joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002ed71
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1002eced
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1002eee0
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1002eee0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1002ee95
jg 0x1002edcd
test eax, eax
je 0x1002ee8b
push 1
push 0x1000
call fcn.10021e78
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1002edf0
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1002ee82
push 0x8000
push ebx
call fcn.1002ec1e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1002ee19
jg 0x1002ee14
cmp ecx, 0x1000
jb 0x1002ee19
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10021c5c
add esp, 0x10
cmp eax, 0xffffffff
je 0x1002ee5e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1002ee14
jl 0x1002ee45
test ecx, ecx
jne 0x1002ee06
push dword [ebp - 0xc]
push ebx
call fcn.1002ec1e
push esi
call fcn.10021ed5
add esp, 0xc
xor ebx, ebx
jmp 0x1002eeee
cmp byte [edi + 0x24], 0
je 0x1002ee75
cmp dword [edi + 0x20], 5
jne 0x1002ee75
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1002ee80
mov ebx, dword [edi + 0x18]
jmp 0x1002ee82
xor ebx, ebx
push esi
call fcn.10021ed5
pop ecx
jmp 0x1002eeee
test ecx, ecx
jg 0x1002ee57
jl 0x1002ee95
test eax, eax
jae 0x1002ee57
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10022158
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1002eeb5
cmp byte [edi + 0x1c], 0
je 0x1002ee57
jmp 0x1002eee6
push ebx
call fcn.1002af7e
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1002ee57
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1002eeee
cmp byte [edi + 0x1c], 0
je 0x1002eeeb
mov ebx, dword [edi + 0x18]
jmp 0x1002eeee
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10022158
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10030510
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003053d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003053d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5d2a3cec
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..pdata
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x259878ee
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x1000869d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor edi, edi
lea edx, [ebp - 0x14]
mov esi, edi
mov dword [ebp - 0x14], edi
call fcn.1001199c
mov ebx, eax
mov dword [ebp - 0x18], ebx
test ebx, ebx
jne 0x100086c5
push 0xfffffffffffffffe
jmp 0x10008897
mov edx, edi
mov eax, dword [0x10020dc8]
mov ecx, edx
and ecx, 0x1f
mov al, byte [ecx + eax + 0x1858]
xor byte [edx + ebx], al
inc edx
cmp edx, 0x20
jb 0x100086c7
mov eax, dword [0x10020dc8]
cmp dword [eax + 0xa4], 1
jne 0x1000870c
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
mov eax, dword [0x10020d98]
push edi
push edi
push 0x100049f2
push edi
push edi
call dword [eax + 0x78]
jmp 0x10008898
lea ecx, [ebp - 4]
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
call fcn.1000b325
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
jne 0x1000872b
or esi, 0xffffffff
jmp 0x10008898
and dword [ebp - 0xc], esi
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10008880
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 8], 1
test ebx, ebx
jne 0x10008856
push 0x10
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.1000a2a6
mov eax, dword [0x10020dc8]
add esp, 0xc
test dword [eax + 0x1898], 0x200
je 0x10008775
mov ecx, 0x2cd
call fcn.1000f64b
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x2c]
mov ecx, dword [edi + eax*4]
call fcn.1000dc2a
test eax, eax
js 0x1000881c
push dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
call fcn.1000dbd4
mov dword [0x10020e9c], eax
pop ecx
test eax, eax
jne 0x100087be
mov eax, dword [0x10020d98]
push dword [ebp - 0x28]
call dword [eax + 0x34]
mov eax, dword [0x10020d98]
push dword [ebp - 0x2c]
call dword [eax + 0x34]
push 0xfffffffffffffffe
pop esi
jmp 0x1000881c
mov eax, dword [0x10020dc8]
lea edx, [ebp - 0x2c]
push dword [ebp - 8]
mov ecx, 0x10007a42
push dword [eax + 0x224]
call fcn.1000b5e9
pop ecx
pop ecx
test eax, eax
jne 0x100087f9
mov eax, dword [0x10020d98]
push dword [ebp - 0x28]
call dword [eax + 0x34]
mov eax, dword [0x10020d98]
push dword [ebp - 0x2c]
call dword [eax + 0x34]
push 0xfffffffffffffffd
jmp 0x100087bb
lea ecx, [ebp - 0x2c]
call fcn.1000b741
test eax, eax
je 0x1000881c
push dword [ebp - 0x2c]
call fcn.100058f8
mov eax, dword [0x10020d98]
pop ecx
push dword [ebp - 0x28]
call dword [eax + 0x34]
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x2c], 0
je 0x10008846
test ebx, ebx
jne 0x10008835
mov eax, dword [0x10020d98]
push ebx
push dword [ebp - 0x2c]
call dword [eax + 0x114]
cmp dword [ebp - 0x28], 0
je 0x10008846
mov eax, dword [0x10020d98]
push dword [ebp - 0x28]
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, 2
jbe 0x10008743
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
cmp eax, ebx
jb 0x10008739
push 0xfffffffffffffffe
push edi
call fcn.1000a122
pop ecx
add edi, 4
pop ecx
sub ebx, 1
jne 0x1000886b
mov ebx, dword [ebp - 4]
shl ebx, 2
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.1000a122
cmp dword [ebp - 0x10], 0
pop ecx
pop ecx
jne 0x10008898
push 0xfffffffffffffffb
pop esi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10009e2d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push 0x126
call fcn.1000a10c
mov ebx, eax
xor eax, eax
pop ecx
test ebx, ebx
je 0x10009ec0
push esi
push edi
mov esi, 0x1001de8c
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea edi, [ebp - 0x20]
xor esi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, esi
cmp byte [ebp - 0x10], al
je 0x10009e7b
inc eax
cmp byte [ebp + eax - 0x10], 0
jne 0x10009e68
push 0xe
pop edx
cmp eax, edx
jbe 0x10009e7b
mov ecx, esi
jmp 0x10009e83
mov edx, eax
mov ecx, esi
test edx, edx
je 0x10009e8f
lea eax, [ecx + 0x30]
mov byte [ebp + ecx - 0x20], al
inc ecx
cmp ecx, edx
jb 0x10009e83
lea eax, [ebp - 0x20]
push eax
call dword [0x1001a0cc]
mov edx, 0x10020c48
sub edx, ebx
mov eax, esi
lea ecx, [esi + ebx]
and eax, 0xf
mov al, byte [eax + 0x1001dcb8]
xor al, byte [edx + ecx]
inc esi
mov byte [ecx], al
cmp esi, 0x126
jb 0x10009ea0
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x1000a2f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov ebx, dword [edi + 0x3c]
mov eax, dword [ebx + edi + 0x78]
test eax, eax
je 0x1000a368
lea ecx, [eax + edi]
mov eax, dword [ecx + 0x24]
mov edx, dword [ecx + 0x20]
add eax, edi
mov dword [ebp - 0x14], eax
add edx, edi
mov eax, dword [ecx + 0x1c]
mov ecx, dword [ecx + 0x18]
add eax, edi
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
test ecx, ecx
je 0x1000a368
mov esi, dword [edx + eax*4]
add esi, edi
push 0
push esi
call fcn.1000df7b
pop ecx
mov edx, eax
mov ecx, esi
call fcn.1000faec
xor eax, 0x218fe95b
cmp eax, dword [ebp - 8]
mov eax, dword [ebp - 4]
pop ecx
je 0x1000a36f
mov edx, dword [ebp - 0x10]
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebp - 0xc]
jb 0x1000a337
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2]
mov ecx, dword [ebx + edi + 0x78]
add ecx, edi
mov esi, dword [esi + eax*4]
add esi, edi
cmp esi, ecx
jb 0x1000a3dc
mov eax, dword [ebx + edi + 0x7c]
add eax, ecx
cmp esi, eax
jae 0x1000a3dc
xor eax, eax
mov cl, byte [esi + eax]
cmp cl, 0x2e
je 0x1000a3aa
test cl, cl
je 0x1000a3aa
mov byte [ebp + eax - 0x58], cl
inc eax
cmp eax, 0x40
jb 0x1000a394
cmp byte [eax + esi], 0
mov dword [ebp + eax - 0x58], 0x6c6c642e
mov byte [ebp + eax - 0x54], 0
je 0x1000a3c0
inc esi
add esi, eax
lea eax, [ebp - 0x58]
push eax
call dword [0x1001a170]
test eax, eax
je 0x1000a368
push esi
push eax
call dword [0x1001a0b8]
test eax, eax
je 0x1000a368
jmp 0x1000a36a
mov eax, esi
jmp 0x1000a36a
Function at 0x1000a3e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x78]
test eax, eax
je 0x1000a435
mov edx, dword [eax + esi + 0x20]
xor edi, edi
mov ebx, dword [eax + esi + 0x24]
add edx, esi
mov ecx, dword [eax + esi + 0x1c]
add ebx, esi
mov eax, dword [eax + esi + 0x18]
add ecx, esi
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp + 8], eax
test eax, eax
je 0x1000a435
mov edx, dword [edx + edi*4]
mov ecx, dword [ebp + 0xc]
add edx, esi
call fcn.1000c5b3
test eax, eax
je 0x1000a43c
mov edx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 8]
jb 0x1000a41b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
movzx eax, word [ebx + edi*2]
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax*4]
add eax, esi
jmp 0x1000a437

Function at 0x1000acca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ebx, ecx
mov dword [ebp - 4], ebx
mov esi, edi
cmp edi, edx
jae 0x1000acf6
mov ecx, dword [ebp + 8]
mov eax, esi
and eax, 0x7f
mov al, byte [eax + ecx]
cmp al, byte [esi + ebx]
je 0x1000ad4e
inc esi
cmp esi, edx
jb 0x1000ace4
mov ebx, 0x10020e7a
mov esi, 0x1001deac
lea edi, [ebp - 0x14]
xor eax, eax
xor ecx, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, ecx
cmp byte [ebp - 0x14], al
je 0x1000ad2b
inc eax
cmp byte [ebp + eax - 0x14], cl
jne 0x1000ad1d
push 0xe
pop edx
cmp eax, edx
ja 0x1000ad31
mov edx, eax
test edx, edx
je 0x1000ad3d
lea eax, [ecx + 0x30]
mov byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, edx
jb 0x1000ad31
lea eax, [ebp - 0x24]
push eax
call dword [0x1001a0cc]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
sub esi, edi
je 0x1000acf6
lea eax, [esi + 1]
push eax
call fcn.1000a10c
mov ebx, eax
mov dword [ebp + 0x10], ebx
pop ecx
test ebx, ebx
jne 0x1000ad6c
mov eax, 0x10020e7a
jmp 0x1000ad49
mov edx, dword [ebp + 8]
mov ecx, ebx
mov ebx, dword [ebp - 4]
sub ecx, edi
mov eax, edi
and eax, 0x7f
mov al, byte [eax + edx]
xor al, byte [edi + ebx]
mov byte [ecx + edi], al
inc edi
sub esi, 1
jne 0x1000ad76
mov ebx, dword [ebp + 0x10]
jmp 0x1000acfb
Function at 0x1000ad92
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 8], ecx
mov esi, edi
mov dword [ebp - 4], ebx
cmp edi, edx
jae 0x1000adcd
mov ecx, dword [ebp + 8]
mov eax, esi
and eax, 0x7f
mov al, byte [eax + ecx]
mov ecx, dword [ebp - 8]
cmp al, byte [esi + ecx]
je 0x1000adc6
inc esi
cmp esi, edx
jb 0x1000adac
jmp 0x1000adcd
mov ecx, esi
sub ecx, edi
mov dword [ebp - 4], ecx
mov esi, 0x1001debc
lea edi, [ebp - 0x14]
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, ebx
cmp byte [ebp - 0x14], al
je 0x1000adfc
inc eax
cmp byte [ebp + eax - 0x14], bl
jne 0x1000adea
push 0xe
pop edx
cmp eax, edx
jbe 0x1000adfc
mov ecx, ebx
jmp 0x1000ae04
mov edx, eax
mov ecx, ebx
test edx, edx
je 0x1000ae10
lea eax, [ecx + 0x30]
mov byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, edx
jb 0x1000ae04
lea eax, [ebp - 0x24]
push eax
call dword [0x1001a0cc]
mov esi, dword [ebp - 4]
lea eax, [esi*2 + 2]
push eax
call fcn.1000a10c
mov edx, eax
pop ecx
test edx, edx
jne 0x1000ae38
mov eax, 0x10020ea8
jmp 0x1000ae60
test esi, esi
je 0x1000ae5e
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov eax, ecx
and eax, 0x7f
mov al, byte [eax + esi]
xor al, byte [ecx + edi]
movzx eax, al
mov word [edx + ebx*2], ax
inc ebx
inc ecx
cmp ebx, dword [ebp - 4]
jb 0x1000ae42
mov eax, edx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000c618
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi]
inc eax
push eax
call fcn.1000a10c
mov edx, eax
pop ecx
test edx, edx
je 0x1000c649
xor ecx, ecx
cmp dword [esi], ecx
jbe 0x1000c649
mov eax, ecx
and eax, 3
mov al, byte [eax + esi + 0x108]
xor al, byte [esi + ecx + 4]
mov byte [ecx + edx], al
inc ecx
cmp ecx, dword [esi]
jb 0x1000c631
mov eax, edx
pop esi
ret
Function at 0x1000f64b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push esi
push edi
push ecx
call fcn.1000a074
mov edi, eax
mov dword [esp], 0x1da
mov dword [ebp - 0x1c], edi
call fcn.1000a074
mov ecx, dword [0x10020dc8]
mov esi, eax
add ecx, 0x648
push ecx
call fcn.10015e1a
mov ecx, dword [0x10020dc8]
push eax
add ecx, 0x122a
lea eax, [ebp - 0x22c]
push ecx
push 0x1001df98
push 0x104
push eax
call fcn.1000c35c
push 0
push edi
mov eax, 0x1001ddb4
push eax
push esi
push eax
mov eax, dword [0x10020dc8]
add eax, 0x1020
push eax
call fcn.1000a9af
add esp, 0x34
lea ecx, [ebp - 0x22c]
push 0
push ecx
push eax
mov eax, dword [0x10020d98]
call dword [eax + 0x120]
mov eax, dword [0x10020d98]
push edi
call dword [eax + 0x14]
mov esi, eax
test esi, esi
jne 0x1000f708
mov eax, dword [0x10020d98]
push edi
call dword [eax + 4]
mov esi, eax
test esi, esi
jne 0x1000f708
lea eax, [ebp - 0x1c]
push eax
call fcn.1000ae78
pop ecx
or eax, 0xffffffff
jmp 0x1000f835
lea eax, [ebp - 0x22c]
push eax
mov eax, dword [0x10020d98]
call dword [eax + 4]
mov edi, eax
mov dword [ebp - 0x18], edi
test edi, edi
je 0x1000f80a
mov ecx, dword [esi + 0x3c]
add ecx, esi
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x78]
test eax, eax
je 0x1000f80a
push ebx
lea ebx, [eax + esi]
mov eax, dword [ebx + 0x20]
mov edx, dword [ebx + 0x24]
add eax, esi
mov dword [ebp - 0x24], eax
add edx, esi
mov eax, dword [ebx + 0x1c]
add eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x18], eax
jbe 0x1000f809
movzx eax, word [edx + eax*2]
mov edi, dword [ebp - 0x20]
mov edi, dword [edi + eax*4]
add edi, esi
cmp edi, ebx
jb 0x1000f77a
mov eax, dword [ecx + 0x7c]
add eax, ebx
cmp edi, eax
jb 0x1000f7f6
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
mov eax, dword [ecx + eax*4]
add eax, esi
push eax
mov eax, dword [0x10020d98]
push dword [ebp - 0x18]
call dword [eax + 0xc]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1000f7f0
push 8
push eax
push edi
call fcn.1000a2c5
add esp, 0xc
test eax, eax
je 0x1000f7f0
cmp byte [edi], 0xe9
jne 0x1000f7f0
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
mov eax, dword [0x10020d98]
push 0x40
push 8
push edi
call dword [eax + 0xfc]
test eax, eax
je 0x1000f7f0
push 8
push dword [ebp - 0x10]
push edi
call fcn.1000a1e9
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
add esp, 0xc
push eax
push dword [ebp - 0x14]
mov eax, dword [0x10020d98]
push 8
push edi
call dword [eax + 0xfc]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebx + 0x18]
jb 0x1000f761
mov edi, dword [ebp - 0x18]
pop ebx
lea eax, [ebp - 0x1c]
push eax
call fcn.1000ae78
pop ecx
test edi, edi
je 0x1000f821
mov eax, dword [0x10020d98]
push edi
call dword [eax + 8]
lea eax, [ebp - 0x22c]
push eax
mov eax, dword [0x10020d98]
call dword [eax + 0x11c]
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1000faec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
not esi
push edi
mov edi, ecx
test edx, edx
jne 0x1000fb00
xor eax, eax
jmp 0x1000fb33
xor ecx, ecx
test edx, edx
je 0x1000fb2f
movzx eax, byte [ecx + edi]
xor esi, eax
mov eax, esi
shr esi, 4
and eax, 0xf
xor esi, dword [eax*4 + 0x1001dcd8]
mov eax, esi
shr esi, 4
and eax, 0xf
xor esi, dword [eax*4 + 0x1001dcd8]
inc ecx
cmp ecx, edx
jb 0x1000fb06
not esi
mov eax, esi
pop edi
pop esi
pop ebp
ret
Function at 0x10012237
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x1001e050
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
call fcn.1000df7b
pop ecx
push 0xf
pop esi
xor ebx, ebx
mov byte [ebp - 9], bl
cmp eax, esi
ja 0x10012263
mov esi, eax
test esi, esi
je 0x10012271
mov ecx, ebx
lea eax, [ecx + 0x41]
mov byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, esi
jb 0x10012265
lea eax, [ebp - 0x18]
push eax
call dword [0x1001a0cc]
cmp dword [ebp - 4], 0
mov edi, dword [ebp + 8]
mov dh, byte [edi + 0x100]
mov al, byte [edi + 0x101]
jle 0x100122c3
inc dh
movzx esi, dh
mov dl, byte [esi + edi]
add al, dl
movzx ecx, al
mov byte [ebp + 0xb], al
mov al, byte [ecx + edi]
mov byte [esi + edi], al
mov byte [ecx + edi], dl
mov al, byte [esi + edi]
mov ecx, dword [ebp - 8]
add al, dl
movzx eax, al
mov al, byte [eax + edi]
xor byte [ebx + ecx], al
inc ebx
mov al, byte [ebp + 0xb]
cmp ebx, dword [ebp - 4]
jl 0x10012290
mov byte [edi + 0x100], dh
mov byte [edi + 0x101], al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10012306
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x5c], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x60], eax
mov dword [ecx + 0x64], eax
ret
Function at 0x100123c4
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
xor edi, edi
lea edx, [esi + 0x1d]
movzx ecx, byte [edx - 1]
movzx eax, byte [edx]
lea edx, [edx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [ebp + edi*4 - 0x154], ecx
inc edi
cmp edi, 0x10
jl 0x100123da
push 0x40
lea ecx, [ebp - 0x14c]
pop edx
mov eax, dword [ecx + 0x2c]
xor eax, dword [ecx + 0x18]
xor eax, dword [ecx - 8]
xor eax, dword [ecx]
lea ecx, [ecx + 4]
rol eax, 1
mov dword [ecx + 0x34], eax
sub edx, 1
jne 0x10012411
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov edi, dword [esi + 8]
and dword [ebp - 0x10], edx
mov dword [ebp - 8], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x10]
mov esi, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
mov ecx, ebx
not ecx
rol edx, 5
and ecx, esi
mov eax, edi
and eax, ebx
or ecx, eax
mov eax, dword [ebp - 0x10]
add edx, ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0x5a827999
mov dword [ebp - 0xc], esi
mov esi, edi
mov edi, ebx
add edx, dword [ebp + eax*4 - 0x154]
mov ebx, dword [ebp - 8]
add edx, ecx
ror edi, 2
inc eax
push 0x14
pop ecx
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], eax
cmp eax, ecx
jl 0x10012446
mov dword [ebp - 4], esi
mov eax, esi
xor eax, edi
rol edx, 5
xor eax, ebx
add edx, eax
mov eax, dword [ebp - 0xc]
add edx, dword [ebp + ecx*4 - 0x154]
add eax, 0x6ed9eba1
add edx, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, edi
mov edi, ebx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 8]
ror edi, 2
inc ecx
mov dword [ebp - 8], edx
cmp ecx, 0x28
jl 0x1001248f
push 0x28
pop esi
mov ecx, edi
rol edx, 5
or ecx, ebx
add edx, 0x8f1bbcdc
add edx, dword [ebp - 0xc]
and ecx, eax
mov eax, edi
and eax, ebx
or ecx, eax
mov eax, dword [ebp - 4]
add ecx, dword [ebp + esi*4 - 0x154]
mov dword [ebp - 0xc], eax
add edx, ecx
mov eax, edi
mov edi, ebx
mov ebx, dword [ebp - 8]
ror edi, 2
inc esi
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
cmp esi, 0x3c
jl 0x100124c8
mov esi, dword [ebp - 0x14]
push 0x3c
pop ecx
xor eax, edi
rol edx, 5
add edx, dword [ebp - 0xc]
xor eax, ebx
add eax, 0xca62c1d6
add eax, dword [ebp + ecx*4 - 0x154]
add edx, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, edi
mov edi, ebx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 8]
ror edi, 2
inc ecx
mov dword [ebp - 8], edx
cmp ecx, 0x50
jl 0x1001250b
add dword [esi + 0xc], eax
add dword [esi + 8], edi
add dword [esi + 4], ebx
add dword [esi], edx
mov eax, dword [ebp - 0xc]
add dword [esi + 0x10], eax
and dword [esi + 0x5c], 0
pop edi
pop esi
pop ebx
leave
ret