push 0x100956c8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0xf120
push 0x112
push 0
call dword [sym.imp.USER32.dll_PostMessageA]
push 9
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10031b48
mov esp, ebp
pop ebp
ret

Function at 0x1002f960
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1006a050]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push ecx
push dword [ebp + 8]
mov ecx, 0x10095ec8
call fcn.10009d70
push 0x10095ec8
push 0x10062a10
push 1
push 0x100929f8
call fcn.10017010
add esp, 0x1c
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHQueryUserNotificationState]
mov eax, dword [ebp - 8]
cmp eax, 2
je 0x1002f9dc
cmp eax, 3
je 0x1002f9dc
cmp eax, 4
je 0x1002f9dc
push 0x41010
push str.CLEO_error
push 0x10095ec8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10031b48
mov esp, ebp
pop ebp
ret
push 0
push 0xf020
push 0x112
push 0
call dword [sym.imp.USER32.dll_PostMessageA]
push 6
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x41010
push str.CLEO_error
push 0x10095ec8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0xf120
push 0x112
push 0
call dword [sym.imp.USER32.dll_PostMessageA]
push 9
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10031b48
mov esp, ebp
pop ebp
ret
Function at 0x1004381e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10043694
Function at 0x10001280
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x103c4120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 4
mov dword [ebp - 0x1c], eax
mov edx, edi
mov esi, 4
jmp 0x100012b0
mov al, byte [edx]
lea edx, [edx + 4]
mov byte [ecx], al
inc ecx
dec esi
jne 0x100012b0
inc edi
dec ebx
jne 0x100012a4
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x10]
mov esi, 4
mov bl, byte [eax]
lea edi, [eax + 8]
movzx eax, bl
lea edx, [edi + 2]
shl eax, 4
mov dword [ebp - 0x18], edi
add edx, eax
lea ecx, [ecx]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
xor byte [ecx - 4], al
lea ecx, [ecx + 1]
movzx eax, byte [edx - 5]
xor byte [ecx - 1], al
movzx eax, byte [edx - 4]
xor byte [ecx + 3], al
movzx eax, byte [edx - 3]
xor byte [ecx + 7], al
dec esi
jne 0x100012e0
dec bl
cmp bl, 1
jb 0x100013ae
movzx ebx, bl
mov edi, ebx
shl edi, 4
jmp 0x10001320
lea eax, [ebp - 0x14]
push eax
call fcn.100016f0
add esp, 4
lea eax, [ebp - 0x14]
mov esi, 4
jmp 0x10001340
mov edx, 4
movzx ecx, byte [eax]
mov cl, byte [ecx + 0x1026e100]
mov byte [eax], cl
inc eax
dec edx
jne 0x10001345
dec esi
jne 0x10001340
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
add edx, 2
mov esi, 4
add edx, edi
jmp 0x10001370
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
xor byte [ecx - 4], al
lea ecx, [ecx + 1]
movzx eax, byte [edx - 5]
xor byte [ecx - 1], al
movzx eax, byte [edx - 4]
xor byte [ecx + 3], al
movzx eax, byte [edx - 3]
xor byte [ecx + 7], al
dec esi
jne 0x10001370
lea eax, [ebp - 0x14]
push eax
call fcn.10001610
add esp, 4
sub edi, 0x10
dec ebx
jne 0x10001320
mov edi, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
call fcn.100016f0
add esp, 4
lea ecx, [ebp - 0x14]
mov esi, 4
mov edx, 4
jmp 0x100013d0
movzx eax, byte [ecx]
mov al, byte [eax + 0x1026e100]
mov byte [ecx], al
inc ecx
dec edx
jne 0x100013d0
dec esi
jne 0x100013c2
lea ecx, [ebp - 0x10]
mov esi, 4
lea edx, [edi + 2]
lea ecx, [ecx]
movzx eax, byte [edx - 2]
lea ecx, [ecx + 1]
xor byte [ecx - 5], al
lea edx, [edx + 4]
movzx eax, byte [edx - 5]
xor byte [ecx - 1], al
movzx eax, byte [edx - 4]
xor byte [ecx + 3], al
movzx eax, byte [edx - 3]
xor byte [ecx + 7], al
dec esi
jne 0x100013f0
mov ebx, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
lea edi, [esi + 4]
mov edi, edi
mov edx, ebx
mov esi, 4
mov al, byte [ecx]
lea edx, [edx + 4]
inc ecx
mov byte [edx - 4], al
dec esi
jne 0x10001427
inc ebx
dec edi
jne 0x10001420
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret
Function at 0x10001450
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor bl, bl
mov cl, byte [edi]
inc cl
shl cl, 2
cmp dword [edi + 4], 0
jbe 0x1000149e
mov esi, dword [ebp + 8]
xor edx, edx
movzx eax, byte [esi + edx*4]
add bl, 1
mov byte [edi + edx*4 + 8], al
movzx eax, byte [esi + edx*4 + 1]
mov byte [edi + edx*4 + 9], al
movzx eax, byte [esi + edx*4 + 2]
mov byte [edi + edx*4 + 0xa], al
movzx eax, byte [esi + edx*4 + 3]
mov byte [edi + edx*4 + 0xb], al
movzx edx, bl
cmp edx, dword [edi + 4]
jb 0x10001470
mov al, byte [edi + 4]
cmp al, cl
jae 0x10001604
movzx edx, al
mov dword [ebp - 4], edx
lea edx, [edx*4 + 5]
add edx, edi
sub cl, al
movzx eax, cl
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
mov bh, byte [edx - 1]
mov cl, byte [edx]
mov bl, byte [edx + 1]
mov ch, byte [edx + 2]
xor edx, edx
mov eax, dword [ebp - 4]
mov esi, dword [edi + 4]
div esi
mov byte [ebp + 0xc], bh
mov dword [ebp - 0x10], edx
mov edx, eax
mov eax, dword [ebp - 0x10]
mov byte [ebp + 0xd], cl
mov byte [ebp + 0xe], bl
mov byte [ebp + 0xf], ch
test eax, eax
jne 0x1000157f
mov byte [ebp + 0xc], cl
lea esi, [eax + 4]
mov byte [ebp + 0xe], ch
lea ecx, [ebp + 0xc]
mov byte [ebp + 0xd], bl
mov byte [ebp + 0xf], bh
jmp 0x10001510
movzx eax, byte [ecx]
mov al, byte [eax + 0x1026e000]
mov byte [ecx], al
inc ecx
dec esi
jne 0x10001510
cmp dl, 1
jne 0x1000152d
mov al, dl
mov byte [0x1026e200], al
jmp 0x1000155d
jbe 0x10001558
dec dl
mov al, 2
mov byte [0x1026e200], al
cmp dl, 1
jbe 0x1000155d
dec dl
movzx ecx, dl
movzx eax, al
shl eax, 8
mov al, byte [eax + 0x1025e002]
dec ecx
jne 0x10001542
mov byte [0x1026e200], al
jmp 0x1000155d
mov al, byte [0x1026e200]
mov bh, byte [ebp + 0xc]
mov cl, byte [ebp + 0xd]
xor bh, al
mov bl, byte [ebp + 0xe]
mov ch, byte [ebp + 0xf]
xor cl, byte [0x1026e201]
xor bl, byte [0x1026e202]
xor ch, byte [0x1026e203]
jmp 0x100015af
cmp esi, 6
jbe 0x100015af
cmp eax, 4
jne 0x100015af
lea eax, [ebp + 0xc]
mov edx, 4
movzx ecx, byte [eax]
lea eax, [eax + 1]
mov cl, byte [ecx + 0x1026e000]
mov byte [eax - 1], cl
dec edx
jne 0x10001591
mov ch, byte [ebp + 0xf]
mov bl, byte [ebp + 0xe]
mov cl, byte [ebp + 0xd]
mov bh, byte [ebp + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
sub eax, dword [edi + 4]
mov edx, dword [ebp - 8]
movzx eax, byte [edi + eax*4 + 8]
xor al, bh
mov byte [edx + 3], al
mov eax, esi
sub eax, dword [edi + 4]
movzx eax, byte [edi + eax*4 + 9]
xor al, cl
mov byte [edx + 4], al
mov eax, esi
sub eax, dword [edi + 4]
movzx eax, byte [edi + eax*4 + 0xa]
xor al, bl
mov byte [edx + 5], al
mov eax, esi
sub eax, dword [edi + 4]
inc esi
mov dword [ebp - 4], esi
movzx eax, byte [edi + eax*4 + 0xb]
xor al, ch
mov byte [edx + 6], al
add edx, 4
dec dword [ebp - 0xc]
mov dword [ebp - 8], edx
jne 0x100014c3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001c70
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x103c4120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x10c], eax
push 0x100
mov dword [ebp - 0x110], esi
movzx eax, byte [esi + 0x62d]
movzx ebx, byte [esi + 0x62c]
mov dword [ebp - 0x108], eax
lea eax, [esi + 0x52c]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.101c6b90
add esp, 0xc
cmp dword [ebp + 0x14], 0
je 0x10001d4b
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
sub dword [ebp - 0x10c], edi
lea esp, [esp]
mov ecx, dword [ebp - 0x108]
lea edi, [edi + 1]
inc ebx
and ebx, 0xff
movzx edx, byte [ebp + ebx - 0x104]
add ecx, edx
and ecx, 0xff
mov dword [ebp - 0x108], ecx
movzx eax, byte [ebp + ecx - 0x104]
mov byte [ebp + ebx - 0x104], al
mov byte [ebp + ecx - 0x104], dl
movzx ecx, byte [ebp + ebx - 0x104]
add ecx, edx
and ecx, 0xff
movzx eax, byte [ebp + ecx - 0x104]
mov ecx, dword [ebp - 0x10c]
xor al, byte [edi - 1]
mov byte [ecx + edi - 1], al
dec esi
jne 0x10001ce0
mov esi, dword [ebp - 0x110]
pop edi
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 4]
mov byte [esi + 0x62c], bl
xor ecx, ebp
mov byte [esi + 0x62d], al
pop esi
pop ebx
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret
Function at 0x100055f0
Capabilities:
Encrypt data using camellia

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 0xc]
xor edx, dword [ebp + 0x14]
mov eax, edx
mov ecx, dword [ebp + 8]
shr eax, 0x18
xor ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
push ebx
mov al, byte [eax + 0x101d87d8]
mov byte [ebp - 2], al
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [ebp - 0xc], edx
push esi
push edi
mov al, byte [eax + 0x101d88d8]
mov byte [ebp + 0xf], al
mov eax, edx
shr eax, 8
movzx eax, al
mov al, byte [eax + 0x101d89d8]
mov byte [ebp + 0x17], al
movzx eax, dl
mov al, byte [eax + 0x101d8ad8]
mov byte [ebp - 1], al
mov eax, edx
shrd ecx, eax, 0x18
shr eax, 0x18
movzx eax, cl
mov ecx, dword [ebp - 8]
mov bh, byte [eax + 0x101d88d8]
mov eax, edx
shrd ecx, eax, 0x10
shr eax, 0x10
movzx eax, cl
mov bl, byte [eax + 0x101d89d8]
mov eax, dword [ebp - 8]
shrd eax, edx, 8
movzx eax, al
shr edx, 8
mov dl, byte [ebp - 1]
mov dh, byte [ebp - 2]
mov cl, byte [eax + 0x101d8ad8]
mov al, cl
xor al, bl
xor al, bh
xor al, dl
xor al, dh
mov ch, al
mov byte [ebp - 4], al
xor ch, byte [ebp + 0x17]
xor ch, byte [ebp + 0xf]
mov eax, dword [ebp - 8]
xor ch, dh
movzx eax, al
mov byte [ebp - 2], ch
mov ah, byte [eax + 0x101d87d8]
xor ah, ch
xor ah, cl
xor ah, byte [ebp + 0xf]
mov ch, ah
mov byte [ebp - 3], ah
mov ah, byte [ebp + 0x17]
xor ch, dl
xor ch, byte [ebp + 0xf]
xor ch, dh
mov al, ch
xor al, cl
xor al, bl
xor al, dh
mov cl, al
mov byte [ebp - 1], al
xor cl, dl
xor cl, ah
xor cl, dh
mov al, cl
xor al, bl
xor al, bh
xor al, dl
mov byte [ebp + 0x17], al
xor al, dl
xor al, ah
xor al, byte [ebp + 0xf]
movzx eax, al
cdq
mov esi, eax
mov edi, edx
shld edi, esi, 8
movzx eax, cl
shl esi, 8
cdq
or esi, eax
or edi, edx
shld edi, esi, 8
movzx eax, ch
shl esi, 8
cdq
or esi, eax
or edi, edx
movzx eax, byte [ebp - 2]
shld edi, esi, 8
cdq
shl esi, 8
or edi, edx
or esi, eax
movzx eax, byte [ebp + 0x17]
shld edi, esi, 8
cdq
shl esi, 8
or edi, edx
or esi, eax
movzx eax, byte [ebp - 1]
shld edi, esi, 8
cdq
shl esi, 8
or edi, edx
or esi, eax
movzx eax, byte [ebp - 3]
shld edi, esi, 8
cdq
shl esi, 8
or edi, edx
or esi, eax
movzx eax, byte [ebp - 4]
shld edi, esi, 8
cdq
shl esi, 8
or eax, esi
or edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100058f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x103c4120]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
cmp byte [edx + 0x4a], 0
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
sete al
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x10], 0x10005c00
lea eax, [eax*4 + 0xc]
mov dword [ebp - 0xc], 0x10005c50
sub al, 1
mov dword [ebp - 8], 0x10005ca0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], eax
js 0x10005a57
movsx ecx, al
mov dword [ebp - 0x14], ecx
push edi
lea ebx, [edx + ecx*4]
mov dword [ebp - 0x20], ebx
mov edi, dword [ebx]
mov eax, ecx
cdq
and ecx, 7
mov ebx, 3
mov dword [ebp - 0x30], edi
mov edi, dword [ebp - 0x24]
idiv ebx
mov eax, dword [ebp - 0x14]
mov ebx, 1
sar eax, 3
shl ebx, cl
mov cl, byte [ebp - 0x18]
mov dword [ebp - 0x2c], esi
and bl, byte [eax + edi + 0x48]
mov eax, dword [ebp - 0x14]
neg bl
sbb bl, bl
sar eax, 1
and cl, 1
and bl, 0x10
shl cl, 2
mov al, byte [eax + edi + 0x40]
mov edi, dword [ebp - 0x30]
shr al, cl
mov ecx, edi
and al, 0xf
and ecx, 0xff0000
add bl, al
movzx eax, bl
push eax
mov eax, edi
shr eax, 0x10
or ecx, eax
mov eax, edi
shl eax, 0x10
and edi, 0xff00
or eax, edi
shr ecx, 8
shl eax, 8
or ecx, eax
mov eax, esi
push ecx
shr eax, 0x10
mov ecx, esi
and ecx, 0xff0000
or ecx, eax
mov eax, esi
and eax, 0xff00
shl esi, 0x10
or eax, esi
shr ecx, 8
shl eax, 8
or ecx, eax
mov eax, dword [ebp + edx*4 - 0x10]
push ecx
call eax
mov ebx, dword [ebp - 0x20]
mov esi, eax
mov edx, dword [ebp - 0x2c]
mov ecx, eax
shr ecx, 0x10
and esi, 0xff0000
or esi, ecx
add esp, 0xc
mov ecx, eax
shr esi, 8
shl ecx, 0x10
and eax, 0xff00
or ecx, eax
mov eax, dword [ebp - 0x18]
shl ecx, 8
dec al
or esi, ecx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
xor esi, dword [ebp - 0x1c]
dec ecx
mov dword [ebp - 0x1c], edx
sub ebx, 4
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], ebx
test al, al
jns 0x10005951
mov eax, dword [ebp - 0x28]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], edx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret
mov dword [ecx], esi
mov dword [ecx + 4], ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret
Function at 0x10005a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x103c4120]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
mov ecx, dword [ebp + 8]
push ebx
push esi
cmp byte [edx + 0x4a], al
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
sete al
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x10], 0x10005c00
lea eax, [eax*4 + 0xc]
mov dword [ebp - 0xc], 0x10005c50
mov dword [ebp - 8], 0x10005ca0
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x11], 0
test eax, eax
jle 0x10005be4
xor ecx, ecx
mov dword [ebp - 0x18], ecx
push edi
lea esp, [esp]
mov edi, dword [edx + ecx*4]
mov eax, ecx
cdq
and ecx, 7
mov ebx, 3
mov dword [ebp - 0x2c], edi
idiv ebx
mov eax, dword [ebp - 0x18]
mov ebx, 1
mov edi, dword [ebp - 0x1c]
shr eax, 3
shl ebx, cl
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], esi
and bl, byte [eax + ecx + 0x48]
mov eax, dword [ebp - 0x18]
neg bl
mov cl, byte [ebp - 0x11]
sbb bl, bl
shr eax, 1
and cl, 1
and bl, 0x10
shl cl, 2
movzx eax, byte [eax + edi + 0x40]
mov edi, dword [ebp - 0x2c]
shr al, cl
mov ecx, edi
and al, 0xf
and ecx, 0xff0000
add bl, al
movzx eax, bl
push eax
mov eax, edi
shr eax, 0x10
or ecx, eax
mov eax, edi
shl eax, 0x10
and edi, 0xff00
or eax, edi
shr ecx, 8
shl eax, 8
or ecx, eax
mov eax, esi
push ecx
shr eax, 0x10
mov ecx, esi
and ecx, 0xff0000
or ecx, eax
mov eax, esi
and eax, 0xff00
shl esi, 0x10
or eax, esi
shr ecx, 8
shl eax, 8
or ecx, eax
mov eax, dword [ebp + edx*4 - 0x10]
push ecx
call eax
mov ebx, dword [ebp - 0x28]
mov esi, eax
mov edx, dword [ebp - 0x1c]
mov ecx, eax
shr ecx, 0x10
and esi, 0xff0000
or esi, ecx
add esp, 0xc
mov ecx, eax
shr esi, 8
and ecx, 0xff00
shl eax, 0x10
or ecx, eax
mov al, byte [ebp - 0x11]
shl ecx, 8
inc al
or esi, ecx
mov byte [ebp - 0x11], al
xor esi, dword [ebp - 0x20]
movzx ecx, al
xor eax, eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ecx
cmp byte [edx + 0x4a], al
sete al
lea eax, [eax*4 + 0xc]
cmp ecx, eax
jl 0x10005ad0
mov eax, dword [ebp - 0x24]
pop edi
mov dword [eax], esi
pop esi
mov dword [eax + 4], ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret
mov dword [ecx], esi
mov dword [ecx + 4], ebx
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret