joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10117760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x1011db00
mov edx, dword fs:[0]
mov dword [ebp - 0x18], edx
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [ecx + 0xdc]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0x1c]
mov ecx, dword [0x105dc2cc]
mov esi, dword [eax + 4]
mov dword [ebp - 0x24], eax
test eax, eax
je 0x101177b6
mov edx, dword [ebp - 0x24]
cmp esi, ecx
je 0x101177ea
mov edi, dword [0x105dc2b8]
mov ebx, dword [0x105dc2f4]
mov edx, dword [ebp - 0x24]
nop word cs:[eax + eax]
cmp esi, edi
je 0x101177dc
cmp esi, ebx
jne 0x10117859
mov edx, dword [edx + 0x18]
mov esi, dword [edx + 4]
test edx, edx
je 0x101177d0
cmp esi, ecx
jne 0x101177d0
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x3c], 0
je 0x10117859
mov ecx, dword [edx + 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x40]
mov dword [ebp - 0x30], eax
cmp ecx, eax
je 0x10117859
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0x34]
mov dword [ebp - 0x2c], edx
mov edi, dword [eax + 0x38]
dec edi
mov eax, ecx
shr eax, 4
mov ebx, ecx
shr ebx, 9
xor ebx, eax
xor eax, eax
nop
and ebx, edi
lea edx, [ebx + ebx*2]
mov esi, dword [ebp - 0x2c]
mov esi, dword [esi + edx*4]
cmp esi, ecx
je 0x1011783e
cmp esi, dword [ebp - 0x30]
je 0x10117859
add ebx, eax
inc ebx
inc eax
cmp eax, edi
jbe 0x10117820
jmp 0x10117859
mov eax, dword [ebp - 0x2c]
cmp byte [eax + edx*4 + 5], 0
je 0x10117859
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax + edx*4 + 4]
mov dword [ebp - 0x10], 0
jmp 0x10117898
mov edx, dword [ebp - 0x28]
lea eax, [edx + 1]
mov dword [ebp - 0x10], 0
cmp eax, 0x100
jae 0x101178e1
mov ecx, dword [ebp - 0x20]
mov dword [ecx + 0xdc], eax
mov esi, dword [ecx + 0xe0]
cmp esi, eax
cmova eax, esi
mov dword [ecx + 0xe0], eax
movzx eax, dl
push 1
push eax
push dword [ebp - 0x24]
call fcn.10115a60
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
movzx edx, byte [ebp + 0xc]
mov ecx, dword [ecx + 0x18]
xor esi, esi
cmp ecx, 3
lea ecx, [ecx + 0x32]
cmovb esi, ecx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
movzx eax, al
movzx edx, dl
push 0
push eax
push edx
push esi
call fcn.10108a70
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
mov dword [eax + 0xdc], ecx
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, dword [ebp - 0x24]
add eax, 8
push 0xff
push 1
push 0x105353e4
push eax
call fcn.1010d850
add esp, 0x10
nop dword [eax]
push ebp
sub esp, 0x10
add ebp, 0xc
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
mov dword [eax + 0xdc], ecx
add esp, 0x10
pop ebp
ret
Function at 0x10128c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
movzx eax, byte [ebp + 4]
mov ecx, ebx
shl ecx, 4
add ecx, 0x18
push eax
push ecx
push ebp
call fcn.1012c500
add esp, 0xc
lea ecx, [ebp + 8]
sub ecx, dword [ebp + 8]
movzx ecx, byte [ecx + 0x14]
and cl, 3
mov byte [eax + 2], cl
mov byte [eax], 8
movzx ecx, byte [ebp + 4]
mov byte [eax + 1], cl
mov byte [eax + 3], 0
mov dword [eax + 0xc], edi
mov byte [eax + 4], bl
movzx ecx, byte [esi + 4]
mov byte [eax + 5], cl
mov byte [eax + 6], 0
lea ecx, [eax + 0x10]
xor ecx, esi
mov dword [eax + 0x10], ecx
test ebx, ebx
jle 0x10128cfe
mov ecx, ebx
and ecx, 3
xor edx, edx
cmp ebx, 4
jb 0x10128cd5
and ebx, 0xfffffffc
lea esi, [eax + 0x54]
xor edx, edx
nop word [eax + eax]
mov dword [esi - 0x30], 0
mov dword [esi - 0x20], 0
mov dword [esi - 0x10], 0
mov dword [esi], 0
add edx, 4
add esi, 0x40
cmp ebx, edx
jne 0x10128cb0
test ecx, ecx
je 0x10128cfe
shl edx, 4
add edx, eax
add edx, 0x24
shl ecx, 4
xor esi, esi
nop word cs:[eax + eax]
mov dword [edx + esi], 0
add esi, 0x10
cmp ecx, esi
jne 0x10128cf0
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1012e710
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
cmp esi, 0x3fffffff
ja 0x1012e7c9
lea ebx, [esi*4]
push 0
push ebx
push eax
mov edi, eax
call fcn.1012c3b0
add esp, 0xc
mov ecx, esi
mov esi, eax
lea ebp, [edi + 8]
sub ebp, dword [edi + 8]
test ecx, ecx
je 0x1012e758
push ebx
push 0
push esi
call fcn.10368a10
add esp, 0xc
mov edx, dword [ebp + 4]
test edx, edx
jle 0x1012e7a2
mov eax, dword [esp + 0x1c]
dec eax
xor ecx, ecx
mov dword [esp], ebp
jmp 0x1012e775
inc ecx
cmp ecx, edx
jge 0x1012e7a2
mov ebx, dword [ebp]
mov ebx, dword [ebx + ecx*4]
test ebx, ebx
je 0x1012e770
nop
mov edx, dword [ebx + 8]
lea edi, [ebx + 0xc]
xor edi, dword [ebx + 0xc]
and edi, eax
mov ebp, dword [esi + edi*4]
mov dword [ebx + 8], ebp
mov dword [esi + edi*4], ebx
mov ebx, edx
test edx, edx
jne 0x1012e780
mov ebp, dword [esp]
mov edx, dword [ebp + 4]
jmp 0x1012e770
shl edx, 2
push 0
push edx
push dword [ebp]
push dword [esp + 0x24]
call fcn.1012c690
add esp, 0x10
mov eax, dword [esp + 0x1c]
mov dword [ebp + 4], eax
mov dword [ebp], esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push eax
call fcn.1012c3a0
int3
Function at 0x1012e840
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x24]
lea ecx, [eax + 0x10]
mov ebx, dword [eax + 0x10]
mov dword [esp + 4], ecx
add ebx, ecx
add eax, 0x14
cmp ebx, 0x20
mov dword [esp + 8], eax
jb 0x1012e8a0
xor esi, esi
mov ecx, ebx
mov edx, ebx
xor edi, edi
nop dword [eax + eax]
add esi, dword [eax]
add edi, dword [eax + 4]
add edx, dword [eax + 8]
xor esi, edx
mov ebp, edx
rol ebp, 0x12
sub esi, ebp
xor edi, esi
mov ebp, esi
rol ebp, 0x15
sub edi, ebp
xor edx, edi
mov ebp, edi
rol ebp, 7
sub edx, ebp
add eax, 0xc
add ecx, 0xfffffff4
cmp ecx, 0x1f
ja 0x1012e870
jmp 0x1012e8a8
mov ecx, ebx
mov edx, ebx
test ebx, ebx
je 0x1012e911
test cl, 1
jne 0x1012e8b6
mov esi, ecx
cmp ecx, 1
jne 0x1012e8d5
jmp 0x1012e913
mov esi, edx
shl esi, 5
mov ebp, edx
shr ebp, 2
add ebp, esi
lea esi, [ecx - 1]
movzx edi, byte [eax + ecx - 1]
add edi, ebp
xor edi, edx
mov edx, edi
cmp ecx, 1
je 0x1012e913
mov edi, edx
nop word [eax + eax]
mov ecx, edi
shl ecx, 5
mov edx, edi
shr edx, 2
add edx, ecx
movzx ecx, byte [eax + esi - 1]
add ecx, edx
xor ecx, edi
mov edx, ecx
shl edx, 5
mov ebp, ecx
shr ebp, 2
add ebp, edx
movzx edi, byte [eax + esi - 2]
add edi, ebp
xor edi, ecx
add esi, 0xfffffffe
jne 0x1012e8e0
jmp 0x1012e913
xor edi, edi
mov eax, dword [esp + 0x20]
lea ebp, [eax + 8]
sub ebp, dword [eax + 8]
mov eax, dword [ebp]
mov ecx, dword [ebp + 4]
dec ecx
and ecx, edi
mov dword [esp], ecx
mov esi, dword [eax + ecx*4]
jmp 0x1012e933
mov esi, dword [esi + 8]
test esi, esi
je 0x1012e973
lea eax, [esi + 0x10]
add eax, dword [esi + 0x10]
cmp eax, ebx
jne 0x1012e930
lea eax, [esi + 0x14]
push ebx
push dword [esp + 0xc]
push eax
call fcn.10366e0d
add esp, 0xc
test eax, eax
jne 0x1012e930
movzx eax, byte [esi + 2]
mov ecx, eax
and cl, 0xb
movzx edx, byte [ebp + 0x14]
not dl
and dl, 3
cmp cl, dl
jne 0x1012e9c7
xor al, 3
mov byte [esi + 2], al
jmp 0x1012e9c7
mov esi, dword [esp + 0x24]
lea eax, [esi + 0xc]
xor edi, eax
mov dword [esi + 0xc], edi
mov eax, dword [esp + 4]
add eax, dword [esi + 0x10]
mov byte [esi + eax + 0x14], 0
mov word [esi + 4], 0x8000
mov eax, dword [ebp]
mov ecx, dword [esp]
mov eax, dword [eax + ecx*4]
mov dword [esi + 8], eax
mov eax, dword [ebp]
mov dword [eax + ecx*4], esi
mov eax, dword [ebp + 4]
mov ecx, dword [ebp + 8]
inc ecx
mov dword [ebp + 8], ecx
cmp ecx, eax
jbe 0x1012e9c7
cmp eax, 0x3fffffff
jg 0x1012e9c7
add eax, eax
push eax
push dword [esp + 0x24]
call fcn.1012e710
add esp, 8
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1012e9e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
cmp edx, 0x20
jb 0x1012ea30
xor esi, esi
mov ecx, edx
xor edi, edi
nop dword [eax + eax]
add esi, dword [eax]
add edi, dword [eax + 4]
add edx, dword [eax + 8]
xor esi, edx
mov ebx, edx
rol ebx, 0x12
sub esi, ebx
xor edi, esi
mov ebx, esi
rol ebx, 0x15
sub edi, ebx
xor edx, edi
mov ebx, edi
rol ebx, 7
sub edx, ebx
add eax, 0xc
add ecx, 0xfffffff4
cmp ecx, 0x1f
ja 0x1012ea00
jmp 0x1012ea38
mov ecx, edx
mov esi, edx
test edx, edx
je 0x1012eaa1
test cl, 1
jne 0x1012ea46
mov esi, ecx
cmp ecx, 1
jne 0x1012ea65
jmp 0x1012eaa3
mov esi, edx
shl esi, 5
mov ebx, edx
shr ebx, 2
add ebx, esi
lea esi, [ecx - 1]
movzx edi, byte [eax + ecx - 1]
add edi, ebx
xor edi, edx
mov edx, edi
cmp ecx, 1
je 0x1012eaa3
mov edi, edx
nop word [eax + eax]
mov ecx, edi
shl ecx, 5
mov edx, edi
shr edx, 2
add edx, ecx
movzx ecx, byte [eax + esi - 1]
add ecx, edx
xor ecx, edi
mov edx, ecx
shl edx, 5
mov ebx, ecx
shr ebx, 2
add ebx, edx
movzx edi, byte [eax + esi - 2]
add edi, ebx
xor edi, ecx
add esi, 0xfffffffe
jne 0x1012ea70
jmp 0x1012eaa3
xor edi, edi
lea ebx, [ebp + 8]
mov eax, ebp
mov ebp, ebx
sub ebp, dword [eax + 8]
mov eax, dword [ebp]
mov ecx, dword [ebp + 4]
dec ecx
and ecx, edi
mov esi, dword [eax + ecx*4]
test esi, esi
mov edx, dword [esp + 0x1c]
jne 0x1012eb7b
cmp edx, 0x40000001
jae 0x1012ebc0
mov esi, dword [esp + 0x14]
movzx eax, byte [esi + 4]
lea ecx, [edx + 0x15]
push eax
push ecx
push esi
mov ebp, edx
call fcn.1012c500
add esp, 0xc
mov ecx, ebx
sub ecx, dword [esi + 8]
mov edx, esi
mov esi, eax
movzx eax, byte [ecx + 0x14]
and al, 3
mov byte [esi + 2], al
mov byte [esi], 5
movzx eax, byte [edx + 4]
mov byte [esi + 1], al
mov word [esi + 4], 0x8000
lea eax, [esi + 0xc]
xor eax, edi
mov dword [esi + 0xc], eax
lea eax, [esi + 0x10]
mov ecx, ebp
sub ecx, eax
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x14]
push ebp
push dword [esp + 0x1c]
push eax
call fcn.10368490
mov edx, dword [esp + 0x20]
add esp, 0xc
mov byte [esi + ebp + 0x14], 0
sub ebx, dword [edx + 8]
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
dec ecx
and ecx, edi
mov eax, dword [eax + ecx*4]
mov dword [esi + 8], eax
mov eax, dword [ebx]
mov dword [eax + ecx*4], esi
mov eax, dword [ebx + 4]
mov ecx, dword [ebx + 8]
inc ecx
mov dword [ebx + 8], ecx
cmp ecx, eax
jbe 0x1012ebb9
cmp eax, 0x3fffffff
jg 0x1012ebb9
add eax, eax
push eax
push edx
call fcn.1012e710
add esp, 8
jmp 0x1012ebb9
mov esi, dword [esi + 8]
test esi, esi
je 0x1012eac5
lea eax, [esi + 0x10]
add eax, dword [esi + 0x10]
cmp eax, edx
jne 0x1012eb70
lea eax, [esi + 0x14]
push edx
push eax
push dword [esp + 0x20]
call fcn.10366e0d
mov edx, dword [esp + 0x28]
add esp, 0xc
test eax, eax
jne 0x1012eb70
movzx eax, byte [esi + 2]
mov ecx, eax
and cl, 0xb
movzx edx, byte [ebp + 0x14]
not dl
and dl, 3
cmp cl, dl
jne 0x1012ebb9
xor al, 3
mov byte [esi + 2], al
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [esp + 0x14]
call fcn.1012c3a0
int3
Function at 0x1012f560
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, edx
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1012f643
mov dword [esp], ecx
dec eax
push eax
call fcn.1012d560
add esp, 4
cmp eax, 0x1a
jge 0x1012f66f
mov ebx, eax
inc ebx
mov edi, 1
mov ebp, 1
mov ecx, ebx
shl ebp, cl
cmp ebx, 0x1a
ja 0x1012f67d
movzx eax, byte [esi + 1]
mov edx, 0x20
mov ecx, ebx
shl edx, cl
push eax
push edx
push dword [esp + 8]
call fcn.1012c3b0
add esp, 0xc
lea ecx, [esi + 0x14]
xor eax, ecx
mov dword [esi + 0x14], eax
xor eax, eax
cmp ebp, 2
mov dword [esp + 4], ebp
cmovge edi, ebp
mov dword [esp], edi
jl 0x1012f622
mov edx, dword [esp]
and edx, 0x7ffffffe
xor edi, edi
xor eax, eax
nop word cs:[eax + eax]
mov ebp, dword [ecx]
xor ebp, ecx
mov dword [ebp + edi + 0x1c], 0
mov dword [ebp + edi + 0xc], 0
mov ebp, dword [ecx]
xor ebp, ecx
mov dword [ebp + edi + 0x3c], 0
mov dword [ebp + edi + 0x2c], 0
add eax, 2
add edi, 0x40
cmp edx, eax
jne 0x1012f5f0
test byte [esp], 1
je 0x1012f63d
xor ecx, dword [ecx]
shl eax, 5
mov dword [ecx + eax + 0x1c], 0
mov dword [ecx + eax + 0xc], 0
mov edx, dword [esp + 4]
jmp 0x1012f653
lea eax, [esi + 0x14]
xor eax, dword [0x105dda90]
mov dword [esi + 0x14], eax
xor ebx, ebx
xor edx, edx
mov eax, 0xffffffff
mov ecx, ebx
shl eax, cl
mov byte [esi + 4], bl
not al
mov byte [esi + 3], al
mov dword [esi + 0xc], edx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10532b9a
push dword [esp + 4]
call fcn.10127650
push dword [esp]
call fcn.1012c3a0
int3

Function at 0x1012f9d0
Capabilities:
Hash data using murmur3

Disassembly:
push edi
push esi
mov eax, dword [edx + 0xc]
dec eax
cmp eax, 4
ja 0x1012f9ef
jmp dword [eax*4 + 0x104cda20]
mov eax, dword [edx]
mov edx, eax
shr edx, 0x10
xor edx, eax
imul eax, edx, 0x85ebca6b
mov edx, eax
shr edx, 0xd
xor edx, eax
imul eax, edx, 0xc2b2ae35
mov edx, eax
shr edx, 0x10
xor edx, eax
jmp 0x1012faa2
lea esi, [ecx + 0x14]
xor esi, dword [ecx + 0x14]
jmp 0x1012fab8
movzx ecx, byte [ecx + 4]
mov eax, 0xffffffff
shl eax, cl
not eax
and eax, edx
shl eax, 5
add eax, esi
pop esi
pop edi
ret
Function at 0x101b1200
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x101b128c
push esi
call fcn.101c38a0
add esp, 4
test al, al
jne 0x101b128c
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x101b1223
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.1022d0c0
add esp, 0xc
test eax, eax
je 0x101b1257
sub eax, esi
push eax
push 0x2e
push esi
call fcn.1022d0c0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x101b1259
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
mov ebx, 0x1505
add edi, esi
cmp esi, edi
jae 0x101b1285
mov al, byte [esi]
push eax
call fcn.101c0950
movsx ecx, al
inc esi
mov eax, ebx
add esp, 4
shl eax, 5
add eax, ebx
xor ecx, eax
mov ebx, ecx
cmp esi, edi
jb 0x101b1267
pop edi
movzx eax, bl
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x101d38d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.101acca0
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x101d3950
mov cl, byte [edi]
test cl, cl
je 0x101d3950
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x101d3900
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x101d3970
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.101acca0
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x101d39f3
mov cl, byte [edi]
test cl, cl
je 0x101d39f3
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
and esi, 0xffffffdf
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x101d39a0
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret
Function at 0x101e0030
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.101acca0
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x34]
mov edi, dword [edi]
mov dword [esp + 0x14], edi
test edi, edi
je 0x101e0079
mov ecx, dword [esp + 0x30]
nop dword [eax]
test esi, esi
je 0x101e0079
mov al, byte [edi + ecx]
dec esi
xor al, byte [ebp]
inc edi
mov byte [ebx], al
inc ebp
inc ebx
and edi, 0xf
mov dword [esp + 0x14], edi
jne 0x101e0060
mov eax, dword [esp + 0x2c]
mov edx, dword [eax + 0xc]
bswap edx
mov dword [esp + 0x24], edx
cmp esi, 0x10
jb 0x101e0114
mov edi, eax
mov ecx, esi
shr ecx, 4
push edi
push dword [esp + 0x2c]
lea eax, [ecx + edx]
neg edx
cmp eax, ecx
cmovae edx, ecx
mov dword [esp + 0x18], edx
xor edx, edx
push dword [esp + 0x18]
cmp eax, ecx
push ebx
cmovae edx, eax
push ebp
mov dword [esp + 0x38], edx
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, edx
bswap eax
mov dword [edi + 0xc], eax
test edx, edx
jne 0x101e00f6
mov edx, 0xc
mov eax, 1
nop word [eax + eax]
movzx ecx, byte [edx + edi - 1]
dec edx
add eax, ecx
mov byte [edx + edi], al
shr eax, 8
test edx, edx
jne 0x101e00e0
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
shl eax, 4
sub esi, eax
add ebx, eax
add ebp, eax
cmp esi, 0x10
jae 0x101e0091
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], edx
test esi, esi
je 0x101e0172
mov ecx, dword [esp + 0x30]
xorps xmm0, xmm0
push eax
push dword [esp + 0x2c]
push 1
push ecx
push ecx
movups xmmword [ecx], xmm0
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, dword [esp + 0x2c]
add edx, 1
bswap edx
mov dword [eax + 0xc], edx
jne 0x101e014d
push eax
call fcn.101e01b0
add esp, 4
mov eax, dword [esp + 0x30]
sub ebp, eax
sub ebx, eax
lea ecx, [edi + eax]
add edi, esi
nop word [eax + eax]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub esi, 1
jne 0x101e0160
mov eax, dword [esp + 0x34]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1022e370
Capabilities:
Create thread

Disassembly:
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0
push 0
call fcn.103748dd
mov ecx, eax
add esp, 0x18
xor eax, eax
test ecx, ecx
je 0x1022e396
cmp ecx, 0xffffffff
cmovne eax, ecx
ret

Function at 0x10256fb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.101acca0
mov eax, dword [esp + 0x10]
push ebx
push esi
test byte [eax + 0x10], 4
mov esi, dword [eax + 4]
lea ebx, [esi - 1]
je 0x10257057
mov ecx, dword [eax + 8]
xor edx, edx
push ebp
xor ebp, ebp
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], ecx
test ecx, ecx
jle 0x10257040
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
push edi
push dword [ecx]
mov eax, ebp
xor eax, ebx
lea edi, [eax - 1]
not eax
shr edi, 0x1f
shr eax, 0x1f
and edi, eax
neg edi
mov esi, edi
or esi, dword [esp + 0x14]
call fcn.10257080
mov ecx, dword [esp + 0x18]
mov edx, esi
not edx
mov dword [esp + 0x14], esi
and edx, 0x20
and eax, edi
add edx, dword [esp + 0x24]
inc ebp
add edx, eax
add ecx, 4
add esp, 4
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ecx
cmp ebp, dword [esp + 0x18]
jl 0x10256ff3
pop edi
mov eax, ebx
shr ebx, 0x1f
not eax
dec eax
shr eax, 0x1f
and eax, ebx
pop ebp
dec eax
pop esi
and eax, edx
pop ebx
add esp, 0xc
ret
test esi, esi
jne 0x10257063
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [eax]
push dword [eax + esi*4 - 4]
call fcn.10257080
add esp, 4
shl esi, 5
add esi, 0xffffffe0
add eax, esi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x10257810
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
lea edx, [eax - 1]
not eax
shr edx, 0x1f
shr eax, 0x1f
and edx, eax
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 4]
dec edx
xor eax, ecx
mov dword [esp + 0x10], edx
and eax, edx
xor ecx, eax
mov dword [ebp + 4], ecx
xor dword [ebx + 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebx + 0xc]
xor eax, ecx
movd xmm0, edx
and eax, edx
pshufd xmm4, xmm0, 0
xor ecx, eax
mov dword [ebp + 0xc], ecx
xor dword [ebx + 0xc], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebx + 0x10]
xor eax, ecx
and eax, edx
and eax, 4
xor ecx, eax
mov dword [ebp + 0x10], ecx
xor dword [ebx + 0x10], eax
xor eax, eax
mov esi, dword [esp + 0x1c]
test esi, esi
jle 0x10257935
push edi
cmp esi, 4
jb 0x10257910
mov ecx, dword [ebp]
lea edi, [esi - 1]
mov edx, dword [ebx]
lea ebp, [esi - 1]
lea ebp, [ecx + ebp*4]
cmp edx, ebp
lea edi, [edx + edi*4]
mov ebp, dword [esp + 0x18]
ja 0x102578a8
cmp edi, ecx
jae 0x10257910
cmp edx, ebx
ja 0x102578b0
cmp edi, ebx
jae 0x10257910
cmp edx, ebp
ja 0x102578b8
cmp edi, ebp
jae 0x10257910
lea edi, [esi - 1]
lea edi, [ecx + edi*4]
cmp ecx, ebx
ja 0x102578c6
cmp edi, ebx
jae 0x10257910
cmp ecx, ebp
ja 0x102578ce
cmp edi, ebp
jae 0x10257910
mov edi, esi
and edi, 0xfffffffc
movups xmm3, xmmword [edx + eax*4]
movups xmm2, xmmword [ecx + eax*4]
movaps xmm1, xmm3
pxor xmm1, xmm2
pand xmm1, xmm4
movaps xmm0, xmm1
pxor xmm1, xmm3
pxor xmm0, xmm2
movups xmmword [ecx + eax*4], xmm0
movups xmmword [edx + eax*4], xmm1
add eax, 4
cmp eax, edi
jl 0x102578d3
mov dword [esp + 0x18], eax
cmp eax, esi
jge 0x10257934
nop dword [eax + eax]
mov ecx, dword [ebp]
mov edx, dword [ecx + eax*4]
lea esi, [ecx + eax*4]
mov ecx, dword [ebx]
mov edi, dword [ecx + eax*4]
xor edi, edx
and edi, dword [esp + 0x14]
xor edx, edi
mov dword [esi], edx
mov ecx, dword [ebx]
xor dword [ecx + eax*4], edi
inc eax
cmp eax, dword [esp + 0x20]
jl 0x10257910
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10257e00
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x24
call fcn.101acca0
push ebx
push esi
push edi
mov edi, dword [esp + 0x34]
xor ecx, ecx
push edi
mov dword [esp + 0x14], 0
xor ebx, ebx
mov dword [esp + 0x10], ecx
call fcn.10256fb0
mov esi, eax
add esp, 4
lea eax, [esi + 7]
cdq
and edx, 7
lea ecx, [edx + eax]
sar ecx, 3
cmp dword [esp + 0x44], ebx
jne 0x10257e71
mov ebx, dword [edi + 0xc]
mov eax, ebx
neg eax
sbb eax, eax
and eax, 0xff
mov dword [esp + 0x10], eax
lea eax, [ecx*8]
cmp eax, esi
jne 0x10257e69
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 0xc], eax
jmp 0x10257e73
mov eax, ebx
mov dword [esp + 0xc], eax
jmp 0x10257e73
xor eax, eax
mov esi, dword [esp + 0x3c]
add eax, ecx
cmp esi, 0xffffffff
jne 0x10257eb1
mov esi, eax
mov dword [esp + 0x3c], esi
mov ecx, dword [edi + 8]
shl ecx, 2
test ecx, ecx
jne 0x10257f30
test esi, esi
je 0x10257fc4
push esi
push ecx
push dword [esp + 0x40]
call fcn.10368a10
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x24
ret
cmp esi, eax
jge 0x10257e84
movups xmm0, xmmword [edi]
mov eax, dword [edi + 0x10]
mov dword [esp + 0x2c], eax
movups xmmword [esp + 0x1c], xmm0
psrldq xmm0, 4
movd ecx, xmm0
test ecx, ecx
jle 0x10257ef2
mov eax, dword [esp + 0x1c]
lea eax, [eax + ecx*4]
nop dword [eax + eax]
cmp dword [eax - 4], 0
lea eax, [eax - 4]
jne 0x10257eee
dec ecx
test ecx, ecx
jg 0x10257ee0
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x28]
xor edx, edx
test ecx, ecx
cmove eax, edx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
call fcn.10256fb0
add eax, 7
add esp, 4
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, dword [esp + 0xc]
cmp esi, eax
jge 0x10257e84
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x24
ret
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
cmp edx, 1
je 0x10257f40
dec eax
add eax, esi
mov edi, dword [edi + 4]
mov dword [esp + 0x44], eax
xor eax, eax
cmp edx, 1
push ebp
sete al
shl edi, 2
xor ebp, ebp
lea eax, [eax*2 - 1]
mov dword [esp + 0x18], eax
lea eax, [ecx - 1]
mov dword [esp + 0x1c], eax
test esi, esi
je 0x10257fc3
mov dword [esp + 0x10], esi
neg edi
mov esi, dword [esp + 0x38]
mov eax, dword [esi]
mov edx, ebp
shr edx, 2
mov ecx, ebp
and ecx, 3
shl ecx, 3
mov edx, dword [eax + edx*4]
mov eax, edi
shr edx, cl
mov ecx, ebp
shr eax, 0x1f
neg al
and dl, al
mov eax, dword [esp + 0x48]
xor dl, byte [esp + 0x14]
add bl, dl
cmp bl, dl
mov byte [eax], bl
sbb ebx, ebx
sub ecx, dword [esp + 0x1c]
add eax, dword [esp + 0x18]
neg ebx
shr ecx, 0x1f
inc edi
add ebp, ecx
mov dword [esp + 0x48], eax
sub dword [esp + 0x10], 1
jne 0x10257f75
mov esi, dword [esp + 0x40]
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x24
ret