joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a4bb0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push esi
mov esi, dword [esp + 0x214]
cmp dword [esi + 0x68], 0
jne 0x100a4bd2
mov eax, dword [esi + 0x4088]
add eax, dword [esi + 0x84]
je 0x100a4bd7
mov eax, 1
push esi
mov dword [esi + 0x8560], eax
call fcn.100a3050
add esp, 4
test eax, eax
je 0x100a4bf5
or eax, 0xffffffff
pop esi
add esp, 0x20c
ret
push ebx
push ebp
push edi
push dword [esi + 0x7c]
push dword [esi + 0x85c8]
call fcn.100a32c0
mov eax, dword [esi + 0x85fc]
add esp, 8
test eax, eax
je 0x100a4de2
shl eax, 2
push eax
call fcn.101fc42d
mov ecx, eax
add esp, 4
mov dword [esi + 0x8868], ecx
test ecx, ecx
je 0x100a4def
mov eax, dword [esi + 0x85fc]
shl eax, 2
push eax
push 0
push ecx
call fcn.101f9320
mov eax, dword [esi + 0x861c]
add esp, 0xc
imul eax, dword [esi + 0x8620]
imul eax, dword [esi + 0x6c]
cmp eax, 0x4000000
jb 0x100a4c97
mov eax, dword [esi + 0x85fc]
shl eax, 2
push eax
call fcn.101fc42d
mov ecx, eax
add esp, 4
mov dword [esi + 0x886c], ecx
test ecx, ecx
je 0x100a4def
mov eax, dword [esi + 0x85fc]
shl eax, 2
push eax
push 0
push ecx
call fcn.101f9320
add esp, 0xc
xor ecx, ecx
mov dword [esp + 0x10], ecx
cmp dword [esi + 0x85fc], ecx
jbe 0x100a4de2
nop dword [eax]
mov eax, dword [esi + 0x861c]
lea ebp, [ecx*4]
imul eax, dword [esi + 0x8620]
imul eax, dword [esi + 0x6c]
cmp eax, 0x4000000
jb 0x100a4d9e
push 0x208
call fcn.101fc42d
mov ecx, dword [esi + 0x886c]
add esp, 4
mov dword [ecx + ebp], eax
mov eax, dword [esi + 0x886c]
mov ebx, dword [eax + ebp]
test ebx, ebx
je 0x100a4def
lea eax, [esp + 0x14]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x100a4def
cmp eax, 0x104
jae 0x100a4def
mov eax, dword [esi + 0x886c]
push dword [eax + ebp]
lea eax, [esp + 0x18]
push 0
push 0x103fe8e0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x100a4def
xor edi, edi
mov ecx, ebx
xor edx, edx
nop word [eax + eax]
mov eax, dword [esi + 0x886c]
mov eax, dword [eax + ebp]
cmp word [eax + edi*2], 0
je 0x100a4d81
mov al, byte [edx + ebx]
test al, al
je 0x100a4d6a
mov byte [ecx], al
inc ecx
mov al, byte [edx + ebx + 1]
test al, al
je 0x100a4d75
mov byte [ecx], al
inc ecx
inc edi
add edx, 2
cmp edi, 0x104
jb 0x100a4d50
mov byte [edi + ebx], 0
mov eax, dword [esi + 0x8868]
push 0x103fe874
add eax, ebp
push ebx
push eax
call fcn.100a2bb0
add esp, 0xc
jmp 0x100a4daf
mov eax, dword [esi + 0x8868]
add eax, ebp
push eax
call fcn.100a2c10
add esp, 4
test eax, eax
jne 0x100a4def
mov eax, dword [esi + 0x8868]
push dword [eax + ebp]
mov eax, dword [esi + 0x85f8]
push dword [eax + ebp]
call fcn.100a32c0
mov ecx, dword [esp + 0x18]
add esp, 8
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, dword [esi + 0x85fc]
jb 0x100a4cb0
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
add esp, 0x20c
ret
pop edi
pop ebp
pop ebx
or eax, 0xffffffff
pop esi
add esp, 0x20c
ret
Function at 0x100dd1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
mov ecx, dword [esp + 0x18]
mov eax, 1
shl eax, cl
mov ecx, eax
sar ecx, 1
or ecx, eax
push ebx
mov ebx, dword [esp + 0x18]
mov dword [esp + 0xc], ecx
xor ecx, ecx
mov dword [esp + 0x1c], ecx
cmp dword [ebx + 0x14], ecx
jbe 0x100dd354
push ebp
push esi
push edi
nop
xor ebp, ebp
mov dword [esp + 0x10], ebp
cmp dword [ebx + 0x10], ebp
jbe 0x100dd341
nop
lea eax, [ecx + 4]
mov esi, ecx
cmp ecx, eax
jae 0x100dd333
nop dword [eax]
mov ecx, dword [ebx + 0x14]
cmp esi, ecx
jae 0x100dd32f
dec eax
cmp esi, eax
je 0x100dd24b
lea eax, [ecx - 1]
cmp esi, eax
je 0x100dd24b
xor edx, edx
jmp 0x100dd250
mov edx, 1
mov ecx, dword [ebx + 0x10]
mov eax, dword [ebx + 8]
mov edi, dword [ebx]
imul ecx, esi
inc esi
mov dword [esp + 0x14], edi
add ecx, ebp
inc ebp
lea eax, [eax + ecx*4]
mov ecx, dword [ebx + 0x20]
imul ecx, esi
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0xc]
add ebp, ecx
movsx ebx, word [eax + ebp*2]
lea ebp, [eax + ebp*2]
test edx, edx
je 0x100dd286
and ebx, 0xfffffbb9
movzx ecx, bl
test bl, bl
je 0x100dd316
test ebx, 0x5000
jne 0x100dd316
mov eax, dword [esp + 0x2c]
shl eax, 8
or eax, ecx
push edi
movzx eax, byte [eax + 0x103fed00]
add eax, 6
lea eax, [edi + eax*4]
mov dword [edi + 0x64], eax
call fcn.100e00e0
add esp, 4
test eax, eax
je 0x100dd30d
push ebx
call fcn.100de130
movzx eax, al
add eax, 6
push ebx
lea eax, [edi + eax*4]
mov dword [edi + 0x64], eax
call fcn.100de1b0
push dword [esp + 0x1c]
movzx edi, al
call fcn.100e00e0
mov ecx, dword [esp + 0x28]
xor edi, eax
mov eax, dword [esp + 0x24]
neg eax
test edi, edi
cmove eax, dword [esp + 0x24]
mov dword [ecx], eax
mov eax, dword [esp + 0x30]
push dword [eax + 0x20]
push edi
push ebp
call fcn.100de270
add esp, 0x18
mov eax, 0x4000
or word [ebp], ax
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
lea eax, [ecx + 4]
cmp esi, eax
jb 0x100dd230
jmp 0x100dd333
mov ecx, dword [esp + 0x28]
inc ebp
mov dword [esp + 0x10], ebp
cmp ebp, dword [ebx + 0x10]
jb 0x100dd220
add ecx, 4
mov dword [esp + 0x28], ecx
cmp ecx, dword [ebx + 0x14]
jb 0x100dd210
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x100ea370
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x100ea390
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x100ea390
mov eax, dword [eax + 0x44]
test eax, eax
je 0x100ea390
push dword [esp + 8]
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100f8180
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x40
push esi
mov esi, dword [esp + 0x48]
mov eax, dword [esi + 0x74]
test al, 1
je 0x100f833c
test al, 6
je 0x100f81b4
push dword [esp + 0x50]
push esi
call fcn.100f6c10
push str.out_of_place
push esi
call fcn.100ea550
add esp, 0x10
pop esi
add esp, 0x40
ret
mov eax, dword [esp + 0x50]
cmp eax, 0x20
je 0x100f81d7
push eax
push esi
call fcn.100f6c10
push str.invalid
push esi
call fcn.100ea550
add esp, 0x10
pop esi
add esp, 0x40
ret
push 0x20
lea eax, [esp + 0x28]
push eax
push esi
call fcn.100f6be0
push 0
push esi
call fcn.100f6c10
add esp, 0x14
test eax, eax
jne 0x100f8337
lea eax, [esp + 0x24]
push eax
push 0
call fcn.100fa640
mov dword [esp + 0x24], eax
lea eax, [esp + 0x30]
push eax
push 0
call fcn.100fa640
mov dword [esp + 0x30], eax
lea eax, [esp + 0x3c]
push eax
push 0
call fcn.100fa640
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x48]
push eax
push 0
call fcn.100fa640
mov dword [esp + 0x28], eax
lea eax, [esp + 0x54]
push eax
push 0
call fcn.100fa640
mov dword [esp + 0x34], eax
lea eax, [esp + 0x60]
push eax
push 0
call fcn.100fa640
mov dword [esp + 0x40], eax
lea eax, [esp + 0x6c]
push eax
push 0
call fcn.100fa640
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x78]
push eax
push 0
call fcn.100fa640
add esp, 0x40
mov dword [esp + 0x18], eax
cmp dword [esp + 0x1c], 0xffffffff
je 0x100f8329
cmp dword [esp + 0x20], 0xffffffff
je 0x100f8329
cmp dword [esp + 4], 0xffffffff
je 0x100f8329
cmp dword [esp + 8], 0xffffffff
je 0x100f8329
cmp dword [esp + 0xc], 0xffffffff
je 0x100f8329
cmp dword [esp + 0x10], 0xffffffff
je 0x100f8329
cmp dword [esp + 0x14], 0xffffffff
je 0x100f8329
cmp eax, 0xffffffff
je 0x100f8329
movzx eax, word [esi + 0x326]
test ax, ax
js 0x100f8337
test al, 0x10
je 0x100f82f9
push dword [esp + 0x4c]
or eax, 0x8000
push esi
mov word [esi + 0x326], ax
call fcn.100f05a0
push str.duplicate
push esi
call fcn.100ea550
add esp, 0x10
pop esi
add esp, 0x40
ret
or eax, 0x10
mov word [esi + 0x326], ax
lea eax, [esp + 4]
push 1
push eax
lea eax, [esi + 0x2dc]
push eax
push esi
call fcn.100f0600
push dword [esp + 0x5c]
push esi
call fcn.100f05a0
add esp, 0x18
pop esi
add esp, 0x40
ret
push str.invalid_values
push esi
call fcn.100ea550
add esp, 8
pop esi
add esp, 0x40
ret
push str.missing_IHDR
push esi
call fcn.100ea400
int3

Function at 0x100fbfc0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx + 8]
test eax, eax
je 0x100fbfeb
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x100fbfd3
mov eax, dword [ecx]
jmp dword [eax + 8]
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.102015fc
add esp, 0x10
ret 0xc
push 0x103ec24c
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 4
push eax
call fcn.101f94fb
int3
Function at 0x100fc450
Capabilities:
Get file size
Read file via mapping

Disassembly:
sub esp, 0x14
push esi
push 0
push 0
push 0
push 2
push 0
push dword [esp + 0x30]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [esi + 0x14], eax
test eax, eax
je 0x100fc4a8
push ebx
lea ebx, [esi + 0x20]
push ebx
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x100fc4ef
push dword [ebx]
push 0
push 0
push 4
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x18], eax
test eax, eax
je 0x100fc536
pop ebx
pop esi
add esp, 0x14
ret 4
lea eax, [esp + 0x10]
mov dword [esp + 0xc], vtable.std::exception.0
push eax
lea eax, [esp + 8]
mov dword [esp + 8], str.failed_to_create_file_mapping
xorps xmm0, xmm0
mov byte [esp + 0xc], 1
push eax
movq qword [esp + 0x18], xmm0
call fcn.101f7351
add esp, 8
mov dword [esp + 0xc], vtable.std::runtime_error.0
lea eax, [esp + 0xc]
push 0x103fa258
push eax
call fcn.101f94fb
lea eax, [esp + 0x14]
mov dword [esp + 0x10], vtable.std::exception.0
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], str.failed_to_get_the_file_size
xorps xmm0, xmm0
mov byte [esp + 0x10], 1
push eax
movq qword [esp + 0x1c], xmm0
call fcn.101f7351
add esp, 8
mov dword [esp + 0x10], vtable.std::runtime_error.0
lea eax, [esp + 0x10]
push 0x103fa258
push eax
call fcn.101f94fb
lea eax, [esp + 0x14]
mov dword [esp + 0x10], vtable.std::exception.0
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], str.failed_to_map_the_file
xorps xmm0, xmm0
mov byte [esp + 0x10], 1
push eax
movq qword [esp + 0x1c], xmm0
call fcn.101f7351
add esp, 8
mov dword [esp + 0x10], vtable.std::runtime_error.0
lea eax, [esp + 0x10]
push 0x103fa258
push eax
call fcn.101f94fb
int3
Function at 0x100fd280
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10265068
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x100fd3cc
cmp byte [ebx + 0x3d], 0
je 0x100fd3cc
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x100fd2d4
xor al, al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, 0xf
mov byte [ebp - 0x28], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
cmp ecx, 0x10
movq qword [ebp - 0x28], xmm0
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], 8
cmovae eax, dword [ebp - 0x28]
mov byte [eax + 8], 0
push esi
mov dword [ebp - 4], 0
push edi
mov ecx, dword [ebp - 0x14]
nop dword [eax]
cmp ecx, 0x10
lea eax, [ebp - 0x10]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x100fd34e
sub eax, 1
je 0x100fd352
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x100fd3a5
xor bl, bl
jmp 0x100fd3a7
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x10]
cmovae eax, edx
sub esi, eax
je 0x100fd387
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.102013d8
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x100fd34a
cmp byte [ebx + 0x3d], 0
je 0x100fd3a5
test esi, esi
jne 0x100fd310
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.10025930
jmp 0x100fd306
mov bl, 1
pop edi
pop esi
cmp ecx, 0x10
jb 0x100fd3bb
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.10011f00
mov al, bl
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov al, 1
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10108a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x24
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x4f5bc]
test eax, eax
je 0x10108aa9
push 2
push 0
push 0x20
push dword [ebx + 0x4f5c0]
call eax
add esp, 0x10
test eax, eax
jne 0x10108c7c
push esi
xor esi, esi
xor eax, eax
mov dword [esp + 8], esi
cmp ax, word [ebx + 0x14]
jae 0x10108c57
push ebp
push edi
nop
xor edi, edi
xor eax, eax
mov dword [esp + 0x20], edi
cmp ax, word [ebx + 0x16]
jae 0x10108c44
mov eax, esi
and eax, 7
lea edx, [eax + eax]
mov dword [esp + 0x30], edx
nop
movzx ecx, word [ebx + 0x492bc]
mov eax, edi
and eax, 1
or eax, edx
mov edx, esi
shr edx, cl
lea ebp, [eax + eax]
movzx eax, word [ebx + 0x1e]
imul edx, eax
mov eax, edi
shr eax, cl
mov ecx, ebp
mov dword [esp + 0x28], ebp
add edx, eax
mov eax, dword [ebx + 0x188]
shr eax, cl
and eax, 3
lea ecx, [eax + edx*4]
mov eax, dword [ebx + 8]
cmp word [eax + ecx*2], 0
lea eax, [eax + ecx*2]
mov dword [esp + 0x2c], eax
jne 0x10108c2f
mov eax, dword [esp + 0x10]
xor esi, esi
add eax, 2
mov dword [esp + 0x1c], esi
xor edx, edx
mov dword [esp + 0x18], edx
lea ebp, [eax - 4]
cmp ebp, eax
ja 0x10108c2b
nop dword [eax]
lea ecx, [edi + 2]
lea eax, [ecx - 4]
mov dword [esp + 0x14], ecx
cmp eax, ecx
ja 0x10108c0a
movzx edi, word [ebx + 0x14]
mov ecx, ebp
and ecx, 7
add ecx, ecx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x14]
cmp ebp, edi
jae 0x10108bfd
movzx ecx, word [ebx + 0x16]
cmp eax, ecx
jae 0x10108bf9
mov edx, dword [ebx + 0x188]
mov ecx, eax
and ecx, 1
mov edi, edx
or ecx, dword [esp + 0x24]
add ecx, ecx
shr edi, cl
mov ecx, dword [esp + 0x28]
shr edx, cl
xor edx, edi
test dl, 3
jne 0x10108bf1
movzx ecx, word [ebx + 0x492bc]
mov esi, ebp
shr esi, cl
mov edx, eax
movzx ecx, word [ebx + 0x1e]
and edi, 3
imul esi, ecx
movzx ecx, word [ebx + 0x492bc]
shr edx, cl
mov ecx, dword [ebx + 8]
add esi, edx
lea edx, [edi + esi*4]
mov esi, dword [esp + 0x1c]
movzx ecx, word [ecx + edx*2]
mov edx, dword [esp + 0x18]
movzx edi, word [ebx + 0x14]
test cx, cx
je 0x10108bf9
inc esi
add edx, ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], edx
jmp 0x10108bf9
mov edx, dword [esp + 0x18]
movzx edi, word [ebx + 0x14]
mov ecx, dword [esp + 0x14]
inc eax
cmp eax, ecx
jbe 0x10108b75
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebp
add eax, 2
cmp ebp, eax
jbe 0x10108b50
test esi, esi
je 0x10108c2b
mov eax, edx
mov ecx, dword [esp + 0x2c]
xor edx, edx
div esi
mov word [ecx], ax
mov esi, dword [esp + 0x10]
movzx eax, word [ebx + 0x16]
inc edi
mov edx, dword [esp + 0x30]
mov dword [esp + 0x20], edi
cmp edi, eax
jb 0x10108ae0
movzx eax, word [ebx + 0x14]
inc esi
mov dword [esp + 0x10], esi
cmp esi, eax
jb 0x10108ac0
pop edi
pop ebp
mov eax, dword [ebx + 0x4f5bc]
pop esi
test eax, eax
je 0x10108c77
push 2
push 1
push 0x20
push dword [ebx + 0x4f5c0]
call eax
add esp, 0x10
test eax, eax
jne 0x10108c93
pop ebx
add esp, 0x24
ret
push 0x103ec24c
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 6
push eax
call fcn.101f94fb
push 0x103ec24c
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 6
push eax
call fcn.101f94fb
int3
Function at 0x1010f260
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x56c
push ebx
push esi
mov esi, dword [esp + 0x578]
mov ebx, ecx
push edi
push esi
push 0xff
call fcn.1020a945
push esi
push 0xd8
call fcn.1020a945
mov edi, dword [esp + 0x590]
add esp, 0x10
mov ecx, str.Exif
lea eax, [edi + 6]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1010f2c0
test dl, dl
je 0x1010f2bc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1010f2c0
add eax, 2
add ecx, 2
test dl, dl
jne 0x1010f2a0
xor eax, eax
jmp 0x1010f2c5
sbb eax, eax
or eax, 1
test eax, eax
je 0x1010f327
movq xmm0, qword [0x102ab964]
mov ax, word [0x102ab96c]
push 0x568
movq qword [esp + 0x10], xmm0
mov word [esp + 0x18], ax
call dword [sym.imp.WS2_32.dll_htons]
push esi
push 0xa
mov word [esp + 0x16], ax
lea eax, [esp + 0x14]
push 1
push eax
call fcn.102013d8
add esp, 0x10
lea eax, [esp + 0x18]
mov ecx, ebx
push 0
push eax
call fcn.101289c0
push esi
push 0x560
lea eax, [esp + 0x20]
push 1
push eax
call fcn.102013d8
add esp, 0x10
mov eax, dword [esp + 0x584]
push esi
add eax, 0xfffffffe
push eax
lea eax, [edi + 2]
push 1
push eax
call fcn.102013d8
add esp, 0x10
pop edi
pop esi
pop ebx
add esp, 0x56c
ret 0xc
Function at 0x101122da
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
sub esp, 0x14
add eax, 0xfffffffd
push ebx
push esi
push edi
mov edi, ecx
cmp eax, 9
ja case.0x1011217d.6
jmp dword [eax*4 + 0x1011235c]
call fcn.101120a0
movzx eax, ax
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fstp qword [esp + 0x18]
fld qword [esp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.1010f760
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x103d8710]
movsd qword [esp + 0x18], xmm0
fld qword [esp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.1010f760
mov ecx, edi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x103d8710]
movsd qword [esp + 0x10], xmm0
call fcn.1010f760
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x103d8710]
ucomisd xmm0, qword [0x103d79c8]
lahf
test ah, 0x44
jp 0x10112221
movsd xmm0, qword [0x103d7ce0]
fld qword [esp + 0x10]
movsd qword [esp + 0x18], xmm0
fdiv qword [esp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.101120a0
cwde
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fstp qword [esp + 0x18]
fld qword [esp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.1010f760
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fstp qword [esp + 0x18]
fld qword [esp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.1010f760
mov ecx, edi
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [esp + 0x10], xmm0
call fcn.1010f760
movd xmm0, eax
cvtdq2pd xmm0, xmm0
ucomisd xmm0, qword [0x103d79c8]
lahf
test ah, 0x44
jp 0x101122ad
movsd xmm0, qword [0x103d7ce0]
fld qword [esp + 0x10]
movsd qword [esp + 0x18], xmm0
fdiv qword [esp + 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.1010f760
push eax
mov ecx, edi
call fcn.10112150
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x1234
call dword [sym.imp.WS2_32.dll_ntohs]
xor ecx, ecx
mov edx, 0x1234
cmp ax, dx
mov edx, 0x4949
sete cl
xor eax, eax
cmp word [edi + 0x492d8], dx
mov edx, 7
sete al
xor ebx, ebx
cmp eax, ecx
cmove ebx, edx
xor esi, esi
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ecx, esi
inc esi
xor ecx, ebx
mov byte [esp + ecx + 0x10], al
cmp esi, 8
jl 0x10112311
fld qword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
pop edi
pop esi
pop ebx
fstp qword [esp + 0xc]
fld qword [esp + 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x10115f00
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebp
push esi
push edi
mov edi, ecx
cdq
push 0
push edx
push eax
mov ecx, dword [edi + 0x49280]
mov esi, dword [ecx]
call dword [esi + 0xc]
mov ecx, edi
call fcn.1010f760
mov ebp, eax
cmp ebp, 0xff
ja 0x101160f0
test ebp, ebp
je 0x101160de
push ebx
mov ebx, 0x10bf
nop dword [eax]
mov ecx, edi
dec ebp
call fcn.101120a0
mov ecx, edi
movzx esi, ax
call fcn.101120a0
mov ecx, dword [edi + 0x49280]
movzx eax, ax
mov dword [esp + 0x18], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov dword [esp + 0x10], eax
cmp esi, 0x100
jne 0x10115f8d
mov ecx, edi
call fcn.101120a0
mov ecx, edi
mov word [edi + 0x10], ax
call fcn.101120a0
mov word [edi + 0x12], ax
jmp 0x101160bd
cmp esi, 0x121
jne 0x10115fc2
mov ecx, edi
call fcn.101120a0
mov ecx, edi
mov word [edi + 0x14], ax
call fcn.101120a0
mov ecx, 0x10bc
mov word [edi + 0x16], ax
cmp ax, cx
jne 0x101160bd
mov word [edi + 0x16], bx
jmp 0x101160bd
cmp esi, 0x130
jne 0x10115ffd
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ecx, dword [edi + 0x49280]
sar eax, 7
mov dword [edi + 0x49314], eax
mov eax, dword [ecx]
call dword [eax + 0x18]
shr eax, 3
not eax
and eax, 1
mov word [edi + 0x492be], ax
jmp 0x101160bd
cmp esi, 0x131
jne 0x1011603f
mov dword [edi + 0x188], 9
lea esi, [edi + 0x1d3]
mov ebx, 0x24
nop word [eax + eax]
mov ecx, dword [edi + 0x49280]
mov eax, dword [ecx]
call dword [eax + 0x18]
and al, 3
lea esi, [esi - 1]
mov byte [esi + 1], al
sub ebx, 1
jne 0x10116020
mov ebx, 0x10bf
jmp 0x101160bd
cmp esi, 0x2ff0
jne 0x10116077
xor esi, esi
nop dword [eax]
mov ecx, edi
call fcn.101120a0
movzx eax, ax
movd xmm0, eax
mov eax, esi
cvtdq2ps xmm0, xmm0
xor eax, 1
inc esi
movss dword [edi + eax*4 + 0x2480c], xmm0
cmp esi, 4
jb 0x10116050
jmp 0x101160bd
cmp esi, 0xc000
jne 0x101160bd
movsx esi, word [edi + 0x492d8]
mov eax, 0x4949
mov ecx, edi
mov word [edi + 0x492d8], ax
call fcn.1010f760
cmp eax, 0x2710
jbe 0x101160a7
mov ecx, edi
call fcn.1010f760
mov ecx, edi
mov word [edi + 0x16], ax
call fcn.1010f760
mov word [edi + 0x14], ax
mov word [edi + 0x492d8], si
mov ecx, dword [edi + 0x49280]
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x10]
push 0
mov edx, dword [ecx]
push 0
push eax
call dword [edx + 0xc]
test ebp, ebp
jne 0x10115f40
pop ebx
movzx eax, word [edi + 0x49314]
mov cx, ax
shl word [edi + 0x14], cl
shr word [edi + 0x16], cl
pop edi
pop esi
pop ebp
pop ecx
ret 4