joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003d6f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 8
push esi
mov esi, eax
shl esi, 4
add esi, dword [ecx + 0x94]
cmp eax, dword [ebp + 0x18]
jge 0x1003d7b0
push ebx
push edi
mov eax, dword [esi + 0xc]
mov edi, dword [ebp + 0xc]
shr eax, 0x1f
xor al, 1
mov dx, word [esi + 4]
mov dword [ebp - 4], eax
movzx eax, word [edi + 2]
cmp word [esi + 8], ax
movzx eax, word [edi + 4]
sbb ecx, ecx
mov bx, word [esi + 6]
inc ecx
cmp word [esi + 0xa], ax
sbb eax, eax
xor edi, edi
inc eax
and ecx, eax
mov eax, dword [ebp + 0x10]
cmp word [eax + 4], dx
movzx eax, word [eax + 2]
cmovae edi, ecx
cmp ax, word [esi + 2]
sbb eax, eax
xor ecx, ecx
inc eax
and edi, eax
mov eax, dword [ebp + 0xc]
cmp word [eax], bx
mov eax, dword [ebp + 0x10]
cmovbe ecx, edi
movzx eax, word [eax]
cmp ax, word [esi]
sbb eax, eax
inc eax
and ecx, eax
neg ecx
and ecx, 0x80000000
cmp byte [ebp - 4], 0
je 0x1003d7b7
test ecx, ecx
je 0x1003d79b
mov ecx, dword [esi + 0xc]
mov eax, ecx
mov ebx, dword [ebp + 8]
and eax, 0x7ffffff
sar ecx, 0x1b
push eax
push ecx
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 4]
mov eax, dword [ebp + 0x14]
add esi, 0x10
inc eax
mov dword [ebp + 0x14], eax
cmp eax, dword [ebp + 0x18]
jl 0x1003d710
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x14
test ecx, ecx
jne 0x1003d79b
mov ecx, dword [esi + 0xc]
neg ecx
mov eax, ecx
shl eax, 4
add esi, eax
mov eax, dword [ebp + 0x14]
add eax, ecx
jmp 0x1003d7a2

Function at 0x10049b30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x10]
test eax, eax
je 0x10049b4a
cmp byte [esi + 0x14], 0
je 0x10049b4a
push eax
call fcn.10076f00
add esp, 4
mov byte [esi + 0x14], 1
mov dword [esi + 0x10], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov eax, dword [esi + 0x24]
test eax, eax
je 0x10049b79
cmp byte [esi + 0x28], 0
je 0x10049b79
push eax
call fcn.10076f00
add esp, 4
mov byte [esi + 0x28], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov eax, dword [esi + 0x38]
test eax, eax
je 0x10049ba8
cmp byte [esi + 0x3c], 0
je 0x10049ba8
push eax
call fcn.10076f00
add esp, 4
mov byte [esi + 0x3c], 1
mov dword [esi + 0x38], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
cmp dword [esi + 0xc], 2
jge 0x10049c24
push ebx
push 0x10
push 0x18
call fcn.10076ef0
mov edx, dword [esi + 8]
add esp, 8
mov ebx, eax
test edx, edx
jle 0x10049bff
xor ecx, ecx
nop
mov eax, dword [esi + 0x10]
lea ecx, [ecx + 0xc]
movq xmm0, qword [eax + ecx - 0xc]
movq qword [ecx + ebx - 0xc], xmm0
mov eax, dword [eax + ecx - 4]
mov dword [ecx + ebx - 4], eax
sub edx, 1
jne 0x10049be0
mov eax, dword [esi + 0x10]
test eax, eax
je 0x10049c15
cmp byte [esi + 0x14], 0
je 0x10049c15
push eax
call fcn.10076f00
add esp, 4
mov dword [esi + 0x10], ebx
mov byte [esi + 0x14], 1
mov dword [esi + 0xc], 2
pop ebx
pop edi
mov ecx, esi
pop esi
jmp fcn.100496c0
Function at 0x1009d931
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1009d970
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1009d970
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1009d970
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1009d970
cmp dword [ecx + 0x74], 0xe
jbe 0x1009d970
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x100a0ca7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100d53e0
push 0x100d53d8
push str.FlsAlloc
push 0x1f
call fcn.100a0bc3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100a0cdb
push dword [ebp + 8]
mov ecx, esi
call dword [0x100b813c]
call esi
jmp 0x100a0ce1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100a0d25
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100d53f0
push 0x100d53e8
push str.FlsGetValue
push 0x21
call fcn.100a0bc3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100a0d5c
push dword [ebp + 8]
mov ecx, esi
call dword [0x100b813c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100a0d64
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100d53f8
push 0x100d53f0
push str.FlsSetValue
push 0x22
call fcn.100a0bc3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100a0d9e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x100b813c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100a2d0e
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100a2dab
push ebx
push esi
call fcn.100a2cd7
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100a2c6b
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100a2d58
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100a2daa
push edi
push eax
call fcn.1009f551
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100a2d78
call fcn.1009f517
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100a2da9
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100a2c6b
add esp, 0x20
test eax, eax
jne 0x100a2d97
push edi
call fcn.1009f517
jmp 0x100a2d9f
push ebx
call fcn.1009f517
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x100aae60
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b708b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x208
mov eax, dword [0x100e3274]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1bc], ecx
mov eax, dword [ebx + 8]
lea ecx, [ebp - 0x1b1]
mov edi, dword [ebx + 0xc]
mov esi, dword [ebx + 0x10]
push str.convexSweepTest
mov dword [ebp - 0x1b8], eax
call fcn.10076f20
movups xmm0, xmmword [edi]
lea eax, [ebp - 0x1c0]
mov dword [ebp - 4], 0
push eax
movups xmmword [ebp - 0x60], xmm0
lea eax, [ebp - 0x1d0]
movups xmm0, xmmword [edi + 0x10]
push eax
lea eax, [ebp - 0xa0]
movups xmmword [ebp - 0x50], xmm0
push eax
movups xmm0, xmmword [edi + 0x20]
lea eax, [ebp - 0x60]
push eax
movups xmmword [ebp - 0x40], xmm0
movups xmm0, xmmword [edi + 0x30]
movups xmmword [ebp - 0x30], xmm0
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0xa0], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [ebp - 0x90], xmm0
movups xmm0, xmmword [esi + 0x20]
movups xmmword [ebp - 0x80], xmm0
movups xmm0, xmmword [esi + 0x30]
movups xmmword [ebp - 0x70], xmm0
call fcn.10066c50
movss xmm1, dword [ebp - 0x1c0]
lea ecx, [ebp - 0xe0]
movss xmm0, dword [ebp - 0x1d0]
add esp, 0x10
mulss xmm0, xmm1
mov dword [ebp - 0x1d4], 0
movss dword [ebp - 0x1e0], xmm0
movss xmm0, dword [ebp - 0x1cc]
mulss xmm0, xmm1
movss dword [ebp - 0x1dc], xmm0
movss xmm0, dword [ebp - 0x1c8]
mulss xmm0, xmm1
movss dword [ebp - 0x1d8], xmm0
xorps xmm0, xmm0
movaps xmmword [ebp - 0x1f0], xmm0
call fcn.100016a0
lea eax, [ebp - 0x1d0]
push eax
lea ecx, [ebp - 0x60]
call fcn.10057ec0
lea eax, [ebp - 0x1d0]
push eax
lea ecx, [ebp - 0xe0]
call fcn.1000e400
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x210]
push eax
push ecx
mov ecx, dword [ebp - 0x1b8]
lea eax, [ebp - 0x1e0]
mov dword [esp], 0x3f800000
push eax
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp - 0xe0]
push eax
call fcn.10025500
movss xmm0, dword [ebx + 0x18]
push ecx
movss dword [esp], xmm0
lea ecx, [ebp - 0x1b0]
push dword [ebx + 0x14]
push dword [ebp - 0x1bc]
push esi
push edi
push dword [ebp - 0x1b8]
call fcn.100a9f30
mov eax, dword [ebp - 0x1bc]
lea edx, [ebp - 0x200]
push edx
lea edx, [ebp - 0x210]
mov byte [ebp - 4], 1
push edx
mov ecx, dword [eax + 0x48]
lea edx, [ebp - 0x1b0]
push edx
lea edx, [ebp - 0x70]
push edx
mov eax, dword [ecx]
lea edx, [ebp - 0x30]
push edx
call dword [eax + 0x14]
lea ecx, [ebp - 0x1b1]
mov dword [ebp - 0x1b0], 0x100b8220
call fcn.10076f40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100924f2
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x14
Function at 0x100b45e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100b460d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100b460d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x408919
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop esi
add edx, 0xc660c333
call fcn.00408938
or eax, edx
or eax, edx
xor dword [ebx], esi
inc ebx
or edx, edx
cmp ebx, ecx
jne fcn.00408919
ret
Function at 0x12d23f5
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, 0x5a4d
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
cmp word [esi], ax
jne 0x12d2558
mov ebx, dword [esi + 0x3c]
add ebx, esi
cmp dword [ebx], 0x4550
jne 0x12d2558
mov eax, dword [edi + 0x688]
test eax, eax
je 0x12d2558
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 8]
push ecx
push 0xffffffffffffffff
call eax
test eax, eax
je 0x12d2558
mov eax, 0x1c0
cmp word [ebp - 4], ax
je 0x12d245d
mov eax, 0xaa64
cmp word [ebp - 4], ax
jne 0x12d2558
cmp dword [ebx + 8], 0x27debf2c
jne 0x12d2488
push 0x4b2e8f83
push 0x4b2e8de3
push 0x4b280000
mov edx, esi
mov ecx, edi
call fcn.012d236f
add esp, 0xc
xor eax, eax
jmp 0x12d255d
cmp dword [ebx + 8], 0x88330560
jne 0x12d249d
push 0x4b3fabde
push 0x4b3fa92b
jmp 0x12d2470
cmp dword [ebx + 8], 0xe892dd44
jne 0x12d24b2
push 0x4b406b8e
push 0x4b4068db
jmp 0x12d2470
and dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
push 0
push 1
push ecx
push 0x2bcd03a7
push esi
mov ecx, edi
call fcn.012d2d7d
test eax, eax
js 0x12d255d
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x12d2558
lea eax, [ebx - 0x140]
mov dword [ebp - 0x1c], 0x3f3f3fe8
push 8
lea ecx, [ebp - 0x1c]
mov word [ebp - 0x18], 0x843f
push ecx
mov edx, 0x140
mov byte [ebp - 0x16], 0xc0
mov ecx, eax
mov dword [ebp - 0x24], 0x1b8
mov word [ebp - 0x20], 0x8400
mov byte [ebp - 0x1e], 0xc0
mov dword [ebp - 0x10], eax
call fcn.012d3315
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x12d2528
mov ecx, dword [ebp - 0x10]
mov edx, 0x140
jmp 0x12d2545
push 7
lea eax, [ebp - 0x1c]
mov edx, 0x200
push eax
mov ecx, ebx
call fcn.012d3315
test eax, eax
jne 0x12d2562
mov edx, 0x200
mov ecx, ebx
push 8
lea eax, [ebp - 0x24]
push eax
call fcn.012d3315
test eax, eax
jne 0x12d2481
mov eax, 0xe0010001
pop edi
pop esi
pop ebx
leave
ret
push eax
push dword [ebp - 0x14]
push esi
jmp 0x12d2475

Function at 0x12d319d
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x12d31bb
mov eax, dword [ecx + 0x3c]
cmp eax, 0x400
jg 0x12d31bb
add eax, ecx
cmp dword [eax], 0x4550
je 0x12d31bd
xor eax, eax
ret
Function at 0x12d6570
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov edx, 1
push ebx
push esi
push edi
xor esi, esi
mov eax, edx
mov dword [ebp + esi*4 - 0x808], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x408], esi
movzx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor ecx, edx
movzx edx, cl
cmp esi, 0x100
jl 0x12d6583
mov esi, 1
mov edx, 0x12dda98
nop dword [eax]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movzx ecx, al
lea eax, [esi + esi]
neg ecx
sbb ecx, ecx
add edx, 4
and ecx, 0x1b
xor ecx, eax
movzx esi, cl
cmp edx, 0x12ddac0
jl 0x12d65c0
mov eax, 1
mov byte [0x12db898], 0x63
mov byte [0x12dc9fb], 0
mov dword [ebp - 4], eax
nop dword [eax]
mov ecx, dword [ebp + eax*4 - 0x408]
lea eax, [ebp - 0x40c]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
shr ecx, 7
add eax, eax
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
add eax, eax
shr ecx, 7
or ecx, eax
movzx edx, cl
mov ecx, edx
shr ecx, 7
lea eax, [edx + edx]
or ecx, eax
xor ecx, 0x63
movzx eax, cl
xor eax, edx
xor ebx, eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x12db898], bl
mov byte [ebx + 0x12dc998], al
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x100
jl 0x12d6600
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 8], ebx
movzx edx, byte [esi + 0x12db898]
mov eax, edx
and al, 0x80
movzx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
movzx eax, cl
mov ecx, eax
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, edx
shl ecx, 8
xor ecx, eax
mov dword [esi*4 + 0x12db998], ecx
rol ecx, 8
mov dword [esi*4 + 0x12dbd98], ecx
rol ecx, 8
mov dword [esi*4 + 0x12dc198], ecx
rol ecx, 8
mov dword [esi*4 + 0x12dc598], ecx
movzx ecx, byte [esi + 0x12dc998]
test ecx, ecx
je 0x12d672f
mov ecx, dword [ebp + ecx*4 - 0x408]
mov eax, dword [ebp - 0x3d0]
add eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x3e4]
add eax, ecx
mov edi, dword [ebp + edx*4 - 0x808]
cdq
idiv ebx
mov eax, dword [ebp - 0x3d4]
add eax, ecx
mov ebx, dword [ebp + edx*4 - 0x808]
cdq
idiv dword [ebp - 8]
mov eax, dword [ebp + edx*4 - 0x808]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3dc]
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x808]
jmp 0x12d6738
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 4]
shl eax, 8
xor eax, ebx
mov ebx, 0xff
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x12dca98], eax
rol eax, 8
mov dword [esi*4 + 0x12dce98], eax
rol eax, 8
mov dword [esi*4 + 0x12dd298], eax
rol eax, 8
mov dword [esi*4 + 0x12dd698], eax
inc esi
cmp esi, 0x100
jl 0x12d6675
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x12d6790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
sub esp, 0x18
test al, 0xf
je 0x12d67a6
mov eax, 0xffffffde
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x12d68fa
cmp dword [ebp + 0xc], 0
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0x1c]
push edi
jne 0x12d6842
mov ebx, dword [ebp + 0x18]
lea edx, [ecx + 0xf]
dec eax
mov dword [ebp - 8], edx
mov edi, ecx
shr eax, 4
sub edi, esi
inc eax
mov dword [ebp + 0x10], eax
movups xmm0, xmmword [ebx]
push esi
push ebx
push dword [ebp + 8]
movups xmmword [ebp - 0x18], xmm0
call fcn.012d7ac0
add esp, 0xc
cmp esi, dword [ebp - 8]
ja 0x12d6813
lea eax, [esi + 0xf]
cmp eax, dword [ebp + 0x14]
jb 0x12d6813
mov ecx, esi
mov edx, 0x10
nop
mov al, byte [edi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x12d6800
mov eax, dword [ebp + 0x14]
jmp 0x12d6823
mov eax, dword [ebp + 0x14]
movups xmm0, xmmword [esi]
movups xmm1, xmmword [eax]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
movups xmm0, xmmword [ebp - 0x18]
add esi, 0x10
add ebx, 0x10
sub edi, 0x10
sub dword [ebp + 0x10], 1
movups xmmword [eax], xmm0
jne 0x12d67d6
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0x18]
lea edx, [eax - 1]
mov ebx, ecx
shr edx, 4
sub ebx, edi
mov dword [ebp - 4], esi
inc edx
mov dword [ebp + 0x10], ebx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
nop dword [eax]
lea eax, [edi + 0xf]
cmp esi, eax
ja 0x12d686e
lea eax, [esi + 0xf]
cmp eax, edi
jae 0x12d687c
lea eax, [ecx + 0xf]
cmp esi, eax
ja 0x12d68ad
lea eax, [esi + 0xf]
cmp eax, ecx
jb 0x12d68ad
mov ebx, esi
mov ecx, edi
mov esi, dword [ebp + 0x10]
sub ebx, edi
mov edx, 0x10
nop word [eax + eax]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub edx, 1
jne 0x12d6890
mov esi, dword [ebp - 4]
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
jmp 0x12d68ba
movups xmm1, xmmword [ecx]
movups xmm0, xmmword [edi]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
cmp dword [ebp + 0xc], 1
push esi
push esi
push edx
jne 0x12d68ca
call fcn.012d8050
jmp 0x12d68cf
call fcn.012d7ac0
movups xmm0, xmmword [esi]
mov ecx, dword [ebp + 0x14]
sub ebx, 0x10
mov edx, dword [ebp + 8]
add esi, 0x10
add esp, 0xc
mov dword [ebp + 0x10], ebx
add edi, 0x10
mov dword [ebp - 4], esi
sub dword [ebp - 8], 1
movups xmmword [ecx], xmm0
jne 0x12d6860
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x12d6940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push esi
push edi
push dword [ebp + 0x10]
xor eax, eax
lea edi, [ebp - 0x118]
push dword [ebp + 0xc]
mov ecx, 0x46
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x118]
push eax
lea esi, [edi + 8]
mov dword [edi + 4], esi
call fcn.012d6b40
add esp, 0xc
mov dword [ebp + 8], eax
test eax, eax
jne 0x12d6b34
mov ecx, dword [ebp - 0x118]
mov dword [edi], ecx
shl ecx, 4
add ecx, dword [ebp - 0x114]
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
sub ecx, 0x10
mov dword [esi + 0xc], eax
add esi, 0x10
mov edi, dword [edi]
dec edi
test edi, edi
jle 0x12d6b1b
push ebx
nop dword [eax]
movzx eax, byte [ecx + 3]
dec edi
movzx edx, byte [eax + 0x12db898]
movzx eax, byte [ecx + 2]
mov edx, dword [edx*4 + 0x12dd698]
movzx eax, byte [eax + 0x12db898]
xor edx, dword [eax*4 + 0x12dd298]
movzx eax, byte [ecx + 1]
movzx eax, byte [eax + 0x12db898]
xor edx, dword [eax*4 + 0x12dce98]
movzx eax, byte [ecx]
movzx eax, byte [eax + 0x12db898]
xor edx, dword [eax*4 + 0x12dca98]
mov dword [esi], edx
mov ebx, dword [ecx + 4]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x12db898]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x12dd298]
movzx eax, byte [eax + 0x12db898]
xor edx, dword [eax*4 + 0x12dce98]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x12db898]
xor edx, dword [eax*4 + 0x12dd698]
movzx eax, bl
movzx eax, byte [eax + 0x12db898]
xor edx, dword [eax*4 + 0x12dca98]
mov dword [esi + 4], edx
mov ebx, dword [ecx + 8]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x12db898]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x12dd298]
movzx eax, byte [eax + 0x12db898]
xor edx, dword [eax*4 + 0x12dce98]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x12db898]
xor edx, dword [eax*4 + 0x12dd698]
movzx eax, bl
movzx eax, byte [eax + 0x12db898]
xor edx, dword [eax*4 + 0x12dca98]
mov dword [esi + 8], edx
mov ebx, dword [ecx + 0xc]
mov eax, ebx
shr eax, 0x10
sub ecx, 0x10
movzx eax, al
movzx edx, byte [eax + 0x12db898]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x12dd298]
movzx eax, byte [eax + 0x12db898]
xor edx, dword [eax*4 + 0x12dce98]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x12db898]
xor edx, dword [eax*4 + 0x12dd698]
movzx eax, bl
movzx eax, byte [eax + 0x12db898]
xor edx, dword [eax*4 + 0x12dca98]
mov dword [esi + 0xc], edx
add esi, 0x10
test edi, edi
jg 0x12d69c0
pop ebx
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret