joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1015a560
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.1015a4b0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1015a5b8
push dword [ebp + 8]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [0x10261f34]
cmp esi, eax
je 0x1015a5a1
cmp esi, dword [0x10261f30]
je 0x1015a5a1
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x10261f34]
cmp byte [ebp + 0x10], 0
je 0x1015a5b8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x10261f34], 0
xor eax, eax
test esi, esi
pop esi
setne al
pop ebp
ret
Function at 0x1015ab60
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0
push 0
push 0x2001f
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push connect
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call fcn.1004488d
mov esi, dword [ebp - 0xc]
test eax, eax
je 0x1015aba7
xor bl, bl
jmp 0x1015abee
mov edx, dword [ebp + 8]
test edx, edx
jne 0x1015abb3
lea eax, [edx + 0xd]
jmp 0x1015abe9
mov ecx, edx
push edi
lea edi, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1015abc0
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x1021e338
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
test eax, eax
sete bl
test esi, esi
je 0x1015abf9
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1015c0e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
test eax, eax
je 0x1015c1ea
push 0x102028b8
push eax
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
call fcn.10181727
mov eax, dword [ebp + 8]
add esp, 0xc
test eax, eax
je 0x1015c1ea
mov ecx, dword [edi + 0x44c]
test ecx, ecx
je 0x1015c135
push ecx
call fcn.10178445
mov eax, dword [ebp + 8]
add esp, 4
mov dword [edi + 0x44c], 0
push eax
push 0xe
lea eax, [edi + 4]
push 1
push eax
call fcn.10180a84
push dword [ebp + 8]
lea eax, [edi + 0x14]
push 0x28
push 1
push eax
call fcn.10180a84
movzx edx, word [edi + 0x22]
add esp, 0x20
mov ecx, dword [edi + 0x18]
mov eax, edx
shr eax, 3
imul ecx, eax
mov dword [edi + 0x444], eax
mov dword [edi + 0x440], ecx
test cl, 3
je 0x1015c182
inc ecx
test cl, 3
jne 0x1015c176
mov dword [edi + 0x440], ecx
cmp edx, 8
jb 0x1015c1df
jne 0x1015c1ab
mov eax, dword [edi + 0x34]
mov ecx, 0x100
push dword [ebp + 8]
test eax, eax
push 4
cmove eax, ecx
push eax
mov dword [edi + 0x3c], eax
lea eax, [edi + 0x40]
push eax
call fcn.10180a84
add esp, 0x10
push esi
mov esi, dword [edi + 0x1c]
imul esi, dword [edi + 0x440]
push esi
mov dword [edi + 0x448], esi
call fcn.1017e1a4
push dword [ebp + 8]
mov dword [edi + 0x44c], eax
push 1
push esi
push eax
call fcn.10180a84
add esp, 0x14
mov ecx, edi
call fcn.1015c1f0
pop esi
push dword [ebp + 8]
call fcn.10179bf7
add esp, 4
pop edi
pop ebp
ret 4

Function at 0x1015d3d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x1015d427
push esi
push 0
push 0
push edi
push 0x1015d3a0
push 0
push 0
mov byte [edi + 8], 0
call fcn.101797d8
mov esi, eax
add esp, 0x18
lea eax, [ebp - 4]
cmp edi, eax
je 0x1015d41b
mov eax, dword [edi]
test eax, eax
je 0x1015d413
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
mov dword [edi], esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x1015d426
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x101620e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
dec eax
cmp eax, 8
ja case.default.0x101620f0
jmp dword [eax*4 + 0x1016219c]
mov eax, dword [ebp + 0xc]
push 0
push dword [ebp + 0x10]
push eax
push eax
call fcn.10167d90
add esp, 0x10
pop ebp
ret
add dword [ebp + 0x10], 0xf4
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.10165f90
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.101694f0
add esp, 0xc
pop ebp
ret
mov eax, dword [ebp + 0xc]
push 0
push dword [ebp + 0x10]
push eax
push eax
call fcn.10169260
add esp, 0x10
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.1016bfb0
push esi
push 0
push 9
call fcn.101611c0
mov esi, dword [ebp + 0x10]
add esp, 4
lea eax, [esi + eax*2]
push eax
push 9
call fcn.101611c0
add esp, 4
add eax, esi
push eax
mov eax, dword [ebp + 0xc]
push esi
push eax
push eax
call fcn.10169310
add esp, 0x18
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
push eax
push eax
push dword [ebp + 0x10]
call fcn.1016da60
add esp, 0xc
pop ebp
ret

Function at 0x10162b50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
dec eax
cmp eax, 8
ja case.default.0x10162b60
jmp dword [eax*4 + 0x10162c04]
mov eax, dword [ebp + 0xc]
push 1
push dword [ebp + 0x10]
push eax
push eax
call fcn.10167d90
add esp, 0x10
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.10166de8
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.101694f0
add esp, 0xc
pop ebp
ret
mov eax, dword [ebp + 0xc]
push 1
push dword [ebp + 0x10]
push eax
push eax
call fcn.10169260
add esp, 0x10
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.1016c720
push esi
push 1
push 9
call fcn.101611c0
mov esi, dword [ebp + 0x10]
add esp, 4
lea eax, [esi + eax*2]
push eax
push 9
call fcn.101611c0
add esp, 4
add eax, esi
push eax
mov eax, dword [ebp + 0xc]
push esi
push eax
push eax
call fcn.10169310
add esp, 0x18
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
push eax
push eax
push dword [ebp + 0x10]
call fcn.1016e310
add esp, 0xc
pop ebp
ret
Function at 0x10163390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x1024bd20]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp + 0xc], eax
jle 0x101634f3
mov ecx, dword [0x1026217c]
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [0x10262174]
push esi
push edi
mov edi, dword [0x10248af0]
lea esp, [esp]
mov al, byte [eax + edx]
xor esi, esi
cmp ecx, 0x140
cmove ecx, esi
mov dword [0x1026217c], ecx
add byte [ebx + ecx], al
mov eax, ecx
and eax, reloc.OLEAUT32.dll_VariantInit
jns 0x101633f5
dec eax
or eax, 0xfffffff8
inc eax
jne 0x101634d3
mov eax, edi
dec eax
jne 0x101634d3
xor esi, esi
mov eax, edi
dec eax
jne 0x1016344d
lea eax, [ebp - 0xa4]
push eax
call fcn.101715c0
push 0x140
push dword [0x10262174]
lea eax, [ebp - 0xa4]
push eax
call fcn.101732c0
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.10171450
mov ebx, dword [0x10262174]
add esp, 0x18
mov edi, dword [0x10248af0]
lea edx, [ebx + esi]
xor eax, eax
lea ecx, [ebx + 0x13]
lea ebx, [ebp - 0x31]
add ecx, esi
cmp edx, ebx
mov ebx, dword [0x10262174]
ja 0x10163471
lea ebx, [ebp - 0x44]
cmp ecx, ebx
mov ebx, dword [0x10262174]
jae 0x10163487
movdqu xmm1, xmmword [edx]
mov eax, 0x10
movdqu xmm0, xmmword [ebp - 0x44]
pxor xmm1, xmm0
movdqu xmmword [edx], xmm1
mov cl, byte [ebp + eax - 0x44]
xor byte [edx + eax], cl
inc eax
cmp eax, 0x14
jl 0x10163487
add esi, 0x14
cmp esi, 0x140
jl 0x10163406
push 0x40
lea eax, [ebp - 0x44]
push 0
push eax
call fcn.10179250
mov eax, edi
add esp, 0xc
dec eax
jne 0x101634ca
push 0x60
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.10179250
add esp, 0xc
mov edx, dword [ebp + 8]
mov ecx, dword [0x1026217c]
mov eax, dword [ebp - 0xa8]
inc ecx
inc eax
mov dword [0x1026217c], ecx
mov dword [ebp - 0xa8], eax
cmp eax, dword [ebp + 0xc]
jl 0x101633d0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1017868e
mov esp, ebp
pop ebp
ret
Function at 0x10163510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x1024bd20]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [0x10248af0]
mov eax, edi
dec eax
je 0x10163540
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1017868e
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [0x10262174]
push esi
xor esi, esi
lea ebx, [ebx]
mov eax, edi
dec eax
jne 0x10163591
lea eax, [ebp - 0xa4]
push eax
call fcn.101715c0
push 0x140
push dword [0x10262174]
lea eax, [ebp - 0xa4]
push eax
call fcn.101732c0
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.10171450
mov ebx, dword [0x10262174]
add esp, 0x18
lea ecx, [esi + 0x13]
xor eax, eax
lea edi, [ebp - 0x31]
add ecx, ebx
lea edx, [ebx + esi]
cmp edx, edi
mov edi, dword [0x10248af0]
ja 0x101635c0
lea ebx, [ebp - 0x44]
cmp ecx, ebx
mov ebx, dword [0x10262174]
jae 0x101635d6
jmp 0x101635c0
movdqu xmm1, xmmword [edx]
mov eax, 0x10
movdqu xmm0, xmmword [ebp - 0x44]
pxor xmm1, xmm0
movdqu xmmword [edx], xmm1
mov cl, byte [ebp + eax - 0x44]
xor byte [edx + eax], cl
inc eax
cmp eax, 0x14
jl 0x101635d6
add esi, 0x14
cmp esi, 0x140
jl 0x10163550
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.1017868e
mov esp, ebp
pop ebp
ret
Function at 0x10167ca0
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x1048
push 0x10248af8
push esi
call fcn.10178c00
mov ecx, dword [ebp + 0xc]
mov eax, 0x48
mov edi, dword [ebp + 0x10]
add esp, 0xc
cmp ecx, eax
mov dword [ebp + 8], 0
cmovg ecx, eax
mov eax, edi
lea ebx, [ecx + edi]
jmp 0x10167ce0
movzx edx, byte [eax]
inc eax
cmp eax, ebx
cmovae eax, edi
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
cmp eax, ebx
cmovae eax, edi
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
cmp eax, ebx
cmovae eax, edi
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
mov ecx, dword [ebp + 8]
cmp eax, ebx
cmovae eax, edi
xor dword [esi + ecx*4], edx
inc ecx
mov dword [ebp + 8], ecx
cmp ecx, 0x12
jl 0x10167ce0
mov dword [ebp - 8], 0
xor edi, edi
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push esi
push eax
call fcn.101737b0
mov eax, dword [ebp - 8]
add esp, 8
mov dword [esi + edi*4], eax
mov eax, dword [ebp - 4]
mov dword [esi + edi*4 + 4], eax
add edi, 2
cmp edi, 0x12
jl 0x10167d32
xor edi, edi
lea eax, [ebp - 8]
push esi
push eax
call fcn.101737b0
mov eax, dword [ebp - 8]
add esp, 8
mov dword [esi + edi*4 + 0x48], eax
mov eax, dword [ebp - 4]
mov dword [esi + edi*4 + 0x4c], eax
add edi, 2
cmp edi, 0x400
jl 0x10167d56
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1016d4f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor eax, eax
push edi
movzx ebx, byte [eax + 0x102645a0]
mov edx, ebx
mov esi, ebx
shr esi, 1
and edx, 3
xor esi, ebx
mov ecx, ebx
shr ecx, 2
shr esi, 1
movzx edi, byte [edx + 0x1024bc28]
xor edi, ecx
movzx ecx, byte [edx + 0x1024bc2c]
xor esi, ecx
xor edi, ebx
xor esi, ebx
imul ecx, esi, 0x10100
add ecx, edi
shl ecx, 8
add ecx, ebx
shl ebx, 0x10
mov dword [eax*4 + 0x102634a0], ecx
imul ecx, esi, 0x1000100
add ecx, edi
add ebx, ecx
mov dword [eax*4 + 0x10263ca0], ebx
movzx ebx, byte [eax + 0x102644a0]
mov edx, ebx
mov esi, ebx
and edx, 3
shr esi, 1
xor esi, ebx
mov ecx, ebx
shr ecx, 2
shr esi, 1
movzx edi, byte [edx + 0x1024bc28]
xor edi, ecx
movzx ecx, byte [edx + 0x1024bc2c]
xor esi, ecx
xor edi, ebx
xor esi, ebx
mov edx, ebx
imul ecx, esi, 0x101
shl edx, 8
add edx, edi
shl esi, 8
shl edx, 0x10
add esi, ebx
shl esi, 8
add edx, ecx
imul ecx, edi, 0x1000001
mov dword [eax*4 + 0x102638a0], edx
add esi, ecx
mov dword [eax*4 + 0x102640a0], esi
inc eax
cmp eax, 0x100
jb 0x1016d4f5
pop edi
pop esi
pop ebx
ret

Function at 0x1016d5c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor eax, eax
push edi
lea esp, [esp]
mov cl, al
mov bh, al
shr cl, 4
and bh, 0xf
movzx edx, cl
mov byte [ebp - 1], cl
mov ecx, edx
movzx esi, bh
xor ecx, esi
movzx edx, byte [edx + 0x1024bc40]
mov bl, byte [ecx + 0x1024bc50]
movzx ecx, byte [esi + 0x1024bc30]
xor edx, ecx
movzx edi, bl
movzx esi, byte [edx + 0x1024bc70]
movzx edx, byte [edi + 0x1024bc40]
xor edi, esi
movzx ecx, byte [esi + 0x1024bc30]
xor edx, ecx
movzx esi, bh
movzx ecx, byte [edx + 0x1024bcb0]
movzx edx, byte [ebp - 1]
shl cl, 4
or cl, byte [edi + 0x1024bc90]
mov byte [eax + 0x102644a0], cl
mov ecx, edx
movzx edx, byte [edx + 0x1024bc40]
xor ecx, esi
mov bl, byte [ecx + 0x1024bc60]
movzx ecx, byte [esi + 0x1024bc30]
xor edx, ecx
movzx edi, bl
movzx esi, byte [edx + 0x1024bc80]
movzx edx, byte [edi + 0x1024bc40]
xor edi, esi
movzx ecx, byte [esi + 0x1024bc30]
xor edx, ecx
movzx ecx, byte [edx + 0x1024bcc0]
shl cl, 4
or cl, byte [edi + 0x1024bca0]
mov byte [eax + 0x102645a0], cl
inc eax
cmp eax, 0x100
jb 0x1016d5d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1016f3f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x1000
push 0
push ebx
call fcn.10179250
add esp, 0xc
xor eax, eax
mov dword [ebp - 4], eax
test eax, eax
jne 0x1016f4a9
mov ecx, dword [ebp + 8]
mov esi, 4
mov eax, dword [ecx]
mov dword [ebx + 0x180], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 0x184], eax
lea edx, [esi + 0x10]
shl edx, 4
lea ecx, [esi + 8]
add edx, ebx
shl ecx, 5
push edx
mov eax, dword [ecx + ebx]
mov dword [edx], eax
mov eax, dword [ecx + ebx + 4]
mov dword [edx + 4], eax
call fcn.1016f840
sar esi, 1
add esp, 4
test esi, esi
jg 0x1016f432
mov eax, dword [ebx + 0x110]
lea ecx, [ebx + 0x80]
mov dword [ecx], eax
mov eax, dword [ebx + 0x114]
push ecx
mov dword [ecx + 4], eax
call fcn.1016f840
add esp, 4
mov esi, 4
mov edx, esi
mov ecx, esi
shl edx, 4
add edx, ebx
shl ecx, 5
push edx
mov eax, dword [ecx + ebx]
mov dword [edx], eax
mov eax, dword [ecx + ebx + 4]
mov dword [edx + 4], eax
call fcn.1016f840
sar esi, 1
add esp, 4
test esi, esi
jg 0x1016f480
jmp 0x1016f514
cmp eax, 1
jle 0x1016f517
lea edx, [eax - 2]
mov ecx, 8
shl edx, 4
shl eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
lea edi, [ecx + eax]
add ecx, edx
add ecx, ecx
shl edi, 4
add edi, ebx
mov eax, dword [ebx + ecx*8]
mov dword [edi], eax
mov eax, dword [ebx + ecx*8 + 4]
mov ecx, eax
mov dword [edi + 4], eax
mov edx, ecx
mov esi, dword [edi]
mov eax, esi
shr eax, 0x18
shl ecx, 8
or eax, ecx
shr edx, 0x18
mov ecx, dword [ebp - 8]
mov dword [edi + 4], eax
shl esi, 8
movzx eax, word [edx*2 + 0x10203618]
mov edx, dword [ebp - 0xc]
xor eax, esi
sar ecx, 1
mov dword [edi], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
test ecx, ecx
jg 0x1016f4c5
mov eax, dword [ebp - 4]
mov ecx, eax
mov edi, 2
shl eax, 8
shl ecx, 4
add eax, 0x10
add eax, ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
nop
lea edx, [ecx + edi]
shl edx, 4
add edx, ebx
cmp edi, 1
jle 0x1016f581
mov ecx, edi
lea esi, [eax + 8]
shl ecx, 4
lea ebx, [edi - 1]
add esi, ecx
lea ebx, [ebx]
mov ecx, dword [eax]
lea eax, [eax + 0x10]
xor ecx, dword [edx]
lea esi, [esi + 0x10]
mov dword [esi - 0x18], ecx
mov ecx, dword [eax - 0xc]
xor ecx, dword [edx + 4]
mov dword [esi - 0x14], ecx
mov ecx, dword [eax - 8]
xor ecx, dword [edx + 8]
mov dword [esi - 0x10], ecx
mov ecx, dword [eax - 4]
xor ecx, dword [edx + 0xc]
mov dword [esi - 0xc], ecx
dec ebx
jne 0x1016f550
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add edi, edi
cmp edi, 0x10
jl 0x1016f530
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x10
jl 0x1016f411
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1016f5b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x2000
push 0
push ebx
call fcn.10179250
add esp, 0xc
xor eax, eax
mov dword [ebp - 4], eax
test eax, eax
jne 0x1016f65f
mov eax, dword [ebp + 8]
mov esi, 4
movdqu xmm0, xmmword [eax]
movdqu xmmword [ebx + 0x180], xmm0
lea ecx, [ecx]
lea eax, [esi + 8]
shl eax, 5
lea ecx, [esi + 0x10]
shl ecx, 4
add ecx, ebx
push ecx
movdqu xmm0, xmmword [eax + ebx]
movdqu xmmword [ecx], xmm0
call fcn.1016f790
sar esi, 1
add esp, 4
test esi, esi
jg 0x1016f5f0
movdqu xmm0, xmmword [ebx + 0x110]
lea eax, [ebx + 0x80]
push eax
movdqu xmmword [eax], xmm0
call fcn.1016f790
add esp, 4
mov esi, 4
mov eax, esi
mov ecx, esi
shl eax, 5
shl ecx, 4
add ecx, ebx
push ecx
movdqu xmm0, xmmword [eax + ebx]
movdqu xmmword [ecx], xmm0
call fcn.1016f790
sar esi, 1
add esp, 4
test esi, esi
jg 0x1016f636
jmp 0x1016f6f3
cmp eax, 1
jle 0x1016f6f6
lea edx, [eax - 2]
mov ecx, 8
shl edx, 4
shl eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
nop
add eax, ecx
shl eax, 4
add ebx, eax
lea eax, [edx + ecx]
shl eax, 4
add eax, dword [ebp + 0xc]
movdqu xmm0, xmmword [eax]
movdqu xmmword [ebx], xmm0
mov esi, dword [ebx + 8]
mov eax, esi
mov ecx, dword [ebx + 0xc]
mov edi, ecx
mov edx, dword [ebx + 4]
shr eax, 0x18
shl ecx, 8
or eax, ecx
shl esi, 8
mov ecx, dword [ebx]
mov dword [ebx + 0xc], eax
mov eax, edx
shr eax, 0x18
or eax, esi
shl edx, 8
mov dword [ebx + 8], eax
mov eax, ecx
shr eax, 0x18
or eax, edx
shr edi, 0x18
mov edx, dword [ebp - 0xc]
mov dword [ebx + 4], eax
shl ecx, 8
movzx eax, word [edi*2 + 0x10203a18]
xor eax, ecx
mov ecx, dword [ebp - 8]
sar ecx, 1
mov dword [ebx], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
test ecx, ecx
jg 0x1016f680
mov eax, dword [ebp - 4]
mov ecx, eax
mov edi, 2
shl eax, 8
shl ecx, 4
add eax, 0x10
add eax, ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
mov edi, edi
lea esi, [ecx + edi]
shl esi, 4
add esi, ebx
cmp edi, 1
jle 0x1016f761
mov ecx, edi
lea edx, [eax + 8]
shl ecx, 4
lea ebx, [edi - 1]
add edx, ecx
lea ebx, [ebx]
mov ecx, dword [eax]
lea eax, [eax + 0x10]
xor ecx, dword [esi]
lea edx, [edx + 0x10]
mov dword [edx - 0x18], ecx
mov ecx, dword [eax - 0xc]
xor ecx, dword [esi + 4]
mov dword [edx - 0x14], ecx
mov ecx, dword [eax - 8]
xor ecx, dword [esi + 8]
mov dword [edx - 0x10], ecx
mov ecx, dword [eax - 4]
xor ecx, dword [esi + 0xc]
mov dword [edx - 0xc], ecx
dec ebx
jne 0x1016f730
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add edi, edi
cmp edi, 0x10
jl 0x1016f710
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x20
jl 0x1016f5d1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10170950
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov eax, dword [0x1024bd20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x16c], eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x168], edi
cmp esi, 0x40
jle 0x101709c7
lea eax, [ebp - 0x160]
push eax
call fcn.101715c0
push esi
lea eax, [ebp - 0x160]
push edi
push eax
call fcn.101732c0
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.10171450
lea edi, [ebp - 0x18]
mov esi, 0x14
add esp, 0x18
mov dword [ebp - 0x168], edi
mov dword [ebp + 0xc], esi
push 0x41
lea eax, [ebp - 0x5c]
push 0x36
push eax
call fcn.10179250
push 0x41
lea eax, [ebp - 0xa0]
push 0x5c
push eax
call fcn.10179250
add esp, 0x18
xor ecx, ecx
test esi, esi
jle 0x10170ab7
cmp esi, 0x10
jb 0x10170a87
lea eax, [edi - 1]
add eax, esi
lea ebx, [ebp - 0xa0]
lea edx, [ebp + esi - 0xa1]
cmp ebx, eax
ja 0x10170a14
cmp edx, edi
jae 0x10170a87
lea ebx, [ebp - 0x5c]
lea edx, [ebp + esi - 0x5d]
cmp ebx, eax
ja 0x10170a23
cmp edx, edi
jae 0x10170a87
mov eax, esi
and eax, 0x8000000f
jns 0x10170a31
dec eax
or eax, 0xfffffff0
inc eax
mov edx, esi
lea ebx, [ebp - 0x5c]
sub edx, eax
lea esi, [ebp - 0xa0]
sub ebx, edi
mov eax, edi
sub esi, edi
mov dword [ebp - 0x164], esi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp - 0x164]
movdqu xmm1, xmmword [eax]
add ecx, 0x10
lea eax, [eax + 0x10]
movdqu xmm0, xmmword [ebx + eax - 0x10]
pxor xmm0, xmm1
movdqu xmmword [ebx + eax - 0x10], xmm0
movdqu xmm0, xmmword [edi + eax - 0x10]
pxor xmm0, xmm1
movdqu xmmword [edi + eax - 0x10], xmm0
cmp ecx, edx
jl 0x10170a53
mov edi, dword [ebp - 0x168]
cmp ecx, esi
jge 0x10170ab7
lea eax, [ebp - 0xa0]
sub eax, edi
lea ebx, [ebp - 0x5c]
sub ebx, edi
mov dword [ebp - 0x164], eax
lea edx, [edi + ecx]
sub esi, ecx
mov edi, eax
mov cl, byte [edx]
lea eax, [edx + ebx]
xor byte [eax], cl
lea eax, [edx + edi]
xor byte [eax], cl
lea edx, [edx + 1]
dec esi
jne 0x10170aa5
lea eax, [ebp - 0x100]
push eax
call fcn.101715c0
push 0x40
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.101732c0
push dword [ebp + 0x14]
lea eax, [ebp - 0x100]
push dword [ebp - 0x170]
push eax
call fcn.101732c0
mov ebx, dword [ebp - 0x16c]
lea eax, [ebp - 0x100]
push eax
push ebx
call fcn.10171450
lea eax, [ebp - 0x100]
push eax
call fcn.101715c0
push 0x40
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.101732c0
push 0x14
lea eax, [ebp - 0x100]
push ebx
push eax
call fcn.101732c0
add esp, 0x40
lea eax, [ebp - 0x100]
push eax
push ebx
call fcn.10171450
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.1017868e
mov esp, ebp
pop ebp
ret