joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10050b10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ac656
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10206f54]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov eax, dword [ebp + 8]
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
test eax, eax
je 0x10050bcb
cmp eax, 0x3fffffff
ja 0x10050cef
lea ebx, [eax*4]
cmp ebx, 0x1000
jb 0x10050b9b
lea eax, [ebx + 0x23]
cmp eax, ebx
jbe 0x10050cf4
push eax
call fcn.101a8b06
add esp, 4
test eax, eax
je 0x10050b95
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
jmp 0x10050bae
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
test ebx, ebx
je 0x10050bac
push ebx
call fcn.101a8b06
add esp, 4
mov ecx, eax
jmp 0x10050bae
xor ecx, ecx
push ebx
lea eax, [ebx + ecx]
mov dword [edi], ecx
push 0
push ecx
mov dword [edi + 8], eax
lea esi, [ebx + ecx]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [edi + 4], esi
push 0x14
mov dword [ebp - 4], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
call fcn.101a8b06
mov esi, eax
add esp, 4
mov dword [ebp - 0x10], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x10050c36
push 1
lea ecx, [esi + 0xc]
push 1
call fcn.100512a0
push 0
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 2
push 0x7fffffff
call fcn.100512a0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
jmp 0x10050c38
xor esi, esi
mov eax, dword [edi + 0xc]
mov byte [ebp - 4], 0
mov dword [edi + 0x14], esi
cmp eax, dword [edi + 0x10]
jae 0x10050cd9
nop dword [eax + eax]
push 8
call fcn.101a8b06
mov edx, eax
add esp, 4
mov dword [ebp - 0x10], edx
test edx, edx
je 0x10050c72
mov dword [edx], 0
mov dword [edx + 4], 0
jmp 0x10050c74
xor edx, edx
mov ecx, dword [edi + 0xc]
mov eax, dword [edi]
mov dword [eax + ecx*4], edx
mov ecx, dword [edi + 0xc]
mov eax, dword [edi]
mov ebx, dword [eax + ecx*4]
cmp dword [ebx + 4], 0
mov dword [ebx], edi
jne 0x10050cca
push 4
call fcn.101a8b06
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov byte [ebp - 4], 3
test esi, esi
je 0x10050cc1
lea eax, [ebp - 0x1c]
push eax
push 0
push ebx
push 0x10050f50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
je 0x10050cf9
jmp 0x10050cc3
xor esi, esi
mov byte [ebp - 4], 0
mov dword [ebx + 4], esi
inc dword [edi + 0xc]
mov eax, dword [edi + 0xc]
cmp eax, dword [edi + 0x10]
jb 0x10050c50
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.1003def0
call fcn.1003ded0
push 0x101f8eec
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0xffffffff
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x100511a0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ac6e3
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10206f54]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp eax, 4
ja case.default.0x100511cd
jmp dword [eax*4 + 0x1005126c]
push 8
call fcn.101a8b06
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x10051202
mov ecx, eax
call fcn.10050a10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0x1c
call fcn.101a8b06
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x10051202
mov ecx, eax
call fcn.10050640
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0x101f8eec
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0xffffffff
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push 0x101f8eec
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0xffffffff
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
nop
adc edx, dword [edx]
add eax, 85087760
adc byte [esi + 0x12], dl
add eax, 0x511d410
adc byte [esi + 0x12], dl
add eax, 0xec8b5510
push ebp
mov ebp, esp

Function at 0x1005126c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ac6e3
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10206f54]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
cmp eax, 4
ja case.default.0x100511cd
jmp dword [eax*4 + 0x1005126c]
push 8
call fcn.101a8b06
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x10051202
mov ecx, eax
call fcn.10050a10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0x1c
call fcn.101a8b06
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x10051202
mov ecx, eax
call fcn.10050640
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
push 0x101f8eec
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0xffffffff
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push 0x101f8eec
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0xffffffff
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
nop
adc edx, dword [edx]
add eax, 85087760
adc byte [esi + 0x12], dl
add eax, 0x511d410
adc byte [esi + 0x12], dl
add eax, 0xec8b5510
push ebp
mov ebp, esp
Function at 0x1005a570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi + 0x38]
call fcn.1005d3c0
push eax
push esi
call fcn.1005d840
push 0
push 0x108
push 0
push edi
call fcn.10085f20
mov ebx, 1
mov dword [edi + 0x34], 0x10001
mov dword [edi + 0x2c], 0x10001
mov eax, 2
mov word [edi + 0x54], ax
add esp, 0x18
mov dword [edi + 0x38], 0x10001
xor eax, eax
mov dword [edi + 0x3c], 0xffffffff
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0xd8], 0x20002
mov word [edi + 0xdc], bx
mov dword [esi + 0x360], sym.AIDE.dll_public:_void___thiscall_AIDE::AIDEDimension::destructor_void_
mov dword [esi + 0x36c], 0
mov dword [esi + 0x370], 0x1005b440
mov dword [esi + 0x374], 0x1005ab40
mov dword [esi + 0x378], 0
mov word [edi + 0x56], bx
mov word [edi + 0x30], bx
mov dword [edi + 0x28], 0
mov dword [edi + 0x40], 0x10000
mov word [edi + 0x74], ax
mov dword [edi + 0x78], eax
cmp dword [esi + 0x384], eax
jbe 0x1005a69e
xor edi, edi
xor ebx, ebx
nop word [eax + eax]
mov eax, dword [esi + 0x380]
cmp dword [ebx + eax + 4], 0
je 0x1005a66a
push dword [ebx + eax + 0xc]
push esi
call fcn.1007fc60
add esp, 8
inc edi
add ebx, 0x10
cmp edi, dword [esi + 0x384]
jb 0x1005a650
push dword [esi + 0x380]
push esi
call fcn.1007fc60
add esp, 8
mov dword [esi + 0x384], 0
mov dword [esi + 0x380], 0
mov ebx, 1
mov edi, dword [0x10208468]
test edi, edi
je 0x1005a6b6
push esi
mov ecx, edi
call dword [0x101b0250]
call edi
add esp, 4
push 1
push 0x103
push esi
call fcn.1005aa20
add esp, 0xc
mov eax, ebx
and dword [esi + 0xc], 0xfffffbf7
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10060900
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 4]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push 0
push edi
push eax
push ebx
push esi
call fcn.100626f0
add esp, 0x14
mov dword [ebp - 8], eax
test eax, eax
je 0x10060962
movzx ecx, word [ebx]
push ecx
push esi
call fcn.1005cce0
add esp, 8
test eax, eax
je 0x10060940
mov eax, dword [eax + 0x1c]
jmp 0x10060945
mov eax, str.unknown_tagname
push 0
push eax
push str.TIFFFetchStripThing
push dword [ebp - 8]
push esi
call fcn.10062f10
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebx + 0xc], 0
