joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10032890
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
push edi
mov esi, ecx
call fcn.10031f80
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp ebx, 1
je 0x100328d3
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x100328c6
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call edi
cmp eax, 0xb7
je 0x100329cb
test ebx, ebx
je 0x100329cb
push 8
call fcn.1007c3b0
xor ecx, ecx
mov dword [ebp - 0xc], eax
add esp, 4
mov dword [ebp - 8], 0
lea edx, [ebp - 0xc]
mov dword [ebp - 4], 3
mov word [eax], cx
mov ecx, esi
call fcn.10032050
test al, al
je 0x100329c0
cmp dword [ebp - 8], 0
jne 0x10032925
cmp ebx, 1
jne 0x100329c0
push esi
lea ecx, [ebp - 0xc]
call fcn.10028700
mov esi, dword [ebp - 0xc]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10032949
push esi
mov bl, 1
call fcn.1007bfd8
mov al, bl
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call edi
cmp eax, 0xb7
je 0x10032966
push esi
xor bl, bl
call fcn.1007bfd8
mov al, bl
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x48]
call fcn.10021750
push esi
lea ecx, [ebp - 0x48]
call fcn.10029200
test al, al
jne 0x1003299a
push dword [ebp - 0x20]
xor bl, bl
call fcn.1007bfd8
add esp, 4
push esi
call fcn.1007bfd8
mov al, bl
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x28]
push dword [ebp - 0x20]
shr ebx, 4
and bl, 1
call fcn.1007bfd8
add esp, 4
push esi
call fcn.1007bfd8
mov al, bl
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0xc]
call fcn.1007bfd8
add esp, 4
call edi
cmp eax, 0xb7
je 0x100329dd
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x80]
call fcn.10021750
push esi
lea ecx, [ebp - 0x80]
call fcn.10029200
test al, al
jne 0x10032a08
push dword [ebp - 0x58]
xor bl, bl
call fcn.1007bfd8
mov al, bl
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x60]
push dword [ebp - 0x58]
shr ebx, 4
and bl, 1
call fcn.1007bfd8
add esp, 4
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10032c70
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
call fcn.10029160
cmp eax, 0xffffffff
je 0x10032ca2
mov edx, eax
and dl, 0x11
cmp dl, 1
jne 0x10032ca2
and eax, 0xfffffffe
mov ecx, esi
mov edx, eax
call fcn.10032720
test al, al
jne 0x10032ca2
pop esi
mov esp, ebp
pop ebp
ret
push edi
mov ecx, esi
call fcn.10031f80
mov edi, eax
cmp edi, 1
je 0x10032cc4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10032cc4
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x10032d35
push 8
call fcn.1007c3b0
xor ecx, ecx
mov dword [ebp - 0xc], eax
add esp, 4
mov dword [ebp - 8], 0
lea edx, [ebp - 0xc]
mov dword [ebp - 4], 3
mov word [eax], cx
mov ecx, esi
call fcn.10032050
test al, al
je 0x10032d2a
cmp dword [ebp - 8], 0
jne 0x10032d0a
cmp edi, 1
jne 0x10032d2a
push esi
lea ecx, [ebp - 0xc]
call fcn.10028700
mov esi, dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
mov edi, eax
call fcn.1007bfd8
add esp, 4
test edi, edi
setne al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp - 0xc]
call fcn.1007bfd8
add esp, 4
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10037560
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
mov esi, ecx
mov ecx, 0x8000000
push edi
cmp byte [esi + 0x16], al
mov dword [esi + 0xc18], 0
setne al
xor edx, edx
cmp byte [esi + 0x15], dl
cmovne ecx, edx
lea eax, [eax*2 + 1]
test ebx, ebx
je 0x100375ae
cmp word [ebx], dx
je 0x100375ae
push edx
push ecx
push 3
push edx
push eax
push connect
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x100375c3
push 0
push ecx
push 3
push 0
push eax
push connect
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x100375df
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x100375df
mov dword [esi + 0xc18], 1
cmp edi, 0xffffffff
mov byte [esi + 0x12], 0
mov dword [esi + 0xc], 0
setne al
mov byte [esi + 0x10], 0
mov byte [ebp + 0xf], al
cmp edi, 0xffffffff
je 0x1003767b
mov dword [esi + 4], edi
test ebx, ebx
je 0x10037629
mov edx, esi
mov ecx, ebx
sub edx, ebx
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx + 0x416], ax
movzx eax, word [ecx - 2]
test ax, ax
jne 0x10037610
jmp 0x10037632
xor eax, eax
mov word [esi + 0x418], ax
push 0
push 0
push 0x1000000
lea eax, [esi + 0x17]
push eax
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [esi + 4], 0xffffffff
je 0x10037678
xor ecx, ecx
cmp dword [ecx*4 + 0x100e0b78], 0
je 0x10037671
inc ecx
cmp ecx, 0x100
jb 0x10037654
mov al, byte [ebp + 0xf]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
mov dword [ecx*4 + 0x100e0b78], esi
mov al, byte [ebp + 0xf]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x10037860
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc], 1
jne 0x10037887
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, 0x4e20
mov dword [esi + 4], eax
cmp dword [ebp + 0xc], edi
cmovle edi, dword [ebp + 0xc]
jmp 0x1003788a
mov edi, dword [ebp + 0xc]
push 0
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100378ff
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x100378d9
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x100378ba
cmp eax, 3
jne 0x100378d9
cmp edi, 0x4e20
jle 0x100378d9
push 0x4e20
push dword [ebp + 8]
mov ecx, esi
call fcn.10037860
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 0xc], 1
jne 0x100378f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x100378f4
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
or eax, 0xffffffff
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10042f10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x100e02ac], 0
push ebx
push esi
mov ebx, edx
mov edx, ecx
push edi
jne 0x10042f28
call fcn.10042e80
mov esi, dword [ebp + 8]
test esi, esi
je 0x10042f4d
nop
test bl, 7
je 0x10042f4d
movzx ecx, byte [ebx]
inc ebx
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100e02a8]
sub esi, 1
jne 0x10042f30
cmp esi, 8
jb 0x10042fdc
mov ecx, esi
shr ecx, 3
nop dword [eax + eax]
xor edx, dword [ebx]
sub esi, 8
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100e02a8]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100e02a8]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100e02a8]
mov eax, edx
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + 0x100e02a8]
xor edx, dword [ebx + 4]
add ebx, 8
xor edx, eax
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100e02a8]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100e02a8]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100e02a8]
movzx eax, dl
shr edx, 8
xor edx, dword [eax*4 + 0x100e02a8]
sub ecx, 1
jne 0x10042f60
xor edi, edi
test esi, esi
je 0x10042ffa
movzx ecx, byte [edi + ebx]
inc edi
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100e02a8]
cmp edi, esi
jb 0x10042fe2
pop edi
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x10043470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], ecx
test esi, esi
je 0x100434f5
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x100434f5
movups xmm1, xmmword [ecx + 4]
cdq
and edx, 0xf
push edi
lea edi, [edx + eax]
sar edi, 4
mov dword [ebp + 0xc], edi
mov dword [ebp + 8], edi
test edi, edi
jle 0x100434e4
push ebx
mov ebx, dword [ebp + 0x10]
mov edi, ecx
sub ebx, esi
nop dword [eax]
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
push esi
call fcn.100437b0
movups xmm0, xmmword [ebp - 0x14]
mov eax, dword [ebp + 8]
dec eax
pxor xmm0, xmm1
mov dword [ebp + 8], eax
movups xmm1, xmmword [esi]
movups xmmword [ebx + esi], xmm0
add esi, 0x10
movups xmmword [ebp - 0x14], xmm0
test eax, eax
jg 0x100434b0
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
pop ebx
shl edi, 4
mov eax, edi
pop edi
movups xmmword [ecx + 4], xmm1
pop esi
mov esp, ebp
pop ebp
ret 0xc
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10043500
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100dc008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
movups xmm0, xmmword [eax]
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x28], ebx
movups xmmword [ebp - 0x24], xmm0
movups xmm0, xmmword [eax + 0x10]
xor eax, eax
xor esi, esi
movups xmmword [ebp - 0x14], xmm0
cmp edi, 0xa
jg 0x10043661
cmp esi, 4
jge 0x10043576
nop
cmp eax, 4
jge 0x10043579
movzx ecx, byte [ebp + esi*4 - 0x24]
lea edx, [eax + edi*4]
mov byte [ebx + edx*4 + 0x14], cl
lea ecx, [eax + edi*4]
lea edx, [ebx + ecx*4]
inc eax
movzx ecx, byte [ebp + esi*4 - 0x23]
mov byte [edx + 0x15], cl
movzx ecx, byte [ebp + esi*4 - 0x22]
mov byte [edx + 0x16], cl
movzx ecx, byte [ebp + esi*4 - 0x21]
inc esi
mov byte [edx + 0x17], cl
cmp esi, 4
jl 0x10043540
cmp eax, 4
jne 0x1004357e
inc edi
xor eax, eax
cmp esi, 4
jl 0x10043530
cmp edi, 0xa
jg 0x10043661
mov esi, 0x100e1178
movzx ecx, byte [ebp - 0x17]
mov ebx, 3
mov dl, byte [ebp - 0x24]
xor dl, byte [ecx + 0x100e0f78]
movzx ecx, byte [ebp - 0x16]
xor dl, byte [esi]
mov byte [ebp - 0x24], dl
movzx ecx, byte [ecx + 0x100e0f78]
xor byte [ebp - 0x23], cl
movzx ecx, byte [ebp - 0x15]
movzx ecx, byte [ecx + 0x100e0f78]
xor byte [ebp - 0x22], cl
movzx ecx, byte [ebp - 0x18]
movzx ecx, byte [ecx + 0x100e0f78]
xor byte [ebp - 0x21], cl
inc esi
mov dword [ebp - 0x2c], esi
lea esi, [ebp - 0x23]
nop dword [eax]
movzx ecx, byte [esi - 1]
lea esi, [esi + 4]
xor byte [esi - 1], cl
movzx ecx, byte [esi - 4]
xor byte [esi], cl
movzx ecx, byte [esi - 3]
xor byte [esi + 1], cl
movzx ecx, byte [esi - 2]
xor byte [esi + 2], cl
sub ebx, 1
jne 0x100435e0
mov ebx, dword [ebp - 0x28]
xor esi, esi
cmp edi, 0xa
jg 0x10043661
cmp esi, 4
jge 0x10043648
cmp eax, 4
jge 0x1004364b
movzx ecx, byte [ebp + esi*4 - 0x24]
lea edx, [eax + edi*4]
mov byte [ebx + edx*4 + 0x14], cl
lea ecx, [eax + edi*4]
lea edx, [ebx + ecx*4]
inc eax
movzx ecx, byte [ebp + esi*4 - 0x23]
mov byte [edx + 0x15], cl
movzx ecx, byte [ebp + esi*4 - 0x22]
mov byte [edx + 0x16], cl
movzx ecx, byte [ebp + esi*4 - 0x21]
inc esi
mov byte [edx + 0x17], cl
cmp esi, 4
jl 0x10043612
cmp eax, 4
jne 0x10043650
inc edi
xor eax, eax
cmp esi, 4
jl 0x10043608
mov esi, dword [ebp - 0x2c]
cmp edi, 0xa
jle 0x10043591
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007bfb0
mov esp, ebp
pop ebp
ret 4
Function at 0x10043680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100dc008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0x10
nop word [eax + eax]
xor eax, eax
movzx ecx, byte [esi + edi + 0x17]
movzx edx, byte [esi + edi + 0x16]
movzx ebx, byte [eax + ecx*4 + 0x100e3d98]
xor bl, byte [eax + edx*4 + 0x100e3998]
movzx ecx, byte [esi + edi + 0x15]
movzx edx, byte [esi + edi + 0x1a]
xor bl, byte [eax + ecx*4 + 0x100e3598]
movzx ecx, byte [esi + edi + 0x14]
xor bl, byte [eax + ecx*4 + 0x100e3198]
movzx ecx, byte [esi + edi + 0x1b]
mov byte [ebp + eax - 0x14], bl
movzx ebx, byte [eax + ecx*4 + 0x100e3d98]
xor bl, byte [eax + edx*4 + 0x100e3998]
movzx ecx, byte [esi + edi + 0x19]
movzx edx, byte [esi + edi + 0x1e]
xor bl, byte [eax + ecx*4 + 0x100e3598]
movzx ecx, byte [esi + edi + 0x18]
xor bl, byte [eax + ecx*4 + 0x100e3198]
movzx ecx, byte [esi + edi + 0x1f]
mov byte [ebp + eax - 0x10], bl
movzx ebx, byte [eax + ecx*4 + 0x100e3d98]
xor bl, byte [eax + edx*4 + 0x100e3998]
movzx ecx, byte [esi + edi + 0x1d]
movzx edx, byte [edi + esi + 0x22]
xor bl, byte [eax + ecx*4 + 0x100e3598]
movzx ecx, byte [esi + edi + 0x1c]
xor bl, byte [eax + ecx*4 + 0x100e3198]
movzx ecx, byte [edi + esi + 0x23]
mov byte [ebp + eax - 0xc], bl
movzx ebx, byte [eax + ecx*4 + 0x100e3d98]
movzx ecx, byte [edi + esi + 0x21]
xor bl, byte [eax + edx*4 + 0x100e3998]
xor bl, byte [eax + ecx*4 + 0x100e3598]
movzx ecx, byte [edi + esi + 0x20]
xor bl, byte [eax + ecx*4 + 0x100e3198]
mov byte [ebp + eax - 8], bl
inc eax
cmp eax, 4
jl 0x100436a2
movups xmm0, xmmword [ebp - 0x14]
movups xmmword [edi + esi + 0x14], xmm0
add esi, 0x10
cmp esi, 0xa0
jl 0x100436a0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007bfb0
mov esp, ebp
pop ebp
ret
Function at 0x10044240
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
mov esi, ecx
call fcn.10047100
mov edi, dword [ebp + 0xc]
mov dword [esi + 0x40], eax
cmp dword [esi + 0x1c], edi
jb 0x100442a8
ja 0x10044270
mov eax, dword [ebp + 8]
cmp dword [esi + 0x18], eax
jbe 0x100442a8
cmp dword [esi + 0x30], 1
je 0x10044281
push ecx
push 0
push dword [esi + 0x3c]
call fcn.10047360
push ecx
push 0
push dword [esi + 0x3c]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
call fcn.10047360
mov ebx, dword [sym.imp.KERNEL32.dll_TlsGetValue]
nop
mov eax, dword [esi + 0x30]
cmp eax, 2
jne 0x1004432c
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 4]
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x24], eax
lea eax, [esi + 0x2c]
mov edx, dword [ecx]
push eax
lea eax, [esi + 0x28]
push eax
push dword [esi + 0x24]
push dword [esi + 0x20]
call dword [edx]
push dword [0x100dcf20]
mov edi, dword [esi + 0x3c]
mov dword [ebp - 4], eax
call ebx
test edi, edi
jne 0x100442ee
mov edi, dword [eax + 8]
mov ecx, dword fs:[0x10]
push edi
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call dword [sym.imp.KERNEL32.dll_SwitchToFiber]
push dword [0x100dcf20]
call ebx
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x100442b0
push dword [eax + 0x14]
push dword [eax + 0xc]
call ecx
add esp, 8
jmp 0x100442b0
cmp eax, 3
jne 0x100443ac
mov eax, dword [esi + 0x38]
cdq
add eax, dword [esi + 0x18]
adc edx, dword [esi + 0x1c]
cmp edx, edi
ja 0x100443ac
jb 0x10044348
mov ecx, dword [ebp + 8]
cmp eax, ecx
ja 0x100443af
push dword [0x100dcf20]
mov edi, dword [esi + 0x3c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
mov dword [esi + 0x38], 0
call ebx
test edi, edi
jne 0x10044367
mov edi, dword [eax + 8]
mov ecx, dword fs:[0x10]
push edi
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call dword [sym.imp.KERNEL32.dll_SwitchToFiber]
push dword [0x100dcf20]
call ebx
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x100442b0
push dword [eax + 0x14]
push dword [eax + 0xc]
call ecx
add esp, 8
jmp 0x100442b0
mov ecx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 8], edi
cmp dword [ebp - 4], edi
jne 0x100443dc
cmp dword [esi + 0x30], 1
jne 0x100443c8
mov dword [ebp - 4], 0xb
jmp 0x100443dc
mov edi, dword [esi + 0x38]
sub edi, ecx
mov ecx, dword [esi + 0x34]
sub ecx, dword [esi + 0x18]
add edi, dword [esi + 0x18]
add ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
push dword [0x100dcf20]
call ebx
add dword [eax + 4], 0xffffffff
jne 0x10044409
push 0
push dword [0x100dcf20]
mov dword [eax], 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0x100e06b0]
test eax, eax
je 0x10044409
call eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
mov dword [esi + 0x40], 0
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10044730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 4]
xor eax, dword [ecx + 0x208]
mov edx, dword [edi]
xor edx, dword [ecx + 0x204]
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 8]
xor eax, dword [ecx + 0x20c]
mov dword [ebp - 8], edx
mov edx, dword [edi + 0xc]
xor edx, dword [ecx + 0x210]
mov dword [ebp - 0x14], eax
xor eax, eax
mov edi, dword [ebp - 0x14]
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], eax
and eax, 3
rol edx, 0xb
add edx, edi
mov esi, dword [ecx + eax*4 + 0x204]
xor edx, esi
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx ebx, byte [eax + ecx + 0x104]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + ecx + 0x104]
shl eax, 8
or ebx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ebx, 8
movzx eax, byte [eax + ecx + 0x104]
or ebx, eax
movzx eax, dl
mov edx, edi
shl ebx, 8
ror edx, 0xf
xor edx, dword [ebp - 4]
movzx eax, byte [eax + ecx + 0x104]
add edx, esi
or ebx, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
xor ebx, dword [ebp - 8]
mov dword [ebp - 8], edi
mov edi, ebx
movzx esi, byte [eax + ecx + 0x104]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + ecx + 0x104]
shl eax, 8
or esi, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + ecx + 0x104]
or esi, eax
movzx eax, dl
shl esi, 8
movzx eax, byte [eax + ecx + 0x104]
or esi, eax
mov eax, dword [ebp - 4]
xor esi, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov edx, esi
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], eax
cmp eax, 0x20
jl 0x10044773
mov eax, dword [ecx + 0x204]
mov edi, dword [ebp + 8]
xor eax, ebx
push edi
mov dword [edi], eax
mov eax, dword [ecx + 0x208]
xor eax, esi
mov dword [edi + 4], eax
mov eax, dword [ecx + 0x20c]
xor eax, dword [ebp - 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x210]
xor eax, dword [ebp - 0xc]
mov dword [edi + 0xc], eax
call fcn.10044a10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10044890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100dc008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], edi
mov eax, dword [edi + 4]
xor eax, dword [ecx + 0x208]
mov edx, dword [edi]
xor edx, dword [ecx + 0x204]
movups xmm0, xmmword [edi]
mov dword [ebp - 0x20], eax
mov eax, dword [edi + 8]
xor eax, dword [ecx + 0x20c]
mov dword [ebp - 0x1c], edx
mov edx, dword [edi + 0xc]
xor edx, dword [ecx + 0x210]
mov dword [ebp - 0x28], eax
mov eax, 0x1f
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 0x24], eax
nop word [eax + eax]
and eax, 3
rol edx, 0xb
add edx, edi
mov esi, dword [ecx + eax*4 + 0x204]
xor edx, esi
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx ebx, byte [eax + ecx + 0x104]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + ecx + 0x104]
shl eax, 8
or ebx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ebx, 8
movzx eax, byte [eax + ecx + 0x104]
or ebx, eax
movzx eax, dl
mov edx, edi
shl ebx, 8
ror edx, 0xf
xor edx, dword [ebp - 0x18]
movzx eax, byte [eax + ecx + 0x104]
add edx, esi
or ebx, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
xor ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], edi
mov edi, ebx
movzx esi, byte [eax + ecx + 0x104]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + ecx + 0x104]
shl eax, 8
or esi, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + ecx + 0x104]
or esi, eax
movzx eax, dl
shl esi, 8
movzx eax, byte [eax + ecx + 0x104]
or esi, eax
mov eax, dword [ebp - 0x18]
xor esi, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov edx, esi
mov eax, dword [ebp - 0x24]
sub eax, 1
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x24], eax
jns 0x100448f0
mov eax, dword [ecx + 0x204]
mov edi, dword [ebp - 0x30]
xor eax, ebx
mov dword [edi], eax
mov eax, dword [ecx + 0x208]
xor eax, esi
mov dword [edi + 4], eax
mov eax, dword [ecx + 0x20c]
xor eax, dword [ebp - 0x1c]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0x210]
xor eax, dword [ebp - 0x20]
mov dword [edi + 0xc], eax
lea eax, [ebp - 0x14]
push eax
call fcn.10044a10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007bfb0
mov esp, ebp
pop ebp
ret 4
Function at 0x10044a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], 4
lea eax, [edx + 1]
mov dword [ebp - 0x18], esi
push edi
mov ecx, dword [esi + 0x210]
mov edi, dword [esi + 0x204]
mov ebx, dword [esi + 0x208]
mov dword [ebp + 8], ecx
mov ecx, edx
sub ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, edx
sub ecx, eax
add ecx, 2
sub edx, eax
mov dword [ebp - 0x10], ecx
lea ecx, [edx + 3]
mov edx, dword [esi + 0x20c]
mov dword [ebp - 0x14], ecx
nop
mov ecx, dword [ebp - 0xc]
lea eax, [eax + 4]
movzx ecx, byte [ecx + eax - 4]
xor edi, dword [ecx*4 + 0x100e02a8]
mov dword [esi + 0x204], edi
movzx ecx, byte [eax - 4]
xor ebx, dword [ecx*4 + 0x100e02a8]
mov ecx, dword [ebp - 0x10]
mov dword [esi + 0x208], ebx
movzx ecx, byte [ecx + eax - 4]
xor edx, dword [ecx*4 + 0x100e02a8]
mov ecx, dword [ebp - 0x14]
mov dword [esi + 0x20c], edx
mov esi, dword [ebp + 8]
movzx ecx, byte [ecx + eax - 4]
xor esi, dword [ecx*4 + 0x100e02a8]
sub dword [ebp - 4], 1
mov dword [ebp + 8], esi
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov dword [esi + 0x210], ecx
jne 0x10044a60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10045020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10045032
sub eax, edx
or ecx, 0xffffffff
push eax
mov edx, edi
call fcn.10042f10
mov word [esi + 0x214], ax
add esp, 4
shr eax, 0x10
mov word [esi + 0x216], ax
xor eax, eax
mov dword [esi + 0x218], eax
mov word [esi + 0x21d], ax
mov byte [esi + 0x21c], al
mov al, byte [edi]
test al, al
je 0x100450f4
push ebx
mov bl, byte [esi + 0x21e]
xor bh, bh
mov dword [ebp - 8], 0
xor cl, cl
mov dword [ebp - 4], 0
nop
add cl, al
movzx edx, al
xor bh, al
mov byte [esi + 0x21c], cl
add bl, al
mov byte [ebp + 0xb], cl
movzx ecx, al
lea edi, [edi + 1]
movzx eax, word [edx*4 + 0x100e02a8]
xor ax, cx
rol bl, 1
xor word [ebp - 4], ax
mov eax, dword [ebp - 4]
mov word [esi + 0x218], ax
movzx eax, word [edx*4 + 0x100e02aa]
add ax, cx
mov byte [esi + 0x21d], bh
mov ecx, dword [ebp - 8]
add cx, ax
mov byte [esi + 0x21e], bl
mov word [esi + 0x21a], cx
mov al, byte [edi]
mov dword [ebp - 8], ecx
mov cl, byte [ebp + 0xb]
test al, al
jne 0x10045090
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10045150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, ecx
test ebx, ebx
je 0x100451f7
push esi
mov edx, 0x1234
push edi
nop dword [eax + eax]
movzx edi, word [eax + 0x214]
add di, dx
mov dx, word [eax + 0x21a]
mov ecx, edi
shr ecx, 1
movzx ecx, cl
movzx ecx, word [ecx*4 + 0x100e02a8]
xor word [eax + 0x216], cx
mov ecx, edi
shr ecx, 1
movzx ecx, cl
movzx ecx, word [ecx*4 + 0x100e02aa]
sub word [eax + 0x218], cx
mov ecx, 1
movzx esi, word [eax + 0x218]
ror dx, cl
xor dx, word [eax + 0x216]
ror dx, cl
movzx ecx, dx
mov edx, dword [ebp + 8]
mov word [eax + 0x21a], cx
xor ecx, esi
xor ecx, edi
mov word [eax + 0x214], cx
shr ecx, 8
xor byte [edx], cl
inc edx
mov dword [ebp + 8], edx
mov edx, 0x1234
sub ebx, 1
jne 0x10045170
pop edi
pop esi
pop ebx
pop ebp
ret 8