joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100028c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push esi
call fcn.1009e1a6
call fcn.10022800
call fcn.10022960
mov dword [0x10114dd4], 0x1010f158
call fcn.100020b0
cmp byte [0x10114154], 0
jne 0x100028f6
call fcn.100016a0
push 0x10114050
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0
call fcn.10001bb0
add esp, 4
lea eax, [esp + 8]
call fcn.10002050
lea esi, [esp + 8]
call fcn.10001dd0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10003db0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x10003dc9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10003e04
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x10003e00
lea ebx, [ebx]
cmp esi, eax
jae 0x10003e04
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x10003df0
cmp esi, eax
jb 0x10003e0a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x10005a10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100cd8b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x1010d170]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x1c
xor eax, eax
mov ecx, esp
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], 0xf
push eax
mov byte [ecx + 4], al
lea eax, [esp + 0x40]
push eax
call fcn.100036c0
call fcn.10005350
add esp, 0x1c
mov dword [esp + 0x14], 0xffffffff
cmp dword [esp + 0x34], 0x10
mov esi, eax
jb 0x10005a85
mov ecx, dword [esp + 0x20]
push ecx
call fcn.1009daa7
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x1000ce00
Capabilities:
Create thread

Disassembly:
push ecx
push edi
push 0
push 0x3e8
mov ecx, esi
call fcn.100a3475
mov ecx, eax
call fcn.100a3593
mov eax, dword [esi + 0x20]
push 1
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [esi + 0x20]
push 0
push 0x3e8
push 1
push ecx
mov dword [esi + 0xec], 0x1e
call dword [sym.imp.USER32.dll_SetTimer]
lea edi, [esi + 0xf0]
push 0x14
mov dword [esi + 0xe8], eax
mov dword [edi], 0
call fcn.1009da6d
mov ecx, dword [esi + 0x20]
mov edx, 0x10
add esp, 4
mov dword [eax + 0xc], ecx
cmp dword [esi + 0x90], edx
jb 0x1000ce74
mov ecx, dword [esi + 0x7c]
jmp 0x1000ce77
lea ecx, [esi + 0x7c]
mov dword [eax], ecx
cmp dword [esi + 0xc8], edx
jb 0x1000ce89
mov ecx, dword [esi + 0xb4]
jmp 0x1000ce8f
lea ecx, [esi + 0xb4]
mov dword [eax + 8], ecx
cmp dword [esi + 0xac], edx
jb 0x1000cea2
mov ecx, dword [esi + 0x98]
jmp 0x1000cea8
lea ecx, [esi + 0x98]
lea edx, [esp + 4]
push edx
push 0
push eax
push 0x1000c6c0
push 0
mov dword [eax + 4], ecx
mov dword [eax + 0x10], edi
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xf4], eax
pop edi
pop ecx
ret

Function at 0x1000cee0
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [esi + 0xf4]
mov dword [esi + 0xf0], 1
test eax, eax
je 0x1000cf2b
cmp eax, 0xffffffff
je 0x1000cf2b
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esi + 0xf4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0xf4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xf4], 0
ret

Function at 0x1000d120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.100a33d6
Function at 0x1000e640
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x80
mov eax, dword [0x1010d170]
xor eax, esp
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x84]
push ebp
mov ebp, dword [esp + 0x8c]
push esi
mov esi, dword [eax + 0x14]
push edi
mov edi, dword [eax + 0x18]
test esi, esi
jne 0x1000e688
test edi, edi
jne 0x1000e688
pop edi
pop esi
or eax, 0xffffffff
pop ebp
mov ecx, dword [esp + 0x7c]
xor ecx, esp
call fcn.100ae60d
add esp, 0x80
ret
xor eax, eax
push 0x5c
push eax
mov dword [esp + 0x71], eax
mov dword [esp + 0x75], eax
mov dword [esp + 0x79], eax
mov dword [esp + 0x7d], eax
mov dword [esp + 0x81], eax
mov dword [esp + 0x85], eax
mov dword [esp + 0x89], eax
mov word [esp + 0x8d], ax
mov byte [esp + 0x8f], al
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x74], 0
call fcn.100b34b0
add esp, 0xc
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
test esi, esi
je 0x1000e718
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000e700
sub eax, edx
je 0x1000e718
push esi
lea ecx, [esp + 0x10]
call fcn.10024970
add esp, 4
test edi, edi
je 0x1000e739
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000e721
sub eax, edx
je 0x1000e739
push edi
lea ecx, [esp + 0x10]
call fcn.10024970
add esp, 4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x68]
call fcn.10024a50
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x6c]
mov eax, dword [esp + 0x70]
mov dword [ebx], ecx
mov ecx, dword [esp + 0x74]
mov dword [ebx + 4], edx
mov dword [ebx + 8], eax
pop edi
mov dword [ebx + 0xc], ecx
mov ecx, dword [esp + 0x84]
pop esi
mov dword [ebp], 0x10
pop ebp
xor ecx, esp
xor eax, eax
call fcn.100ae60d
add esp, 0x80
ret
Function at 0x10031d80
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x1010d170]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x10031dcb
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x10031dcb
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
call fcn.100b1579
add eax, 0x40
push eax
call fcn.100b1cae
add esp, 0xc
jmp 0x10031f0a
mov ebx, dword [ebp + 8]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10031dd3
sub eax, edx
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.100b5c00
mov esi, esp
test esi, esi
jne 0x10031df7
mov esi, str.no_stack_
jmp 0x10031e7f
push edi
push esi
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x10031e21
test edi, edi
jbe 0x10031e21
lea ecx, [ecx]
mov edx, dword [ebp + 8]
movsx cx, byte [eax + edx]
mov word [esi + eax*2], cx
inc eax
cmp eax, edi
jb 0x10031e10
xor eax, eax
test edi, edi
jbe 0x10031e7f
cmp word [esi + eax*2], 0x25
jne case.0x10031e44.43
lea ecx, [esi + eax*2 + 2]
movzx edx, word [ecx]
add edx, 0xffffffd6
cmp edx, 0x49
ja case.0x10031e44.43
movzx edx, byte [edx + 0x10031f3c]
jmp dword [edx*4 + 0x10031f24]
inc eax
add ecx, 2
jmp 0x10031e32
mov ecx, 0x53
mov word [esi + eax*2 + 2], cx
jmp case.0x10031e44.43
mov edx, 0x73
jmp 0x10031e75
mov ecx, 0x43
mov word [esi + eax*2 + 2], cx
jmp case.0x10031e44.43
mov edx, 0x63
mov word [esi + eax*2 + 2], dx
inc eax
cmp eax, edi
jb 0x10031e27
lea eax, [ebp + 0xc]
push eax
push esi
lea ecx, [ebp - 0x204]
push 0xff
push ecx
call fcn.100b1b76
xor edx, edx
add esp, 0x10
mov word [ebp - 6], dx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x10031ef4
call fcn.10031c40
test eax, eax
jle 0x10031ef4
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
push 0
lea ecx, [ebp - 0x208]
push ecx
push 0
push 1
push 0
push 0
push 0
mov esi, eax
push 1
lea eax, [ebp - 0x204]
push esi
mov dword [ebp - 0x208], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x10031f0a
push 0x10
push str.OpenSSL:_FATAL
lea edx, [ebp - 0x204]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ae60d
mov esp, ebp
pop ebp
ret
Function at 0x10042f50
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x10042f97
mov al, byte [edx]
test al, al
je 0x10042f97
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x10042f67
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x1005b8a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x2c
mov eax, dword [0x1010d170]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
mov ebp, dword [esp + 0x44]
movzx edx, byte [edi + 1]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], ecx
movzx ecx, byte [edi]
shl edx, 8
or ecx, edx
mov esi, dword [eax]
lea eax, [edi + 1]
movzx edx, byte [eax + 1]
mov dword [esp + 0x24], eax
inc eax
inc eax
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax]
inc eax
movzx ebx, byte [eax + 1]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax]
inc eax
inc eax
shl ebx, 8
or edx, ebx
movzx ebx, byte [eax + 1]
movzx eax, byte [eax]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 8
shl ebx, 0x10
or edx, ebx
mov byte [esp + 0x2d], al
mov eax, ecx
mov ebx, ecx
mov byte [esp + 0x2c], cl
shr eax, 0x10
shr ecx, 0x18
mov byte [esp + 0x2e], al
mov byte [esp + 0x2f], cl
mov ecx, edx
mov eax, edx
mov dword [esp + 0x20], edx
mov byte [esp + 0x30], dl
shr ecx, 8
shr eax, 0x10
shr edx, 0x18
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x31], cl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
test ebp, ebp
je 0x1005ba71
lea esp, [esp]
mov ebp, 1
sub dword [esp + 0x10], ebp
test esi, esi
jne 0x1005b9d7
mov ecx, dword [esp + 0x28]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.1005c250
mov ebx, dword [esp + 0x24]
mov eax, ebx
shr eax, 8
mov ecx, ebx
shr ecx, 0x10
mov edx, ebx
shr edx, 0x18
mov byte [esp + 0x35], al
mov eax, dword [esp + 0x28]
mov byte [esp + 0x36], cl
mov byte [esp + 0x37], dl
mov ecx, eax
mov edx, eax
mov byte [esp + 0x38], al
shr ecx, 8
shr edx, 0x10
shr eax, 0x18
add esp, 8
add dword [esp + 0xc], ebp
mov byte [esp + 0x2c], bl
mov byte [esp + 0x31], cl
mov byte [esp + 0x32], dl
mov byte [esp + 0x33], al
mov cl, byte [esp + esi + 0x2c]
mov ebp, dword [esp + 0x3c]
xor cl, byte [ebp]
mov eax, dword [esp + 0x18]
inc esi
mov byte [eax], cl
inc eax
inc ebp
and esi, 7
cmp dword [esp + 0x10], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x3c], ebp
jne 0x1005b970
cmp dword [esp + 0xc], 0
je 0x1005ba59
mov eax, dword [esp + 0x24]
mov byte [edi], bl
mov edx, ebx
shr edx, 8
mov byte [eax], dl
inc eax
mov ecx, ebx
shr ecx, 0x10
mov byte [eax], cl
mov ecx, dword [esp + 0x20]
inc eax
shr ebx, 0x18
mov byte [eax], bl
mov byte [eax + 1], cl
inc eax
inc eax
mov edx, ecx
shr edx, 8
mov byte [eax], dl
inc eax
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
shr ecx, 0x18
mov byte [eax + 1], cl
mov eax, dword [esp + 0x14]
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.100ae60d
add esp, 0x2c
ret
mov ecx, dword [esp + 0x14]
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.100ae60d
add esp, 0x2c
ret
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x34]
mov dword [edx], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100ae60d
add esp, 0x2c
ret
Function at 0x1005bc70
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
cmp eax, 0x80
push esi
mov esi, edx
push edi
mov byte [esi], 0
jle 0x1005bc83
mov eax, 0x80
test ecx, ecx
jle 0x1005bc8f
cmp ecx, 0x400
jle 0x1005bc94
mov ecx, 0x400
push ebx
test eax, eax
jle 0x1005bcae
mov edi, dword [esp + 0x10]
push ebp
sub edi, esi
mov ebp, eax
mov bl, byte [edi + edx]
mov byte [edx], bl
inc edx
sub ebp, 1
jne 0x1005bca2
pop ebp
cmp eax, 0x80
movzx edx, byte [esi + eax - 1]
jge 0x1005bcde
mov edi, esi
sub edi, eax
mov edi, edi
movzx ebx, byte [edi + eax]
add ebx, edx
and ebx, 0xff
movzx edx, byte [ebx + 0x100e5ae8]
mov byte [eax + esi], dl
inc eax
cmp eax, 0x80
jl 0x1005bcc0
lea edx, [ecx + 7]
neg ecx
sar edx, 3
mov eax, 0x80
and ecx, 7
sub eax, edx
lea edi, [eax + esi]
mov ebx, 0xff
sar ebx, cl
movzx ecx, byte [edi]
and ebx, ecx
movzx ecx, byte [ebx + 0x100e5ae8]
mov byte [edi], cl
test eax, eax
je 0x1005bd26
lea esp, [esp]
movzx ebx, byte [edi + edx - 1]
dec edi
xor ebx, ecx
movzx ecx, byte [ebx + 0x100e5ae8]
dec eax
mov byte [edi], cl
test eax, eax
jne 0x1005bd10
lea ecx, [esi + 0xfc]
lea eax, [esi + 0x7e]
mov edx, 0x40
pop ebx
movzx esi, byte [eax + 1]
movzx edi, byte [eax]
shl esi, 8
or esi, edi
and esi, 0xffff
mov dword [ecx], esi
sub ecx, 4
sub eax, 2
sub edx, 1
jne 0x1005bd35
pop edi
pop esi
ret
Function at 0x1005cb20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x38
mov eax, dword [0x1010d170]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x3c]
push ebx
mov dword [esp + 0x14], eax
mov al, byte [esi]
push ebp
mov ebp, dword [esp + 0x48]
mov ebx, edx
mov edx, dword [esi + 0x2c]
mov dword [esp + 0x20], ecx
mov ecx, dword [esi + 0x28]
push edi
mov byte [esp + 0x13], al
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], edx
test al, 0x40
jne 0x1005cb72
push edx
lea edx, [esi + 0x10]
push edx
push esi
call ecx
mov al, byte [esp + 0x1f]
add esp, 0xc
add dword [esi + 0x20], 1
adc dword [esi + 0x24], 0
movzx eax, al
and eax, 7
mov edx, 0xf
sub edx, eax
mov byte [esi], al
mov eax, edx
xor ecx, ecx
mov dword [esp + 0x18], edx
cmp eax, 0xf
jae 0x1005cba3
mov edi, edi
movzx edi, byte [esi + eax]
or ecx, edi
mov byte [esi + eax], 0
inc eax
shl ecx, 8
cmp eax, 0xf
jb 0x1005cb90
movzx eax, byte [esi + 0xf]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, ebp
je 0x1005cbc6
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100ae60d
add esp, 0x38
ret
lea ecx, [ebp + 0xf]
or ecx, 8
shr ecx, 3
add dword [esi + 0x20], ecx
adc dword [esi + 0x24], 0
cmp dword [esi + 0x24], 0x20000000
jb 0x1005cbfe
ja 0x1005cbe7
cmp dword [esi + 0x20], 0
jbe 0x1005cbfe
mov eax, 0xfffffffe
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100ae60d
add esp, 0x38
ret
mov edi, ebp
shr edi, 4
test edi, edi
je 0x1005cc3c
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
lea edx, [esi + 0x10]
push edx
push esi
push eax
push edi
push ecx
push ebx
call dword [esp + 0x3c]
shl edi, 4
mov edx, edi
add dword [esp + 0x34], edx
add esp, 0x18
add ebx, edx
sub ebp, edx
je 0x1005cca1
shr edx, 4
mov eax, esi
call fcn.1005cae0
mov edx, dword [esp + 0x18]
test ebp, ebp
je 0x1005cca5
xor eax, eax
test ebp, ebp
jbe 0x1005cc52
mov dl, byte [ebx + eax]
xor byte [esi + eax + 0x10], dl
inc eax
cmp eax, ebp
jb 0x1005cc46
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x20]
lea eax, [esi + 0x10]
push ecx
push eax
push eax
call edi
mov edx, dword [esp + 0x20]
push edx
lea eax, [esp + 0x38]
push eax
push esi
call edi
add esp, 0x18
xor ecx, ecx
test ebp, ebp
jbe 0x1005cca1
lea edx, [esp + 0x28]
mov edi, ebx
sub edi, edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x28]
sub edx, eax
lea ebx, [ebx]
lea eax, [esp + ecx + 0x28]
mov bl, byte [edi + eax]
xor bl, byte [eax]
inc ecx
mov byte [edx + eax], bl
cmp ecx, ebp
jb 0x1005cc90
mov edx, dword [esp + 0x18]
cmp edx, 0x10
jae 0x1005ccc0
mov ecx, 0x10
sub ecx, edx
push ecx
lea eax, [esi + edx]
push 0
push eax
call fcn.100b34b0
add esp, 0xc
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x2c]
push eax
push esi
call dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
xor dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x38]
xor dword [esi + 0x1c], ecx
xor dword [esi + 0x14], edx
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x48]
xor dword [esi + 0x18], eax
mov dl, byte [esp + 0x1f]
add esp, 0xc
pop edi
pop ebp
pop ebx
xor ecx, esp
mov byte [esi], dl
xor eax, eax
call fcn.100ae60d
add esp, 0x38
ret
Function at 0x1005cd10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x38
mov eax, dword [0x1010d170]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x3c]
push ebx
mov ebx, dword [esp + 0x44]
mov dword [esp + 0x10], eax
mov al, byte [esi]
mov dword [esp + 0xc], ecx
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 0x2c]
push ebp
push edi
mov byte [esp + 0xf], al
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], edx
test al, 0x40
jne 0x1005cd5c
push edx
lea eax, [esi + 0x10]
push eax
push esi
call ecx
mov al, byte [esp + 0x1b]
add esp, 0xc
movzx eax, al
and eax, 7
mov ebp, 0xf
sub ebp, eax
mov byte [esi], al
mov eax, ebp
xor ecx, ecx
mov dword [esp + 0x20], ebp
cmp eax, 0xf
jae 0x1005cd93
jmp 0x1005cd80
movzx edx, byte [esi + eax]
or ecx, edx
mov byte [esi + eax], 0
inc eax
shl ecx, 8
cmp eax, 0xf
jb 0x1005cd80
movzx eax, byte [esi + 0xf]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, ebx
je 0x1005cdb6
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100ae60d
add esp, 0x38
ret
mov edi, ebx
shr edi, 4
test edi, edi
je 0x1005cdf6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
lea ecx, [esi + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
push esi
push edx
push edi
push eax
push ecx
call dword [esp + 0x3c]
shl edi, 4
mov edx, edi
add dword [esp + 0x30], edx
add dword [esp + 0x2c], edx
add esp, 0x18
sub ebx, edx
je 0x1005ce4e
shr edx, 4
mov eax, esi
call fcn.1005cae0
test ebx, ebx
je 0x1005ce4e
mov edx, dword [esp + 0x10]
push edx
lea eax, [esp + 0x2c]
push eax
push esi
call dword [esp + 0x28]
add esp, 0xc
xor eax, eax
test ebx, ebx
jbe 0x1005ce3d
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
lea ecx, [esp + 0x28]
mov edx, ecx
sub edi, ecx
sub ebp, edx
lea edx, [esp + eax + 0x28]
mov cl, byte [edi + edx]
xor cl, byte [edx]
inc eax
mov byte [edx + ebp], cl
xor byte [esi + eax + 0xf], cl
cmp eax, ebx
jb 0x1005ce24
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
lea eax, [esi + 0x10]
push ecx
push eax
push eax
call dword [esp + 0x28]
add esp, 0xc
cmp ebp, 0x10
jae 0x1005ce69
mov edx, 0x10
sub edx, ebp
push edx
lea eax, [esi + ebp]
push 0
push eax
call fcn.100b34b0
add esp, 0xc
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
push ecx
push esi
call dword [esp + 0x28]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
xor dword [esi + 0x14], eax
xor dword [esi + 0x18], ecx
xor dword [esi + 0x10], edx
mov al, byte [esp + 0x1b]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x40]
xor dword [esi + 0x1c], edx
add esp, 0xc
pop edi
pop ebp
pop ebx
mov byte [esi], al
xor ecx, esp
xor eax, eax
call fcn.100ae60d
add esp, 0x38
ret
Function at 0x1005d660
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0xc
push ebx
mov ebx, eax
xor eax, eax
push ebp
push edi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x16c], eax
mov dword [esi + 0x168], eax
cmp ecx, 0xc
jne 0x1005d6c0
mov eax, dword [ebx]
mov dword [esi], eax
mov ecx, dword [ebx + 4]
mov dword [esi + 4], ecx
mov edx, dword [ebx + 8]
mov dword [esi + 8], edx
mov byte [esi + 0xf], 1
mov ebx, 1
jmp 0x1005d7ec
mov edi, ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], eax
cmp ecx, 0x10
jb 0x1005d73e
mov edi, ebx
sub edi, esi
shr ecx, 4
mov dword [esp + 0xc], ecx
lea ebx, [ebx]
lea ecx, [ebx + 2]
mov eax, esi
mov ebp, 4
lea ebx, [ebx]
movzx edx, byte [edi + eax]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
sub ebp, 1
jne 0x1005d6f0
lea eax, [esi + 0x60]
push eax
push esi
call fcn.1005d220
sub dword [esp + 0x24], 0x10
add esp, 8
add ebx, 0x10
add edi, 0x10
sub dword [esp + 0xc], 1
jne 0x1005d6e0
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp ecx, eax
je 0x1005d768
jbe 0x1005d75b
mov eax, esi
sub ebx, esi
mov ebp, ecx
lea ebx, [ebx]
mov cl, byte [eax + ebx]
xor byte [eax], cl
inc eax
sub ebp, 1
jne 0x1005d750
lea edx, [esi + 0x60]
push edx
push esi
call fcn.1005d220
add esp, 8
mov eax, dword [esp + 0x14]
shld eax, edi, 3
mov edx, eax
shr edx, 0x18
xor byte [esi + 8], dl
mov edx, eax
shr edx, 0x10
xor byte [esi + 9], dl
add edi, edi
add edi, edi
mov edx, eax
shr edx, 8
xor byte [esi + 0xa], dl
add edi, edi
mov ecx, edi
mov edx, eax
xor byte [esi + 0xb], dl
xor byte [esi + 0xf], cl
mov edi, eax
mov edx, ecx
shrd edx, edi, 0x18
xor byte [esi + 0xc], dl
shr edi, 0x18
mov edi, eax
mov edx, ecx
shrd edx, edi, 0x10
xor byte [esi + 0xd], dl
mov edx, ecx
shrd edx, eax, 8
xor byte [esi + 0xe], dl
shr eax, 8
lea eax, [esi + 0x60]
push eax
push esi
shr edi, 0x10
call fcn.1005d220
movzx ebx, byte [esi + 0xc]
movzx ecx, byte [esi + 0xd]
movzx edx, byte [esi + 0xe]
movzx eax, byte [esi + 0xf]
shl ebx, 8
or ebx, ecx
shl ebx, 8
or ebx, edx
shl ebx, 8
add esp, 8
or ebx, eax
mov ecx, dword [esi + 0x174]
mov eax, dword [esi + 0x170]
push ecx
lea edx, [esi + 0x20]
push edx
push esi
call eax
inc ebx
add esp, 0xc
mov ecx, ebx
mov edx, ebx
mov eax, ebx
pop edi
shr ecx, 0x18
shr edx, 0x10
shr eax, 8
pop ebp
mov byte [esi + 0xf], bl
mov byte [esi + 0xc], cl
mov byte [esi + 0xd], dl
mov byte [esi + 0xe], al
pop ebx
add esp, 0xc
ret
Function at 0x1005d830
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
mov ebx, eax
mov eax, dword [esi + 0x38]
or eax, dword [esi + 0x3c]
push ebp
mov ebp, dword [esp + 0x10]
push edi
je 0x1005d84c
mov eax, 0xfffffffe
pop edi
pop ebp
pop ebx
pop ecx
ret
xor eax, eax
mov ecx, ebx
add ecx, dword [esi + 0x30]
adc eax, dword [esi + 0x34]
cmp eax, 0x20000000
ja 0x1005d8f9
jb 0x1005d86b
test ecx, ecx
ja 0x1005d8f9
mov edi, dword [esi + 0x16c]
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
test edi, edi
je 0x1005d8a9
jmp 0x1005d880
test ebx, ebx
je 0x1005d895
mov cl, byte [ebp]
xor byte [edi + esi + 0x40], cl
inc edi
inc ebp
dec ebx
and edi, 0xf
jne 0x1005d880
jmp 0x1005d899
test edi, edi
jne 0x1005d8ec
lea edx, [esi + 0x60]
push edx
lea eax, [esi + 0x40]
push eax
call fcn.1005d220
add esp, 8
mov eax, ebx
and eax, 0xfffffff0
mov dword [esp + 0xc], eax
je 0x1005d8cf
push eax
lea ecx, [esi + 0x60]
push ecx
lea edx, [esi + 0x40]
push edx
mov ecx, ebp
call fcn.1005d3a0
mov eax, dword [esp + 0x18]
add esp, 0xc
add ebp, eax
sub ebx, eax
test ebx, ebx
je 0x1005d8ec
xor eax, eax
mov edi, ebx
test ebx, ebx
jbe 0x1005d8ec
jmp 0x1005d8e0
mov cl, byte [eax + ebp]
xor byte [esi + eax + 0x40], cl
inc eax
cmp eax, ebx
jb 0x1005d8e0
mov dword [esi + 0x16c], edi
xor eax, eax
pop edi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret