joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006e370
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [0x108651fc]
cmp byte [edi + 0x2f5d], 0
lea eax, [edi + 0x20]
jne 0x1006e495
mov ecx, dword [eax]
push ebx
test ecx, ecx
je 0x1006e48d
push esi
push 0x101d05f0
push ecx
call fcn.10062090
mov esi, eax
add esp, 8
test esi, esi
je 0x1006e489
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x1006e47f
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1006e47f
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp - 4], ebx
cmp ebx, 0xffffffff
je 0x1006e47f
push 0
push dword [ebp - 8]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x1006e47f
mov eax, dword [0x108651fc]
test eax, eax
je 0x1006e415
inc dword [eax + 0x36c]
push dword [0x10865204]
push ebx
call dword [0x10747008]
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1006e47f
push esi
push dword [ebp - 4]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp - 4]
je 0x1006e46b
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov eax, dword [0x108651fc]
test eax, eax
je 0x1006e459
dec dword [eax + 0x36c]
push dword [0x10865204]
push ebx
call dword [0x1074700c]
add esp, 8
jmp 0x1006e489
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push dword [ebp - 4]
push ebx
call fcn.10063d80
add esp, 0xc
jmp 0x1006e44a
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
lea eax, [edi + 0x20]
pop esi
mov byte [edi + 0x2f5d], 1
pop ebx
movss xmm0, dword [edi + 0x2f60]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x1006e4e6
subss xmm0, dword [edi + 0x18]
comiss xmm1, xmm0
movss dword [edi + 0x2f60], xmm0
jb 0x1006e4e6
mov eax, dword [eax]
test eax, eax
je 0x1006e4d5
push eax
call fcn.1006baf0
add esp, 4
mov dword [edi + 0x2f60], 0
pop edi
mov esp, ebp
pop ebp
ret
mov byte [edi + 0x354], 1
mov dword [edi + 0x2f60], 0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10070090
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015cb43
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10863dc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x28], 0
mov byte [ebp - 4], 2
mov eax, 0xffff
mov word [ecx + 0x3e], ax
xor eax, eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x3a], 0xffffffff
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov word [ecx + 0x38], ax
mov byte [ecx + 0x40], al
mov dword [ecx + 0x44], 0x3f800000
mov dword [ecx + 0x4c], eax
mov dword [ecx + 0x48], eax
mov dword [ecx + 0x50], eax
mov word [ecx + 0x54], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10077d70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x10077d97
push eax
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.100642f0
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x10077dbc
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.100642f0
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x10077de1
push eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.100642f0
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x44]
test eax, eax
je 0x10077e22
push eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.100642f0
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x10077e47
push eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.100642f0
add esp, 4
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x10077e6c
push eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.100642f0
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.100732f0
Function at 0x10080ce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015cdcd
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x10863dc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.10061640
mov esi, eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x10080eb2
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x10080eb2
push 0x38
call fcn.100642c0
mov edi, eax
add esp, 4
mov dword [ebp - 0x3c], edi
lea eax, [ebp - 0x21]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x10080d68
push 0x38
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x10080d6a
xor edi, edi
mov dword [ebp - 4], 0xffffffff
or dword [esi + 4], 6
mov edx, dword [ebp + 8]
mov dword [esi + 0xbc], edi
mov dword [esi + 0xb4], str.imgui_impl_win32
mov dword [edi], edx
mov byte [edi + 0x25], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov dword [edi + 0x20], 9
mov dword [esi + 0xd8], edx
mov dword [esi + 0x2c], 9
mov dword [esi + 0x30], 0x25
mov dword [esi + 0x34], 0x27
mov dword [esi + 0x38], 0x26
mov dword [esi + 0x3c], 0x28
mov dword [esi + 0x40], 0x21
mov dword [esi + 0x44], 0x22
mov dword [esi + 0x48], 0x24
mov dword [esi + 0x4c], 0x23
mov dword [esi + 0x50], 0x2d
mov dword [esi + 0x54], 0x2e
mov dword [esi + 0x58], 8
mov dword [esi + 0x5c], 0x20
mov dword [esi + 0x60], 0xd
mov dword [esi + 0x64], 0x1b
mov dword [esi + 0x68], 0xd
mov dword [esi + 0x6c], 0x41
mov dword [esi + 0x70], 0x43
mov dword [esi + 0x74], 0x56
mov dword [esi + 0x78], 0x58
mov dword [esi + 0x7c], 0x59
mov dword [esi + 0x80], 0x5a
xor esi, esi
mov dword [ebp - 0x38], str.xinput1_4.dll
mov dword [ebp - 0x34], str.xinput1_3.dll
mov dword [ebp - 0x30], str.xinput9_1_0.dll
mov dword [ebp - 0x2c], str.xinput1_2.dll
mov dword [ebp - 0x28], str.xinput1_1.dll
push dword [ebp + esi*4 - 0x38]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x10080e8f
inc esi
cmp esi, 5
jl 0x10080e75
mov al, 1
jmp 0x10080eb4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.XInputGetCapabilities
push ebx
mov dword [edi + 0x28], ebx
call esi
push str.XInputGetState
push ebx
mov dword [edi + 0x2c], eax
call esi
mov dword [edi + 0x30], eax
mov al, 1
jmp 0x10080eb4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10107e25
mov esp, ebp
pop ebp
ret
Function at 0x10099dd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x10099ea9
movd xmm0, dword [esi]
mov eax, 0x10
movups xmm2, xmmword [0x103f77d0]
movaps xmm1, xmmword [0x101d5bf0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
movd xmm0, dword [esi + 4]
movaps xmm1, xmmword [0x101d5c00]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 4], xmm1
movd xmm0, dword [esi + 8]
movaps xmm1, xmmword [0x101d5c10]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 8], xmm1
movd xmm0, dword [esi + 0xc]
movaps xmm1, xmmword [0x101d5c20]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 0xc], xmm1
lea edx, [esi + eax]
lea ecx, [eax - 0x31]
inc eax
xor byte [edx], cl
cmp eax, 0x16
jb 0x10099e97
mov byte [esi + 0x17], 0
mov eax, esi
pop esi
ret
Function at 0x1009a920
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10863dc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov ebx, dword [eax]
lea eax, [ebp - 8]
add ebx, dword [ebp + 0x10]
push eax
push 0x40
push 4
mov edi, dword [ebx]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
mov dword [ebx], ecx
push dword [ebp - 8]
push 4
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop ebx
call fcn.10107e25
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1009a980
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10863dc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [eax]
lea eax, [ebp - 8]
add edi, dword [ebp + 0x10]
push eax
push 0x40
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.10107e25
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1009a9d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xe], 0
je 0x1009aa42
movups xmm4, xmmword [0x103f77d0]
push esi
push edi
mov edi, 0xffffffd4
lea eax, [edi - 1]
movd xmm2, edi
lea esi, [edi - 3]
movd xmm0, eax
movd xmm3, esi
lea edx, [edi - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [ecx + edi + 0x2c]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ecx + edi + 0x2c], xmm3
add edi, 4
cmp edi, 0xffffffe0
jb 0x1009a9e4
xor byte [ecx + 0xc], 0xdd
pop edi
pop esi
mov byte [ecx + 0xe], 0
mov eax, ecx
ret
Function at 0x1009bf00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015d3be
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x10863dc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 1
call fcn.10107acd
lea edi, [esi + 4]
mov dword [ebp - 0x14], eax
push edi
push 0
push eax
push 0x1009cae0
push 0
push 0
mov dword [ebp - 0x18], 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x1009bfac
mov ecx, 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], ecx
and ecx, 0xfffffffe
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10107e25
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x1009d590
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015d708
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x10863dc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
mov esi, dword [0x10865b38]
mov dword [ebp - 0x14], esi
test esi, esi
je 0x1009d605
mov byte [ebp - 4], 2
lea ecx, [esi + 0x278]
call fcn.1001cf20
mov byte [ebp - 4], 1
lea ecx, [esi + 0x5c]
call fcn.1001cf20
mov byte [ebp - 4], 0
lea ecx, [esi + 0x10]
call fcn.1000f6a0
push 0x298
push esi
call fcn.10107afd
add esp, 8
mov esi, dword [0x10865248]
mov dword [ebp - 0x14], esi
test esi, esi
je 0x1009d647
mov byte [ebp - 4], 5
lea ecx, [esi + 0x278]
call fcn.1001cf20
mov byte [ebp - 4], 4
lea ecx, [esi + 0x5c]
call fcn.1001cf20
mov byte [ebp - 4], 0
lea ecx, [esi + 0x10]
call fcn.1000f6a0
push 0x298
push esi
call fcn.10107afd
add esp, 8
mov esi, dword [0x10865b40]
push 0xc
push esi
call fcn.10107afd
add esp, 8
test esi, esi
je 0x1009d666
mov dword [0x10865b40], 0x8123
mov esi, dword [0x10865b44]
push 0xc
push esi
call fcn.10107afd
add esp, 8
test esi, esi
je 0x1009d685
mov dword [0x10865b44], 0x8123
mov esi, dword [0x10865b68]
push 0xc
push esi
call fcn.10107afd
add esp, 8
test esi, esi
je 0x1009d6a4
mov dword [0x10865b68], 0x8123
mov eax, dword [0x10864f28]
push 0
push dword [eax + 0x6c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x10864f28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [eax + 0x6c]
call esi
mov eax, dword [0x10864f28]
push 0
push dword [eax + 0x60]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [0x10864f28]
push dword [eax + 0x60]
call esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebx + 8]
call fcn.1000f6a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1009f150
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x10863dc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x10866308]
push ebx
push edi
call fcn.100bf6f0
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [ebp + 8]
mov ebx, eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x34], 0xe92d4ff0
push eax
push 0x40
push 0x2d
add edi, 0x37f9548
mov dword [ebp - 0x30], 0xe59f0010
push edi
push ebx
mov dword [ebp - 0x2c], 0xe3a01001
mov dword [ebp - 0x28], 0xe08f0000
mov dword [ebp - 0x24], 0xebda672b
mov dword [ebp - 0x20], 0xe3a00000
mov dword [ebp - 0x1c], 0xe8bd8ff0
mov dword [ebp - 0x18], 0xc
mov dword [ebp - 0x14], 0x6862696c
mov dword [ebp - 0x10], 0x65706c65
mov dword [ebp - 0xc], 0x6f732e72
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 0x2d
lea eax, [ebp - 0x34]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push dword [ebp - 0x38]
push 0x2d
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop ebx
call fcn.10107e25
mov esp, ebp
pop ebp
ret
Function at 0x100aa040
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x100aa062
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax + 0x52]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x100aa050
mov byte [esi + 8], 0
mov eax, esi
pop esi
ret

Function at 0x100aa070
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, ecx
cmp byte [edi + 9], 0
je 0x100aa0ea
movups xmm4, xmmword [0x103f77d0]
mov eax, 0x55
push ebx
push esi
lea ebx, [eax - 0x53]
nop word [eax + eax]
lea ecx, [eax - 1]
movd xmm2, eax
lea esi, [eax - 3]
movd xmm0, ecx
movd xmm3, esi
lea edx, [eax - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + eax - 0x55]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + eax - 0x55], xmm3
add eax, 4
sub ebx, 1
jne 0x100aa090
pop esi
pop ebx
mov byte [edi + 9], 0
mov eax, edi
pop edi
ret

Function at 0x100aa0f0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, ecx
cmp byte [edi + 0x10], 0
je 0x100aa178
movups xmm4, xmmword [0x103f77d0]
push ebx
mov ebx, 0x55
push esi
lea eax, [ebx - 0x49]
nop word [eax + eax]
lea ecx, [ebx - 1]
movd xmm2, ebx
lea esi, [ebx - 3]
movd xmm0, ecx
movd xmm3, esi
lea edx, [ebx - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + ebx - 0x55]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + ebx - 0x55], xmm3
add ebx, 4
cmp ebx, 0x61
jb 0x100aa110
pop esi
pop ebx
lea edx, [edi + eax]
lea ecx, [eax + 0x52]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x100aa166
mov byte [edi + 0x10], 0
mov eax, edi
pop edi
ret

Function at 0x100aa320
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x100aa3f9
movd xmm0, dword [esi]
mov eax, 0x10
movups xmm2, xmmword [0x103f77d0]
movaps xmm1, xmmword [str.RSTUVWXYZ____a]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
movd xmm0, dword [esi + 4]
movaps xmm1, xmmword [0x1023c500]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 4], xmm1
movd xmm0, dword [esi + 8]
movaps xmm1, xmmword [0x1023c510]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 8], xmm1
movd xmm0, dword [esi + 0xc]
movaps xmm1, xmmword [0x1023c520]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 0xc], xmm1
lea edx, [esi + eax]
lea ecx, [eax + 0x52]
inc eax
xor byte [edx], cl
cmp eax, 0x13
jb 0x100aa3e7
mov byte [esi + 0x14], 0
mov eax, esi
pop esi
ret
Function at 0x100aa400
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x100aa4d9
movd xmm0, dword [esi]
mov eax, 0x10
movups xmm2, xmmword [0x103f77d0]
movaps xmm1, xmmword [str.RSTUVWXYZ____a]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
movd xmm0, dword [esi + 4]
movaps xmm1, xmmword [0x1023c500]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 4], xmm1
movd xmm0, dword [esi + 8]
movaps xmm1, xmmword [0x1023c510]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 8], xmm1
movd xmm0, dword [esi + 0xc]
movaps xmm1, xmmword [0x1023c520]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 0xc], xmm1
lea edx, [esi + eax]
lea ecx, [eax + 0x52]
inc eax
xor byte [edx], cl
cmp eax, 0x14
jb 0x100aa4c7
mov byte [esi + 0x15], 0
mov eax, esi
pop esi
ret

Function at 0x100aa4e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x100aa5b9
movd xmm0, dword [esi]
mov eax, 0x10
movups xmm2, xmmword [0x103f77d0]
movaps xmm1, xmmword [str.RSTUVWXYZ____a]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
movd xmm0, dword [esi + 4]
movaps xmm1, xmmword [0x1023c500]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 4], xmm1
movd xmm0, dword [esi + 8]
movaps xmm1, xmmword [0x1023c510]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 8], xmm1
movd xmm0, dword [esi + 0xc]
movaps xmm1, xmmword [0x1023c520]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 0xc], xmm1
lea edx, [esi + eax]
lea ecx, [eax + 0x52]
inc eax
xor byte [edx], cl
cmp eax, 0x15
jb 0x100aa5a7
mov byte [esi + 0x16], 0
mov eax, esi
pop esi
ret
Function at 0x100aa5c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x100aa699
movd xmm0, dword [esi]
mov eax, 0x10
movups xmm2, xmmword [0x103f77d0]
movaps xmm1, xmmword [str.RSTUVWXYZ____a]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
movd xmm0, dword [esi + 4]
movaps xmm1, xmmword [0x1023c500]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 4], xmm1
movd xmm0, dword [esi + 8]
movaps xmm1, xmmword [0x1023c510]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 8], xmm1
movd xmm0, dword [esi + 0xc]
movaps xmm1, xmmword [0x1023c520]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 0xc], xmm1
lea edx, [esi + eax]
lea ecx, [eax + 0x52]
inc eax
xor byte [edx], cl
cmp eax, 0x17
jb 0x100aa687
mov byte [esi + 0x18], 0
mov eax, esi
pop esi
ret

Function at 0x100aa6a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
je 0x100aa6c2
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax + 0x52]
inc eax
xor byte [edx], cl
cmp eax, 0xb
jb 0x100aa6b0
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
ret

Function at 0x100aa6d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, ecx
cmp byte [edi + 0xd], 0
je 0x100aa74a
movups xmm4, xmmword [0x103f77d0]
mov eax, 0x55
push ebx
push esi
lea ebx, [eax - 0x52]
nop word [eax + eax]
lea ecx, [eax - 1]
movd xmm2, eax
lea esi, [eax - 3]
movd xmm0, ecx
movd xmm3, esi
lea edx, [eax - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + eax - 0x55]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + eax - 0x55], xmm3
add eax, 4
sub ebx, 1
jne 0x100aa6f0
pop esi
pop ebx
mov byte [edi + 0xd], 0
mov eax, edi
pop edi
ret