joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001ad0
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, dword [0x104cca6c]
jmp dword [eax*4 + 0x104ba0a0]

Function at 0x10001af0
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, dword [0x104cca6c]
jmp dword [eax*4 + 0x104ba0d8]

Function at 0x1000a140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
push ebx
mov eax, dword [esp + 0x18]
test eax, eax
jle 0x1000a23a
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
cmp eax, 6
jle 0x1000a201
cmp esi, edi
jbe 0x1000a16c
mov edx, esi
sub edx, edi
cmp eax, edx
jle 0x1000a180
cmp edi, esi
jbe 0x1000a201
mov edx, edi
sub edx, esi
cmp eax, edx
jg 0x1000a201
cmp eax, 0x10
jl 0x1000a23e
cmp eax, 0x226
jl 0x1000a242
mov edx, esi
and edx, 0x1f
mov ecx, edx
neg ecx
add ecx, 0x20
test edx, edx
cmovne edx, ecx
lea ebx, [edx + 0x10]
cmp eax, ebx
jl 0x1000a23e
mov ecx, eax
sub ecx, edx
and ecx, 0xf
neg ecx
add ecx, eax
test edx, edx
jbe 0x1000a1d1
xor ebx, ebx
movzx eax, byte [ebx + edi]
mov byte [ebx + esi], al
inc ebx
cmp ebx, edx
jb 0x1000a1c1
mov eax, dword [esp + 0x18]
vmovdqu xmm0, xmmword [edx + edi]
vmovdqu xmmword [edx + esi], xmm0
add edx, 0x10
cmp edx, ecx
jb 0x1000a1d1
mov edx, eax
lea ebx, [ecx + 1]
sub edx, ecx
cmp eax, ebx
jb 0x1000a23a
xor eax, eax
add esi, ecx
add ecx, edi
movzx ebx, byte [eax + ecx]
mov byte [eax + esi], bl
inc eax
cmp eax, edx
jb 0x1000a1f3
jmp 0x1000a23a
mov ecx, eax
shr ecx, 0x1f
add ecx, eax
sar ecx, 1
test ecx, ecx
jbe 0x1000a24b
xor ebx, ebx
movzx eax, byte [edi + ebx*2]
mov byte [esi + ebx*2], al
movzx edx, byte [edi + ebx*2 + 1]
mov byte [esi + ebx*2 + 1], dl
inc ebx
cmp ebx, ecx
jb 0x1000a210
mov eax, dword [esp + 0x18]
lea edx, [ebx + ebx + 1]
cmp edx, eax
ja 0x1000a23a
movzx eax, byte [edx + edi - 1]
mov byte [edx + esi - 1], al
pop ebx
pop edi
pop esi
ret
xor ecx, ecx
jmp 0x1000a1e2
mov ecx, eax
xor edx, edx
and ecx, 0xfffffff0
jmp 0x1000a1d1
mov edx, 1
jmp 0x1000a22d
Function at 0x100bf4f0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
sub esp, 0x24
mov ebp, dword [esp + 0x2c]
lea ecx, [esp]
mov eax, dword [0x104c5878]
xor eax, esp
mov dword [esp + 0x20], eax
lea edx, [ebp + 0x50]
mov dword [esp], 0x6a09e667
mov dword [esp + 4], 0xbb67ae85
mov dword [esp + 8], 0x3c6ef372
mov dword [esp + 0xc], 0xa54ff53a
mov dword [esp + 0x10], 0x510e527f
mov dword [esp + 0x14], 0x9b05688c
mov dword [esp + 0x18], 0x1f83d9ab
mov dword [esp + 0x1c], 0x5be0cd19
push 0x20
push edx
push ecx
call fcn.10009b50
add esp, 0xc
xor eax, eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
mov dword [ebp + 4], eax
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.103b6385
add esp, 0x24
pop ebp
ret
Function at 0x100c2d90
Capabilities:
Hash data using sha256

Disassembly:
push ebp
lea esp, [esp - 0x24]
mov ebp, dword [esp + 0x2c]
lea ecx, [esp]
mov eax, dword [0x104c5878]
xor eax, esp
mov dword [esp + 0x20], eax
lea edx, [ebp + 0x50]
mov dword [esp], 0x6a09e667
mov dword [esp + 4], 0xbb67ae85
mov dword [esp + 8], 0x3c6ef372
mov dword [esp + 0xc], 0xa54ff53a
mov dword [esp + 0x10], 0x510e527f
mov dword [esp + 0x14], 0x9b05688c
mov dword [esp + 0x18], 0x1f83d9ab
mov dword [esp + 0x1c], 0x5be0cd19
push 0x20
push edx
push ecx
call fcn.10009d40
lea esp, [esp + 0xc]
xor eax, eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
mov dword [ebp + 4], eax
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.103b6385
lea esp, [esp + 0x24]
pop ebp
ret
Function at 0x100c4f90
Capabilities:
Hash data using sha256

Disassembly:
push ebp
sub esp, 0x24
mov ebp, dword [esp + 0x2c]
lea ecx, [esp]
mov eax, dword [0x104c5878]
xor eax, esp
mov dword [esp + 0x20], eax
lea edx, [ebp + 0x50]
mov dword [esp], 0x6a09e667
mov dword [esp + 4], 0xbb67ae85
mov dword [esp + 8], 0x3c6ef372
mov dword [esp + 0xc], 0xa54ff53a
mov dword [esp + 0x10], 0x510e527f
mov dword [esp + 0x14], 0x9b05688c
mov dword [esp + 0x18], 0x1f83d9ab
mov dword [esp + 0x1c], 0x5be0cd19
push 0x20
push edx
push ecx
call fcn.10009f50
add esp, 0xc
xor eax, eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
mov dword [ebp + 4], eax
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.103b6385
add esp, 0x24
pop ebp
ret
Function at 0x100c6ee0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
sub esp, 0x24
mov ebp, dword [esp + 0x2c]
lea ecx, [esp]
mov eax, dword [0x104c5878]
xor eax, esp
mov dword [esp + 0x20], eax
lea edx, [ebp + 0x50]
mov dword [esp], 0x6a09e667
mov dword [esp + 4], 0xbb67ae85
mov dword [esp + 8], 0x3c6ef372
mov dword [esp + 0xc], 0xa54ff53a
mov dword [esp + 0x10], 0x510e527f
mov dword [esp + 0x14], 0x9b05688c
mov dword [esp + 0x18], 0x1f83d9ab
mov dword [esp + 0x1c], 0x5be0cd19
push 0x20
push edx
push ecx
call fcn.1000a140
add esp, 0xc
xor eax, eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
mov dword [ebp + 4], eax
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.103b6385
add esp, 0x24
pop ebp
ret

Function at 0x100c9090
Capabilities:
Hash data using sha256

Disassembly:
push ebp
sub esp, 0x24
mov ebp, dword [esp + 0x2c]
lea ecx, [esp]
mov eax, dword [0x104c5878]
xor eax, esp
mov dword [esp + 0x20], eax
lea edx, [ebp + 0x50]
mov dword [esp], 0x6a09e667
mov dword [esp + 4], 0xbb67ae85
mov dword [esp + 8], 0x3c6ef372
mov dword [esp + 0xc], 0xa54ff53a
mov dword [esp + 0x10], 0x510e527f
mov dword [esp + 0x14], 0x9b05688c
mov dword [esp + 0x18], 0x1f83d9ab
mov dword [esp + 0x1c], 0x5be0cd19
push 0x20
push edx
push ecx
call fcn.1000a340
add esp, 0xc
xor eax, eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
mov dword [ebp + 4], eax
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.103b6385
add esp, 0x24
pop ebp
ret

Function at 0x100d5030
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov eax, dword [0x104cca6c]
jmp dword [eax*4 + 0x104c4600]

Function at 0x100d5040
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov eax, dword [0x104cca6c]
jmp dword [eax*4 + 0x104c461c]

Function at 0x100d5050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x104cca6c]
jmp dword [eax*4 + 0x104c4638]

Function at 0x100d5060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x104cca6c]
jmp dword [eax*4 + 0x104c4654]

Function at 0x100d5070
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x104cca6c]
jmp dword [eax*4 + 0x104c4670]

Function at 0x100d5080
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x104cca6c]
jmp dword [eax*4 + 0x104c468c]
Function at 0x100f5370
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
sub esp, 8
test ecx, ecx
jbe 0x100f5448
cmp ecx, 4
jb 0x100f544f
mov edi, edx
and edi, 0xf
je 0x100f53a2
test edi, 3
jne 0x100f544f
neg edi
add edi, 0x10
shr edi, 2
lea ebx, [edi + 4]
cmp ecx, ebx
jb 0x100f544f
mov ebx, ecx
sub ebx, edi
and ebx, 3
neg ebx
add ebx, ecx
test edi, edi
jbe 0x100f53e3
xor esi, esi
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 4], ecx
mov ecx, dword [edx + esi*4]
test ecx, ecx
cmovl ecx, ebx
sub ecx, eax
cmovs ecx, ebx
mov dword [edx + esi*4], ecx
inc esi
cmp esi, edi
jb 0x100f53c7
mov ebx, dword [esp]
mov ecx, dword [esp + 4]
movd xmm0, eax
pshufd xmm0, xmm0, 0
pxor xmm1, xmm1
movdqa xmm2, xmmword [edx + edi*4]
movdqa xmm3, xmm2
pxor xmm2, xmm1
pcmpgtd xmm3, xmm1
pand xmm3, xmm2
pxor xmm3, xmm1
psubd xmm3, xmm0
movdqa xmm4, xmm3
pxor xmm3, xmm1
pcmpgtd xmm4, xmm1
pand xmm4, xmm3
pxor xmm4, xmm1
movdqa xmmword [edx + edi*4], xmm4
add edi, 4
cmp edi, ebx
jb 0x100f53f0
cmp ebx, ecx
jae 0x100f5448
xor esi, esi
mov edi, dword [edx + ebx*4]
test edi, edi
cmovl edi, esi
sub edi, eax
cmovs edi, esi
mov dword [edx + ebx*4], edi
inc ebx
cmp ebx, ecx
jb 0x100f5433
add esp, 8
pop ebx
pop edi
pop esi
ret
xor ebx, ebx
jmp 0x100f542d

Function at 0x100f6cc0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
lea esp, [esp - 8]
test ecx, ecx
jbe 0x100f6d9f
cmp ecx, 4
jb 0x100f6da7
mov edi, edx
and edi, 0xf
je 0x100f6cf3
test edi, 3
jne 0x100f6da7
neg edi
add edi, 0x10
shr edi, 2
mov ebx, edi
add ebx, 4
cmp ecx, ebx
jb 0x100f6da7
mov ebx, ecx
sub ebx, edi
and ebx, 3
neg ebx
add ebx, ecx
test edi, edi
jbe 0x100f6d38
xor esi, esi
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 4], ecx
mov ecx, dword [edx + esi*4]
test ecx, ecx
cmovl ecx, ebx
sub ecx, eax
cmovs ecx, ebx
mov dword [edx + esi*4], ecx
lea esi, [esi + 1]
cmp esi, edi
jb 0x100f6d1a
mov ebx, dword [esp]
mov ecx, dword [esp + 4]
movd xmm0, eax
pshufd xmm0, xmm0, 0
pxor xmm1, xmm1
movdqa xmm2, xmmword [edx + edi*4]
movdqa xmm3, xmm2
pxor xmm2, xmm1
pcmpgtd xmm3, xmm1
pand xmm3, xmm2
pxor xmm3, xmm1
psubd xmm3, xmm0
movdqa xmm4, xmm3
pxor xmm3, xmm1
pcmpgtd xmm4, xmm1
pand xmm4, xmm3
pxor xmm4, xmm1
movdqa xmmword [edx + edi*4], xmm4
lea edi, [edi + 4]
cmp edi, ebx
jb 0x100f6d45
cmp ebx, ecx
jae 0x100f6d9f
xor esi, esi
mov edi, dword [edx + ebx*4]
test edi, edi
cmovl edi, esi
sub edi, eax
cmovs edi, esi
mov dword [edx + ebx*4], edi
lea ebx, [ebx + 1]
cmp ebx, ecx
jb 0x100f6d88
lea esp, [esp + 8]
pop ebx
pop edi
pop esi
ret
xor ebx, ebx
jmp 0x100f6d82
Function at 0x100ffe40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
push ebx
push ebp
push esi
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
cmp ebx, 0xf
mov ebp, dword [esp + 0x18]
mov edx, dword [ecx]
not edx
jge 0x100ffecd
test ebx, ebx
je 0x100ffebc
mov eax, ebx
shr eax, 0x1f
add eax, ebx
sar eax, 1
test eax, eax
jbe 0x100ffec6
xor edi, edi
movzx esi, byte [ebp + edi*2]
xor esi, edx
and esi, 0xff
shr edx, 8
xor edx, dword [esi*4 + 0x1043fe00]
movzx esi, byte [ebp + edi*2 + 1]
inc edi
xor esi, edx
and esi, 0xff
shr edx, 8
xor edx, dword [esi*4 + 0x1043fe00]
cmp edi, eax
jb 0x100ffe6d
lea eax, [edi + edi + 1]
cmp eax, ebx
ja 0x100ffebc
movzx eax, byte [eax + ebp - 1]
xor eax, edx
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x1043fe00]
not edx
mov dword [ecx], edx
pop ecx
pop ebp
pop ebx
pop edi
pop esi
ret
mov eax, 1
jmp 0x100ffea4
mov eax, ebp
and eax, 7
je 0x100ffef5
neg eax
and eax, 7
sub ebx, eax
movzx edi, byte [ebp]
inc ebp
xor edi, edx
and edi, 0xff
shr edx, 8
xor edx, dword [edi*4 + 0x1043fe00]
dec eax
jne 0x100ffedb
mov eax, ebx
and ebx, 7
sar eax, 3
mov dword [esp], ebx
xor edx, dword [ebp]
movzx edi, dl
mov esi, dword [ebp + 4]
add ebp, 8
mov ebx, dword [edi*4 + 0x10440200]
mov edi, edx
shr edi, 8
and edi, 0xff
xor ebx, dword [edi*4 + 0x10440600]
mov edi, edx
shr edi, 0x10
and edi, 0xff
shr edx, 0x18
mov edi, dword [edi*4 + 0x10440a00]
xor edi, dword [edx*4 + 0x10440e00]
xor ebx, edi
mov edi, esi
mov edx, esi
and edx, 0xff
shr edi, 8
and edi, 0xff
mov edx, dword [edx*4 + 0x10441200]
xor edx, dword [edi*4 + 0x10441600]
mov edi, esi
shr edi, 0x10
and edi, 0xff
shr esi, 0x18
mov edi, dword [edi*4 + 0x10441a00]
xor edi, dword [esi*4 + 0x1043fe00]
xor edx, edi
xor edx, ebx
dec eax
jne 0x100fff00
mov ebx, dword [esp]
jmp 0x100ffe5a
Function at 0x100fffa0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
push ebx
push ebp
push esi
mov ecx, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov edx, dword [ecx]
not edx
cmp dword [esp + 0x1c], 0xf
jge 0x1010002e
test ebx, ebx
je 0x1010001d
mov eax, ebx
shr eax, 0x1f
add eax, ebx
sar eax, 1
test eax, eax
jbe 0x10100027
xor edi, edi
movzx esi, byte [ebp + edi*2]
xor esi, edx
and esi, 0xff
shr edx, 8
xor edx, dword [esi*4 + 0x10441e00]
movzx esi, byte [ebp + edi*2 + 1]
inc edi
xor esi, edx
and esi, 0xff
shr edx, 8
xor edx, dword [esi*4 + 0x10441e00]
cmp edi, eax
jb 0x100fffcf
add edi, edi
inc edi
cmp edi, ebx
ja 0x1010001d
movzx eax, byte [edi + ebp - 1]
xor eax, edx
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x10441e00]
not edx
mov dword [ecx], edx
pop ecx
pop ebp
pop ebx
pop edi
pop esi
ret
mov edi, 1
jmp 0x10100005
mov eax, ebp
and eax, 7
je 0x10100056
neg eax
and eax, 7
sub ebx, eax
movzx edi, byte [ebp]
inc ebp
xor edi, edx
and edi, 0xff
shr edx, 8
xor edx, dword [edi*4 + 0x10441e00]
dec eax
jne 0x1010003c
mov eax, ebx
and ebx, 7
sar eax, 3
mov dword [esp], ebx
xor edx, dword [ebp]
movzx edi, dl
mov esi, dword [ebp + 4]
mov ebx, dword [edi*4 + 0x10442200]
mov edi, edx
shr edi, 8
and edi, 0xff
xor ebx, dword [edi*4 + 0x10442600]
mov edi, edx
shr edi, 0x10
and edi, 0xff
shr edx, 0x18
mov edi, dword [edi*4 + 0x10442a00]
xor edi, dword [edx*4 + 0x10442e00]
xor ebx, edi
mov edi, esi
shr edi, 8
movzx edx, byte [ebp + 4]
add ebp, 8
and edi, 0xff
mov edx, dword [edx*4 + 0x10443200]
xor edx, dword [edi*4 + 0x10443600]
mov edi, esi
shr edi, 0x10
and edi, 0xff
shr esi, 0x18
mov edi, dword [edi*4 + 0x10443a00]
xor edi, dword [esi*4 + 0x10441e00]
xor edx, edi
xor edx, ebx
dec eax
jne 0x10100061
mov ebx, dword [esp]
jmp 0x100fffbc
Function at 0x101004f0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
push ebx
push ebp
push esi
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
cmp ebx, 0xf
mov ebp, dword [esp + 0x18]
mov edx, dword [ecx]
not edx
jge 0x1010057d
test ebx, ebx
je 0x1010056c
mov eax, ebx
shr eax, 0x1f
add eax, ebx
sar eax, 1
test eax, eax
jbe 0x10100576
xor edi, edi
movzx esi, byte [ebp + edi*2]
xor esi, edx
and esi, 0xff
shr edx, 8
xor edx, dword [esi*4 + 0x10444280]
movzx esi, byte [ebp + edi*2 + 1]
inc edi
xor esi, edx
and esi, 0xff
shr edx, 8
xor edx, dword [esi*4 + 0x10444280]
cmp edi, eax
jb 0x1010051d
lea eax, [edi + edi + 1]
cmp eax, ebx
ja 0x1010056c
movzx eax, byte [eax + ebp - 1]
xor eax, edx
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x10444280]
not edx
mov dword [ecx], edx
pop ecx
pop ebp
pop ebx
pop edi
pop esi
ret
mov eax, 1
jmp 0x10100554
mov eax, ebp
and eax, 7
je 0x101005a5
neg eax
and eax, 7
sub ebx, eax
movzx edi, byte [ebp]
inc ebp
xor edi, edx
and edi, 0xff
shr edx, 8
xor edx, dword [edi*4 + 0x10444280]
dec eax
jne 0x1010058b
mov eax, ebx
and ebx, 7
sar eax, 3
mov dword [esp], ebx
xor edx, dword [ebp]
movzx edi, dl
mov esi, dword [ebp + 4]
add ebp, 8
mov ebx, dword [edi*4 + 0x10444680]
mov edi, edx
shr edi, 8
and edi, 0xff
xor ebx, dword [edi*4 + 0x10444a80]
mov edi, edx
shr edi, 0x10
and edi, 0xff
shr edx, 0x18
mov edi, dword [edi*4 + 0x10444e80]
xor edi, dword [edx*4 + 0x10445280]
xor ebx, edi
mov edi, esi
mov edx, esi
and edx, 0xff
shr edi, 8
and edi, 0xff
mov edx, dword [edx*4 + 0x10445680]
xor edx, dword [edi*4 + 0x10445a80]
mov edi, esi
shr edi, 0x10
and edi, 0xff
shr esi, 0x18
mov edi, dword [edi*4 + 0x10445e80]
xor edi, dword [esi*4 + 0x10444280]
xor edx, edi
xor edx, ebx
dec eax
jne 0x101005b0
mov ebx, dword [esp]
jmp 0x1010050a
Function at 0x10100a10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
push ebx
push ebp
push esi
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov edx, dword [ecx]
not edx
cmp ebx, 0xf
jge 0x10100a9d
test ebx, ebx
je 0x10100a8c
mov eax, ebx
shr eax, 0x1f
add eax, ebx
sar eax, 1
test eax, eax
jbe 0x10100a96
xor edi, edi
movzx esi, byte [ebp + edi*2]
xor esi, edx
and esi, 0xff
shr edx, 8
xor edx, dword [esi*4 + 0x10446700]
movzx esi, byte [ebp + edi*2 + 1]
inc edi
xor esi, edx
and esi, 0xff
shr edx, 8
xor edx, dword [esi*4 + 0x10446700]
cmp edi, eax
jb 0x10100a3d
lea eax, [edi + edi + 1]
cmp eax, ebx
ja 0x10100a8c
movzx eax, byte [eax + ebp - 1]
xor eax, edx
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x10446700]
not edx
mov dword [ecx], edx
pop ecx
pop ebp
pop ebx
pop edi
pop esi
ret
mov eax, 1
jmp 0x10100a74
mov eax, ebp
and eax, 7
je 0x10100ac5
neg eax
and eax, 7
sub ebx, eax
movzx edi, byte [ebp]
inc ebp
xor edi, edx
and edi, 0xff
shr edx, 8
xor edx, dword [edi*4 + 0x10446700]
dec eax
jne 0x10100aab
mov eax, ebx
and ebx, 7
sar eax, 3
mov dword [esp], ebx
xor edx, dword [ebp]
movzx edi, dl
mov esi, dword [ebp + 4]
add ebp, 8
mov ebx, dword [edi*4 + 0x10446b00]
mov edi, edx
shr edi, 8
and edi, 0xff
xor ebx, dword [edi*4 + 0x10446f00]
mov edi, edx
shr edi, 0x10
and edi, 0xff
shr edx, 0x18
mov edi, dword [edi*4 + 0x10447300]
xor edi, dword [edx*4 + 0x10447700]
xor ebx, edi
mov edi, esi
mov edx, esi
and edx, 0xff
shr edi, 8
and edi, 0xff
mov edx, dword [edx*4 + 0x10447b00]
xor edx, dword [edi*4 + 0x10447f00]
mov edi, esi
shr edi, 0x10
and edi, 0xff
shr esi, 0x18
mov edi, dword [edi*4 + 0x10448300]
xor edi, dword [esi*4 + 0x10446700]
xor edx, edi
xor edx, ebx
dec eax
jne 0x10100ad0
mov ebx, dword [esp]
jmp 0x10100a2a
Function at 0x10100f40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
push ebx
push ebp
push esi
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov edx, dword [ecx]
not edx
cmp ebx, 0xf
jge 0x10100fcd
test ebx, ebx
je 0x10100fbc
mov eax, ebx
shr eax, 0x1f
add eax, ebx
sar eax, 1
test eax, eax
jbe 0x10100fc6
xor edi, edi
movzx esi, byte [ebp + edi*2]
xor esi, edx
and esi, 0xff
shr edx, 8
xor edx, dword [esi*4 + 0x10448b80]
movzx esi, byte [ebp + edi*2 + 1]
inc edi
xor esi, edx
and esi, 0xff
shr edx, 8
xor edx, dword [esi*4 + 0x10448b80]
cmp edi, eax
jb 0x10100f6d
lea eax, [edi + edi + 1]
cmp eax, ebx
ja 0x10100fbc
movzx eax, byte [eax + ebp - 1]
xor eax, edx
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x10448b80]
not edx
mov dword [ecx], edx
pop ecx
pop ebp
pop ebx
pop edi
pop esi
ret
mov eax, 1
jmp 0x10100fa4
mov eax, ebp
and eax, 7
je 0x10100ff5
neg eax
and eax, 7
sub ebx, eax
movzx edi, byte [ebp]
inc ebp
xor edi, edx
and edi, 0xff
shr edx, 8
xor edx, dword [edi*4 + 0x10448b80]
dec eax
jne 0x10100fdb
mov eax, ebx
and ebx, 7
sar eax, 3
mov dword [esp], ebx
xor edx, dword [ebp]
movzx edi, dl
mov esi, dword [ebp + 4]
add ebp, 8
mov ebx, dword [edi*4 + 0x10448f80]
mov edi, edx
shr edi, 8
and edi, 0xff
xor ebx, dword [edi*4 + 0x10449380]
mov edi, edx
shr edi, 0x10
and edi, 0xff
shr edx, 0x18
mov edi, dword [edi*4 + 0x10449780]
xor edi, dword [edx*4 + 0x10449b80]
xor ebx, edi
mov edi, esi
mov edx, esi
and edx, 0xff
shr edi, 8
and edi, 0xff
mov edx, dword [edx*4 + 0x10449f80]
xor edx, dword [edi*4 + 0x1044a380]
mov edi, esi
shr edi, 0x10
and edi, 0xff
shr esi, 0x18
mov edi, dword [edi*4 + 0x1044a780]
xor edi, dword [esi*4 + 0x10448b80]
xor edx, edi
xor edx, ebx
dec eax
jne 0x10101000
mov ebx, dword [esp]
jmp 0x10100f5a
Function at 0x10109e70
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
push ebp
mov esi, dword [esp + 0x48]
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x4c]
mov esi, dword [esi]
mov ebx, dword [ebx]
mov ecx, dword [esp + 0x18]
xor eax, eax
lea ecx, [ecx + 0x100]
pxor mm0, mm0
movd mm3, ebx
movd mm1, ecx
pcmpeqb xmm2, xmm2
jmp 0x10109ea8
add eax, 1
add esi, 1
movd mm0, eax
cmp esi, dword [esp + 0x34]
jge 0x10109fd5
cmp eax, dword [esp + 0x38]
jge 0x10109fd5
movzx eax, byte [esi + edi + 2]
shl ebx, 5
xor ebx, eax
mov eax, esi
and ebx, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
mov ebp, dword [edx + ebx*4]
mov dword [edx + ebx*4], esi
movd mm3, ebx
mov ebx, edi
sub eax, ebp
cmp eax, dword [esp + 0x2c]
jge 0x10109fa7
cmp ebp, dword [esp + 0x3c]
cmovl ebx, dword [esp + 0x24]
movd mm2, eax
movzx eax, word [esi + edi]
lea edi, [esi + edi]
movzx ecx, word [ebp + ebx]
lea ebx, [ebp + ebx]
cmp eax, ecx
jne 0x10109fa3
xor ecx, ecx
mov eax, dword [ecx + edi]
xor eax, dword [ecx + ebx]
jne 0x10109f31
lea ecx, [ecx + 4]
cmp ecx, 0x100
jl 0x10109f0d
movzx eax, word [ecx + edi]
movzx edx, word [ecx + ebx]
xor eax, edx
jne 0x10109f31
add ecx, 2
jmp 0x10109f39
bsf eax, eax
shr eax, 3
add ecx, eax
cmp ecx, 3
jl 0x10109fa3
lea ebp, [esi + 1]
lea esi, [ecx + esi - 1]
lea eax, [ecx - 3]
mov edi, dword [esp + 0x14]
movd ebx, mm3
mov edx, dword [esp + 0x28]
movzx ecx, byte [ebp + edi + 2]
shl ebx, 5
xor ebx, ecx
and ebx, dword [esp + 0x30]
mov dword [edx + ebx*4], ebp
add ebp, 1
cmp ebp, esi
jle 0x10109f53
movd edx, mm2
lea ecx, [edx - 1]
movd ebp, mm1
cmp edx, 0x101
jl 0x10109f85
shr ecx, 7
add ecx, 0x100
movzx ecx, byte [ecx + ebp]
mov ebp, dword [esp + 0x20]
add word [ebp + ecx*4], 1
mov ebp, dword [esp + 0x18]
movzx ebp, byte [eax + ebp]
add ebp, 0x101
jmp 0x10109fb2
mov edi, dword [esp + 0x14]
movzx eax, byte [esi + edi]
xor edx, edx
mov ebp, eax
movd ebx, mm3
mov ecx, dword [esp + 0x1c]
add word [ecx + ebp*4], 1
movd ebp, mm0
mov ecx, dword [esp + 0x44]
mov word [ecx + ebp*2], dx
mov edx, dword [esp + 0x40]
mov byte [ebp + edx], al
mov eax, ebp
jmp 0x10109e9f
mov edi, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [edi], esi
mov dword [ecx], ebx
emms
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x1010ae10
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
push ebp
mov esi, dword [esp + 0x48]
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x4c]
mov esi, dword [esi]
mov ebx, dword [ebx]
mov ecx, dword [esp + 0x18]
xor eax, eax
lea ecx, [ecx + 0x100]
pxor mm0, mm0
movd mm3, ebx
movd mm1, ecx
pcmpeqb xmm2, xmm2
jmp 0x1010ae48
add eax, 1
add esi, 1
movd mm0, eax
cmp esi, dword [esp + 0x34]
jge 0x1010af75
cmp eax, dword [esp + 0x38]
jge 0x1010af75
movzx eax, byte [esi + edi + 2]
shl ebx, 5
xor ebx, eax
mov eax, esi
and ebx, dword [esp + 0x30]
mov edx, dword [esp + 0x28]
mov ebp, dword [edx + ebx*4]
mov dword [edx + ebx*4], esi
movd mm3, ebx
mov ebx, edi
sub eax, ebp
cmp eax, dword [esp + 0x2c]
jge 0x1010af47
cmp ebp, dword [esp + 0x3c]
cmovl ebx, dword [esp + 0x24]
movd mm2, eax
movzx eax, word [esi + edi]
lea edi, [esi + edi]
movzx ecx, word [ebp + ebx]
lea ebx, [ebp + ebx]
cmp eax, ecx
jne 0x1010af43
xor ecx, ecx
mov eax, dword [ecx + edi]
xor eax, dword [ecx + ebx]
jne 0x1010aed1
lea ecx, [ecx + 4]
cmp ecx, 0x100
jl 0x1010aead
movzx eax, word [ecx + edi]
movzx edx, word [ecx + ebx]
xor eax, edx
jne 0x1010aed1
add ecx, 2
jmp 0x1010aed9
bsf eax, eax
shr eax, 3
add ecx, eax
cmp ecx, 3
jl 0x1010af43
lea ebp, [esi + 1]
lea esi, [ecx + esi - 1]
lea eax, [ecx - 3]
mov edi, dword [esp + 0x14]
movd ebx, mm3
mov edx, dword [esp + 0x28]
movzx ecx, byte [ebp + edi + 2]
shl ebx, 5
xor ebx, ecx
and ebx, dword [esp + 0x30]
mov dword [edx + ebx*4], ebp
add ebp, 1
cmp ebp, esi
jle 0x1010aef3
movd edx, mm2
lea ecx, [edx - 1]
movd ebp, mm1
cmp edx, 0x101
jl 0x1010af25
shr ecx, 7
add ecx, 0x100
movzx ecx, byte [ecx + ebp]
mov ebp, dword [esp + 0x20]
add word [ebp + ecx*4], 1
mov ebp, dword [esp + 0x18]
movzx ebp, byte [eax + ebp]
add ebp, 0x101
jmp 0x1010af52
mov edi, dword [esp + 0x14]
movzx eax, byte [esi + edi]
xor edx, edx
mov ebp, eax
movd ebx, mm3
mov ecx, dword [esp + 0x1c]
add word [ecx + ebp*4], 1
movd ebp, mm0
mov ecx, dword [esp + 0x44]
mov word [ecx + ebp*2], dx
mov edx, dword [esp + 0x40]
mov byte [ebp + edx], al
mov eax, ebp
jmp 0x1010ae3f
mov edi, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [edi], esi
mov dword [ecx], ebx
emms
pop ebp
pop ebx
pop edi
pop esi
ret