joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f480
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, 0x100
mov dword [ebp - 4], ecx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
or edx, esi
add edi, edi
mov ecx, esi
and ecx, edi
mov eax, edx
add ecx, esi
shr eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
movzx ecx, word [ecx + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
shr eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp + 0xc]
add ebx, dword [eax + ecx*4]
mov ecx, edx
xor ecx, edi
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x1000f496
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10010a80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movaps xmm0, xmmword [0x101296a0]
push ebx
push esi
mov esi, ecx
mov ebx, 0x400
push edi
mov edi, 0xc
mov dword [esi + 0x2c], 0
lea edx, [esi + 0x1e54]
mov dword [esi + 0x44], 1
mov dword [esi + 0x40], 1
mov dword [esi + 0x3c], 1
mov dword [esi + 0x38], 1
mov eax, dword [esi + 0x78]
mov dword [esi + 0x70], eax
lea eax, [esi + 0x201c]
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
movups xmmword [esi + 0x1e1c], xmm0
movups xmmword [esi + 0x1e2c], xmm0
mov ecx, 0x10
nop word [eax + eax]
mov word [eax - 0x180], bx
mov word [eax], bx
add eax, 2
sub ecx, 1
jne 0x10010b30
mov word [edx - 0x18], bx
mov word [edx], bx
mov word [edx + 0x18], bx
mov word [edx + 0x30], bx
add edx, 2
sub edi, 1
jne 0x10010b21
mov eax, 0x4000400
lea edi, [esi + 0x219c]
mov ecx, 0x80
rep stosd dword es:[edi], eax
lea edi, [esi + 0x239c]
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x94]
mov eax, 0x300
add ecx, dword [esi + 0x98]
shl eax, cl
test eax, eax
je 0x10010ba2
mov edi, dword [esi + 0x50]
mov ecx, eax
shr ecx, 1
mov eax, 0x4000400
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, 0x4000400
lea edi, [esi + 0x249c]
mov ecx, 0x80
rep stosd dword es:[edi], eax
lea edi, [esi + 0x269c]
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov ecx, 0x80
lea edi, [esi + 0x289c]
rep stosd dword es:[edi], eax
lea edi, [esi + 0x2a9c]
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov dword [esi + 0x1c], 0
lea eax, [esi + 0xbca4]
mov dword [esi + 0x18], 0
mov ecx, 0x800
mov dword [eax], 0x40000000
lea eax, [eax + 0x20]
sub ecx, 1
jne 0x10010bf4
mov dword [esi + 0x34], ecx
mov eax, 1
mov ecx, dword [esi + 0x9c]
mov edx, 0x100
shl eax, cl
mov ecx, dword [esi + 0x94]
dec eax
mov dword [esi + 0x4c], eax
mov eax, edx
shr eax, cl
mov ecx, dword [esi + 0x98]
shl edx, cl
sub edx, eax
pop edi
mov dword [esi + 0x48], edx
pop esi
pop ebx
ret
Function at 0x100117e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov dword [ebp - 8], edx
xor ebx, ebx
push esi
mov edx, ecx
push edi
mov dword [ebp - 4], edx
mov edi, ebx
mov esi, ebx
shr esi, 2
shr edi, 1
mov eax, edi
and eax, 1
movzx ecx, word [edx + esi*2 + 4]
neg eax
shr eax, 4
neg esi
and eax, 0x7f
shr ecx, 4
xor ecx, eax
and esi, 0x7f0
movzx eax, word [edx + 2]
xor esi, eax
mov eax, dword [ebp + 0xc]
shr esi, 4
mov edx, dword [eax + ecx*4]
add edx, dword [eax + esi*4]
mov eax, dword [ebp - 4]
mov esi, dword [ebp + 0xc]
add edx, dword [ebp - 8]
movzx ecx, word [eax + edi*2 + 8]
mov edi, dword [ebp + 8]
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
mov eax, dword [esi + eax*4]
add eax, edx
mov dword [edi + ebx*4], eax
mov eax, dword [esi + ecx*4]
add eax, edx
mov edx, dword [ebp - 4]
mov dword [edi + ebx*4 + 4], eax
add ebx, 2
cmp ebx, 8
jb 0x100117f3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10017360
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, dword [edi + 0x18]
and esi, 0xf
mov dword [edi + esi*4 + 0x20], SysStringLen
inc esi
cmp esi, 0xe
je 0x1001739e
nop dword [eax + eax]
and esi, 0xf
jne 0x10017390
push edi
lea edx, [edi + 0x20]
mov ecx, edi
call fcn.10017560
mov dword [edi + esi*4 + 0x20], 0
inc esi
cmp esi, 0xe
jne 0x10017380
mov ecx, dword [edi + 0x18]
lea edx, [edi + 0x20]
mov eax, dword [edi + 0x1c]
shld eax, ecx, 5
push ebx
shl ecx, 5
mov dword [edi + 0x5c], ecx
mov ecx, edi
mov dword [edi + 0x58], eax
call fcn.10017560
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
mov dword [edi + 0x10], 0xc3d2e1f0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
pop edi
pop esi
pop ebx
ret

Function at 0x100174a0
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
xor edx, edx
mov esi, dword [edi + 0x18]
and esi, 0x3f
mov ecx, esi
shr esi, 2
and ecx, 3
je 0x100174bd
mov edx, dword [edi + esi*4 + 0x20]
shl ecx, 3
mov eax, SysReAllocString
shr eax, cl
or eax, edx
mov dword [edi + esi*4 + 0x20], eax
inc esi
cmp esi, 0xe
je 0x100174f1
and esi, 0xf
jne 0x100174e3
push edi
lea edx, [edi + 0x20]
mov ecx, edi
call fcn.10017560
mov dword [edi + esi*4 + 0x20], 0
inc esi
cmp esi, 0xe
jne 0x100174d3
mov ecx, dword [edi + 0x18]
lea edx, [edi + 0x20]
mov eax, dword [edi + 0x1c]
shld eax, ecx, 3
push edi
shl ecx, 3
mov dword [edi + 0x5c], ecx
mov ecx, edi
mov dword [edi + 0x58], eax
call fcn.10017560
xor ecx, ecx
mov eax, dword [edi + ecx*4]
lea ebx, [ebx + 4]
bswap eax
inc ecx
mov dword [ebx - 4], eax
cmp ecx, 5
jb 0x10017511
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
mov dword [edi + 0x10], 0xc3d2e1f0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
pop edi
pop esi
pop ebx
ret
Function at 0x10017e80
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
ret
Function at 0x100189b0
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, dword [edi + 0x20]
and esi, 0x3f
mov byte [esi + edi + 0x28], 0x80
inc esi
cmp esi, 0x38
je 0x100189df
and esi, 0x3f
jne 0x100189d4
mov ecx, edi
call fcn.10018b80
mov byte [edi + esi + 0x28], 0
inc esi
cmp esi, 0x38
jne 0x100189c8
mov ecx, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
shld eax, ecx, 3
shl ecx, 3
bswap ecx
bswap eax
mov dword [edi + 0x64], ecx
mov ecx, edi
mov dword [edi + 0x60], eax
call fcn.10018b80
xor edx, edx
nop
mov ecx, dword [edi + edx*4 + 4]
lea ebx, [ebx + 8]
mov eax, dword [edi + edx*4]
add edx, 2
bswap eax
mov dword [ebx - 8], eax
bswap ecx
mov dword [ebx - 4], ecx
cmp edx, 8
jb 0x10018a00
mov dword [edi], 0x6a09e667
mov dword [edi + 4], 0xbb67ae85
mov dword [edi + 8], 0x3c6ef372
mov dword [edi + 0xc], 0xa54ff53a
mov dword [edi + 0x10], 0x510e527f
mov dword [edi + 0x14], 0x9b05688c
mov dword [edi + 0x18], 0x1f83d9ab
mov dword [edi + 0x1c], 0x5be0cd19
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
pop edi
pop esi
pop ebx
ret

Function at 0x10018a70
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
ret

Function at 0x10019bfd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
push dword [ebp + 8]
mov esi, ecx
push edx
push edi
push edi
call fcn.100ee7c1
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x10019c27
call fcn.10019b42
mov edi, eax
mov eax, edi
pop edi
pop esi
leave
ret 4

Function at 0x10019c7b
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx], edx
sub edx, 1
je 0x10019c9d
sub edx, 3
je 0x10019c94
sub edx, 6
jne 0x10019ca1
add ecx, 0x10
jmp fcn.10018a70
or dword [ecx + 8], 0xffffffff
or dword [ecx + 0xc], 0xffffffff
ret
or dword [ecx + 4], 0xffffffff
ret
Function at 0x10023964
Capabilities:
Create directory

Disassembly:
push 0x38
mov eax, 0x1011cf25
call fcn.100e060a
mov esi, ecx
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10023984
mov al, 1
jmp 0x100239c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10023995
xor al, al
jmp 0x100239c9
lea ecx, [ebp - 0x44]
call fcn.10024165
lea ecx, [ebp - 0x1c]
call fcn.1001f773
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.100242f1
test al, al
je 0x100239be
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
push dword [ebp - 0x1c]
call fcn.100e05ce
pop ecx
mov al, bl
call fcn.100e05d3
ret

Function at 0x10023ba1
Capabilities:
Delete file
Set file attributes

Disassembly:
push esi
mov esi, ecx
call fcn.1002486a
cmp eax, 0xffffffff
je 0x10023bc5
test al, 0x10
jne 0x10023bc5
test al, 1
je 0x10023bc5
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10023bd4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10023bd4
mov al, 1
pop esi
ret
xor al, al
pop esi
ret

Function at 0x10023e00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x101620c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov eax, dword [edi]
and dword [edi + 4], 0
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x210]
push eax
call fcn.1001fa5b
lea eax, [esi - 1]
mov ecx, 0x103
cmp ecx, eax
mov ecx, dword [ebp - 4]
pop edi
sbb al, al
xor ecx, ebp
inc al
pop esi
call fcn.100e0010
leave
ret
Function at 0x10023ec8
Capabilities:
Set file attributes

Disassembly:
push 0x8c
mov eax, 0x1011cfb9
call fcn.100e060a
mov esi, ecx
lea ecx, [ebp - 0x98]
call fcn.10024165
lea ecx, [ebp - 0x70]
call fcn.1001f773
push dword [esi]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x98]
call fcn.100242f1
test al, al
je 0x10023f18
mov ebx, dword [ebp - 0x78]
mov eax, ebx
shr eax, 4
test al, 1
jne 0x10023f29
push 0x10b
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 0x70]
call fcn.100e05ce
pop ecx
xor al, al
call fcn.100e05d3
ret
push dword [ebp - 0x70]
or dword [ebp - 4], 0xffffffff
shr ebx, 0xa
call fcn.100e05ce
pop ecx
test bl, 1
jne 0x10024005
push esi
lea ecx, [ebp - 0x18]
call fcn.1001f698
push 0x5c
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.1001fe29
mov edi, dword [ebp - 0x14]
or dword [ebp - 0x28], 0xffffffff
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.1001f773
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x28]
call fcn.10024a87
lea ecx, [ebp - 0x60]
call fcn.10024165
lea ecx, [ebp - 0x38]
call fcn.1001f773
mov byte [ebp - 4], 4
jmp 0x10023fd2
cmp edi, dword [ebp - 0x14]
jae 0x10023fa6
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 0x14], edi
mov word [eax + edi*2], cx
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x18]
call fcn.1001fd55
mov eax, dword [ebp - 0x40]
shr eax, 4
test al, 1
je 0x10023fc6
lea ecx, [ebp - 0x18]
call fcn.10023ec8
jmp 0x10023fce
mov ecx, dword [ebp - 0x18]
call fcn.10023ba1
test al, al
je 0x10024023
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x28]
call fcn.100249d2
test al, al
jne 0x10023f95
push dword [ebp - 0x38]
call fcn.100e05ce
push dword [ebp - 0x24]
call fcn.100e05ce
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.100241aa
push dword [ebp - 0x18]
call fcn.100e05ce
pop ecx
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10023f21
mov ecx, dword [esi]
call fcn.10023ebb
jmp 0x10023f23
push dword [ebp - 0x38]
call fcn.100e05ce
push dword [ebp - 0x24]
call fcn.100e05ce
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.100241aa
push dword [ebp - 0x18]
jmp 0x10023f1b

Function at 0x1002486a
Capabilities:
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
ret

Function at 0x10024f1c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x101620c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
xor ecx, ecx
mov eax, dword [edi]
and dword [edi + 4], 0
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
mov ecx, edi
lea eax, [ebp - 0x210]
push eax
call fcn.1001fa5b
lea eax, [esi - 1]
mov ecx, 0x103
cmp ecx, eax
mov ecx, dword [ebp - 4]
pop edi
sbb al, al
xor ecx, ebp
inc al
pop esi
call fcn.100e0010
leave
ret
Function at 0x100346ae
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
cmp esi, 0x200
jb 0x10034712
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x10034712
mov edx, dword [ecx + 0x3c]
cmp edx, 0x1000
jae 0x10034712
lea eax, [edx + 0x200]
cmp eax, esi
ja 0x10034712
test dl, 7
jne 0x10034712
add ecx, edx
cmp dword [ecx], 0x4550
jne 0x10034712
movzx eax, word [ecx + 4]
sub eax, 0x14c
je 0x1003472e
sub eax, 0x74
je 0x10034727
dec eax
sub eax, 1
je 0x10034727
dec eax
sub eax, 1
je 0x10034720
sub eax, 0x3c
je 0x10034719
sub eax, 0x8464
je 0x1003472e
xor eax, eax
pop esi
pop ebp
ret 4
mov edx, 0x3030401
jmp 0x10034733
mov edx, 0x3030701
jmp 0x10034733
mov edx, 0x3030501
jmp 0x10034733
mov edx, 0x3030103
mov eax, 0x400
cmp word [ecx + 0x14], ax
ja 0x10034712
movzx eax, word [ecx + 0x18]
mov ecx, 0x10b
cmp ax, cx
je 0x10034756
mov ecx, 0x20b
cmp ax, cx
jne 0x10034712
mov eax, dword [ebp + 8]
mov dword [eax], edx
xor eax, eax
inc eax
jmp 0x10034714

Function at 0x1003c749
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp edx, 8
jb 0x1003c76a
push edi
mov edi, edx
shr edi, 3
mov eax, dword [ecx + 4]
sub edx, 8
xor eax, dword [ecx]
add ecx, 8
xor esi, eax
sub edi, 1
jne 0x1003c757
pop edi
cmp edx, 4
jb 0x1003c774
xor esi, dword [ecx]
add ecx, 4
and edx, 3
cmp edx, 2
jbe 0x1003c785
movzx eax, byte [ecx]
shl eax, 0x10
xor esi, eax
inc ecx
cmp edx, 1
jbe 0x1003c793
movzx eax, byte [ecx]
shl eax, 8
xor esi, eax
inc ecx
test edx, edx
je 0x1003c79c
movzx ecx, byte [ecx]
xor esi, ecx
mov eax, esi
pop esi
ret
Function at 0x10063715
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
xor edi, edi
lea eax, [edx + esi]
cmp edx, eax
cmova esi, ebx
test esi, esi
je 0x10063749
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
movzx eax, word [eax*2 + 0x101677a8]
xor ecx, eax
inc edx
inc edi
cmp edi, esi
jne 0x1006372e
pop edi
pop esi
mov eax, ecx
pop ebx
pop ebp
ret 4

Function at 0x10069ac8
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x3c], 2
mov eax, dword [ebp + 8]
jge 0x10069ae4
cmp byte [ecx + 0x42], 0
je 0x10069b45
cmp eax, 0x3f
jb 0x10069b45
je 0x10069b39
dec eax
jmp 0x10069b45
cmp eax, 0x2c
jb 0x10069b45
cmp dword [ecx + 0x3c], 3
jl 0x10069af9
cmp eax, 0x2c
jne 0x10069af8
push 0x48
jmp 0x10069b44
dec eax
cmp dword [ecx + 0x3c], 4
jl 0x10069b09
cmp eax, 0x2c
jne 0x10069b08
push 0x49
jmp 0x10069b44
dec eax
cmp eax, 0x3a
jb 0x10069b45
cmp byte [ecx + 0x14], 0
je 0x10069b29
cmp eax, 0x3a
jne 0x10069b1d
push 0x44
jmp 0x10069b44
cmp eax, 0x3b
jne 0x10069b26
push 0x45
jmp 0x10069b44
sub eax, 2
cmp eax, 0x3f
jb 0x10069b3d
cmp byte [ecx + 0x42], 0
je 0x10069b3d
cmp eax, 0x3f
jne 0x10069ae1
push 0x46
jmp 0x10069b44
cmp eax, 0x44
jne 0x10069b45
push 0x47
pop eax
pop ebp
ret 4
Function at 0x1008148a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10123ac2
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x101620c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [esi + 0x158]
mov dword [esi], vtable.NArchive::NSquashfs::CHandler.0
mov dword [esi + 4], vtable.NArchive::NSquashfs::CHandler.1.0
call fcn.1001c877
and dword [ebp - 4], 0
mov ecx, dword [esi + 0x85c]
test ecx, ecx
je 0x100814db
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push dword [esi + 0x850]
call fcn.100e05ce
pop ecx
mov ecx, dword [esi + 0x154]
mov dword [ebp - 4], 1
test ecx, ecx
je 0x100814fe
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x14c]
mov dword [ebp - 4], 2
test ecx, ecx
je 0x10081515
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [esi + 0x144]
mov dword [ebp - 4], 3
test ecx, ecx
je 0x1008152c
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push dword [esi + 0x128]
call fcn.100e05ce
push dword [esi + 0x11c]
call fcn.100e05ce
push dword [esi + 0x110]
call fcn.100e05ce
add esp, 0xc
mov ecx, dword [esi + 0xf8]
mov dword [ebp - 4], 4
test ecx, ecx
je 0x10081567
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push dword [esi + 0x7c]
call fcn.100e05ce
pop ecx
lea ecx, [esi + 0x5c]
call fcn.1008146b
lea ecx, [esi + 0x3c]
call fcn.1008146b
push dword [esi + 0x30]
call fcn.100e05ce
push dword [esi + 0x24]
call fcn.100e05ce
push dword [esi + 0x18]
call fcn.100e05ce
push dword [esi + 0xc]
call fcn.100e05ce
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret
Function at 0x1008c53b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, edx
mov esi, ecx
test edi, edi
je 0x1008c56f
movzx eax, byte [ebx]
mov edx, esi
shr edx, 8
xor edx, eax
shl esi, 8
movzx eax, dl
movzx esi, si
movzx ecx, word [eax*2 + 0x101679d0]
xor esi, ecx
inc ebx
sub edi, 1
jne 0x1008c54c
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x100b29f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov eax, dword [esi + 0x18]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0xc], eax
