joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x103c4120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, 0x100
mov ecx, dword [ebp + 8]
push ebx
push esi
movzx eax, ax
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x3c], edi
cmp ax, dx
jae 0x10010706
mov esi, eax
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x34], xmm0
movdqu xmmword [ebp - 0x24], xmm0
lea eax, [esi + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
push ecx
lea eax, [ebp - 0x34]
push eax
call fcn.101c6b90
mov eax, esi
lea edx, [ebp - 0x34]
shr eax, 3
add esp, 0xc
add edx, eax
and esi, 0x80000007
jns 0x100106fc
dec esi
or esi, 0xfffffff8
inc esi
mov al, 1
mov ecx, esi
shl al, cl
or byte [edx], al
jmp 0x10010719
movdqu xmm0, xmmword [ecx]
movdqu xmmword [ebp - 0x34], xmm0
movdqu xmm0, xmmword [ecx + 0x10]
movdqu xmmword [ebp - 0x24], xmm0
mov ecx, dword [ebp - 0x18]
xor bl, bl
mov esi, edi
mov edi, 4
movzx eax, bl
xor eax, dword [ebp - 0x34]
xor eax, dword [ebp - 0x28]
xor eax, dword [ebp - 0x20]
xor eax, ecx
xor eax, 0x9e3779b9
rol eax, 0xb
mov dword [esi], eax
lea eax, [ebp - 0x30]
push 0x1c
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.101c72a0
mov ecx, dword [esi]
add esp, 0xc
inc bl
mov dword [ebp - 0x18], ecx
add esi, 4
dec edi
jne 0x10010725
cmp bl, 0x84
jb 0x10010720
mov ebx, dword [ebp - 0x3c]
lea eax, [ebp - 0x14]
xor cl, cl
sub ebx, eax
mov byte [ebp - 0x35], cl
mov edi, edi
mov eax, 3
lea esi, [ebp - 0x14]
sub al, cl
mov edi, 4
and eax, 7
mov ecx, dword [eax*4 + 0x1029e8b0]
mov dword [ebp - 0x40], ecx
lea esp, [esp]
lea eax, [ebx + esi]
push eax
push esi
call ecx
mov ecx, dword [ebp - 0x40]
add esp, 8
inc esi
dec edi
jne 0x10010790
mov eax, dword [ebp - 0x3c]
add ebx, 0x10
movdqu xmm0, xmmword [ebp - 0x14]
mov cl, byte [ebp - 0x35]
inc cl
movdqu xmmword [eax], xmm0
add eax, 0x10
mov byte [ebp - 0x35], cl
mov dword [ebp - 0x3c], eax
cmp cl, 0x21
jb 0x10010770
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret

Function at 0x10010840
Capabilities:
Encode data using xor
Encrypt data using skipjack

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x103c4120]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
sub edi, eax
nop
lea ecx, [ebp - 0x10]
add ecx, esi
inc esi
mov al, byte [edi + ecx]
neg al
mov byte [ecx], al
cmp esi, 0xa
jl 0x10010860
xor esi, esi
movzx edi, byte [ebp + esi - 0x10]
xor eax, eax
jmp 0x10010880
mov ecx, edi
xor ecx, eax
mov cl, byte [ecx + 0x101e09c0]
mov byte [edx + eax], cl
inc eax
cmp eax, 0x100
jl 0x10010880
inc esi
add edx, 0x100
cmp esi, 0xa
jl 0x10010874
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret
Function at 0x10011bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
movdqu xmm0, xmmword [eax]
push esi
push eax
lea eax, [edi + 0x28]
push eax
movdqu xmmword [edi + 8], xmm0
call fcn.10011f20
lea eax, [esi + 1]
add esp, 0xc
lea edx, [edi + 0x19]
mov esi, 4
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 4]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 2]
xor byte [eax - 2], cl
dec esi
jne 0x10011be0
movdqu xmm0, xmmword [edi + 8]
movdqu xmmword [edi + 0x18], xmm0
pop edi
pop esi
pop ebp
ret
Function at 0x10012180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [0x103c4120]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
movzx ecx, byte [edx]
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
mov edi, dword [ebp + 8]
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 5]
mov dword [ebp - 0xa8], ecx
movzx ecx, byte [edx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
mov dword [ebp - 0xa4], ecx
movzx ecx, byte [edx + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
mov dword [ebp - 0xa0], ecx
movzx ecx, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xf]
shl ecx, 8
or ecx, eax
mov eax, 0x101e0c10
mov dword [ebp - 0x9c], ecx
xor esi, esi
movdqu xmm0, xmmword [ebp - 0xa8]
movdqu xmm1, xmmword [eax]
pxor xmm1, xmm0
movdqu xmmword [ebp - 0x94], xmm1
mov edi, edi
mov ecx, dword [esi + 0x101e0c20]
xor ecx, dword [ebp + esi - 0x90]
xor ecx, dword [ebp + esi - 0x8c]
xor ecx, dword [ebp + esi - 0x88]
mov eax, ecx
mov dword [ebp - 0x98], ecx
shr eax, 0x18
mov ebx, ecx
shr ebx, 0x10
shr ecx, 8
mov dl, byte [eax + 0x101e0b10]
movzx eax, bl
movzx edx, dl
shl edx, 8
mov bl, byte [eax + 0x101e0b10]
movzx eax, cl
mov cl, byte [eax + 0x101e0b10]
mov eax, dword [ebp - 0x98]
movzx eax, al
mov ch, byte [eax + 0x101e0b10]
movzx eax, bl
or edx, eax
movzx eax, cl
shl edx, 8
or edx, eax
movzx eax, ch
shl edx, 8
or edx, eax
mov ecx, edx
mov eax, edx
rol ecx, 0xd
ror eax, 9
xor ecx, eax
xor ecx, dword [ebp + esi - 0x94]
xor ecx, edx
mov dword [ebp + esi - 0x84], ecx
mov dword [esi + edi], ecx
add esi, 4
cmp esi, 0x80
jb 0x10012250
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret

Function at 0x10012720
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov edx, dword [esi]
xor edx, dword [ebp + 0x10]
mov ecx, edx
mov eax, edx
shr ecx, 0x18
and ecx, 0x3f
shr eax, 0x10
and eax, 0x3f
mov ecx, dword [ecx*4 + 0x101e0da0]
xor ecx, dword [eax*4 + 0x101e0fa0]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
xor ecx, dword [eax*4 + 0x101e11a0]
xor ecx, dword [edx*4 + 0x101e13a0]
xor dword [edi], ecx
mov edx, dword [esi]
ror edx, 4
xor edx, dword [ebp + 0x14]
mov ecx, edx
mov eax, edx
shr ecx, 0x18
and ecx, 0x3f
shr eax, 0x10
and eax, 0x3f
mov ecx, dword [ecx*4 + 0x101e0ca0]
xor ecx, dword [eax*4 + 0x101e0ea0]
mov eax, edx
shr eax, 8
and edx, 0x3f
and eax, 0x3f
xor ecx, dword [eax*4 + 0x101e10a0]
xor ecx, dword [edx*4 + 0x101e12a0]
xor dword [edi], ecx
pop edi
pop esi
pop ebp
ret
Function at 0x10013ab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, 0x20
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, ebx
mov edi, eax
rep movsd dword es:[edi], dword [esi]
lea esi, [ebx + 0x80]
test esi, esi
je 0x10013af6
movdqu xmm0, xmmword [esi]
movdqu xmmword [eax + 0x88], xmm0
mov edx, dword [esi + 8]
mov ecx, dword [esi + 0xc]
xor edx, dword [esi]
xor ecx, dword [esi + 4]
mov dword [eax + 0x98], edx
mov dword [eax + 0x9c], ecx
jmp 0x10013b02
xorps xmm0, xmm0
movdqu xmmword [eax], xmm0
movq qword [eax + 0x10], xmm0
mov dword [eax + 0x80], 0xa9fc1a22
mov edx, 0x10
mov dword [eax + 0x84], 0x1bd11bda
jmp 0x10013b20
mov ecx, dword [ebx]
lea ebx, [ebx + 8]
xor dword [eax + 0x80], ecx
mov ecx, dword [ebx - 4]
xor dword [eax + 0x84], ecx
dec edx
jne 0x10013b20
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10013e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
movdqu xmm0, xmmword [esi]
lea edi, [esi + 0x20]
movdqu xmmword [eax], xmm0
movdqu xmm0, xmmword [esi + 0x10]
movdqu xmmword [eax + 0x10], xmm0
test edi, edi
je 0x10013e70
movdqu xmm0, xmmword [edi]
movdqu xmmword [eax + 0x28], xmm0
mov edx, dword [edi + 8]
mov ecx, dword [edi + 0xc]
xor edx, dword [edi]
xor ecx, dword [edi + 4]
mov dword [eax + 0x38], edx
mov dword [eax + 0x3c], ecx
jmp 0x10013e7d
xorps xmm0, xmm0
movdqu xmmword [eax + 0x28], xmm0
movq qword [eax + 0x38], xmm0
mov dword [eax + 0x20], 0xa9fc1a22
mov edx, 4
mov dword [eax + 0x24], 0x1bd11bda
mov ecx, dword [esi]
lea esi, [esi + 8]
xor dword [eax + 0x20], ecx
mov ecx, dword [esi - 4]
xor dword [eax + 0x24], ecx
dec edx
jne 0x10013e90
pop edi
pop esi
pop ebp
ret

Function at 0x10014340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
movdqu xmm0, xmmword [esi]
lea edi, [esi + 0x40]
movdqu xmmword [eax], xmm0
movdqu xmm0, xmmword [esi + 0x10]
movdqu xmmword [eax + 0x10], xmm0
movdqu xmm0, xmmword [esi + 0x20]
movdqu xmmword [eax + 0x20], xmm0
movdqu xmm0, xmmword [esi + 0x30]
movdqu xmmword [eax + 0x30], xmm0
test edi, edi
je 0x10014394
movdqu xmm0, xmmword [edi]
movdqu xmmword [eax + 0x48], xmm0
mov edx, dword [edi + 8]
mov ecx, dword [edi + 0xc]
xor edx, dword [edi]
xor ecx, dword [edi + 4]
mov dword [eax + 0x58], edx
mov dword [eax + 0x5c], ecx
jmp 0x100143a1
xorps xmm0, xmm0
movdqu xmmword [eax + 0x48], xmm0
movq qword [eax + 0x58], xmm0
mov dword [eax + 0x40], 0xa9fc1a22
mov edx, 8
mov dword [eax + 0x44], 0x1bd11bda
mov ecx, dword [esi]
lea esi, [esi + 8]
xor dword [eax + 0x40], ecx
mov ecx, dword [esi - 4]
xor dword [eax + 0x44], ecx
dec edx
jne 0x100143b4
pop edi
pop esi
pop ebp
ret
Function at 0x1002db90
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c8
mov eax, dword [0x103c4120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x3fc
mov dword [ebp - 0x4c8], eax
lea eax, [ebp - 0x4c0]
push 0
push eax
mov dword [ebp - 0x4c4], 0
call fcn.101c6a70
add esp, 0xc
xor ecx, ecx
movsx eax, byte [ecx + 0x1029fa00]
mov eax, dword [ebx + eax*4 - 4]
mov dword [ebp + ecx*4 - 0x4c4], eax
movsx eax, byte [ecx + 0x1029fa01]
mov eax, dword [ebx + eax*4 - 4]
mov dword [ebp + ecx*4 - 0x4c0], eax
movsx eax, byte [ecx + 0x1029fa02]
mov eax, dword [ebx + eax*4 - 4]
mov dword [ebp + ecx*4 - 0x4bc], eax
movsx eax, byte [ecx + 0x1029fa03]
mov eax, dword [ebx + eax*4 - 4]
mov dword [ebp + ecx*4 - 0x4b8], eax
movsx eax, byte [ecx + 0x1029fa04]
mov eax, dword [ebx + eax*4 - 4]
mov dword [ebp + ecx*4 - 0x4b4], eax
movsx eax, byte [ecx + 0x1029fa05]
mov eax, dword [ebx + eax*4 - 4]
mov dword [ebp + ecx*4 - 0x4b0], eax
add ecx, 6
cmp ecx, 0x30
jl 0x1002dbd4
push 0x30
push dword [ebp - 0x4c8]
lea eax, [ebp - 0xc4]
mov ecx, 0x30
lea esi, [ebp - 0x4c4]
lea edi, [ebp - 0xc4]
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.1002de40
lea eax, [ebp - 0xc4]
push eax
push ebx
call fcn.1002ddc0
push 0x3fc
lea eax, [ebp - 0x4c0]
mov dword [ebp - 0x4c4], 0
push 0
push eax
call fcn.101c6a70
add esp, 0x20
xor eax, eax
mov edi, edi
movsx ecx, byte [eax + 0x1029fca8]
mov ecx, dword [ebx + ecx*4 - 4]
mov dword [ebp + eax*4 - 0x4c4], ecx
movsx ecx, byte [eax + 0x1029fca9]
mov ecx, dword [ebx + ecx*4 - 4]
mov dword [ebp + eax*4 - 0x4c0], ecx
movsx ecx, byte [eax + 0x1029fcaa]
mov ecx, dword [ebx + ecx*4 - 4]
mov dword [ebp + eax*4 - 0x4bc], ecx
movsx ecx, byte [eax + 0x1029fcab]
mov ecx, dword [ebx + ecx*4 - 4]
mov dword [ebp + eax*4 - 0x4b8], ecx
add eax, 4
cmp eax, 0x20
jl 0x1002dca0
mov edi, ebx
lea esi, [ebp - 0x4c4]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret

Function at 0x1002ddc0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
add edi, 8
add eax, 4
mov edx, dword [eax - 4]
lea eax, [eax + 0x18]
mov ecx, dword [eax - 8]
lea edi, [edi + 0x10]
lea esi, [ecx + edx*2]
mov ecx, dword [eax - 0x14]
mov edx, dword [eax - 0x18]
lea edx, [ecx + edx*2]
mov ecx, dword [eax - 0x10]
lea edx, [ecx + edx*2]
mov ecx, dword [eax - 0xc]
lea edx, [ecx + edx*2]
lea ecx, [ebx + esi]
add ebx, 4
shl ecx, 4
lea edx, [edx + 0x1029faa8]
add edx, ecx
movzx ecx, byte [edx]
and ecx, 1
mov dword [edi - 0x18], ecx
movzx ecx, byte [edx]
shr ecx, 1
and ecx, 1
mov dword [edi - 0x14], ecx
movzx ecx, byte [edx]
shr ecx, 2
and ecx, 1
mov dword [edi - 0x10], ecx
movzx ecx, byte [edx]
shr ecx, 3
and ecx, 1
mov dword [edi - 0xc], ecx
cmp ebx, 0x20
jl 0x1002ddd4
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1002de40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
sub esp, 8
xor ecx, ecx
test edx, edx
jle 0x1002def1
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp edx, 8
jb 0x1002ded8
lea eax, [edx - 1]
push ebx
lea eax, [esi + eax*4]
lea ebx, [edx - 1]
lea ebx, [edi + ebx*4]
cmp edi, eax
ja 0x1002de75
cmp ebx, esi
jae 0x1002ded7
mov eax, edx
and eax, 0x80000007
jns 0x1002de83
dec eax
or eax, 0xfffffff8
inc eax
mov ebx, edx
mov edx, esi
sub ebx, eax
sub edx, edi
mov dword [ebp - 4], edx
lea eax, [edi + 0x10]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 8], ebx
mov ebx, esi
mov esi, dword [ebp - 4]
lea esp, [esp]
movdqu xmm0, xmmword [ebx]
add ecx, 8
lea ebx, [ebx + 0x20]
lea eax, [eax + 0x20]
movdqu xmm1, xmmword [eax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x30], xmm1
movdqu xmm1, xmmword [esi + eax - 0x20]
movdqu xmm0, xmmword [eax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x20], xmm1
cmp ecx, dword [ebp - 8]
jl 0x1002dea0
mov esi, dword [ebp + 0xc]
pop ebx
cmp ecx, edx
jge 0x1002deef
sub esi, edi
lea eax, [edi + ecx*4]
sub edx, ecx
mov ecx, dword [eax + esi]
lea eax, [eax + 4]
xor dword [eax - 4], ecx
dec edx
jne 0x1002dee3
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002df60
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x588
mov eax, dword [0x103c4120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0xfc
mov dword [ebp - 0x588], eax
lea eax, [ebp - 0x100]
push 0
push eax
mov dword [ebp - 0x104], 0
call fcn.101c6a70
mov esi, dword [ebp + 0xc]
add esp, 0xc
xor eax, eax
mov ecx, eax
shr ecx, 3
movzx edx, byte [ecx + esi]
movzx ecx, al
and ecx, 7
shr edx, cl
and edx, 1
mov dword [ebp + eax*4 - 0x104], edx
inc eax
cmp eax, 0x40
jl 0x1002dfa7
push 0x3fc
lea eax, [ebp - 0x580]
mov dword [ebp - 0x584], 0
push 0
push eax
call fcn.101c6a70
add esp, 0xc
xor ecx, ecx
lea ebx, [ebx]
movsx eax, byte [ecx + 0x101e18a0]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + ecx*4 - 0x584], eax
movsx eax, byte [ecx + 0x101e18a1]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + ecx*4 - 0x580], eax
movsx eax, byte [ecx + 0x101e18a2]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + ecx*4 - 0x57c], eax
movsx eax, byte [ecx + 0x101e18a3]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + ecx*4 - 0x578], eax
add ecx, 4
cmp ecx, 0x40
jl 0x1002dff0
push dword [ebp - 0x588]
mov ecx, 0x40
lea esi, [ebp - 0x584]
lea edi, [ebp - 0x104]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x104]
mov ecx, 0x20
lea esi, [ebp - 0x104]
lea edi, [ebp - 0x184]
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.1002db90
push 0x20
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.1002de40
push 0x3fc
lea eax, [ebp - 0x580]
mov dword [ebp - 0x584], 0
mov ecx, 0x20
lea esi, [ebp - 0x184]
lea edi, [ebp - 0x84]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.101c6a70
add esp, 0x20
xor edx, edx
mov edi, edi
movsx eax, byte [edx + 0x101e18e0]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + edx*4 - 0x584], eax
movsx eax, byte [edx + 0x101e18e1]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + edx*4 - 0x580], eax
movsx eax, byte [edx + 0x101e18e2]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + edx*4 - 0x57c], eax
movsx eax, byte [edx + 0x101e18e3]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + edx*4 - 0x578], eax
add edx, 4
cmp edx, 0x40
jl 0x1002e0d0
mov ecx, 0x40
lea esi, [ebp - 0x584]
lea edi, [ebp - 0x104]
xorps xmm0, xmm0
rep movsd dword es:[edi], dword [esi]
movq qword [ebx], xmm0
lea edi, [ebp - 0x100]
mov esi, 2
movzx eax, byte [edi - 4]
lea edx, [esi - 2]
shr edx, 3
lea ecx, [esi - 2]
and ecx, 7
lea edi, [edi + 0x10]
shl al, cl
lea ecx, [esi - 1]
and ecx, 7
or byte [edx + ebx], al
lea edx, [esi - 1]
movzx eax, byte [edi - 0x10]
shl al, cl
mov ecx, esi
shr edx, 3
and ecx, 7
or byte [edx + ebx], al
mov edx, esi
movzx eax, byte [edi - 0xc]
shr edx, 3
shl al, cl
lea ecx, [esi + 1]
add esi, 4
or byte [edx + ebx], al
mov edx, ecx
movzx eax, byte [edi - 8]
and ecx, 7
shr edx, 3
shl al, cl
or byte [edx + ebx], al
lea eax, [esi - 2]
cmp eax, 0x40
jl 0x1002e151
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret
Function at 0x1002e1d0
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x588
mov eax, dword [0x103c4120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0xfc
mov dword [ebp - 0x588], eax
lea eax, [ebp - 0x100]
push 0
push eax
mov dword [ebp - 0x104], 0
call fcn.101c6a70
mov esi, dword [ebp + 0xc]
add esp, 0xc
xor eax, eax
mov ecx, eax
shr ecx, 3
movzx edx, byte [ecx + esi]
movzx ecx, al
and ecx, 7
shr edx, cl
and edx, 1
mov dword [ebp + eax*4 - 0x104], edx
inc eax
cmp eax, 0x40
jl 0x1002e217
push 0x3fc
lea eax, [ebp - 0x580]
mov dword [ebp - 0x584], 0
push 0
push eax
call fcn.101c6a70
add esp, 0xc
xor ecx, ecx
lea ebx, [ebx]
movsx eax, byte [ecx + 0x101e18a0]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + ecx*4 - 0x584], eax
movsx eax, byte [ecx + 0x101e18a1]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + ecx*4 - 0x580], eax
movsx eax, byte [ecx + 0x101e18a2]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + ecx*4 - 0x57c], eax
movsx eax, byte [ecx + 0x101e18a3]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + ecx*4 - 0x578], eax
add ecx, 4
cmp ecx, 0x40
jl 0x1002e260
push dword [ebp - 0x588]
mov ecx, 0x40
lea esi, [ebp - 0x584]
lea edi, [ebp - 0x104]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x84]
mov ecx, 0x20
lea esi, [ebp - 0x84]
lea edi, [ebp - 0x184]
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.1002db90
push 0x20
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.1002de40
push 0x3fc
lea eax, [ebp - 0x580]
mov dword [ebp - 0x584], 0
mov ecx, 0x20
lea esi, [ebp - 0x184]
lea edi, [ebp - 0x104]
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.101c6a70
add esp, 0x20
xor edx, edx
mov edi, edi
movsx eax, byte [edx + 0x101e18e0]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + edx*4 - 0x584], eax
movsx eax, byte [edx + 0x101e18e1]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + edx*4 - 0x580], eax
movsx eax, byte [edx + 0x101e18e2]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + edx*4 - 0x57c], eax
movsx eax, byte [edx + 0x101e18e3]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + edx*4 - 0x578], eax
add edx, 4
cmp edx, 0x40
jl 0x1002e340
mov ecx, 0x40
lea esi, [ebp - 0x584]
lea edi, [ebp - 0x104]
xorps xmm0, xmm0
rep movsd dword es:[edi], dword [esi]
movq qword [ebx], xmm0
lea edi, [ebp - 0x100]
mov esi, 2
movzx eax, byte [edi - 4]
lea edx, [esi - 2]
shr edx, 3
lea ecx, [esi - 2]
and ecx, 7
lea edi, [edi + 0x10]
shl al, cl
lea ecx, [esi - 1]
and ecx, 7
or byte [edx + ebx], al
lea edx, [esi - 1]
movzx eax, byte [edi - 0x10]
shl al, cl
mov ecx, esi
shr edx, 3
and ecx, 7
or byte [edx + ebx], al
mov edx, esi
movzx eax, byte [edi - 0xc]
shr edx, 3
shl al, cl
lea ecx, [esi + 1]
add esi, 4
or byte [edx + ebx], al
mov edx, ecx
movzx eax, byte [edi - 8]
and ecx, 7
shr edx, 3
shl al, cl
or byte [edx + ebx], al
lea eax, [esi - 2]
cmp eax, 0x40
jl 0x1002e3c1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret
Function at 0x1002e440
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x504
mov eax, dword [0x103c4120]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x100]
push esi
push edi
push 0xfc
push 0
push eax
mov dword [ebp - 0x104], 0
call fcn.101c6a70
mov esi, dword [ebp + 8]
add esp, 0xc
xor eax, eax
mov edi, edi
mov ecx, eax
shr ecx, 3
movzx edx, byte [ecx + esi]
movzx ecx, al
and ecx, 7
shr edx, cl
and edx, 1
mov dword [ebp + eax*4 - 0x104], edx
inc eax
cmp eax, 0x40
jl 0x1002e480
push 0x3fc
lea eax, [ebp - 0x500]
mov dword [ebp - 0x504], 0
push 0
push eax
call fcn.101c6a70
add esp, 0xc
xor ecx, ecx
jmp 0x1002e4d0
movsx eax, byte [ecx + str.91__]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + ecx*4 - 0x504], eax
movsx eax, byte [ecx + 0x1029fa31]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + ecx*4 - 0x500], eax
movsx eax, byte [ecx + 0x1029fa32]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + ecx*4 - 0x4fc], eax
movsx eax, byte [ecx + 0x1029fa33]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + ecx*4 - 0x4f8], eax
add ecx, 4
cmp ecx, 0x38
jl 0x1002e4d0
mov ecx, 0x38
lea esi, [ebp - 0x504]
lea edi, [ebp - 0x104]
rep movsd dword es:[edi], dword [esi]
movsx esi, byte [0x1029fa68]
lea eax, [ebp - 0x104]
push esi
push 0x1c
push eax
call fcn.1002dd10
push esi
lea eax, [ebp - 0x94]
push 0x1c
push eax
call fcn.1002dd10
push 0x3fc
lea eax, [ebp - 0x500]
mov dword [ebp - 0x504], 0
push 0
push eax
call fcn.101c6a70
add esp, 0x24
xor ecx, ecx
jmp 0x1002e590
movsx eax, byte [ecx + 0x1029fa78]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + ecx*4 - 0x504], eax
movsx eax, byte [ecx + 0x1029fa79]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + ecx*4 - 0x500], eax
movsx eax, byte [ecx + 0x1029fa7a]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + ecx*4 - 0x4fc], eax
movsx eax, byte [ecx + 0x1029fa7b]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + ecx*4 - 0x4f8], eax
movsx eax, byte [ecx + 0x1029fa7c]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + ecx*4 - 0x4f4], eax
movsx eax, byte [ecx + 0x1029fa7d]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp + ecx*4 - 0x4f0], eax
add ecx, 6
cmp ecx, 0x30
jl 0x1002e590
mov edi, ebx
lea esi, [ebp - 0x504]
mov ecx, 0x30
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret
Function at 0x1002ebc0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx ecx, si
shr esi, 0x10
test edi, edi
jne 0x1002ebdc
lea eax, [edi + 1]
pop edi
pop esi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jle 0x1002ecdd
jmp 0x1002ebf0
mov edx, 0x15b0
cmp ebx, edx
cmovl edx, ebx
sub ebx, edx
mov dword [ebp + 0x10], ebx
cmp edx, 0x10
jl 0x1002eca2
mov ebx, edx
shr ebx, 4
mov eax, ebx
neg eax
shl eax, 4
add edx, eax
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 8]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 9]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xa]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xb]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xc]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xd]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xe]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xf]
add esi, ecx
add edi, 0x10
add ecx, eax
add esi, ecx
dec ebx
jne 0x1002ec16
mov ebx, dword [ebp + 0x10]
test edx, edx
je 0x1002ecb1
movzx eax, byte [edi]
inc edi
add ecx, eax
add esi, ecx
dec edx
jne 0x1002eca6
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul edx, edx, 0xffff000f
add esi, edx
test ebx, ebx
jg 0x1002ebf0
shl esi, 0x10
pop ebx
or esi, ecx
pop edi
mov eax, esi
pop esi
pop ebp
ret