joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100610f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, dword [ecx + 4]
movzx ebp, word [edi + 0xc]
cmp ebp, dword [ecx + 0xc]
ja 0x10061233
movzx edx, word [edi + ebp*2 + 0xc]
push esi
mov esi, dword [esp + 0x10]
and edx, 0x3fff
cmp esi, ebp
jae 0x10061232
cmp dword [esp + 0x14], 0
push ebx
mov ebx, dword [esp + 0x1c]
jne 0x10061133
movzx ecx, word [edi + esi*2 + 0xe]
and ecx, 0x3fff
jmp 0x10061167
test ebx, ebx
jle 0x1006114f
test esi, esi
jne 0x10061142
mov ecx, 0x1000
jmp 0x10061167
movzx ecx, word [edi + esi*2 + 0xc]
and ecx, 0x3fff
jmp 0x10061167
test esi, esi
jne 0x1006115a
mov eax, 0x1000
jmp 0x10061164
movzx eax, word [edi + esi*2 + 0xc]
and eax, 0x3fff
lea ecx, [eax + ebx]
test ebx, ebx
js 0x10061173
cmp edx, ebx
jb 0x10061231
cmp ecx, edx
jb 0x10061231
test ebx, ebx
js 0x10061191
movzx eax, word [edi + esi*2 + 0xe]
and eax, 0x3fff
cmp eax, ebx
jl 0x10061231
mov eax, ecx
sub eax, ebx
cmp eax, 0x1000
ja 0x10061231
cmp ecx, 0x1000
ja 0x10061231
mov eax, edx
sub eax, ebx
mov dword [esp + 0x18], eax
add eax, edi
mov dword [esp + 0x14], eax
lea eax, [edi + 0xe]
cmp dword [esp + 0x14], eax
jb 0x10061231
lea eax, [ebp*2 + 0xe]
cmp dword [esp + 0x18], eax
jb 0x10061231
sub ecx, edx
lea eax, [edx + edi]
push ecx
push eax
push dword [esp + 0x1c]
call fcn.10118700
movzx eax, word [edi + 0xc]
add esp, 0xc
cmp esi, eax
jae 0x10061212
lea edx, [esi + 7]
lea edx, [edi + edx*2]
movzx eax, word [edx]
lea edx, [edx + 2]
mov ecx, eax
inc esi
sub ecx, ebx
xor ecx, eax
and ecx, 0x3fff
xor ecx, eax
mov word [edx - 2], cx
movzx eax, word [edi + 0xc]
cmp esi, eax
jb 0x100611f1
movzx ecx, word [edi + 0xc]
mov eax, 0x3fff
mov dx, word [edi + ecx*2 + 0xc]
and dx, ax
lea eax, [ecx + ecx]
sub dx, ax
sub dx, 0xe
mov word [edi + 2], dx
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x10061ea0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x218
mov eax, dword [0x101366b4]
xor eax, esp
mov dword [esp + 0x214], eax
mov eax, dword [esp + 0x224]
push ebx
mov ebx, dword [ecx + 4]
lea ecx, [esp + 8]
push ebp
push esi
push edi
push 0x6b39dac7
mov dword [esp + 0x14], eax
call fcn.10062d80
push 0x6b39dac7
lea ecx, [esp + 0x120]
call fcn.10062d80
push 0x80
lea ebp, [ebx + 0x18]
push ebp
lea ecx, [esp + 0x1c]
call fcn.10062df0
cvttsd2si edi, qword [ebx + 0x72]
lea esi, [ebx + 0x42]
mov edx, 4
mov ecx, esi
sub edx, esi
xor dword [ecx], edi
lea ecx, [ecx + 4]
lea eax, [edx + ecx]
cmp eax, 0x28
jle 0x10061f08
mov edx, dword [esp + 0x230]
mov ecx, esi
mov edi, 0x24
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10061f59
add ecx, 4
add edx, 4
sub edi, 4
jae 0x10061f23
mov eax, dword [esp + 0x22c]
movdqu xmm0, xmmword [eax]
movdqu xmmword [esi], xmm0
movdqu xmm0, xmmword [eax + 0x10]
movdqu xmmword [esi + 0x10], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x20], xmm0
jmp 0x10061f69
mov ecx, dword [esp + 0x10]
push 1
push 0xfffff88f
call fcn.10063120
cvttsd2si edx, qword [ebx + 0x72]
mov ecx, 4
sub ecx, esi
xor dword [esi], edx
lea esi, [esi + 4]
lea eax, [ecx + esi]
cmp eax, 0x28
jle 0x10061f75
push 0x80
push ebp
lea ecx, [esp + 0x124]
call fcn.10062df0
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10117cfd
add esp, 0x218
ret 0xc

Function at 0x10062140
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x214
mov eax, dword [0x101366b4]
xor eax, esp
mov dword [esp + 0x210], eax
cmp dword [esp + 0x21c], 0x28
mov eax, dword [esp + 0x220]
push ebx
mov ebx, dword [ecx + 4]
push ebp
mov ebp, dword [esp + 0x220]
jae 0x10062184
push 1
push 0xfffffbe9
mov ecx, eax
call fcn.10063120
jmp 0x10062224
push esi
push edi
push 0x6b39dac7
lea ecx, [esp + 0x14]
call fcn.10062d80
push 0x6b39dac7
lea ecx, [esp + 0x11c]
call fcn.10062d80
lea eax, [ebx + 0x18]
push 0x80
push eax
lea ecx, [esp + 0x18]
call fcn.10062df0
cvttsd2si edi, qword [ebx + 0x72]
lea ecx, [ebx + 0x42]
mov esi, 4
mov edx, ecx
sub esi, ecx
xor dword [edx], edi
lea edx, [edx + 4]
lea eax, [esi + edx]
cmp eax, 0x28
jle 0x100621c8
movdqu xmm0, xmmword [ecx]
mov edx, 4
sub edx, ecx
movdqu xmmword [ebp], xmm0
movdqu xmm0, xmmword [ecx + 0x10]
movdqu xmmword [ebp + 0x10], xmm0
movq xmm0, qword [ecx + 0x20]
movq qword [ebp + 0x20], xmm0
cvttsd2si esi, qword [ebx + 0x72]
mov edi, edi
xor dword [ecx], esi
lea ecx, [ecx + 4]
lea eax, [edx + ecx]
cmp eax, 0x28
jle 0x10062200
push 0x80
lea eax, [ebx + 0x18]
push eax
lea ecx, [esp + 0x120]
call fcn.10062df0
pop edi
pop esi
mov ecx, dword [esp + 0x218]
pop ebp
pop ebx
xor ecx, esp
call fcn.10117cfd
add esp, 0x214
ret 0xc
Function at 0x10062240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x194
mov eax, dword [0x101366b4]
xor eax, esp
mov dword [esp + 0x190], eax
push ebx
push esi
mov esi, dword [ecx + 4]
mov ecx, 0x20
push edi
add esi, 0x18
lea edi, [esp + 0x10]
cmp dword [ebp + 8], 0
rep movsd dword es:[edi], dword [esi]
je 0x100622bd
push 0x6b39dac7
lea ecx, [esp + 0x94]
call fcn.10062d80
push 0x80
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x98]
call fcn.10062df0
cvttsd2si edx, qword [esp + 0x6a]
mov ecx, 4
lea eax, [esp + 0x3a]
lea ebx, [ebx]
xor dword [eax], edx
lea eax, [eax + 4]
add ecx, 4
cmp ecx, 0x28
jle 0x100622b0
mov eax, dword [esp + 0x6a]
xor ebx, ebx
mov dword [esp + 0xc], eax
jmp 0x100622d0
movzx edi, byte [esp + ebx*2 + 0x42]
lea esi, [ebx + 3]
lea ecx, [esi + 1]
mov eax, 0xaaaaaaab
mul ecx
mov ecx, ebx
shr edx, 4
lea eax, [edx + edx*2]
shl eax, 3
sub ecx, eax
mov eax, 0xaaaaaaab
add ecx, 4
shl edi, cl
lea ecx, [esi - 2]
mul ecx
mov ecx, ebx
shr edx, 4
lea eax, [edx + edx*2]
shl eax, 3
sub ecx, eax
movzx eax, byte [esp + ebx*2 + 0x3c]
inc ecx
shl eax, cl
lea ecx, [esi - 1]
xor edi, eax
mov eax, 0xaaaaaaab
mul ecx
mov ecx, ebx
shr edx, 4
lea eax, [edx + edx*2]
shl eax, 3
sub ecx, eax
movzx eax, byte [esp + ebx*2 + 0x3e]
add ecx, 2
shl eax, cl
mov ecx, ebx
xor edi, eax
mov eax, 0xaaaaaaab
mul esi
shr edx, 4
lea eax, [edx + edx*2]
shl eax, 3
sub ecx, eax
movzx eax, byte [esp + ebx*2 + 0x40]
add ecx, 3
shl eax, cl
mov ecx, ebx
xor edi, eax
mov eax, 0xaaaaaaab
mul ebx
shr edx, 4
lea eax, [edx + edx*2]
movzx edx, byte [esp + ebx*2 + 0x3a]
shl eax, 3
add ebx, 5
sub ecx, eax
mov eax, dword [esp + 0xc]
shl edx, cl
xor edi, edx
xor eax, edi
mov dword [esp + 0xc], eax
cmp ebx, 0x28
jb 0x100622d0
mov ecx, dword [esp + 0x19c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10117cfd
mov esp, ebp
pop ebp
ret 4

Function at 0x100624d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x190
mov eax, dword [0x101366b4]
xor eax, esp
mov dword [esp + 0x18c], eax
push esi
mov esi, dword [ecx + 4]
lea ecx, [esp + 0x84]
push edi
push 0x6b39dac7
call fcn.10062d80
add esi, 0x18
lea edi, [esp + 8]
mov ecx, 0x20
lea eax, [esp + 8]
rep movsd dword es:[edi], dword [esi]
push 0x80
push eax
lea ecx, [esp + 0x90]
call fcn.10062df0
cvttsd2si edx, qword [esp + 0x62]
mov ecx, 4
lea eax, [esp + 0x32]
xor dword [eax], edx
lea eax, [eax + 4]
add ecx, 4
cmp ecx, 0x28
jle 0x10062533
mov ecx, dword [esp + 0x194]
xor eax, eax
cmp word [esp + 0x32], ax
pop edi
setne al
pop esi
xor ecx, esp
call fcn.10117cfd
mov esp, ebp
pop ebp
ret 4
Function at 0x10062560
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x118
mov eax, dword [0x101366b4]
xor eax, esp
mov dword [esp + 0x114], eax
push ebx
push esi
push edi
mov esi, ecx
lea ecx, [esp + 0x18]
push 0x6b39dac7
call fcn.10062d80
mov ebx, dword [esi + 4]
push 0x1000
push 0
push ebx
call fcn.10117f50
mov esi, dword [esp + 0x134]
lea edi, [ebx + 0xe00]
mov eax, 0x1000100
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov dword [ebx], pe_nt_image_headers32
add esp, 0xc
mov eax, dword [esi + 4]
mov dword [ebx + 0x14], eax
mov eax, dword [esi]
cmp eax, 1
jne 0x100625d0
movdqu xmm0, xmmword [0x10008ae0]
jmp 0x100625e7
cmp eax, 4
jne 0x100625df
movdqu xmm0, xmmword [0x10008ac0]
jmp 0x100625e7
movdqu xmm0, xmmword [0x10008ad0]
movdqu xmmword [ebx + 4], xmm0
mov eax, dword [esi + 8]
mov dword [ebx + 0x18], eax
mov eax, dword [esi + 0xc]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi]
cmp eax, 3
je 0x1006260d
cmp eax, 4
je 0x1006260d
mov dword [ebx + 0x3e], 0
jmp 0x1006261b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
or eax, 0xa0a00000
mov dword [ebx + 0x3e], eax
mov eax, dword [ebx + 0x3e]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x12c]
test eax, eax
je 0x1006264a
movdqu xmm0, xmmword [eax]
movdqu xmmword [ebx + 0x42], xmm0
movdqu xmm0, xmmword [eax + 0x10]
movdqu xmmword [ebx + 0x52], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [ebx + 0x62], xmm0
mov dword [ebx + 0x6a], 0x2649
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x6e], eax
mov ax, word [esi + 0x14]
mov word [ebx + 0x3c], ax
lea eax, [esp + 0x10]
push eax
call fcn.10068550
movsd xmm0, qword [esp + 0x10]
ucomisd xmm0, qword [0x10008d08]
lahf
test ah, 0x44
jp 0x1006268b
movsd xmm0, qword [0x10008d10]
movsd qword [esp + 0x10], xmm0
push ebp
movsd qword [ebx + 0x72], xmm0
lea ebp, [ebx + 0x9c]
xor esi, esi
lea esp, [esp]
mov eax, dword [esi + 0x10008af0]
mov edi, esi
mov dword [ebp - 4], eax
mov edx, 0xc
mov ecx, ebp
sub edi, ebp
lea eax, [edx + 0x7ffffff2]
test eax, eax
je 0x100626d1
mov al, byte [edi + ecx + 0x10008af4]
test al, al
je 0x100626d1
mov byte [ecx], al
inc ecx
dec edx
jne 0x100626b4
jmp 0x100626d5
test edx, edx
jne 0x100626d6
dec ecx
mov byte [ecx], 0
cmp dword [esi + 0x10008af0], 0
je 0x100626f0
add esi, 0x10
add ebp, 0x10
cmp esi, 0x200
jb 0x100626a0
cvttsd2si edi, qword [ebx + 0x72]
lea edx, [ebx + 0x42]
mov esi, 4
sub esi, edx
pop ebp
xor dword [edx], edi
lea edx, [edx + 4]
lea ecx, [esi + edx]
cmp ecx, 0x28
jle 0x10062700
push 0x80
lea ecx, [ebx + 0x18]
push ecx
lea ecx, [esp + 0x20]
call fcn.10062df0
mov ecx, dword [esp + 0x120]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10117cfd
add esp, 0x118
ret 0xc
Function at 0x10062910
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x21c
mov eax, dword [0x101366b4]
xor eax, esp
mov dword [esp + 0x218], eax
push ebp
mov ebp, dword [esp + 0x22c]
push esi
mov esi, ecx
lea ecx, [esp + 0x118]
push 0x6b39dac7
call fcn.10062d80
mov esi, dword [esi + 4]
mov eax, pe_nt_image_headers32
cmp word [esi], ax
jne 0x10062b00
cmp word [esi + 2], 0
jne 0x10062b00
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1006296c
cmp eax, 1
jne 0x10062b00
push ebx
lea edx, [esi + 4]
mov ebx, 0xc
push edi
mov ecx, edx
mov edi, 0x10008ad0
lea ecx, [ecx]
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x10062998
add ecx, 4
add edi, 4
sub ebx, 4
jae 0x10062980
mov ebx, 2
jmp 0x100629bc
mov ecx, 0x10008ac0
mov edi, 0xc
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x10062af7
add edx, 4
add ecx, 4
sub edi, 4
jae 0x100629a2
mov ebx, 4
cmp dword [esi + 0x14], 0
jne 0x100629de
push 1
push 0
push 0
push 0xffffdd9f
push 0xfffffc05
mov ecx, ebp
call fcn.100630b0
jmp 0x10062ada
lea eax, [esi + 0x18]
push 0x80
push eax
lea ecx, [esp + 0x128]
mov dword [esp + 0x18], eax
call fcn.10062df0
cmp dword [esi + 0x6a], 0x38e
jbe 0x10062a21
movsd xmm0, qword [esi + 0x72]
ucomisd xmm0, qword [0x10008d08]
lahf
test ah, 0x44
jp 0x10062a21
push 1
push 0xfffffbfc
mov ecx, ebp
call fcn.10063120
test byte [ebp], 8
jne 0x10062a43
cvttsd2si edi, qword [esi + 0x72]
lea ecx, [esi + 0x42]
mov edx, 4
sub edx, ecx
xor dword [ecx], edi
lea ecx, [ecx + 4]
lea eax, [edx + ecx]
cmp eax, 0x28
jle 0x10062a36
mov eax, dword [ebp]
and eax, 8
mov dword [esp + 0x14], eax
jne 0x10062a88
cmp word [esi + 0x42], 0
lea ecx, [esi + 0x42]
je 0x10062a88
cmp dword [esp + 0x234], 2
je 0x10062a88
mov edx, dword [esp + 0x230]
test edx, edx
je 0x10062aac
mov edi, 0x24
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10062aac
add ecx, 4
add edx, 4
sub edi, 4
jae 0x10062a73
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x10062aa8
cmp dword [esi + 0x3e], eax
je 0x10062aa8
cmp ebx, 4
mov eax, 3
push 0x4b8
mov ecx, ebp
cmovne ebx, eax
call fcn.10063180
mov eax, ebx
jmp 0x10062adc
push 0x6b39dac7
lea ecx, [esp + 0x1c]
call fcn.10062d80
push 0x80
push dword [esp + 0x14]
lea ecx, [esp + 0x20]
call fcn.10062df0
push 1
push 0xfffff88f
mov ecx, ebp
call fcn.10063120
xor eax, eax
pop edi
pop ebx
mov ecx, dword [esp + 0x220]
pop esi
pop ebp
xor ecx, esp
call fcn.10117cfd
add esp, 0x21c
ret 0xc
push 1
push 0xfffffbfc
jmp 0x10062ad3
cmp word [esi + 0x40e], 0
je 0x10062b27
push 0x39c76bda
lea ecx, [esp + 0x14]
call fcn.10062d80
push 0x800
push esi
lea ecx, [esp + 0x18]
call fcn.10062df0
cmp word [esi], 1
jne 0x10062b54
cmp dword [esi + 0x406], 0x68636952
jne 0x10062b54
push 1
push 0
push 0
push 0xffffdda0
push 0xfffffc05
mov ecx, ebp
call fcn.100630b0
xor eax, eax
jmp 0x10062ade
push 1
push 0xfffffbfc
mov ecx, ebp
call fcn.10063120
xor eax, eax
jmp 0x10062ade
Function at 0x10062df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x10062e43
lea esi, [ecx + 6]
mov edi, dword [ebp + 8]
xor ebx, ebx
xor edx, edx
mov bl, byte [ecx + 4]
mov dl, byte [ecx + 5]
inc bl
push ebp
xor eax, eax
mov ebp, dword [ebp + 0xc]
mov cl, byte [esi + ebx]
add dl, cl
mov ch, byte [edi]
inc edi
mov al, byte [esi + edx]
mov byte [esi + edx], cl
mov byte [esi + ebx], al
add al, cl
inc bl
xor ch, byte [esi + eax]
dec ebp
mov byte [edi - 1], ch
mov cl, byte [esi + ebx]
jne 0x10062e1b
pop ebp
mov ecx, dword [ebp - 4]
mov byte [ecx + 4], dh
mov byte [ecx + 5], dl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1006b060
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, ecx
test byte [edi + 0x14], 0x80
jne 0x1006b11f
mov eax, dword [esp + 0x38]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x48]
mov dword [esp + 0x30], 0
push eax
push ebx
push dword [esp + 0x48]
mov dword [esp + 0x40], 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1006b105
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 1
push eax
mov ecx, 0x10138ce8
call fcn.10083200
mov eax, dword [esp + 0xc]
test al, 1
jne 0x1006b0df
cmp dword [esp + 0x10], 0xfffffc15
jne 0x1006b0df
or dword [edi + 0x14], 0x80
jmp 0x1006b0f3
test al, 8
je 0x1006b0f3
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.10062ed0
mov eax, dword [esp + 0xc]
test eax, 0xfffffffe
je 0x1006b119
lea ecx, [esp + 0xc]
call fcn.10062fa0
jmp 0x1006b119
cmp dword [esp + 0x44], ebx
je 0x1006b119
push 1
push 0xfffffc06
mov ecx, esi
call fcn.10063120
test byte [edi + 0x14], 0x80
je 0x1006b18d
push ebp
lea ebp, [edi + 0x18]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
push dword [esp + 0x44]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1006b14c
push esi
mov ecx, 0x10138ce8
call fcn.10083200
jmp 0x1006b185
push 0
lea eax, [esp + 0x4c]
push eax
push ebx
push dword [esp + 0x4c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1006b171
push esi
mov ecx, 0x10138ce8
call fcn.10083200
jmp 0x1006b185
cmp dword [esp + 0x48], ebx
je 0x1006b185
push 1
push 0xfffffc06
mov ecx, esi
call fcn.10063120
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
inc dword [0x10138d58]
test byte [esi], 8
je 0x1006b1a2
push 0
push esi
mov ecx, edi
call fcn.1006b340
pop edi
pop esi
pop ebx
add esp, 0x28
ret 0x10
Function at 0x1006b450
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, ecx
test byte [edi + 0x14], 0x80
jne 0x1006b50f
mov eax, dword [esp + 0x38]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x48]
mov dword [esp + 0x30], 0
push eax
push ebx
push dword [esp + 0x48]
mov dword [esp + 0x40], 0
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1006b4f5
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 1
push eax
mov ecx, 0x10138ce8
call fcn.10083200
mov eax, dword [esp + 0xc]
test al, 1
jne 0x1006b4cf
cmp dword [esp + 0x10], 0xfffffc15
jne 0x1006b4cf
or dword [edi + 0x14], 0x80
jmp 0x1006b4e3
test al, 8
je 0x1006b4e3
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.10062ed0
mov eax, dword [esp + 0xc]
test eax, 0xfffffffe
je 0x1006b509
lea ecx, [esp + 0xc]
call fcn.10062fa0
jmp 0x1006b509
cmp dword [esp + 0x44], ebx
je 0x1006b509
push 1
push 0xfffff8f0
mov ecx, esi
call fcn.10063120
test byte [edi + 0x14], 0x80
je 0x1006b57d
push ebp
lea ebp, [edi + 0x18]
push ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
push dword [esp + 0x44]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x1006b53c
push esi
mov ecx, 0x10138ce8
call fcn.10083200
jmp 0x1006b575
push 0
lea eax, [esp + 0x4c]
push eax
push ebx
push dword [esp + 0x4c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1006b561
push esi
mov ecx, 0x10138ce8
call fcn.10083200
jmp 0x1006b575
cmp dword [esp + 0x48], ebx
je 0x1006b575
push 1
push 0xfffff8f0
mov ecx, esi
call fcn.10063120
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebp
inc dword [0x10138d5c]
test byte [esi], 8
je 0x1006b592
push 0
push esi
mov ecx, edi
call fcn.1006b340
pop edi
pop esi
pop ebx
add esp, 0x28
ret 0x10
Function at 0x100729a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x14]
push ebx
push ebp
mov ebp, ecx
lea eax, [edx + 7]
mov dword [esp + 8], ebp
shr eax, 3
push esi
mov ecx, dword [ebp]
push edi
mov edi, dword [esp + 0x28]
lea ebx, [eax*8 + 1]
add ebx, eax
mov dword [esp + 0x14], ebx
lea eax, [ecx + ebx]
cmp eax, dword [ebp + 0xc]
ja 0x100729da
mov esi, dword [ebp + 4]
add esi, ecx
jmp 0x100729e9
push edi
push ebx
mov ecx, ebp
call fcn.10073780
mov edx, dword [esp + 0x24]
mov esi, eax
test byte [edi], 8
jne 0x10072b29
cmp dword [esp + 0x1c], 0
jne 0x10072a01
mov byte [esi], 0x7f
inc esi
xor bl, bl
jmp 0x10072a08
mov byte [esi], 0x80
inc esi
or bl, 0xff
mov ecx, dword [esp + 0x20]
movsx eax, bl
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm1, xmm0, 0
cmp edx, 8
jbe 0x10072a8a
lea edi, [edx - 9]
shr edi, 3
inc edi
lea esp, [esp]
movzx eax, byte [ecx]
sub edx, 8
xor al, bl
mov byte [esi], al
movzx eax, byte [ecx + 1]
xor al, bl
mov byte [esi + 1], al
movzx eax, byte [ecx + 2]
xor al, bl
mov byte [esi + 2], al
movzx eax, byte [ecx + 3]
xor al, bl
mov byte [esi + 3], al
movzx eax, byte [ecx + 4]
xor al, bl
mov byte [esi + 4], al
movzx eax, byte [ecx + 5]
xor al, bl
mov byte [esi + 5], al
movzx eax, byte [ecx + 6]
xor al, bl
mov byte [esi + 6], al
movzx eax, byte [ecx + 7]
add ecx, 8
xor al, bl
mov byte [esi + 7], al
mov byte [esi + 8], 9
add esi, 9
dec edi
jne 0x10072a30
mov dword [esp + 0x24], edx
test edx, edx
je 0x10072b22
xor ebp, ebp
test edx, edx
je 0x10072afc
cmp edx, 0x20
jb 0x10072ae7
lea eax, [ecx - 1]
lea edi, [esi - 1]
add eax, edx
add edi, edx
cmp esi, eax
ja 0x10072aaf
cmp edi, ecx
jae 0x10072ae7
mov eax, edx
mov edi, edx
and eax, 0x1f
sub edi, eax
jmp 0x10072ac0
movdqu xmm0, xmmword [ecx]
add ebp, 0x20
pxor xmm0, xmm1
movdqu xmmword [esi], xmm0
movdqu xmm0, xmmword [ecx + 0x10]
add ecx, 0x20
pxor xmm0, xmm1
movdqu xmmword [esi + 0x10], xmm0
add esi, 0x20
cmp ebp, edi
jb 0x10072ac0
cmp ebp, edx
jae 0x10072afc
mov edi, edx
sub ecx, esi
sub edi, ebp
mov al, byte [ecx + esi]
xor al, bl
mov byte [esi], al
inc esi
dec edi
jne 0x10072af1
mov eax, 8
sub eax, edx
push eax
movzx eax, bl
push eax
push esi
call fcn.10117f50
mov ecx, dword [esp + 0x30]
add esp, 0xc
mov ebp, dword [esp + 0x10]
mov al, cl
xor al, bl
sub esi, ecx
mov byte [esi + 8], al
mov eax, dword [esp + 0x14]
add dword [ebp], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
Function at 0x100730e0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
xor ebx, ebx
push esi
mov esi, ecx
push edi
lea eax, [ebp + 8]
xor edi, edi
cmp eax, dword [esi]
jae 0x10073111
mov eax, dword [esi + 4]
movzx eax, byte [eax + ebp]
sub eax, ebx
je 0x10073111
sub eax, 0x80
je 0x10073202
sub eax, 0x7f
jne 0x1007311f
mov ecx, dword [esp + 0x24]
push 0x3ec
call fcn.10063180
mov eax, dword [esp + 0x24]
test byte [eax], 4
jne 0x1007321c
lea ecx, [ebp + 1]
mov ebp, 8
add ecx, dword [esi + 4]
neg ebx
mov esi, dword [esp + 0x1c]
sbb bl, bl
movsx eax, bl
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movzx eax, bl
pshufd xmm1, xmm0, 0
mov dword [esp + 0x10], eax
lea ebx, [ebx]
movzx edx, byte [ecx + 8]
xor edx, eax
cmp edx, 8
cmova edx, ebp
lea ebp, [edx + edi]
mov dword [esp + 0x18], ebp
cmp ebp, dword [esp + 0x20]
ja 0x1007320c
xor edi, edi
test edx, edx
je 0x100731df
cmp edx, 0x20
jb 0x100731ce
lea eax, [ecx - 1]
lea ebp, [esi - 1]
add eax, edx
add ebp, edx
cmp esi, eax
ja 0x1007319a
cmp ebp, ecx
jae 0x100731ca
mov eax, edx
mov ebp, edx
and eax, 0x1f
sub ebp, eax
movdqu xmm0, xmmword [ecx]
add edi, 0x20
pxor xmm0, xmm1
movdqu xmmword [esi], xmm0
movdqu xmm0, xmmword [ecx + 0x10]
add ecx, 0x20
pxor xmm0, xmm1
movdqu xmmword [esi + 0x10], xmm0
add esi, 0x20
cmp edi, ebp
jb 0x100731a3
mov ebp, dword [esp + 0x18]
cmp edi, edx
jae 0x100731df
sub edx, edi
mov al, byte [ecx]
inc ecx
xor al, bl
mov byte [esi], al
inc esi
dec edx
jne 0x100731d4
mov dl, byte [ecx]
mov edi, ebp
mov eax, dword [esp + 0x10]
xor dl, bl
inc ecx
mov ebp, 8
cmp dl, 8
ja 0x10073160
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
mov ebx, 1
jmp 0x1007311f
mov ecx, dword [esp + 0x24]
push 1
push 0xfffffbf2
call fcn.10063120
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10

Function at 0x100738d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
mov ecx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x20]
mov esi, 1
lea eax, [ecx + 9]
cmp eax, dword [ebp]
jae 0x10073904
mov eax, dword [ebp + 4]
movzx eax, byte [eax + ecx]
sub eax, ebx
je 0x10073904
sub eax, 0x80
je 0x1007393c
sub eax, 0x7f
jne 0x10073914
push 0x3ec
mov ecx, edi
call fcn.10063180
mov ecx, dword [esp + 0x14]
test byte [edi], 4
jne 0x10073933
mov eax, dword [ebp + 4]
inc eax
add ecx, eax
neg ebx
sbb bl, bl
mov dl, byte [ecx + 8]
lea ecx, [ecx + 9]
xor dl, bl
add esi, 9
cmp dl, 8
ja 0x10073923
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret 0x10
mov ebx, esi
jmp 0x10073914