joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001933e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x68
xor esi, esi
xorpd xmm0, xmm0
mov eax, esi
mov ecx, 0xaaaaaaab
movsd xmm2, qword [0x10187120]
mov ebx, esi
movsd xmm1, qword [0x10187128]
movsd xmm6, qword [0x10188f80]
movapd xmm3, xmm0
mov dword [esp + 8], esi
movsd qword [esp + 0x30], xmm0
mul ecx
lea ecx, [esi - 0x12]
mov eax, edx
and edx, 0x7ffffffe
shr eax, 1
lea eax, [eax + eax*2]
addsd xmm3, xmm1
sub ebx, eax
lea eax, [esi + esi + 0x13]
mulsd xmm3, xmm2
cmp esi, 0x12
xorps xmm4, xmm4
cvtsi2sd xmm4, eax
divsd xmm3, qword [0x1018a818]
lea eax, [esi + 2]
mulsd xmm4, xmm2
cmovb eax, esi
divsd xmm4, qword [0x1018a820]
lea edi, [eax*4 + 0x1029da80]
movsd qword [esp + 0x28], xmm3
movsd qword [esp + 0x20], xmm4
xorps xmm4, xmm4
cvtsi2sd xmm4, ecx
lea ecx, [esi - 6]
xor esi, esi
xorps xmm5, xmm5
cvtsi2sd xmm5, ecx
addsd xmm4, xmm1
lea ecx, [edx + edx + 0x1029dbc0]
addsd xmm5, xmm1
mulsd xmm4, xmm2
mov dword [esp + 0xc], ecx
mulsd xmm5, xmm2
divsd xmm4, xmm6
divsd xmm5, xmm6
movsd qword [esp + 0x18], xmm4
movsd qword [esp + 0x10], xmm5
cmp ebx, 1
je 0x10019426
cmp esi, 2
je 0x1001951f
movsd xmm0, qword [esp + 0x28]
movsd qword [esp], xmm0
call fcn.1016be80
fstp qword [esp + 0x58]
mov eax, esi
movsd xmm0, qword [esp + 0x58]
and eax, 0x7fffffff
cmp eax, 3
je 0x10019481
cmp eax, 1
jne 0x100194cd
cmp dword [esp + 8], 0x1d
xorpd xmm1, xmm1
ja 0x100194d1
mov eax, dword [esp + 8]
cmp eax, 0x18
jb 0x100194b1
movsd xmm0, qword [esp + 0x18]
movsd qword [esp], xmm0
call fcn.1016be80
fstp qword [esp + 0x48]
movsd xmm1, qword [esp + 0x48]
jmp 0x100194d1
cmp dword [esp + 8], 6
xorpd xmm1, xmm1
jb 0x100194d1
mov eax, dword [esp + 8]
cmp eax, 0xb
ja 0x100194c0
movsd xmm0, qword [esp + 0x10]
movsd qword [esp], xmm0
call fcn.1016be80
fstp qword [esp + 0x50]
movsd xmm1, qword [esp + 0x50]
jmp 0x100194d1
movsd xmm1, qword [0x10187360]
cmp eax, 0x11
jbe 0x100194cd
jmp 0x100194d1
movsd xmm1, qword [0x10187360]
cmp eax, 0x12
jb 0x100194d1
movapd xmm1, xmm0
movsd xmm0, qword [esp + 0x20]
movsd qword [esp + 0x38], xmm1
movsd qword [esp], xmm0
call fcn.1016ade0
movsd xmm0, qword [0x1018a828]
fstp qword [esp + 0x40]
cmp esi, 2
mov eax, edi
cmove eax, dword [esp + 0xc]
divsd xmm0, qword [esp + 0x40]
mulsd xmm0, qword [esp + 0x38]
mulsd xmm0, qword [0x1018a830]
cvtsd2ss xmm0, xmm0
movss dword [eax], xmm0
movsd xmm0, qword [esp + 0x30]
inc esi
add edi, 0xa0
cmp esi, 4
jne 0x10019418
mov esi, dword [esp + 8]
addsd xmm0, qword [0x10187360]
inc esi
cmp esi, 0x24
jne 0x10019350
movapd xmm0, xmmword [0x10187140]
xor eax, eax
mov ecx, 0x1029dd04
xor edx, edx
mov esi, dword [ecx + edx*4 - 0x284]
mov dword [ecx + edx*4 - 4], esi
movss xmm1, dword [ecx + edx*4 - 0x280]
xorpd xmm1, xmm0
movss dword [ecx + edx*4], xmm1
add edx, 2
cmp edx, 0x28
jb 0x10019556
inc eax
add ecx, 0xa0
cmp eax, 4
jne 0x10019554
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1001ca6f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 8]
test byte [eax + 0x2b8], 1
je 0x1001ca8a
cmp dword [eax + 0x2bc], 0
je 0x1001ca93
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.1000d49e
cmp dword [eax + 0x78], 0x1000d3a9
je 0x1001ca8a
mov eax, dword [eax + 0x1c]
mov ebx, dword [ebp + 0xc]
mov esi, dword [eax + 0x14]
mov eax, dword [esi + 0x84]
cmp eax, 1
jne 0x1001cafd
lea edi, [esi + 0x28]
push edi
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov dword [esi + 0x9c], ebx
mov eax, 3
lea ebx, [esi + 0x1c]
xchg dword [esi + 0x84], eax
push ebx
call dword [sym.imp.KERNEL32.dll_WakeAllConditionVariable]
jmp 0x1001cae3
push 0
push 0xffffffffffffffff
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SleepConditionVariableSRW]
mov eax, dword [esi + 0x84]
cmp eax, 1
jne 0x1001cad7
mov esi, dword [esi + 0xa0]
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
jmp 0x1001cb00
xor esi, esi
dec esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1004ce74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0x14]
test eax, eax
mov dword [ebp - 0x10], eax
jle 0x1004cf23
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
add dword [ebp - 0x10], edi
lea edx, [eax + 0x14]
lea ecx, [eax + 4]
lea esi, [eax + 0xc]
mov dword [ebp - 0x1c], edx
lea edx, [eax + 0x12]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + 0x24]
test ecx, ecx
jne 0x1004cee9
xor ecx, ecx
push ecx
push ecx
push 1
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [eax]
call fcn.1004c29a
add esp, 0x18
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov cl, byte [eax + 1]
inc cl
cmp eax, edx
mov byte [eax + 1], cl
jb 0x1004cee3
dec eax
test cl, cl
je 0x1004ced2
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
mov edx, dword [ebp - 0x10]
mov esi, eax
mov eax, edi
sub eax, ecx
add eax, 0x10
cmp eax, edx
cmova eax, edx
mov edx, ecx
sub edx, edi
add edx, eax
and edx, 0xf
cmp edi, eax
mov dword [esi + 0x24], edx
jae 0x1004cf1b
lea ecx, [esi + ecx + 0x14]
mov dl, byte [ecx]
inc ecx
xor dl, byte [edi]
inc edi
mov byte [ebx], dl
inc ebx
cmp edi, eax
jb 0x1004cf0e
cmp edi, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
jb 0x1004ceaf
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1004dc48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [ebp + 8]
push dword [esi]
call fcn.1016c2b0
add esp, 4
inc eax
push eax
call sym.ffmpeg.dll_av_malloc
add esp, 4
mov ebx, eax
test eax, eax
je 0x1004dd46
mov edi, dword [esi]
push str.__n_t_r
push edi
call fcn.1016c3c0
add esp, 8
lea esi, [edi + eax]
mov al, byte [edi + eax]
mov dword [ebp - 0x18], ebx
test al, al
je 0x1004dd18
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0xd], al
push dword [ebp + 0xc]
push esi
call fcn.1016c3c0
add esp, 8
test eax, eax
jne 0x1004dd1d
mov cl, byte [ebp - 0xd]
lea edi, [esi + 1]
cmp cl, 0x5c
je 0x1004dcf8
cmp cl, 0x27
jne 0x1004dd0b
mov cl, byte [esi + 1]
test cl, cl
sete al
cmp cl, 0x27
setne dl
add esi, 2
cmp al, dl
je 0x1004dce8
mov byte [ebx], cl
inc ebx
mov cl, byte [esi]
test cl, cl
sete al
cmp cl, 0x27
setne dl
inc esi
xor dl, al
test dl, dl
jne 0x1004dcce
lea edi, [esi - 1]
mov ecx, dword [ebp - 0x14]
test al, al
cmove edi, esi
cmove ecx, ebx
mov dword [ebp - 0x14], ecx
jmp 0x1004dd0e
mov al, byte [edi]
test al, al
je 0x1004dd0b
add esi, 2
mov byte [ebx], al
inc ebx
mov dword [ebp - 0x14], ebx
mov edi, esi
jmp 0x1004dd0e
mov byte [ebx], cl
inc ebx
mov al, byte [edi]
mov esi, edi
test al, al
jne 0x1004dc96
jmp 0x1004dd1f
mov eax, ebx
mov dword [ebp - 0x14], ebx
mov edi, esi
mov esi, dword [ebp - 0x14]
dec ebx
cmp ebx, esi
mov byte [ebx + 1], 0
jb 0x1004dd3e
push str.__n_t_r
push ebx
call fcn.1016c3c0
add esp, 8
dec ebx
test eax, eax
jne 0x1004dd23
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x18]
mov dword [eax], edi
mov eax, ebx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1004e111
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x14]
xor esi, esi
cmp ebx, 0x3ffffffe
ja 0x1004e200
lea eax, [ebx + 2]
mov ecx, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax*4 + 1]
cmp eax, dword [ebp + 0xc]
jg 0x1004e200
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
cmp ebx, 4
jl 0x1004e1aa
push dword [esi]
call fcn.101688a0
add esp, 4
mov ecx, eax
add esi, 3
shr ecx, 0x1a
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], cl
mov ecx, eax
shr ecx, 0x14
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 1], cl
mov ecx, eax
shr eax, 8
shr ecx, 0xe
and eax, 0x3f
and ecx, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 2], cl
mov byte [edi + 3], al
add edi, 4
cmp ebx, 6
lea ebx, [ebx - 3]
jg 0x1004e154
test ebx, ebx
je 0x1004e1ec
xor eax, eax
mov ecx, ebx
mov edx, eax
movzx eax, byte [esi]
inc esi
shl edx, 8
or eax, edx
dec ecx
jne 0x1004e1b2
mov esi, dword [ebp + 8]
shl ebx, 3
test ebx, ebx
jle 0x1004e1f5
shl eax, 6
add ebx, 6
add ebx, 0xfffffffa
mov edx, eax
mov ecx, ebx
shr edx, cl
and edx, 0x3f
mov cl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], cl
inc edi
cmp ebx, 6
jg 0x1004e1d0
jmp 0x1004e1f5
mov esi, dword [ebp + 8]
jmp 0x1004e1f5
mov byte [edi], 0x3d
inc edi
mov eax, edi
sub eax, esi
test al, 3
jne 0x1004e1f1
mov byte [edi], 0
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x1004ee04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
mov eax, 0xffffffea
lea edx, [ecx - 8]
cmp edx, 0x18
ja 0x1004ef06
xor edx, edx
mov ebx, dword [ebp + 0x14]
xor edi, edi
xor esi, esi
inc edx
shld edi, edx, cl
shl edx, cl
test cl, 0x20
cmovne edi, edx
cmovne edx, esi
cmp ebx, edx
sbb esi, edi
jge 0x1004ef06
mov edx, dword [ebp + 0x18]
cmp edx, 0x1000
je 0x1004ee57
cmp edx, 0x404
jne 0x1004ef06
mov eax, 0x20
mov edi, ebx
xor esi, esi
sub eax, ecx
mov ecx, eax
shl edi, cl
cmp dword [ebp + 0xc], 0
je 0x1004ee85
mov ecx, 8
mov eax, esi
mov edx, eax
and eax, 1
neg eax
shr edx, 1
and eax, ebx
xor eax, edx
dec ecx
jne 0x1004ee73
jmp 0x1004eea5
mov eax, esi
mov ecx, 8
shl eax, 0x18
lea edx, [eax + eax]
sar eax, 0x1f
and eax, edi
xor eax, edx
dec ecx
jne 0x1004ee8f
push eax
call fcn.101688a0
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + esi*4], eax
inc esi
cmp esi, 0x100
jne 0x1004ee66
mov edi, dword [ebp + 8]
xor eax, eax
cmp dword [ebp + 0x18], 0x1000
mov dword [edi + 0x400], 1
jb 0x1004ef06
lea eax, [edi + 0x400]
xor ecx, ecx
mov edx, 0xfffff400
mov ebx, dword [eax + edx + 0x800]
movzx esi, bl
shr ebx, 8
xor ebx, dword [edi + esi*4]
mov dword [eax + edx + 0xc00], ebx
add edx, 0x400
jne 0x1004eed9
inc ecx
add eax, 4
cmp ecx, 0x100
jne 0x1004eed4
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1004f0d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
cmp dword [ebx + 0x400], 0
lea edx, [esi + ecx]
jne 0x1004f195
test ecx, ecx
jle 0x1004f12c
mov edi, esi
and edi, 3
je 0x1004f12c
mov ecx, ebx
mov edi, esi
movzx ebx, byte [edi]
movzx ebp, al
shr eax, 8
inc edi
xor ebx, ebp
xor eax, dword [ecx + ebx*4]
cmp edi, edx
jae 0x1004f124
mov ebx, edi
and ebx, 3
jne 0x1004f10a
mov ebx, ecx
mov ecx, dword [esp + 0x2c]
jmp 0x1004f12e
mov edi, esi
lea ebp, [edx - 3]
cmp edi, ebp
jae 0x1004f193
add ecx, 0xfffffffc
mov dword [esp + 4], edx
mov edx, ebx
mov ebx, edi
mov dword [esp + 8], ebp
sub ecx, edi
lea ecx, [esi + ecx + 4]
and ecx, 0xfffffffc
mov dword [esp], ecx
xor eax, dword [ebx]
add ebx, 4
movzx ebp, ah
movzx esi, al
mov ecx, eax
shr eax, 0xe
mov ebp, dword [edx + ebp*4 + 0x800]
and eax, 0x3fc
shr ecx, 0x18
xor ebp, dword [edx + esi*4 + 0xc00]
xor ebp, dword [edx + eax + 0x400]
mov eax, ebp
mov ebp, dword [esp + 8]
xor eax, dword [edx + ecx*4]
cmp ebx, ebp
jb 0x1004f150
add edi, dword [esp]
mov ebx, edx
mov edx, dword [esp + 4]
mov esi, edi
cmp esi, edx
jae 0x1004f1ac
movzx edi, byte [esi]
movzx ecx, al
shr eax, 8
inc esi
xor edi, ecx
xor eax, dword [ebx + edi*4]
cmp edx, esi
jne 0x1004f199
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10056680
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa8
mov eax, dword [0x101db764]
xor eax, ebp
cmp dword [0x101ae9f0], 0x79
mov dword [esp + 0xa0], eax
jae 0x10056837
mov eax, dword [0x102a81cc]
xor esi, esi
xor edi, edi
mov dword [esp + 0x10], eax
mov eax, dword [0x102a81c8]
mov dword [esp + 0xc], eax
lfence
rdtsc
xor dword [0x102a8204], eax
lfence
rdtsc
mov dword [esp + 8], 0
xor dword [0x102a8274], edx
jmp 0x10056733
mov cl, byte [esp + 6]
and byte [esp + 7], cl
je 0x10056724
jmp 0x100567c6
mov ecx, dword [0x102a81c8]
mov edx, 0x1ff
lea edi, [esi + 0x3b9fce47]
and ecx, edx
imul edx, dword [ecx*4 + 0x102a81d0], 0x19660d
cmp esi, 0xc46031b9
cmovb edi, esi
lea edx, [edi + edx + 0x3c6ef35f]
mov dword [ecx*4 + 0x102a81d0], edx
mov ecx, dword [esp + 8]
mov edi, eax
test ecx, ecx
cmove ecx, eax
mov dword [esp + 8], ecx
call fcn.1016acad
lea ecx, [edi + esi*2]
mov esi, eax
sub esi, edi
cmp ecx, eax
jge 0x100566ef
mov ebx, dword [0x102a81c8]
mov ecx, dword [0x102a81cc]
lea edi, [esi + 0x3b9fce47]
cmp esi, 0xc46031b9
cmovb edi, esi
add ebx, 1
mov edx, ebx
adc ecx, 0
mov dword [0x102a81c8], ebx
and edx, 0x1ff
mov dword [0x102a81cc], ecx
add dword [edx*4 + 0x102a81d0], edi
mov edi, eax
sub edi, dword [esp + 8]
cmp edi, 0x1f
jl 0x10056724
mov edx, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
or edx, edi
mov edx, 4
setne byte [esp + 7]
sub ebx, dword [esp + 0xc]
sbb ecx, edi
cmp edx, ebx
mov edx, 0
mov edi, 0
sbb edx, ecx
mov edx, 0x40
setb byte [esp + 6]
cmp edx, ebx
sbb edi, ecx
jae 0x100566e0
lfence
rdtsc
lea esi, [esp + 0x28]
add dword [0x102a838c], eax
push 0xa0
push esi
call fcn.100570bf
add esp, 8
push 0x800
push 0x102a81d0
push esi
call fcn.1005aaa5
add esp, 0xc
lea edi, [esp + 0x14]
push edi
push esi
call fcn.1005ab49
add esp, 8
push dword [edi]
call fcn.101688a0
add esp, 4
mov esi, eax
push dword [edi + 0x10]
call fcn.101688a0
add esp, 4
mov ecx, dword [esp + 0xa0]
mov edi, eax
add edi, esi
xor ecx, ebp
call fcn.1015e65c
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.1016a210
Function at 0x10087b71
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
cmp dword [ebp + 8], 0
jle 0x10087c99
cvtsi2sd xmm0, dword [ebp + 8]
mov edi, edx
add ecx, 4
xor eax, eax
xorpd xmm1, xmm1
movsd qword [esp + 0x28], xmm0
movsd qword [esp + 0x20], xmm1
addsd xmm1, qword [0x10187128]
mov ebx, 0xfffffff9
mov dword [esp + 0xc], ecx
mov dword [esp + 0x18], eax
mulsd xmm1, qword [0x10187358]
movsd qword [esp + 0x30], xmm1
lea eax, [ebx + 1]
xorps xmm1, xmm1
cvtsi2sd xmm1, eax
mov dword [esp + 0x1c], eax
mulsd xmm1, qword [esp + 0x30]
divsd xmm1, xmm0
xorps xmm0, xmm0
cvtss2sd xmm0, dword [edi + ebx*4 + 0x1c]
movsd qword [esp + 0x10], xmm0
movsd qword [esp + 0x38], xmm1
movsd qword [esp], xmm1
call fcn.1016ade0
fstp qword [esp + 0x48]
movsd xmm0, qword [esp + 0x10]
mov esi, dword [esp + 0xc]
movsd xmm1, qword [esp + 0x38]
mulsd xmm0, qword [esp + 0x48]
cvtsd2ss xmm0, xmm0
movss dword [esi + ebx*8 + 0x34], xmm0
xorps xmm0, xmm0
cvtss2sd xmm0, dword [edi + ebx*4 + 0x1c]
movsd qword [esp], xmm1
movsd qword [esp + 0x10], xmm0
call fcn.1016be80
movapd xmm0, xmmword [0x10187140]
fstp qword [esp + 0x40]
movapd xmm1, xmm0
movsd xmm0, qword [esp + 0x10]
mulsd xmm0, qword [esp + 0x40]
cvtsd2ss xmm0, xmm0
xorpd xmm0, xmm1
movss dword [esi + ebx*8 + 0x38], xmm0
mov ebx, dword [esp + 0x1c]
movsd xmm0, qword [esp + 0x28]
test ebx, ebx
jne 0x10087bc6
mov eax, dword [esp + 0x18]
movsd xmm1, qword [esp + 0x20]
mov ecx, dword [esp + 0xc]
inc eax
add ecx, 0x40
addsd xmm1, qword [0x10187360]
cmp eax, dword [ebp + 8]
jne 0x10087b9d
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100992a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ecx, dword [ecx + 0x6e38]
mov edx, dword [eax + 0x350]
imul ecx, dword [ecx + 0x4a0], 0xfffffffa
lea ecx, [edx + ecx + 0x30]
mov edx, 0x33
cmp ecx, 0x34
cmovl edx, ecx
xor ecx, ecx
test edx, edx
cmovns ecx, edx
cmp dword [eax + 0x348], 1
mov edx, 0x101bc290
je 0x100992fa
mov edx, dword [eax + 0x8488]
shl edx, 0xb
lea edx, [edx + 0x101bca90]
mov esi, 0xfffffc00
movsx edi, byte [edx + esi*2 + 0x800]
movsx ebx, byte [edx + esi*2 + 0x801]
imul edi, ecx
sar edi, 4
add ebx, edi
lea edi, [ebx + ebx - 0x7f]
mov ebp, edi
sar ebp, 0x1f
xor ebp, edi
mov ebx, ebp
and ebx, 1
or ebx, 0x7c
cmp ebp, 0x7c
cmovle ebx, ebp
mov byte [eax + esi + 0x8488], bl
inc esi
jne 0x100992ff
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100a5ba8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [esi + 0x670c]
mov edi, dword [esi + 0x5ef8]
cmp eax, 2
sete dl
cmp eax, 3
lea eax, [edi + 0x54]
lea edx, [edi + edx*4 + 0x4c]
cmove edx, eax
mov eax, dword [ecx + 0x6314]
cmp dword [esi + 0x6708], 0
mov ebx, dword [edx]
mov dword [ebp - 0x14], eax
je 0x100a5c81
mov eax, dword [ecx + 0x5b6c]
xor edx, edx
mov dword [ebp - 0x18], ebx
jmp 0x100a5c08
mov esi, dword [ebp + 8]
mov edx, ecx
mov edi, dword [esi + 0x5ef8]
test eax, 0x7fffffff
mov dword [ebp - 0x10], edx
je 0x100a5c6e
mov edx, dword [ebp - 0x10]
mov ebx, 0x10
mov eax, dword [edi + edx*4 + 0x4c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x631c]
mov eax, dword [eax + edx*4 + 0x4c]
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 0x20]
lea esi, [ebx - 0x10]
mov ecx, edi
push ebx
push dword [ebp - 0x1c]
call fcn.100a5cbd
add esp, 8
mov ecx, dword [ebp - 0x10]
lea edx, [ebx + 1]
add ebx, 0xfffffff1
xor esi, ecx
shl ecx, 7
add ecx, edi
mov dword [ecx + esi*4 + 0x55ec], eax
mov eax, dword [edi + 0x5b6c]
lea ecx, [eax + eax]
cmp ebx, ecx
mov ebx, edx
jb 0x100a5c31
mov ecx, dword [ebp - 0x10]
inc ecx
cmp ecx, 2
jne 0x100a5bfd
mov edi, dword [ebp + 0xc]
mov ecx, edi
mov edi, dword [ebp - 0x18]
jmp 0x100a5c89
mov eax, dword [ecx + 0x5b6c]
mov edi, ebx
test eax, eax
mov eax, dword [ebp - 0x14]
je 0x100a5cb5
xor esi, esi
mov ebx, ecx
mov edx, edi
push esi
push eax
call fcn.100a5cbd
mov ecx, ebx
add esp, 8
mov dword [ebx + esi*4 + 0x556c], eax
inc esi
mov eax, dword [ebp - 0x14]
cmp esi, dword [ebx + 0x5b6c]
jb 0x100a5c92
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100ae258
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov al, 1
cmp dword [edx + 0x553c], 0
jne 0x100ae289
mov esi, dword [ecx + 0x5f2c]
mov edi, dword [edx + 0x5524]
test byte [esi + edi*4], 4
jne 0x100ae289
cmp dword [edx + 0x350], 0
sete al
mov esi, dword [ecx + 0x6e38]
cmp dword [esi + 0xc], 3
jne 0x100ae2a9
test al, al
jne 0x100ae2a2
cmp dword [ecx + 0x6440], 0
je 0x100ae2c4
pop esi
pop edi
jmp fcn.100ae2d2
test al, al
je 0x100ae2b4
pop esi
pop edi
jmp fcn.100b1084
cmp dword [ecx + 0x6440], 0
je 0x100ae2cb
pop esi
pop edi
jmp fcn.100b36b3
pop esi
pop edi
jmp fcn.100b015d
pop esi
pop edi
jmp fcn.100b4f91
Function at 0x100de6ff
Capabilities:
Encode data using xor

Disassembly:
push esi
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
movdqa xmm2, xmmword [0x10187140]
movdqa xmm3, xmmword [0x101aeb00]
pxor xmm1, xmm1
mov esi, dword [edx]
mov dword [edx], 0
and ecx, 0xfffffffe
xor edx, edx
add esi, 0x20
sar esi, 6
movd xmm0, esi
pshufd xmm0, xmm0, 0
mov esi, 0xfffffff8
movq xmm4, qword [eax + esi + 8]
movdqa xmm6, xmm3
punpcklwd xmm4, xmm1
paddd xmm4, xmm0
movdqa xmm5, xmm4
pxor xmm5, xmm2
pcmpgtd xmm6, xmm5
pxor xmm5, xmm5
psubd xmm5, xmm4
pand xmm4, xmm6
psrad xmm5, 0x1f
psrld xmm5, 0x17
pandn xmm6, xmm5
por xmm6, xmm4
pshuflw xmm4, xmm6, 0xe8
pshufhw xmm4, xmm4, 0xe8
pshufd xmm4, xmm4, 0xe8
movq qword [eax + esi + 8], xmm4
add esi, 8
jne 0x100de741
inc edx
add eax, ecx
cmp edx, 4
jne 0x100de73c
pop esi
ret

Function at 0x100de7a1
Capabilities:
Encode data using xor

Disassembly:
push esi
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
movdqa xmm2, xmmword [0x10187140]
movdqa xmm3, xmmword [0x101aeb00]
mov esi, dword [edx]
mov dword [edx], 0
and ecx, 0xfffffffe
xor edx, edx
add esi, 0x20
sar esi, 6
movd xmm0, esi
pshufd xmm0, xmm0, 0
mov esi, 0xfffffff0
movdqu xmm7, xmmword [eax + esi + 0x10]
pxor xmm1, xmm1
movdqa xmm5, xmm3
movdqa xmm4, xmm7
punpcklwd xmm7, xmm1
punpckhwd xmm4, xmm1
paddd xmm7, xmm0
paddd xmm4, xmm0
movdqa xmm1, xmm7
movdqa xmm6, xmm4
pxor xmm1, xmm2
pxor xmm6, xmm2
pcmpgtd xmm5, xmm6
movdqa xmm6, xmm3
pcmpgtd xmm6, xmm1
pxor xmm1, xmm1
psubd xmm1, xmm7
pand xmm7, xmm6
psrad xmm1, 0x1f
psrld xmm1, 0x17
pandn xmm6, xmm1
pxor xmm1, xmm1
psubd xmm1, xmm4
pand xmm4, xmm5
por xmm6, xmm7
psrad xmm1, 0x1f
pslld xmm6, 0x10
psrld xmm1, 0x17
psrad xmm6, 0x10
pandn xmm5, xmm1
por xmm5, xmm4
pslld xmm5, 0x10
psrad xmm5, 0x10
packssdw xmm6, xmm5
movdqu xmmword [eax + esi + 0x10], xmm6
add esi, 0x10
jne 0x100de7df
inc edx
add eax, ecx
cmp edx, 8
jne 0x100de7da
pop esi
ret

Function at 0x100df3a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 8]
movdqa xmm2, xmmword [0x10187140]
movdqa xmm3, xmmword [0x101aeb40]
pxor xmm1, xmm1
mov esi, dword [edx]
mov dword [edx], 0
and ecx, 0xfffffffe
xor edx, edx
add esi, 0x20
sar esi, 6
movd xmm0, esi
pshufd xmm0, xmm0, 0
mov esi, 0xfffffff8
movq xmm4, qword [eax + esi + 8]
movdqa xmm6, xmm3
punpcklwd xmm4, xmm1
paddd xmm4, xmm0
movdqa xmm5, xmm4
pxor xmm5, xmm2
pcmpgtd xmm6, xmm5
pxor xmm5, xmm5
psubd xmm5, xmm4
pand xmm4, xmm6
psrad xmm5, 0x1f
psrld xmm5, 0x16
pandn xmm6, xmm5
por xmm6, xmm4
pshuflw xmm4, xmm6, 0xe8
pshufhw xmm4, xmm4, 0xe8
pshufd xmm4, xmm4, 0xe8
movq qword [eax + esi + 8], xmm4
add esi, 8
jne 0x100df3e2
inc edx
add eax, ecx
cmp edx, 4
jne 0x100df3dd
pop esi
ret