joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419b32
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 0x18]
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
push 0
push edi
mov dword [esi + 8], edi
mov byte [esi + 0x1e], al
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 8]
mov ecx, esi
call fcn.00419acb
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x18], eax
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push 2
lea eax, [ebp - 0x10]
push eax
push edi
call ebx
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esi + 4]
test eax, eax
je 0x419b99
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 8]
push esi
push dword [esi]
sub edi, eax
push 0
push dword [ebp + 0xc]
lea ecx, [eax + 1]
dec edi
mov dword [ebp + 0x18], ecx
dec edi
call ebx
push eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push eax
push edi
push dword [ebp - 0xc]
xor edi, edi
push dword [ebp + 0x18]
push 0x40000000
push edi
push str.RarHtmlClassName
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 4], eax
cmp dword [esi + 0x10], edi
jne 0x419c1b
cmp dword [ebp + 0xc], edi
je 0x419c31
cmp dword [esi + 0x18], edi
jne 0x419c31
mov eax, dword [esi + 0x14]
cmp eax, edi
je 0x419c31
push eax
mov ecx, esi
call fcn.004194f7
mov esi, eax
cmp esi, edi
je 0x419c31
push 5
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.0041a58e
pop ecx
jmp 0x419c31
cmp eax, edi
je 0x419c31
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x419c38
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x42b198
push 1
xor ebx, ebx
push ebx
push 0x42b258
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x419d09
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x42b248
push eax
call dword [ecx]
test eax, eax
jl 0x419d00
cmp byte [ebp + 8], bl
je 0x419c8b
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 2
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp dword [ebp + 0x18], ebx
je 0x419ca8
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
cmp dword [ebp + 0x1c], ebx
jne 0x419cba
push 0x42a73c
jmp 0x419cbd
push dword [ebp + 0x1c]
push eax
call dword [ecx + 0x44]
cmp dword [ebp + 0x20], ebx
je 0x419cd2
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp dword [ebp + 0x14], ebx
je 0x419ce3
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x419cf7
mov bl, 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, bl
pop ebx
leave
ret 0x1c

Function at 0x419d23
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x41e75e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430298]
jne 0x41e768
repz ret
jmp fcn.00423f04
Function at 0x425795
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e7df
and dword [ebp - 4], 0
cmp dword [0x4501f0], 0
mov ebx, eax
jne 0x425846
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4258f7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4258f7
push eax
call fcn.0041e76d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4501f0], eax
call esi
push eax
call fcn.0041e76d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4501f4], eax
call esi
push eax
call fcn.0041e76d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4501f8], eax
call esi
push eax
call fcn.0041e76d
pop ecx
mov dword [0x450200], eax
test eax, eax
je 0x425846
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e76d
pop ecx
mov dword [0x4501fc], eax
mov eax, dword [0x4501fc]
cmp eax, ebx
je 0x42589e
cmp dword [0x450200], ebx
je 0x42589e
push eax
call fcn.0041e7e8
push dword [0x450200]
mov esi, eax
call fcn.0041e7e8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42589e
test edi, edi
je 0x42589e
call esi
test eax, eax
je 0x425895
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x425895
test byte [ebp - 0xc], 1
jne 0x42589e
or dword [ebp + 0x10], 0x200000
jmp 0x4258d7
mov eax, dword [0x4501f4]
cmp eax, ebx
je 0x4258d7
push eax
call fcn.0041e7e8
pop ecx
test eax, eax
je 0x4258d7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4258d7
mov eax, dword [0x4501f8]
cmp eax, ebx
je 0x4258d7
push eax
call fcn.0041e7e8
pop ecx
test eax, eax
je 0x4258d7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4501f0]
call fcn.0041e7e8
pop ecx
test eax, eax
je 0x4258f7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4258f9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4030e4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x412008], 0x8088405
inc edx
mov dword [ebx + 0x412008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40aa03
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00404914
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.004067f4
mov edi, eax
cmp edi, 0x104
jbe 0x40aa26
mov eax, edi
add eax, eax
call fcn.00402e04
mov esi, eax
jmp 0x40aa28
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.004067f4
push edi
push esi
call fcn.0040688c
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x40aa61
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x40aa4b
mov eax, esp
cmp esi, eax
je 0x40aa6e
mov eax, esi
call fcn.00402e20
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x40aaa8
cmp bl, 0
je 0x40aaa4
cmp bl, 0x41
jl 0x40aa9f
cmp bl, 0x5a
jg 0x40aa9f
or bl, 0x20
xor al, bl
inc esi
jmp 0x40aa83
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x40a9e8

Function at 0x40c6b0
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x417d9c
mov eax, esi
mov edx, 8
test al, 1
je 0x40c6cc
shr eax, 1
xor eax, 0xedb88320
jmp 0x40c6ce
shr eax, 1
dec edx
jne 0x40c6bf
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40c6b8
pop esi
ret

Function at 0x40c6e4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x417d98], 0
jne 0x40c707
call fcn.0040c6b0
push 1
push 0x417d98
call fcn.004066b0
mov eax, edi
test esi, esi
je 0x40c732
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x417d9c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40c70d
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x409577
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404ee9
and dword [ebp - 4], 0
cmp dword [0x412990], 0
mov ebx, eax
jne 0x409628
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4096d9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4096d9
push eax
call fcn.00404e77
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x412990], eax
call esi
push eax
call fcn.00404e77
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x412994], eax
call esi
push eax
call fcn.00404e77
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x412998], eax
call esi
push eax
call fcn.00404e77
pop ecx
mov dword [0x4129a0], eax
test eax, eax
je 0x409628
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404e77
pop ecx
mov dword [0x41299c], eax
mov eax, dword [0x41299c]
cmp eax, ebx
je 0x409680
cmp dword [0x4129a0], ebx
je 0x409680
push eax
call fcn.00404ef2
push dword [0x4129a0]
mov esi, eax
call fcn.00404ef2
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409680
test edi, edi
je 0x409680
call esi
test eax, eax
je 0x409677
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409677
test byte [ebp - 0xc], 1
jne 0x409680
or dword [ebp + 0x10], 0x200000
jmp 0x4096b9
mov eax, dword [0x412994]
cmp eax, ebx
je 0x4096b9
push eax
call fcn.00404ef2
pop ecx
test eax, eax
je 0x4096b9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4096b9
mov eax, dword [0x412998]
cmp eax, ebx
je 0x4096b9
push eax
call fcn.00404ef2
pop ecx
test eax, eax
je 0x4096b9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x412990]
call fcn.00404ef2
pop ecx
test eax, eax
je 0x4096d9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4096db
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40d5e3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40d614
jmp section..htext
test dword [ebp + 0xc], 0xfffffff9
jne 0x40d5f0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40d641
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040374a
pop ecx
call fcn.00403724
mov eax, dword [eax]
jmp 0x40d669
test al, 0x10
jne 0x40d667
test al, 1
je 0x40d667
test byte [ebp + 0xc], 2
je 0x40d667
call fcn.00403737
mov dword [eax], 5
call fcn.00403724
mov dword [eax], 0xd
jmp 0x40d638
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10018200
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x10018720
test edx, edx
je 0x10018720
call fcn.10018217
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x10018760
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.10018200
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x100187d1
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x10018796
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x100190e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x10019164
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x1001913c
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x10019144
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.10019169

Function at 0x1004d680
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10286280]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xorps xmm0, xmm0
mov dword [ebp - 8], 0
mov edx, ecx
movq qword [ebp - 0x10], xmm0
push esi
lea ecx, [ebp - 0x10]
xor bl, bl
call fcn.1004d560
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
cmp esi, eax
je 0x1004d6e0
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi]
call edi
test eax, eax
movzx ebx, bl
mov eax, 1
cmovne ebx, eax
add esi, 4
cmp esi, dword [ebp - 0x14]
jne 0x1004d6c1
mov esi, dword [ebp - 0x10]
pop edi
test esi, esi
je 0x1004d710
mov ecx, dword [ebp - 8]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x1004d706
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004d722
push ecx
push esi
call fcn.101a5c8a
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.101a575e
mov esp, ebp
pop ebp
ret
call fcn.101ab5a5
int3
Function at 0x1004e230
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x1004e24e
push 0
push 0
push 0
push 0x1004e220
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc

Function at 0x1004ff50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101dacd0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10286280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.101a5826
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.101a4d22
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.10050020
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1005f260
Capabilities:
Hash data using sha1

Disassembly:
mov eax, 0x40
call fcn.101a6170
mov eax, dword [0x10286280]
xor eax, esp
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x48], 0x1d
push esi
mov esi, dword [esp + 0x48]
push edi
mov edi, dword [esp + 0x58]
je 0x1005f29c
pop edi
mov eax, 0xfffffffe
pop esi
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.101a575e
add esp, 0x40
ret
test esi, esi
je 0x1005f3ab
cmp dword [esp + 0x54], 0x30
jne 0x1005f3ab
push 0x30
push edi
push esi
call fcn.1005f180
add esp, 0xc
test eax, eax
jle 0x1005f3ab
movaps xmm0, xmmword [str.6666666666666666O]
lea eax, [esp + 8]
push 0x28
push eax
push esi
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
movq qword [esp + 0x34], xmm0
call fcn.1005f180
add esp, 0xc
test eax, eax
je 0x1005f3ab
lea eax, [esp + 0x30]
push esi
push eax
call fcn.1005efe0
add esp, 8
test eax, eax
je 0x1005f3ab
push 0x4c
lea eax, [esi + 0x14]
push 0
push eax
call fcn.101a7620
push 0x30
push edi
push esi
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
call fcn.1005f180
add esp, 0x18
test eax, eax
jle 0x1005f3ab
movaps xmm0, xmmword [0x1020a710]
lea eax, [esp + 8]
push 0x28
push eax
push esi
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
movq qword [esp + 0x34], xmm0
call fcn.1005f180
add esp, 0xc
test eax, eax
je 0x1005f3ab
push 0x14
lea eax, [esp + 0x34]
push eax
push esi
call fcn.1005f180
add esp, 0xc
test eax, eax
je 0x1005f3ab
lea eax, [esp + 0x30]
push 0x14
push eax
call fcn.10001320
add esp, 8
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.101a575e
add esp, 0x40
ret
mov ecx, dword [esp + 0x44]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.101a575e
add esp, 0x40
ret

