joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002e90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100418b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
lea ebp, [edi + 0x14]
mov esi, ecx
mov ecx, ebp
mov dword [esp + 0x10], ebp
call fcn.1000f800
push esi
mov ecx, edi
mov dword [esp + 0x28], 0
call fcn.10002a60
mov eax, dword [esp + 0x30]
mov dword [esi + 4], edi
mov dword [esi + 0xc], eax
call dword [0x10043240]
mov dword [esi + 8], eax
mov dword [esp + 0x2c], esi
mov esi, dword [esi + 4]
lea edi, [esi + 0x2c]
mov esi, dword [edi + 4]
mov edx, dword [esi + 4]
lea ecx, [esp + 0x2c]
push ecx
push edx
push esi
mov ecx, edi
mov dword [esp + 0x24], esi
call fcn.10008100
push 1
mov ecx, edi
mov ebx, eax
call fcn.100081a0
mov dword [esi + 4], ebx
mov eax, dword [ebx + 4]
mov dword [eax], ebx
mov esi, dword [esi + 4]
cmp esi, dword [edi + 4]
jne 0x10002f25
call fcn.1002dc5d
mov ecx, ebp
mov dword [esp + 0x24], 0xffffffff
call fcn.1000f810
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 8

Function at 0x10007930
Capabilities:
Hash data with md5

Disassembly:
push esi
push edi
mov esi, ecx
push 0x40
lea edi, [esi + 0x5c]
push 0
push edi
call fcn.1002d3b0
add esp, 0xc
mov byte [edi], 0x80
pop edi
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
pop esi
ret

Function at 0x1000b8a6
Capabilities:
Create thread

Disassembly:
sub esp, 0x204
push esi
mov esi, ecx
push 0x104
lea eax, [esp + 8]
mov dword [esi + 0xab04], 0
mov dword [esi + 0xab00], 0
mov ecx, dword [0x100606d8]
push eax
push ecx
call dword [0x1004325c]
lea edx, [esp + 4]
push edx
call dword [0x10043284]
lea eax, [esp + 4]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x1000b8e6
mov ecx, dword [str.DataTool.dll]
mov edx, dword [0x10043d74]
mov dword [eax], ecx
mov ecx, dword [0x10043d78]
mov dword [eax + 4], edx
mov dx, word [0x10043d7c]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
lea eax, [esp + 4]
push eax
call dword [0x100431fc]
test eax, eax
mov dword [esi + 0xaafc], eax
jne 0x1000b967
call dword [0x100431c0]
push eax
lea ecx, [esp + 0x10c]
push 0x10043d5c
push ecx
call fcn.1002dcb7
add esp, 0xc
push 0
push 0x10043d50
lea edx, [esp + 0x110]
push edx
push 0
call dword [0x10043320]
xor eax, eax
pop esi
add esp, 0x204
ret
push edi
mov edi, dword [0x100431e4]
push str._ReSet__YAXH_Z
push eax
call edi
mov dword [esi + 0xab00], eax
mov eax, dword [esi + 0xaafc]
push str._ReadFromClient__YAHPAEH_Z
push eax
call edi
mov ecx, dword [esi + 0xaafc]
push str._WriteToClient__YAHPAEH_Z
push ecx
mov dword [esi + 0xab04], eax
call edi
mov dword [esi + 0xab08], eax
mov eax, dword [esi + 0xab00]
test eax, eax
pop edi
je 0x1000b95d
cmp dword [esi + 0xab04], 0
je 0x1000b95d
push 1
call eax
push esi
push 0
push 0x1000b810
mov byte [esi + 0xaa74], 1
call fcn.1002f072
xor edx, edx
add esp, 0x10
test eax, eax
setne dl
mov dword [esi + 0xaaf8], eax
pop esi
mov eax, edx
add esp, 0x204
ret
Function at 0x10010280
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10041bde
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
xor eax, eax
push esi
mov esi, ecx
mov ecx, 0xa
mov dword [esp + 4], esi
mov dword [esi], vtable.CList_unsigned_long_int__unsigned_long_int_const__.0
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], ecx
mov dword [esp + 0x10], eax
mov dword [esi + 0x1c], vtable.CList_unsigned_long_int__unsigned_long_int_const__.0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
lea ecx, [esi + 0x38]
mov byte [esp + 0x10], 1
call fcn.1000f7e0
lea ecx, [esi + 0x50]
mov byte [esp + 0x10], 2
call fcn.1000f7e0
mov ecx, dword [esp + 8]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x100105a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10041c69
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.10002430
xor ebx, ebx
mov dword [esi], vtable.TUdp::CRecvGWin.0
mov dword [esp + 0x18], ebx
mov dword [esi + 0x18], vtable.CList_class_TUdp::CMessage___class_TUdp::CMessage__const_const__.0
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], 0xa
lea ecx, [esi + 0x34]
mov byte [esp + 0x18], 1
call fcn.1000f7e0
lea edi, [esi + 0x4c]
mov ecx, edi
mov byte [esp + 0x18], 2
call fcn.1000f7e0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov dword [esi + 0x68], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x6c], ecx
mov ecx, edi
mov byte [esp + 0x18], 3
mov dword [esi + 0x64], edx
mov dword [esi + 0x78], eax
call fcn.1000f800
mov ecx, edi
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
call fcn.1000f810
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x10010930
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x10041c27
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.10002430
xor ebx, ebx
mov dword [esi], vtable.TUdp::CSendGWin.0
mov ecx, vtable.CList_class_TUdp::CMessage___class_TUdp::CMessage__const_const__.0
mov eax, 0xa
mov dword [esp + 0x18], ebx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], ecx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], eax
lea ecx, [esi + 0x70]
mov byte [esp + 0x18], 2
call fcn.1000f7e0
lea edi, [esi + 0x90]
push 0x7d0
lea eax, [edi + 0x7d0]
push ebx
push eax
mov byte [esp + 0x24], 3
mov dword [edi + 0xfa0], ebx
call fcn.1002d3b0
push 0x7d0
push ebx
push edi
call fcn.1002d3b0
add esp, 0x18
lea ecx, [esi + 0x1034]
call fcn.1000f7e0
lea ecx, [esi + 0x1078]
mov byte [esp + 0x18], 4
mov dword [esi + 0x1054], 0x10043e94
mov dword [esi + 0x1058], 0xc8
mov dword [esi + 0x1060], 0x14
mov dword [esi + 0x1064], ebx
mov byte [esi + 0x106c], bl
mov dword [esi + 0x1070], edi
call fcn.10010280
push 0x1f40
lea edi, [esi + 0x10e0]
push ebx
push edi
call fcn.1002d3b0
add esp, 0xc
call dword [0x10043240]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [edi + 0x1f40], eax
mov eax, dword [esp + 0x28]
mov dword [esi + 0x1050], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esi + 0x88], edx
mov edx, dword [esp + 0x30]
mov dword [esi + 0x2c], eax
mov eax, 1
mov dword [esi + 0x30], ecx
mov dword [esi + 0x104c], edx
mov dword [esi + 0x34], eax
mov dword [esi + 0x1074], ebx
mov dword [esi + 0x14], 0x5dc
mov dword [esi + 0x18], 0x10000
mov dword [esi + 0x1c], eax
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
pop edi
mov dword [esi + 0x20], 0x80
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x14
Function at 0x10016250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x14
cmp eax, 0x1e
jge 0x10016262
xor al, al
add esp, 0x14
ret
push ebp
mov cl, 0x6c
push esi
push edi
mov dl, 0x72
mov byte [esp + 0x13], cl
mov byte [esp + 0x17], cl
mov cl, 0x6e
lea edi, [eax - 0x14]
test edi, edi
mov byte [esp + 0xc], 0x6b
mov byte [esp + 0xd], 0x64
mov byte [esp + 0xe], dl
mov byte [esp + 0xf], 0x2e
mov byte [esp + 0x10], 0x78
mov byte [esp + 0x11], 0
mov byte [esp + 0x12], 0x47
mov byte [esp + 0x14], 0x6f
mov byte [esp + 0x15], 0x62
mov byte [esp + 0x16], 0x61
mov byte [esp + 0x18], 0
mov byte [esp + 0x19], 0x57
mov byte [esp + 0x1a], 0x69
mov byte [esp + 0x1b], cl
mov byte [esp + 0x1c], cl
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], dl
mov byte [esp + 0x1f], 0
jl 0x10016374
jmp 0x100162e0
mov edx, dword [esp + 0x24]
mov eax, 0x14
lea ecx, [esp + 0xc]
add edx, edi
nop
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x10016308
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x100162f0
test eax, eax
je 0x10016365
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x10016357
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x10016365
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x10016357
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x10016365
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x10016357
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x10016365
movzx esi, byte [edx]
movzx eax, byte [ecx]
sub esi, eax
je 0x10016365
test esi, esi
mov eax, 1
jg 0x10016367
or eax, 0xffffffff
jmp 0x10016367
xor eax, eax
test eax, eax
je 0x1001637d
sub edi, 1
jns 0x100162e0
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x14
ret
mov ecx, dword [esp + 0x24]
movzx edx, byte [edi + ecx + 0x14]
mov eax, dword [esp + 0x2c]
pop edi
sub edx, 1
pop esi
mov dword [eax], edx
mov al, 1
pop ebp
add esp, 0x14
ret
Function at 0x1001c8b5
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x1054]
push edi
mov edi, dword [edx + 0x1048]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x1001ca0a
push ebx
mov ebx, 0xffc03fc0
mov edx, dword [edx + 0x1050]
lea edx, [eax + edx*4]
add edi, eax
cmp eax, edx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x1001c9e5
mov esi, dword [eax + 4]
mov eax, dword [eax]
mov edx, dword [edi + 4]
mov edi, dword [edi]
mov ecx, eax
shr ecx, 2
and ecx, ebx
mov ebp, edi
shr ebp, 2
and ebp, ebx
add ecx, ebp
mov ebp, esi
shr ebp, 2
and ebp, ebx
add ecx, ebp
mov ebp, edx
shr ebp, 2
and ebp, ebx
lea ebx, [ecx + ebp - 0x7fff80]
mov ecx, eax
mov ebp, edi
and ecx, 0xff00ff
and ebp, 0xff00ff
add ecx, ebp
mov ebp, esi
and ebp, 0xff00ff
add ecx, ebp
mov ebp, edx
and ebp, 0xff00ff
shr eax, 2
lea ecx, [ecx + ebp + 0x20002]
shr ecx, 2
xor ebx, ecx
mov ecx, 0x3fc03fc0
and eax, ecx
shr edi, 2
and edi, ecx
add eax, edi
mov edi, dword [esp + 0x18]
shr esi, 2
and esi, ecx
add eax, esi
shr edx, 2
and edx, ecx
lea eax, [eax + edx + 0x800080]
and ebx, 0xff00ff
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 4
mov dword [eax], ebx
mov eax, dword [esp + 0x14]
add eax, 8
add edi, 8
cmp eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov ebx, 0xffc03fc0
jb 0x1001c918
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1048]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1048]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x1001c8f5
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x1001cb2f
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1054]
push edi
mov edi, dword [esi + 0x1048]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x1001cc76
push ebx
mov edx, 0xf81f
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1050]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x1001cc51
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff07e0
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x1002]
mov ebp, eax
and ebp, 0xffff07e0
add ebp, ecx
mov ecx, edi
and ecx, 0xffff07e0
add ebp, ecx
mov ecx, esi
and ecx, 0xffff07e0
shr ebx, 2
lea ecx, [ecx + ebp + 0x40]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff07e0
lea eax, [eax + esi + 0x1002]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x1001cb98
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1048]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1048]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x1001cb6f
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x1001cda3
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1054]
mov edx, dword [esi + 0x18]
push edi
mov edi, dword [esi + 0x1048]
imul ebp, edi
add ebp, edx
cmp edx, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], ebp
jae 0x1001cee9
push ebx
mov eax, 0x83e0
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1050]
lea esi, [edx + esi*2]
mov dword [esp + 0x10], ebx
add edi, edx
cmp edx, esi
mov ebx, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x1001cec4
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx edx, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
and ebp, eax
mov ebx, edx
and ebx, eax
add ebx, ebp
mov ebp, edi
and ebp, eax
add ebx, ebp
mov dword [esp + 0x24], ecx
and ecx, 0x7c1f
mov ebp, esi
and ebp, eax
lea ebx, [ebx + ebp + 0x10040]
mov ebp, edx
and ebp, 0x7c1f
add ebp, ecx
mov ecx, edi
and ecx, 0x7c1f
add ebp, ecx
mov ecx, esi
and ecx, 0x7c1f
lea ecx, [ecx + ebp + 0x802]
shr ecx, 2
shr ebx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and ecx, eax
and edx, eax
add edx, ecx
and edi, eax
add edx, edi
mov edi, dword [esp + 0x1c]
and esi, eax
and ebx, 0xffff7c1f
lea ecx, [edx + esi + 0x10040]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [ecx], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x1001ce0c
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1048]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1048]
lea edx, [edx + edi*2]
cmp edx, ebp
mov dword [esp + 0x20], edx
jb 0x1001cde3
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x1001cef2
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1054]
push edi
mov edi, dword [esi + 0x1048]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x1001d03c
push ebx
mov edx, 0xf0f0
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1050]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x1001d017
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff0f0f
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x2020]
mov ebp, eax
and ebp, 0xffff0f0f
add ebp, ecx
mov ecx, edi
and ecx, 0xffff0f0f
add ebp, ecx
mov ecx, esi
and ecx, 0xffff0f0f
shr ebx, 2
lea ecx, [ecx + ebp + 0x202]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff0f0f
lea eax, [eax + esi + 0x2020]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x1001cf5b
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1048]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1048]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x1001cf32
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x1001d045
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x1054]
push edi
mov edi, dword [edx + 0x1048]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x1001d17b
push ebx
mov edx, dword [edx + 0x1050]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x1001d156
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0x1c
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 8]
mov ecx, eax
and ecx, 0xffff00e3
mov ebx, ebp
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00e3
shr edx, 2
lea ecx, [ecx + ebx + 0x42]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xe3
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0x1c
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x42]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x1001d0a4
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1048]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1048]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x1001d080
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x1001d21f
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
mov ebp, dword [edx + 0x1048]
push edi
mov edi, dword [edx + 0x1054]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x18]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x1001d363
push ebx
push esi
mov esi, 0xff1c
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x1050]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x1001d33d
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xe3
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 0x42]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x208]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x208]
shr eax, 2
and edx, 0xffff00e3
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x1001d288
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x1048]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x1048]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x1001d25f
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x1001d492
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
mov ebp, dword [edx + 0x1048]
push edi
mov edi, dword [edx + 0x1054]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x18]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x1001d5d6
push ebx
push esi
mov esi, 0xff00
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x1050]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x1001d5b0
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xff
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 2]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x200]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x200]
shr eax, 2
and edx, 0xffff00ff
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x1001d4fb
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x1048]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x1048]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x1001d4d2
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret