joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10029400
Capabilities:
Encode data using xor

Disassembly:
test edi, edi
je 0x1002943c
test esi, esi
je 0x1002943c
mov edx, dword [ecx]
test edx, edx
je 0x1002943c
xor ecx, ecx
test esi, esi
jbe 0x1002943e
push ebx
push ebp
jmp 0x10029420
movzx ebx, byte [ecx + edi]
mov ebp, eax
and ebp, 0xff
xor ebx, ebp
shr eax, 8
xor eax, dword [edx + ebx*4]
inc ecx
cmp ecx, esi
jb 0x10029420
pop ebp
pop ebx
ret
xor eax, eax
ret

Function at 0x10029440
Capabilities:
Hash data with crc32

Disassembly:
mov eax, dword [esi]
test eax, eax
je 0x10029455
push eax
call fcn.1005758d
add esp, 4
mov dword [esi], 0
push 0x100d61b4
push 0x400
call fcn.10057582
add esp, 8
mov dword [esi], eax
test eax, eax
je 0x1002950c
push 0x400
push 0
push eax
call fcn.10059a00
add esp, 0xc
xor ecx, ecx
mov eax, ecx
shr eax, 1
test cl, 1
je 0x10029491
xor eax, 0xedb88320
test al, 1
je 0x1002949e
shr eax, 1
xor eax, 0xedb88320
jmp 0x100294a0
shr eax, 1
test al, 1
je 0x100294ad
shr eax, 1
xor eax, 0xedb88320
jmp 0x100294af
shr eax, 1
test al, 1
je 0x100294bc
shr eax, 1
xor eax, 0xedb88320
jmp 0x100294be
shr eax, 1
test al, 1
je 0x100294cb
shr eax, 1
xor eax, 0xedb88320
jmp 0x100294cd
shr eax, 1
test al, 1
je 0x100294da
shr eax, 1
xor eax, 0xedb88320
jmp 0x100294dc
shr eax, 1
test al, 1
je 0x100294e9
shr eax, 1
xor eax, 0xedb88320
jmp 0x100294eb
shr eax, 1
test al, 1
je 0x100294f8
shr eax, 1
xor eax, 0xedb88320
jmp 0x100294fa
shr eax, 1
mov edx, dword [esi]
mov dword [edx + ecx*4], eax
inc ecx
cmp ecx, 0x100
jl 0x10029483
ret
Function at 0x1002d370
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push 0
push 0
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1002d3a3
call fcn.10002c20
pop esi
pop ebp
pop ebx
pop ecx
ret
push edi
push 0x100d61b4
push 0x80000
call fcn.10057582
mov edi, eax
add esp, 8
test edi, edi
jne 0x1002d3ce
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 0x8007000e
pop ebx
pop ecx
ret
push 0x80000
push 0
push edi
call fcn.10059a00
add esp, 0xc
push 0
lea ecx, [esp + 0x14]
push ecx
push 0x80000
push edi
push esi
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1002d41d
call fcn.10002c20
push edi
mov ebx, eax
call fcn.1005758d
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], 0
mov esi, edi
jbe 0x1002d455
lea ecx, [ecx]
cmp dword [esp + 0x10], 4
jae 0x1002d43b
xor eax, eax
jmp 0x1002d446
push ebx
mov eax, esi
call fcn.1002d070
add esp, 4
mov dword [ebp], eax
test eax, eax
jne 0x1002d45c
inc esi
sub dword [esp + 0x10], 1
jne 0x1002d430
mov dword [ebp], 0
push edi
call fcn.1005758d
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x10034110
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
push 1
lea edx, [esp + 0xc]
push edx
xor ecx, ecx
xor eax, eax
push ecx
push eax
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0xc]
push eax
mov dword [esp + 0x20], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1003414c
call fcn.10002c20
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edx, dword [esi + 0xc]
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x10034140
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 4], edx
mov eax, dword [ebp + 0x14]
mov edx, dword [esp + 0x14]
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100341f0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
cmp eax, 0x400000
jb 0x10034200
mov eax, 0x400000
mov edx, dword [esp + 8]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x14]
push edx
push ecx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1003422f
call fcn.10002c20
ret 0x10
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1003423d
mov edx, dword [esp + 0xc]
mov dword [eax], edx
xor eax, eax
ret 0x10

Function at 0x100342c0
Capabilities:
Get file size

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
xor eax, eax
cmp esi, eax
jne 0x100342da
mov eax, 0x80070057
pop esi
add esp, 8
ret 8
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 8]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp + 4]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x10034305
call fcn.10002c20
pop esi
add esp, 8
ret 8
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esi], eax
mov dword [esi + 4], ecx
xor eax, eax
pop esi
add esp, 8
ret 8

Function at 0x10034320
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 1
lea edx, [esp + 0xc]
push edx
xor ecx, ecx
xor eax, eax
push ecx
push eax
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x10]
push eax
mov dword [esp + 0x20], ecx
call edi
test eax, eax
jne 0x10034360
call fcn.10002c20
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [esi + 0x10]
push 0
push 0
push ecx
push edx
push eax
call edi
test eax, eax
je 0x10034353
mov ecx, dword [esi + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x10034353
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ecx, dword [esi + 0x10]
push 0
push 0
push edx
push eax
push ecx
call edi
test eax, eax
je 0x10034353
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x100343b0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 0xc]
cmp eax, 0x400000
jb 0x100343c0
mov eax, 0x400000
mov edx, dword [esp + 8]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x10]
push edx
push ecx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100343ef
call fcn.10002c20
ret 0x10
mov eax, dword [esp + 0x10]
test eax, eax
je 0x100343fd
mov edx, dword [esp + 0xc]
mov dword [eax], edx
xor eax, eax
ret 0x10

Function at 0x10035a00
Capabilities:
Check if file exists

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor cl, cl
xor ebx, ebx
push edi
mov dword [esi + 0xc18], ebx
cmp byte [esi + 0x16], cl
je 0x10035a18
mov cl, 1
mov eax, 1
test cl, cl
je 0x10035a26
mov eax, 3
xor ecx, ecx
cmp byte [esi + 0x15], bl
setne cl
dec ecx
and ecx, 0x8000000
cmp ebp, ebx
je 0x10035a53
cmp word [ebp], bx
je 0x10035a53
push ebx
push ecx
push 3
push ebx
push eax
push closesocket
push ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x10035a65
push ebx
push ecx
push 3
push ebx
push eax
push closesocket
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10035a81
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10035a81
mov dword [esi + 0xc18], 1
cmp edi, 0xffffffff
mov byte [esi + 0x12], bl
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
setne bl
test bl, bl
je 0x10035b13
mov dword [esi + 4], edi
test ebp, ebp
je 0x10035ac4
mov ecx, esi
sub ecx, ebp
mov eax, ebp
add ecx, 0x418
jmp 0x10035ab0
movzx edx, word [eax]
mov word [ecx + eax], dx
movzx edx, word [eax]
add eax, 2
test dx, dx
jne 0x10035ab0
jmp 0x10035ad0
xor eax, eax
mov word [esi + 0x418], ax
lea ecx, [ecx]
push 0
push 0
push 0x1000000
lea ecx, [esi + 0x17]
push ecx
push 0xffffffffffffffff
push ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp dword [esi + 4], 0xffffffff
je 0x10035b13
xor eax, eax
cmp dword [eax*4 + 0x100d6d50], 0
je 0x10035b0c
inc eax
cmp eax, 0x100
jb 0x10035af2
pop edi
pop ebp
mov al, bl
pop ebx
ret 4
mov dword [eax*4 + 0x100d6d50], esi
pop edi
pop ebp
mov al, bl
pop ebx
ret 4
Function at 0x10035c70
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
push edi
mov edi, dword [esp + 0x14]
jne 0x10035c97
cmp edi, 0x4e20
jle 0x10035c8c
mov edi, 0x4e20
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
mov ebx, dword [esp + 0x10]
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x18]
push eax
push edi
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10035d08
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x10035ce6
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x10035ccb
cmp eax, 3
jne 0x10035ce6
cmp edi, 0x4e20
jle 0x10035ce6
push 0x4e20
push ebx
mov ecx, esi
call fcn.10035c70
pop edi
pop esi
pop ebx
ret 8
cmp dword [esi + 0xc], 1
jne 0x10035cff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x10035cff
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
pop edi
pop esi
or eax, 0xffffffff
pop ebx
ret 8
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
Function at 0x10037c10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x30
xor ecx, ecx
mov dword [eax + 4], ecx
mov eax, dword [eax]
push ebx
mov ebx, dword [esp + 0x38]
xor edx, edx
mov word [eax], dx
movzx eax, word [ebx]
push ebp
push edi
xor edi, edi
cmp ax, cx
je 0x10037c3b
inc edi
cmp word [ebx + edi*2], cx
jne 0x10037c34
cmp edi, 1
movzx ebp, ax
jl 0x10037dae
cmp bp, 0x5c
je 0x10037dae
cmp bp, 0x2e
jne 0x10037c6f
cmp edi, 1
je 0x10037dae
cmp edi, 2
jne 0x10037c6f
cmp word [ebx + 2], bp
je 0x10037dae
push esi
push 4
lea esi, [esp + 0x14]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
call fcn.1002fb40
cmp edi, 3
jle 0x10037caf
cmp word [ebx + 2], 0x3a
jne 0x10037caf
cmp word [ebx + 4], 0x5c
jne 0x10037caf
cmp bp, 0x61
jb 0x10037ca6
cmp bp, 0x7a
jbe 0x10037d17
add ebp, 0xffffffbf
cmp bp, 0x19
jbe 0x10037d17
mov eax, dword [esp + 0x18]
cmp eax, 0x105
jg 0x10037ccf
cmp eax, 0x106
je 0x10037ccf
push 0x106
lea esi, [esp + 0x14]
call fcn.1002fb40
mov eax, dword [esp + 0x10]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea esi, [esp + 0x10]
mov edi, eax
call fcn.10033f30
test edi, edi
je 0x10037d97
cmp edi, 0x104
ja 0x10037d97
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
cmp word [edx + ecx*2 - 2], 0x5c
je 0x10037d17
push 0x5c
mov eax, esi
call fcn.1002f0c0
push 0x100c5a24
lea eax, [esp + 0x38]
call fcn.1002ef60
mov edi, eax
lea eax, [esp + 0x28]
call fcn.1002efc0
lea ecx, [esp + 0x10]
push ecx
lea eax, [esp + 0x2c]
call fcn.1002f1c0
lea edi, [esp + 0x28]
lea eax, [esp + 0x1c]
call fcn.1002efc0
push ebx
lea eax, [esp + 0x20]
call fcn.1002f130
mov eax, dword [esp + 0x48]
lea edi, [esp + 0x1c]
call fcn.1002f070
mov edx, dword [esp + 0x1c]
push edx
call fcn.1005758d
mov eax, dword [esp + 0x2c]
push eax
call fcn.1005758d
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.1005758d
mov edx, dword [esp + 0x1c]
push edx
call fcn.1005758d
add esp, 0x10
pop esi
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x30
ret
mov eax, dword [esp + 0x10]
push eax
call fcn.1005758d
add esp, 4
pop esi
pop edi
pop ebp
xor al, al
pop ebx
add esp, 0x30
ret
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 0x30
ret

