joyce8/EMBER2024-capa huggingface dataset:
Function at 0x78502100
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x54
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0x1c]
test edx, edx
je 0x78502200
test byte [section..data], 1
jne 0x785021c0
mov eax, dword [0x7850a028]
mov dword [esp + 8], 5
mov dword [esp + 4], 0x81
mov dword [esp], eax
call sym._FindResourceA_12
sub esp, 0xc
test eax, eax
je 0x78502230
mov dword [esp + 4], eax
mov eax, dword [0x7850a028]
mov dword [esp], eax
call sym._LoadResource_8
sub esp, 8
test eax, eax
je 0x78502210
mov dword [esp], eax
call sym._LockResource_4
sub esp, 4
test eax, eax
je 0x78502210
lea edx, [ebp - 0x40]
mov dword [esp + 0xc], sym._UIInsertObjectDlgProc_16
mov dword [esp + 0x10], edx
mov edx, dword [ebx + 8]
mov dword [esp + 4], eax
mov eax, dword [0x7850a028]
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], 0
call sym._DialogBoxIndirectParamA_20
sub esp, 0x14
cmp eax, 0xffffffff
je 0x78502220
mov ebx, dword [ebp - 4]
leave
ret 4
mov dword [esp + 0x14], str.Customized_template_not_supported_n
mov dword [esp + 0x10], 0x59
mov dword [esp + 0xc], str.OleUIInsertObjectA
mov dword [esp + 8], 0x7850903d
mov dword [esp + 4], 0x78508000
mov dword [esp], 0
call sym._ros_dbg_log
jmp 0x78502122
mov eax, dword [ebx + 0x20]
test eax, eax
jne 0x78502115
jmp 0x78502122
mov eax, 0x6f
mov ebx, dword [ebp - 4]
leave
ret 4
mov eax, 0x70
jmp 0x785021b2
mov eax, 0x6e
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x785022e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x74
mov ebx, dword [ebp + 0xc]
test byte [0x78508010], 8
jne 0x78502304
cmp ebx, 1
je 0x7850234f
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret 0xc
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], str._p_0x_x__p_n
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0x57
mov dword [esp + 0x18], eax
mov dword [esp + 0xc], str.DllMain
mov dword [esp + 8], 0x785091e5
mov dword [esp + 4], 0x78508010
mov dword [esp], 3
call sym._ros_dbg_log
cmp ebx, 1
jne 0x785022f8
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._DisableThreadLibraryCalls_4
mov eax, dword [ebp + 8]
sub esp, 4
mov dword [esp], str.Object_Descriptor
mov dword [0x7850a028], eax
call sym._RegisterClipboardFormatW_4
sub esp, 4
mov dword [0x7850a018], eax
mov dword [esp], str.Link_Source_Descriptor
call sym._RegisterClipboardFormatW_4
sub esp, 4
mov dword [0x7850a014], eax
mov dword [esp], str.Embed_Source
call sym._RegisterClipboardFormatW_4
sub esp, 4
mov dword [0x7850a024], eax
mov dword [esp], str.Embedded_Object
call sym._RegisterClipboardFormatW_4
sub esp, 4
mov dword [0x7850a020], eax
mov dword [esp], str.Link_Source
call sym._RegisterClipboardFormatW_4
sub esp, 4
mov dword [0x7850a01c], eax
mov dword [esp], str.OwnerLink
call sym._RegisterClipboardFormatW_4
sub esp, 4
mov dword [0x7850a010], eax
mov dword [esp], str.FileName
call sym._RegisterClipboardFormatW_4
sub esp, 4
mov dword [0x7850a00c], eax
mov dword [esp], str.FileNameW
call sym._RegisterClipboardFormatW_4
mov dword [ebp - 0x4e], 0x4c004f
mov dword [0x7850a008], eax
xor eax, eax
sub esp, 4
mov word [ebp - 0x32], ax
lea eax, [ebp - 0x4e]
mov dword [esp], eax
mov dword [ebp - 0x4a], 0x550045
mov dword [ebp - 0x46], 0x5f0049
mov dword [ebp - 0x42], 0x53004d
mov dword [ebp - 0x3e], 0x5f0047
mov dword [ebp - 0x3a], 0x450048
mov dword [ebp - 0x36], 0x50004c
call sym._RegisterWindowMessageW_4
mov dword [ebp - 0x30], 0x4c004f
sub esp, 4
mov dword [0x7850a004], eax
lea eax, [ebp - 0x30]
mov dword [esp], eax
mov dword [ebp - 0x2c], 0x550045
mov dword [ebp - 0x28], 0x5f0049
mov dword [ebp - 0x24], 0x53004d
mov dword [ebp - 0x20], 0x5f0047
mov dword [ebp - 0x1c], 0x4e0045
mov dword [ebp - 0x18], 0x440044
mov dword [ebp - 0x14], 0x410049
mov dword [ebp - 0x10], 0x4f004c
mov dword [ebp - 0xc], 0x47
call sym._RegisterWindowMessageW_4
mov ebx, dword [ebp - 4]
mov dword [section..bss], eax
sub esp, 4
mov eax, 1
leave
ret 0xc
Function at 0x78503ab0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x1c
mov dword [ebp - 0x18], edx
mov dword [esp + 4], 0x1fb
mov dword [esp], eax
call sym._GetDlgItem_8
sub esp, 8
mov edi, eax
mov dword [esp], ebx
mov dword [esp + 4], 0x1fa
call sym._GetDlgItem_8
sub esp, 8
mov dword [ebp - 0x14], eax
mov dword [esp], ebx
mov dword [esp + 4], 0x1fc
call sym._GetDlgItem_8
mov edx, dword [ebp - 0x18]
sub esp, 8
mov esi, eax
and dword [edx], 0xfffffff7
mov dword [esp], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1fa
call sym._CheckDlgButton_12
mov ecx, dword [ebp - 0x14]
sub esp, 0xc
mov dword [esp], ecx
mov dword [esp + 4], 0
call sym._EnableWindow_8
sub esp, 8
mov dword [esp], edi
mov dword [esp + 4], 0
call sym._ShowWindow_8
sub esp, 8
mov dword [esp], edi
mov dword [esp + 4], 0
call sym._EnableWindow_8
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], 0
call sym._ShowWindow_8
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], 0
call sym._EnableWindow_8
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x78507300
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea esi, [ebp + 0xc]
sub esp, 0x10
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], 0x78509aa4
call sym._fwrite
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll_vfprintf]
call sym._abort
lea esi, [esi]
Function at 0x10083a90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1070dd84]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push 0x103bf5cc
push esi
mov dword [ebp - 0x18], eax
call fcn.1039eecf
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x10083ad6
push esi
push str.Unable_to_open__s
push 1
push edi
call fcn.10064f70
jmp 0x10083bef
push ebx
push 1
lea eax, [ebp - 0x10]
mov dword [edi], 0
push 9
push eax
call fcn.1039f0bf
add esp, 0x10
test eax, eax
je 0x10083bdc
lea ecx, [ebp - 0x10]
mov eax, dword [ecx]
cmp eax, dword [str.filmgrn1E__lld__lld__d__hd__d_n]
jne 0x10083bdc
mov eax, dword [ecx + 4]
cmp eax, dword [0x103bf314]
jne 0x10083bdc
push ebx
mov dword [ebp - 0x14], 0
call fcn.1039edec
add esp, 4
test eax, eax
jne 0x10083bc0
nop dword [eax]
push 0x2a0
call sym.aom.dll_aom_malloc
mov esi, eax
add esp, 4
test esi, esi
je 0x10083bb0
push 0x2a0
push 0
push esi
call fcn.1039a3e0
push esi
push edi
push ebx
call fcn.10083fa0
mov eax, dword [ebp - 0x14]
add esp, 0x18
mov dword [esi + 0x298], 0
test eax, eax
je 0x10083b72
mov dword [eax + 0x298], esi
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0
jne 0x10083b7c
mov dword [eax], esi
mov dword [eax + 4], esi
cmp dword [edi], 0
mov dword [ebp - 0x14], esi
jne 0x10083bc0
push ebx
call fcn.1039edec
add esp, 4
test eax, eax
je 0x10083b30
push ebx
call fcn.1039edbc
mov eax, dword [edi]
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10398bef
mov esp, ebp
pop ebp
ret
push str.Unable_to_allocate_grain_table_entry
push 2
push edi
call fcn.10064f70
add esp, 0xc
push ebx
call fcn.1039edbc
mov eax, dword [edi]
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10398bef
mov esp, ebp
pop ebp
ret
push str.Unable_to_read__or_invalid__file_magic
push 1
push edi
call fcn.10064f70
push ebx
call fcn.1039edbc
mov eax, dword [edi]
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10398bef
mov esp, ebp
pop ebp
ret
Function at 0x10092b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
mov ebx, dword [ebp + 0x18]
push esi
lea esi, [eax + eax]
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], esi
lea edi, [eax + eax]
mov dword [ebp + 8], edi
cmp dword [ebp + 0x1c], edx
jle 0x10092cb4
mov eax, dword [ebp + 0xc]
xorps xmm3, xmm3
add eax, eax
xorps xmm2, xmm2
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
add eax, eax
mov dword [ebp - 0xc], eax
xor ecx, ecx
test ebx, ebx
jle 0x10092bc6
cmp ebx, 8
jb 0x10092bc6
cmp dword [0x10757c00], 2
jl 0x10092bc6
mov edx, ebx
lea eax, [edi + 8]
mov ebx, esi
and edx, 0xfffffff8
sub ebx, edi
mov dword [ebp + 0x10], ebx
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x10]
nop
movq xmm0, qword [esi + ecx*2]
lea eax, [eax + 0x10]
pmovzxwd xmm1, xmm0
movq xmm0, qword [eax - 0x18]
add ecx, 8
pmovzxwd xmm0, xmm0
psubd xmm1, xmm0
pabsd xmm0, xmm1
paddd xmm3, xmm0
movq xmm0, qword [edi + eax - 0x10]
pmovzxwd xmm1, xmm0
movq xmm0, qword [eax - 0x10]
pmovzxwd xmm0, xmm0
psubd xmm1, xmm0
pabsd xmm0, xmm1
paddd xmm2, xmm0
cmp ecx, edx
jl 0x10092b70
mov edi, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov dword [ebp + 0x10], 0
mov dword [ebp - 8], 0
cmp ecx, ebx
jge 0x10092c76
mov eax, ebx
sub eax, ecx
cmp eax, 2
jl 0x10092c4c
lea eax, [ebx - 1]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea edx, [ecx + 1]
mov eax, edi
lea edx, [esi + edx*2]
sub eax, esi
mov dword [ebp + 8], edx
mov dword [ebp - 0x14], eax
mov esi, ebx
movzx edx, word [edx - 2]
movzx eax, word [edi + ecx*2]
add ecx, 2
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ebp - 0x14]
add ebx, eax
mov eax, dword [ebp + 8]
movzx edx, word [edx + eax]
movzx eax, word [eax]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ebp + 8]
add esi, eax
add edx, 4
mov eax, ecx
mov dword [ebp + 8], edx
cmp ecx, dword [ebp - 0x18]
jl 0x10092c00
mov dword [ebp + 0x10], ebx
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 8], esi
mov esi, dword [ebp - 0x10]
cmp eax, ebx
jge 0x10092c65
lea eax, [ecx + ecx]
movzx ecx, word [eax + edi]
movzx eax, word [eax + esi]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ebp - 4]
add edx, eax
jmp 0x10092c68
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 8]
add edx, eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], edx
add esi, dword [ebp - 0x1c]
add edi, eax
sub dword [ebp + 0x1c], 1
mov dword [ebp - 0x10], esi
mov dword [ebp + 8], edi
jne 0x10092b42
paddd xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
paddd xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
paddd xmm2, xmm0
pop edi
movd eax, xmm2
pop esi
pop ebx
add eax, edx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10092cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x1c]
xor edx, edx
mov dword [ebp - 4], edx
push ebx
mov ebx, dword [ebp + 0x18]
test eax, eax
jle 0x10092e19
push esi
mov esi, dword [ebp + 8]
xorps xmm3, xmm3
push edi
mov edi, dword [ebp + 0x10]
xorps xmm2, xmm2
xor ecx, ecx
test ebx, ebx
jle 0x10092d31
cmp ebx, 0x20
jb 0x10092d31
lea eax, [edi + 0x10]
mov edx, ebx
mov edi, esi
and edx, 0xffffffe0
sub edi, dword [ebp + 0x10]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ecx + esi]
add ecx, 0x20
psadbw xmm1, xmm0
movups xmm0, xmmword [eax - 0x20]
paddd xmm3, xmm1
movups xmm1, xmmword [edi + eax - 0x20]
psadbw xmm1, xmm0
paddd xmm2, xmm1
cmp ecx, edx
jl 0x10092d00
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
cmp ecx, ebx
jge 0x10092de7
mov eax, ebx
sub eax, ecx
cmp eax, 2
jl 0x10092dbe
lea eax, [ebx - 1]
mov edx, esi
mov dword [ebp - 0x18], eax
lea eax, [edi + 1]
add eax, ecx
sub edx, edi
mov edi, dword [ebp - 0xc]
mov ebx, edi
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], edx
nop dword [eax]
movzx eax, byte [eax - 1]
movzx edx, byte [ecx + esi]
add ecx, 2
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ebp - 0x14]
add edi, eax
mov eax, dword [ebp - 8]
movzx edx, byte [eax + edx]
movzx eax, byte [eax]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, ecx
add ebx, eax
mov eax, dword [ebp - 8]
add eax, 2
mov dword [ebp - 8], eax
cmp ecx, dword [ebp - 0x18]
jl 0x10092d70
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp + 0x10]
cmp edx, ebx
jge 0x10092dd6
movzx eax, byte [ecx + edi]
movzx edx, byte [ecx + esi]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ebp - 4]
add edx, eax
jmp 0x10092dd9
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
add edx, eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 4], edx
add edi, dword [ebp + 0x14]
add esi, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0x10], edi
mov dword [ebp + 0x1c], eax
jne 0x10092ce8
paddd xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
paddd xmm2, xmm0
pop edi
movd eax, xmm2
pop esi
pop ebx
add eax, edx
mov esp, ebp
pop ebp
ret
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10098090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push edi
mov edi, dword [ebp + 0x18]
lea ebx, [eax + eax]
mov dword [ebp - 4], edx
cmp dword [ebp + 0x1c], edx
jle 0x10098206
mov eax, dword [ebp + 0xc]
xorps xmm6, xmm6
add eax, eax
xorps xmm3, xmm3
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
push esi
xor ecx, ecx
test edi, edi
jle 0x100981c1
cmp edi, 8
jb 0x1009817c
cmp dword [0x10757c00], 2
jl 0x1009817c
movaps xmm4, xmmword [0x103c2320]
mov esi, edi
and esi, 0xfffffff8
mov edx, 0xc
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0x14]
add esi, 0x10
movd xmm5, edx
mov edx, eax
sub edx, dword [ebp + 0x14]
mov dword [ebp + 8], edx
mov edx, dword [ebp - 4]
mov edi, dword [ebp + 8]
nop dword [eax]
movups xmm1, xmmword [esi - 0x10]
lea esi, [esi + 0x20]
movq xmm0, qword [ebx + ecx*2]
movups xmm2, xmmword [eax + ecx*4]
pmovzxwd xmm0, xmm0
pmulld xmm0, xmm1
movups xmm1, xmmword [esi - 0x20]
psubd xmm2, xmm0
pabsd xmm0, xmm2
movups xmm2, xmmword [edi + esi - 0x20]
paddd xmm0, xmm4
psrad xmm0, xmm5
paddd xmm6, xmm0
movq xmm0, qword [ebx + ecx*2 + 8]
pmovzxwd xmm0, xmm0
pmulld xmm0, xmm1
psubd xmm2, xmm0
add ecx, 8
pabsd xmm0, xmm2
paddd xmm0, xmm4
psrad xmm0, xmm5
paddd xmm3, xmm0
cmp ecx, dword [ebp - 8]
jl 0x10098110
mov edi, dword [ebp + 0x18]
cmp ecx, edi
jge 0x100981c1
lea esi, [eax + ecx*4]
mov eax, dword [ebp + 0x14]
sub eax, dword [ebp + 0x10]
mov dword [ebp + 8], eax
nop dword [eax + eax]
movzx edx, word [ebx + ecx*2]
lea esi, [esi + 4]
imul edx, dword [eax + esi - 4]
inc ecx
mov eax, dword [esi - 4]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ebp - 4]
add eax, 0x800
sar eax, 0xc
add edx, eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], edx
cmp ecx, edi
jl 0x10098190
mov eax, dword [ebp + 0x10]
add ebx, dword [ebp - 0xc]
lea ecx, [edi*4]
add dword [ebp + 0x14], ecx
add eax, ecx
sub dword [ebp + 0x1c], 1
mov dword [ebp + 0x10], eax
jne 0x100980c1
paddd xmm3, xmm6
movaps xmm0, xmm3
psrldq xmm0, 8
paddd xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
paddd xmm3, xmm0
pop esi
movd eax, xmm3
pop edi
pop ebx
add eax, edx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100984a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
xor eax, eax
push ebx
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 8], eax
cmp dword [ebp + 0x1c], eax
jle 0x100986b9
mov edx, dword [ebp + 0x14]
lea eax, [ebx*4]
push esi
mov esi, dword [ebp + 8]
xorps xmm6, xmm6
push edi
mov edi, dword [ebp + 0x10]
xorps xmm5, xmm5
xor ecx, ecx
test ebx, ebx
jle 0x1009858f
cmp ebx, 8
jb 0x1009858f
cmp dword [0x10757c00], 2
jl 0x1009858f
movaps xmm3, xmmword [0x103c2320]
mov eax, ebx
and eax, 0xfffffff8
mov ebx, edi
mov dword [ebp - 0xc], eax
sub ebx, edx
mov eax, 0xc
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp + 0x18]
movd xmm4, eax
lea eax, [edx + 0x10]
mov edx, dword [ebp - 0x10]
nop dword [eax + eax]
movups xmm1, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movd xmm0, dword [ecx + esi]
movups xmm2, xmmword [edi + ecx*4]
pmovzxbd xmm0, xmm0
pmulld xmm0, xmm1
movups xmm1, xmmword [eax - 0x20]
psubd xmm2, xmm0
pabsd xmm0, xmm2
movups xmm2, xmmword [edx + eax - 0x20]
paddd xmm0, xmm3
psrad xmm0, xmm4
paddd xmm6, xmm0
movd xmm0, dword [esi + ecx + 4]
pmovzxbd xmm0, xmm0
pmulld xmm0, xmm1
psubd xmm2, xmm0
add ecx, 8
pabsd xmm0, xmm2
paddd xmm0, xmm3
psrad xmm0, xmm4
paddd xmm5, xmm0
cmp ecx, dword [ebp - 0xc]
jl 0x10098520
mov edx, dword [ebp + 0x14]
lea eax, [ebx*4]
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
cmp ecx, ebx
jge 0x10098678
mov eax, ebx
sub eax, ecx
cmp eax, 2
jl 0x10098635
lea eax, [ebx - 1]
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ecx + 1]
lea eax, [edi + eax*4]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov edx, eax
sub edx, edi
mov edi, ebx
mov dword [ebp - 0x14], edx
movzx edx, byte [ecx + esi]
imul edx, dword [eax + ecx*4]
mov eax, dword [ebp - 4]
mov eax, dword [eax - 4]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [ecx + esi + 1]
mov esi, dword [ebp - 0x14]
add eax, 0x800
sar eax, 0xc
add ecx, 2
add ebx, eax
mov eax, dword [ebp - 4]
add dword [ebp - 4], 8
imul edx, dword [esi + eax]
mov eax, dword [eax]
mov esi, dword [ebp + 8]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, ecx
add eax, 0x800
sar eax, 0xc
add edi, eax
mov eax, dword [ebp + 0x14]
cmp ecx, dword [ebp - 0x18]
jl 0x100985d0
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp + 0x10]
cmp edx, ebx
jge 0x10098660
mov edx, dword [ebp + 0x14]
lea eax, [ecx*4]
movzx ecx, byte [ecx + esi]
imul ecx, dword [eax + edx]
mov eax, dword [eax + edi]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ebp - 8]
add eax, 0x800
sar eax, 0xc
add edx, eax
jmp 0x10098663
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x10]
add edx, eax
lea eax, [ebx*4]
mov dword [ebp - 8], edx
mov edx, dword [ebp + 0x14]
add esi, dword [ebp + 0xc]
add edi, eax
add edx, eax
mov dword [ebp + 8], esi
sub dword [ebp + 0x1c], 1
mov dword [ebp + 0x10], edi
mov dword [ebp + 0x14], edx
jne 0x100984d0
mov eax, dword [ebp - 8]
paddd xmm5, xmm6
movaps xmm0, xmm5
psrldq xmm0, 8
paddd xmm5, xmm0
movups xmm0, xmm5
psrldq xmm0, 4
paddd xmm5, xmm0
movd ecx, xmm5
pop edi
pop esi
add eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10147de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
vmovdqu ymm1, ymmword [0x103e1020]
sub esp, 0x18
vpxor xmm2, xmm2, xmm2
push edi
mov edi, dword [ebp + 0x28]
test edi, edi
jle 0x10147f16
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x20]
add eax, eax
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
add eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
add eax, eax
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
cmp dword [ebp + 0x2c], 0
jle 0x10147ef1
mov edi, dword [ebp + 8]
mov esi, eax
mov eax, dword [ebp + 0x2c]
sub edi, ecx
dec eax
mov dword [ebp - 8], edx
sub esi, edx
shr eax, 4
mov dword [ebp - 4], ecx
mov edx, ecx
mov ecx, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], edi
nop dword [eax]
mov edi, dword [ebp + 0x24]
lea edx, [edx + 0x10]
lea ecx, [ecx + 0x20]
vmovdqu ymm5, ymmword [esi + ecx - 0x20]
vmovdqu xmm0, xmmword [edx + edi - 0x10]
mov edi, dword [ebp + 0x30]
vpaddusb xmm0, xmm0, xmmword [edx - 0x10]
vpavgb xmm0, xmm0, xmm2
vpmovzxbw ymm7, xmm0
vpunpckhwd ymm0, ymm5, ymmword [ecx - 0x20]
vpsubw ymm6, ymm1, ymm7
vpunpckhwd ymm1, ymm7, ymm6
vpmaddwd ymm0, ymm0, ymm1
vpsubd ymm1, ymm0, ymmword [edi]
vmovd xmm0, dword [ebp + 0x34]
vpsrad ymm2, ymm1, xmm0
vpunpcklwd ymm0, ymm5, ymmword [ecx - 0x20]
vpunpcklwd ymm1, ymm7, ymm6
vpmaddwd ymm0, ymm0, ymm1
vpsubd ymm1, ymm0, ymmword [edi]
mov edi, dword [ebp - 0xc]
vmovd xmm0, dword [ebp + 0x34]
vpsrad ymm0, ymm1, xmm0
vmovdqu ymm1, ymmword [0x103e1020]
vpackssdw ymm0, ymm0, ymm2
vpackuswb ymm0, ymm0, ymm0
vpermq ymm0, ymm0, 0xd8
vmovdqu xmmword [edi + edx - 0x10], xmm0
vpxor xmm2, xmm2, xmm2
sub eax, 1
jne 0x10147e50
vmovdqu ymm1, ymmword [0x103e1020]
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x28]
add ecx, dword [ebp - 0x10]
add esi, dword [ebp + 0xc]
add eax, dword [ebp - 0x14]
add edx, dword [ebp - 0x18]
sub edi, 1
mov dword [ebp + 0x20], ecx
mov dword [ebp + 8], esi
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x18], edx
mov dword [ebp + 0x28], edi
jne 0x10147e23
pop esi
pop edi
vzeroupper
mov esp, ebp
pop ebp
ret
Function at 0x101892e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov cl, byte [ecx + 0x1155]
mov eax, dword [eax + 0x1e4]
sub eax, dword [ebp + 0x10]
mov byte [ebp - 1], cl
movzx ecx, cl
cmp ecx, eax
mov esi, ecx
push edi
cmovge esi, eax
mov eax, 0x10
cmp esi, eax
cmovge esi, eax
mov eax, dword [ebp + 0x18]
cdq
xor ebx, ebx
xor eax, edx
mov dword [ebp - 0x14], esi
sub eax, edx
mov dword [ebp - 8], eax
cmp eax, 1
jle 0x1018933c
mov ebx, 1
test byte [ebp + 0x10], bl
je 0x1018933c
xor eax, eax
cmp ecx, 2
cmovb ebx, eax
xor edi, edi
test esi, esi
jle 0x10189423
mov eax, dword [ebp + 8]
add eax, 0x3a98
mov dword [ebp + 8], 2
mov dword [ebp - 0xc], eax
nop dword [eax + eax]
mov esi, dword [ebp + 0xc]
lea ecx, [edi + ebx]
imul ecx, dword [esi + 8]
mov eax, dword [esi + 0xfd0]
mov dl, byte [esi + 0x1155]
movzx esi, dl
add ecx, dword [ebp + 0x18]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
mov dword [ebp + 0x10], eax
mov dh, byte [eax + 0x10409e18]
movzx eax, dh
cmp esi, eax
cmovae esi, eax
cmp byte [ebp - 1], 0x10
jb 0x101893a8
cmp esi, 4
mov eax, 4
cmovb esi, eax
jmp 0x101893ba
cmp dword [ebp - 8], 1
jle 0x101893ba
mov eax, 2
cmp esi, eax
cmova eax, esi
mov esi, eax
mov ecx, 2
cmp dl, cl
jb 0x101893ef
cmp dl, dh
ja 0x101893ef
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x38]
movzx ecx, byte [eax + 0x10409e00]
mov eax, dword [ebp + 0x18]
sub eax, dword [ebp + 0x34]
inc eax
cmp eax, ecx
cmovge eax, ecx
cmp eax, 2
mov ecx, eax
cmovl ecx, dword [ebp + 8]
sub eax, dword [ebp + 0x18]
dec eax
mov dword [edx], eax
mov eax, esi
imul eax, ecx
push eax
push dword [ebp - 0xc]
push dword [ebp + 0x30]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x14]
push dword [ebp - 0x10]
call fcn.10187570
add edi, esi
add esp, 0x28
cmp edi, dword [ebp - 0x14]
jl 0x10189360
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret