joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018150
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
push 0
push 0
push 0
imul eax, dword [eax + 4], 0x3e8
push 0x10014300
push 0
push 0
mov dword [0x10098cfc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
ret 4

Function at 0x10018640
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
mov edi, 5
cmp byte [esi + 4], bl
jbe 0x100186ae
push ebp
mov ebp, 0x100
nop dword [eax]
movzx eax, byte [edi + esi + 0x17]
mov dl, byte [edi + esi]
add eax, 0x2800
push eax
mov al, dl
xor al, 0x80
test dl, dl
movzx ecx, al
movzx eax, dl
cmovns ecx, eax
movzx eax, byte [edi + esi + 1]
movzx ecx, cl
imul ecx, ebp
add cx, ax
movzx eax, cx
mov ecx, 0x1009d570
push eax
call fcn.1001cfa0
movzx eax, byte [edi + esi + 0x43]
inc ebx
lea edi, [edi + eax*8]
movzx eax, byte [esi + 4]
lea edi, [edi + 0x44]
cmp ebx, eax
jl 0x10018660
pop ebp
pop edi
pop esi
pop ebx
ret 4

Function at 0x100195d0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library

Disassembly:
sub esp, 0x2a4
mov eax, dword [0x1008b884]
xor eax, esp
mov dword [esp + 0x2a0], eax
mov eax, dword [0x1008b6ec]
push esi
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
push edi
push dword [eax]
mov edi, dword [esp + 0x2b4]
call esi
lea eax, [esp + 0x18]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [0x1008b6ec]
mov dword [ecx], eax
mov eax, dword [0x1008b6ec]
cmp dword [eax], 0xffffffff
jne 0x1001966e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x1b0]
push str.Error_msg:__d__d
push eax
call fcn.10002520
add esp, 0x10
lea eax, [esp + 0x1a8]
push 0
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
jmp 0x1001970b
mov eax, 2
push edi
mov word [esp + 0xc], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push dword [esp + 0x2b4]
mov dword [esp + 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0xa], ax
lea eax, [esp + 8]
push 0x10
push eax
mov eax, dword [0x1008b6ec]
push dword [eax]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
mov eax, dword [0x1008b6ec]
je 0x100196d2
push 3
push 0x400
push dword [0x1009e8b0]
push dword [eax]
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
cmp eax, 0xffffffff
jne 0x100196e0
mov eax, dword [0x1008b6ec]
push dword [eax]
call esi
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
jmp 0x1001970b
mov word [0x6e2be9c], 0
mov ecx, 0x1009d33c
push dword [0x1c3249c]
call fcn.1001bdf0
push dword [0x1c3249c]
mov ecx, 0x1009d318
call fcn.1001bdf0
mov al, 1
mov ecx, dword [esp + 0x2a8]
pop edi
pop esi
xor ecx, esp
call fcn.100472b7
add esp, 0x2a4
ret 8
Function at 0x10019f30
Capabilities:
Convert ip address from string
Resolve dns

Disassembly:
sub esp, 0x30
mov eax, dword [0x1008b884]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
mov ebx, dword [esp + 0x38]
lea eax, [esp + 0x24]
push eax
push ebx
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jne 0x1001a0ab
push ebx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1001a0ab
mov eax, dword [eax + 0xc]
push ebp
push esi
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov ebp, eax
mov dword [esp + 0x10], 0
mov esi, ebp
mov dword [esp + 0xc], ebp
mov dword [esp + 0x24], 0xf
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10019f92
sub esi, ecx
push edi
cmp esi, 0xf
ja 0x10019fc3
push esi
lea eax, [esp + 0x18]
mov dword [esp + 0x28], esi
push ebp
push eax
call fcn.10049bd0
mov byte [esp + esi + 0x20], 0
mov edi, dword [esp + 0x34]
mov ebp, dword [esp + 0x20]
jmp 0x1001a042
cmp esi, 0x7fffffff
ja 0x1001a0bd
mov edi, esi
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x10019ff3
mov eax, connect
mov edi, closesocket
push eax
call fcn.10001820
add esp, 4
mov ebp, eax
jmp 0x1001a027
mov eax, 0x16
cmp edi, eax
cmovb edi, eax
lea eax, [edi + 1]
cmp eax, 0x1000
jb 0x1001a014
push eax
call fcn.10001820
add esp, 4
mov ebp, eax
jmp 0x1001a027
test eax, eax
je 0x1001a025
push eax
call fcn.10046f5f
add esp, 4
mov ebp, eax
jmp 0x1001a027
xor ebp, ebp
push esi
push dword [esp + 0x14]
mov dword [esp + 0x2c], esi
push ebp
mov dword [esp + 0x34], edi
call fcn.10049bd0
mov byte [esi + ebp], 0
mov dword [esp + 0x20], ebp
add esp, 0xc
mov dword [ebx], 0
cmp edi, 0x10
lea ecx, [esp + 0x14]
cmovae ecx, ebp
sub ebx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ebx + ecx - 1], al
test al, al
jne 0x1001a057
lea esi, [esp + 0x14]
cmp edi, 0x10
jb 0x1001a096
inc edi
mov esi, ebp
mov ecx, esi
cmp edi, 0x1000
jb 0x1001a08c
mov ecx, dword [ebp - 4]
mov eax, esi
sub eax, ecx
add edi, 0x23
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001a0c2
push edi
push ecx
call fcn.10046f8f
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100472b7
add esp, 0x30
ret
mov ecx, dword [esp + 0x30]
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.100472b7
add esp, 0x30
ret
call fcn.100024c0
call fcn.1004be8f
int3
Function at 0x1001a2a0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1008b884]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], ecx
call dword [sym.imp.SecureEngineSDK32.dll_Ordinal_132]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100057b0
push 0
push str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890__
lea ecx, [ebp - 0x1c]
call fcn.1001acb0
cmp eax, 0xffffffff
je 0x1001a2f5
push 0x10
push 0x1006b1d4
push str.Window_title_is_invalid__alphanumerical_characters__space_and______are_allowed_only
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.SecureEngineSDK32.dll_Ordinal_532]
lea ecx, [ebp - 0x1c]
call fcn.10006d20
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100472b7
mov esp, ebp
pop ebp
ret 4
Function at 0x1001ca00
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
call esi
mov ebx, dword [esp + 0x10]
sub eax, edi
cmp eax, ebx
jae 0x1001ca30
push ebp
mov ebp, dword [esp + 0x18]
nop
push ebp
call dword [sym.imp.KERNEL32.dll_Sleep]
call esi
sub eax, edi
cmp eax, ebx
jb 0x1001ca20
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret

Function at 0x1001ca60
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x1001caab
mov ebx, dword [edi + 0x3c]
cmp dword [ebx + edi], 0x4550
jne 0x1001caab
mov ebx, dword [ebx + edi + 0x78]
xor esi, esi
add ebx, edi
mov ebp, dword [ebx + 0x20]
add ebp, edi
cmp dword [ebx + 0x14], esi
jbe 0x1001caab
mov eax, dword [ebp + esi*4]
push dword [esp + 0x18]
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1001cab2
inc esi
cmp esi, dword [ebx + 0x14]
jb 0x1001ca90
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
movzx eax, si
cmp ax, 0xffff
je 0x1001caab
movsx ecx, ax
mov eax, dword [ebx + 0x24]
lea eax, [eax + ecx*2]
movsx ecx, word [eax + edi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edi]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10024e30
Capabilities:
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
cmp byte [0x1009fbe0], 0
jne 0x10024e3e
call fcn.100404a0
cmp byte [0x1009fbea], 0
je 0x10024e5c
push 0
push 0x40
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.100408a0
add esp, 0x10
ret
jmp fcn.10020640
Function at 0x10029c20
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
push ebx
push ebp
xor ebp, ebp
mov dword [esp + 0x18], ecx
push edi
test eax, eax
je 0x10029c36
mov ebp, dword [eax]
xor ebx, ebx
bswap ebp
add eax, 4
je 0x10029c41
mov ebx, dword [eax]
xor edi, edi
bswap ebx
add eax, 4
je 0x10029c4c
mov edi, dword [eax]
mov eax, dword [ecx + 8]
mov edx, 0xb0b
mov dword [esp + 0x24], edx
mov dword [esp + 0xc], eax
push esi
bswap edi
test eax, eax
je 0x10029d3a
mov eax, dword [ecx + 0x24]
mov ecx, dword [eax]
mov esi, dword [eax + 4]
mov eax, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], eax
nop
mov eax, edx
xor ebx, esi
shl eax, 0x10
xor eax, ecx
xor ebp, eax
mov eax, dword [esp + 0x14]
xor eax, edx
mov esi, ebp
xor edi, eax
shr esi, 0x10
mov eax, edi
xor esi, edi
xor eax, ebx
shr esi, 8
xor eax, ebp
mov edx, ebx
mov ecx, eax
shl edx, 0x10
rol eax, 8
xor edx, edi
rol ecx, 0x10
xor ecx, eax
shl edx, 8
mov eax, ebp
shl eax, 0x10
xor eax, ebx
shl eax, 8
xor esi, eax
mov eax, ebx
shr eax, 0x10
xor eax, ebp
shr eax, 8
xor edx, eax
mov eax, edx
shl edx, 0x10
xor eax, ecx
xor ebx, eax
mov eax, esi
shr eax, 0x10
xor esi, ecx
xor edx, eax
xor esi, ebp
xor edx, ecx
ror esi, 0xa
xor edx, edi
mov edi, ebx
rol edx, 1
not edi
mov ebp, edx
or edi, esi
not ebp
xor edi, edx
or ebp, ebx
ror edi, 0xa
xor ebp, esi
not esi
or esi, edx
rol ebp, 1
mov edx, dword [esp + 0x28]
xor ebx, esi
mov esi, dword [esp + 0x1c]
add edx, edx
mov ecx, edx
mov eax, edx
xor edx, 0x11011
and eax, 0x10000
cmove edx, ecx
sub dword [esp + 0x10], 1
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
jne 0x10029c80
mov ecx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x24]
mov eax, edx
shl eax, 0x10
xor eax, dword [ecx]
xor ebx, dword [ecx + 4]
xor ebp, eax
mov eax, dword [ecx + 8]
mov esi, ebp
xor eax, edx
shr esi, 0x10
xor edi, eax
mov ecx, ebx
mov eax, edi
shl ecx, 0x10
xor eax, ebx
xor esi, edi
xor eax, ebp
shr esi, 8
mov edx, eax
xor ecx, edi
rol eax, 8
rol edx, 0x10
xor edx, eax
shl ecx, 8
mov eax, ebp
shl eax, 0x10
xor eax, ebx
shl eax, 8
xor esi, eax
mov eax, ebx
shr eax, 0x10
xor eax, ebp
shr eax, 8
xor ecx, eax
mov eax, ecx
shl ecx, 0x10
xor eax, edx
xor ebx, eax
mov eax, esi
shr eax, 0x10
xor esi, edx
xor ecx, eax
xor esi, ebp
xor ecx, edx
xor edi, ecx
mov ecx, dword [esp + 0x2c]
bswap esi
test ecx, ecx
je 0x10029db0
xor esi, dword [ecx]
mov eax, dword [esp + 0x30]
test eax, eax
je 0x10029dba
mov dword [eax], esi
lea edx, [eax + 4]
test ecx, ecx
lea eax, [ecx + 4]
cmove eax, ecx
bswap ebx
pop esi
test eax, eax
je 0x10029dce
xor ebx, dword [eax]
test edx, edx
je 0x10029dd4
mov dword [edx], ebx
add edx, 4
lea ecx, [eax + 4]
test eax, eax
bswap edi
cmove ecx, eax
test ecx, ecx
je 0x10029de7
xor edi, dword [ecx]
test edx, edx
je 0x10029ded
mov dword [edx], edi
pop edi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
Function at 0x1002ac20
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push esi
xor esi, esi
push edi
mov edi, dword [ecx + 0x34]
test eax, eax
je 0x1002ac39
mov esi, dword [eax]
xor edx, edx
bswap esi
add eax, 4
je 0x1002ac44
mov edx, dword [eax]
bswap edx
test edi, edi
je 0x1002acaf
mov eax, dword [ecx + 0x2c]
push ebp
mov ecx, dword [eax + 0xc]
mov ebp, dword [eax + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
nop dword [eax]
mov ecx, esi
mov eax, esi
shr ecx, 5
shl eax, 4
add ecx, ebx
add eax, ebp
xor ecx, eax
lea eax, [esi + edi]
xor ecx, eax
sub edx, ecx
mov ecx, edx
mov eax, edx
shr ecx, 5
add ecx, dword [esp + 0x10]
shl eax, 4
add eax, dword [esp + 0x14]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
sub esi, ecx
add edi, 0x61c88647
jne 0x1002ac70
mov ebx, dword [esp + 0x20]
pop ebp
bswap esi
test ebx, ebx
je 0x1002acb7
xor esi, dword [ebx]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1002acc1
mov dword [eax], esi
test ebx, ebx
lea ecx, [eax + 4]
lea eax, [ebx + 4]
pop edi
cmove eax, ebx
pop esi
bswap edx
pop ebx
test eax, eax
je 0x1002acd7
xor edx, dword [eax]
test ecx, ecx
je 0x1002acdd
mov dword [ecx], edx
add esp, 8
ret 0xc

Function at 0x1002acf0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push esi
push edi
xor edi, edi
xor esi, esi
test eax, eax
je 0x1002ad08
mov esi, dword [eax]
xor edx, edx
bswap esi
add eax, 4
je 0x1002ad13
mov edx, dword [eax]
push ebp
mov ebp, dword [ecx + 0x34]
bswap edx
test ebp, ebp
je 0x1002ad82
mov eax, dword [ecx + 0x2c]
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
nop
mov ecx, edx
mov eax, edx
shr ecx, 5
sub edi, 0x61c88647
shl eax, 4
add ecx, ebx
add eax, dword [esp + 0x10]
xor ecx, eax
lea eax, [edx + edi]
xor ecx, eax
add esi, ecx
mov ecx, esi
mov eax, esi
shr ecx, 5
add ecx, dword [esp + 0x14]
shl eax, 4
add eax, dword [esp + 0x18]
xor ecx, eax
lea eax, [esi + edi]
xor ecx, eax
add edx, ecx
cmp edi, ebp
jne 0x1002ad40
mov ebx, dword [esp + 0x24]
bswap esi
pop ebp
test ebx, ebx
je 0x1002ad8b
xor esi, dword [ebx]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x1002ad95
mov dword [eax], esi
test ebx, ebx
lea ecx, [eax + 4]
lea eax, [ebx + 4]
pop edi
cmove eax, ebx
pop esi
bswap edx
pop ebx
test eax, eax
je 0x1002adab
xor edx, dword [eax]
test ecx, ecx
je 0x1002adb1
mov dword [ecx], edx
add esp, 0xc
ret 0xc
Function at 0x1002ae60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
push edi
mov edi, ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [edi + 0x14]
mov ebp, dword [edi + 0x18]
lea eax, [eax*4]
add eax, ebp
test ecx, ecx
je 0x1002ae85
mov ebx, dword [ecx]
xor edx, edx
add ecx, 4
je 0x1002ae8e
mov edx, dword [ecx]
mov edi, dword [edi + 8]
test edi, edi
je 0x1002aeb6
sub edx, dword [eax - 4]
lea eax, [eax - 8]
movzx ecx, bl
and ecx, 0x1f
ror edx, cl
xor edx, ebx
sub ebx, dword [eax]
movzx ecx, dl
and ecx, 0x1f
ror ebx, cl
xor ebx, edx
sub edi, 1
jne 0x1002ae95
sub edx, dword [ebp + 4]
sub ebx, dword [ebp]
test esi, esi
je 0x1002aec2
xor ebx, dword [esi]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1002aecc
mov dword [eax], ebx
test esi, esi
lea ecx, [eax + 4]
lea eax, [esi + 4]
pop edi
cmove eax, esi
pop esi
pop ebp
pop ebx
test eax, eax
je 0x1002aee3
mov eax, dword [eax]
xor edx, eax
test ecx, ecx
je 0x1002aee9
mov dword [ecx], edx
ret 0xc

Function at 0x1002aef0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x18]
test eax, eax
je 0x1002af09
mov edx, dword [eax]
xor ecx, ecx
add eax, 4
je 0x1002af12
mov ecx, dword [eax]
mov ebx, dword [esi]
mov eax, dword [edi + 8]
add ebx, edx
mov edx, dword [esi + 4]
xor edi, edi
add edx, ecx
test eax, eax
je 0x1002af4b
mov ebp, eax
movzx ecx, dl
xor ebx, edx
and ecx, 0x1f
rol ebx, cl
add ebx, dword [esi + edi*8 + 8]
movzx ecx, bl
xor edx, ebx
and ecx, 0x1f
rol edx, cl
add edx, dword [esi + edi*8 + 0xc]
inc edi
cmp edi, ebp
jb 0x1002af26
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x1002af52
xor ebx, dword [ebp]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1002af5c
mov dword [eax], ebx
test ebp, ebp
lea ecx, [eax + 4]
pop edi
lea eax, [ebp + 4]
pop esi
cmove eax, ebp
pop ebp
pop ebx
test eax, eax
je 0x1002af73
mov eax, dword [eax]
xor edx, eax
test ecx, ecx
je 0x1002af79
mov dword [ecx], edx
ret 0xc
Function at 0x1002b200
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
mov ebx, ecx
push ebp
push esi
xor esi, esi
mov ecx, dword [ebx + 0x18]
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x14], ecx
push edi
lea eax, [ecx + eax*4]
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x1002b222
mov esi, dword [ecx]
lea edx, [ecx + 4]
xor ecx, ecx
mov dword [esp + 0x20], ecx
test edx, edx
je 0x1002b235
mov ecx, dword [edx]
mov dword [esp + 0x20], ecx
xor edi, edi
add edx, 4
je 0x1002b23e
mov edi, dword [edx]
xor ebp, ebp
add edx, 4
je 0x1002b247
mov ebp, dword [edx]
mov edx, dword [ebx + 8]
sub eax, 8
mov dword [esp + 0x10], edx
sub edi, dword [eax + 4]
sub esi, dword [eax]
test edx, edx
je 0x1002b2b7
nop word [eax + eax]
sub eax, 8
mov dword [esp + 0x14], eax
mov eax, esi
mov esi, ebp
mov ebp, edi
mov edi, ecx
mov ecx, eax
mov dword [esp + 0x20], ecx
lea ebx, [eax*2 + 1]
imul ebx, eax
lea edx, [ebp*2 + 1]
mov eax, dword [esp + 0x14]
imul edx, ebp
sub edi, dword [eax + 4]
sub esi, dword [eax]
rol ebx, 5
movzx ecx, bl
and ecx, 0x1f
rol edx, 5
ror edi, cl
movzx ecx, dl
xor edi, edx
and ecx, 0x1f
ror esi, cl
mov ecx, dword [esp + 0x20]
xor esi, ebx
sub dword [esp + 0x10], 1
jne 0x1002b260
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
sub ebp, dword [eax + 4]
sub ecx, dword [eax]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x1002b2d4
mov eax, dword [eax]
xor esi, eax
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
test edx, edx
je 0x1002b2de
mov dword [edx], esi
lea esi, [edx + 4]
test eax, eax
lea edx, [eax + 4]
cmove edx, eax
test edx, edx
je 0x1002b2ef
xor ecx, dword [edx]
test esi, esi
je 0x1002b2f5
mov dword [esi], ecx
add esi, 4
lea ecx, [edx + 4]
test edx, edx
cmove ecx, edx
test ecx, ecx
je 0x1002b306
xor edi, dword [ecx]
test esi, esi
je 0x1002b30c
mov dword [esi], edi
add esi, 4
lea eax, [ecx + 4]
test ecx, ecx
cmove eax, ecx
test eax, eax
je 0x1002b31f
mov eax, dword [eax]
xor ebp, eax
test esi, esi
je 0x1002b325
mov dword [esi], ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0xc
Function at 0x1002b330
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov dword [esp], 0
push ebx
push ebp
push esi
mov esi, ecx
mov ebp, dword [esi + 0x18]
test eax, eax
je 0x1002b350
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
xor ebx, ebx
add eax, 4
je 0x1002b359
mov ebx, dword [eax]
lea ecx, [eax + 4]
xor eax, eax
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x1002b36c
mov eax, dword [ecx]
mov dword [esp + 0x18], eax
xor edx, edx
add ecx, 4
je 0x1002b375
mov edx, dword [ecx]
mov ecx, dword [esi + 8]
push edi
mov edi, dword [ebp]
add edi, ebx
mov dword [esp + 0x14], ecx
mov ebx, dword [ebp + 4]
add ebp, 8
add ebx, edx
test ecx, ecx
je 0x1002b3e2
nop
lea edx, [edi*2 + 1]
imul edx, edi
lea eax, [ebx*2 + 1]
imul eax, ebx
rol edx, 5
rol eax, 5
mov esi, edx
xor esi, dword [esp + 0x10]
movzx ecx, al
and ecx, 0x1f
mov dword [esp + 0x10], edi
rol esi, cl
mov edi, eax
xor edi, dword [esp + 0x1c]
mov eax, ebx
mov ebx, dword [ebp]
movzx ecx, dl
add ebx, esi
and ecx, 0x1f
mov dword [esp + 0x1c], eax
rol edi, cl
add edi, dword [ebp + 4]
add ebp, 8
sub dword [esp + 0x14], 1
jne 0x1002b390
add eax, dword [ebp + 4]
mov ecx, dword [ebp]
add ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1002b400
mov eax, dword [eax]
xor ecx, eax
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
test edx, edx
je 0x1002b40a
mov dword [edx], ecx
lea esi, [edx + 4]
test eax, eax
lea edx, [eax + 4]
cmove edx, eax
test edx, edx
je 0x1002b41b
xor edi, dword [edx]
test esi, esi
je 0x1002b421
mov dword [esi], edi
add esi, 4
lea ecx, [edx + 4]
test edx, edx
pop edi
cmove ecx, edx
mov edx, dword [esp + 0x18]
test ecx, ecx
je 0x1002b437
xor edx, dword [ecx]
test esi, esi
je 0x1002b43d
mov dword [esi], edx
add esi, 4
lea eax, [ecx + 4]
test ecx, ecx
cmove eax, ecx
test eax, eax
je 0x1002b450
mov eax, dword [eax]
xor ebx, eax
test esi, esi
je 0x1002b456
mov dword [esi], ebx
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x1003f030
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 8
mov edx, dword [esp + 0x10]
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov edi, dword [esp + 0x1c]
cmp eax, 4
jb 0x1003f068
mov esi, eax
shr esi, 2
nop
mov ecx, dword [edi]
sub eax, 4
xor ecx, dword [edx]
add edi, 4
or ebx, ecx
add edx, 4
sub esi, 1
jne 0x1003f050
mov dword [esp + 0x24], eax
mov esi, ebx
mov ecx, ebx
shr esi, 8
xor ebp, ebp
or esi, ebx
shr ecx, 0x10
and esi, 0xff00
or esi, ecx
movzx ecx, bl
shr esi, 8
or esi, ecx
mov dword [esp + 0x10], esi
test eax, eax
je 0x1003f157
cmp eax, 8
jb 0x1003f138
mov ebx, eax
mov esi, edi
and ebx, 0xfffffff8
xorps xmm4, xmm4
sub esi, edx
xorps xmm3, xmm3
mov dword [esp + 0x14], esi
mov ecx, edx
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
nop dword [eax + eax]
movd xmm2, dword [eax + ecx]
lea ecx, [ecx + 8]
movd xmm1, dword [ecx - 8]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [ecx - 4]
por xmm4, xmm2
punpcklbw xmm1, xmm0
movd xmm2, dword [edi + ebp + 4]
add ebp, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp ebp, ebx
jb 0x1003f0c0
mov eax, dword [esp + 0x24]
por xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd ecx, xmm3
or esi, ecx
cmp ebp, eax
jae 0x1003f157
sub edi, edx
lea ebx, [edx + ebp]
sub eax, ebp
movzx edx, byte [ebx + edi]
lea ebx, [ebx + 1]
movzx ecx, byte [ebx - 1]
xor edx, ecx
or esi, edx
sub eax, 1
jne 0x1003f143
pop edi
test esi, esi
pop esi
pop ebp
sete al
pop ebx
add esp, 8
ret
Function at 0x1003f170
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x1c
test eax, eax
je 0x1003f2b6
mov edx, dword [esp + 0x20]
push ebx
mov ebx, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x2c]
push edi
cmp eax, 4
jb 0x1003f1b3
mov edi, eax
shr edi, 2
mov ecx, dword [esi]
sub eax, 4
xor ecx, dword [ebx]
add esi, 4
mov dword [edx], ecx
add ebx, 4
add edx, 4
sub edi, 1
jne 0x1003f198
mov dword [esp + 0x38], eax
push ebp
xor ebp, ebp
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
test eax, eax
je 0x1003f2b2
cmp eax, 0x40
jb 0x1003f28f
lea ecx, [ebx - 1]
lea edi, [edx - 1]
add ecx, eax
add edi, eax
cmp edx, ecx
ja 0x1003f1e5
cmp edi, ebx
jae 0x1003f28f
lea ecx, [esi - 1]
add ecx, eax
cmp edx, ecx
ja 0x1003f1f6
cmp edi, esi
jae 0x1003f28f
mov ecx, eax
lea edi, [edx + 0x10]
mov eax, edx
mov dword [esp + 0x18], edi
sub eax, ebx
and ecx, 0xffffffc0
mov dword [esp + 0x20], eax
mov edi, esi
sub edi, ebx
mov dword [esp + 0x28], ecx
mov eax, esi
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x18]
sub eax, edx
mov edx, dword [esp + 0x20]
mov ecx, ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
movups xmm0, xmmword [ecx]
lea ecx, [ecx + 0x40]
movups xmm1, xmmword [eax + ecx - 0x40]
lea edi, [edi + 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx - 0x30]
movups xmmword [edx + ecx - 0x40], xmm1
movups xmm1, xmmword [ebx + edi - 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx - 0x20]
movups xmmword [edi - 0x40], xmm1
movups xmm1, xmmword [esi + ebp + 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx - 0x10]
movups xmmword [edi - 0x30], xmm1
movups xmm1, xmmword [esi + ebp + 0x30]
add ebp, 0x40
pxor xmm1, xmm0
movups xmmword [edi - 0x20], xmm1
cmp ebp, dword [esp + 0x28]
jb 0x1003f230
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
cmp ebp, eax
jae 0x1003f2b2
sub esi, ebx
lea edi, [ebx + ebp]
sub edx, ebx
sub eax, ebp
nop dword [eax]
mov cl, byte [edi + esi]
lea edi, [edi + 1]
xor cl, byte [edi - 1]
mov byte [edi + edx - 1], cl
sub eax, 1
jne 0x1003f2a0
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1c
ret