Function at 0x10038190
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
cmp eax, 0x400000
jbe 0x100381a0
mov eax, 0x400000
mov edx, dword [esp + 8]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0xc]
push edx
push ecx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
test eax, eax
setne al
test ecx, ecx
je 0x100381d6
mov edx, dword [esp + 0xc]
mov dword [ecx], edx
test al, al
je 0x100381df
xor eax, eax
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100381f1
mov eax, 0x80004005
ret 0x10
jle 0x100381fd
and eax, 0xffff
or eax, 0x80070000
ret 0x10
Function at 0x100382b0
Capabilities:
Get file size

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [ecx + 8]
push esi
push edi
lea eax, [esp + 0xc]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100382d8
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jne 0x10038300
mov eax, dword [esp + 0xc]
push 1
push 0
push 0
push eax
call fcn.10065760
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [esp + 0x10]
pop edi
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop esi
ret 8
call edi
test eax, eax
jne 0x10038310
pop edi
mov eax, 0x80004005
pop esi
ret 8
jle 0x1003831c
and eax, 0xffff
or eax, 0x80070000
pop edi
pop esi
ret 8

Function at 0x10038d90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0x10]
lea eax, [edi + 0x14]
mov dword [ecx], eax
mov esi, dword [edi + 0xc]
add esi, dword [ebp + 8]
mov ebx, dword [edi + 0x10]
adc ebx, dword [ebp + 0xc]
push 1
xor eax, eax
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], eax
cmp eax, esi
jne 0x10038dde
cmp ecx, ebx
je 0x10038dfc
mov edx, dword [edi + 4]
sub esi, eax
sbb ebx, ecx
push 1
lea ecx, [esp + 0x20]
push ecx
push esi
push edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push 0
push eax
mov eax, dword [edi + 4]
push 0x20000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
neg eax
sbb eax, eax
pop edi
and eax, 0xffffffe2
pop esi
add eax, 0x1e
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10038e30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov ebx, ecx
mov esi, dword [ebx + 8]
add esi, dword [ebp + 8]
mov edx, dword [ebx + 4]
push edi
mov edi, dword [ebx + 0xc]
adc edi, dword [ebp + 0xc]
push 1
xor eax, eax
lea ecx, [esp + 0x18]
push ecx
push eax
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], eax
cmp eax, esi
jne 0x10038e76
cmp ecx, edi
je 0x10038e94
sub esi, eax
push 1
lea eax, [esp + 0x20]
push eax
sbb edi, ecx
mov ecx, dword [ebx + 4]
push esi
push ecx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [ebp + 0x14]
mov ecx, dword [edx]
cmp ecx, 0x20000
jbe 0x10038ea6
mov ecx, 0x20000
mov esi, dword [ebp + 0x10]
push 0
push edx
lea eax, [ebx + 0x10]
push ecx
mov dword [esi], eax
mov edx, dword [ebx + 4]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100404d0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x100d7154], 0
push ebx
push esi
push edi
mov esi, eax
jne 0x100404e3
call fcn.10040440
mov ebx, dword [esp + 0x10]
test esi, esi
jbe 0x1004050d
jmp 0x100404f0
test bl, 7
je 0x1004050d
movzx eax, byte [ebx]
movzx ecx, dl
xor eax, ecx
shr edx, 8
xor edx, dword [eax*4 + 0x100d7150]
dec esi
inc ebx
test esi, esi
ja 0x100404f0
cmp esi, 8
jb 0x100405a0
mov edi, esi
shr edi, 3
jmp 0x10040520
xor edx, dword [ebx]
add ebx, 8
movzx ecx, dl
mov eax, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x100d7150]
sub esi, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x100d7150]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100d7150]
mov ecx, eax
movzx edx, cl
mov eax, dword [edx*4 + 0x100d7150]
xor eax, dword [ebx - 4]
shr ecx, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100d7150]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x100d7150]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x100d7150]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x100d7150]
sub edi, 1
mov edx, eax
jne 0x10040520
xor eax, eax
test esi, esi
jbe 0x100405be
movzx ecx, byte [eax + ebx]
movzx edi, dl
xor ecx, edi
shr edx, 8
xor edx, dword [ecx*4 + 0x100d7150]
inc eax
cmp eax, esi
jb 0x100405a6
pop edi
pop esi
mov eax, edx
pop ebx
ret
Function at 0x10040b40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [0x100d1040]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x34]
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
je 0x10040c45
test eax, eax
jle 0x10040c45
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
mov dword [esp + 0x1c], edx
cdq
and edx, 0xf
add eax, edx
sar eax, 4
mov dword [esp + 0x18], ecx
mov ecx, dword [ebx + 0x10]
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
test eax, eax
jle 0x10040c15
jmp 0x10040ba0
lea edx, [esp + 0x28]
push edx
mov edx, esi
mov ecx, ebx
call fcn.10040f30
mov edx, dword [esp + 0x20]
xor dword [esp + 0x30], edx
mov edx, dword [esp + 0x24]
xor dword [esp + 0x34], edx
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x2c]
xor ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
xor eax, ebp
mov ebp, dword [esi]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], edx
mov edx, dword [esi + 0xc]
mov dword [edi], eax
mov eax, dword [esp + 0x30]
mov dword [edi + 8], eax
mov eax, dword [esp + 0x10]
mov dword [edi + 4], ecx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x34]
dec eax
mov dword [edi + 0xc], ecx
add esi, 0x10
add edi, 0x10
mov dword [esp + 0x24], edx
mov dword [esp + 0x10], eax
test eax, eax
jg 0x10040ba0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [ebx + 4], ebp
pop ebp
mov dword [ebx + 8], edx
mov edx, dword [esp + 0x20]
pop edi
mov dword [ebx + 0xc], ecx
pop esi
mov dword [ebx + 0x10], edx
shl eax, 4
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1005710f
add esp, 0x2c
ret 8
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1005710f
add esp, 0x2c
ret 8
Function at 0x10040c60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x100d1040]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
mov esi, ecx
mov ecx, 8
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
xor ecx, ecx
xor eax, eax
lea esp, [esp]
cmp edi, 0xa
jg 0x10040dbd
cmp eax, 4
jge 0x10040cd6
mov edi, edi
cmp ecx, 4
jge 0x10040cd9
mov bl, byte [esp + eax*4 + 0x10]
lea edx, [ecx + edi*4]
mov byte [ebp + edx*4 + 0x14], bl
lea edx, [ecx + edi*4]
lea esi, [ebp + edx*4]
movzx edx, byte [esp + eax*4 + 0x11]
mov byte [esi + 0x15], dl
movzx edx, byte [esp + eax*4 + 0x12]
mov byte [esi + 0x16], dl
movzx edx, byte [esp + eax*4 + 0x13]
inc eax
inc ecx
cmp eax, 4
mov byte [esi + 0x17], dl
jl 0x10040ca0
cmp ecx, 4
jne 0x10040cde
inc edi
xor ecx, ecx
cmp eax, 4
jl 0x10040c90
cmp edi, 0xa
jg 0x10040dbd
mov edx, 0x100da550
movzx esi, byte [esp + 0x1d]
mov al, byte [esp + 0x10]
xor al, byte [esi + 0x100da670]
movzx esi, byte [esp + 0x1e]
movzx ebx, byte [esi + 0x100da670]
movzx esi, byte [esp + 0x1f]
xor byte [esp + 0x11], bl
movzx ebx, byte [esi + 0x100da670]
movzx esi, byte [esp + 0x1c]
xor byte [esp + 0x12], bl
movzx ebx, byte [esi + 0x100da670]
xor al, byte [edx]
xor byte [esp + 0x13], bl
mov byte [esp + 0x10], al
inc edx
lea eax, [esp + 0x11]
mov esi, 3
movzx ebx, byte [eax - 1]
xor byte [eax + 3], bl
movzx ebx, byte [eax]
xor byte [eax + 4], bl
movzx ebx, byte [eax + 1]
xor byte [eax + 5], bl
movzx ebx, byte [eax + 2]
xor byte [eax + 6], bl
add eax, 4
sub esi, 1
jne 0x10040d40
xor eax, eax
cmp edi, 0xa
jg 0x10040dbd
cmp eax, 4
jge 0x10040da7
nop
cmp ecx, 4
jge 0x10040daa
movzx ebx, byte [esp + eax*4 + 0x10]
lea esi, [ecx + edi*4]
mov byte [ebp + esi*4 + 0x14], bl
movzx ebx, byte [esp + eax*4 + 0x11]
lea esi, [ecx + edi*4]
lea esi, [ebp + esi*4]
mov byte [esi + 0x15], bl
movzx ebx, byte [esp + eax*4 + 0x12]
mov byte [esi + 0x16], bl
movzx ebx, byte [esp + eax*4 + 0x13]
inc eax
inc ecx
cmp eax, 4
mov byte [esi + 0x17], bl
jl 0x10040d70
cmp ecx, 4
jne 0x10040daf
inc edi
xor ecx, ecx
cmp eax, 4
jl 0x10040d65
cmp edi, 0xa
jle 0x10040cf1
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1005710f
add esp, 0x24
ret 4
Function at 0x10040de0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x100d1040]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
push ebx
push esi
push edi
lea esi, [eax + 0x24]
lea ecx, [eax + 0x28]
mov edi, 9
xor eax, eax
jmp 0x10040e10
movzx edx, byte [ecx - 1]
movzx edx, byte [eax + edx*4 + 0x100d7550]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x100d7950]
movzx ebx, byte [ecx - 3]
xor dl, byte [eax + ebx*4 + 0x100d7d50]
movzx ebx, byte [ecx - 4]
xor dl, byte [eax + ebx*4 + 0x100d8150]
movzx ebx, byte [ecx + 2]
mov byte [esp + eax + 0xc], dl
movzx edx, byte [ecx + 3]
movzx edx, byte [eax + edx*4 + 0x100d7550]
xor dl, byte [eax + ebx*4 + 0x100d7950]
movzx ebx, byte [ecx + 1]
xor dl, byte [eax + ebx*4 + 0x100d7d50]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x100d8150]
movzx ebx, byte [ecx + 6]
mov byte [esp + eax + 0x10], dl
movzx edx, byte [ecx + 7]
movzx edx, byte [eax + edx*4 + 0x100d7550]
xor dl, byte [eax + ebx*4 + 0x100d7950]
movzx ebx, byte [ecx + 5]
xor dl, byte [eax + ebx*4 + 0x100d7d50]
movzx ebx, byte [ecx + 4]
xor dl, byte [eax + ebx*4 + 0x100d8150]
movzx ebx, byte [ecx + 0xa]
mov byte [esp + eax + 0x14], dl
movzx edx, byte [ecx + 0xb]
movzx edx, byte [eax + edx*4 + 0x100d7550]
xor dl, byte [eax + ebx*4 + 0x100d7950]
movzx ebx, byte [ecx + 9]
xor dl, byte [eax + ebx*4 + 0x100d7d50]
movzx ebx, byte [ecx + 8]
xor dl, byte [eax + ebx*4 + 0x100d8150]
inc eax
cmp eax, 4
mov byte [esp + eax + 0x17], dl
jl 0x10040e10
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov dword [esi], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 4], edx
mov edx, dword [esp + 0x18]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
add ecx, 0x10
add esi, 0x10
sub edi, 1
jne 0x10040e00
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1005710f
add esp, 0x14
ret 4