joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b3490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffe0
push esi
push edi
sub esp, 0xf8
mov edx, dword [0x103e1e90]
xor edx, esp
mov dword [esp + 0xe0], edx
mov edx, 0xc0
vmovups xmm0, xmmword [0x1039ddf0]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
vmovups xmmword [esp + 0xd0], xmm0
vmovups xmm0, xmmword [edx + 0x1039dd20]
vmovups xmmword [esp + edx], xmm0
vmovups xmm1, xmmword [edx + 0x1039dd10]
vmovups xmmword [esp + edx - 0x10], xmm1
vmovups xmm2, xmmword [edx + 0x1039dd00]
vmovups xmmword [esp + edx - 0x20], xmm2
vmovups xmm3, xmmword [edx + 0x1039dcf0]
vmovups xmmword [esp + edx - 0x30], xmm3
sub edx, 0x40
jne 0x100b34c9
vmovups xmm0, xmmword [0x1039dd20]
vmovups xmmword [esp], xmm0
vbroadcastss ymm2, dword [ecx]
mov edi, ecx
vmovups ymm0, ymmword [0x1039de00]
and edi, 0x1e
vmovaps ymm1, ymm2
test cl, 3
jne 0x100b3594
test edi, edi
je 0x100b3562
shr edi, 2
neg edi
lea esi, [edi + 8]
cmp eax, esi
jl 0x100b3562
mov edx, esi
sub eax, esi
shl edx, 5
lea esi, [edi*4 + 0x20]
vmovups ymm4, ymmword [esp + edx - 0x20]
vmaskmovps ymm3, ymm4, ymmword [ecx]
add ecx, esi
vblendvps ymm5, ymm0, ymm3, ymm4
vminps ymm2, ymm2, ymm5
mov edi, eax
and edi, 0xf
mov edx, edi
sar eax, 4
and edx, 7
test eax, eax
jle 0x100b3586
xor esi, esi
inc esi
vminps ymm2, ymm2, ymmword [ecx]
vminps ymm1, ymm1, ymmword [ecx + 0x20]
add ecx, 0x40
cmp esi, eax
jl 0x100b3575
vminps ymm4, ymm2, ymm1
test edi, 0xfffffff8
jne 0x100b35c4
jmp 0x100b35cb
mov edi, eax
and edi, 0xf
mov edx, edi
sar eax, 4
and edx, 7
test eax, eax
jle 0x100b35b8
xor esi, esi
inc esi
vminps ymm2, ymm2, ymmword [ecx]
vminps ymm1, ymm1, ymmword [ecx + 0x20]
add ecx, 0x40
cmp esi, eax
jl 0x100b35a7
vminps ymm4, ymm2, ymm1
test edi, 0xfffffff8
je 0x100b35cb
vminps ymm4, ymm4, ymmword [ecx]
add ecx, 0x20
test edx, edx
je 0x100b35e7
shl edx, 5
vmovups ymm2, ymmword [esp + edx - 0x20]
vmaskmovps ymm1, ymm2, ymmword [ecx]
vblendvps ymm3, ymm0, ymm1, ymm2
vminps ymm4, ymm4, ymm3
vperm2f128 ymm1, ymm4, ymm0, 0x21
vminps ymm2, ymm4, ymm1
vshufps ymm3, ymm2, ymm0, 0x4e
vminps ymm4, ymm2, ymm3
vshufps ymm0, ymm4, ymm0, 1
vminps ymm5, ymm4, ymm0
mov eax, dword [ebp + 0x10]
vmovss dword [eax], xmm5
mov ecx, dword [esp + 0xe0]
xor ecx, esp
vzeroupper
call fcn.10295946
add esp, 0xf8
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100c8830
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
mov ebx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movss xmm2, dword [ebx]
lea eax, [ebx + 8]
movss xmm1, dword [ebx + 4]
movaps xmm0, xmm2
addss xmm0, xmm1
subss xmm2, xmm1
movss dword [ebx], xmm0
lea esi, [edx - 3]
movss dword [ebx + 4], xmm2
lea edi, [ebx + edx*8 - 0x10]
movaps xmm0, xmmword [0x1039ec40]
test esi, esi
jle 0x100c88da
xor ebx, ebx
nop dword [eax + eax]
nop dword [eax + eax]
movsd xmm7, qword [eax]
add ebx, 4
movhps xmm7, qword [eax + 8]
movsd xmm6, qword [edi + 8]
movaps xmm3, xmm7
movhps xmm6, qword [edi]
xorps xmm7, xmm0
movsldup xmm4, xmmword [ecx]
addsubps xmm3, xmm6
movshdup xmm5, xmmword [ecx]
xorps xmm4, xmm0
mulps xmm5, xmm3
xorps xmm6, xmm0
shufps xmm3, xmm3, 0xb1
add ecx, 0x10
mulps xmm4, xmm3
addps xmm5, xmm4
addps xmm6, xmm5
addsubps xmm7, xmm5
movlps qword [eax], xmm6
movhps qword [eax + 8], xmm6
add eax, 0x10
movlps qword [edi + 8], xmm7
movhps qword [edi], xmm7
add edi, 0xfffffff0
cmp ebx, esi
jl 0x100c8880
mov ebx, edx
and ebx, 3
cmp ebx, 3
je 0x100c88fa
test dl, 2
je 0x100c88f6
xorps xmm0, xmm0
subss xmm0, dword [eax + 4]
movss dword [eax + 4], xmm0
pop ebx
pop edi
pop esi
ret
movsd xmm5, qword [eax]
movsd xmm4, qword [eax + 8]
movaps xmm1, xmm5
movsldup xmm2, xmmword [ecx]
xorps xmm5, xmm0
movshdup xmm3, xmmword [ecx]
xorps xmm2, xmm0
addsubps xmm1, xmm4
xorps xmm4, xmm0
mulps xmm3, xmm1
shufps xmm1, xmm1, 0xb1
mulps xmm2, xmm1
addps xmm3, xmm2
addps xmm4, xmm3
addsubps xmm5, xmm3
movlps qword [eax], xmm4
movlps qword [eax + 8], xmm5
pop ebx
pop edi
pop esi
ret
Function at 0x10230340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push edi
push ebx
sub esp, 0x18
mov edi, SysReAllocString
mov ebx, dword [0x103e1e90]
xor ebx, esp
mov dword [esp + 0x10], ebx
xor ebx, ebx
mov dword [esp], edi
mov dword [esp + 4], ebx
mov dword [esp + 8], edi
mov dword [esp + 0xc], ebx
movss xmm1, dword [esp]
movss xmm3, dword [esp + 4]
movss xmm0, dword [esp + 8]
movss xmm2, dword [esp + 0xc]
unpcklps xmm1, xmm0
unpcklps xmm3, xmm2
pxor xmm0, xmm0
mov eax, dword [ebp + 0x10]
cmp eax, 3
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
unpcklps xmm1, xmm3
jge 0x102303e8
dec eax
cmp eax, 0xffffffff
je 0x102303d4
movlps xmm0, qword [edx]
dec eax
movaps xmm3, xmm0
shufps xmm3, xmm0, 0xf5
movsd xmm2, qword [ecx]
pxor xmm3, xmm1
shufps xmm0, xmm0, 0xf0
mulps xmm0, xmm2
shufps xmm2, xmm2, 0xf1
mulps xmm3, xmm2
addps xmm0, xmm3
movlps qword [edx], xmm0
add edx, 8
cmp eax, 0xffffffff
jne 0x102303a5
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10295946
add esp, 0x18
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
test dl, 7
jne 0x10230496
test dl, 0xf
je 0x10230424
movsd xmm3, qword [edx]
dec eax
movaps xmm4, xmm3
shufps xmm4, xmm3, 0xf5
movsd xmm2, qword [ecx]
pxor xmm4, xmm1
shufps xmm3, xmm3, 0xf0
add ecx, 8
mulps xmm3, xmm2
shufps xmm2, xmm2, 0xf1
mulps xmm4, xmm2
addps xmm4, xmm3
movlps qword [edx], xmm4
add edx, 8
mov ebx, eax
and eax, 1
sar ebx, 1
test cl, 0xf
jne 0x10230463
movaps xmm4, xmmword [edx]
movaps xmm3, xmm4
shufps xmm3, xmm4, 0xa0
shufps xmm4, xmm4, 0xf5
movaps xmm2, xmmword [ecx]
pxor xmm4, xmm1
mulps xmm3, xmm2
add ecx, 0x10
shufps xmm2, xmm2, 0xb1
mulps xmm4, xmm2
addps xmm4, xmm3
movaps xmmword [edx], xmm4
add edx, 0x10
dec ebx
jne 0x10230430
jmp 0x1023039f
movaps xmm4, xmmword [edx]
movups xmm2, xmmword [ecx]
movaps xmm3, xmm4
add ecx, 0x10
shufps xmm3, xmm4, 0xa0
shufps xmm4, xmm4, 0xf5
mulps xmm3, xmm2
pxor xmm4, xmm1
shufps xmm2, xmm2, 0xb1
mulps xmm4, xmm2
addps xmm4, xmm3
movaps xmmword [edx], xmm4
add edx, 0x10
dec ebx
jne 0x10230463
jmp 0x1023039f
mov ebx, eax
and eax, 1
sar ebx, 1
test cl, 0xf
jne 0x102304d5
movups xmm4, xmmword [edx]
movaps xmm3, xmm4
shufps xmm3, xmm4, 0xa0
shufps xmm4, xmm4, 0xf5
movaps xmm2, xmmword [ecx]
pxor xmm4, xmm1
mulps xmm3, xmm2
add ecx, 0x10
shufps xmm2, xmm2, 0xb1
mulps xmm4, xmm2
addps xmm4, xmm3
movups xmmword [edx], xmm4
add edx, 0x10
dec ebx
jne 0x102304a2
jmp 0x1023039f
movups xmm4, xmmword [edx]
movups xmm2, xmmword [ecx]
movaps xmm3, xmm4
add ecx, 0x10
shufps xmm3, xmm4, 0xa0
shufps xmm4, xmm4, 0xf5
mulps xmm3, xmm2
pxor xmm4, xmm1
shufps xmm2, xmm2, 0xb1
mulps xmm4, xmm2
addps xmm4, xmm3
movups xmmword [edx], xmm4
add edx, 0x10
dec ebx
jne 0x102304d5
jmp 0x1023039f
Function at 0x1026e840
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x103e1e90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
mov esi, dword [ebp + 8]
push edi
push 0x60
push 0
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x408], 0
call ebx
mov edi, eax
test edi, edi
jne 0x1026e8b0
push 2
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x1026e8b0
call fcn.1026c5e0
mov esi, eax
jmp 0x1026e969
push dword [ebp - 0x410]
push dword [ebp - 0x40c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x1026e8d3
call fcn.1026c5e0
jmp 0x1026e95c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x1026e8e8
call fcn.1026c5e0
jmp 0x1026e95c
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x1026e900
mov esi, 0x8007000e
jmp 0x1026e95e
push eax
lea ecx, [ebp - 0x408]
call fcn.1026bf30
cmp dword [ebp - 0x408], 0
jne 0x1026e91c
mov esi, 0x8007000e
jmp 0x1026e95e
push esi
push dword [ebp - 0x408]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x1026e93c
call fcn.1026c5e0
jmp 0x1026e95c
mov eax, dword [ebp - 0x408]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x418]
push dword [ebp - 0x408]
call fcn.1026e6e0
mov esi, eax
test edi, edi
je 0x1026e969
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x1026e982
lea ecx, [ebp - 0x408]
call fcn.1026d840
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10295946
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1026f2f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x1026f309
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1026f315
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x1026f310
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1026f350
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x1026f365
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x1026f370
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1026f370
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x10271270
Capabilities:
Allocate or change rwx memory

Disassembly:
push esi
mov esi, ecx
push edi
lea edi, [esi + 0xc]
mov dword [esi + 0x20], 0
push edi
mov dword [esi + 0x1c], 0
call fcn.10002a50
add esp, 4
mov dword [esi], eax
push 0x40
push 0x3000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 4], eax
test eax, eax
je 0x102712e9
push dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualLock]
push dword [esi + 4]
mov dword [esi + 8], eax
push edi
call fcn.10003180
push edi
mov dword [esi + 0x28], eax
call fcn.100028b0
add esp, 0xc
mov dword [esi + 0x30], eax
push 0x40
push 0x3000
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esi + 0x34], eax
test eax, eax
jne 0x102712f3
mov ecx, esi
call fcn.102711f0
pop edi
mov dword [esi + 0x2c], 0
pop esi
ret
push dword [esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualLock]
mov dword [esi + 0x38], eax
mov eax, dword [edi]
cmp eax, 0xbb80
ja 0x10271312
mov dword [esi + 0x50], 0x400
jmp 0x10271329
cmp eax, 0x17700
jne 0x10271322
mov dword [esi + 0x50], 0x800
jmp 0x10271329
mov dword [esi + 0x50], 0x1000
cmp dword [esi + 0x20], 0
je 0x10271337
mov eax, dword [esi + 0x50]
add eax, eax
mov dword [esi + 0x50], eax
pop edi
mov dword [esi + 0x2c], 1
pop esi
ret
Function at 0x10274971
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x878
mov eax, dword [0x103e1e90]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
xor ecx, ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x86c], eax
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x868], eax
mov dword [eax], ecx
lea eax, [ebp - 0x878]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x864]
mov dword [ebp - 0x85c], ecx
push eax
lea eax, [ebp - 0x404]
mov dword [ebp - 0x864], 0x200
push eax
push dword [ebp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x102749ec
cmp eax, 0xea
je 0x102749ec
mov ebx, 0x887c003a
jmp 0x10274b17
lea eax, [ebp - 0x85c]
push eax
push esi
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov ebx, eax
test ebx, ebx
js 0x10274b17
push dword [ebp - 0x85c]
lea eax, [ebp - 0x404]
push eax
call fcn.10297cb3
pop ecx
pop ecx
test eax, eax
jne 0x10274b17
lea eax, [ebp - 0x860]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x404]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
je 0x10274a56
jle 0x10274b17
movzx ebx, bx
or ebx, 0x80070000
jmp 0x10274b17
lea eax, [ebp - 0x858]
push eax
push esi
push dword [ebp - 0x860]
call fcn.10274b41
mov ebx, eax
test ebx, ebx
js 0x10274b0b
lea eax, [ebp - 0x864]
mov dword [ebp - 0x428], 1
push eax
lea eax, [ebp - 0x404]
mov dword [ebp - 0x864], 0x400
push eax
lea eax, [ebp - 0x870]
push eax
push 0
push str.APOInterface0
push dword [ebp - 0x860]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
je 0x10274ac2
jle 0x10274b0b
movzx ebx, bx
or ebx, 0x80070000
jmp 0x10274b0b
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov ebx, eax
test ebx, ebx
js 0x10274b0b
mov eax, dword [ebp - 0x868]
lea esi, [ebp - 0x414]
lea edi, [ebp - 0x424]
mov ecx, 0x111
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x86c]
lea esi, [ebp - 0x858]
rep movsd dword es:[edi], dword [esi]
mov dword [eax], 1
push dword [ebp - 0x860]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x85c], 0
je 0x10274b2c
push dword [ebp - 0x85c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10295946
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10279804
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x102c06bc
call fcn.1029c900
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x102798fc
cmp byte [esi + 0x46], bl
je 0x102798fc
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x10279840
xor al, al
jmp 0x102798fe
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.10267d30
mov dword [ebp - 4], ebx
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov ebx, edi
cmp eax, 0x10
jae 0x1027986d
lea ebx, [ebp - 0x28]
mov edi, ebx
mov ecx, dword [esi + 0x40]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
add eax, ebx
mov edx, dword [ecx]
push eax
push edi
lea eax, [esi + 0x48]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x10279894
dec eax
je 0x10279898
dec eax
dec eax
je 0x102798ea
xor bl, bl
jmp 0x102798ec
mov byte [esi + 0x46], 0
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
mov ecx, edi
cmp eax, 0x10
jae 0x102798a8
lea ecx, [ebp - 0x28]
mov ebx, dword [ebp - 0x2c]
sub ebx, ecx
je 0x102798d0
cmp eax, 0x10
jae 0x102798b7
lea edi, [ebp - 0x28]
push dword [esi + 0x50]
push ebx
push 1
push edi
call fcn.1029e864
add esp, 0x10
cmp ebx, eax
jne 0x10279890
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x28]
cmp byte [esi + 0x46], 0
je 0x102798ea
test ebx, ebx
jne 0x10279861
push ebx
push 8
lea ecx, [ebp - 0x28]
call fcn.1027897b
jmp 0x1027985b
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.102676a0
mov al, bl
jmp 0x102798fe
mov al, 1
call fcn.1029c8af
ret
Function at 0x102cf2c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
shl eax, 3
imul ecx, eax
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
lea edx, [esi + edx*4]
mov dword [esp + 0x28], edx
lea ebx, [0x102cf160]
mov ebp, dword [esp + 0x14]
mov edx, dword [esi]
shl edx, 3
lea edx, [edx + ebp]
mov ebp, dword [esp + 0x20]
movsd xmm0, qword [edx]
movsd xmm1, qword [ecx + edx]
movsd xmm2, qword [edx + ecx*2]
movaps xmm3, xmm1
addps xmm1, xmm2
subps xmm3, xmm2
movaps xmm4, xmm0
addps xmm0, xmm1
movlps qword [edi], xmm0
add edx, eax
mulps xmm1, xmmword [ebx + 0x10]
mulps xmm3, xmmword [ebx + 0x20]
addps xmm4, xmm1
shufps xmm3, xmm3, 0xb1
xorps xmm3, xmmword [ebx]
movaps xmm5, xmm4
subps xmm4, xmm3
movlps qword [edi + 8], xmm4
addps xmm5, xmm3
movlps qword [edi + 0x10], xmm5
add edi, 0x18
dec ebp
jg 0x102cf2fb
add esi, 4
cmp esi, dword [esp + 0x28]
jne 0x102cf2eb
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x102cf360
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
shl eax, 3
imul ecx, eax
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
lea edx, [esi + edx*4]
mov dword [esp + 0x28], edx
mov edx, SysReAllocString
movd xmm7, edx
pslldq xmm7, 8
test edi, 0xf
jne 0x102cf412
mov edx, dword [esi]
shl edx, 3
lea edx, [edx + ebx]
lea ebp, [ecx + edx]
mov dword [esp + 0x14], ebp
lea ebp, [ecx + ecx*2]
movsd xmm0, qword [edx]
movsd xmm6, qword [ecx + edx]
movlhps xmm0, xmm6
movsd xmm1, qword [edx + ecx*2]
movsd xmm6, qword [ebp + edx]
movlhps xmm1, xmm6
movaps xmm2, xmm0
subps xmm0, xmm1
xorps xmm0, xmm7
addps xmm1, xmm2
movaps xmm2, xmm1
shufps xmm1, xmm0, 0xbe
movlhps xmm2, xmm0
movaps xmm0, xmm1
addps xmm1, xmm2
subps xmm2, xmm0
movaps xmm0, xmm1
shufps xmm1, xmm2, 0x88
shufps xmm0, xmm2, 0xdd
add edx, eax
movaps xmmword [edi], xmm1
movaps xmmword [edi + 0x10], xmm0
add edi, 0x20
cmp edx, dword [esp + 0x14]
jne 0x102cf3b1
add esi, 4
cmp esi, dword [esp + 0x28]
jne 0x102cf39f
jmp 0x102cf48b
mov edx, dword [esi]
shl edx, 3
lea edx, [edx + ebx]
lea ebp, [ecx + edx]
mov dword [esp + 0x14], ebp
lea ebp, [ecx + ecx*2]
movsd xmm0, qword [edx]
movsd xmm6, qword [ecx + edx]
movlhps xmm0, xmm6
movsd xmm1, qword [edx + ecx*2]
movsd xmm6, qword [ebp + edx]
movlhps xmm1, xmm6
movaps xmm2, xmm0
subps xmm0, xmm1
xorps xmm0, xmm7
addps xmm1, xmm2
movaps xmm2, xmm1
shufps xmm1, xmm0, 0xbe
movlhps xmm2, xmm0
movaps xmm0, xmm1
addps xmm1, xmm2
subps xmm2, xmm0
movaps xmm0, xmm1
shufps xmm1, xmm2, 0x88
shufps xmm0, xmm2, 0xdd
add edx, eax
movlps qword [edi], xmm1
movhps qword [edi + 8], xmm1
movlps qword [edi + 0x10], xmm0
movhps qword [edi + 0x18], xmm0
add edi, 0x20
cmp edx, dword [esp + 0x14]
jne 0x102cf424
add esi, 4
cmp esi, dword [esp + 0x28]
jne 0x102cf412
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x102d1030
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
sub esp, 0x18
mov ebp, dword [esp + 0x38]
lea eax, [ebp + 1]
mov dword [esp], eax
mov eax, dword [esp + 0x30]
shl eax, 3
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x3c]
imul ecx, eax
mov dword [esp + 0xc], ecx
lea eax, [ebp - 1]
imul ecx, eax
mov dword [esp + 0x10], ecx
shl ebp, 3
lea ebx, [0x102cf160]
mov dword [esp + 0x14], ebx
movaps xmm7, xmmword [ebx + 0x80]
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
lea edi, [ecx + esi]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x44]
mov ebx, dword [esp + 0x14]
movsd xmm6, qword [esi]
movaps xmm2, xmm6
movsd xmm0, qword [ecx + esi]
movlhps xmm0, xmm0
movsd xmm1, qword [edi]
movlhps xmm1, xmm1
xorps xmm1, xmmword [ebx + 0xa0]
addps xmm0, xmm1
movaps xmmword [edx], xmm0
andps xmm0, xmmword [ebx + 0xb0]
addps xmm2, xmm0
add esi, ecx
sub edi, ecx
add edx, 0x10
cmp esi, edi
jne 0x102d1093
mov esi, dword [esp + 0x34]
movlps qword [esi], xmm2
mov dword [esp + 4], esi
lea edi, [ebp + esi - 8]
mov dword [esp + 8], edi
mov edi, dword [esp + 0x40]
lea ebx, [ebp + edi]
mov ecx, 2
movaps xmm4, xmm6
xorps xmm3, xmm3
mov esi, dword [esp + 0x44]
mov eax, dword [esp]
mov edx, ecx
sub eax, 4
jle 0x102d112c
movsd xmm0, qword [edi + edx*4]
shufps xmm0, xmm0, 0x50
mulps xmm0, xmmword [esi]
add edx, ecx
mov edx, dword [ebx + edx*2]
addps xmm4, xmm0
movsd xmm1, qword [edi + edx*4]
shufps xmm1, xmm1, 0x50
mulps xmm1, xmmword [esi + 0x10]
add edx, ecx
mov edx, dword [ebx + edx*2]
addps xmm3, xmm1
add esi, 0x20
sub eax, 4
jg 0x102d10f8
addps xmm4, xmm3
add eax, 2
jle 0x102d1140
movsd xmm0, qword [edi + edx*4]
shufps xmm0, xmm0, 0x50
mulps xmm0, xmmword [esi]
addps xmm4, xmm0
movhlps xmm0, xmm4
movlhps xmm4, xmm4
shufps xmm0, xmm0, 0x11
xorps xmm0, xmm7
addps xmm4, xmm0
mov esi, dword [esp + 4]
movlps qword [esi + 8], xmm4
add esi, 8
mov dword [esp + 4], esi
mov eax, dword [esp + 8]
movhps qword [eax], xmm4
sub eax, 8
mov dword [esp + 8], eax
add ecx, 2
cmp ecx, dword [esp]
jl 0x102d10e4
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
add esi, ecx
mov dword [esp + 0x2c], esi
mov esi, dword [esp + 0x34]
add esi, ebp
mov dword [esp + 0x34], esi
mov esi, dword [esp + 0x3c]
dec esi
mov dword [esp + 0x3c], esi
jg 0x102d1075
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x102d17d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
shl eax, 3
imul ecx, eax
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
lea edx, [esi + edx*4]
mov dword [esp + 0x28], edx
lea ebx, [0x102cf160]
mov ebp, dword [esp + 0x14]
mov edx, dword [esi]
shl edx, 3
lea edx, [edx + ebp]
mov ebp, dword [esp + 0x20]
movsd xmm0, qword [edx]
movsd xmm1, qword [ecx + edx]
movsd xmm2, qword [edx + ecx*2]
movaps xmm3, xmm1
addps xmm1, xmm2
subps xmm3, xmm2
movaps xmm4, xmm0
addps xmm0, xmm1
movlps qword [edi], xmm0
add edx, eax
mulps xmm1, xmmword [ebx + 0x10]
mulps xmm3, xmmword [ebx + 0x20]
addps xmm4, xmm1
shufps xmm3, xmm3, 0xb1
xorps xmm3, xmmword [ebx]
movaps xmm5, xmm4
addps xmm4, xmm3
movlps qword [edi + 8], xmm4
subps xmm5, xmm3
movlps qword [edi + 0x10], xmm5
add edi, 0x18
dec ebp
jg 0x102d180b
add esi, 4
cmp esi, dword [esp + 0x28]
jne 0x102d17fb
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x102d1870
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
shl eax, 3
imul ecx, eax
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
lea edx, [esi + edx*4]
mov dword [esp + 0x28], edx
mov edx, SysReAllocString
movd xmm7, edx
pslldq xmm7, 0xc
test edi, 0xf
jne 0x102d1922
mov edx, dword [esi]
shl edx, 3
lea edx, [edx + ebx]
lea ebp, [ecx + edx]
mov dword [esp + 0x14], ebp
lea ebp, [ecx + ecx*2]
movsd xmm0, qword [edx]
movsd xmm6, qword [ecx + edx]
movlhps xmm0, xmm6
movsd xmm1, qword [edx + ecx*2]
movsd xmm6, qword [ebp + edx]
movlhps xmm1, xmm6
movaps xmm2, xmm0
subps xmm0, xmm1
xorps xmm0, xmm7
addps xmm1, xmm2
movaps xmm2, xmm1
shufps xmm1, xmm0, 0xbe
movlhps xmm2, xmm0
movaps xmm0, xmm1
addps xmm1, xmm2
subps xmm2, xmm0
movaps xmm0, xmm1
shufps xmm1, xmm2, 0x88
shufps xmm0, xmm2, 0xdd
add edx, eax
movaps xmmword [edi], xmm1
movaps xmmword [edi + 0x10], xmm0
add edi, 0x20
cmp edx, dword [esp + 0x14]
jne 0x102d18c1
add esi, 4
cmp esi, dword [esp + 0x28]
jne 0x102d18af
jmp 0x102d199b
mov edx, dword [esi]
shl edx, 3
lea edx, [edx + ebx]
lea ebp, [ecx + edx]
mov dword [esp + 0x14], ebp
lea ebp, [ecx + ecx*2]
movsd xmm0, qword [edx]
movsd xmm6, qword [ecx + edx]
movlhps xmm0, xmm6
movsd xmm1, qword [edx + ecx*2]
movsd xmm6, qword [ebp + edx]
movlhps xmm1, xmm6
movaps xmm2, xmm0
subps xmm0, xmm1
xorps xmm0, xmm7
addps xmm1, xmm2
movaps xmm2, xmm1
shufps xmm1, xmm0, 0xbe
movlhps xmm2, xmm0
movaps xmm0, xmm1
addps xmm1, xmm2
subps xmm2, xmm0
movaps xmm0, xmm1
shufps xmm1, xmm2, 0x88
shufps xmm0, xmm2, 0xdd
add edx, eax
movlps qword [edi], xmm1
movhps qword [edi + 8], xmm1
movlps qword [edi + 0x10], xmm0
movhps qword [edi + 0x18], xmm0
add edi, 0x20
cmp edx, dword [esp + 0x14]
jne 0x102d1934
add esi, 4
cmp esi, dword [esp + 0x28]
jne 0x102d1922
pop ebp
pop edi
pop esi
pop ebx
ret