mov al, byte [esi + 2]
mov word [edi], cx
mov byte [ebp + 0xf], al
cmp byte [esi + 1], cl
je 0x100b2a8d
lea eax, [esi + 0x20]
push eax
lea ecx, [edi + 0x24]
call fcn.1001f7ba
lea eax, [esi + 0x2c]
lea ecx, [edi + 0x60]
cmp eax, ecx
je 0x100b2a3a
push dword [eax + 4]
push dword [eax]
call fcn.1002f024
movzx eax, byte [esi + 4]
mov ecx, edi
push eax
push 0x800
call fcn.100b2b47
mov eax, dword [esi + 0x10]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x70], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x74], eax
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x78], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x7c], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x80], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x84], eax
mov al, byte [esi + 3]
mov byte [edi + 0x88], al
mov al, byte [ebp + 0xf]
xor edx, edx
mov dword [edi + 0x40], 0x3f
mov byte [edi + 5], dl
test al, al
jne 0x100b2aa6
mov byte [ebp - 4], 1
cmp byte [ebx + 0x6c], dl
jne 0x100b2aa9
mov byte [ebp - 4], dl
push dword [ebp - 4]
mov ecx, edi
push 1
call fcn.100b2b47
push dword [ebp + 8]
mov ecx, edi
push 8
call fcn.100b2b47
cmp byte [ebp + 0xf], 0
je 0x100b2ae0
xor eax, eax
mov byte [edi + 4], 0x14
mov word [edi + 2], ax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x1c], eax
lea ecx, [edi + 0x30]
call fcn.100aca2e
lea ecx, [edi + 0x50]
mov byte [edi + 0x3e], 0
call fcn.100aca2e
xor ecx, ecx
mov byte [edi + 0x5e], cl
cmp byte [ebp + 0xf], cl
je 0x100b2b19
xor eax, eax
mov byte [edi + 4], 0x14
mov word [edi + 2], ax
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], ecx
mov dword [edi + 0x1c], ecx
jmp 0x100b2b40
cmp byte [ebx + 0x6c], cl
je 0x100b2b40
cmp byte [ebx + 0x58], cl
je 0x100b2b40
cmp dword [ebx + 0x64], ecx
jne 0x100b2b2d
push 8
pop eax
jmp 0x100b2b32
mov eax, dword [ebx + 0x60]
mov al, byte [eax]
mov dl, byte [ebx + 0x59]
mov ecx, edi
movzx eax, al
push eax
call fcn.100b21cc
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100bdf10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, ecx
push esi
push edi
cmp dword [eax + 0x34], 0xa
jae 0x100bdf75
nop word [eax + eax]
mov esi, dword [eax]
cmp esi, 8
jae 0x100bdf4d
mov ecx, dword [eax + 8]
cmp ecx, dword [eax + 0xc]
je 0x100be03d
mov dl, byte [ecx]
lea edi, [esi + 8]
inc ecx
movzx edx, dl
mov dword [eax + 8], ecx
mov ecx, 0x18
sub ecx, esi
shl edx, cl
or edx, dword [eax + 4]
jmp 0x100bdf52
mov edx, dword [eax + 4]
mov edi, esi
mov ecx, edx
shr edx, 0x18
shl ecx, 8
mov dword [eax + 4], ecx
lea ecx, [edi - 8]
mov dword [eax], ecx
mov ecx, dword [eax + 0x34]
mov byte [eax + ecx + 0x70ce], dl
inc dword [eax + 0x34]
cmp dword [eax + 0x34], 0xa
jb 0x100bdf20
mov dword [eax + 0x70d8], 0
movzx ecx, byte [eax + 0x70d4]
shl ecx, 8
mov dword [eax + 0x70d8], ecx
movzx edx, byte [eax + 0x70d5]
or edx, ecx
shl edx, 8
mov dword [eax + 0x70d8], edx
movzx ecx, byte [eax + 0x70d6]
or ecx, edx
shl ecx, 8
mov dword [eax + 0x70d8], ecx
movzx edx, byte [eax + 0x70d7]
or edx, ecx
mov dword [eax + 0x70d8], edx
mov cl, byte [eax + 0x70ce]
cmp cl, 0x31
jne 0x100be042
cmp byte [eax + 0x70cf], 0x41
jne 0x100be042
cmp byte [eax + 0x70d0], 0x59
jne 0x100be042
cmp byte [eax + 0x70d1], 0x26
jne 0x100be042
cmp byte [eax + 0x70d2], 0x53
jne 0x100be042
cmp byte [eax + 0x70d3], 0x59
jne 0x100be042
cmp byte [eax + 0x70e0], 0
jne 0x100be011
add dword [eax + 0x70e8], 1
adc dword [eax + 0x70ec], 0
add dword [eax + 0x70f0], 1
mov byte [eax + 0x70e0], 1
adc dword [eax + 0x70f4], 0
mov ecx, dword [eax + 0x70dc]
rol ecx, 1
xor ecx, edx
mov dword [eax + 0x70dc], ecx
mov dword [eax + 0x30], 2
pop edi
xor eax, eax
pop esi
ret
cmp cl, 0x17
jne 0x100be0d8
cmp byte [eax + 0x70cf], 0x72
jne 0x100be0d8
cmp byte [eax + 0x70d0], 0x45
jne 0x100be0d8
cmp byte [eax + 0x70d1], 0x38
jne 0x100be0d8
cmp byte [eax + 0x70d2], 0x50
jne 0x100be0d8
cmp byte [eax + 0x70d3], 0x90
jne 0x100be0d8
cmp byte [eax + 0x70e0], 0
jne 0x100be093
add dword [eax + 0x70e8], 1
adc dword [eax + 0x70ec], 0
mov esi, dword [eax + 4]
mov byte [eax + 0x70e0], 1
test esi, esi
je 0x100be0a8
mov byte [eax + 0x70e2], 1
mov edx, dword [eax]
mov ecx, edx
and ecx, 7
mov dword [eax + 0x30], 0xb
sub edx, ecx
shl esi, cl
mov ecx, dword [eax + 0x70d8]
mov dword [eax], edx
mov dword [eax + 4], esi
cmp ecx, dword [eax + 0x70dc]
je 0x100be03d
mov byte [eax + 0x70e1], 1
pop edi
mov eax, 1
pop esi
ret
Function at 0x100c101a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov byte [ebp - 1], dl
or dword [ebx], 0xffffffff
cmp dword [ecx], 0x23170f69
jne 0x100c10f3
mov eax, 0x40c1
cmp word [ecx + 4], ax
jne 0x100c10f3
mov edi, dword [ebp + 0xc]
mov edx, 0x2790
mov byte [edi], 1
movzx eax, word [ecx + 6]
cmp ax, dx
jne 0x100c105f
mov byte [edi], 0
jmp 0x100c106d
mov edx, 0x2791
cmp ax, dx
jne 0x100c10f3
mov eax, dword [ecx + 8]
xor esi, esi
mov ecx, dword [ecx + 0xc]
mov dword [ebp + 0xc], eax
mov dword [ebp - 8], ecx
cmp dword [0x10167be0], esi
jbe 0x100c10f3
mov ch, byte [ebp + 8]
mov edx, dword [esi*4 + 0x10167be8]
cmp eax, dword [edx + 8]
jne 0x100c10c9
mov ebx, dword [ebp - 8]
cmp ebx, dword [edx + 0xc]
mov ebx, dword [ebp + 0x10]
jne 0x100c10c9
xor eax, eax
cmp byte [edi], al
je 0x100c10a8
cmp dword [edx + 4], eax
jmp 0x100c10aa
cmp dword [edx], eax
sete al
test eax, eax
jne 0x100c10c6
mov cl, byte [edx + 0x18]
test ch, ch
je 0x100c10bf
test cl, cl
sete al
jmp 0x100c10c2
movzx eax, cl
test eax, eax
je 0x100c10d4
mov eax, dword [ebp + 0xc]
inc esi
cmp esi, dword [0x10167be0]
jb 0x100c1086
jmp 0x100c10f3
movzx ecx, byte [ebp - 1]
movzx eax, byte [ebp - 1]
xor ecx, 1
cmp dword [edx + 0x14], 1
cmove ecx, eax
test ecx, ecx
je 0x100c10f1
mov eax, 0x80004002
jmp 0x100c10f5
mov dword [ebx], esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc