joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014af0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x40
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
movss xmm0, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
push dword [esp + 8]
movss dword [edi], xmm0
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ecx
ret

Function at 0x10014b30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
push 0x40
push 2
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ax, word [esp + 0x10]
mov word [edi], ax
lea eax, [esp + 4]
push eax
push dword [esp + 8]
push 2
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ecx
ret

Function at 0x10014b70
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x18]
lea eax, [esp + 4]
push edi
mov edi, dword [esp + 0x14]
push eax
push 0x40
push esi
push edi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10014ba4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
add esp, 8
ret
push esi
push dword [esp + 0x1c]
push edi
call fcn.10048a90
add esp, 0xc
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0xc]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10014b98
pop edi
xor eax, eax
pop esi
add esp, 8
ret
Function at 0x10017bb0
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push 0
push 0
push 0
imul eax, dword [eax + 4], 0x3e8
push 0x10013ec0
push 0
push 0
mov dword [0x10099d1c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret 4

Function at 0x10018070
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, 5
cmp byte [esi + 4], bl
jbe 0x100180de
push ebp
mov ebp, 0x100
nop dword [eax]
movzx eax, byte [edi + esi + 0x17]
mov dl, byte [edi + esi]
add eax, 0x2800
push eax
mov al, dl
xor al, 0x80
test dl, dl
movzx ecx, al
movzx eax, dl
cmovns ecx, eax
movzx eax, byte [edi + esi + 1]
movzx ecx, cl
imul ecx, ebp
add cx, ax
movzx eax, cx
mov ecx, 0x1009e388
push eax
call fcn.1001c0e0
movzx eax, byte [edi + esi + 0x43]
inc ebx
lea edi, [edi + eax*8]
movzx eax, byte [esi + 4]
lea edi, [edi + 0x44]
cmp ebx, eax
jl 0x10018090
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x10018f50
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library

Disassembly:
sub esp, 0x2a4
mov eax, dword [0x1008c880]
xor eax, esp
mov dword [esp + 0x2a0], eax
mov eax, dword [0x1008c6ec]
push esi
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
push edi
push dword [eax]
mov edi, dword [esp + 0x2b4]
call esi
lea eax, [esp + 0x18]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [0x1008c6ec]
mov dword [ecx], eax
mov eax, dword [0x1008c6ec]
cmp dword [eax], 0xffffffff
jne 0x10018fee
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x1b0]
push str.Error_msg:__d__d
push eax
call fcn.10002150
add esp, 0x10
lea eax, [esp + 0x1a8]
push 0
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
jmp 0x1001908b
mov eax, 2
push edi
mov word [esp + 0xc], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push dword [esp + 0x2b4]
mov dword [esp + 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xa], ax
lea eax, [esp + 8]
push 0x10
push eax
mov eax, dword [0x1008c6ec]
push dword [eax]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
mov eax, dword [0x1008c6ec]
je 0x10019052
push 3
push 0x400
push dword [0x1009f6c8]
push dword [eax]
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
cmp eax, 0xffffffff
jne 0x10019060
mov eax, dword [0x1008c6ec]
push dword [eax]
call esi
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
jmp 0x1001908b
mov word [0x6e2be9c], 0
mov ecx, 0x1009e35c
push dword [0x1c3249c]
call fcn.1001b650
push dword [0x1c3249c]
mov ecx, 0x1009e338
call fcn.1001b650
mov al, 1
mov ecx, dword [esp + 0x2a8]
pop edi
pop esi
xor ecx, esp
call fcn.100463c8
add esp, 0x2a4
ret 8
Function at 0x10019870
Capabilities:
Convert ip address from string
Resolve dns

Disassembly:
sub esp, 0x30
mov eax, dword [0x1008c880]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x24]
push eax
push ebx
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jne 0x100199eb
push ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x100199eb
mov eax, dword [eax + 0xc]
push ebp
push esi
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov ebp, eax
mov dword [esp + 0x10], 0
mov esi, ebp
mov dword [esp + 0xc], ebp
mov dword [esp + 0x24], 0xf
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x100198d2
sub esi, ecx
push edi
cmp esi, 0xf
ja 0x10019903
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x28], esi
push ebp
push eax
call fcn.10048a90
mov byte [esp + esi + 0x20], 0
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x20]
jmp 0x10019982
cmp esi, 0x7fffffff
ja 0x100199fd
mov edi, esi
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x10019933
mov eax, connect
mov edi, closesocket
push eax
call fcn.100017f0
add esp, 4
mov ebp, eax
jmp 0x10019967
mov eax, 0x16
cmp edi, eax
cmovb edi, eax
lea eax, [edi + 1]
cmp eax, 0x1000
jb 0x10019954
push eax
call fcn.100017f0
add esp, 4
mov ebp, eax
jmp 0x10019967
test eax, eax
je 0x10019965
push eax
call fcn.10046070
add esp, 4
mov ebp, eax
jmp 0x10019967
xor ebp, ebp
push esi
push dword [esp + 0x14]
mov dword [esp + 0x2c], esi
push ebp
mov dword [esp + 0x34], edi
call fcn.10048a90
mov byte [esi + ebp], 0
mov dword [esp + 0x20], ebp
add esp, 0xc
mov dword [ebx], 0
cmp edi, 0x10
lea ecx, [esp + 0x14]
cmovae ecx, ebp
sub ebx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ebx + ecx - 1], al
test al, al
jne 0x10019997
lea esi, [esp + 0x14]
cmp edi, 0x10
jb 0x100199d6
inc edi
mov esi, ebp
mov ecx, esi
cmp edi, 0x1000
jb 0x100199cc
mov ecx, dword [ebp - 4]
mov eax, esi
sub eax, ecx
add edi, 0x23
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10019a02
push edi
push ecx
call fcn.100460a0
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100463c8
add esp, 0x30
ret
mov ecx, dword [esp + 0x30]
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.100463c8
add esp, 0x30
ret
call fcn.10002100
call fcn.1004afbf
int3

Function at 0x10019bd0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1008c880]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100052e0
push 0
push str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890__
lea ecx, [ebp - 0x1c]
call fcn.1001a560
cmp eax, 0xffffffff
je 0x10019c1f
push 0x10
push 0x1006c1fc
push str.Window_title_is_invalid__alphanumerical_characters__space_and______are_allowed_only
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x1c]
call fcn.10006850
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100463c8
mov esp, ebp
pop ebp
ret 4
Function at 0x1001bdf0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
call esi
mov ebx, dword [esp + 0x10]
sub eax, edi
cmp eax, ebx
jae 0x1001be20
push ebp
mov ebp, dword [esp + 0x18]
nop
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
sub eax, edi
cmp eax, ebx
jb 0x1001be10
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret

Function at 0x1001be90
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x1001bedb
mov ebx, dword [edi + 0x3c]
cmp dword [ebx + edi], 0x4550
jne 0x1001bedb
mov ebx, dword [ebx + edi + 0x78]
xor esi, esi
add ebx, edi
mov ebp, dword [ebx + 0x20]
add ebp, edi
cmp dword [ebx + 0x14], esi
jbe 0x1001bedb
mov eax, dword [ebp + esi*4]
push dword [esp + 0x18]
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1001bee2
inc esi
cmp esi, dword [ebx + 0x14]
jb 0x1001bec0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
movzx eax, si
cmp ax, 0xffff
je 0x1001bedb
movsx ecx, ax
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movsx ecx, word [eax + edi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edi]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10023f70
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x100a09f8], 0
jne 0x10023f7e
call fcn.1003f5e0
cmp byte [0x100a0a02], 0
je 0x10023f9c
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.1003f9e0
add esp, 0x10
ret
jmp fcn.1001f780
Function at 0x10028d60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
push ebx
push ebp
xor ebp, ebp
mov dword [esp + 0x18], ecx
push edi
test eax, eax
je 0x10028d76
mov ebp, dword [eax]
xor ebx, ebx
bswap ebp
add eax, 4
je 0x10028d81
mov ebx, dword [eax]
xor edi, edi
bswap ebx
add eax, 4
je 0x10028d8c
mov edi, dword [eax]
mov eax, dword [ecx + 8]
mov edx, 0xb0b
mov dword [esp + 0x24], edx
mov dword [esp + 0xc], eax
push esi
bswap edi
test eax, eax
je 0x10028e7a
mov eax, dword [ecx + 0x24]
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], eax
nop
mov eax, edx
xor ebx, esi
shl eax, 0x10
xor eax, ecx
xor ebp, eax
mov eax, dword [esp + 0x14]
xor eax, edx
mov esi, ebp
xor edi, eax
shr esi, 0x10
mov eax, edi
xor esi, edi
xor eax, ebx
shr esi, 8
xor eax, ebp
mov edx, ebx
mov ecx, eax
shl edx, 0x10
rol eax, 8
xor edx, edi
rol ecx, 0x10
xor ecx, eax
shl edx, 8
mov eax, ebp
shl eax, 0x10
xor eax, ebx
shl eax, 8
xor esi, eax
mov eax, ebx
shr eax, 0x10
xor eax, ebp
shr eax, 8
xor edx, eax
mov eax, edx
shl edx, 0x10
xor eax, ecx
xor ebx, eax
mov eax, esi
shr eax, 0x10
xor esi, ecx
xor edx, eax
xor esi, ebp
xor edx, ecx
ror esi, 0xa
xor edx, edi
mov edi, ebx
rol edx, 1
not edi
mov ebp, edx
or edi, esi
not ebp
xor edi, edx
or ebp, ebx
ror edi, 0xa
xor ebp, esi
not esi
or esi, edx
rol ebp, 1
mov edx, dword [esp + 0x28]
xor ebx, esi
mov esi, dword [esp + 0x1c]
add edx, edx
mov ecx, edx
mov eax, edx
xor edx, 0x11011
and eax, 0x10000
cmove edx, ecx
sub dword [esp + 0x10], 1
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
jne 0x10028dc0
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x24]
mov eax, edx
shl eax, 0x10
xor eax, dword [ecx]
xor ebx, dword [ecx + 4]
xor ebp, eax
mov eax, dword [ecx + 8]
mov esi, ebp
xor eax, edx
shr esi, 0x10
xor edi, eax
mov ecx, ebx
mov eax, edi
shl ecx, 0x10
xor eax, ebx
xor esi, edi
xor eax, ebp
shr esi, 8
mov edx, eax
xor ecx, edi
rol eax, 8
rol edx, 0x10
xor edx, eax
shl ecx, 8
mov eax, ebp
shl eax, 0x10
xor eax, ebx
shl eax, 8
xor esi, eax
mov eax, ebx
shr eax, 0x10
xor eax, ebp
shr eax, 8
xor ecx, eax
mov eax, ecx
shl ecx, 0x10
xor eax, edx
xor ebx, eax
mov eax, esi
shr eax, 0x10
xor esi, edx
xor ecx, eax
xor esi, ebp
xor ecx, edx
xor edi, ecx
mov ecx, dword [esp + 0x2c]
bswap esi
test ecx, ecx
je 0x10028ef0
xor esi, dword [ecx]
mov eax, dword [esp + 0x30]
test eax, eax
je 0x10028efa
mov dword [eax], esi
lea edx, [eax + 4]
test ecx, ecx
lea eax, [ecx + 4]
cmove eax, ecx
bswap ebx
pop esi
test eax, eax
je 0x10028f0e
xor ebx, dword [eax]
test edx, edx
je 0x10028f14
mov dword [edx], ebx
add edx, 4
lea ecx, [eax + 4]
test eax, eax
bswap edi
cmove ecx, eax
test ecx, ecx
je 0x10028f27
xor edi, dword [ecx]
test edx, edx
je 0x10028f2d
mov dword [edx], edi
pop edi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x10029d60
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push esi
xor esi, esi
push edi
mov edi, dword [ecx + 0x34]
test eax, eax
je 0x10029d79
mov esi, dword [eax]
xor edx, edx
bswap esi
add eax, 4
je 0x10029d84
mov edx, dword [eax]
bswap edx
test edi, edi
je 0x10029def
mov eax, dword [ecx + 0x2c]
push ebp
mov ecx, dword [eax + 0xc]
mov ebp, dword [eax + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
nop dword [eax]
mov ecx, esi
mov eax, esi
shr ecx, 5
shl eax, 4
add ecx, ebx
add eax, ebp
xor ecx, eax
lea eax, [esi + edi]
xor ecx, eax
sub edx, ecx
mov ecx, edx
mov eax, edx
shr ecx, 5
add ecx, dword [esp + 0x10]
shl eax, 4
add eax, dword [esp + 0x14]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
sub esi, ecx
add edi, 0x61c88647
jne 0x10029db0
mov ebx, dword [esp + 0x20]
pop ebp
bswap esi
test ebx, ebx
je 0x10029df7
xor esi, dword [ebx]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10029e01
mov dword [eax], esi
test ebx, ebx
lea ecx, [eax + 4]
lea eax, [ebx + 4]
pop edi
cmove eax, ebx
pop esi
bswap edx
pop ebx
test eax, eax
je 0x10029e17
xor edx, dword [eax]
test ecx, ecx
je 0x10029e1d
mov dword [ecx], edx
add esp, 8
ret 0xc

Function at 0x10029e30
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
xor edi, edi
xor esi, esi
test eax, eax
je 0x10029e48
mov esi, dword [eax]
xor edx, edx
bswap esi
add eax, 4
je 0x10029e53
mov edx, dword [eax]
push ebp
mov ebp, dword [ecx + 0x34]
bswap edx
test ebp, ebp
je 0x10029ec2
mov eax, dword [ecx + 0x2c]
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
nop
mov ecx, edx
mov eax, edx
shr ecx, 5
sub edi, 0x61c88647
shl eax, 4
add ecx, ebx
add eax, dword [esp + 0x10]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
add esi, ecx
mov ecx, esi
mov eax, esi
shr ecx, 5
add ecx, dword [esp + 0x14]
shl eax, 4
add eax, dword [esp + 0x18]
xor ecx, eax
lea eax, [esi + edi]
xor ecx, eax
add edx, ecx
cmp edi, ebp
jne 0x10029e80
mov ebx, dword [esp + 0x24]
bswap esi
pop ebp
test ebx, ebx
je 0x10029ecb
xor esi, dword [ebx]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10029ed5
mov dword [eax], esi
test ebx, ebx
lea ecx, [eax + 4]
lea eax, [ebx + 4]
pop edi
cmove eax, ebx
pop esi
bswap edx
pop ebx
test eax, eax
je 0x10029eeb
xor edx, dword [eax]
test ecx, ecx
je 0x10029ef1
mov dword [ecx], edx
add esp, 0xc
ret 0xc
Function at 0x10029fa0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov edi, ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [edi + 0x14]
mov ebp, dword [edi + 0x18]
lea eax, [eax*4]
add eax, ebp
test ecx, ecx
je 0x10029fc5
mov ebx, dword [ecx]
xor edx, edx
add ecx, 4
je 0x10029fce
mov edx, dword [ecx]
mov edi, dword [edi + 8]
test edi, edi
je 0x10029ff6
sub edx, dword [eax - 4]
lea eax, [eax - 8]
movzx ecx, bl
and ecx, 0x1f
ror edx, cl
xor edx, ebx
sub ebx, dword [eax]
movzx ecx, dl
and ecx, 0x1f
ror ebx, cl
xor ebx, edx
sub edi, 1
jne 0x10029fd5
sub edx, dword [ebp + 4]
sub ebx, dword [ebp]
test esi, esi
je 0x1002a002
xor ebx, dword [esi]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1002a00c
mov dword [eax], ebx
test esi, esi
lea ecx, [eax + 4]
lea eax, [esi + 4]
pop edi
cmove eax, esi
pop esi
pop ebp
pop ebx
test eax, eax
je 0x1002a023
mov eax, dword [eax]
xor edx, eax
test ecx, ecx
je 0x1002a029
mov dword [ecx], edx
ret 0xc

Function at 0x1002a030
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x18]
test eax, eax
je 0x1002a049
mov edx, dword [eax]
xor ecx, ecx
add eax, 4
je 0x1002a052
mov ecx, dword [eax]
mov ebx, dword [esi]
mov eax, dword [edi + 8]
add ebx, edx
mov edx, dword [esi + 4]
xor edi, edi
add edx, ecx
test eax, eax
je 0x1002a08b
mov ebp, eax
movzx ecx, dl
xor ebx, edx
and ecx, 0x1f
rol ebx, cl
add ebx, dword [esi + edi*8 + 8]
movzx ecx, bl
xor edx, ebx
and ecx, 0x1f
rol edx, cl
add edx, dword [esi + edi*8 + 0xc]
inc edi
cmp edi, ebp
jb 0x1002a066
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x1002a092
xor ebx, dword [ebp]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1002a09c
mov dword [eax], ebx
test ebp, ebp
lea ecx, [eax + 4]
pop edi
lea eax, [ebp + 4]
pop esi
cmove eax, ebp
pop ebp
pop ebx
test eax, eax
je 0x1002a0b3
mov eax, dword [eax]
xor edx, eax
test ecx, ecx
je 0x1002a0b9
mov dword [ecx], edx
ret 0xc
Function at 0x1002a340
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
mov ebx, ecx
push ebp
push esi
xor esi, esi
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x14], ecx
push edi
lea eax, [ecx + eax*4]
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x1002a362
mov esi, dword [ecx]
lea edx, [ecx + 4]
xor ecx, ecx
mov dword [esp + 0x20], ecx
test edx, edx
je 0x1002a375
mov ecx, dword [edx]
mov dword [esp + 0x20], ecx
xor edi, edi
add edx, 4
je 0x1002a37e
mov edi, dword [edx]
xor ebp, ebp
add edx, 4
je 0x1002a387
mov ebp, dword [edx]
mov edx, dword [ebx + 8]
sub eax, 8
mov dword [esp + 0x10], edx
sub edi, dword [eax + 4]
sub esi, dword [eax]
test edx, edx
je 0x1002a3f7
nop word [eax + eax]
sub eax, 8
mov dword [esp + 0x14], eax
mov eax, esi
mov esi, ebp
mov ebp, edi
mov edi, ecx
mov ecx, eax
mov dword [esp + 0x20], ecx
lea ebx, [eax*2 + 1]
imul ebx, eax
lea edx, [ebp*2 + 1]
mov eax, dword [esp + 0x14]
imul edx, ebp
sub edi, dword [eax + 4]
sub esi, dword [eax]
rol ebx, 5
movzx ecx, bl
and ecx, 0x1f
rol edx, 5
ror edi, cl
movzx ecx, dl
xor edi, edx
and ecx, 0x1f
ror esi, cl
mov ecx, dword [esp + 0x20]
xor esi, ebx
sub dword [esp + 0x10], 1
jne 0x1002a3a0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
sub ebp, dword [eax + 4]
sub ecx, dword [eax]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x1002a414
mov eax, dword [eax]
xor esi, eax
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
test edx, edx
je 0x1002a41e
mov dword [edx], esi
lea esi, [edx + 4]
test eax, eax
lea edx, [eax + 4]
cmove edx, eax
test edx, edx
je 0x1002a42f
xor ecx, dword [edx]
test esi, esi
je 0x1002a435
mov dword [esi], ecx
add esi, 4
lea ecx, [edx + 4]
test edx, edx
cmove ecx, edx
test ecx, ecx
je 0x1002a446
xor edi, dword [ecx]
test esi, esi
je 0x1002a44c
mov dword [esi], edi
add esi, 4
lea eax, [ecx + 4]
test ecx, ecx
cmove eax, ecx
test eax, eax
je 0x1002a45f
mov eax, dword [eax]
xor ebp, eax
test esi, esi
je 0x1002a465
mov dword [esi], ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x1002a470
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp], 0
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, dword [esi + 0x18]
test eax, eax
je 0x1002a490
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
xor ebx, ebx
add eax, 4
je 0x1002a499
mov ebx, dword [eax]
lea ecx, [eax + 4]
xor eax, eax
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x1002a4ac
mov eax, dword [ecx]
mov dword [esp + 0x18], eax
xor edx, edx
add ecx, 4
je 0x1002a4b5
mov edx, dword [ecx]
mov ecx, dword [esi + 8]
push edi
mov edi, dword [ebp]
add edi, ebx
mov dword [esp + 0x14], ecx
mov ebx, dword [ebp + 4]
add ebp, 8
add ebx, edx
test ecx, ecx
je 0x1002a522
nop
lea edx, [edi*2 + 1]
imul edx, edi
lea eax, [ebx*2 + 1]
imul eax, ebx
rol edx, 5
rol eax, 5
mov esi, edx
xor esi, dword [esp + 0x10]
movzx ecx, al
and ecx, 0x1f
mov dword [esp + 0x10], edi
rol esi, cl
mov edi, eax
xor edi, dword [esp + 0x1c]
mov eax, ebx
mov ebx, dword [ebp]
movzx ecx, dl
add ebx, esi
and ecx, 0x1f
mov dword [esp + 0x1c], eax
rol edi, cl
add edi, dword [ebp + 4]
add ebp, 8
sub dword [esp + 0x14], 1
jne 0x1002a4d0
add eax, dword [ebp + 4]
mov ecx, dword [ebp]
add ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1002a540
mov eax, dword [eax]
xor ecx, eax
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
test edx, edx
je 0x1002a54a
mov dword [edx], ecx
lea esi, [edx + 4]
test eax, eax
lea edx, [eax + 4]
cmove edx, eax
test edx, edx
je 0x1002a55b
xor edi, dword [edx]
test esi, esi
je 0x1002a561
mov dword [esi], edi
add esi, 4
lea ecx, [edx + 4]
test edx, edx
pop edi
cmove ecx, edx
mov edx, dword [esp + 0x18]
test ecx, ecx
je 0x1002a577
xor edx, dword [ecx]
test esi, esi
je 0x1002a57d
mov dword [esi], edx
add esi, 4
lea eax, [ecx + 4]
test ecx, ecx
cmove eax, ecx
test eax, eax
je 0x1002a590
mov eax, dword [eax]
xor ebx, eax
test esi, esi
je 0x1002a596
mov dword [esi], ebx
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x1003e170
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 8
mov edx, dword [esp + 0x10]
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov edi, dword [esp + 0x1c]
cmp eax, 4
jb 0x1003e1a8
mov esi, eax
shr esi, 2
nop
mov ecx, dword [edi]
sub eax, 4
xor ecx, dword [edx]
add edi, 4
or ebx, ecx
add edx, 4
sub esi, 1
jne 0x1003e190
mov dword [esp + 0x24], eax
mov esi, ebx
mov ecx, ebx
shr esi, 8
xor ebp, ebp
or esi, ebx
shr ecx, 0x10
and esi, 0xff00
or esi, ecx
movzx ecx, bl
shr esi, 8
or esi, ecx
mov dword [esp + 0x10], esi
test eax, eax
je 0x1003e297
cmp eax, 8
jb 0x1003e278
mov ebx, eax
mov esi, edi
and ebx, 0xfffffff8
xorps xmm4, xmm4
sub esi, edx
xorps xmm3, xmm3
mov dword [esp + 0x14], esi
mov ecx, edx
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
nop dword [eax + eax]
movd xmm2, dword [eax + ecx]
lea ecx, [ecx + 8]
movd xmm1, dword [ecx - 8]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [ecx - 4]
por xmm4, xmm2
punpcklbw xmm1, xmm0
movd xmm2, dword [edi + ebp + 4]
add ebp, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp ebp, ebx
jb 0x1003e200
mov eax, dword [esp + 0x24]
por xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd ecx, xmm3
or esi, ecx
cmp ebp, eax
jae 0x1003e297
sub edi, edx
lea ebx, [edx + ebp]
sub eax, ebp
movzx edx, byte [ebx + edi]
lea ebx, [ebx + 1]
movzx ecx, byte [ebx - 1]
xor edx, ecx
or esi, edx
sub eax, 1
jne 0x1003e283
pop edi
test esi, esi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret