joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100aef50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x2c]
nop dword [eax]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, esi
sub edx, dword [edi + 0x6c]
mov dword [ebp + 8], edx
cmp dword [edi + 0x6c], eax
jb 0x100aefdf
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.1002afe0
mov edx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x100aefaf
sub eax, esi
jmp 0x100aefb1
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x100aefa0
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x100aefd0
sub eax, esi
jmp 0x100aefd2
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x100aefc1
mov edx, dword [ebp + 8]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x100af094
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp + 8], ecx
test ecx, ecx
jne 0x100af00c
xor eax, eax
jmp 0x100af058
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x100af029
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.100b6910
jmp 0x100af039
cmp eax, 2
jne 0x100af042
push ecx
push dword [ebx]
push dword [ebx + 0x30]
call fcn.100af2c0
mov ecx, dword [ebp + 8]
add esp, 0xc
mov dword [ebx + 0x30], eax
push ecx
push dword [ebx]
push dword [ebp - 4]
call fcn.1002afe0
mov eax, dword [ebp + 8]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x100af080
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x100af094
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x100aef60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100af2c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x100af2cc
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.100af2e0
Function at 0x100ccd30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x10188068]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x100], 0
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0xf8], 0x1010000
mov dword [ebp - 0xf4], 0x1010101
mov dword [ebp - 0xf0], 0x1010101
mov dword [ebp - 0xec], 0x1010101
mov dword [ebp - 0xe8], 0x1010101
mov dword [ebp - 0xe4], 0x1010101
mov dword [ebp - 0xe0], 0x1010101
mov dword [ebp - 0xdc], 0x2020202
mov dword [ebp - 0xd8], 0x2020202
mov dword [ebp - 0xd4], 0x2020202
mov dword [ebp - 0xd0], 0x2020202
mov dword [ebp - 0xcc], 0x2020202
mov dword [ebp - 0xc8], 0x2020202
mov dword [ebp - 0xc4], 0x3030202
mov dword [ebp - 0xc0], 0x3030303
mov dword [ebp - 0xbc], 0x3030303
mov dword [ebp - 0xb8], 0x3030303
mov dword [ebp - 0xb4], 0x53525150
mov dword [ebp - 0xb0], 0x57565554
mov dword [ebp - 0xac], 0x5b5a5958
mov dword [ebp - 0xa8], 0x5f5e5d5c
mov dword [ebp - 0xa4], 0x63626160
mov dword [ebp - 0xa0], 0x67666564
mov dword [ebp - 0x9c], 0x6b6a6968
mov dword [ebp - 0x98], 0x6f6e6d6c
mov dword [ebp - 0x94], 0x73727170
mov dword [ebp - 0x90], 0x77767574
mov dword [ebp - 0x8c], 0x7b7a7978
mov dword [ebp - 0x88], 0x7f7e7d7c
mov dword [ebp - 0x84], 0x83828180
mov dword [ebp - 0x80], 0x87868584
mov dword [ebp - 0x7c], 0x8b8a8988
mov dword [ebp - 0x78], 0x8f8e8d8c
mov dword [ebp - 0x74], 0x93929190
mov dword [ebp - 0x70], 0x97969594
mov dword [ebp - 0x6c], 0x9b9a9998
mov dword [ebp - 0x68], 0x9f9e9d9c
mov dword [ebp - 0x64], 0xa3a2a1a0
mov dword [ebp - 0x60], 0xa7a6a5a4
mov dword [ebp - 0x5c], 0xabaaa9a8
mov dword [ebp - 0x58], 0xafaeadac
mov dword [ebp - 0x54], 0xb3b2b1b0
mov dword [ebp - 0x50], 0xb7b6b5b4
mov dword [ebp - 0x4c], 0xbbbab9b8
mov dword [ebp - 0x48], 0xbfbebdbc
mov dword [ebp - 0x44], 0xc3c2c1c0
mov dword [ebp - 0x40], 0xc7c6c5c4
mov dword [ebp - 0x3c], 0xcbcac9c8
mov dword [ebp - 0x38], 0xcfcecdcc
mov dword [ebp - 0x34], 0xd3d2d1d0
mov dword [ebp - 0x30], 0xd7d6d5d4
mov dword [ebp - 0x2c], 0xdbdad9d8
mov dword [ebp - 0x28], 0xdfdedddc
mov dword [ebp - 0x24], 0xe3e2e1e0
mov dword [ebp - 0x20], 0xe7e6e5e4
mov dword [ebp - 0x1c], 0xebeae9e8
mov dword [ebp - 0x18], 0xefeeedec
mov dword [ebp - 0x14], 0xf3f2f1f0
mov dword [ebp - 0x10], 0xf7f6f5f4
mov dword [ebp - 0xc], 0xfbfaf9f8
mov dword [ebp - 8], 0xfffefdfc
test edx, edx
jne 0x100ccf88
mov eax, 0xffffff37
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029ae5
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x100ccfa1
mov eax, 0xffffff38
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029ae5
mov esp, ebp
pop ebp
ret 0xc
test ecx, ecx
je 0x100ccf8c
push esi
push 0x100
lea esi, [ebp - 0x104]
push esi
push ecx
push eax
push dword [edx + 8]
call fcn.100c3830
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029ae5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100d8b10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
not eax
test esi, esi
je 0x100d8be2
push edi
mov edi, dword [ebp + 8]
movzx ecx, byte [edi]
lea edi, [edi + 1]
xor eax, ecx
mov ecx, eax
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
movzx edx, al
neg edx
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
movzx ecx, al
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
sub esi, 1
jne 0x100d8b28
pop edi
not eax
pop esi
pop ebp
ret

Function at 0x100da0a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 0x12
push ebx
xor bl, bl
cmp byte [0x1018f9dc], bl
je 0x100da12d
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100da12c
cmp dword [esi], 0x6d43564c
jne 0x100da12c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 8]
push 0
push eax
push 1
lea eax, [ebp - 1]
mov dword [ebp - 8], 0
push eax
push dword [esi + 4]
call edi
test eax, eax
je 0x100da126
nop dword [eax]
cmp dword [ebp - 8], 1
jne 0x100da13b
mov al, byte [ebp - 1]
test bl, bl
je 0x100da105
cmp al, byte [esi + 0x114]
je 0x100da132
cmp al, 0x1b
mov dword [ebp - 8], 0
push 0
lea eax, [ebp - 8]
sete bl
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call edi
test eax, eax
jne 0x100da0f0
mov eax, 0x408
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x409
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100da150
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x1018f9dc], 0
push esi
push edi
je 0x100da22e
mov esi, dword [ebp + 8]
test esi, esi
je 0x100da22e
cmp dword [esi], 0x6d43564c
jne 0x100da22e
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100da22e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 8]
push 0
push eax
push 1
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push eax
push dword [esi + 4]
mov dword [ebp - 8], 0
call ebx
test eax, eax
je 0x100da217
cmp dword [ebp - 8], 0
je 0x100da20b
mov al, byte [ebp - 1]
cmp al, 0x1b
jne 0x100da223
nop dword [eax + eax]
push 0
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [esi + 4]
call ebx
test eax, eax
je 0x100da217
cmp dword [ebp - 8], 0
je 0x100da20b
mov cl, byte [ebp - 1]
cmp cl, 1
je 0x100da1ff
cmp cl, 0x1b
je 0x100da1c0
xor eax, eax
cmp cl, byte [esi + 0x114]
pop ebx
setne al
pop edi
add eax, 0x403
pop esi
mov esp, ebp
pop ebp
ret
mov byte [edi], 0x1b
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
mov eax, 0x409
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
pop edi
mov eax, 0x408
pop esi
mov esp, ebp
pop ebp
ret
pop ebx
mov byte [edi], al
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x12
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100da240
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 0x12
cmp byte [0x1018f9dc], 0
je 0x100da300
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100da2ff
cmp dword [esi], 0x6d43564c
jne 0x100da2ff
push 0xc
push dword [esi + 4]
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_PurgeComm]
mov al, byte [esi + 0x114]
push 0
mov byte [ebp - 3], al
lea eax, [ebp - 8]
push eax
push 2
lea eax, [ebp - 4]
mov byte [ebp - 4], 0x1b
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x100da2fa
mov eax, dword [esi + 0x120]
push ebx
xor ebx, ebx
push edi
test eax, eax
je 0x100da2cb
push eax
call fcn.1002d945
add esp, 4
mov dword [esi + 0x120], ebx
mov dword [esi + 0x11c], ebx
mov eax, dword [ebp + 0xc]
lea edi, [eax + eax]
push edi
call fcn.1002de03
add esp, 4
mov dword [esi + 0x120], eax
test eax, eax
je 0x100da2ea
mov dword [esi + 0x11c], edi
pop edi
mov dword [esi + 0x118], ebx
mov ax, bx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x408
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100da310
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, 0x12
cmp byte [0x1018f9dc], 0
je 0x100da40c
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100da40b
cmp dword [esi], 0x6d43564c
jne 0x100da40b
mov cl, byte [ebp + 0xc]
lea edx, [ebp - 4]
movzx eax, byte [ebp - 3]
cmp cl, 0x1b
push ebx
push edi
mov edi, 1
mov dword [ebp - 8], 0
cmove eax, edi
mov byte [ebp - 4], cl
mov edi, dword [esi + 0x120]
xor ebx, ebx
cmp cl, 0x1b
mov byte [ebp - 3], al
sete bl
inc ebx
test edi, edi
je 0x100da3e5
mov ecx, dword [esi + 0x118]
lea eax, [ecx + ebx]
cmp eax, dword [esi + 0x11c]
ja 0x100da3d9
mov eax, edx
push ebx
push eax
lea eax, [ecx + edi]
push eax
call fcn.1002afe0
mov edi, dword [esi + 0x118]
add esp, 0xc
mov cl, byte [ebp + 0x10]
add edi, ebx
mov dword [esi + 0x118], edi
test cl, cl
je 0x100da3b5
mov edx, dword [esi + 0x120]
jmp 0x100da3b8
lea edx, [ebp - 4]
test cl, cl
mov dword [ebp - 0xc], 0
mov eax, 0x12
cmove eax, dword [ebp - 0xc]
cmove edi, ebx
movzx eax, ax
jne 0x100da3e7
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
pop edi
pop ebx
mov eax, 0x81
pop esi
mov esp, ebp
pop ebp
ret
mov edi, ebx
push 0
lea eax, [ebp - 8]
push eax
push edi
push edx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
mov eax, 0x408
je 0x100da409
xor ecx, ecx
cmp dword [ebp - 8], edi
cmove eax, ecx
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100dbd00
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x10188068]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x48]
push edi
mov edi, dword [ebp + 0x10]
push 0x40
push 0
push eax
call fcn.1002ae80
mov eax, dword [ebp + 0x14]
add esp, 0xc
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
test eax, eax
jne 0x100dbd77
mov dword [ebp - 0x68], 0x6a09e667
mov dword [ebp - 0x64], 0xbb67ae85
mov dword [ebp - 0x60], 0x3c6ef372
mov dword [ebp - 0x5c], 0xa54ff53a
mov dword [ebp - 0x58], 0x510e527f
mov dword [ebp - 0x54], 0x9b05688c
mov dword [ebp - 0x50], 0x1f83d9ab
mov dword [ebp - 0x4c], 0x5be0cd19
jmp 0x100dbdaf
mov dword [ebp - 0x68], 0xc1059ed8
mov dword [ebp - 0x64], 0x367cd507
mov dword [ebp - 0x60], 0x3070dd17
mov dword [ebp - 0x5c], 0xf70e5939
mov dword [ebp - 0x58], 0xffc00b31
mov dword [ebp - 0x54], 0x68581511
mov dword [ebp - 0x50], 0x64f98fa7
mov dword [ebp - 0x4c], 0xbefa4fa4
push dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.100dccd0
lea eax, [ebp - 0x70]
push edi
push eax
call fcn.100dbdf0
add esp, 0x14
lea ecx, [ebp - 0x70]
mov eax, 0x6c
pop edi
pop esi
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x100dbdd6
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029ae5
mov esp, ebp
pop ebp
ret
Function at 0x100dcc00
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov edx, 0x367cd507
mov ecx, dword [ebp + 0xc]
test ecx, ecx
push ebx
push esi
mov dword [eax], 0
mov ebx, 0xa54ff53a
mov dword [eax + 4], 0
mov esi, 0x9b05688c
mov eax, 0xbb67ae85
mov dword [ebp - 4], 0xc1059ed8
cmovne eax, edx
mov ecx, 0x5be0cd19
mov dword [ebp - 8], eax
mov edx, 0x3070dd17
mov eax, 0x3c6ef372
cmovne eax, edx
mov edx, 0x510e527f
mov dword [ebp - 0xc], eax
mov eax, 0xf70e5939
cmovne ebx, eax
mov eax, 0x64f98fa7
push edi
mov edi, 0x1f83d9ab
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp + 0xc]
cmovne edi, eax
mov eax, 0x68581511
cmovne esi, eax
mov eax, 0xffc00b31
cmovne edx, eax
test ebx, ebx
mov ebx, dword [ebp + 8]
mov eax, 0xbefa4fa4
cmovne ecx, eax
mov eax, 0x6a09e667
cmovne eax, dword [ebp - 4]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x10]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], esi
mov dword [eax + 0x20], edi
pop edi
mov dword [eax + 0x24], ecx
mov ecx, dword [ebp + 0xc]
pop esi
mov dword [eax + 0x68], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100dd090
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x10188068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov edx, 1
nop dword [eax]
mov eax, edx
mov dword [ebp + esi*4 - 0x804], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x404], esi
movzx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor ecx, edx
movzx edx, cl
cmp esi, 0x100
jl 0x100dd0b0
mov esi, 1
mov edx, 0x10191bf0
nop dword [eax]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movzx ecx, al
lea eax, [esi + esi]
neg ecx
sbb ecx, ecx
add edx, 4
and ecx, 0x1b
xor ecx, eax
movzx esi, cl
cmp edx, 0x10191c18
jl 0x100dd0f0
mov eax, 1
mov byte [0x1018f9f0], 0x63
mov byte [0x10190b53], 0
mov dword [ebp - 0x808], eax
nop dword [eax]
mov ecx, dword [ebp + eax*4 - 0x404]
lea eax, [ebp - 0x408]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
shr ecx, 7
add eax, eax
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
add eax, eax
shr ecx, 7
or ecx, eax
movzx edx, cl
mov ecx, edx
shr ecx, 7
lea eax, [edx + edx]
or ecx, eax
xor ecx, 0x63
movzx eax, cl
xor eax, edx
xor ebx, eax
mov eax, dword [ebp - 0x808]
mov byte [eax + 0x1018f9f0], bl
mov byte [ebx + 0x10190af0], al
inc eax
mov dword [ebp - 0x808], eax
cmp eax, 0x100
jl 0x100dd130
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 0x80c], ebx
nop
movzx edx, byte [esi + 0x1018f9f0]
mov eax, edx
and al, 0x80
movzx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
movzx eax, cl
mov ecx, eax
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, eax
mov dword [esi*4 + 0x1018faf0], ecx
rol ecx, 8
mov dword [esi*4 + 0x1018fef0], ecx
rol ecx, 8
mov dword [esi*4 + 0x101902f0], ecx
rol ecx, 8
mov dword [esi*4 + 0x101906f0], ecx
movzx ecx, byte [esi + 0x10190af0]
test ecx, ecx
je 0x100dd270
mov ecx, dword [ebp + ecx*4 - 0x404]
mov eax, dword [ebp - 0x3cc]
add eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x3e0]
add eax, ecx
mov edi, dword [ebp + edx*4 - 0x804]
cdq
idiv ebx
mov eax, dword [ebp - 0x3d0]
add eax, ecx
mov ebx, dword [ebp + edx*4 - 0x804]
cdq
idiv dword [ebp - 0x80c]
mov eax, dword [ebp + edx*4 - 0x804]
mov dword [ebp - 0x808], eax
mov eax, dword [ebp - 0x3d8]
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x804]
jmp 0x100dd27c
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x808], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 0x808]
shl eax, 8
xor eax, ebx
mov ebx, 0xff