Function at 0x10061f50
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.101a6170
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x10061fd0
mov cl, byte [edi]
test cl, cl
je 0x10061fd0
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x10061f80
pop esi
mov ecx, eax
pop ebx
shr ecx, 0x10
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret
Function at 0x10062050
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.101a6170
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x100620d3
mov cl, byte [edi]
test cl, cl
je 0x100620d3
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
and esi, 0xffffffdf
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x10062080
pop esi
mov ecx, eax
pop ebx
shr ecx, 0x10
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret
Function at 0x10065470
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
lea edx, [eax - 1]
not eax
shr edx, 0x1f
shr eax, 0x1f
and edx, eax
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 4]
dec edx
xor eax, ecx
mov dword [esp + 0x10], edx
and eax, edx
xor ecx, eax
mov dword [ebp + 4], ecx
xor dword [ebx + 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebx + 0xc]
xor eax, ecx
movd xmm0, edx
and eax, edx
pshufd xmm4, xmm0, 0
xor ecx, eax
mov dword [ebp + 0xc], ecx
xor dword [ebx + 0xc], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebx + 0x10]
xor eax, ecx
and eax, edx
and eax, 4
xor ecx, eax
mov dword [ebp + 0x10], ecx
xor dword [ebx + 0x10], eax
xor eax, eax
mov esi, dword [esp + 0x1c]
test esi, esi
jle 0x10065586
push edi
cmp esi, 4
jb 0x10065561
mov ecx, dword [ebp]
lea edi, [esi - 1]
mov edx, dword [ebx]
lea ebp, [esi - 1]
lea ebp, [ecx + ebp*4]
cmp edx, ebp
lea edi, [edx + edi*4]
mov ebp, dword [esp + 0x18]
ja 0x10065504
cmp edi, ecx
jae 0x10065561
cmp edx, ebx
ja 0x1006550c
cmp edi, ebx
jae 0x10065561
cmp edx, ebp
ja 0x10065514
cmp edi, ebp
jae 0x10065561
lea edi, [esi - 1]
lea edi, [ecx + edi*4]
cmp ecx, ebx
ja 0x10065522
cmp edi, ebx
jae 0x10065561
cmp ecx, ebp
ja 0x1006552a
cmp edi, ebp
jae 0x10065561
mov edi, esi
and edi, 0xfffffffc
nop
movups xmm3, xmmword [edx + eax*4]
movups xmm2, xmmword [ecx + eax*4]
movaps xmm1, xmm3
xorps xmm1, xmm2
andps xmm1, xmm4
movaps xmm0, xmm1
xorps xmm1, xmm3
xorps xmm0, xmm2
movups xmmword [ecx + eax*4], xmm0
movups xmmword [edx + eax*4], xmm1
add eax, 4
cmp eax, edi
jl 0x10065530
mov dword [esp + 0x18], eax
cmp eax, esi
jge 0x10065585
mov ecx, dword [ebp]
mov edx, dword [ecx + eax*4]
lea esi, [ecx + eax*4]
mov ecx, dword [ebx]
mov edi, dword [ecx + eax*4]
xor edi, edx
and edi, dword [esp + 0x14]
xor edx, edi
mov dword [esi], edx
mov ecx, dword [ebx]
xor dword [ecx + eax*4], edi
inc eax
cmp eax, dword [esp + 0x20]
jl 0x10065561
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10083ff0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.101a6170
mov ecx, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x24]
shr ecx, 3
mov dword [esp + 8], ecx
cmp esi, dword [esp + 0x28]
jb 0x10084208
push ebx
push ebp
push edi
nop word [eax + eax]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x100841e2
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
movzx eax, byte [ecx + 7]
cdq
mov ebp, eax
mov ebx, edx
movzx eax, byte [ecx + 6]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 5]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 4]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 3]
cdq
mov ecx, ebp
shld ebx, ecx, 8
mov edi, edx
mov dword [esp + 0x20], ebp
shl ecx, 8
or edi, ebx
or eax, ecx
and ebp, 0x55555555
mov ecx, dword [esp + 0x2c]
mov ebx, eax
mov dword [esp + 0x18], eax
shld edi, ebx, 8
movzx eax, byte [ecx + 2]
cdq
shl ebx, 8
or edi, edx
or ebx, eax
movzx eax, byte [ecx + 1]
cdq
shld edi, ebx, 8
shl ebx, 8
or edi, edx
or ebx, eax
movzx eax, byte [ecx]
cdq
add ecx, 8
shld edi, ebx, 8
mov dword [esp + 0x2c], ecx
shl ebx, 8
or ebx, eax
mov eax, ebx
and eax, 0x55555555
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
and ecx, 0xff00ff
mov dword [esp + 0x18], ecx
mov ecx, ebp
shr ecx, 1
or ecx, ebp
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ebp, eax
shr ebp, 4
or ebp, eax
and ebx, 0xaaaaaaaa
and ebp, 0xff00ff
lea eax, [ebx + ebx]
or eax, ebx
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
and ecx, 0xf0f0f0f0
mov edi, ecx
shl edi, 4
or edi, ecx
mov ecx, dword [esp + 0x20]
and ecx, 0xaaaaaaaa
and edi, 0xff00ff00
mov ebx, edi
and edi, 0xffff00
shr ebx, 8
or ebx, edi
lea eax, [ecx + ecx]
shr ebx, 8
or eax, ecx
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
and ecx, 0xf0f0f0f0
mov edx, ecx
shl edx, 4
or edx, ecx
mov ecx, ebp
and edx, 0xff00ff00
shl ebp, 8
mov eax, edx
and ecx, 0xffffff00
shl eax, 8
or ecx, ebp
or eax, edx
shl ecx, 8
and eax, 0xffff0000
xor edx, edx
or ebx, eax
mov eax, dword [esp + 0x18]
shr eax, 8
or eax, dword [esp + 0x18]
movzx eax, ax
or ecx, eax
mov eax, dword [esp + 0x10]
or edx, ecx
mov ecx, dword [esp + 0x28]
xor dword [ecx + eax*8], edx
xor dword [ecx + eax*8 + 4], ebx
inc eax
mov dword [esp + 0x10], eax
cmp eax, esi
jb 0x10084034
mov esi, dword [esp + 0x30]
jmp 0x100841e6
mov ecx, dword [esp + 0x28]
push ecx
call fcn.10083730
sub esi, dword [esp + 0x38]
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], esi
cmp esi, dword [esp + 0x34]
jae 0x10084020
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
add esp, 0x14
ret