joyce8/EMBER2024-capa huggingface dataset:
Function at 0x674300
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
call fcn.00704a10
test eax, eax
jne 0x67447a
push edi
cmp byte [0x82f384], al
jne 0x674321
xor edi, edi
jmp 0x67433c
push 5
call dword [0x82f3c8]
mov edi, eax
add esp, 4
test edi, edi
je 0x67433c
push edi
call dword [0x82f3d0]
add esp, 4
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
jle 0x674460
test esi, esi
je 0x674460
cmp dword [0x83de00], 0
jne 0x6743f3
push 0
call fcn.006709d0
movups xmm0, xmmword [str.expand_32_byte_k]
add esp, 4
movups xmmword [0x83de00], xmm0
test eax, eax
jne 0x674388
push 0x2c
push eax
push 0x83de10
call sub.VCRUNTIME140.dll_memset
jmp 0x6743d2
mov ecx, dword [0x82f494]
test ecx, ecx
je 0x6743c5
xorps xmm0, xmm0
mov dword [0x83de10], ecx
movlpd qword [0x83de14], xmm0
movlpd qword [0x83de1c], xmm0
movlpd qword [0x83de24], xmm0
movlpd qword [0x83de2c], xmm0
movlpd qword [0x83de34], xmm0
jmp 0x6743d5
push 0x83de10
push 0x2c
push eax
mov eax, dword [eax + 0x38]
call eax
add esp, 0xc
mov eax, dword [0x83de30]
xor cl, cl
mov dword [0x83de3c], eax
mov dword [0x83de30], 0
mov byte [0x83de80], cl
jmp 0x6743f9
mov cl, byte [0x83de80]
movzx eax, cl
cmp ebx, eax
jle 0x674443
test cl, cl
je 0x674421
movzx eax, cl
push eax
push 0x83de40
push esi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [0x83de80]
add esp, 0xc
sub ebx, eax
add esi, eax
inc dword [0x83de30]
mov edx, 0x83de00
mov ecx, 0x83de40
call fcn.00674010
mov cl, 0x40
mov byte [0x83de80], cl
cmp ebx, 0x40
jg 0x674400
movzx eax, cl
sub eax, ebx
push ebx
add eax, 0x83de40
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
sub byte [0x83de80], bl
jmp 0x67446a
mov dword [0x83de00], 0
test edi, edi
je 0x674478
push edi
call dword [0x82f3d8]
add esp, 4
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x6a6ee0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
push 0
push 0x14
mov dword [ebx], 0
call fcn.006711f0
mov esi, eax
add esp, 8
test esi, esi
jne 0x6a6f10
lea eax, [esi + 7]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x82f384], 0
mov edi, dword [ebp + 8]
je 0x6a6f5b
mov eax, dword [0x82f480]
test eax, eax
je 0x6a6f33
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x6a6f5b
mov eax, dword [ebp - 4]
mov dword [esi + 8], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x674480
push 0
push 0
mov dword [esi + 0xc], edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x6a6f68
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
cmp dword [esi + 8], 0
jne 0x6a6f81
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call dword [ebp - 4]
add esp, 4
mov dword [esi + 0x10], eax
pop edi
mov dword [ebx], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6b5b10
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push dword [ebp + 0x10]
mov edi, edx
mov ebx, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
mov byte [ebx + 0x10], 1
push edi
push edi
push str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d___Q___d_NULL
push ebx
call fcn.006bbb00
add esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x6b5b51
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
push str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1___Q___d_NULL
push ebx
call fcn.006bbb00
add esp, 0x14
pop edi
pop ebx
pop ebp
ret
Function at 0x711e20
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
test edx, edx
push ebx
mov ecx, 0x367cd507
mov dword [ebp - 0xc], 0xc1059ed8
mov dword [eax], 0
mov ebx, 0xa54ff53a
mov dword [eax + 4], 0
mov edx, 0x510e527f
mov eax, 0xbb67ae85
cmovne eax, ecx
mov ecx, 0x3070dd17
mov dword [ebp - 0x10], eax
mov eax, 0x3c6ef372
cmovne eax, ecx
mov ecx, 0x5be0cd19
mov dword [ebp - 0x14], eax
mov eax, 0xf70e5939
cmovne ebx, eax
mov eax, 0x64f98fa7
push esi
push edi
mov edi, 0x1f83d9ab
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 8]
cmovne edi, eax
mov eax, 0x68581511
mov esi, 0x9b05688c
cmovne esi, eax
test ebx, ebx
mov ebx, dword [ebp - 4]
mov eax, 0xffc00b31
cmovne edx, eax
mov eax, 0xbefa4fa4
cmovne ecx, eax
mov eax, 0x6a09e667
cmovne eax, dword [ebp - 0xc]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], esi
mov dword [eax + 0x20], edi
pop edi
mov dword [eax + 0x24], ecx
mov ecx, dword [ebp - 8]
pop esi
mov dword [eax + 0xe8], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x717820
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Encode data using xor
Get local ipv4 addresses
Get socket information
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b95e2
mov eax, dword fs:[0]
push eax
sub esp, 0x1c4
mov eax, dword [0x82f184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1d0], edi
mov dword [ebp - 0x1cc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea eax, [ebp - 0x1b4]
mov dword [ebp - 4], 0
push eax
push 0x202
mov dword [ebp - 0x1cc], 1
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
mov dword [ebp - 0x1c0], 7
xorps xmm0, xmm0
mov dword [ebp - 0x1c8], esi
mov eax, 2
mov dword [ebp - 0x1bc], 0x95829780
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x24], ax
xor ecx, ecx
mov dword [ebp - 0x1b8], 0xbf869384
nop word [eax + eax]
lea eax, [ecx - 0x48]
xor byte [ebp + ecx - 0x1bc], al
inc ecx
mov eax, dword [ebp - 0x1c0]
cmp ecx, eax
jb 0x7178e0
mov byte [ebp + eax - 0x1bc], 0
lea eax, [ebp - 0x1bc]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x35
mov dword [ebp - 0x20], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
lea eax, [ebp - 0x24]
push 0x10
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
mov esi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test esi, esi
mov esi, dword [ebp - 0x1c8]
jne 0x71798a
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x10
push eax
lea eax, [ebp - 0x1c4]
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x1c4], xmm0
call dword [sym.imp.WS2_32.dll_getsockname]
push dword [ebp - 0x1c0]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, eax
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x1c8], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x717974
sub ecx, dword [ebp - 0x1c8]
push ecx
push edx
mov ecx, edi
call fcn.00407ab0
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0076d59e
mov esp, ebp
pop ebp
ret
Function at 0x719580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b9918
mov eax, dword fs:[0]
push eax
sub esp, 0x70
push ebx
push esi
push edi
mov eax, dword [0x82f184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov dword [ebp - 0x10], eax
mov edi, ecx
mov dword [ebp - 0x18], edi
movzx esi, word [eax + 4]
xor ebx, ebx
test esi, esi
je 0x719651
movzx eax, word [edx + 0x12]
lea ecx, [edx + 6]
cmp eax, dword [ebp + 0x10]
lea edx, [edx + 0xe]
cmovne ecx, ebx
mov ebx, ecx
sub esi, 1
jne 0x7195c0
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x719651
mov esi, dword [ebp + 0xc]
lea ebx, [esi + 0x26]
push ebx
call fcn.0078f0da
mov edi, eax
xor eax, eax
mov word [ebp - 0x30], ax
mov eax, dword [ebp - 0x10]
push esi
push dword [ebp + 8]
mov cx, word [eax + 2]
mov eax, 1
mov word [ebp - 0x2e], cx
mov ecx, dword [ebp - 0x30]
mov dword [edi], ecx
mov ecx, dword [ebp - 0x14]
mov word [edi + 4], ax
mov eax, dword [ecx]
mov dword [edi + 6], eax
mov eax, dword [ecx + 4]
mov dword [edi + 0xa], eax
lea eax, [edi + 0x16]
mov dword [edi + 0xe], esi
push eax
mov dword [edi + 0x12], 0x16
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x18]
add esp, 0x10
mov dword [eax], edi
mov dword [eax + 4], ebx
mov byte [eax + 0x1c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x7c], 0x21
xor eax, eax
mov dword [ebp - 0x78], 0xd600fc
mov dword [ebp - 0x74], 0x9c00d4
mov dword [ebp - 0x70], 0x9d00c8
mov dword [ebp - 0x6c], 0xd000d8
mov dword [ebp - 0x68], 0xaf00b5
mov dword [ebp - 0x64], 0xe300a6
mov dword [ebp - 0x60], 0xb70083
mov dword [ebp - 0x5c], 0x8e00b6
mov dword [ebp - 0x58], 0xa600ab
mov dword [ebp - 0x54], 0x8f00a4
mov dword [ebp - 0x50], 0xbf00a5
mov dword [ebp - 0x4c], 0xa1008b
mov dword [ebp - 0x48], 0xa300a4
mov dword [ebp - 0x44], 0xf300ab
mov dword [ebp - 0x40], 0xac00b6
mov dword [ebp - 0x3c], 0xbe00f6
mov dword [ebp - 0x38], 0xd900bc
lea ecx, [eax + 0xb8]
xor word [ebp + eax*2 - 0x78], cx
inc eax
mov ecx, dword [ebp - 0x7c]
cmp eax, ecx
jb 0x7196d1
xor eax, eax
mov dword [ebp - 0x20], 7
mov word [ebp + ecx*2 - 0x78], ax
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x24], eax
lea edx, [ecx + 2]
mov word [ebp - 0x34], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x719700
sub ecx, edx
lea eax, [ebp - 0x78]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x34]
call fcn.004044f0
mov dword [ebp - 0x1c], 0
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.00404120
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x34]
mov dword [edi + 0x18], eax
mov byte [edi + 0x1c], 1
call fcn.00404490
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x71a950
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x82f184]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [ecx]
movaps xmm0, xmmword [0x7e37f0]
movzx ecx, byte [eax + 0x14]
movzx edx, byte [eax + 0x17]
movzx ebx, byte [eax + 0x15]
mov dword [ebp - 0x40], ecx
movzx ecx, byte [eax + 0x13]
mov dword [ebp - 0x44], ecx
movzx ecx, byte [eax + 0x12]
mov dword [ebp - 0x48], ecx
movzx ecx, byte [eax + 0x11]
mov dword [ebp - 0x4c], ecx
movzx ecx, byte [eax + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x50], ecx
movzx ecx, byte [eax + 0xe]
mov dword [ebp - 0x54], ecx
movzx ecx, byte [eax + 0xf]
mov dword [ebp - 0x58], ecx
movzx ecx, byte [eax + 0xc]
mov dword [ebp - 0x5c], ecx
movzx ecx, byte [eax + 0xd]
mov dword [ebp - 0x60], ecx
movzx ecx, byte [eax + 8]
mov dword [ebp - 0x64], ecx
movzx ecx, byte [eax + 9]
mov dword [ebp - 0x68], ecx
movzx ecx, byte [eax + 0xa]
movzx edi, byte [eax + 0x16]
movzx eax, byte [eax + 0xb]
movups xmmword [ebp - 0xb4], xmm0
mov dword [ebp - 0x3c], esi
movaps xmm0, xmmword [0x7e4010]
movups xmmword [ebp - 0xa4], xmm0
mov dword [ebp - 0x6c], ecx
xor ecx, ecx
movaps xmm0, xmmword [0x7e3de0]
mov dword [ebp - 0x3c], eax
mov eax, 0x44
movups xmmword [ebp - 0x94], xmm0
mov dword [ebp - 0xb8], eax
movaps xmm0, xmmword [0x7e3b10]
movups xmmword [ebp - 0x84], xmm0
mov dword [ebp - 0x74], 0xa3c8c9dd
mov byte [ebp - 0x70], 0xfc
mov word [ebp - 0x6f], cx
mov byte [ebp - 0x6d], cl
nop dword [eax]
lea eax, [ecx - 0x48]
xor byte [ebp + ecx - 0xb4], al
inc ecx
mov eax, dword [ebp - 0xb8]
cmp ecx, eax
jb 0x71aa30
push edx
push edi
push ebx
push dword [ebp - 0x40]
mov byte [ebp + eax - 0xb4], 0
lea eax, [ebp - 0xb4]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
push dword [ebp - 0x3c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0071cc30
lea ecx, [ebp - 0x38]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
lea edx, [ecx + 1]
add esp, 0x48
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x71aaa1
sub ecx, edx
lea eax, [ebp - 0x38]
push ecx
push eax
mov ecx, esi
call fcn.00407ab0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0076d59e
mov esp, ebp
pop ebp
ret 4
Function at 0x7266e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add ecx, 4
pop ebp
jmp fcn.00724400
Function at 0x7293a0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7bad28
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x82f184]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ecx, edi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x20], edi
push esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0
call fcn.00404120
add edi, 0x18
mov dword [ebp - 4], 1
add esi, 0x18
mov dword [ebp - 0x1c], edi
push esi
mov ecx, edi
call fcn.00472130
lea eax, [esi + 0xc]
mov byte [ebp - 4], 2
lea ecx, [edi + 0xc]
push eax
call fcn.00404120
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
mov byte [ebp - 4], 3
lea eax, [esi + 0x3c]
lea ecx, [edi + 0x3c]
push eax
call fcn.00404120
lea eax, [esi + 0x54]
mov byte [ebp - 4], 4
lea ecx, [edi + 0x54]
push eax
call fcn.00404120
mov eax, dword [esi + 0x6c]
mov dword [edi + 0x6c], eax
movups xmm0, xmmword [esi + 0x70]
mov byte [ebp - 4], 5
movups xmmword [edi + 0x70], xmm0
movzx eax, byte [esi + 0x80]
mov byte [edi + 0x80], al
movzx eax, byte [esi + 0x81]
mov byte [edi + 0x81], al
movzx eax, byte [esi + 0x82]
mov byte [edi + 0x82], al
mov eax, dword [esi + 0x84]
mov dword [edi + 0x84], eax
mov eax, dword [esi + 0x88]
add esi, 0x8c
mov dword [edi + 0x88], eax
add edi, 0x8c
push esi
mov ecx, edi
mov dword [ebp - 0x1c], edi
call fcn.00404120
lea eax, [esi + 0x18]
mov byte [ebp - 4], 6
lea ecx, [edi + 0x18]
push eax
call fcn.00404120
lea eax, [esi + 0x30]
mov byte [ebp - 4], 7
lea ecx, [edi + 0x30]
push eax
call fcn.00404120
lea eax, [esi + 0x48]
mov byte [ebp - 4], 8
lea ecx, [edi + 0x48]
push eax
call fcn.00404120
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 1
mov edi, dword [ebp - 0x10]
cmp dword [edi + 0xb4], 0
jne 0x729571
lea eax, [ebp - 0x38]
push eax
call fcn.006603b0
mov esi, eax
add edi, 0xa4
add esp, 4
cmp edi, esi
je 0x729532
mov ecx, edi
call fcn.00404490
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [edi], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [edi + 0x10], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x24]
cmp edx, 8
jb 0x72956e
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x729564
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x729564
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0076d313
add esp, 8
mov edi, dword [ebp - 0x10]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x7384a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x18
push esi
cmp eax, 1
je 0x738636
cmp eax, 2
je 0x738636
cmp eax, 3
jne 0x73851b
push edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0xb
mov dword [ebp - 0xc], 0xd8d5d5da
mov dword [ebp - 8], 0xd9d1e2d7
mov dword [ebp - 4], 0xc3b0a4a6
call fcn.004131e0
mov esi, dword [ebp + 8]
mov edx, eax
mov ecx, edx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
lea edi, [ecx + 1]
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x738501
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.00407ab0
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 4
jne 0x738552
movaps xmm0, xmmword [0x7c8ef0]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x13
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 4], 0xcba4a6a1
call fcn.004131e0
mov ecx, dword [ebp + 8]
push eax
call fcn.00406b50
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 7
jne 0x73856c
mov ecx, dword [ebp + 8]
push 0x83c520
call fcn.00406bb0
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 8
jne 0x738586
mov ecx, dword [ebp + 8]
push 0x83c538
call fcn.00406bb0
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 9
jne 0x7385af
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 0xf]
call fcn.00735ed0
mov ecx, eax
call fcn.004131e0
mov ecx, dword [ebp + 8]
push eax
call fcn.00406b50
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x7385d8
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 0xf]
call fcn.00735ea0
mov ecx, eax
call fcn.004131e0
mov ecx, dword [ebp + 8]
push eax
call fcn.00406b50
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 6
jne 0x738601
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 0xf]
call fcn.00735f80
mov ecx, eax
call fcn.004131e0
mov ecx, dword [ebp + 8]
push eax
call fcn.00406b50
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 9
mov dword [ebp - 0xc], 0xdeded7cd
mov dword [ebp - 8], 0xdad0d4da
mov dword [ebp - 4], 0xc1a4
call fcn.004131e0
mov ecx, dword [ebp + 8]
push eax
call fcn.00406b50
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
movaps xmm0, xmmword [0x7c8eb0]
mov eax, 0x11
mov dword [ebp - 0x18], eax
xor ecx, ecx
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 4], 0xc9a6
lea eax, [ecx - 0x48]
xor byte [ebp + ecx - 0x14], al
inc ecx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
jb 0x738652
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov byte [ebp + eax - 0x14], 0
lea edx, [ecx + 1]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x738680
sub ecx, edx
lea eax, [ebp - 0x14]
push ecx
push eax
mov ecx, esi
call fcn.00407ab0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x7386a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x1c
push esi
cmp eax, 2
jne 0x73870e
movaps xmm0, xmmword [0x7c8e60]
mov eax, 0xc
mov dword [ebp - 0x14], eax
xor ecx, ecx
movups xmmword [ebp - 0x10], xmm0
lea eax, [ecx - 0x48]
xor byte [ebp + ecx - 0x10], al
inc ecx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
jb 0x7386c4
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov byte [ebp + eax - 0x10], 0
lea edx, [ecx + 1]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x7386f2
sub ecx, edx
lea eax, [ebp - 0x10]
push ecx
push eax
mov ecx, esi
call fcn.00407ab0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x738780
movaps xmm0, xmmword [0x7c8ed0]
mov eax, 0x15
mov dword [ebp - 0x1c], eax
xor ecx, ecx
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0xaea196a6
mov dword [ebp - 4], 0xcdb5
lea eax, [ecx - 0x48]
xor byte [ebp + ecx - 0x18], al
inc ecx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
jb 0x738736
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x18]
mov byte [ebp + eax - 0x18], 0
lea edx, [ecx + 1]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x738764
sub ecx, edx
lea eax, [ebp - 0x18]
push ecx
push eax
mov ecx, esi
call fcn.00407ab0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x7387da
push edi
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 5
mov dword [ebp - 8], 0xc8d5d5db
mov dword [ebp - 4], 0xbdd9
call fcn.004131e0
mov esi, dword [ebp + 8]
mov edx, eax
mov ecx, edx
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
lea edi, [ecx + 1]
mov byte [esi], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x7387c0
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.00407ab0
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x738811
movaps xmm0, xmmword [0x7c8ec0]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0x13
movups xmmword [ebp - 0x14], xmm0
mov dword [ebp - 4], 0xcbb3a5a4
call fcn.004131e0
mov ecx, dword [ebp + 8]
push eax
call fcn.00406b50
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 5
jne 0x73883a
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp + 0xf]
call fcn.00735f50
mov ecx, eax
call fcn.004131e0
mov ecx, dword [ebp + 8]
push eax
call fcn.00406b50
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], 9
lea ecx, [ebp - 0x10]
cmp eax, 4
jne 0x738860
mov dword [ebp - 0xc], 0xe4c3cbcc
mov dword [ebp - 8], 0xded7cfc8
mov dword [ebp - 4], 0xc1ac
jmp 0x738875
mov dword [ebp - 0xc], 0xdeded7cd
mov dword [ebp - 8], 0xdad0d4da
mov dword [ebp - 4], 0xc1a4
call fcn.004131e0
mov ecx, dword [ebp + 8]
push eax
call fcn.00406b50
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret