joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1056f49
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x108e1f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp eax, edi
jne 0x1056f6f
xor al, al
jmp 0x1057066
mov dword [0x1098690], eax
mov eax, dword [ebp + 0xc]
mov dword [0x109868c], eax
mov al, byte [ebp + 0x10]
mov byte [0x10986ac], al
cmp dword [0x10986a4], edi
jne 0x1057064
push 0x1012168
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x10986a4], eax
cmp eax, edi
je 0x105703c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x101215c
push eax
call esi
push 0x1012148
push dword [0x10986a4]
mov dword [0x1098694], eax
call esi
mov dword [0x109869c], eax
pop esi
cmp dword [0x1098694], edi
jne 0x1056fdb
cmp eax, edi
je 0x105703c
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x105703c
cmp dword [ebp - 0x114], 6
jb 0x105703c
cmp dword [ebp - 0x110], edi
jne 0x105703c
cmp dword [ebp - 0x108], 2
jne 0x105703c
cmp dword [ebp - 0x10c], 0x147c
jae 0x105703c
mov eax, dword [0x1098694]
mov dword [0x1098698], eax
mov eax, dword [0x109869c]
mov dword [0x1098694], edi
mov dword [0x10986a0], eax
mov dword [0x109869c], edi
call fcn.0105ae22
mov byte [0x1098640], al
mov eax, 0xbb8
push eax
push 0x40
mov dword [0x10986f0], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x10986ec], eax
mov dword [0x1098644], edi
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.01034b69
leave
ret 0xc
Function at 0x10577eb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x1098690]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1057810
xor al, al
jmp 0x10578cb
push edi
push esi
push dword [0x1098690]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x105786b
push esi
push dword [0x1098690]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x105786b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp + 8], eax
test eax, eax
je 0x105786b
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, dword [ebp + 0x14]
mov dword [esi], eax
test eax, eax
je 0x105786b
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x105786f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [esi], 0
xor al, al
jmp 0x10578ca
push edi
push dword [ebp + 8]
push eax
call sub.msvcrt.dll_memcpy
and dword [ebp + 0xc], 0
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push 1
push dword [esi]
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov edi, dword [ebp + 0x10]
test eax, eax
jne 0x10578aa
push 0
push dword [ebp + 0xc]
call fcn.0104da71
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [edi]
test eax, eax
je 0x10578c8
mov ecx, dword [eax + 8]
and dword [eax + 8], 0
test ecx, ecx
jne 0x10578c8
xor eax, eax
inc eax
jmp 0x10578ca
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x105ac8d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
push ebx
push esi
mov eax, edx
push edi
mov dword [ebp - 0xc], edx
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x105aca3
sub eax, esi
sar eax, 1
mov dword [ebp - 4], eax
mov eax, 0x40000000
cmp dword [ebp - 4], eax
jbe 0x105acc1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jb 0x105ad66
mov ax, word [edx]
cmp ax, word [0x108e534]
jne 0x105ad66
push 0xa
xor esi, esi
add edx, 2
push esi
push edx
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x105ad66
shr eax, 4
inc eax
push esi
movzx ebx, ax
push ebx
push 6
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call esi
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceExW]
push eax
call edi
test eax, eax
jne 0x105ad2d
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
movzx eax, ax
push eax
push ebx
push 6
push 0
call esi
push eax
call edi
test eax, eax
je 0x105ad66
push eax
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x105ad66
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x105ad66
mov ecx, dword [ebp - 0x10]
and ecx, 0xf
jbe 0x105ad5a
dec ecx
movzx edx, word [eax]
lea eax, [eax + edx*2 + 2]
jne 0x105ad50
movzx ecx, word [eax]
add eax, 2
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], eax
mov esi, dword [ebp - 4]
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0103472f
mov edi, eax
pop ecx
test edi, edi
je 0x105ae16
add esi, esi
push esi
push dword [ebp - 0xc]
push edi
call sub.msvcrt.dll_memcpy
xor eax, eax
mov word [esi + edi], ax
add esp, 0xc
xor ebx, ebx
mov eax, edi
mov dword [ebp - 8], ebx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x105adaa
sub eax, ecx
sar eax, 1
jne 0x105adf5
push edi
call fcn.0103479e
mov eax, dword [ebp + 8]
pop ecx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x105adc7
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
lea eax, [esi + esi]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
push dword [ebp + 8]
mov dword [ebp - 8], eax
push esi
push eax
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
jmp 0x105ae13
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push 1
push eax
push ebx
push ebx
push edi
push 0x500
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push edi
call fcn.0103479e
pop ecx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x105c932
Capabilities:
Create thread

Disassembly:
mov edi, edi
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x105c942
call fcn.0105c8ec
lea eax, [esi + 8]
push eax
push 0
push esi
push 0x105c8bd
push 0
push 0
mov byte [esi + 0xc], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 4], eax
pop esi
ret
Function at 0x106115b
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x1098f20], 0
jne 0x106122c
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor ebx, ebx
inc ebx
cmp dword [ebp - 4], ebx
mov dword [ebp - 8], eax
jle 0x1061224
push 4
pop eax
push esi
push edi
mov ecx, dword [ebp - 8]
mov edi, dword [ecx + ebx*4]
mov edx, 0x1014b50
mov ecx, edi
mov si, word [ecx]
cmp si, word [edx]
jne 0x10611ca
test si, si
je 0x10611c6
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x10611ca
add ecx, eax
add edx, eax
test si, si
jne 0x10611a6
xor ecx, ecx
jmp 0x10611cf
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x106120f
mov edx, 0x1014b3c
mov ecx, edi
mov si, word [ecx]
cmp si, word [edx]
jne 0x10611fe
test si, si
je 0x10611fa
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x10611fe
add ecx, eax
add edx, eax
test si, si
jne 0x10611da
xor ecx, ecx
jmp 0x1061203
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
je 0x106121b
inc ebx
cmp ebx, dword [ebp - 4]
jl 0x1061199
jmp 0x1061222
mov dword [0x108e538], 2
jmp 0x1061222
and dword [0x108e538], 0
pop edi
pop esi
mov byte [0x1098f20], 1
pop ebx
mov eax, dword [0x108e538]
leave
ret

Function at 0x106138c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ecx]
xor edx, edx
test esi, esi
jbe 0x10613b7
push edi
mov edi, dword [ecx + 0xc]
mov cl, dl
add cl, 7
and cl, 0x1f
rol eax, cl
movzx ecx, byte [edi + edx]
xor eax, ecx
inc edx
cmp edx, esi
jb 0x10613a1
pop edi
pop esi
pop ebp
ret 4

Function at 0x1061426
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ecx]
push edi
mov edi, dword [ebp + 8]
test eax, eax
jbe 0x1061452
push ebx
push esi
mov esi, dword [ecx + 0xc]
mov ebx, eax
mov ecx, dword [esi]
push 0
call fcn.0106138c
rol edi, 0x11
xor edi, eax
add esi, 4
dec ebx
jne 0x106143c
pop esi
pop ebx
mov eax, edi
pop edi
pop ebp
ret 4

Function at 0x1061581
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
push edi
xor edi, edi
test eax, eax
jbe 0x10615a6
push ebx
push esi
mov esi, dword [ecx + 0xc]
mov ebx, eax
mov ecx, dword [esi]
push edi
call fcn.01061426
rol edi, 0xb
xor edi, eax
add esi, 4
dec ebx
jne 0x1061591
pop esi
pop ebx
mov eax, edi
pop edi
ret
Function at 0x106682d
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x108e1f8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.010667c2
mov eax, 0x1000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x98]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x10668a0
cmp dword [ebp - 0x94], 5
jb 0x10668c1
jmp 0x10668bd
cmp dword [ebp - 0x88], 1
jne 0x10668c1
cmp dword [ebp - 0x94], 4
ja 0x10668bd
jne 0x10668c1
cmp dword [ebp - 0x90], 0
jbe 0x10668c1
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x10184f0
call fcn.01066666
test eax, eax
jge 0x10668e2
mov byte [0x109698c], 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01034b69
leave
ret

Function at 0x1066b0e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x1099308], 0
push esi
jne 0x1066a7c
call fcn.01066973
test eax, eax
je 0x1066abf
mov eax, dword [0x1099308]
cmp eax, 1
jne 0x1066a9d
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1066abf
pop esi
ret
push eax
call dword [0x1099310]
test eax, eax
jne 0x1066b07
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1066ac3
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x1099308]
call dword [0x1099310]
mov edi, eax
test edi, edi
je 0x1066ae8
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1066b04
mov edi, esi
add esi, 0xff0
push edi
push dword [0x1099308]
call dword [0x109930c]
add edi, 0x10
cmp edi, esi
jb 0x1066af0
mov eax, edi
pop edi
pop esi
ret
jmp 0x1066a69

Function at 0x106cc74
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x2000000
push 0
push 0x101afd0
push 0x80000002
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExA]
test eax, eax
jne 0x106ccd4
push edi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x106ccd4
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x106ccd4
xor eax, eax
inc eax
jmp 0x106ccd6
xor eax, eax
leave
ret 0x10
Function at 0x106cdcd
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
xor eax, eax
cmp dword [0x1099330], eax
jne 0x106ce67
push ebx
push esi
push edi
mov esi, 0x101af58
xor edi, edi
push esi
inc edi
push eax
mov dword [0x1099330], edi
mov dword [ebp - 4], eax
call fcn.0106ca38
push esi
push 0
mov ebx, eax
call fcn.0106ca38
add esp, 0x10
mov esi, eax
test ebx, ebx
je 0x106ce17
test esi, esi
je 0x106ce17
cmp ebx, esi
jne 0x106ce1a
mov dword [ebp - 4], edi
test ebx, ebx
je 0x106ce25
push ebx
call fcn.0103479e
pop ecx
test esi, esi
je 0x106ce34
cmp esi, ebx
je 0x106ce34
push esi
call fcn.0103479e
pop ecx
push 0
call fcn.0103479e
cmp dword [ebp - 4], 0
pop ecx
je 0x106ce64
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x101b110
call esi
push 0x101b0b0
call esi
push 0x101b058
call esi
push 0x101b024
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x106cf17
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
sub eax, 0
push edi
je 0x106d08e
dec eax
je 0x106cfac
dec eax
jne 0x106d029
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov ecx, dword [esi + 0x20]
mov edi, dword [ebp + 0xc]
add ecx, edi
cmp ecx, eax
jbe 0x106cf86
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x14]
lea ebx, [ecx + edi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
add eax, eax
cmp ebx, eax
jbe 0x106cf6a
mov eax, ebx
jmp 0x106cf75
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
add eax, eax
mov ecx, dword [esi + 0x14]
push eax
call fcn.01084512
test eax, eax
jl 0x106d090
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push edi
push dword [ebp + 8]
push eax
call dword [ecx + 0xc]
add eax, dword [esi + 0x20]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [eax], edi
add dword [esi + 0x20], edi
jmp 0x106d08e
mov eax, dword [esi + 0x1c]
mov ebx, dword [ebp + 0xc]
lea ecx, [eax + ebx]
mov edi, 0x10000
cmp ecx, edi
ja 0x106cfdd
mov ecx, dword [esi + 0x18]
push ebx
push dword [ebp + 8]
add ecx, eax
push ecx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0x10]
add esp, 0xc
add dword [esi + 0x1c], ebx
mov dword [eax], ebx
jmp 0x106d08e
cmp eax, edi
je 0x106d008
test eax, eax
je 0x106d008
mov ebx, dword [ebp + 8]
mov ecx, edi
sub ecx, eax
push ecx
mov ecx, dword [esi + 0x18]
add ecx, eax
push ebx
push ecx
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x1c]
sub ebx, eax
add esp, 0xc
add ebx, edi
mov dword [ebp + 8], ebx
jmp 0x106d00e
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x106d03d
push 0
push dword [ebp + 0x10]
push edi
push dword [esi + 0x18]
push dword [esi]
call ebx
test eax, eax
jne 0x106d030
mov eax, 0x80004005
jmp 0x106d090
add dword [esi + 0x20], edi
sub edi, dword [esi + 0x1c]
and dword [esi + 0x1c], 0
mov dword [ebp - 4], edi
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 4]
shr eax, 0x10
test eax, eax
je 0x106d069
push 0
push dword [ebp + 0x10]
mov edi, eax
shl edi, 0x10
push edi
push dword [ebp + 8]
push dword [esi]
call ebx
test eax, eax
je 0x106d029
add dword [esi + 0x20], edi
add dword [ebp - 4], edi
add dword [ebp + 8], edi
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 4], edi
jae 0x106d086
sub edi, dword [ebp - 4]
push edi
push dword [ebp + 8]
push dword [esi + 0x18]
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [esi + 0x1c], edi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x106d09c
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
sub eax, 0
je 0x106d0e3
dec eax
je 0x106d0b5
dec eax
je 0x106d0e3
jmp 0x106d0d2
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x106d0e3
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [esi + 0x18]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x106d0d9
mov eax, 0x80004005
jmp 0x106d0e5
mov eax, dword [esi + 0x1c]
add dword [esi + 0x20], eax
and dword [esi + 0x1c], 0
xor eax, eax
pop esi
leave
ret

Function at 0x106e5e6
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
mov dword [ebp - 0x14], eax
cmp edx, eax
jae 0x106e709
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edx, dword [ebp + 0x14]
jae 0x106e6ed
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x106e63f
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
mov dword [ebp + 0xc], edx
cmp edx, dword [ebp - 0x14]
jb 0x106e61d
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18
Function at 0x106e9dd
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ecx + 4]
push esi
mov esi, dword [eax + 0x20]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x6c]
imul eax, dword [ecx + 0x60]
push edi
mov edi, dword [ecx + 0x20]
add eax, edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x2c], eax
cmp edi, eax
jae 0x106eafc
mov eax, 0xf81f
mov edx, 0x7e0
push ebx
mov dword [ebp - 0xc], esi
mov esi, dword [ecx + 0x60]
mov ecx, dword [ecx + 0x68]
lea ecx, [edi + ecx*2]
add esi, edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], ecx
cmp edi, ecx
jae 0x106ead8
movzx ecx, word [esi + 2]
mov dword [ebp - 8], ecx
movzx ecx, word [edi + 2]
mov dword [ebp - 4], ecx
movzx ecx, word [esi]
movzx esi, word [edi]
mov ebx, ecx
and ebx, eax
mov edi, esi
and edi, eax
add edi, ebx
mov ebx, dword [ebp - 4]
and ebx, eax
add edi, ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x20], ecx
and ecx, edx
and ebx, eax
lea edi, [edi + ebx + 0x1002]
mov ebx, esi
and ebx, edx
add ebx, ecx
mov ecx, dword [ebp - 4]
and ecx, edx
add ebx, ecx
mov ecx, dword [ebp - 8]
and ecx, edx
lea ecx, [ebx + ecx + 0x40]
shr ecx, 2
shr edi, 2
xor edi, ecx
mov ecx, dword [ebp - 0x20]
and ecx, eax
and esi, eax
add esi, ecx
mov ecx, dword [ebp - 4]
and ecx, eax
add esi, ecx
mov ecx, dword [ebp - 8]
and ecx, eax
lea ecx, [esi + ecx + 0x1002]
mov esi, dword [ebp - 0x14]
and edi, edx
shr ecx, 2
xor edi, ecx
mov ecx, dword [ebp - 0xc]
add dword [ebp - 0xc], 2
mov word [ecx], di
mov edi, dword [ebp - 0x10]
add edi, 4
add esi, 4
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
cmp edi, dword [ebp - 0x24]
jb 0x106ea39
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
mov ebx, dword [ecx + 4]
mov esi, dword [ebp - 0x18]
add esi, dword [ebx + 0x60]
mov ecx, dword [ecx]
mov ebx, dword [ecx + 0x60]
lea edi, [edi + ebx*2]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], edi
cmp edi, dword [ebp - 0x2c]
jb 0x106ea1a
pop ebx
pop edi
xor eax, eax
pop esi
leave
ret
Function at 0x106ec02
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ecx + 4]
push esi
mov esi, dword [eax + 0x20]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x6c]
imul eax, dword [ecx + 0x60]
push edi
mov edi, dword [ecx + 0x20]
add eax, edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x2c], eax
cmp edi, eax
jae 0x106ed24
mov eax, 0x83e0
mov edx, 0x7c1f
push ebx
mov dword [ebp - 0xc], esi
mov esi, dword [ecx + 0x60]
mov ecx, dword [ecx + 0x68]
lea ecx, [edi + ecx*2]
add esi, edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], ecx
cmp edi, ecx
jae 0x106ed00
movzx ecx, word [esi + 2]
mov dword [ebp - 8], ecx
movzx ecx, word [edi + 2]
mov dword [ebp - 4], ecx
movzx ecx, word [esi]
movzx esi, word [edi]
mov ebx, ecx
and ebx, eax
mov edi, esi
and edi, eax
add edi, ebx
mov ebx, dword [ebp - 4]
and ebx, eax
add edi, ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x20], ecx
and ecx, edx
and ebx, eax
lea edi, [edi + ebx + 0x10040]
mov ebx, esi
and ebx, edx
add ebx, ecx
mov ecx, dword [ebp - 4]
and ecx, edx
add ebx, ecx
mov ecx, dword [ebp - 8]
and ecx, edx
lea ecx, [ebx + ecx + 0x802]
shr ecx, 2
shr edi, 2
xor edi, ecx
mov ecx, dword [ebp - 0x20]
and ecx, eax
and esi, eax
add esi, ecx
mov ecx, dword [ebp - 4]
and ecx, eax
add esi, ecx
mov ecx, dword [ebp - 8]
and ecx, eax
lea ecx, [esi + ecx + 0x10040]
mov esi, dword [ebp - 0x14]
and edi, edx
shr ecx, 2
xor edi, ecx
mov ecx, dword [ebp - 0xc]
add dword [ebp - 0xc], 2
mov word [ecx], di
mov edi, dword [ebp - 0x10]
add edi, 4
add esi, 4
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
cmp edi, dword [ebp - 0x24]
jb 0x106ec5e
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
mov ebx, dword [ecx + 4]
mov esi, dword [ebp - 0x18]
add esi, dword [ebx + 0x60]
mov ecx, dword [ecx]
mov ebx, dword [ecx + 0x60]
lea edi, [edi + ebx*2]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], edi
cmp edi, dword [ebp - 0x2c]
jb 0x106ec3f
pop ebx
pop edi
xor eax, eax
pop esi
leave
ret
Function at 0x106ed2f
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ecx + 4]
push esi
mov esi, dword [eax + 0x20]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ecx]
mov eax, dword [ecx + 0x6c]
imul eax, dword [ecx + 0x60]
push edi
mov edi, dword [ecx + 0x20]
add eax, edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x2c], eax
cmp edi, eax
jae 0x106ee51
mov eax, 0xf0f0
mov edx, 0xf0f
push ebx
mov dword [ebp - 0xc], esi
mov esi, dword [ecx + 0x60]
mov ecx, dword [ecx + 0x68]
lea ecx, [edi + ecx*2]
add esi, edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], ecx
cmp edi, ecx
jae 0x106ee2d
movzx ecx, word [esi + 2]
mov dword [ebp - 8], ecx
movzx ecx, word [edi + 2]
mov dword [ebp - 4], ecx
movzx ecx, word [esi]
movzx esi, word [edi]
mov ebx, ecx
and ebx, eax
mov edi, esi
and edi, eax
add edi, ebx
mov ebx, dword [ebp - 4]
and ebx, eax
add edi, ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x20], ecx
and ecx, edx
and ebx, eax
lea edi, [edi + ebx + 0x2020]
mov ebx, esi
and ebx, edx
add ebx, ecx
mov ecx, dword [ebp - 4]
and ecx, edx
add ebx, ecx
mov ecx, dword [ebp - 8]
and ecx, edx
lea ecx, [ebx + ecx + 0x202]
shr ecx, 2
shr edi, 2
xor edi, ecx
mov ecx, dword [ebp - 0x20]
and ecx, eax
and esi, eax
add esi, ecx
mov ecx, dword [ebp - 4]
and ecx, eax
add esi, ecx
mov ecx, dword [ebp - 8]
and ecx, eax
lea ecx, [esi + ecx + 0x2020]
mov esi, dword [ebp - 0x14]
and edi, edx
shr ecx, 2
xor edi, ecx
mov ecx, dword [ebp - 0xc]
add dword [ebp - 0xc], 2
mov word [ecx], di
mov edi, dword [ebp - 0x10]
add edi, 4
add esi, 4
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
cmp edi, dword [ebp - 0x24]
jb 0x106ed8b
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
mov ebx, dword [ecx + 4]
mov esi, dword [ebp - 0x18]
add esi, dword [ebx + 0x60]
mov ecx, dword [ecx]
mov ebx, dword [ecx + 0x60]
lea edi, [edi + ebx*2]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], edi
cmp edi, dword [ebp - 0x2c]
jb 0x106ed6c
pop ebx
pop edi
xor eax, eax
pop esi
leave
ret