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x10190bf0], eax
rol eax, 8
mov dword [esi*4 + 0x10190ff0], eax
rol eax, 8
mov dword [esi*4 + 0x101913f0], eax
rol eax, 8
mov dword [esi*4 + 0x101917f0], eax
inc esi
cmp esi, 0x100
jl 0x100dd1b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10029ae5
mov esp, ebp
pop ebp
ret
Function at 0x100df190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x10188068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x324], eax
push esi
mov esi, dword [ebp + 0xc]
cmp ebx, 0x180
jbe 0x100df1d1
pop esi
mov eax, 0xffffffc8
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10029ae5
mov esp, ebp
pop ebp
ret
push 0x1a0
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.1002ae80
lea eax, [ebp - 0x31c]
push eax
call fcn.100dd4a0
mov eax, ebx
mov byte [ebp - 0x1f1], bl
shr eax, 0x18
mov byte [ebp - 0x1f4], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0x1f3], al
mov eax, ebx
shr eax, 8
push ebx
mov byte [ebp - 0x1f2], al
lea eax, [ebp - 0x1ec]
push esi
push eax
mov byte [ebp - 0x1ed], 0x30
call fcn.1002afe0
lea esi, [ebx + 0x19]
mov byte [ebp + ebx - 0x1ec], 0x80
add esp, 0x1c
mov dword [ebp - 0x328], esi
xor eax, eax
mov byte [ebp + eax - 0x64], al
inc eax
cmp eax, 0x20
jl 0x100df242
push 0x100
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x31c]
push eax
call fcn.100dd6f0
mov al, byte [ebp - 0x201]
add esp, 0xc
xor ebx, ebx
mov dword [ebp - 0x320], ebx
push edi
xorps xmm0, xmm0
mov edi, esi
movups xmmword [ebp - 0x14], xmm0
test esi, esi
je 0x100df2dd
lea esi, [ebp - 0x204]
mov ebx, 0x10
lea eax, [ebp - 0x14]
sub esi, eax
xor eax, eax
lea edx, [ebp - 0x14]
add edx, eax
inc eax
mov cl, byte [esi + edx]
xor byte [edx], cl
cmp eax, 0x10
jl 0x100df292
add esi, ebx
mov eax, edi
cmp edi, ebx
cmovae eax, ebx
sub edi, eax
lea eax, [ebp - 0x14]
push eax
push eax
lea eax, [ebp - 0x31c]
push 1
push eax
call fcn.100dd450
add esp, 0x10
test edi, edi
jne 0x100df290
movups xmm0, xmmword [ebp - 0x14]
mov ebx, dword [ebp - 0x320]
mov al, byte [ebp - 0x201]
mov esi, dword [ebp - 0x328]
movups xmmword [ebp + ebx - 0x44], xmm0
add ebx, 0x10
inc al
mov byte [ebp - 0x201], al
mov dword [ebp - 0x320], ebx
cmp ebx, 0x30
jl 0x100df273
push 0x100
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x31c]
push eax
call fcn.100dd6f0
add esp, 0xc
mov esi, 3
pop edi
nop word [eax + eax]
lea eax, [ebp - 0x24]
push eax
push eax
lea eax, [ebp - 0x31c]
push 1
push eax
call fcn.100dd450
mov eax, dword [ebp - 0x324]
add esp, 0x10
movups xmm0, xmmword [ebp - 0x24]
movups xmmword [eax], xmm0
add eax, 0x10
mov dword [ebp - 0x324], eax
sub esi, 1
jne 0x100df320
lea eax, [ebp - 0x31c]
push eax
call fcn.100dd480
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop esi
pop ebx
call fcn.10029ae5
mov esp, ebp
pop ebp
ret
Function at 0x100df380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10188068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x30
mov dword [ebp - 0x38], eax
lea edi, [ebp - 0x34]
mov eax, edi
push 0
push eax
call fcn.1002ae80
mov edx, dword [ebp - 0x38]
mov esi, 1
add esp, 0xc
mov ebx, 3
sub esi, edx
lea eax, [edx + 0x20]
lea ecx, [edx + 0xf]
mov dword [ebp - 0x3c], eax
mov eax, ecx
add byte [eax], 1
jne 0x100df3d2
dec eax
lea ecx, [esi + eax]
test ecx, ecx
jg 0x100df3c5
push edi
push edx
lea eax, [edx + 0x20]
push 1
push eax
call fcn.100dd450
mov edx, dword [ebp - 0x38]
add esp, 0x10
add edi, 0x10
lea ecx, [edx + 0xf]
sub ebx, 1
jne 0x100df3c3
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x34]
pop edi
pop esi
xor ecx, ecx
sub edx, eax
pop ebx
nop dword [eax]
lea eax, [ebp - 0x34]
add eax, ecx
add ecx, 0x10
movups xmm0, xmmword [eax]
movups xmm1, xmmword [edx + eax]
pxor xmm1, xmm0
movups xmmword [eax], xmm1
cmp ecx, 0x30
jl 0x100df400
push 0x100
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x3c]
call fcn.100dd6f0
mov eax, dword [ebp - 0x38]
add esp, 0xc
movups xmm0, xmmword [ebp - 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
movups xmmword [eax], xmm0
xor eax, eax
call fcn.10029ae5
mov esp, ebp
pop ebp
ret
Function at 0x100df6e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10188068]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x30], ebx
push eax
push 0x10
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
push ebx
movups xmmword [ebp - 0x14], xmm0
call fcn.100e2520
add esp, 0x14
test eax, eax
jne 0x100df8cb
movzx eax, byte [ebp - 0x13]
xor edx, edx
movzx ecx, byte [ebp - 0x10]
push esi
movzx esi, byte [ebp - 0x14]
shl esi, 8
or esi, eax
shl ecx, 8
movzx eax, byte [ebp - 0x12]
shl esi, 8
or esi, eax
mov dword [ebx + 0xc0], 0
movzx eax, byte [ebp - 0x11]
shl esi, 8
or esi, eax
mov dword [ebx + 0xc4], 0
movzx eax, byte [ebp - 0xf]
or ecx, eax
mov dword [ebx + 0x104], esi
movzx eax, byte [ebp - 0xe]
shl ecx, 8
or ecx, eax
mov dword [ebx + 0x40], 0
movzx eax, byte [ebp - 0xd]
shl ecx, 8
or ecx, eax
mov dword [ebx + 0x44], 0
movzx eax, byte [ebp - 0xb]
or edx, ecx
movzx ecx, byte [ebp - 8]
push edi
movzx edi, byte [ebp - 0xc]
shl edi, 8
or edi, eax
shl ecx, 8
movzx eax, byte [ebp - 0xa]
shl edi, 8
or edi, eax
mov dword [ebp - 0x1c], edx
movzx eax, byte [ebp - 9]
xor edx, edx
shl edi, 8
or edi, eax
mov dword [ebp - 0x20], 4
movzx eax, byte [ebp - 7]
or ecx, eax
mov dword [ebx + 0x84], edi
movzx eax, byte [ebp - 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 5]
shl ecx, 8
or ecx, eax
or edx, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edx
mov dword [ebx + 0x80], edx
mov dword [ebx + 0x100], ecx
shrd dword [ebp - 0x18], edi, 1
shl ecx, 0x1f
and edx, 1
shr edi, 1
xor eax, eax
or dword [ebp - 0x18], eax
or edi, ecx
mov ecx, dword [ebp - 0x1c]
shrd ecx, esi, 1
imul edx, edx, 0xe1000000
xor ecx, eax
shr esi, 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
xor esi, edx
mov edx, dword [ebp - 0x18]
mov dword [ebx + eax*8 + 0x40], edx
mov dword [ebx + eax*8 + 0x44], edi
mov dword [ebx + eax*8 + 0xc0], ecx
mov dword [ebx + eax*8 + 0xc4], esi
sar eax, 1
mov dword [ebp - 0x20], eax
test eax, eax
jg 0x100df7f1
mov ecx, 2
mov dword [ebp - 0x20], ecx
nop dword [eax + eax]
lea edi, [ecx + 0x18]
mov eax, dword [ebx + edi*8]
lea edi, [ebx + edi*8]
mov dword [ebp - 0x1c], eax
lea edx, [ecx + 8]
mov eax, dword [edi + 4]
lea edx, [ebx + edx*8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx]
mov dword [ebp - 0x28], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x2c], eax
cmp ecx, 1
jle 0x100df8bd
lea eax, [ebx + 0x48]
sub edi, edx
lea esi, [edx + 8]
lea ebx, [ecx - 1]
mov edx, dword [eax + 0x80]
lea eax, [eax + 8]
mov ecx, dword [eax + 0x7c]
lea esi, [esi + 8]
xor edx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0x18]
mov dword [edi + esi - 8], edx
mov dword [edi + esi - 4], ecx
mov edx, dword [eax - 8]
mov ecx, dword [eax - 4]
xor edx, dword [ebp - 0x28]
xor ecx, dword [ebp - 0x2c]
mov dword [esi - 8], edx
mov dword [esi - 4], ecx
sub ebx, 1
jne 0x100df883
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x30]
add ecx, ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 8
jle 0x100df850
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10029ae5
mov esp, ebp
pop ebp
ret