joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4120a2
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186c0], 0
push ebx
push esi
mov esi, 0x4186c8
jne 0x4120ce
call dword [sym.imp.KERNEL32.DLL_TlsAlloc]
push esi
mov dword [0x4186e0], eax
call dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
mov dword [0x4186c0], 1
push dword [0x4186e0]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x41216b
push 0x14
push 8
push dword [0x41804c]
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412195
push esi
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [0x4186c4]
test eax, eax
je 0x412110
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186c4], ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41219a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_RegisterWaitForSingleObject]
push ebx
push dword [0x4186e0]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x41804c]
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
test eax, eax
je 0x412195
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8
Function at 0x402f30
Capabilities:
Accept command line arguments

Disassembly:
push 0x10
pop eax
nop
nop
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.0040348f
call fcn.0040312f
call sub.KERNEL32.dll_GetCommandLineA
push eax
pop ebx
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
or ebx, ebx
jne 0x402f67
jmp 0x403005
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x402f66
cmp cl, 0x22
je 0x402fbf
cmp cl, 0x20
setne al
sub edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x402fdf
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x402fdf
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
sub edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x402f9f
jmp 0x402fdf
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
sub edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x402fbf
cmp cl, 0x22
je 0x403041
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x402fff
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x402fef
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
push 0xa
pop edx
nop
nop
je 0x403023
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
sub ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.0040136b
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x402fdf

Function at 0x4036b0
Capabilities:
Terminate process

Disassembly:
and eax, sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter
nop
nop
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
invalid

Function at 0x404e00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or al, 0x97
loope 0x404e7a
test eax, 0x8b348bfb
xor bl, ah
mov bh, al
invalid
cmp eax, 0xdf92d584
xchg ecx, eax
test eax, 0x11c588b
shr ecx, cl
sldt word [eax]
add bl, al
push ss
sti
dec edi
int1
sbb dh, cl
add eax, dword [edx]
int1
pop esp
pushfd
or al, 0x22
jb 0x404e26
add al, 0x8b

Function at 0x40a9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
nop
nop
dec esp
cmpsd dword [esi], dword es:[edi]
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 0x14
mov byte [0x4ddb5756], al
or al, 0x31
pop ss
test edx, edx
mov dword [ecx - 8], edi
jne 0x40a9c3
push edi
pop esi
xor eax, eax
lahf
mov ebp, dword [esi]
mov edi, 0x8b0010c2
push ebp
clc
mov ecx, dword [ebp - 0x58]
cmp dword [ecx], 0
je 0x40a997
pcmpeqw mm5, qword [eax + 0x33]
invalid
Function at 0x101d50f
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push 0x1003808
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x101d57d
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x1003824
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x101d574
cmp dword [ebp - 0xc], 4
jne 0x101d574
cmp dword [ebp - 0x10], edi
je 0x101d574
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x10c5244], edi
xor eax, eax
jmp 0x101d5bc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x10c5244], edi
jge 0x101d5b7
lea eax, [ebp - 0x34]
push eax
mov dword [0x10c5244], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x101d5b7
cmp word [ebp - 0x14], 5
jb 0x101d5b7
call fcn.0101d4ea
test eax, eax
je 0x101d5b7
emms
mov dword [0x10c5244], 1
mov eax, dword [0x10c5244]
pop edi
leave
ret
Function at 0x1034e32
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x98
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0x78], esi
push edi
mov edi, ecx
jne 0x1034e53
mov eax, 0x8876086c
jmp 0x1034f46
cmp dword [ebp + 0x7c], esi
je 0x1034ed5
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x18], 2
je 0x1034eb5
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push 0xfde9
call ebx
mov dword [ebp + 0x6c], eax
add eax, 3
and eax, 0xfffffffc
call fcn.0108f730
mov dword [ebp + 0x7c], esp
push esi
push esi
push dword [ebp + 0x6c]
push dword [ebp + 0x7c]
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push 0xfde9
call ebx
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x78], eax
mov dword [ebp + 0x7c], esi
cmp dword [ebp + 0x7c], esi
je 0x1034ed5
push esi
push 0x10000000
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x1034eee
push esi
push 0x10000000
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [edi], eax
je 0x1034f34
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
je 0x1034f34
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi + 0xc], eax
je 0x1034f34
cmp eax, esi
je 0x1034f41
push esi
push esi
push esi
push 4
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, esi
mov dword [edi + 8], eax
jne 0x1034f44
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x88760b59
jmp 0x1034f46
mov dword [edi + 8], esi
xor eax, eax
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8
Function at 0x1056152
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x1003808
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10561a9
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x10561a9
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x10561a9
xor eax, eax
inc eax
jmp 0x10561ab
xor eax, eax
leave
ret 0x10
Function at 0x1089acc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
mov esi, ecx
call fcn.01089864
push ebx
push ebx
mov ecx, esi
mov byte [ebp - 1], al
call fcn.010896b2
mov byte [ebp - 2], al
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
push 0x1011440
push edi
mov dword [ebp - 0xc], edi
call sub.msvcrt.dll_strstr
test eax, eax
pop ecx
pop ecx
je 0x1089b12
mov byte [esi + 0x33b], 1
push 0x1011434
push edi
call sub.msvcrt.dll_strstr
test eax, eax
pop ecx
pop ecx
je 0x1089b2a
mov byte [esi + 0x33a], 1
push 0x101142c
push edi
call sub.msvcrt.dll_strstr
test eax, eax
pop ecx
pop ecx
je 0x1089b55
push 1
push ebx
mov ecx, esi
call fcn.01089864
push 1
push ebx
mov ecx, esi
mov byte [ebp - 1], al
call fcn.010896b2
mov byte [ebp - 2], al
push 0x1011424
push edi
call sub.msvcrt.dll_strstr
test eax, eax
pop ecx
pop ecx
je 0x1089b80
push ebx
push 1
mov ecx, esi
call fcn.01089864
push ebx
push 1
mov ecx, esi
mov byte [ebp - 1], al
call fcn.010896b2
mov byte [ebp - 2], al
push 0x1011418
push edi
call sub.msvcrt.dll_strstr
test eax, eax
pop ecx
pop ecx
je 0x1089bd7
cmp byte [esi + 0x30], bl
je 0x1089b9b
mov eax, dword [esi + 0x3c]
jmp 0x1089b9e
mov eax, dword [esi + 0x74]
mov edi, dword [eax + 0x24]
cmp dword [edi + 0xc], ebx
mov dword [ebp - 8], ebx
jbe 0x1089bd7
push dword [ebp - 8]
mov ecx, edi
call fcn.0108e323
mov eax, dword [eax]
cmp eax, 3
jne 0x1089bc7
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [edi + 0xc]
jb 0x1089ba9
jmp 0x1089bd7
cmp byte [esi + 0x30], bl
je 0x1089bd1
mov dword [esi + 0x5c], eax
jmp 0x1089bd7
mov dword [esi + 0x94], eax
push 0x1011410
push dword [ebp - 0xc]
call sub.msvcrt.dll_strstr
test eax, eax
pop ecx
pop ecx
je 0x1089c2d
cmp byte [esi + 0x30], bl
je 0x1089bf4
mov eax, dword [esi + 0x3c]
jmp 0x1089bf7
mov eax, dword [esi + 0x74]
mov edi, dword [eax + 0x24]
cmp dword [edi + 0xc], ebx
mov dword [ebp - 8], ebx
jbe 0x1089c2d
push dword [ebp - 8]
mov ecx, edi
call fcn.0108e323
cmp dword [eax], ebx
je 0x1089c1d
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [edi + 0xc]
jb 0x1089c02
jmp 0x1089c2d
cmp byte [esi + 0x30], bl
je 0x1089c27
mov dword [esi + 0x5c], ebx
jmp 0x1089c2d
mov dword [esi + 0x94], ebx
cmp byte [esi + 0x33a], bl
je 0x1089c3d
cmp byte [ebp - 1], bl
je 0x1089c3d
mov byte [esi + 0x30], bl
cmp byte [ebp - 2], bl
jne 0x1089c4a
cmp byte [ebp - 1], bl
je 0x1089c54
mov byte [esi + 0x30], bl
cmp byte [ebp - 1], bl
jne 0x1089c5b
cmp byte [ebp - 2], bl
jne 0x1089c5b
mov eax, 0x82000003
jmp 0x1089c5d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x108dcec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x108dd9e
mov ebx, dword [ebp + 0xc]
cmp ebx, 1
jl 0x108dd9e
push 0x100949d
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push 0x10121a8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x108dd67
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1012194
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 8]
and byte [edi + ebx - 1], 0
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x108dd6e
mov eax, 0x80004005
jmp 0x108dda3
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call esi
push 0x101218c
mov dword [ebp - 8], eax
call esi
mov ecx, dword [ebp - 8]
add ecx, eax
cmp ecx, ebx
jge 0x108dd9e
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x108dd8b
mov esi, 0x101218c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, eax
jmp 0x108dda3
mov eax, 0x80070057
pop edi
pop esi
pop ebx
leave
ret
Function at 0x108f2a4
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push esi
push edi
push 0x3e8
mov esi, ecx
call fcn.0108e58f
mov edi, eax
xor ebx, ebx
cmp edi, ebx
je 0x108f364
cmp byte [esi + 8], bl
je 0x108f2ca
mov dword [esi + 0x10], edi
jmp 0x108f2cd
mov dword [esi + 0x48], edi
mov ecx, dword [edi + 0x138]
and byte [esp + 0xe], 0
and byte [esp + 0xf], 0
cmp dword [ecx + 0xc], ebx
jbe 0x108f306
push ebx
call fcn.0108e323
cmp byte [eax + 0x10], 0
je 0x108f2f5
mov byte [esp + 0xe], 1
jmp 0x108f2fa
mov byte [esp + 0xf], 1
mov ecx, dword [edi + 0x138]
inc ebx
cmp ebx, dword [ecx + 0xc]
jb 0x108f2e2
movzx eax, byte [esp + 0xe]
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
push eax
mov ebp, 0x3f8
push ebp
push dword [esi]
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
movzx eax, byte [esp + 0x13]
push eax
mov edi, 0x3fa
push edi
push dword [esi]
call ebx
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 8], 0
je 0x108f34b
cmp byte [esp + 0x12], 0
je 0x108f34b
push ebp
jmp 0x108f34c
push edi
push edi
push ebp
push dword [esi]
call dword [sym.imp.USER32.dll_CheckRadioButton]
pop ebp
pop edi
mov ecx, esi
pop esi
pop ebx
add esp, 4
jmp fcn.0108e86b
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10a0f15
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x10a1036
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x10a101a
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x10a0f6c
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x10a0f4a
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18
Function at 0x10a1302
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x20]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1064]
push edi
mov edi, dword [esi + 0x1058]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x20]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x10a1449
mov edx, 0xf81f
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1060]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x10a1424
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff07e0
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x1002]
mov ebp, eax
and ebp, 0xffff07e0
add ebp, ecx
mov ecx, edi
and ecx, 0xffff07e0
add ebp, ecx
mov ecx, esi
and ecx, 0xffff07e0
shr ebx, 2
lea ecx, [ecx + ebp + 0x40]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff07e0
lea eax, [eax + esi + 0x1002]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x10a136b
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1058]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1058]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x10a1342
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x10a1576
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x20]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1064]
mov edx, dword [esi + 0x20]
push edi
mov edi, dword [esi + 0x1058]
imul ebp, edi
add ebp, edx
cmp edx, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], ebp
jae 0x10a16bc
mov eax, 0x83e0
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1060]
lea esi, [edx + esi*2]
mov dword [esp + 0x10], ebx
add edi, edx
cmp edx, esi
mov ebx, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x10a1697
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx edx, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
and ebp, eax
mov ebx, edx
and ebx, eax
add ebx, ebp
mov ebp, edi
and ebp, eax
add ebx, ebp
mov dword [esp + 0x24], ecx
and ecx, 0x7c1f
mov ebp, esi
and ebp, eax
lea ebx, [ebx + ebp + 0x10040]
mov ebp, edx
and ebp, 0x7c1f
add ebp, ecx
mov ecx, edi
and ecx, 0x7c1f
add ebp, ecx
mov ecx, esi
and ecx, 0x7c1f
lea ecx, [ecx + ebp + 0x802]
shr ecx, 2
shr ebx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and ecx, eax
and edx, eax
add edx, ecx
and edi, eax
add edx, edi
mov edi, dword [esp + 0x1c]
and esi, eax
and ebx, 0xffff7c1f
lea ecx, [edx + esi + 0x10040]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [ecx], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x10a15df
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1058]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1058]
lea edx, [edx + edi*2]
cmp edx, ebp
mov dword [esp + 0x20], edx
jb 0x10a15b6
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x10a16c5
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x20]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1064]
push edi
mov edi, dword [esi + 0x1058]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x20]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x10a180f
mov edx, 0xf0f0
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1060]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x10a17ea
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff0f0f
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x2020]
mov ebp, eax
and ebp, 0xffff0f0f
add ebp, ecx
mov ecx, edi
and ecx, 0xffff0f0f
add ebp, ecx
mov ecx, esi
and ecx, 0xffff0f0f
shr ebx, 2
lea ecx, [ecx + ebp + 0x202]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff0f0f
lea eax, [eax + esi + 0x2020]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x10a172e
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1058]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1058]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x10a1705
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x10a1818
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x20]
mov eax, dword [edx + 0x20]
push esi
mov esi, dword [edx + 0x1064]
push edi
mov edi, dword [edx + 0x1058]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x10a194e
push ebx
mov edx, dword [edx + 0x1060]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x10a1929
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0x1c
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 8]
mov ecx, eax
and ecx, 0xffff00e3
mov ebx, ebp
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00e3
shr edx, 2
lea ecx, [ecx + ebx + 0x42]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xe3
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0x1c
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x42]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x10a1877
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1058]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1058]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x10a1853
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret