joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12d35
Capabilities:
Encode data using xor

Disassembly:
add edi, 0xc50a6130
mov al, byte [0x30513053]
sub al, 0x88
or byte [ecx], bl
lodsd eax, dword [esi]
pop esi
add byte [eax + 1], bh
cmp al, 0xee
aaa
add byte [ecx + 0x738900b9], bl
dec esp
adc eax, 0x75ce59be
and byte [esi], ah
or esi, dword [eax]
bound eax, qword [esi]
sub byte [edx + eax], cl
add byte [edx], al
xor dword [eax + esi + 0x52], edx
push ds
dec esp
add byte [eax], ch
jnp 0x12d6e
inc esp
add byte [ecx + 0x33], cl
add byte [ecx + 0x31], cl
add byte [edx + 0x324a0041], ch
add bh, byte [ebp + eax*2 - 0x7fc6f880]
add al, 0x57
das
invalid
Function at 0x12eaa
Capabilities:
Authenticate hmac

Disassembly:
sbb dword [edi - 0x61], 0x43
inc ebx
rol byte [ecx + 0x6b], 0x4b
lahf
dec cx
inc ecx
pushal
cmp dh, byte [esi]
loopne 0x12eff
popal
cmp al, 0x45
lodsd eax, dword [esi]
mov al, byte [0x2520421f]
and dword [edx], esp
inc ebx
mov al, byte [0x3ee03924]
scasb al, byte es:[edi]
cmp eax, esp
add dword [ecx - 0x6c], esp
popal
inc ecx
xor eax, 0xa0360162
inc esi
stosb byte es:[edi], al
cmp dl, al
jle 0x12f22
and byte [ebp + 0x37], cl
inc eax
or eax, dword [ecx - 0x20]
inc esp
mov bh, 0xa1
dec esi
jg 0x12f35
and dword [edx], ecx
inc ecx
and byte [ebx], cl
and dword [eax + 0x38], ecx
loopne 0x12f21
jle 0x12f2f
mov al, byte [0xcf17df0f]
pop ss
aas
mov bh, 0x3f
mov bh, 0x30
jnp 0x12ead
add byte [ecx - 0x56], ch
out dx, eax
mov al, 0xe4
retf
dec ecx
inc ecx
mov al, byte [0x1620331e]
push ss
xor eax, 0x11ee0af
das
and dword [esi + 0x61], eax
xchg ecx, eax
xor esp, dword [eax + 0x20]
xor dword [eax + 2], esp
mov edx, 0x3848a038
and byte [edx - 0x1f], dh
dec eax
cmp byte [eax], ah
jb 0x12f1b
and ah, byte [ecx + 1]
xor eax, 0x30b66560
loopne 0x12f49
popal
cdq
xor ah, byte [eax + 0x2b]
loope 0x12f4b
xor al, 0x60
add al, 0x26
inc esi
jg 0x12f9b
jg 0x12f9d
add byte [esi], bh
in eax, dx
into
stosb byte es:[edi], al
push ebx
add byte [ebp - 0x7cfd622b], al
and eax, ebx
sbb byte [eax], al
cmp al, 0xd8
adc eax, 0xf6428670
inc esp
mov esi, 0x7f497f1f
dec ecx
mov al, byte [0x68e8dbb9]
dec ecx
inc esi
and byte [esi], bl
stosb byte es:[edi], al
xor esp, dword [edx + 0x45603420]
xor ah, byte [eax]
add dword [edx], esi
mov al, byte [0x6231ea45]
and byte [eax], bh
and byte [eax], ah
xor esp, dword [eax + 0x3e]
mov eax, dword [0x5a6f6145]
inc esp
mov al, byte [0x25a03202]
mov al, byte [0x30e2a125]
pushal
inc edx
mov eax, dword [0x426030e2]
inc esi
aad 0xe0
add eax, dword [eax + 0x4e]
xor byte [eax], ah
inc esp
and ah, byte [edi + edi*8]
xchg edx, eax
aas
jg 0x12ffd
pop edi
sbb byte [edi - 0x80], 0x5f
adc byte [edi], 1
pop edi
cmp byte [eax + eax], 3
pop edi
cmp byte [edi + 0x73af5824], 0x18
inc eax
and dword [eax], eax
sub al, 0x18
push 0xed61eaf3
and byte [eax + 0x35], 0x80
mov edi, 0x8051a0fd
adc al, 0x5c
inc edx
mov ch, 0x90
and al, 0x39
invalid
pop esp
inc ebx
mov dl, 0
aaa
rcr byte [edx], 0x34
nop
add eax, dword [ebp - 0x13]
push eax
add eax, dword [eax + edx*4 + 0x13]
mov cl, 0x3b
xor dword [edi + 0x1f7a2812], ebx
pop esp
call [edi + 0x37]
add dword [edi + edi*8 - 0x6e], 0x92ff680f
call dword [edx - 0x6d00c8a1]
add dword [esi + 0x2b], edi
mov ch, 0x98
push ecx
and dword [esi], esi
rcr dword [esi], cl
add al, cl
cld
jg 0x13017
sbb ecx, edi
out 0x44, eax
rcr byte [esi + 0x1d], 1
cmp al, byte [ecx - 0xfbdc8a9]
adc byte [ecx], dh
dec ecx
xlatb
xor dword [0xf7134b1], esi
inc ebx
invalid
Function at 0x4126f0
Capabilities:
Check if file exists
Get file attributes
Hide graphical window

Disassembly:
mov eax, dword [0x41eaf8]
sub esp, 0x108
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x412814
mov ebx, dword [esp + 0x11c]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp byte [ebx], 0
jne 0x412791
call fcn.004123d0
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x42208c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004053b0
add esp, 4
test eax, eax
je 0x4127ca
mov edx, dword [0x41eae8]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push ebx
push edx
mov dword [esp + 0x20], 0
call fcn.00405260
add esp, 0x10
lea eax, [esp + 0x14]
push eax
call ebp
test al, 0x10
je 0x4127a9
call fcn.004123d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
push ebx
call ebp
cmp eax, 0xffffffff
jne 0x412725
call fcn.004123d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x41eb00]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 1
push eax
call esi
mov eax, dword [0x41eb08]
test eax, eax
je 0x4127e8
push 0
push eax
call esi
mov eax, dword [0x41eafc]
test eax, eax
je 0x4127f6
push 0
push eax
call esi
mov ecx, dword [esp + 0x120]
mov edx, dword [0x41eb04]
mov eax, dword [0x41eaf8]
push ecx
push ebx
push edx
push eax
call fcn.004125c0
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret

Function at 0x415bcc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push dword [ebp + 8]
call fcn.0041572a
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00415765
imul esp, dword [ebx - 0x6277d089], 0xffffff7c
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.00415765
jge 0x415c8e
ljmp 0xffff:0x7c858d1c
jne 0x415ca0
Function at 0x415e44
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x415e3c
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x415e5a
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov dword [ecx + eax], 0x948b0000
invalid
or byte [ecx], al
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x415eb8
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
add byte [eax], al
inc eax
add byte [eax], al
inc eax
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x415e9f
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x415ea8
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x415eb2
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x415e94
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x415e1e
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x415f05
dec eax
je 0x415efc
sub eax, 3
je 0x415ef3
mov dword [ebp - 4], 0x40
jmp 0x415f22
mov dword [ebp - 4], 4
jmp 0x415f08
mov dword [ebp - 4], 0x20
jmp 0x415f08
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x415f54
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x415ed4
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00415765
inc eax
xchg dword [ecx + esi], ebx
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x415f60
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415e81
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x415e3c
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x415e5a
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov dword [ecx + eax], 0x948b0000
invalid
or byte [ecx], al
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x415eb8
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
add byte [eax], al
inc eax
add byte [eax], al
inc eax
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x415e9f
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x415ea8
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x415eb2
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x415e94
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x415e1e
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x415f05
dec eax
je 0x415efc
sub eax, 3
je 0x415ef3
mov dword [ebp - 4], 0x40
jmp 0x415f22
mov dword [ebp - 4], 4
jmp 0x415f08
mov dword [ebp - 4], 0x20
jmp 0x415f08
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x415f54
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x415ed4
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00415765
inc eax
xchg dword [ecx + esi], ebx
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x415f60
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x416c0a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00415765
jns 0x416c7f
sub dword [edx - 0x73], 0xfff8d485
call dword [eax - 0x18]
pop ss
jmp 0x416c5c
invalid
call 0x51416c7c
push 0x40
push 5
push dword [ebp - 0x3a8]
call dword [ebp - 0x6e4]
push 5
lea eax, [ebp - 0x394]
push eax
push dword [ebp - 0x3a8]
call fcn.004156d6
add esp, 0xc
lea eax, [ebp - 0x718]
push eax
push dword [ebp - 0x718]
push 5
push dword [ebp - 0x3a8]
call dword [ebp - 0x6e4]
call fcn.00415765
jl 0x416ced
adc eax, 0xa58310
stc
invalid
adc byte [ebx - 0x6ff7b], cl
inc dword [eax - 0x393fa5c]
invalid
Function at 0x1000f8f1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
not edx
push edi
mov edi, dword [esp + 0xc]
test esi, esi
je 0x1000f91d
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100c4538]
inc edi
sub esi, 1
jne 0x1000f905
not edx
pop edi
mov eax, edx
pop esi
ret

Function at 0x1000f924
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
not ebx
push edi
mov edi, dword [esp + 0x14]
mov edx, ebx
test edi, edi
je 0x1000f98a
mov al, byte [esi]
dec edi
inc esi
cmp al, 0x23
jne 0x1000f952
cmp edi, 2
jb 0x1000f952
cmp byte [esi], al
jne 0x1000f952
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100c4538]
test edi, edi
jne 0x1000f93b
jmp 0x1000f991
cmp al, 0x23
jne 0x1000f978
cmp byte [esi], al
jne 0x1000f978
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x100c4538]
mov al, byte [esi]
inc esi
test al, al
jne 0x1000f96a
pop edi
not edx
pop esi
mov eax, edx
pop ebx
ret

Function at 0x10010319
Capabilities:
Read file on windows

Disassembly:
push dword [esp + 0x18]
push dword [esp + 0x14]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.100a43e2
add esp, 0x10
xor edx, edx
ret

Function at 0x1001beb8
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100c1d8d
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x101274a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x30], 0
je 0x1001beec
push dword [esi + 0x30]
call fcn.1001a8ac
pop ecx
cmp dword [esi + 0x34], 0
je 0x1001befb
push dword [esi + 0x34]
call fcn.1001a8ac
pop ecx
and dword [ebp - 4], 0
lea eax, [esi + 0x64]
push 0x1001b692
push 2
push 0xc
push eax
call fcn.1009cba4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
leave
ret
Function at 0x1004172d
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, str.C:Users_viktoDesktopTANKSOFTSAMP_API_ONE_HEADERimguiimgui_draw.cpp
push edi
cmp dword [esi + 0x24], 0
jle 0x10041743
cmp dword [esi + 0x28], 0
jg 0x10041756
push 0x8b2
push ebx
push str.TexWidth___0__TexHeight___0
call fcn.100a3881
add esp, 0xc
mov edi, dword [esp + 0x10]
mov eax, 0xffff
cmp word [edi + 4], ax
jne 0x10041778
push 0x8b3
push ebx
push str.rect__IsPacked__
call fcn.100a3881
add esp, 0xc
movzx eax, word [edi + 4]
movd xmm1, eax
movzx eax, word [edi + 6]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mulss xmm1, dword [esi + 0x2c]
mov eax, dword [esp + 0x14]
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [esi + 0x30]
movss dword [eax], xmm1
movss dword [eax + 4], xmm0
movzx eax, word [edi]
movzx ecx, word [edi + 4]
add ecx, eax
movzx eax, word [edi + 6]
movd xmm1, ecx
movzx ecx, word [edi + 2]
add ecx, eax
mov eax, dword [esp + 0x18]
cvtdq2ps xmm1, xmm1
pop edi
movd xmm0, ecx
mulss xmm1, dword [esi + 0x2c]
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [esi + 0x30]
pop esi
movss dword [eax], xmm1
pop ebx
movss dword [eax + 4], xmm0
ret 0xc
Function at 0x10056a5b
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
dec ebx
cmp ebp, ebx
jg 0x10056ac7
push 0x1f
pop edx
mov ecx, ebx
and ecx, edx
push esi
mov dword [esp + 0x18], ecx
push edi
mov eax, ebp
mov edi, ebp
or eax, edx
sar edi, 5
cmp ebx, eax
push 0x1f
cmovg ecx, edx
xor esi, esi
inc ecx
xor eax, eax
bts esi, ecx
cmp ecx, 0x20
mov ecx, ebp
cmovae eax, esi
and ecx, edx
xor esi, eax
xor edx, edx
bts edx, ecx
xor eax, eax
dec esi
cmp ecx, 0x20
mov ecx, dword [esp + 0x20]
cmovae eax, edx
add ebp, 0x20
xor edx, eax
and ebp, 0xffffffe0
mov eax, dword [esp + 0x18]
neg edx
and esi, edx
pop edx
or dword [eax + edi*4], esi
cmp ebp, ebx
jle 0x10056a77
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1007849a
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x24]
push 9
pop ecx
xor eax, eax
xor ebx, ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
mov dword [esi], ebx
push eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp + 8]
div ecx
push 0x40
sub ecx, edx
add ecx, dword [ebp + 8]
test edx, edx
push 0x3000
cmove ecx, dword [ebp + 8]
push ecx
push ebx
mov dword [esi + 4], ecx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x100788ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x101274a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
mov edi, 0x104
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.d3d9.dll
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.100b14c1
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, eax
lea ecx, [edx + esi]
cmp edx, ecx
jae 0x10078965
mov ecx, 0x8689
inc edx
mov eax, 0x6c7
cmp word [edx], ax
jne 0x1007895e
cmp word [edx + 6], cx
jne 0x1007895e
cmp word [edx + 0xc], cx
je 0x10078978
lea eax, [esi + edx]
cmp edx, eax
jb 0x10078947
inc edx
mov ecx, dword [ebp - 4]
mov eax, edx
pop edi
xor ecx, ebp
pop esi
call fcn.1009caa0
leave
ret 4
add edx, 2
jmp 0x10078966
Function at 0x10083aba
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x24]
mov eax, 0x58bf
push ebp
push esi
mov esi, dword [esp + 0x28]
xor ebp, ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], 0xce6dd971
mov word [esp + 0x1c], ax
push edi
test esi, esi
je 0x10083aed
test ebx, ebx
jne 0x10083b01
push 0x44
push str.C:Users_viktoDesktopTANKSOFTSAMP_API_ONE_HEADERSAMPRakNetDataBlockEncryptor.cpp
push str.input__inputLength
call fcn.100a3881
add esp, 0xc
call fcn.10093c43
lea ecx, [ebx + 5]
mov byte [esp + 0x2c], al
and cl, 0xf
mov bl, 0xf
sub bl, cl
call fcn.10093c43
mov edx, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
shl al, 4
or al, bl
mov dword [esp + 0x14], eax
movzx eax, bl
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x10], eax
push ebx
push esi
lea ecx, [ebx + 6]
add ecx, eax
add eax, 6
add eax, edi
mov dword [edx], ecx
push eax
cmp esi, edi
jne 0x10083b4f
call fcn.1009f330
jmp 0x10083b54
call fcn.1009f330
mov eax, dword [esp + 0x20]
add esp, 0xc
mov cl, byte [esp + 0x2c]
mov esi, ebp
mov byte [edi + 5], al
mov eax, dword [esp + 0x10]
mov byte [edi + 4], cl
test eax, eax
je 0x10083b87
mov ebx, eax
call fcn.10093c43
mov byte [edi + esi + 6], al
inc esi
cmp esi, ebx
jb 0x10083b71
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
add ebx, 2
lea ecx, [esp + 0x1c]
add eax, ebx
push eax
lea eax, [edi + 4]
push eax
call fcn.10082ce0
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
push edi
push 0x10
push edi
mov dword [edi], eax
lea eax, [ebx + 0x240]
push ebx
push eax
call fcn.10098f04
mov eax, dword [esp + 0x4c]
add esp, 0x14
mov esi, dword [eax]
sub esi, 0x10
cmp esi, 0x10
jb 0x10083bfb
add edi, esi
push 0x10
mov ecx, edi
sub ebp, esi
pop edx
mov al, byte [ecx + ebp]
xor byte [ecx], al
inc ecx
sub edx, 1
jne 0x10083bcf
push edi
push 0x10
push edi
lea eax, [ebx + 0x240]
push ebx
push eax
call fcn.10098f04
mov ebp, esi
add esp, 0x14
sub esi, 0x10
sub edi, 0x10
cmp esi, 0x10
jae 0x10083bc8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
Function at 0x1008e641
Capabilities:
Encode data using xor

Disassembly:
push 0x1f8
mov eax, 0x100c328b
call fcn.1009cd1d
mov dword [ebp - 0x1d8], ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x1d0]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1d4], esi
mov dword [ebp - 0x1e4], edi
call fcn.10093a78
and dword [ebp - 4], 0
cmp dword [esi + 0x83c], 4
jne 0x1008e7b9
mov eax, dword [edi + 0x15]
lea esi, [edi + 0x19]
push 8
pop ecx
lea edi, [ebp - 0x7c]
mov dword [ebp - 0x1e0], eax
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x1d8]
mov dword [ebp - 0x1dc], eax
cmp byte [edi + 0x9a5], 1
jne 0x1008e6e5
cmp byte [edi + 0x9a4], 0
jne 0x1008e6e5
lea eax, [ebp - 0x1dc]
mov eax, dword [eax]
cmp eax, dword [edi + 0x980]
jne 0x1008e7c1
lea edx, [ebp - 0x7c]
xor ecx, ecx
mov eax, dword [edx + ecx*4]
cmp eax, dword [edi + ecx*4 + 0x984]
jne 0x1008e7c1
inc ecx
cmp ecx, 8
jne 0x1008e6cf
xor esi, esi
call fcn.10093c43
mov dword [ebp + esi - 0x24], eax
add esi, 4
cmp esi, 0x14
jl 0x1008e6e7
and dword [ebp - 0x1e8], 0
lea eax, [ebp - 0x7c]
push 5
pop ecx
xorps xmm0, xmm0
lea esi, [ebp - 0x24]
movlpd qword [ebp - 0x1f0], xmm0
lea edi, [ebp - 0x204]
push eax
push dword [ebp - 0x1e0]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x1d0]
call fcn.10093ab3
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x1d0]
call fcn.100939d0
mov esi, dword [ebp - 0x1e4]
xor edx, edx
mov ecx, dword [ebp - 0x1d4]
inc esi
mov al, byte [esi + edx]
xor al, byte [ebp + edx - 0x24]
mov byte [ecx + edx + 0x81c], al
inc edx
cmp edx, 0x10
jl 0x1008e755
mov byte [ecx + 0x82c], 1
lea edi, [ebp - 0x5b]
push 5
pop ecx
mov byte [ebp - 0x5c], 0x10
rep movsd dword es:[edi], dword [esi]
push 8
pop ecx
lea esi, [ebp - 0x9c]
lea edi, [ebp - 0x47]
rep movsd dword es:[edi], dword [esi]
call fcn.10086fa4
xor ecx, ecx
push ecx
push eax
mov eax, dword [ebp - 0x1d4]
push ecx
push ecx
push dword [eax + 8]
push dword [eax + 4]
lea eax, [ebp - 0x5c]
push ecx
push 6
push ecx
mov ecx, dword [ebp - 0x1d8]
push 0x1a8
push eax
call fcn.1008fdc5
call fcn.1009ccdb
ret 8
push 1
call fcn.1009017b
mov esi, eax
mov eax, dword [ebp - 0x1d4]
pop ecx
push 1
mov ecx, dword [esi + 0x14]
mov byte [ecx], 0x1c
mov dword [esi + 0x10], 8
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ax, word [eax + 8]
mov word [esi + 8], ax
push dword [esi + 8]
push ecx
mov ecx, edi
call fcn.1008dba2
push esi
mov ecx, edi
mov word [esi], ax
call fcn.1009332b
mov ecx, dword [ebp - 0x1d4]
mov dword [ecx + 0x83c], 2
jmp 0x1008e7b9
Function at 0x10093c43
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [0x10103a08], 0xffffffff
push ebx
push esi
mov ebx, 0x1012efa8
mov esi, 0x1012efb0
push edi
mov edi, ebx
jge 0x10093b57
push 0x1105
call fcn.10093b06
pop ecx
mov eax, dword [0x1012efa8]
mov edx, dword [0x1012efac]
push ebp
mov dword [0x10103a08], 0x26f
mov ebp, 0xe3
mov dword [0x1012f96c], 0x1012efac
mov ecx, edx
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, edx
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edx
xor ecx, dword [esi + 0x62c]
mov dword [edi], ecx
add edi, 4
mov edx, dword [esi]
add esi, 4
sub ebp, 1
jne 0x10093b7c
mov ebp, 0x18c
mov ecx, edx
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, edx
and al, 1
shr ecx, 1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edx
xor ecx, dword [ebx]
lea ebx, [ebx + 4]
mov dword [edi], ecx
lea edi, [edi + 4]
mov edx, dword [esi]
lea esi, [esi + 4]
sub ebp, 1
jne 0x10093bb8
mov edx, dword [0x1012efa8]
mov ecx, edx
xor ecx, eax
and ecx, 0x7ffffffe
xor ecx, eax
mov eax, edx
and al, 1
shr ecx, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
and eax, 0x9908b0df
xor ecx, eax
mov eax, edx
xor ecx, dword [ebx]
shr eax, 0xb
xor edx, eax
mov dword [edi], ecx
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
pop edi
mov eax, edx
shr eax, 0x12
pop esi
xor eax, edx
pop ebx
ret
sub dword [0x10103a08], 1
js 0x10093b34
mov eax, dword [0x1012f96c]
mov ecx, dword [eax]
add eax, 4
mov dword [0x1012f96c], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x10098d31
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [0x1012f970]
push ebx
push ebp
mov ebp, dword [esp + 0x14]
cmp ebp, eax
push esi
mov esi, dword [esp + 0x10]
cmovg ebp, eax
shl eax, 4
add eax, dword [esp + 0x14]
push 4
push eax
push esi
call fcn.1009971e
push 4
push 0x10103d10
push esi
call fcn.100997bb
push 4
push 1
push esi
call fcn.10099749
mov ebx, dword [0x1012f970]
add esp, 0x24
dec ebx
cmp ebx, ebp
jle 0x10098dbb
push edi
mov edi, ebx
shl edi, 4
add edi, dword [esp + 0x18]
sub ebx, ebp
push 4
push edi
push esi
call fcn.1009971e
push 4
push esi
call fcn.10099904
push 4
push 0x10103d10
push esi
call fcn.100997bb
push 4
push 1
push esi
call fcn.10099749
add esp, 0x2c
sub edi, 0x10
sub ebx, 1
jne 0x10098d87
pop edi
test ebp, ebp
jne 0x10098dce
push 4
push dword [esp + 0x18]
push esi
call fcn.1009971e
add esp, 0xc
pop esi
pop ebp
xor eax, eax
pop ebx
ret