joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f8580
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.100860f0
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x58]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
xor ebp, ebp
push ebp
xor esi, esi
call fcn.100ec8c0
add esp, 0xc
test eax, eax
je 0x100f85d8
lea ecx, [ecx]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
shl edx, 0xa
test eax, edx
je 0x100f85c0
inc esi
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
inc ebp
push ebp
call fcn.100ec8c0
add esp, 0xc
test eax, eax
jne 0x100f85b0
mov eax, dword [esp + 0x4c]
cdq
idiv esi
mov ebx, eax
cmp esi, 1
jne 0x100f85ee
mov dword [esp + 0x4c], 0
mov eax, dword [esp + 0x50]
mov ebp, dword [esp + 0x48]
push edi
push 0
push eax
call fcn.10085bc0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
mov dword [esp + 0x60], 0
call fcn.100ec8c0
add esp, 0x18
test eax, eax
je 0x100f86cf
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
shl eax, 0xa
test ecx, eax
je 0x100f86ab
mov esi, dword [esp + 0x14]
test esi, esi
je 0x100f86dc
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
push edi
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x6c]
push eax
and edx, 1
push ecx
mov ecx, dword [esp + 0x58]
add edx, ebx
push edx
mov edx, dword [esp + 0x64]
push ebp
call fcn.100f8180
add esp, 0x30
test eax, eax
je 0x100f86fa
add ebp, ebx
test edi, edi
jle 0x100f86ab
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
sub ecx, eax
mov esi, edi
lea ecx, [ecx]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub esi, 1
jne 0x100f86a0
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
inc eax
push edx
push eax
mov dword [esp + 0x54], eax
call fcn.100ec8c0
add esp, 0xc
test eax, eax
jne 0x100f8623
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
push 0x114
push str.._ssl_t1_enc.c
push 0x146
push 0x11c
push 0x14
call fcn.100ff8f0
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x100fa6e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.100860f0
mov eax, dword [0x10207390]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x3c], 0
test esi, esi
jne 0x100fa727
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.1008545e
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push esi
call fcn.1016456f
add esp, 8
test eax, eax
jl 0x100fa710
mov eax, 8
call fcn.100860f0
fldz
fstp qword [esp]
lea ecx, [esp + 0x50]
push 0x30
push ecx
call fcn.100fa550
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test ebx, ebx
je 0x100fa710
push 0x1018fa8c
push esi
call fcn.1008c7bf
add esp, 8
mov dword [esp + 0x40], eax
test eax, eax
je 0x100fa801
jmp 0x100fa784
mov eax, dword [esp + 0x40]
test ebx, ebx
jle 0x100fa792
cmp ebx, 0x400
mov esi, ebx
jl 0x100fa797
mov esi, 0x400
push eax
push esi
lea edx, [esp + 0x80]
push 1
push edx
call fcn.1008cacc
mov edi, eax
add esp, 0x10
mov dword [esp + 0x44], edi
test edi, edi
jle 0x100fa7e5
fild dword [esp + 0x44]
mov eax, 8
call fcn.100860f0
lea eax, [esp + 0x80]
fstp qword [esp]
push esi
push eax
call fcn.100fa550
add dword [esp + 0x4c], edi
add esp, 0x10
test ebx, ebx
jle 0x100fa780
sub ebx, esi
test ebx, ebx
jg 0x100fa780
mov ecx, dword [esp + 0x40]
push ecx
call fcn.10085d6d
lea edx, [esp + 0x7c]
push 0x400
push edx
call fcn.10164e90
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1008545e
mov esp, ebp
pop ebp
ret
Function at 0x10107830
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.100860f0
mov eax, dword [0x10207390]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x10107895
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x10107895
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.100928e8
add eax, 0x40
push eax
call fcn.100a3bc0
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1008545e
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.10164952
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x10107924
call fcn.101076f0
test eax, eax
jle 0x10107924
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1008545e
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1008545e
add esp, 0x108
ret

Function at 0x10107980
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x101079a4
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
sub edi, 1
jne 0x10107996
pop esi
movzx eax, cl
pop edi
ret

Function at 0x10107d90
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x10107dd7
mov al, byte [edx]
test al, al
je 0x10107dd7
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x10107da7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x10108530
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov edx, dword [edi + 0x1c]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.100fb150
add esp, 8
test esi, esi
jg 0x1010858e
je 0x1010856c
cmp esi, 0xffffffff
jne 0x1010858e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 4
je 0x10108583
cmp eax, 0xb
je 0x10108583
cmp eax, 0x2733
jne 0x1010858e
push 0xa
push edi
call fcn.100fb170
add esp, 8
pop edi
mov eax, esi
pop esi
ret
Function at 0x10118e20
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.100860f0
mov eax, dword [0x10207390]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0x14], ecx
test ebp, ebp
je 0x10118e6f
mov eax, 1
mov dword [esi], ebp
jmp 0x10118e71
mov ebp, dword [esi]
test ecx, ecx
je 0x10118f54
push ebp
call fcn.101137b0
mov ebx, eax
add esp, 4
cmp ebx, 0x80
jle 0x10118ea0
push str.j____int_sizeof_ctx__key_
push 0x68
push str..cryptohmachmac.c
call fcn.10107950
add esp, 0xc
mov edi, dword [esp + 0xa8]
cmp ebx, edi
jge 0x10118ef7
mov ecx, dword [esp + 0x10]
push ecx
lea ebx, [esi + 4]
push ebp
push ebx
call fcn.1010ba60
add esp, 0xc
test eax, eax
je 0x10118ff6
mov edx, dword [esp + 0x14]
push edi
push edx
push ebx
call fcn.1010bc10
add esp, 0xc
test eax, eax
je 0x10118ff6
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.1010bc20
add esp, 0xc
test eax, eax
je 0x10118ff6
jmp 0x10118f31
cmp edi, 0x80
jbe 0x10118f13
push str.len_0__len__int_sizeof_ctx__key_
push 0x75
push str..cryptohmachmac.c
call fcn.10107950
add esp, 0xc
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea edx, [esi + 0x50]
push edx
call fcn.10088150
mov eax, dword [esp + 0xb4]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], eax
mov edi, dword [edi]
cmp edi, 0x80
je 0x10118f5c
mov ecx, 0x80
sub ecx, edi
push ecx
lea edx, [edi + esi + 0x50]
push 0
push edx
call fcn.10085bc0
add esp, 0xc
jmp 0x10118f5c
test eax, eax
je 0x10118fe2
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x10118f60
mov edi, dword [esp + 0x10]
push edi
lea ebx, [esi + 0x1c]
push ebp
push ebx
call fcn.1010ba60
add esp, 0xc
test eax, eax
je 0x10118ff6
push ebp
call fcn.101137b0
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.1010bc10
add esp, 0x10
test eax, eax
je 0x10118ff6
xor eax, eax
mov cl, byte [esi + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x10118fa4
push edi
lea ebx, [esi + 0x34]
push ebp
push ebx
call fcn.1010ba60
add esp, 0xc
test eax, eax
je 0x10118ff6
push ebp
call fcn.101137b0
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.1010bc10
add esp, 0x10
test eax, eax
je 0x10118ff6
lea eax, [esi + 0x1c]
push eax
add esi, 4
push esi
call fcn.1010bdb0
add esp, 8
test eax, eax
jne 0x10118ffa
xor eax, eax
jmp 0x10118fff
mov eax, 1
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1008545e
add esp, 0x8c
ret
Function at 0x101191f0
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
lea eax, [ecx + 1]
ret

Function at 0x10119290
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret

Function at 0x101198e0
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.10085bc0
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
mov eax, 1
pop esi
ret

Function at 0x10119940
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.10085bc0
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
pop esi
ret
Function at 0x101302a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.100860f0
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 0x160]
push edi
mov dword [esp + 0x18], eax
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], ecx
mov dword [esi + 0x16c], ecx
mov dword [esi + 0x168], ecx
cmp ebx, 0xc
jne 0x10130315
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov byte [esi + 0xf], 1
lea edi, [ebx - 0xb]
jmp 0x101303e4
mov eax, ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
cmp ebx, 0x10
jb 0x1013038a
mov edi, dword [esp + 0x1c]
sub edi, esi
shr eax, 4
mov dword [esp + 0x20], eax
push ebp
mov ecx, dword [esp + 0x20]
add ecx, 2
mov eax, esi
mov ebp, 4
movzx edx, byte [edi + eax]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
sub ebp, 1
jne 0x10130340
lea eax, [esi + 0x60]
push eax
push esi
call dword [esp + 0x24]
add dword [esp + 0x28], 0x10
add esp, 8
add edi, 0x10
sub ebx, 0x10
sub dword [esp + 0x24], 1
jne 0x10130332
mov eax, dword [esp + 0x10]
xor ecx, ecx
pop ebp
cmp ebx, ecx
je 0x101303bb
jbe 0x101303ab
mov ecx, dword [esp + 0x1c]
mov eax, esi
sub ecx, esi
mov edi, ebx
lea ebx, [ebx]
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
sub edi, 1
jne 0x101303a0
lea eax, [esi + 0x60]
push eax
push esi
call dword [esp + 0x20]
mov eax, dword [esp + 0x14]
add esp, 8
mov ecx, dword [esp + 0x10]
shld ecx, eax, 3
add eax, eax
bswap ecx
xor dword [esi + 8], ecx
add eax, eax
lea ecx, [esi + 0x60]
add eax, eax
push ecx
bswap eax
xor dword [esi + 0xc], eax
push esi
call dword [esp + 0x20]
mov edi, dword [esi + 0xc]
add esp, 8
bswap edi
mov edx, dword [esi + 0x174]
mov ecx, dword [esi + 0x170]
push edx
lea eax, [esi + 0x20]
push eax
push esi
call ecx
add esp, 0xc
inc edi
bswap edi
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x10130410
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.100860f0
push esi
mov esi, dword [esp + 0xc]
mov ecx, dword [esi + 0x38]
or ecx, dword [esi + 0x3c]
mov eax, dword [esi + 0x164]
mov edx, dword [esi + 0x160]
mov dword [esp + 0xc], eax
je 0x1013043f
mov eax, 0xfffffffe
pop esi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
xor eax, eax
mov ecx, ebx
add ecx, dword [esi + 0x30]
adc eax, dword [esi + 0x34]
cmp eax, 0x20000000
ja 0x101304f0
jb 0x10130463
test ecx, ecx
ja 0x101304f0
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, dword [esi + 0x16c]
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
test edi, edi
je 0x101304a6
lea esp, [esp]
test ebx, ebx
je 0x10130495
mov al, byte [ebp]
xor byte [edi + esi + 0x40], al
inc edi
inc ebp
dec ebx
and edi, 0xf
jne 0x10130480
jmp 0x10130499
test edi, edi
jne 0x101304e2
lea ecx, [esi + 0x60]
push ecx
lea eax, [esi + 0x40]
push eax
call edx
add esp, 8
mov eax, ebx
and eax, 0xfffffff0
mov dword [esp + 0x10], eax
je 0x101304ca
push eax
push ebp
lea ecx, [esi + 0x60]
push ecx
lea edx, [esi + 0x40]
push edx
call dword [esp + 0x28]
mov eax, dword [esp + 0x20]
add esp, 0x10
add ebp, eax
sub ebx, eax
test ebx, ebx
je 0x101304e2
xor eax, eax
mov edi, ebx
test ebx, ebx
jbe 0x101304e2
mov cl, byte [eax + ebp]
xor byte [esi + eax + 0x40], cl
inc eax
cmp eax, ebx
jb 0x101304d6
mov dword [esi + 0x16c], edi
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret
pop ebx
or eax, 0xffffffff
pop esi
pop ecx
ret
Function at 0x101309d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.100860f0
push esi
mov esi, dword [esp + 0x14]
mov ecx, dword [esi + 0x164]
mov eax, dword [esi + 0x174]
mov edx, dword [esi + 0x160]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], eax
xor eax, eax
add ecx, dword [esi + 0x38]
mov dword [esp + 4], edx
adc eax, dword [esi + 0x3c]
cmp eax, 0xf
ja 0x10130bbc
jb 0x10130a1d
cmp ecx, 0xffffffe0
ja 0x10130bbc
cmp dword [esi + 0x16c], 0
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
je 0x10130a43
lea eax, [esi + 0x60]
push eax
lea ecx, [esi + 0x40]
push ecx
call edx
add esp, 8
mov dword [esi + 0x16c], 0
push ebx
mov ebx, dword [esi + 0x168]
push ebp
mov ebp, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x28]
bswap ebp
test ebx, ebx
je 0x10130aa0
lea esp, [esp]
cmp dword [esp + 0x2c], 0
je 0x10130a89
mov al, byte [ebx + esi + 0x10]
mov ecx, dword [esp + 0x24]
xor al, byte [ecx]
dec dword [esp + 0x2c]
mov byte [edi], al
xor byte [ebx + esi + 0x40], al
inc ecx
inc ebx
inc edi
and ebx, 0xf
mov dword [esp + 0x24], ecx
jne 0x10130a60
jmp 0x10130a91
test ebx, ebx
jne 0x10130bac
lea edx, [esi + 0x60]
push edx
lea eax, [esi + 0x40]
push eax
call dword [esp + 0x18]
add esp, 8
mov ecx, dword [esp + 0x2c]
cmp ecx, 0xc00
jb 0x10130b11
mov eax, 0xaaaaaaab
mul ecx
shr edx, 0xb
mov dword [esp + 0x10], edx
lea ebx, [ebx]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push esi
push ecx
push 0xc0
push edi
push edx
call dword [esp + 0x44]
add ebp, 0xc0
mov eax, ebp
bswap eax
push 0xc00
mov dword [esi + 0xc], eax
push edi
lea eax, [esi + 0x60]
push eax
lea eax, [esi + 0x40]
push eax
call dword [esp + 0x38]
mov eax, 0xc00
add dword [esp + 0x48], eax
sub dword [esp + 0x50], eax
add esp, 0x24
add edi, eax
sub dword [esp + 0x10], 1
jne 0x10130ac0
mov ecx, dword [esp + 0x2c]
mov eax, ecx
and eax, 0xfffffff0
mov dword [esp + 0x10], eax
je 0x10130b64
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push esi
push ecx
shr eax, 4
push eax
push edi
push edx
mov dword [esp + 0x2c], eax
call dword [esp + 0x44]
add ebp, dword [esp + 0x2c]
lea ecx, [esi + 0x60]
mov eax, ebp
bswap eax
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x24]
add dword [esp + 0x38], eax
sub dword [esp + 0x40], eax
push eax
push edi
push ecx
lea edx, [esi + 0x40]
push edx
call dword [esp + 0x38]
mov ecx, dword [esp + 0x50]
add esp, 0x24
add edi, dword [esp + 0x10]
test ecx, ecx
je 0x10130bac
mov eax, dword [esp + 0x20]
mov edx, dword [esi + 0x170]
push eax
lea ecx, [esi + 0x10]
push ecx
push esi
call edx
mov edx, dword [esp + 0x30]
inc ebp
bswap ebp
add esp, 0xc
mov dword [esi + 0xc], ebp
lea ecx, [ebx + edi]
sub edx, edi
lea esp, [esp]
mov al, byte [esi + ebx + 0x10]
xor al, byte [edx + ecx]
mov edi, dword [esp + 0x2c]
mov byte [ecx], al
xor byte [esi + ebx + 0x40], al
dec edi
inc ebx
inc ecx
mov dword [esp + 0x2c], edi
test edi, edi
jne 0x10130b90
pop edi
pop ebp
mov dword [esi + 0x168], ebx
pop ebx
xor eax, eax
pop esi
add esp, 0xc
ret
or eax, 0xffffffff
pop esi
add esp, 0xc
ret
Function at 0x10130bd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.100860f0
push esi
mov esi, dword [esp + 0x18]
mov ecx, dword [esi + 0x164]
mov eax, dword [esi + 0x174]
mov edx, dword [esi + 0x160]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 4], eax
xor eax, eax
add ecx, dword [esi + 0x38]
mov dword [esp + 8], edx
adc eax, dword [esi + 0x3c]
cmp eax, 0xf
ja 0x10130dbe
jb 0x10130c1d
cmp ecx, 0xffffffe0
ja 0x10130dbe
cmp dword [esi + 0x16c], 0
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
je 0x10130c43
lea eax, [esi + 0x60]
push eax
lea ecx, [esi + 0x40]
push ecx
call edx
add esp, 8
mov dword [esi + 0x16c], 0
mov eax, dword [esi + 0xc]
push ebx
mov ebx, dword [esi + 0x168]
push ebp
mov ebp, dword [esp + 0x28]
bswap eax
push edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x24], eax
test ebx, ebx
je 0x10130c9c
cmp dword [esp + 0x30], 0
je 0x10130c85
mov al, byte [edi]
mov dl, byte [ebx + esi + 0x10]
dec dword [esp + 0x30]
xor dl, al
mov byte [ebp], dl
xor byte [ebx + esi + 0x40], al
inc ebx
inc edi
inc ebp
and ebx, 0xf
jne 0x10130c61
jmp 0x10130c8d
test ebx, ebx
jne 0x10130dae
lea eax, [esi + 0x60]
push eax
lea ecx, [esi + 0x40]
push ecx
call dword [esp + 0x1c]
add esp, 8
mov edx, dword [esp + 0x30]
cmp edx, 0xc00
jb 0x10130d0d
mov eax, 0xaaaaaaab
mul edx
shr edx, 0xb
mov dword [esp + 0x14], edx
push 0xc00
push edi
lea eax, [esi + 0x60]
push eax
lea eax, [esi + 0x40]
push eax
call dword [esp + 0x28]
mov edx, dword [esp + 0x20]
push esi
push edx
push 0xc0
push ebp
push edi
call dword [esp + 0x58]
mov eax, dword [esp + 0x48]
sub dword [esp + 0x54], 0xc00
add eax, 0xc0
mov dword [esp + 0x48], eax
add esp, 0x24
bswap eax
add ebp, 0xc00
add edi, 0xc00
sub dword [esp + 0x14], 1
mov dword [esi + 0xc], eax
jne 0x10130cb6
mov edx, dword [esp + 0x30]
mov ecx, edx
and ecx, 0xfffffff0
mov dword [esp + 0x1c], ecx
je 0x10130d64
mov eax, ecx
push ecx
shr eax, 4
mov dword [esp + 0x18], eax
push edi
lea eax, [esi + 0x60]
push eax
lea ecx, [esi + 0x40]
push ecx
call dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
push esi
push edx
push eax
push ebp
push edi
call dword [esp + 0x58]
mov eax, dword [esp + 0x48]
add eax, dword [esp + 0x38]
add esp, 0x24
mov dword [esp + 0x24], eax
bswap eax
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x1c]
add ebp, eax
add edi, eax
sub dword [esp + 0x30], eax
mov edx, dword [esp + 0x30]
test edx, edx
je 0x10130dae
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x170]
push ecx
lea edx, [esi + 0x10]
push edx
push esi
call eax
mov eax, dword [esp + 0x30]
inc eax
bswap eax
add esp, 0xc
mov dword [esi + 0xc], eax
lea eax, [ebx + ebp]
sub edi, ebp
lea esp, [esp]
mov cl, byte [edi + eax]
mov dl, byte [esi + ebx + 0x10]
mov ebp, dword [esp + 0x30]
xor byte [esi + ebx + 0x40], cl
xor dl, cl
dec ebp
mov byte [eax], dl
inc ebx
inc eax
mov dword [esp + 0x30], ebp
test ebp, ebp
jne 0x10130d90
pop edi
pop ebp
mov dword [esi + 0x168], ebx
pop ebx
xor eax, eax
pop esi
add esp, 0x10
ret
or eax, 0xffffffff
pop esi
add esp, 0x10
ret