ja 0x10060a77
jb 0x10060977
cmp dword [ebx + 8], edi
jae 0x10060a77
movzx eax, word [ebx]
push eax
push esi
call fcn.1005cce0
push str.LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT
mov ebx, eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ecx, eax
add esp, 0xc
mov eax, 0xf4240
test ecx, ecx
je 0x100609a6
push ecx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
test ebx, ebx
je 0x100609af
mov ecx, dword [ebx + 0x1c]
jmp 0x100609b4
mov ecx, str.unknown_tagname
push ecx
cmp edi, eax
jbe 0x100609de
push str.Incorrect_count_for___s_
push str.TIFFFetchStripThing
push esi
call fcn.1006c5e0
push dword [ebp - 4]
push esi
call fcn.1007fc60
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Incorrect_count_for___s___tag_ignored
push str.TIFFFetchStripThing
push esi
call fcn.10085cb0
push str.for_strip_array
push 0
push 8
push 0
push edi
push esi
call fcn.10058a70
mov ebx, eax
add esp, 0x28
test ebx, ebx
jne 0x10060a1e
push dword [ebp - 4]
push esi
call fcn.1007fc60
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 8]
mov eax, edx
or eax, dword [ecx + 0xc]
je 0x10060a44
push 0
lea eax, [edx*8]
push eax
push dword [ebp - 4]
push ebx
call fcn.10085f00
mov ecx, dword [ebp + 0xc]
add esp, 0x10
mov eax, dword [ecx + 8]
sub edi, eax
push 0
shl edi, 3
push edi
lea eax, [ebx + eax*8]
push 0
push eax
call fcn.10085f20
push dword [ebp - 4]
push esi
call fcn.1007fc60
mov eax, dword [ebp + 0x14]
add esp, 0x18
pop edi
mov dword [eax], ebx
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp - 4]
pop edi
pop esi
mov dword [eax], ebx
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10073470
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
movzx eax, word [esi + 0x20]
cmp eax, 6
ja case.0x10073489.4
jmp dword [eax*4 + 0x10073658]
cmp word [esi + 0x18], 8
je case.0x10073489.4
movzx eax, word [esi + 0x18]
mov edi, 1
mov cl, al
shl edi, cl
mov ecx, 0xff
dec edi
cmp eax, 0x10
push 0
cmove edi, ecx
lea eax, [edi + 1]
push eax
push dword [esi]
call fcn.1007fc70
add esp, 0xc
mov dword [esi + 0x38], eax
test eax, eax
jne 0x100734ee
push str.No_space_for_photometric_conversion_table
push dword [esi]
call fcn.1005ccd0
add esp, 4
push eax
push dword [esi]
call fcn.1006c5e0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
cmp word [esi + 0x20], bx
jne 0x1007351e
test edi, edi
js 0x10073540
imul eax, edi, 0xff
mov dword [ebp - 4], eax
cdq
idiv edi
mov ecx, dword [esi + 0x38]
mov byte [ebx + ecx], al
inc ebx
mov eax, dword [ebp - 4]
sub eax, 0xff
mov dword [ebp - 4], eax
cmp ebx, edi
jle 0x10073503
jmp 0x10073540
test edi, edi
js 0x10073540
xor eax, eax
mov dword [ebp - 4], eax
cdq
idiv edi
mov ecx, dword [esi + 0x38]
mov byte [ebx + ecx], al
inc ebx
mov eax, dword [ebp - 4]
add eax, 0xff
mov dword [ebp - 4], eax
cmp ebx, edi
jle 0x10073527
cmp word [esi + 0x18], 0x10
ja case.0x10073489.4
movzx eax, word [esi + 0x20]
cmp eax, 1
je 0x10073555
test ax, ax
jne case.0x10073489.4
push esi
call fcn.100746b0
add esp, 4
test eax, eax
jne 0x10073569
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x38]
push dword [esi]
call fcn.1007fc60
add esp, 8
mov dword [esi + 0x38], 0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov cl, byte [esi + 0x18]
mov eax, 1
mov edx, dword [esi + 0x24]
mov ebx, dword [esi + 0x2c]
mov edi, dword [esi + 0x28]
shl eax, cl
mov ecx, eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test ecx, ecx
jle 0x100735db
mov dword [ebp - 4], 0x100
mov ax, word [edx]
lea edx, [edx + 2]
dec ecx
cmp ax, word [ebp - 4]
jae 0x10073612
mov ax, word [edi]
add edi, 2
cmp ax, word [ebp - 4]
jae 0x10073612
mov ax, word [ebx]
add ebx, 2
cmp ax, word [ebp - 4]
jae 0x10073612
test ecx, ecx
jg 0x100735b2
push str.Assuming_8_bit_colormap
push dword [esi]
call fcn.1005ccd0
add esp, 4
push eax
push dword [esi]
call fcn.10085cb0
add esp, 0xc
cmp word [esi + 0x18], 8
ja case.0x10073489.4
push esi
call fcn.10074990
add esp, 4
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
add edx, 0xffffffff
js 0x100735f5
mov eax, dword [esi + 0x28]
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
sub ebx, eax
sub edi, eax
lea ecx, [eax + edx*2]
nop word [eax + eax]
sub edx, 1
movzx eax, byte [ebx + ecx + 1]
mov word [ebx + ecx], ax
lea ecx, [ecx - 2]
movzx eax, byte [ecx + 3]
mov word [ecx + 2], ax
movzx eax, byte [edi + ecx + 3]
mov word [edi + ecx + 2], ax
jns 0x10073630
jmp 0x100735f5
Function at 0x100a4e10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx - 4]
jle 0x100a4e7a
mov ecx, dword [ebp + 8]
sub ecx, ebx
push esi
mov dword [ebp + 8], ecx
push edi
nop word [eax + eax]
mov esi, dword [ecx + ebx]
lea ebx, [ebx + 4]
mov ecx, eax
mov edi, esi
and edi, 0xffff00ff
and ecx, 0xffff00ff
add edi, ecx
mov edx, esi
movzx ecx, ax
and edx, 0xff00
add edx, ecx
and eax, 0xff00ffff
mov ecx, dword [ebp + 8]
xor edi, edx
and esi, 0xff00ff00
and edi, 0xff00ff
add eax, esi
xor eax, edi
sub dword [ebp + 0x10], 1
mov dword [ebx - 4], eax
jne 0x100a4e30
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x100a5930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi + eax*4]
cmp esi, edi
jae 0x100a5983
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [esi]
lea eax, [eax + 2]
mov edx, ebx
mov ecx, ebx
shr edx, 0x10
add esi, 4
shr ecx, 0xd
xor dl, cl
mov ecx, ebx
and dl, 7
shr ecx, 0x10
xor dl, cl
mov ecx, ebx
mov byte [eax - 2], dl
mov edx, ebx
shr edx, 5
shr ecx, 3
xor dl, cl
shr ebx, 5
and dl, 0x1f
xor dl, bl
mov byte [eax - 1], dl
cmp esi, edi
jb 0x100a5946
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x100a5990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
lea edi, [esi + eax*4]
cmp esi, edi
jae 0x100a59d9
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [esi]
lea eax, [eax + 2]
mov edx, ebx
mov ecx, ebx
shr ecx, 0xc
add esi, 4
shr edx, 0x10
xor dl, cl
mov ecx, ebx
shr ecx, 0x10
and dl, 0xf
xor dl, cl
mov ecx, ebx
shr ecx, 0x1c
and bl, 0xf0
or cl, bl
mov byte [eax - 2], dl
mov byte [eax - 1], cl
cmp esi, edi
jb 0x100a59a6
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x100c7070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebx]
lea eax, [eax + esi*2]
add eax, esi
imul ecx, eax, 0x2c
mov eax, dword [ebx + 4]
add ecx, dword [ebx + 0x14]
test eax, eax
jns 0x100c70b2
mov eax, dword [ecx]
cmp eax, 0xfffe0000
jb 0x100c70a3
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
pop esi
mov dword [ecx], eax
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, eax
jg 0x100c7214
push edi
mov edi, 2
mov eax, dword [ecx]
cmp eax, 0xfffe0000
jb 0x100c70d1
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10001
mov dword [ecx], eax
mov eax, dword [ebx + 8]
movsx edx, word [eax + esi*2]
test edx, edx
jne 0x100c7119
mov eax, dword [ecx + 4]
inc esi
cmp eax, 0xfffe0000
jb 0x100c70f6
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
mov dword [ecx + 4], eax
movzx eax, byte [esi + 0x101d9b80]
imul ecx, eax, 0x84
mov eax, dword [ebx + 8]
movsx edx, word [eax + esi*2]
add ecx, dword [ebx + 0x14]
test edx, edx
je 0x100c70e3
mov eax, dword [ecx + 4]
inc esi
mov dword [ebp - 8], esi
cmp eax, 0xfffe0000
jb 0x100c712f
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10001
mov dword [ecx + 4], eax
lea eax, [edx + 1]
cmp edi, eax
mov eax, dword [ecx + 8]
sbb edi, edi
neg edi
cmp eax, 0xfffe0000
jb 0x100c7152
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
add eax, edi
mov dword [ecx + 8], eax
lea eax, [edx + 1]
cmp eax, 2
ja 0x100c717c
movzx eax, byte [esi + 0x101d9b80]
imul ecx, eax, 0x84
add ecx, 0x2c
add ecx, dword [ebx + 0x14]
jmp 0x100c7205
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, 0x43
cmp eax, 0x43
cmovg eax, edx
xor edi, edi
movzx ebx, word [eax*4 + 0x101dfdf4]
shr ebx, 1
movzx edx, word [eax*4 + 0x101dfdf6]
mov dword [ebp - 4], edx
je 0x100c71ed
mov esi, dword [ebp - 4]
lea edx, [ecx + 0xc]
nop dword [eax]
test bl, 1
je 0x100c71e2
mov ecx, edi
mov eax, 2
shl eax, cl
mov ecx, dword [edx]
and eax, esi
neg eax
sbb eax, eax
neg eax
cmp ecx, 0xfffe0000
jb 0x100c71d9
inc ecx
shr ecx, 1
and ecx, 0x7fff7fff
add eax, 0x10000
add eax, ecx
mov dword [edx], eax
inc edi
add edx, 4
sar ebx, 1
jne 0x100c71b0
mov esi, dword [ebp - 8]
movzx eax, byte [esi + 0x101d9b80]
mov ebx, dword [ebp + 0xc]
imul ecx, eax, 0x84
mov eax, dword [ebx + 0x14]
add eax, 0x58
add ecx, eax
mov edi, 2
cmp esi, dword [ebx + 4]
jle 0x100c70c0
pop edi
cmp esi, 0x10
jge 0x100c7231
mov eax, dword [ecx]
cmp eax, 0xfffe0000
jb 0x100c722a
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
mov dword [ecx], eax
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100d5080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
sub esp, 0x10
cmp edx, 2
jle 0x100d5234
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
mov ebx, dword [eax]
mov esi, dword [eax + 4]
test edi, edi
je 0x100d50eb
mov eax, ebx
shr eax, 8
movzx eax, al
mov ecx, eax
shl ecx, 0x10
or ecx, eax
mov eax, ebx
and eax, 0xffff00ff
add ecx, eax
mov eax, esi
xor ecx, ebx
shr eax, 8
and ecx, 0xff00ff
movzx eax, al
xor ebx, ecx
mov ecx, eax
shl ecx, 0x10
or ecx, eax
mov eax, esi
and eax, 0xffff00ff
add ecx, eax
mov eax, dword [ebp + 0x10]
xor ecx, esi
and ecx, 0xff00ff
xor esi, ecx
lea ecx, [edx - 1]
mov dword [ebp - 0xc], 1
cmp ecx, 1
jle 0x100d5231
mov ecx, dword [ebp + 0xc]
lea edx, [eax + 8]
shl ecx, 2
mov dword [ebp - 4], edx
test edi, edi
je 0x100d51e0
lea edi, [ecx + 4]
add edi, eax
sub eax, ecx
add eax, 4
mov dword [ebp - 8], edi
mov dword [ebp + 0x10], eax
mov eax, dword [eax]
mov edi, ebx
shr eax, 8
movzx ebx, al
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], esi
mov esi, dword [edx]
mov eax, dword [eax]
shr eax, 8
movzx edx, al
mov eax, esi
shr eax, 8
movzx eax, al
mov ecx, eax
shl ecx, 0x10
or ecx, eax
mov eax, esi
and eax, 0xffff00ff
add ecx, eax
mov eax, dword [ebp - 8]
xor ecx, esi
and ecx, 0xff00ff
xor esi, ecx
mov ecx, edx
shl ecx, 0x10
or ecx, edx
mov edx, dword [eax]
mov eax, edx
and eax, 0xffff00ff
add ecx, eax
mov eax, dword [ebp + 0x10]
xor ecx, edx
and ecx, 0xff00ff
xor ecx, edx
mov edx, dword [eax]
mov eax, edx
push esi
push edi
push ecx
mov ecx, ebx
and eax, 0xffff00ff
shl ecx, 0x10
or ecx, ebx
mov ebx, dword [ebp - 0x10]
add ecx, eax
xor ecx, edx
and ecx, 0xff00ff
xor ecx, edx
push ecx
push ebx
call fcn.100d4ec0
mov edi, dword [ebp - 0xc]
add esp, 0x14
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 4]
add dword [ebp + 0x10], 4
add edx, 4
add dword [ebp - 8], 4
mov byte [edi + ecx], al
inc edi
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
dec ecx
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edx
cmp edi, ecx
jl 0x100d5122
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, eax
mov dword [ebp - 0xc], 1
sub edi, ecx
add ecx, 4
add edi, 4
add ecx, eax
mov dword [ebp - 8], ecx
mov eax, ebx
mov ebx, esi
mov esi, dword [edx]
push esi
push eax
push dword [ecx]
push dword [edi]
push ebx
call fcn.100d4ec0
mov ecx, dword [ebp - 0xc]
lea edi, [edi + 4]
mov edx, dword [ebp + 0x14]
add esp, 0x14
add dword [ebp - 4], 4
add dword [ebp - 8], 4
mov byte [ecx + edx], al
inc ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
dec eax
mov dword [ebp - 0xc], ecx
cmp ecx, eax
mov ecx, dword [ebp - 8]
jl 0x100d51f6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100d7c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10206f54]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movaps xmm0, xmmword [0x101f26d0]
push ebx
push esi
mov ebx, dword [eax + 0x18]
mov dword [ebp - 0x28], eax
push edi
mov edi, 1
mov dword [ebp - 0x24], edi
mov esi, edi
mov dword [ebp - 0x1c], esi
movups xmmword [ebp - 0x14], xmm0
cmp ebx, 4
jge 0x100d7c73
cmp ebx, edi
jle 0x100d7d99
jmp 0x100d7c78
mov ebx, 4
lea ecx, [eax + 0x480]
add eax, 0x72c
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x20], eax
nop dword [eax]
xor edx, edx
test edi, edi
jle 0x100d7ccd
mov ecx, dword [ebp - 0x28]
add ecx, 0x444
nop
mov esi, dword [eax - 4]
cmp esi, dword [ecx - 4]
mov esi, dword [ebp - 0x1c]
jne 0x100d7cb4
mov eax, dword [eax]
cmp eax, dword [ecx]
je 0x100d7cc4
mov eax, dword [ebp - 0x20]
inc edx
add ecx, 0x2e8
cmp edx, edi
jl 0x100d7ca0
mov ecx, dword [ebp - 0x18]
jmp 0x100d7ccf
mov ecx, dword [ebp - 0x18]
mov dword [ebp + esi*4 - 0x14], edx
jmp 0x100d7d05
xor edx, edx
lea eax, [ebp - 0x14]
mov dword [eax + esi*4], edx
lea eax, [eax + esi*4]
cmp edi, esi
je 0x100d7cf8
mov esi, dword [ebp - 0x20]
mov ecx, 0xba
mov edi, dword [ebp - 0x18]
add esi, 0xfffffd54
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
inc edi
add ecx, 0x2e8
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x20]
inc esi
add eax, 0x2e8
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], eax
cmp esi, ebx
jl 0x100d7c90
cmp edi, ebx
jge 0x100d7d99
mov ecx, dword [ebp - 0x28]
mov esi, dword [ecx + 0x2c]
imul esi, dword [ecx + 0x28]
test esi, esi
jle 0x100d7d5f
mov edi, ecx
mov eax, dword [edi + 0x588c]
dec esi
mov ecx, dword [eax + esi*8]
lea edx, [eax + esi*8]
mov eax, ecx
shr eax, 5
and eax, 3
mov eax, dword [ebp + eax*4 - 0x14]
shl eax, 5
xor eax, ecx
and eax, 0x60
xor eax, ecx
mov dword [edx], eax
test esi, esi
jg 0x100d7d30
mov edi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
imul eax, edi, 0x2e8
mov dword [ecx + 0x18], edi
lea edx, [eax + ecx]
add eax, 0x198
add eax, ecx
sub ebx, edi
nop dword [eax]
nop dword [eax + eax]
mov edi, eax
lea esi, [edx - 0x150]
mov ecx, 0xba
add eax, 0x2e8
rep movsd dword es:[edi], dword [esi]
sub ebx, 1
jne 0x100d7d80
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101a8b60
mov esp, ebp
pop ebp
ret