joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10093cc0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov ebx, ecx
push edi
push 8
push 0x31
mov ecx, dword [ebx + 0x10]
mov dword [esp + 0x18], ebx
call fcn.100946a0
mov ecx, dword [ebx + 0x10]
push 8
push 0x41
call fcn.100946a0
mov ecx, dword [ebx + 0x10]
push 8
push 0x59
call fcn.100946a0
mov ecx, dword [ebx + 0x10]
push 8
push 0x26
call fcn.100946a0
mov ecx, dword [ebx + 0x10]
push 8
push 0x53
call fcn.100946a0
mov ecx, dword [ebx + 0x10]
push 8
push 0x59
call fcn.100946a0
mov ebp, dword [esp + 0x18]
or esi, 0xffffffff
xor ebx, ebx
xor edi, edi
mov dh, byte [ebp]
mov dl, byte [edi + ebp]
mov byte [esp + 0x18], dh
cmp ebx, 4
jne 0x10093d4e
test dl, dl
je 0x10093d4a
movzx ecx, dh
mov eax, esi
shl esi, 8
shr eax, 0x18
xor eax, ecx
xor esi, dword [eax*4 + 0x1010b428]
add dl, 0xff
jne 0x10093d34
xor ebx, ebx
jmp 0x10093d7c
cmp dh, dl
movzx ecx, dh
movzx eax, dl
cmovne ecx, eax
movzx eax, dl
mov dh, cl
inc ebx
mov ecx, esi
shl esi, 8
shr ecx, 0x18
xor ecx, eax
mov eax, 1
xor esi, dword [ecx*4 + 0x1010b428]
cmp byte [esp + 0x18], dl
cmovne ebx, eax
inc edi
cmp edi, dword [esp + 0x1c]
jb 0x10093d21
mov ecx, dword [esp + 0x10]
not esi
push esi
call fcn.100947e0
push dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
push ebp
call fcn.10093340
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x100a2410
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x14
push ebx
mov ebx, ecx
mov ecx, dword [esp + 0x1c]
movzx edx, word [ebx + 8]
push ebp
lea ebp, [ebx + 8]
mov dword [esp + 0x14], ebx
mov eax, dword [ecx + 8]
inc eax
mov dword [esp + 0xc], ebp
imul eax, edx
xor edx, edx
push esi
push edi
mov esi, 1
dec eax
div dword [ecx + 4]
movzx ecx, word [ebx + 0xa]
lea edx, [ebx + 0xa]
mov edi, eax
cmp ecx, edi
jbe 0x100a245c
nop dword [eax + eax]
movzx eax, word [edx + 2]
lea edx, [edx + 2]
inc esi
cmp eax, edi
ja 0x100a2450
movzx eax, word [ebp]
mov ecx, dword [esp + 0x28]
push eax
movzx eax, word [ebx + esi*2 + 6]
push eax
movzx eax, word [ebx + esi*2 + 8]
push eax
call fcn.100a25e0
movzx edi, byte [esi + ebx + 0x89]
lea ecx, [ebx + 8]
dec esi
mov dword [esp + 0x20], edi
lea ecx, [ecx + esi*2]
nop dword [eax]
add word [ecx], 8
lea ecx, [ecx - 2]
mov eax, esi
dec esi
test eax, eax
jne 0x100a2490
mov eax, 0xed8
cmp word [ebp], ax
jbe 0x100a25cf
add dword [ebx + 4], 0xffffffff
jne 0x100a25a1
xor esi, esi
mov dword [ebx + 4], 0x32
cmp dword [ebx], esi
jbe 0x100a24dd
mov edx, ebp
movzx ecx, word [edx]
lea edx, [edx + 2]
movzx eax, word [edx]
inc esi
sub ecx, eax
inc ecx
sar ecx, 1
mov word [edx - 2], cx
cmp esi, dword [ebx]
jb 0x100a24c6
mov eax, dword [ebx]
xor esi, esi
mov dword [esp + 0x10], esi
sub eax, 1
je 0x100a257d
mov ecx, 1
lea eax, [ebx + 0x89]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cmp ecx, dword [ebx]
jae 0x100a2561
lea edi, [ebp + 2]
nop word [eax + eax]
movzx ecx, word [edi]
movzx edx, word [ebp]
cmp dx, cx
jae 0x100a2551
mov esi, edx
mov edx, dword [esp + 0x28]
mov dl, byte [ebx + edx + 0x89]
mov word [ebp], cx
mov cl, byte [eax + ebx + 0x8a]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x18]
mov byte [ebx + ebp], cl
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
mov word [edi], si
mov byte [eax + ebx + 0x8a], dl
inc eax
add edi, 2
cmp eax, dword [ebx]
jb 0x100a2510
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov eax, dword [ebx]
inc esi
add ebp, 2
mov dword [esp + 0x10], esi
inc ecx
mov dword [esp + 0x14], ebp
dec eax
mov dword [esp + 0x28], ecx
cmp esi, eax
jb 0x100a2501
mov edi, dword [esp + 0x20]
lea edx, [esi + 4]
lea edx, [ebx + edx*2]
mov cx, word [edx + 2]
lea edx, [edx - 2]
add word [edx + 2], cx
mov ecx, esi
dec esi
test ecx, ecx
jne 0x100a2583
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
mov edx, dword [ebx]
lea ecx, [ebx + 8]
dec edx
lea ecx, [ecx + edx*2]
nop word [eax + eax]
shr word [ecx], 1
movzx eax, word [ecx]
movzx esi, word [ecx + 2]
cmp ax, si
ja 0x100a25c5
lea eax, [esi + 1]
mov word [ecx], ax
mov eax, edx
sub ecx, 2
dec edx
test eax, eax
jne 0x100a25b0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x100a7fd0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
xor bl, bl
push edi
mov edi, ecx
xor dl, dl
mov ecx, dword [esp + 0x10]
xor eax, eax
mov byte [edi + 4], 0
mov dword [edi], 0xffffffff
test esi, esi
je 0x100a80b5
cmp esi, 0x20
jb 0x100a8060
mov edx, esi
xorps xmm2, xmm2
and edx, 0xffffffe0
movaps xmm1, xmm2
nop word [eax + eax]
movups xmm0, xmmword [ecx + eax]
pxor xmm2, xmm0
movups xmm0, xmmword [ecx + eax + 0x10]
add eax, 0x20
pxor xmm1, xmm0
cmp eax, edx
jb 0x100a8010
pxor xmm1, xmm2
movaps xmm0, xmm1
psrldq xmm0, 8
pxor xmm1, xmm0
movaps xmm0, xmm1
psrldq xmm0, 4
pxor xmm1, xmm0
movaps xmm0, xmm1
psrldq xmm0, 2
pxor xmm1, xmm0
movaps xmm0, xmm1
psrldq xmm0, 1
pxor xmm1, xmm0
movd edx, xmm1
cmp eax, esi
jae 0x100a806c
xor dl, byte [eax + ecx]
inc eax
cmp eax, esi
jb 0x100a8064
test dl, dl
jne 0x100a80b5
test esi, esi
je 0x100a80b5
mov edx, esi
mov byte [edi + 4], 1
mov bl, 1
call fcn.100cc8c0
mov edx, eax
xor ecx, ecx
xor eax, eax
cmp dword [eax + 0x100efa64], edx
jne 0x100a8097
cmp dword [eax + 0x100efa60], esi
je 0x100a80a3
add eax, 0xc
inc ecx
cmp eax, 0x48
jb 0x100a8087
or ecx, 0xffffffff
mov dword [edi], ecx
test ecx, ecx
js 0x100a80b1
pop edi
pop esi
mov al, 1
pop ebx
ret 8
mov byte [edi + 4], 0
pop edi
pop esi
mov al, bl
pop ebx
ret 8

Function at 0x100ade00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x80
push ebx
push ebp
push esi
push edi
push 5
lea edx, [esp + 0x14]
mov ebx, ecx
call fcn.100c4340
push 5
lea edx, [esp + 0x54]
lea ecx, [ebx + 0x60]
call fcn.100c4340
mov esi, dword [esp + 0x94]
mov edi, dword [esp + 0x98]
mov eax, dword [esi]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x10]
mov dword [esp + 0x20], eax
test edi, edi
je 0x100adea8
nop dword [eax]
lea eax, [esp + 0x50]
mov ecx, ebx
push eax
lea edx, [esp + 0x14]
call fcn.100c44b0
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x54]
lea ecx, [ebx + 0x60]
call fcn.100c44b0
mov eax, dword [esp + 0x10]
xor dword [esi], eax
mov eax, dword [esp + 0x14]
xor dword [esi + 4], eax
mov eax, dword [esp + 0x18]
xor dword [esi + 8], eax
mov eax, dword [esp + 0x1c]
xor dword [esi + 0xc], eax
mov eax, dword [esp + 0x20]
xor dword [esi + 0x10], eax
sub edi, 1
jne 0x100ade60
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret 8
Function at 0x100adec0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xb4
push ebp
push esi
xorps xmm0, xmm0
mov ebp, ecx
push edi
mov edi, dword [esp + 0xc8]
movups xmmword [esp + 0xc], xmm0
movups xmmword [esp + 0x1c], xmm0
movups xmmword [esp + 0x2c], xmm0
movups xmmword [esp + 0x3c], xmm0
cmp edi, 0x40
jbe 0x100adf34
lea ecx, [esp + 0x60]
call fcn.100c4c00
mov edx, dword [esp + 0xc4]
lea ecx, [esp + 0x60]
push edi
call fcn.100c4c40
lea edx, [esp + 0x4c]
lea ecx, [esp + 0x60]
call fcn.100c43f0
xor eax, eax
nop word [eax + eax]
mov ecx, dword [esp + eax + 0x4c]
bswap ecx
mov dword [esp + eax + 0xc], ecx
add eax, 4
cmp eax, 0x14
jb 0x100adf20
jmp 0x100adf6b
xor esi, esi
test edi, edi
je 0x100adf6b
push ebx
mov ebx, dword [esp + 0xc8]
mov eax, esi
lea edx, [esp + 0x10]
shr eax, 2
mov ecx, 3
lea edx, [edx + eax*4]
mov eax, esi
and eax, 3
sub ecx, eax
movzx eax, byte [esi + ebx]
shl ecx, 3
inc esi
shl eax, cl
or dword [edx], eax
cmp esi, edi
jb 0x100adf42
pop ebx
movaps xmm1, xmmword [str.6666666666666666jjjjjjjjjjjjjjjjp]
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
movups xmm0, xmmword [esp + eax*4 + 0xc]
pxor xmm0, xmm1
movups xmmword [esp + eax*4 + 0xc], xmm0
movups xmm0, xmmword [esp + eax*4 + 0x1c]
pxor xmm0, xmm1
movups xmmword [esp + eax*4 + 0x1c], xmm0
add eax, 8
cmp eax, 0x10
jb 0x100adf80
mov ecx, ebp
call fcn.100c4c00
push 0x10
lea edx, [esp + 0x10]
mov ecx, ebp
call fcn.100c43a0
movaps xmm1, xmmword [0x100efcd0]
xor eax, eax
movups xmm0, xmmword [esp + eax*4 + 0xc]
pxor xmm0, xmm1
movups xmmword [esp + eax*4 + 0xc], xmm0
movups xmm0, xmmword [esp + eax*4 + 0x1c]
pxor xmm0, xmm1
movups xmmword [esp + eax*4 + 0x1c], xmm0
add eax, 8
cmp eax, 0x10
jb 0x100adfc1
lea ecx, [ebp + 0x60]
call fcn.100c4c00
push 0x10
lea edx, [esp + 0x10]
lea ecx, [ebp + 0x60]
call fcn.100c43a0
pop edi
pop esi
pop ebp
add esp, 0xb4
ret 8
Function at 0x100ae010
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
xorps xmm0, xmm0
push esi
mov esi, dword [esp + 0x4c]
push edi
mov edi, ecx
movups xmmword [esp + 8], xmm0
movups xmmword [esp + 0x18], xmm0
movups xmmword [esp + 0x28], xmm0
movups xmmword [esp + 0x38], xmm0
cmp esi, 0x40
jbe 0x100ae055
call fcn.100c4c00
mov edx, dword [esp + 0x4c]
mov ecx, edi
push esi
call fcn.100c4c40
lea edx, [esp + 8]
mov ecx, edi
call fcn.100c43f0
jmp 0x100ae06b
test esi, esi
je 0x100ae06b
push esi
push dword [esp + 0x50]
lea eax, [esp + 0x10]
push eax
call fcn.100cf690
add esp, 0xc
movaps xmm1, xmmword [str.6666666666666666jjjjjjjjjjjjjjjjp]
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
movups xmm0, xmmword [esp + eax + 8]
pxor xmm0, xmm1
movups xmmword [esp + eax + 8], xmm0
movups xmm0, xmmword [esp + eax + 0x18]
pxor xmm0, xmm1
movups xmmword [esp + eax + 0x18], xmm0
add eax, 0x20
cmp eax, 0x40
jb 0x100ae080
mov ecx, edi
call fcn.100c4c00
push 0x40
lea edx, [esp + 0xc]
mov ecx, edi
call fcn.100c4c40
movaps xmm1, xmmword [0x100efcd0]
xor eax, eax
movups xmm0, xmmword [esp + eax + 8]
pxor xmm0, xmm1
movups xmmword [esp + eax + 8], xmm0
movups xmm0, xmmword [esp + eax + 0x18]
pxor xmm0, xmm1
movups xmmword [esp + eax + 0x18], xmm0
add eax, 0x20
cmp eax, 0x40
jb 0x100ae0c1
lea ecx, [edi + 0x60]
call fcn.100c4c00
push 0x40
lea edx, [esp + 0xc]
lea ecx, [edi + 0x60]
call fcn.100c4c40
pop edi
pop esi
add esp, 0x40
ret 8

Function at 0x100ae140
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
xorps xmm0, xmm0
push esi
mov esi, dword [esp + 0x4c]
push edi
mov edi, ecx
movups xmmword [esp + 8], xmm0
movups xmmword [esp + 0x18], xmm0
movups xmmword [esp + 0x28], xmm0
movups xmmword [esp + 0x38], xmm0
cmp esi, 0x40
jbe 0x100ae185
call fcn.100c5650
mov edx, dword [esp + 0x4c]
mov ecx, edi
push esi
call fcn.100c56a0
lea edx, [esp + 8]
mov ecx, edi
call fcn.100c5590
jmp 0x100ae19b
test esi, esi
je 0x100ae19b
push esi
push dword [esp + 0x50]
lea eax, [esp + 0x10]
push eax
call fcn.100cf690
add esp, 0xc
movaps xmm1, xmmword [str.6666666666666666jjjjjjjjjjjjjjjjp]
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
movups xmm0, xmmword [esp + eax + 8]
pxor xmm0, xmm1
movups xmmword [esp + eax + 8], xmm0
movups xmm0, xmmword [esp + eax + 0x18]
pxor xmm0, xmm1
movups xmmword [esp + eax + 0x18], xmm0
add eax, 0x20
cmp eax, 0x40
jb 0x100ae1b0
mov ecx, edi
call fcn.100c5650
push 0x40
lea edx, [esp + 0xc]
mov ecx, edi
call fcn.100c56a0
movaps xmm1, xmmword [0x100efcd0]
xor eax, eax
movups xmm0, xmmword [esp + eax + 8]
pxor xmm0, xmm1
movups xmmword [esp + eax + 8], xmm0
movups xmm0, xmmword [esp + eax + 0x18]
pxor xmm0, xmm1
movups xmmword [esp + eax + 0x18], xmm0
add eax, 0x20
cmp eax, 0x40
jb 0x100ae1f1
lea ecx, [edi + 0x68]
call fcn.100c5650
push 0x40
lea edx, [esp + 0xc]
lea ecx, [edi + 0x68]
call fcn.100c56a0
pop edi
pop esi
add esp, 0x40
ret 8
Function at 0x100ae750
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x20]
call fcn.100c5650
mov ebx, 0x3e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 4
lea edx, [esp + 0x18]
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x24]
call fcn.100c56a0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 4
lea edx, [esp + 0x18]
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x24]
call fcn.100c56a0
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x100ae7f1
push str.SystemFunction036
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100ae7ea
push 0x20
lea ecx, [esp + 0x8c]
push ecx
call eax
test al, al
je 0x100ae7ea
push 0x20
lea edx, [esp + 0x8c]
mov ebx, 0x64
lea ecx, [esp + 0x24]
call fcn.100c56a0
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebp, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x18]
push eax
call ebp
test eax, eax
je 0x100ae811
push 8
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x24]
call fcn.100c56a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 4
lea edx, [esp + 0x18]
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x24]
call fcn.100c56a0
mov esi, 0x64
nop
mov edx, edi
lea ecx, [esp + 0x20]
call fcn.100c5590
lea ecx, [esp + 0x20]
call fcn.100c5650
push 0x20
mov edx, edi
lea ecx, [esp + 0x24]
call fcn.100c56a0
sub esi, 1
jne 0x100ae830
sub ebx, 1
jne 0x100ae7f7
mov edx, edi
lea ecx, [esp + 0x20]
call fcn.100c5590
mov byte [edi + 0x20], bl
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100aebc0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x14]
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x20], 4
lea eax, [edx + 1]
mov ecx, edx
sub ecx, eax
mov dword [esp + 0x10], ecx
mov ecx, edx
mov ebx, dword [esi + 0x104]
sub ecx, eax
mov ebp, dword [esi + 0x108]
add ecx, 2
sub edx, eax
mov dword [esp + 0x14], ecx
push edi
mov edi, dword [esi + 0x100]
lea ecx, [edx + 3]
mov edx, dword [esi + 0x10c]
mov dword [esp + 0x1c], ecx
nop dword [eax]
mov ecx, dword [esp + 0x14]
lea eax, [eax + 4]
movzx ecx, byte [ecx + eax - 4]
xor edi, dword [ecx*4 + 0x101118e0]
mov dword [esi + 0x100], edi
movzx ecx, byte [eax - 4]
xor ebx, dword [ecx*4 + 0x101118e0]
mov ecx, dword [esp + 0x18]
mov dword [esi + 0x104], ebx
movzx ecx, byte [ecx + eax - 4]
xor ebp, dword [ecx*4 + 0x101118e0]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x108], ebp
movzx ecx, byte [ecx + eax - 4]
xor edx, dword [ecx*4 + 0x101118e0]
sub dword [esp + 0x24], 1
mov dword [esi + 0x10c], edx
jne 0x100aec10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x100af1e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xf4
push ebx
push esi
push edi
lea eax, [ecx + 0x194]
push 0x20
push eax
lea ecx, [esp + 0x38]
call fcn.100ae140
mov eax, dword [esp + 0x104]
lea edx, [esp + 0xc]
push 4
lea ecx, [esp + 0x34]
mov dword [esp + 0x10], eax
call fcn.100c56a0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x34]
call fcn.100ae110
xor ebx, ebx
mov edx, 0xfffffffe
nop word [eax + eax]
movzx edi, byte [esp + edx + 0x12]
lea ecx, [edx - 2]
movzx eax, byte [esp + edx + 0x15]
and ecx, 3
movzx esi, byte [esp + edx + 0x14]
shl ecx, 3
shl edi, cl
lea ecx, [edx + 1]
and ecx, 3
shl ecx, 3
shl eax, cl
lea ecx, [edx - 1]
and ecx, 3
xor edi, eax
movzx eax, byte [esp + edx + 0x13]
shl ecx, 3
shl eax, cl
mov ecx, edx
and ecx, 3
add edx, 4
shl ecx, 3
xor edi, eax
shl esi, cl
xor edi, esi
lea ecx, [edx + 2]
xor ebx, edi
cmp ecx, 0x20
jb 0x100af230
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0xf4
ret 4

Function at 0x100b0120
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xa0
push esi
movzx eax, dl
mov esi, ecx
push 0x40
push eax
lea eax, [esp + 0xc]
push eax
call fcn.100d15a0
movups xmm0, xmmword [esp + 0x10]
add esp, 0xc
mov eax, 0x10
movups xmm1, xmmword [esi]
pxor xmm1, xmm0
movups xmmword [esp + 4], xmm1
mov cl, byte [eax + esi]
xor byte [esp + eax + 4], cl
inc eax
cmp eax, 0x14
jb 0x100b0152
lea ecx, [esp + 0x44]
call fcn.100c4c00
push 0x40
lea edx, [esp + 8]
lea ecx, [esp + 0x48]
call fcn.100c4c40
mov edx, dword [esp + 0xa8]
lea ecx, [esp + 0x44]
call fcn.100c43f0
pop esi
add esp, 0xa0
ret 4
Function at 0x100b18a0
Capabilities:
Encode data using xor

Disassembly:
movups xmm0, xmmword [0x100efef8]
mov dword [ecx + 0x400], 0
xor edx, edx
movups xmm1, xmmword [0x100efee8]
lea eax, [ecx + 0x24]
nop dword [eax]
movups xmmword [eax - 0x24], xmm1
lea eax, [eax + 0x80]
movups xmmword [eax - 0x94], xmm0
xor dword [eax - 0x9c], edx
inc edx
xor dword [eax - 0xa4], 0x2080020
xor dword [eax - 0x98], 0x20000000
mov dword [eax - 0x84], 0
mov dword [eax - 0x80], 0
mov dword [eax - 0x7c], 0
mov dword [eax - 0x78], 0
mov dword [eax - 0x34], 0
mov dword [eax - 0x30], 0
cmp edx, 8
jb 0x100b18c0
mov dword [ecx + 0x3f4], 0xffffffff
ret

Function at 0x100b1cd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x14]
mov ebx, ecx
push edi
xor edi, edi
mov dword [esp + 0xc], ebx
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x100b1cf3
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
push ebp
lea ebp, [edx - 4]
mov edx, dword [esp + 0x20]
add ebp, ebx
nop dword [eax]
lea eax, [edi + ebx]
cmp eax, ebp
jae 0x100b1d16
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x100b1d16
inc eax
cmp eax, ebp
jb 0x100b1d07
mov ecx, eax
sub ecx, edi
mov edi, eax
sub ecx, ebx
sub edi, ebx
cmp eax, ebp
jae 0x100b1e19
cmp ecx, 2
jbe 0x100b1d6b
xor esi, esi
movzx ebx, byte [eax + 4]
lea ecx, [ebx + 1]
test cl, 0xfe
jne 0x100b1e04
movzx ecx, byte [eax + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 2]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [eax + 1]
shl ebx, 8
or ebx, ecx
mov ecx, dword [esp + 0x18]
add ecx, 5
add ecx, edi
test edx, edx
je 0x100b1d95
add ebx, ecx
jmp 0x100b1d97
shr esi, cl
test esi, esi
je 0x100b1d2f
cmp esi, 4
ja 0x100b1d8a
cmp esi, 3
je 0x100b1d8a
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x100b1d2f
or esi, 8
shr esi, 1
inc edi
jmp 0x100b1d00
sub ebx, ecx
test esi, esi
je 0x100b1dd6
and esi, 6
mov edx, ebx
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x100b1dd0
mov edx, 0x100
shl edx, cl
mov ecx, dword [esp + 0x18]
dec edx
add ecx, 5
xor ebx, edx
mov edx, dword [esp + 0x20]
add ecx, edi
test edx, edx
je 0x100b1dcc
add ebx, ecx
jmp 0x100b1dd4
sub ebx, ecx
jmp 0x100b1dd4
mov edx, dword [esp + 0x20]
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov byte [eax + 4], bl
mov eax, 5
mov ebx, dword [esp + 0x10]
add edi, eax
jmp 0x100b1d00
mov ebx, dword [esp + 0x10]
or esi, 8
mov eax, 1
shr esi, 1
add edi, eax
jmp 0x100b1d00
pop ebp
cmp ecx, 2
jbe 0x100b1e30
mov eax, dword [esp + 0x18]
xor esi, esi
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
mov eax, dword [esp + 0x18]
shr esi, cl
mov dword [eax], esi
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
Function at 0x100b3a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x2c
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [esp + 0x30], ebx
mov eax, dword [esi + 0x10]
mov dword [esp + 0x1c], eax
cmp eax, 3
jae 0x100b3ab6
inc dword [esi + 4]
inc dword [esi + 0x14]
inc dword [esi]
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
jne 0x100b3aae
call fcn.100b4040
pop esi
xor eax, eax
pop ebx
add esp, 0x2c
ret
mov ecx, dword [esi]
push ebp
push edi
mov dword [esp + 0x10], 2
movzx edx, byte [ecx]
movzx eax, byte [ecx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 1]
xor edx, dword [esi + eax*4 + 0x60]
mov eax, dword [esi + 0x24]
movzx ecx, dx
mov ebp, dword [eax + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [esi + 4]
mov dword [ecx], eax
mov eax, dword [esi + 0x30]
mov ecx, dword [esi]
mov edi, dword [esi + 0x18]
mov edx, dword [esi + 4]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x28]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
add eax, ecx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edx
mov dword [ecx + eax*4], ebp
mov ecx, dword [esp + 0x14]
nop dword [eax]
sub edx, ebp
cmp edx, edi
jae 0x100b3bc9
cmp eax, edx
sbb eax, eax
and eax, edi
mov edi, dword [esp + 0x1c]
sub eax, edx
add eax, dword [esp + 0x18]
mov eax, dword [edi + eax*4]
mov edi, edx
mov dword [esp + 0x2c], eax
neg edi
mov eax, dword [esp + 0x10]
lea ebp, [edi + ecx]
mov al, byte [ecx + eax]
mov ecx, dword [esp + 0x10]
cmp al, byte [ecx + ebp]
mov ecx, dword [esp + 0x14]
jne 0x100b3b9e
mov eax, ecx
mov cl, byte [ecx]
cmp cl, byte [ebp]
jne 0x100b3b83
inc eax
cmp eax, dword [esp + 0x28]
je 0x100b3bba
mov cl, byte [eax]
cmp cl, byte [eax + edi]
je 0x100b3b75
mov ecx, dword [esp + 0x14]
sub eax, ecx
cmp dword [esp + 0x10], eax
jae 0x100b3b9e
mov dword [ebx], eax
mov dword [esp + 0x10], eax
lea eax, [edx - 1]
mov dword [ebx + 4], eax
add ebx, 8
sub dword [esp + 0x20], 1
je 0x100b3bc9
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x34]
jmp 0x100b3b30
mov eax, dword [esp + 0x24]
mov dword [ebx], eax
lea eax, [edx - 1]
mov dword [ebx + 4], eax
add ebx, 8
sub ebx, dword [esp + 0x38]
inc dword [esi + 4]
inc dword [esi + 0x14]
inc dword [esi]
mov ecx, dword [esi + 4]
sar ebx, 2
pop edi
pop ebp
cmp ecx, dword [esi + 8]
jne 0x100b3be9
mov ecx, esi
call fcn.100b4040
pop esi
mov eax, ebx
pop ebx
add esp, 0x2c
ret
Function at 0x100b40c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov dword [ecx + 0x34], 0
lea esi, [ecx + 0x60]
mov word [ecx + 0x1e], 0
xor edx, edx
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x468], 0xffffffff
mov dword [ecx + 0x46c], 0xffffffff
mov dword [ecx + 0x30], 0x20
mov byte [ecx + 0x1d], 1
mov dword [ecx + 0x48], 4
mov ecx, edx
lea esi, [esi + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [esi - 4], eax
cmp edx, 0x100
jb 0x100b4100
pop esi
ret