joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002f00
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [eax + 0x18]
test eax, eax
je 0x10002f60
push ebx
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ebx, eax
xor ecx, ecx
mov edx, 2
lea edi, [ebx + 1]
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100348e1
add esp, 4
mov esi, eax
mov eax, dword [ebp - 4]
push edi
push esi
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 8]
xor eax, eax
mov word [esi + ebx*2], ax
mov eax, esi
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov dword [eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret 4

Function at 0x10002f80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push 0x48
call fcn.100348a3
mov esi, eax
add esp, 4
test esi, esi
je 0x10002fa7
push 0x48
push 0
push esi
call fcn.1003578d
add esp, 0xc
jmp 0x10002fa9
xor esi, esi
push 0x48
push 0
push esi
call fcn.1003578d
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 0x10003060
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x1000302d
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x10003025
cmp dword [esi], 0
je 0x1000301a
cmp byte [esi + 0x45], 0
mov byte [esi + 0x44], 1
jne 0x1000301a
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
push 0
call edi
cmp byte [esi + 0x45], 0
je 0x10003010
push 0x48
push esi
call fcn.100348d3
add esp, 8
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop dword [eax]
push 0xffffffffffffffff
push dword [ebp - 4]
call esi
test eax, eax
jne 0x10003040
push dword [ebp - 4]
call edi
mov eax, dword [ebp - 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100039e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 4], esi
cmp ebx, 1
jge case.default.0x10003a03
mov eax, dword [ebp + 0xc]
cmp eax, 3
ja case.default.0x10003a03
jmp dword [eax*4 + 0x10003ae8]
push 0
push 0
push 0xf1
push dword [esi + ebx*4 + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
push 2
push 0xf1
push dword [esi + ebx*4 + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0
push 1
push 0xf1
push dword [esi + ebx*4 + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
push 0
push 2
push 0xf1
push dword [esi + ebx*4 + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [esi + ebx*4 + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
xor ecx, ecx
mov edx, 2
lea eax, [esi + 0xa]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100348e1
add esp, 4
lea ecx, [esi + 1]
mov edi, eax
mov eax, dword [ebp - 4]
push ecx
push edi
push dword [eax + ebx*4 + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextW]
movups xmm0, xmmword [str.__failed_]
mov ecx, eax
cmp ecx, esi
push edi
cmovg ecx, esi
movups xmmword [edi + ecx*2], xmm0
mov eax, dword [0x100380e8]
mov dword [edi + ecx*2 + 0x10], eax
mov eax, dword [ebp - 4]
push dword [eax + ebx*4 + 0x10]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push edi
call fcn.100348ea
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10003b80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
push dword [edi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10003b98
xor al, al
pop edi
pop ebp
ret
mov eax, dword [edi + 0x34]
push 0
push dword [edi + eax*4 + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 0xc]
push 5
mov dword [edi + 0x34], eax
push dword [edi + eax*4 + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 0x38]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov al, 1
pop edi
pop ebp
ret
Function at 0x100067c0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [edx + 0x3c]
lea esi, [edi + edx]
cmp edi, ebx
ja 0x10006927
lea eax, [edi + 0x18]
cmp eax, ebx
ja 0x10006927
movzx ecx, word [esi + 0x14]
lea eax, [edi + 0x18]
add eax, ecx
cmp eax, ebx
ja 0x10006927
movzx eax, word [esi + 6]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [ebp + 0xc], eax
cmp ebx, eax
jb 0x10006927
sub ecx, edx
mov eax, ebx
sub eax, dword [ebp + 0xc]
add ecx, 0x18
add ecx, esi
cmp ecx, eax
ja 0x10006927
push 0x10038358
mov eax, 0xdfff
and word [esi + 0x16], ax
push ebx
push edx
call fcn.10007050
add esp, 0xc
test eax, eax
je 0x10006927
movzx ecx, word [esi + 4]
mov edx, 0x14c
cmp cx, dx
jne 0x10006867
mov dword [esi + 0x28], eax
lea eax, [edi + 0x90]
cmp eax, ebx
jae 0x10006927
mov eax, dword [esi + 0x88]
jmp 0x1000688c
mov edx, 0x8664
cmp cx, dx
jne 0x10006927
mov dword [esi + 0x28], eax
lea eax, [edi + 0xa0]
cmp eax, ebx
jae 0x10006927
mov eax, dword [esi + 0x98]
mov esi, dword [ebp + 8]
push eax
push esi
call fcn.10006ce0
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x10006927
push 4
call fcn.100348a3
mov ecx, dword [ebp - 4]
mov edi, eax
add esp, 4
mov dword [edi], 0x20018
lea eax, [edi + 4]
mov dword [ebp + 0xc], eax
add ecx, esi
je 0x1000691c
cmp edi, eax
je 0x1000691c
mov eax, ecx
sub eax, esi
cmp eax, ebx
jae 0x1000691c
add eax, 0x10
cmp eax, ebx
ja 0x1000691c
movzx edx, word [ecx + 0xc]
add edx, 2
lea esi, [ecx + edx*8]
mov eax, esi
sub eax, dword [ebp + 8]
cmp eax, ebx
jae 0x1000691c
movzx eax, word [ecx + 0xe]
add eax, edx
lea edx, [ecx + eax*8]
mov eax, edx
sub eax, dword [ebp + 8]
cmp eax, ebx
ja 0x1000691c
cmp esi, edx
je 0x10006912
nop
mov eax, dword [esi]
test eax, eax
js 0x1000690b
cmp ax, word [edi]
je 0x10006930
add esi, 8
cmp esi, edx
jne 0x10006900
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
test ecx, ecx
jne 0x100068c3
push 4
push edi
call fcn.100348d3
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
lea ecx, [edi + 2]
sub eax, ecx
push eax
push ecx
push edi
call fcn.10035787
mov eax, dword [ebp + 0xc]
add esp, 0xc
sub eax, 2
mov dword [ebp + 0xc], eax
cmp edi, eax
je 0x10006967
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x1000691c
mov esi, dword [ebp + 8]
and ecx, 0x7fffffff
add ecx, dword [ebp - 4]
add ecx, esi
jmp 0x10006918
push 4
push edi
call fcn.100348d3
add esp, 8
test esi, esi
je 0x10006927
mov eax, 1
pop edi
mov word [esi], ax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006ce0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
mov dword [ebp + 8], eax
test ebx, ebx
je 0x10006d27
mov edi, dword [ebp + 0xc]
lea ecx, [eax + 0x10]
nop word [eax + eax]
mov esi, dword [ecx - 4]
cmp edi, esi
jb 0x10006d1f
mov eax, dword [ecx]
add eax, esi
cmp edi, eax
jb 0x10006d2e
inc edx
add ecx, 0x28
cmp edx, ebx
jb 0x10006d10
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 8]
lea eax, [edx + edx*4]
mov eax, dword [ecx + eax*8 + 0x14]
sub eax, esi
add eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10007050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, 0x14c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x3c]
movzx ecx, word [eax + edi + 4]
cmp cx, dx
jne 0x10007074
push dword [eax + edi + 0x78]
jmp 0x10007089
mov edx, 0x8664
cmp cx, dx
jne 0x100071ad
push dword [eax + edi + 0x88]
push edi
call fcn.10006ce0
add esp, 8
test eax, eax
je 0x100071ad
mov esi, dword [ebp + 0xc]
lea ebx, [eax + edi]
cmp eax, esi
jae 0x100071ad
add eax, 0x28
cmp eax, esi
ja 0x100071ad
push dword [ebx + 0x20]
push edi
call fcn.10006ce0
push dword [ebx + 0x24]
mov dword [ebp - 4], eax
push edi
call fcn.10006ce0
push dword [ebx + 0x1c]
mov edi, eax
push dword [ebp + 8]
call fcn.10006ce0
mov ecx, eax
add esp, 0x18
mov eax, dword [ebp - 4]
test eax, eax
je 0x100071ad
test edi, edi
je 0x100071ad
test ecx, ecx
je 0x100071ad
mov esi, dword [ebp + 8]
add esi, eax
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0xc]
cmp eax, esi
jae 0x100071ad
mov edx, dword [ebx + 0x18]
mov dword [ebp - 4], edx
lea eax, [eax + edx*4]
mov edx, dword [ebp + 8]
cmp eax, esi
ja 0x100071ad
lea eax, [edi + edx]
mov dword [ebp - 0xc], eax
cmp edi, esi
jae 0x100071ad
mov eax, dword [ebx + 0x18]
lea eax, [edi + eax*2]
cmp eax, esi
ja 0x100071ad
mov edi, edx
lea eax, [ecx + edi]
mov dword [ebp - 0x10], eax
cmp ecx, esi
jae 0x100071ad
mov eax, dword [ebx + 0x14]
mov dword [ebp + 8], eax
lea eax, [ecx + eax*4]
cmp eax, esi
ja 0x100071ad
mov ebx, dword [ebp - 4]
xor esi, esi
test ebx, ebx
je 0x100071ad
mov eax, dword [ebp - 8]
mov eax, dword [eax + esi*4]
test eax, eax
je 0x100071a8
push eax
push edi
call fcn.10006ce0
add esp, 8
test eax, eax
je 0x100071a8
mov ecx, dword [ebp + 0x10]
add eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10007193
test dl, dl
je 0x1000718f
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10007193
add eax, 2
add ecx, 2
test dl, dl
jne 0x10007173
xor eax, eax
jmp 0x10007198
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100071a8
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + esi*2]
cmp eax, dword [ebp + 8]
jb 0x100071b6
inc esi
cmp esi, ebx
jb 0x10007156
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov eax, dword [ecx + eax*4]
mov esp, ebp
pop ebp
ret
Function at 0x1000b0f0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor ebx, ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ebx
nop dword [eax]
mov ecx, dword [ebx + sym.ModInstaller.dll_delayResolveImportRVAs]
cmp ecx, 1
jbe 0x1000b1b9
lea esi, [ecx + eax]
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x1000b202
cmp dword [esi + 0x10], 0
je 0x1000b202
add eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000b202
mov edx, dword [esi + 0x10]
mov eax, dword [ebp - 4]
add edx, eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], edx
mov ecx, dword [edx]
test ecx, ecx
je 0x1000b1b9
mov ebx, edx
jns 0x1000b16b
movzx eax, cx
jmp 0x1000b170
add ecx, 2
add eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x1000b1fb
lea eax, [ebp - 8]
push eax
push 0x40
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
mov dword [ebx], esi
push eax
push dword [ebp - 8]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
inc edx
mov ecx, dword [eax + edx*4]
lea ebx, [eax + edx*4]
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], edx
test ecx, ecx
jne 0x1000b164
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x10], ebx
cmp ebx, 0x80
jb 0x1000b110
push 0
push 1
push eax
call fcn.10034c60
push 0
push 0
push 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push dword [ebp - 4]
call fcn.1000a520
add esp, 4
push 0
call dword [0x100371ec]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x10
push str.UABE_Mod_installer
push str.Unable_to_find_the_MSVC_2022_redistributable__nMake_sure_the_32bit_and_64bit_versions_are_installed.
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10012820
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 4]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push 0xf0000000
push 1
push 0
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x20], esi
push eax
movups xmmword [ebx], xmm0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x100129bc
lea eax, [ebp + 0xc]
push eax
push 0
push 0
push 0x8002
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x100129b1
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
sub eax, ecx
sar eax, 5
mov dword [ebp - 8], 0
test eax, eax
je 0x1001298f
xor ebx, ebx
mov dword [ebp - 0xc], ebx
cmp byte [ebx + ecx + 4], 0
jne 0x100128a0
mov edx, dword [ebx + ecx]
jmp 0x100128b4
mov eax, dword [ebx + ecx]
cmp eax, dword [edi + 0x1c]
jb 0x100128af
mov edx, 0x10038a94
jmp 0x100128b4
mov edx, dword [edi + 0x30]
add edx, eax
cmp byte [ebx + ecx + 0xc], 0
jne 0x100128c1
mov esi, dword [ebx + ecx + 8]
jmp 0x100128d6
mov eax, dword [ebx + ecx + 8]
cmp eax, dword [edi + 0x1c]
jb 0x100128d1
mov esi, 0x10038a94
jmp 0x100128d6
mov esi, dword [edi + 0x30]
add esi, eax
mov eax, dword [ebx + ecx + 0x14]
mov dword [ebp - 0x10], eax
movzx eax, byte [ebx + ecx + 0x11]
mov dword [ebp - 0x14], eax
movzx eax, word [ebx + ecx + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + ecx + 0x1c]
and eax, 0x4000
mov dword [ebp - 0x1c], eax
mov eax, edx
lea ebx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10012900
push 0
sub eax, ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptHashData]
push eax
push edx
push dword [ebp + 0xc]
call ebx
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10012920
push 0
sub ecx, edx
push ecx
push esi
push dword [ebp + 0xc]
call ebx
push 0
push 4
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call ebx
push 0
push 4
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
call ebx
push 0
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call ebx
push 0
push 4
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
call ebx
mov esi, dword [ebp - 0x20]
mov edx, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
inc edx
add ebx, 0x20
mov dword [ebp - 8], edx
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
sub eax, ecx
sar eax, 5
mov dword [ebp - 0xc], ebx
cmp edx, eax
jb 0x10012894
mov ebx, dword [ebp + 8]
push 0
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x10
push eax
push ebx
push 2
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10019410
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret 4
Function at 0x100219b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, dword [edx + 0x10]
jb 0x100219c3
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test edi, edi
je 0x100219e1
nop
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edi
jb 0x100219d0
pop edi
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x100296b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
test esi, esi
je 0x100296db
mov edx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, esi
jb 0x100296c4
pop edi
mov eax, edx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret
Function at 0x10029ad0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov esi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x10029aec
mov esi, dword [edx]
xor ecx, ecx
mov edi, 0x811c9dc5
test ebx, ebx
je 0x10029b08
movzx eax, byte [ecx + esi]
inc ecx
xor eax, edi
imul edi, eax, 0x1000193
cmp ecx, ebx
jb 0x10029af7
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0xc]
push edi
push edx
push eax
mov ecx, ebx
call fcn.10022320
mov esi, dword [eax + 4]
test esi, esi
je 0x10029b7a
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
and ecx, edi
lea ecx, [eax + ecx*8]
mov eax, dword [ecx]
cmp dword [ecx + 4], esi
jne 0x10029b47
cmp eax, esi
jne 0x10029b3f
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov dword [ecx + 4], eax
jmp 0x10029b4f
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
jmp 0x10029b4f
cmp eax, esi
jne 0x10029b4f
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
lea edx, [ebx + 4]
dec dword [edx + 4]
mov eax, dword [esi + 4]
push esi
push edx
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
call fcn.10022490
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1002bc80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
xor eax, eax
push ebx
push esi
mov dword [ebp - 8], eax
lea edx, [ecx + 0x325c8]
mov dword [ebp - 0xc], edx
push edi
nop word [eax + eax]
xor ebx, ebx
mov dword [ebp - 4], 4
mov edi, eax
lea eax, [ebx + 1]
nop
movzx edx, word [ecx + eax*2 + 0x32c4c]
mov esi, edi
and esi, 1
shr edx, 4
mov ecx, esi
shr edi, 1
neg ecx
add eax, eax
sar ecx, 4
or eax, esi
and ecx, 0x7f
xor edx, ecx
mov ecx, dword [ebp + 8]
add ebx, dword [ecx + edx*4 + 0x30f34]
sub dword [ebp - 4], 1
jne 0x1002bcb0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov dword [edx], ebx
add edx, 4
mov dword [ebp - 0xc], edx
cmp eax, 0x10
jb 0x1002bca0
pop edi
pop esi
mov dword [ecx + 0x84], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002bd10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1003f0bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 4
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20c], eax
nop dword [eax]
nop dword [eax + eax]
movzx ecx, byte [edi + eax + 0x30734]
mov ebx, ecx
mov dword [ebp - 0x218], ecx
mov edx, ecx
shr ebx, 1
and edx, 1
dec ebx
or edx, 2
mov ecx, ebx
shl edx, cl
xor ecx, ecx
sub eax, edx
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x208], ecx
lea esi, [ecx + 1]
test ebx, ebx
je 0x1002bdd0
mov edx, eax
shr eax, 1
mov dword [ebp - 0x210], eax
and edx, 1
mov eax, esi
add esi, esi
sub eax, dword [ebp - 0x218]
or esi, edx
add eax, dword [ebp - 0x214]
movzx ecx, word [edi + eax*2 + 0x32b66]
mov eax, edx
neg eax
shr ecx, 4
sar eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp - 0x208]
add eax, dword [edi + ecx*4 + 0x30f34]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x210]
sub ebx, 1
jne 0x1002bd76
mov ecx, dword [ebp - 0x208]
mov eax, dword [ebp - 0x20c]
mov dword [ebp + eax*4 - 0x204], ecx
inc eax
mov dword [ebp - 0x20c], eax
cmp eax, 0x80
jb 0x1002bd40
lea ecx, [ebp - 0x204]
mov dword [ebp - 0x218], 4
sub ecx, edi
lea esi, [edi + 0x319c8]
lea eax, [edi + 0x32968]
mov dword [ebp - 0x21c], esi
lea edx, [edi + 0x31dd0]
mov dword [ebp - 0x208], eax
sub ecx, 0x31dc8
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x214], ecx
mov eax, dword [edi + 0x88]
xor ebx, ebx
mov dword [ebp - 0x210], ebx
test eax, eax
je 0x1002bea2
mov eax, ebx
xor esi, esi
mov ebx, dword [ebp - 0x208]
or eax, 0x40
mov edx, eax
and eax, 1
shr edx, 1
neg eax
sar eax, 4
and eax, 0x7f
movzx ecx, word [ebx + edx*2]
shr ecx, 4
xor ecx, eax
mov eax, edx
add esi, dword [edi + ecx*4 + 0x30f34]
cmp eax, 1
jne 0x1002be50
mov ebx, dword [ebp - 0x210]
mov eax, dword [ebp - 0x21c]
mov dword [eax + ebx*4], esi
inc ebx
mov eax, dword [edi + 0x88]
mov dword [ebp - 0x210], ebx
cmp ebx, eax
jb 0x1002be43
mov esi, dword [ebp - 0x21c]
mov edx, dword [ebp - 0x20c]
mov ecx, 0xe
cmp eax, ecx
jbe 0x1002bec6
nop dword [eax + eax]
mov eax, ecx
shr eax, 1
shl eax, 4
sub eax, 0x50
add dword [esi + ecx*4], eax
inc ecx
cmp ecx, dword [edi + 0x88]
jb 0x1002beb0
mov eax, dword [esi]
mov ecx, 4
mov ebx, dword [ebp - 0x214]
mov dword [edx - 8], eax
mov eax, dword [esi + 4]
mov dword [edx - 4], eax
mov eax, dword [esi + 8]
mov dword [edx], eax
mov eax, dword [esi + 0xc]
mov dword [edx + 4], eax
add edx, 8
nop word [eax + eax]
movzx eax, byte [edi + ecx + 0x30734]
lea edx, [edx + 4]
inc ecx
mov eax, dword [esi + eax*4]
add eax, dword [ebx + edx - 4]
mov dword [edx - 4], eax
cmp ecx, 0x80
jb 0x1002bef0
mov edx, dword [ebp - 0x20c]
add esi, 0x100
sub dword [ebp - 0x208], 0xffffff80
add edx, 0x200
sub ebx, 0x200
mov dword [ebp - 0x21c], esi
sub dword [ebp - 0x218], 1
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x214], ebx
jne 0x1002be31
mov ecx, dword [ebp - 4]
mov dword [edi + 0x80], 0
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100348ef
mov esp, ebp
pop ebp
ret