joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415620
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd000]
push edi
or ebp, 0xffffffff
jmp 0x415642
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x415649
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x415638
mov eax, 1
add ebx, ebx
jne 0x41565b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41566c
jne 0x41568b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41568b
dec eax
add ebx, ebx
jne 0x415678
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x415650
add ebx, ebx
jne 0x415687
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4156dd
xor ecx, ecx
sub eax, 3
jb 0x4156a3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x415712
sar eax, 1
mov ebp, eax
jmp 0x4156ae
add ebx, ebx
jne 0x4156ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41567c
inc ecx
add ebx, ebx
jne 0x4156bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41567c
add ebx, ebx
jne 0x4156c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4156be
jne 0x4156da
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4156be
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4156fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4156ee
jmp 0x41563e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4156fc
add edi, ecx
jmp 0x41563e
pop esi
mov edi, esi
mov ecx, 0x9e00
jmp 0x41574e
mov al, byte [edi]
add edi, 1
cmp al, 0x80
jb 0x41572f
cmp al, 0x8f
ja 0x41572f
cmp byte [edi - 2], 0xf
je 0x415735
sub al, 0xe8
cmp al, 1
ja 0x415758
cmp byte [edi], 2
jne 0x415758
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
mov dword [edi], eax
add edi, 4
sub ecx, 4
mov al, byte [edi]
add edi, 1
loop 0x41572f
sub ecx, 1
jg 0x41571c
lea edi, [esi + 0x13000]
mov eax, dword [edi]
or eax, eax
je 0x4157ae
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x16a24]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x16b00]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x415763
mov ecx, edi
jns 0x415792
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16b04]
or eax, eax
je 0x4157a8
mov dword [ebx], eax
add ebx, 4
jmp 0x415780
call dword [esi + 0x16b14]
mov ebp, dword [esi + 0x16b08]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4157e2
sub esp, 0xffffff80
jmp 0x40a9bc
Function at 0x1004da60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101bffa9
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x1029f280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], 0
lea ecx, [edi + 4]
mov dword [edi], 0x102961dc
xorps xmm0, xmm0
push 2
movups xmmword [ecx], xmm0
push 0x10294b38
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.10053b80
xorps xmm0, xmm0
movups xmmword [edi + 0x1c], xmm0
mov dword [edi + 0x2c], 0
movups xmm0, xmmword [ebp + 0xc]
mov dword [edi + 0x30], 0
mov byte [ebp + 0xc], 0
movups xmmword [edi + 0x1c], xmm0
movq xmm0, qword [ebp + 0x1c]
movq qword [edi + 0x2c], xmm0
mov dword [ebp + 0x1c], 0
mov dword [ebp + 0x20], 0xf
mov dword [edi + 0x34], 0
mov byte [edi + 0x38], 1
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
lea ecx, [edi + 0x74]
mov byte [ebp - 4], 3
call fcn.1004fcc0
mov byte [ebp - 4], 4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [edi + 0x3c], xmm0
push pe_nt_image_headers32
movups xmmword [edi + 0x4c], xmm0
mov dword [edi + 0x5c], 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
call fcn.10193f98
push pe_nt_image_headers32
push 0
push eax
mov dword [ebp - 0x10], eax
call fcn.101960f0
mov ecx, dword [ebp - 0x10]
add esp, 0x10
movq xmm0, qword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
movq qword [ecx + 4], xmm0
mov dword [ecx + 0xc], eax
lea eax, [ecx + 0x28]
mov dword [ecx], 0x10294d08
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x18], 0x10294c9c
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x24], 0xfa
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x10], ecx
mov byte [ebp - 4], 6
mov eax, dword [edi + 0x6c]
cmp eax, dword [edi + 0x70]
je 0x1004dbd0
mov dword [eax], ecx
add dword [edi + 0x6c], 4
jmp 0x1004dbea
lea ecx, [ebp - 0x10]
push ecx
push eax
lea ecx, [edi + 0x68]
call fcn.100597b0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1004dbea
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp + 0x20]
cmp ecx, 0xf
jbe 0x1004dc1a
mov edx, dword [ebp + 0xc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1004dc10
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004dc2f
push ecx
push edx
call fcn.101943fc
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
call fcn.1019f0fb
int3
Function at 0x1004f4c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1029f280]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xorps xmm0, xmm0
mov dword [ebp - 8], 0
mov edx, ecx
movq qword [ebp - 0x10], xmm0
push esi
lea ecx, [ebp - 0x10]
xor bl, bl
call fcn.1004f3a0
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
cmp esi, eax
je 0x1004f520
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi]
call edi
test eax, eax
movzx ebx, bl
mov eax, 1
cmovne ebx, eax
add esi, 4
cmp esi, dword [ebp - 0x14]
jne 0x1004f501
mov esi, dword [ebp - 0x10]
pop edi
test esi, esi
je 0x1004f550
mov ecx, dword [ebp - 8]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x1004f546
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004f562
push ecx
push esi
call fcn.101943fc
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.10193ea5
mov esp, ebp
pop ebp
ret
call fcn.1019f0fb
int3
Function at 0x1004f8d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x1004f8ee
push 0
push 0
push 0
push 0x1004f8c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc

Function at 0x100509c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
lea ebx, [eax + 0x10]
mov dword [eax + 8], esi
mov edi, 1
mov dword [eax + 0xc], edx
push 0x5851f42d
mov ecx, edx
xor eax, eax
push 0x4c957f2d
shr ecx, 0x1e
xor eax, edx
xor ecx, esi
push eax
push ecx
call fcn.10194790
mov esi, eax
lea ebx, [ebx + 8]
add esi, edi
mov dword [ebx - 8], esi
adc edx, 0
inc edi
mov dword [ebx - 4], edx
cmp edi, 0x138
jb 0x100509e0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov dword [eax], 0x138
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100580e0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
push edi
mov edi, 1
mov dword [ebp - 0x10], ebx
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x1005821a
lea eax, [ecx - 1]
mov esi, dword [ebx + 4]
or eax, edi
mov dword [ebp - 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
lea ecx, [ebx + 0xc]
mov dword [ebp - 0x14], ecx
lea eax, [edi + edi]
push eax
call fcn.100508c0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x100581ed
mov bl, byte [eax + 8]
mov edi, dword [ebp - 0x10]
mov ecx, dword [ecx]
movzx edx, bl
xor edx, 0x811c9dc5
mov edi, dword [edi + 0x18]
imul edx, edx, 0x1000193
and edi, edx
mov edx, dword [ebp - 0x14]
mov edx, dword [edx]
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0xc], edx
cmp edi, esi
jne 0x10058179
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x100581e3
mov edx, dword [edx + 4]
cmp bl, byte [edx + 8]
jne 0x100581b0
mov edx, dword [edx]
mov dword [ebp - 4], edx
cmp edx, eax
je 0x100581a8
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 4]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
jmp 0x100581e3
cmp edi, edx
je 0x100581c0
mov edx, dword [edx + 4]
cmp bl, byte [edx + 8]
je 0x100581f6
cmp edi, edx
jne 0x100581b4
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
jne 0x10058145
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 4], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp - 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x100581e3
push str.invalid_hash_bucket_count
call fcn.10191eaa
int3
Function at 0x10058240
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
mov eax, 0x1fffffff
bsr ecx, eax
push esi
mov esi, 1
mov dword [ebp - 0x14], ebx
mov eax, esi
shl eax, cl
mov ecx, dword [ebp + 8]
push edi
cmp ecx, eax
ja 0x100583ba
lea eax, [ecx - 1]
or eax, esi
bsr ecx, eax
mov eax, dword [ebx + 4]
push eax
mov dword [ebp - 8], eax
lea ecx, [ecx + 1]
shl esi, cl
lea ecx, [ebx + 0xc]
lea eax, [esi + esi]
push eax
call fcn.100508c0
lea eax, [esi - 1]
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x18], eax
mov esi, dword [ebx + 4]
mov eax, dword [ebp - 8]
mov esi, dword [esi]
mov edi, esi
cmp esi, eax
je 0x10058395
cmp dword [esi + 0x1c], 0xf
lea ecx, [esi + 8]
mov edi, dword [edi]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
jbe 0x100582c1
mov edx, dword [ecx]
mov dword [ebp - 4], edx
xor edx, edx
mov ebx, 0x811c9dc5
cmp dword [ecx + 0x10], edx
jbe 0x100582ea
mov eax, dword [ebp - 4]
mov edi, dword [ebp - 0xc]
movzx ecx, byte [edx + eax]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, edi
jb 0x100582d3
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0xc]
and edx, ebx
lea ecx, [ecx + edx*8]
mov dword [ebp - 4], ecx
cmp dword [ecx], eax
jne 0x10058309
mov dword [ecx], esi
mov dword [ecx + 4], esi
jmp 0x1005838b
mov ebx, dword [ecx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.10058710
test al, al
jne 0x10058343
mov ebx, dword [ebx]
cmp ebx, esi
je 0x1005833b
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], esi
jmp 0x10058388
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
je 0x1005836b
nop word [eax + eax]
mov ebx, dword [ebx + 4]
lea eax, [ebx + 8]
push eax
lea eax, [esi + 8]
push eax
call fcn.10058710
test al, al
je 0x1005839e
mov eax, dword [ebp - 4]
cmp dword [eax], ebx
jne 0x10058350
mov edx, dword [esi + 4]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], esi
mov eax, dword [ebp - 8]
mov esi, edi
cmp edi, eax
jne 0x100582a5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 4]
mov ebx, dword [ebx]
mov dword [edx], edi
mov ecx, dword [edi + 4]
mov dword [ecx], ebx
mov eax, dword [ebx + 4]
mov dword [eax], esi
mov dword [ebx + 4], ecx
mov dword [edi + 4], edx
mov dword [esi + 4], eax
jmp 0x10058388
push str.invalid_hash_bucket_count
call fcn.10191eaa
int3
Function at 0x10066bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
movzx ebp, ax
xor eax, eax
mov esi, ebp
push edi
shr esi, 8
xor edi, edi
mov dword [esp + 0x10], esi
cmp dword [esp + 0x20], eax
jbe 0x10066c11
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
movzx ecx, word [ecx + edi*2]
mov edx, ecx
movzx ecx, cl
shr edx, 8
add edx, eax
cmp esi, ecx
jb 0x10066c11
jne 0x10066c08
cmp eax, edx
jge 0x10066c08
mov ecx, dword [esp + 0x18]
movzx esi, cl
movzx ecx, byte [eax + ebx]
cmp cx, si
je 0x10066c39
inc eax
cmp eax, edx
jl 0x10066bf6
mov esi, dword [esp + 0x10]
inc edi
mov eax, edx
cmp edi, dword [esp + 0x20]
jb 0x10066bd3
mov edi, dword [esp + 0x2c]
xor eax, eax
mov bl, 1
test edi, edi
je 0x10066c4f
mov esi, dword [esp + 0x28]
movzx ecx, byte [eax + esi]
test cl, cl
jns 0x10066c41
movzx edx, byte [eax + esi + 1]
inc eax
and ecx, 0x7f
shl ecx, 8
or edx, ecx
jmp 0x10066c43
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret
mov edx, ecx
sub ebp, edx
js 0x10066c4f
inc eax
xor bl, 1
cmp eax, edi
jb 0x10066c21
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret
Function at 0x10075e50
Capabilities:
Hash data using sha1

Disassembly:
mov eax, 0x40
call fcn.101949d0
mov eax, dword [0x1029f280]
xor eax, esp
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x48], 0x1d
push esi
mov esi, dword [esp + 0x48]
push edi
mov edi, dword [esp + 0x58]
je 0x10075e8c
pop edi
mov eax, 0xfffffffe
pop esi
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.10193ea5
add esp, 0x40
ret
test esi, esi
je 0x10075f9b
cmp dword [esp + 0x54], 0x30
jne 0x10075f9b
push 0x30
push edi
push esi
call fcn.10075d70
add esp, 0xc
test eax, eax
jle 0x10075f9b
movaps xmm0, xmmword [str.6666666666666666O]
lea eax, [esp + 8]
push 0x28
push eax
push esi
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
movq qword [esp + 0x34], xmm0
call fcn.10075d70
add esp, 0xc
test eax, eax
je 0x10075f9b
lea eax, [esp + 0x30]
push esi
push eax
call fcn.10075bd0
add esp, 8
test eax, eax
je 0x10075f9b
push 0x4c
lea eax, [esi + 0x14]
push 0
push eax
call fcn.101960f0
push 0x30
push edi
push esi
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
call fcn.10075d70
add esp, 0x18
test eax, eax
jle 0x10075f9b
movaps xmm0, xmmword [0x101f1500]
lea eax, [esp + 8]
push 0x28
push eax
push esi
movups xmmword [esp + 0x14], xmm0
movups xmmword [esp + 0x24], xmm0
movq qword [esp + 0x34], xmm0
call fcn.10075d70
add esp, 0xc
test eax, eax
je 0x10075f9b
push 0x14
lea eax, [esp + 0x34]
push eax
push esi
call fcn.10075d70
add esp, 0xc
test eax, eax
je 0x10075f9b
lea eax, [esp + 0x30]
push 0x14
push eax
call fcn.10001320
add esp, 8
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.10193ea5
add esp, 0x40
ret
mov ecx, dword [esp + 0x44]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.10193ea5
add esp, 0x40
ret

Function at 0x10078b40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.101949d0
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x10078bc0
mov cl, byte [edi]
test cl, cl
je 0x10078bc0
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x10078b70
pop esi
mov ecx, eax
pop ebx
shr ecx, 0x10
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret
Function at 0x10078c40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.101949d0
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x10078cc3
mov cl, byte [edi]
test cl, cl
je 0x10078cc3
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
and esi, 0xffffffdf
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x10078c70
pop esi
mov ecx, eax
pop ebx
shr ecx, 0x10
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret
Function at 0x1007c060
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
lea edx, [eax - 1]
not eax
shr edx, 0x1f
shr eax, 0x1f
and edx, eax
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 4]
dec edx
xor eax, ecx
mov dword [esp + 0x10], edx
and eax, edx
xor ecx, eax
mov dword [ebp + 4], ecx
xor dword [ebx + 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebx + 0xc]
xor eax, ecx
movd xmm0, edx
and eax, edx
pshufd xmm4, xmm0, 0
xor ecx, eax
mov dword [ebp + 0xc], ecx
xor dword [ebx + 0xc], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebx + 0x10]
xor eax, ecx
and eax, edx
and eax, 4
xor ecx, eax
mov dword [ebp + 0x10], ecx
xor dword [ebx + 0x10], eax
xor eax, eax
mov esi, dword [esp + 0x1c]
test esi, esi
jle 0x1007c176
push edi
cmp esi, 4
jb 0x1007c151
mov ecx, dword [ebp]
lea edi, [esi - 1]
mov edx, dword [ebx]
lea ebp, [esi - 1]
lea ebp, [ecx + ebp*4]
cmp edx, ebp
lea edi, [edx + edi*4]
mov ebp, dword [esp + 0x18]
ja 0x1007c0f4
cmp edi, ecx
jae 0x1007c151
cmp edx, ebx
ja 0x1007c0fc
cmp edi, ebx
jae 0x1007c151
cmp edx, ebp
ja 0x1007c104
cmp edi, ebp
jae 0x1007c151
lea edi, [esi - 1]
lea edi, [ecx + edi*4]
cmp ecx, ebx
ja 0x1007c112
cmp edi, ebx
jae 0x1007c151
cmp ecx, ebp
ja 0x1007c11a
cmp edi, ebp
jae 0x1007c151
mov edi, esi
and edi, 0xfffffffc
nop
movups xmm3, xmmword [edx + eax*4]
movups xmm2, xmmword [ecx + eax*4]
movaps xmm1, xmm3
xorps xmm1, xmm2
andps xmm1, xmm4
movaps xmm0, xmm1
xorps xmm1, xmm3
xorps xmm0, xmm2
movups xmmword [ecx + eax*4], xmm0
movups xmmword [edx + eax*4], xmm1
add eax, 4
cmp eax, edi
jl 0x1007c120
mov dword [esp + 0x18], eax
cmp eax, esi
jge 0x1007c175
mov ecx, dword [ebp]
mov edx, dword [ecx + eax*4]
lea esi, [ecx + eax*4]
mov ecx, dword [ebx]
mov edi, dword [ecx + eax*4]
xor edi, edx
and edi, dword [esp + 0x14]
xor edx, edi
mov dword [esi], edx
mov ecx, dword [ebx]
xor dword [ecx + eax*4], edi
inc eax
cmp eax, dword [esp + 0x20]
jl 0x1007c151
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1009abd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.101949d0
mov ecx, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x24]
shr ecx, 3
mov dword [esp + 8], ecx
cmp esi, dword [esp + 0x28]
jb 0x1009ade8
push ebx
push ebp
push edi
nop word [eax + eax]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x1009adc2
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
movzx eax, byte [ecx + 7]
cdq
mov ebp, eax
mov ebx, edx
movzx eax, byte [ecx + 6]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 5]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 4]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 3]
cdq
mov ecx, ebp
shld ebx, ecx, 8
mov edi, edx
mov dword [esp + 0x20], ebp
shl ecx, 8
or edi, ebx
or eax, ecx
and ebp, 0x55555555
mov ecx, dword [esp + 0x2c]
mov ebx, eax
mov dword [esp + 0x18], eax
shld edi, ebx, 8
movzx eax, byte [ecx + 2]
cdq
shl ebx, 8
or edi, edx
or ebx, eax
movzx eax, byte [ecx + 1]
cdq
shld edi, ebx, 8
shl ebx, 8
or edi, edx
or ebx, eax
movzx eax, byte [ecx]
cdq
add ecx, 8
shld edi, ebx, 8
mov dword [esp + 0x2c], ecx
shl ebx, 8
or ebx, eax
mov eax, ebx
and eax, 0x55555555
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
and ecx, 0xff00ff
mov dword [esp + 0x18], ecx
mov ecx, ebp
shr ecx, 1
or ecx, ebp
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ebp, eax
shr ebp, 4
or ebp, eax
and ebx, 0xaaaaaaaa
and ebp, 0xff00ff
lea eax, [ebx + ebx]
or eax, ebx
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
and ecx, 0xf0f0f0f0
mov edi, ecx
shl edi, 4
or edi, ecx
mov ecx, dword [esp + 0x20]
and ecx, 0xaaaaaaaa
and edi, 0xff00ff00
mov ebx, edi
and edi, 0xffff00
shr ebx, 8
or ebx, edi
lea eax, [ecx + ecx]
shr ebx, 8
or eax, ecx
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
and ecx, 0xf0f0f0f0
mov edx, ecx
shl edx, 4
or edx, ecx
mov ecx, ebp
and edx, 0xff00ff00
shl ebp, 8
mov eax, edx
and ecx, 0xffffff00
shl eax, 8
or ecx, ebp
or eax, edx
shl ecx, 8
and eax, 0xffff0000
xor edx, edx
or ebx, eax
mov eax, dword [esp + 0x18]
shr eax, 8
or eax, dword [esp + 0x18]
movzx eax, ax
or ecx, eax
mov eax, dword [esp + 0x10]
or edx, ecx
mov ecx, dword [esp + 0x28]
xor dword [ecx + eax*8], edx
xor dword [ecx + eax*8 + 4], ebx
inc eax
mov dword [esp + 0x10], eax
cmp eax, esi
jb 0x1009ac14
mov esi, dword [esp + 0x30]
jmp 0x1009adc6
mov ecx, dword [esp + 0x28]
push ecx
call fcn.1009a310
sub esi, dword [esp + 0x38]
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], esi
cmp esi, dword [esp + 0x34]
jae 0x1009ac00
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
add esp, 0x14
ret