joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10028f10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1004c6eb
mov eax, dword fs:[0]
push eax
sub esp, 0xe8
mov eax, dword [0x100661b0]
xor eax, esp
mov dword [esp + 0xe0], eax
push ebx
push esi
push edi
mov eax, dword [0x100661b0]
xor eax, esp
push eax
lea eax, [esp + 0xf8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], edx
push eax
mov edx, 0x10055324
mov dword [esp + 0x28], ecx
call fcn.10017cc0
mov edi, eax
add esp, 4
test edi, edi
jne 0x10028f79
mov eax, 1
jmp 0x10029144
push 2
push 0xffffff74
push edi
call fcn.1003546a
add esp, 0xc
test eax, eax
push edi
je 0x10028fa0
call fcn.100366fa
add esp, 4
mov eax, 0xa
jmp 0x10029144
call fcn.10035687
add esp, 4
mov ebx, eax
mov esi, str.babylonsig
nop
push edi
call fcn.100378eb
movsx ecx, byte [esi]
add esp, 4
cmp eax, ecx
jne 0x1002902e
add esi, 1
cmp byte [esi], 0
jne 0x10028fb0
push edi
lea esi, [esp + 0x9e]
call fcn.10028410
add esp, 4
push edi
lea esi, [esp + 0x78]
call fcn.10028410
add esp, 4
push 0
push 0
push edi
call fcn.1003546a
add esp, 0xc
push ebx
call fcn.10034bff
mov esi, eax
add esp, 4
test esi, esi
je 0x1002901b
push ebx
call fcn.10034bff
add esp, 4
test eax, eax
mov dword [esp + 0x14], eax
jne 0x10029041
push esi
call fcn.10034fb4
add esp, 4
push edi
call fcn.100366fa
add esp, 4
mov eax, 0xc
jmp 0x10029144
push edi
call fcn.100366fa
add esp, 4
mov eax, 0xb
jmp 0x10029144
push edi
push ebx
push 1
push esi
call fcn.10036c2c
add esp, 0x10
cmp eax, ebx
je 0x1002907b
mov edx, dword [esp + 0x14]
push edx
call fcn.10034fb4
add esp, 4
push esi
call fcn.10034fb4
add esp, 4
push edi
call fcn.100366fa
add esp, 4
mov eax, 0xd
jmp 0x10029144
push edi
call fcn.100366fa
mov eax, dword [esp + 0x18]
add esp, 4
push ebx
push esi
push eax
call fcn.10039170
add esp, 0xc
push 0x48
xor edi, edi
lea ecx, [esp + 0x30]
push edi
push ecx
call fcn.10037fe0
add esp, 0xc
lea edx, [ebx - 1]
push edx
lea eax, [esp + 0x30]
push esi
push eax
call fcn.100289d0
add esp, 0xc
push esi
call fcn.10034fb4
add esp, 4
lea eax, [esp + 0xc8]
lea ecx, [esp + 0x48]
call fcn.10028950
lea esi, [esp + 0x18]
mov dword [esp + 0x18], vtable.CEllipticCurveContext.0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
call fcn.1002a6a0
mov dword [esp + 0x100], edi
lea ecx, [esp + 0xc8]
push ecx
lea edi, [esp + 0x78]
mov edx, 0x100bd2c0
mov ecx, esi
call fcn.1002a590
test eax, eax
mov edx, dword [esp + 0x14]
je 0x10029120
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [eax], edx
mov dword [ecx], ebx
xor esi, esi
jmp 0x1002912e
push edx
call fcn.10034fb4
add esp, 4
mov esi, 0xe
mov dword [esp + 0x100], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.10028380
mov eax, esi
mov ecx, dword [esp + 0xf8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xe0]
xor ecx, esp
call fcn.100346f8
mov esp, ebp
pop ebp
ret
Function at 0x10029220
Capabilities:
Hash data using sha1

Disassembly:
push 0xffffffffffffffff
push 0x1004b3eb
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x100661b0]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100661b0]
xor eax, esp
push eax
lea eax, [esp + 0x148]
mov dword fs:[0], eax
mov eax, dword [esp + 0x15c]
mov ebp, dword [esp + 0x158]
push 0x48
mov ebx, ecx
xor edi, edi
lea ecx, [esp + 0x28]
push edi
push ecx
mov dword [esp + 0x2c], eax
mov esi, edx
call fcn.10037fe0
mov eax, esi
add esp, 0xc
mov dword [esp + 0x6c], 0x67452301
mov dword [esp + 0x70], 0xefcdab89
mov dword [esp + 0x74], 0x98badcfe
mov dword [esp + 0x78], 0x10325476
mov dword [esp + 0x7c], 0xc3d2e1f0
mov dword [esp + 0x84], edi
mov dword [esp + 0x80], edi
lea ecx, [eax + 1]
mov edi, edi
mov dl, byte [eax]
add eax, 1
test dl, dl
jne 0x100292c0
push esi
sub eax, ecx
lea esi, [esp + 0x70]
call fcn.1002cc30
add esp, 4
lea edi, [esp + 0x2c]
mov ecx, esi
call fcn.1002ccd0
mov dword [esp + 0x24], 6
mov word [esp + 0xcc], 0xf
mov esi, 1
lea ebx, [ebx]
lea edx, [esp + 0x24]
push edx
call fcn.10028840
mov word [esp + esi*2 + 0xd0], ax
add esi, 1
add esp, 4
cmp esi, 0x10
jb 0x10029300
xor edi, edi
cmp ebx, edi
je 0x10029332
push ebx
lea ecx, [esp + 0x28]
call fcn.10028750
add esp, 4
jmp 0x10029341
push edi
lea eax, [esp + 0x28]
push edi
push eax
call fcn.100289d0
add esp, 0xc
lea eax, [esp + 0x11c]
lea ecx, [esp + 0x40]
call fcn.10028950
lea esi, [esp + 0x14]
mov dword [esp + 0x14], vtable.CEllipticCurveContext.0
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call fcn.1002a6a0
mov dword [esp + 0x150], edi
mov esi, dword [esp + 0x20]
cmp esi, edi
je 0x10029389
lea ebx, [esp + 0xcc]
lea ecx, [esp + 0x14]
call fcn.1002a370
mov word [esp + 0xf4], 0xf
mov esi, 1
jmp 0x100293a0
lea ecx, [esp + 0x24]
push ecx
call fcn.10028840
mov word [esp + esi*2 + 0xf8], ax
add esi, 1
add esp, 4
cmp esi, 0x10
jb 0x100293a0
lea edx, [esp + 0xf4]
push edx
lea eax, [esp + 0xd0]
push eax
lea edi, [esp + 0x74]
lea ecx, [esp + 0x124]
lea edx, [esp + 0x1c]
call fcn.1002a490
cmp word [esp + 0x6c], 0
je 0x10029389
push ebp
lea edi, [esp + 0x96]
call fcn.10029170
lea ecx, [ebp + 0x41]
add esp, 4
push ecx
lea edi, [esp + 0x70]
mov byte [ebp + 0x40], 0x3a
call fcn.10029170
add esp, 4
mov byte [ebp + 0x81], 0
mov dword [esp + 0x150], 0xffffffff
mov eax, dword [esp + 0x18]
xor esi, esi
cmp eax, esi
mov dword [esp + 0x14], vtable.CEllipticCurveContext.0
je 0x1002943e
push eax
call fcn.10034fb4
add esp, 4
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0x1c]
cmp eax, esi
je 0x10029453
push eax
call fcn.10034fb4
add esp, 4
mov dword [esp + 0x1c], esi
xor eax, eax
mov ecx, dword [esp + 0x148]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.100346f8
add esp, 0x140
ret
Function at 0x10029ad0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1004b3ab
mov eax, dword fs:[0]
push eax
sub esp, 0x150
mov eax, dword [0x100661b0]
xor eax, esp
mov dword [esp + 0x148], eax
push ebx
push esi
push edi
mov eax, dword [0x100661b0]
xor eax, esp
push eax
lea eax, [esp + 0x160]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0x48
mov dword [esp + 0x24], eax
xor ebx, ebx
lea eax, [esp + 0x110]
push ebx
push eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
call fcn.10037fe0
movzx eax, byte [esi]
add esi, 1
add esp, 0xc
push esi
lea esi, [esp + 0x30]
mov dword [esp + 0x30], 0x67452301
mov dword [esp + 0x34], 0xefcdab89
mov dword [esp + 0x38], 0x98badcfe
mov dword [esp + 0x3c], 0x10325476
mov dword [esp + 0x40], 0xc3d2e1f0
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], ebx
call fcn.1002cc30
add esp, 4
lea edi, [esp + 0x114]
mov ecx, esi
call fcn.1002ccd0
mov dword [esp + 0x10c], 6
mov word [esp + 0xe4], 0xf
mov esi, 1
lea ecx, [esp + 0x10c]
push ecx
call fcn.10028840
mov word [esp + esi*2 + 0xe8], ax
add esi, 1
add esp, 4
cmp esi, 0x10
jb 0x10029ba2
mov edi, vtable.CEllipticCurveContext.0
lea esi, [esp + 0x14]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.1002a6a0
mov dword [esp + 0x168], ebx
xor eax, eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], eax
mov dword [esp + 0xd0], eax
mov dword [esp + 0xd4], eax
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], eax
mov word [esp + 0xe0], ax
mov word [esp + 0x10c], 1
mov esi, 0x1f
jmp 0x10029c40
push 8
lea edx, [esp + 0xc0]
call fcn.1002b4d0
mov edx, dword [esp + 0x24]
movzx ax, byte [edx + esi]
mov word [esp + 0x112], ax
add esp, 4
lea ecx, [esp + 0x10c]
lea eax, [esp + 0xbc]
call fcn.1002b390
sub esi, 1
jns 0x10029c40
mov ecx, eax
push ecx
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x34]
call fcn.1002d460
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0xec]
call fcn.1002d180
lea esi, [esp + 0xe4]
lea ebx, [esp + 0x2c]
call fcn.1002afe0
mov edx, dword [esp + 0x28]
mov eax, dword [ebp + 0x10]
mov esi, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
add eax, 0xffffffe0
push eax
add edx, 0x20
lea ecx, [esp + 0xec]
call fcn.10029940
add esp, 8
mov esi, eax
mov dword [esp + 0x168], 0xffffffff
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], edi
xor edi, edi
cmp eax, edi
je 0x10029cff
push eax
call fcn.10034fb4
add esp, 4
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x10029d14
push eax
call fcn.10034fb4
add esp, 4
mov dword [esp + 0x1c], edi
mov eax, esi
mov ecx, dword [esp + 0x160]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x148]
xor ecx, esp
call fcn.100346f8
mov esp, ebp
pop ebp
ret
Function at 0x1002a820
Capabilities:
Encode data using xor

Disassembly:
movzx edx, word [esi]
push ebx
push edi
mov edi, eax
movzx eax, word [edi]
cmp ax, dx
mov ebx, ecx
jbe 0x1002a881
mov ecx, 1
cmp dx, cx
jb 0x1002a859
jmp 0x1002a840
movzx eax, cx
add eax, eax
mov dx, word [eax + edi]
xor dx, word [eax + esi]
add ecx, 1
mov word [eax + ebx], dx
cmp cx, word [esi]
jbe 0x1002a840
movzx edx, word [esi]
movzx eax, cx
movzx ecx, word [edi]
sub ecx, edx
add ecx, ecx
add eax, eax
push ecx
lea ecx, [eax + edi]
push ecx
add eax, ebx
push eax
call fcn.10039170
mov dx, word [edi]
add esp, 0xc
pop edi
mov word [ebx], dx
pop ebx
ret
jae 0x1002a8d1
mov ecx, 1
cmp ax, cx
jb 0x1002a8a9
lea ecx, [ecx]
movzx eax, cx
add eax, eax
mov dx, word [eax + edi]
xor dx, word [eax + esi]
add ecx, 1
mov word [eax + ebx], dx
cmp cx, word [edi]
jbe 0x1002a890
movzx edx, word [esi]
movzx eax, cx
movzx ecx, word [edi]
sub edx, ecx
add eax, eax
add edx, edx
push edx
lea ecx, [eax + esi]
push ecx
add eax, ebx
push eax
call fcn.10039170
mov dx, word [esi]
add esp, 0xc
pop edi
mov word [ebx], dx
pop ebx
ret
movzx eax, ax
test ax, ax
jbe 0x1002a8f9
lea esp, [esp]
movzx ecx, ax
add ecx, ecx
mov dx, word [ecx + edi]
xor dx, word [ecx + esi]
jne 0x1002a8f9
add eax, 0xffff
test ax, ax
ja 0x1002a8e0
test ax, ax
mov word [ebx], ax
jbe 0x1002a928
movzx ecx, ax
sub edi, esi
lea ecx, [esi + ecx*2]
sub ebx, esi
jmp 0x1002a910
mov dx, word [edi + ecx]
xor dx, word [ecx]
add eax, 0xffff
mov word [ebx + ecx], dx
sub ecx, 2
test ax, ax
ja 0x1002a910
pop edi
pop ebx
ret

Function at 0x1002a930
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, word [edx]
cmp ecx, 0x11
jle 0x1002a95a
push esi
lea eax, [edx + ecx*2 - 0x1c]
lea esi, [ecx - 0x11]
movzx ecx, word [eax + 0x1c]
xor word [eax - 6], cx
xor word [eax], cx
mov word [eax + 0x1c], 0
sub eax, 2
sub esi, 1
jne 0x1002a940
pop esi
cmp word [edx], 0x11
jbe 0x1002a97d
mov word [edx], 0x11
movzx eax, word [edx]
movzx ecx, ax
cmp word [edx + ecx*2], 0
jne 0x1002a97d
add eax, 0xffffffff
test ax, ax
mov word [edx], ax
jne 0x1002a965
ret
Function at 0x1002a980
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x34
mov eax, dword [0x100661b0]
xor eax, esp
mov dword [esp + 0x30], eax
push ebp
mov ebp, dword [esp + 0x40]
cmp word [ebp], 0
push esi
mov esi, ecx
mov dword [esp + 0xc], ebp
mov dword [esp + 8], esi
je 0x1002aaeb
movzx eax, word [esi]
test ax, ax
je 0x1002aaeb
movzx eax, ax
test eax, eax
push ebx
je 0x1002a9e6
mov ecx, dword [esp + 0x44]
mov edx, dword [ecx + 8]
mov ecx, esi
lea ebx, [esp + 0x14]
sub ecx, ebx
lea esp, [esp]
lea ebx, [ecx + eax*2]
sub eax, 1
movzx ebx, word [esp + ebx + 0x14]
mov bx, word [edx + ebx*2]
mov word [esp + eax*2 + 0x16], bx
jne 0x1002a9d0
push 0x48
push 0
push edi
call fcn.10037fe0
movzx ebx, word [ebp]
add esp, 0xc
test ebx, ebx
je 0x1002aa74
jmp 0x1002aa00
movzx edx, word [ebp + ebx*2]
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 8]
movzx esi, word [ecx + edx*2]
cmp si, 0x7fff
je 0x1002aa6b
mov edx, dword [esp + 0xc]
movzx ecx, word [edx]
test ecx, ecx
je 0x1002aa6b
lea eax, [ebx + ecx]
lea edx, [edi + eax*2 - 2]
lea esp, [esp]
movzx eax, word [esp + ecx*2 + 0x14]
cmp ax, 0x7fff
je 0x1002aa61
add eax, esi
movzx eax, ax
cmp ax, 0x7fff
movzx eax, ax
jb 0x1002aa4e
sub eax, 0x7fff
mov ebp, dword [esp + 0x44]
mov ebp, dword [ebp + 4]
mov ax, word [ebp + eax*2]
xor word [edx], ax
mov ebp, dword [esp + 0x10]
sub ecx, 1
sub edx, 2
test ecx, ecx
jne 0x1002aa30
sub ebx, 1
jne 0x1002aa00
mov esi, dword [esp + 0xc]
mov ax, word [esi]
add ax, word [ebp]
pop ebx
sub ax, 1
movzx ecx, ax
cmp ecx, 0x11
mov word [edi], ax
jle 0x1002aaab
lea eax, [edi + ecx*2 - 0x1c]
lea edx, [ecx - 0x11]
movzx ecx, word [eax + 0x1c]
xor word [eax - 6], cx
xor word [eax], cx
mov word [eax + 0x1c], 0
sub eax, 2
sub edx, 1
jne 0x1002aa92
cmp word [edi], 0x11
jbe 0x1002aaf0
mov word [edi], 0x11
jmp 0x1002aac0
movzx eax, word [edi]
movzx ecx, ax
cmp word [edi + ecx*2], 0
jne 0x1002aaf0
add eax, 0xffffffff
test ax, ax
mov word [edi], ax
jne 0x1002aac0
pop esi
pop ebp
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100346f8
add esp, 0x34
ret 8
mov word [edi], 0
mov ecx, dword [esp + 0x38]
pop esi
pop ebp
xor ecx, esp
call fcn.100346f8
add esp, 0x34
ret 8
Function at 0x1002ac30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [ebp + 8]
movzx ecx, cx
movzx ecx, word [esi + ecx*2]
movzx esi, word [edx]
mov dword [esp + 0x10], ecx
movzx ecx, word [esp + 0x14]
push edi
movzx edi, word [eax]
add esi, ecx
cmp edi, esi
lea ebx, [eax + ecx*2]
jge 0x1002ac7c
lea ebx, [ebx]
add word [eax], 1
movzx esi, word [eax]
movzx esi, si
mov word [eax + esi*2], 0
movzx esi, word [edx]
movzx edi, word [eax]
add esi, ecx
cmp edi, esi
jl 0x1002ac60
movzx edi, word [edx]
test di, di
je 0x1002acce
movzx ecx, di
lea esi, [ebx + ecx*2]
sub edx, ebx
lea esp, [esp]
movzx ecx, word [edx + esi]
mov ebx, dword [ebp + 8]
movzx ecx, word [ebx + ecx*2]
cmp cx, 0x7fff
je 0x1002acc0
add ecx, dword [esp + 0x14]
cmp cx, 0x7fff
movzx ecx, cx
jb 0x1002acb6
sub ecx, 0x7fff
mov ebx, dword [ebp + 4]
mov cx, word [ebx + ecx*2]
xor word [esi], cx
add edi, 0xffff
sub esi, 2
test di, di
jne 0x1002ac90
cmp word [eax], 0
pop edi
pop esi
pop ebp
pop ebx
je 0x1002acf8
jmp 0x1002ace0
movzx ecx, word [eax]
movzx edx, cx
cmp word [eax + edx*2], 0
jne 0x1002acf8
add ecx, 0xffffffff
test cx, cx
mov word [eax], cx
jne 0x1002ace0
ret 8
Function at 0x1002ad00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xe4
mov eax, dword [0x100661b0]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xe8]
cmp word [eax], 0
push esi
push edi
mov edi, edx
mov esi, ecx
mov dword [esp + 8], edi
jne 0x1002ad35
mov eax, 1
jmp 0x1002aeed
push ebx
mov ebx, 1
mov word [edi], bx
mov word [edi + 2], bx
movzx ecx, word [eax]
push ebp
lea edx, [ecx + ecx + 2]
push edx
push eax
lea eax, [esp + 0x68]
push eax
mov word [esp + 0xb4], 0
call fcn.10039170
push 0x48
lea ecx, [esp + 0x28]
push 0
push ecx
call fcn.10037fe0
mov eax, dword [esp + 0x78]
add esp, 0x18
cmp ax, bx
mov bp, 0x12
mov word [esp + 0x18], bp
mov word [esp + 0x1a], bx
mov word [esp + 0x20], bx
mov word [esp + 0x3c], bx
je 0x1002aeb5
mov edi, dword [esp + 0x18]
jmp 0x1002ada4
mov eax, dword [esp + 0x60]
cmp ax, bp
jae 0x1002ae3c
movzx edx, ax
movzx ecx, word [esp + edx*2 + 0x60]
add ecx, ecx
mov dword [esp + 0x14], ecx
jmp 0x1002adc4
mov ecx, dword [esp + 0x14]
movzx edx, bp
movzx edx, word [esp + edx*2 + 0x18]
sub edi, eax
mov eax, dword [esi + 8]
mov dx, word [eax + edx*2]
sub dx, word [eax + ecx]
movzx ebx, di
add dx, 0x7fff
movzx eax, dx
cmp ax, 0x7fff
movzx eax, ax
jb 0x1002adf2
sub eax, 0x7fff
mov ecx, dword [esi + 4]
movzx edi, word [ecx + eax*2]
push ebx
push esi
lea edx, [esp + 0x68]
mov ecx, edi
lea eax, [esp + 0x20]
call fcn.1002ac30
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov edx, ebx
mov ecx, edi
lea eax, [esp + 0xb0]
call fcn.1002ac30
mov bp, word [esp + 0x18]
cmp bp, 1
je 0x1002aec2
mov eax, dword [esp + 0x60]
cmp bp, ax
mov edi, dword [esp + 0x18]
jae 0x1002adc0
mov ecx, dword [esi + 8]
mov edx, eax
movzx eax, ax
movzx eax, word [esp + eax*2 + 0x60]
mov ax, word [ecx + eax*2]
movzx ebx, bp
movzx ebx, word [esp + ebx*2 + 0x18]
sub ax, word [ecx + ebx*2]
sub edx, edi
add ax, 0x7fff
movzx eax, ax
movzx edx, dx
cmp ax, 0x7fff
mov dword [esp + 0x14], edx
movzx eax, ax
jb 0x1002ae77
sub eax, 0x7fff
mov ecx, dword [esi + 4]
movzx ebx, word [ecx + eax*2]
push edx
push esi
lea edx, [esp + 0x20]
mov ecx, ebx
lea eax, [esp + 0x68]
call fcn.1002ac30
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edx
push esi
lea edx, [esp + 0xb0]
mov ecx, ebx
call fcn.1002ac30
cmp word [esp + 0x60], 1
jne 0x1002ada0
mov edi, eax
mov eax, dword [esp + 0x62]
mov edx, edi
call fcn.1002abe0
jmp 0x1002aee9
mov eax, dword [esp + 0x1a]
lea edx, [esp + 0xa8]
call fcn.1002abe0
movzx eax, word [esp + 0xa8]
lea ecx, [eax + eax + 2]
push ecx
push edx
push ebx
call fcn.10039170
add esp, 0xc
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xe8]
pop edi
pop esi
xor ecx, esp
call fcn.100346f8
add esp, 0xe4
ret 4
Function at 0x1002b0e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
cmp ebp, 0x10
push esi
mov esi, eax
mov eax, dword [esp + 0x10]
lea ebx, [eax + 0x120]
push edi
mov edi, ebx
jb 0x1002b137
mov ecx, ebp
shr ecx, 4
mov dword [esp + 0x18], ecx
mov ecx, dword [edi]
xor dword [esi], ecx
mov edx, dword [edi + 4]
xor dword [esi + 4], edx
mov ecx, dword [edi + 8]
xor dword [esi + 8], ecx
mov edx, dword [edi + 0xc]
xor dword [esi + 0xc], edx
push eax
push esi
call fcn.1002d830
mov eax, dword [esp + 0x1c]
mov edi, esi
add esp, 8
add esi, 0x10
sub ebp, 0x10
sub dword [esp + 0x18], 1
jne 0x1002b104
test ebp, ebp
mov ecx, dword [edi]
mov dword [ebx], ecx
mov edx, dword [edi + 4]
mov dword [eax + 0x124], edx
mov ecx, dword [edi + 8]
mov dword [eax + 0x128], ecx
mov edx, dword [edi + 0xc]
mov dword [eax + 0x12c], edx
je 0x1002b199
xor eax, eax
test ebp, ebp
jbe 0x1002b16d
mov cl, byte [eax + esi]
xor byte [ebx + eax], cl
add eax, 1
cmp eax, ebp
jb 0x1002b160
push ebp
push edi
push esi
call fcn.10039170
mov edx, dword [esp + 0x20]
push edx
push ebx
call fcn.1002d830
mov eax, dword [ebx]
mov dword [edi], eax
mov ecx, dword [ebx + 4]
mov dword [edi + 4], ecx
mov edx, dword [ebx + 8]
mov dword [edi + 8], edx
mov eax, dword [ebx + 0xc]
add esp, 0x14
mov dword [edi + 0xc], eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1002b1a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebx, ecx
cmp ebx, 0x20
push esi
mov esi, edx
jb 0x1002b23b
lea eax, [ebx - 0x10]
shr eax, 4
mov dword [esp + 0xc], eax
lea ecx, [ecx]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
mov ebp, dword [esi]
mov dword [esp + 0x14], eax
lea eax, [edi + 0x90]
push eax
push esi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edx
call fcn.1002dd70
mov eax, dword [edi + 0x120]
xor dword [esi], eax
mov ecx, dword [edi + 0x124]
xor dword [esi + 4], ecx
mov edx, dword [edi + 0x128]
xor dword [esi + 8], edx
mov eax, dword [edi + 0x12c]
xor dword [esi + 0xc], eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
add esp, 8
add esi, 0x10
sub ebx, 0x10
sub dword [esp + 0xc], 1
mov dword [edi + 0x120], ebp
mov dword [edi + 0x124], ecx
mov dword [edi + 0x128], edx
mov dword [edi + 0x12c], eax
jne 0x1002b1c0
cmp ebx, 0x10
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov eax, dword [esi + 8]
mov dword [esp + 0x10], ecx
mov ecx, dword [esi + 0xc]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
jbe 0x1002b28c
lea ebp, [edi + 0x90]
push ebp
push esi
call fcn.1002dd70
add esp, 8
xor eax, eax
add ebx, 0xfffffff0
je 0x1002b289
mov dl, byte [esi + eax]
xor byte [esi + eax + 0x10], dl
mov cl, byte [esi + eax + 0x10]
xor cl, dl
mov byte [esi + eax], cl
add eax, 1
cmp eax, ebx
jb 0x1002b272
push ebp
jmp 0x1002b293
lea edx, [edi + 0x90]
push edx
push esi
call fcn.1002dd70
mov eax, dword [edi + 0x120]
xor dword [esi], eax
mov ecx, dword [edi + 0x124]
xor dword [esi + 4], ecx
mov edx, dword [edi + 0x128]
xor dword [esi + 8], edx
mov eax, dword [edi + 0x12c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
add esp, 8
xor dword [esi + 0xc], eax
mov eax, dword [esp + 0x18]
pop esi
mov dword [edi + 0x120], ecx
mov ecx, dword [esp + 0x18]
pop ebp
mov dword [edi + 0x124], edx
mov dword [edi + 0x128], eax
mov dword [edi + 0x12c], ecx
pop ebx
add esp, 0x14
ret
Function at 0x1002d770
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [eax]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
push edi
mov dword [esi + 0xc], edx
add esi, 0x14
lea edi, [ebp + 0x78]
mov ebx, 0x100522b0
add ebp, 0x70
mov eax, dword [esi - 8]
ror eax, 8
xor eax, dword [ebx]
lea ecx, [esi - 0x14]
xor eax, dword [ecx]
push ecx
mov dword [esi - 4], eax
mov dword [ebp], eax
mov eax, dword [esi - 0x10]
xor eax, dword [esi - 4]
mov dword [esi], eax
mov dword [edi - 4], eax
mov eax, dword [esi]
xor eax, dword [esi - 0xc]
mov dword [esi + 4], eax
mov dword [edi], eax
mov eax, dword [esi - 8]
xor eax, dword [esi + 4]
mov dword [esi + 8], eax
mov dword [edi + 4], eax
call fcn.1002d500
add ebx, 4
add esp, 4
sub ebp, 0x10
sub edi, 0x10
add esi, 0x10
cmp ebx, 0x100522d0
jl 0x1002d7a0
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov eax, dword [esp + 0x18]
mov dword [eax + 0x80], edx
mov edx, dword [ecx + 4]
pop edi
mov dword [eax + 0x84], edx
mov edx, dword [ecx + 8]
pop esi
mov dword [eax + 0x88], edx
mov ecx, dword [ecx + 0xc]
pop ebp
mov dword [eax + 0x8c], ecx
pop ebx
ret

Function at 0x1002e2b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
push esi
push edi
mov edi, eax
mov esi, edx
jne 0x1002e2bf
pop edi
xor eax, eax
pop esi
ret
cmp edi, 8
not esi
jb 0x1002e3a7
push ebp
mov ebp, edi
shr ebp, 3
movzx edx, byte [ecx]
xor edx, esi
and edx, 0xff
add ecx, 1
mov eax, esi
shr eax, 8
xor eax, dword [edx*4 + 0x10051aa0]
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x10051aa0]
movzx edx, byte [ecx + 1]
xor edx, eax
and edx, 0xff
add ecx, 1
shr eax, 8
xor eax, dword [edx*4 + 0x10051aa0]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x10051aa0]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x10051aa0]
movzx edx, byte [ecx + 1]
xor edx, eax
add ecx, 1
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x10051aa0]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x10051aa0]
movzx edx, byte [ecx + 1]
add ecx, 1
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x10051aa0]
add ecx, 1
sub edi, 8
sub ebp, 1
mov esi, eax
jne 0x1002e2d0
pop ebp
test edi, edi
je 0x1002e3cc
jmp 0x1002e3b0
movzx eax, byte [ecx]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + 0x10051aa0]
add ecx, 1
sub edi, 1
jne 0x1002e3b0
mov eax, esi
pop edi
not eax
pop esi
ret
Function at 0x1002e780
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 0x3c], 0
jne 0x1002e7d3
cmp dword [esi + 4], 0
jne 0x1002e7dc
call fcn.1003698b
mov dword [eax], 0
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
push eax
push 0x4000
push 1
push ecx
call fcn.10036c2c
add esp, 0x10
test eax, eax
mov dword [esi + 4], eax
jne 0x1002e7d7
mov edx, dword [esi + 0x40]
push edx
mov dword [esi + 0x3c], 1
call fcn.10037e45
add esp, 4
test eax, eax
je 0x1002e7d3
mov dword [esi + 0x38], 0xffffffff
or eax, 0xffffffff
ret
mov eax, dword [esi + 0x44]
mov dword [esi], eax
mov eax, dword [esi]
add dword [esi + 4], 0xffffffff
mov cl, byte [eax]
add eax, 1
mov dword [esi], eax
movzx eax, cl
ret