joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10036c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
xor esi, esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], esi
push edi
test ebx, ebx
je 0x10036da3
test edx, edx
je 0x10036c7f
mov eax, dword [ebp + 8]
test eax, eax
je 0x10036da3
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x10036da3
mov edi, eax
mov ecx, esi
sub edi, esi
nop
mov esi, dword [ebx + 0x80]
cmp esi, 0x40
jae 0x10036c79
mov al, byte [edi + ecx]
xor al, byte [esi + ebx + 0x40]
mov esi, dword [ebp - 4]
mov byte [ecx], al
inc esi
inc dword [ebx + 0x80]
inc ecx
mov dword [ebp - 4], esi
sub edx, 1
jne 0x10036c50
jmp 0x10036c7c
mov esi, dword [ebp - 4]
mov dword [ebp - 8], edx
mov edi, dword [ebp + 8]
lea eax, [ebx + 0x40]
cmp edx, 0x40
jb 0x10036d5d
mov ecx, dword [ebp + 0xc]
lea eax, [ebx + 0x41]
mov dword [ebp - 0x14], eax
mov eax, edi
sub eax, ecx
shr edx, 6
inc ecx
mov dword [ebp - 0x10], eax
add esi, ecx
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 4]
add edi, 3
mov eax, edx
add edi, ecx
shl eax, 6
add ecx, eax
mov dword [ebp - 4], ecx
nop dword [eax]
lea edx, [ebx + 0x40]
mov ecx, ebx
call fcn.10036910
inc dword [ebx + 0x30]
mov edx, 8
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x10]
nop dword [eax + eax]
movzx eax, byte [edi - 3]
lea ecx, [ecx + 8]
xor al, byte [ecx - 9]
mov byte [esi - 1], al
movzx eax, byte [ebx + esi]
xor al, byte [ecx - 8]
mov byte [esi], al
movzx eax, byte [edi - 1]
xor al, byte [ecx - 7]
mov byte [esi + 1], al
movzx eax, byte [ecx - 6]
xor al, byte [edi]
mov byte [esi + 2], al
movzx eax, byte [edi + 1]
xor al, byte [ecx - 5]
mov byte [esi + 3], al
movzx eax, byte [edi + 2]
xor al, byte [ecx - 4]
mov byte [esi + 4], al
movzx eax, byte [edi + 3]
xor al, byte [ecx - 3]
mov byte [esi + 5], al
movzx eax, byte [edi + 4]
add edi, 8
xor al, byte [ecx - 2]
mov byte [esi + 6], al
add esi, 8
sub edx, 1
jne 0x10036ce0
mov edx, dword [ebp - 8]
mov ebx, dword [ebp - 0x18]
sub edx, 0x40
sub dword [ebp - 0xc], 1
mov dword [ebp - 8], edx
jne 0x10036cc0
mov edi, dword [ebp - 0x10]
lea eax, [ebx + 0x40]
mov esi, dword [ebp + 0xc]
jmp 0x10036d62
mov esi, dword [ebp + 0xc]
sub edi, esi
test edx, edx
je 0x10036d9a
mov edx, eax
mov ecx, ebx
call fcn.10036910
mov eax, dword [ebp - 4]
xor edx, edx
inc dword [ebx + 0x30]
add eax, esi
mov esi, dword [ebp - 8]
mov dword [ebp - 0x18], eax
nop
lea ecx, [eax + edx]
mov al, byte [edi + ecx]
xor al, byte [ebx + edx + 0x40]
inc edx
mov byte [ecx], al
mov eax, dword [ebp - 0x18]
cmp edx, esi
jb 0x10036d80
mov dword [ebx + 0x80], esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffffaf
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100394b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov eax, edx
mov dword [ebp - 4], ecx
push edi
mov edi, dword [ebp + 8]
xor dl, dl
xor esi, esi
mov dword [ebp - 8], eax
test edi, edi
je 0x10039570
push ebx
mov ebx, eax
sub ebx, ecx
cmp edi, 0x20
jb 0x10039551
mov eax, dword [ebp - 4]
mov ecx, edi
mov edx, dword [ebp - 8]
and ecx, 0xffffffe0
xorps xmm3, xmm3
xorps xmm2, xmm2
add eax, 0x10
nop dword [eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [esi + edx]
add esi, 0x20
xorps xmm1, xmm0
orps xmm3, xmm1
movups xmm1, xmmword [ebx + eax - 0x20]
movups xmm0, xmmword [eax - 0x20]
xorps xmm1, xmm0
orps xmm2, xmm1
cmp esi, ecx
jb 0x100394f0
orps xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
orps xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
orps xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
orps xmm2, xmm0
movd edx, xmm2
cmp esi, edi
jae 0x10039566
mov ecx, dword [ebp - 4]
lea eax, [esi + ecx]
sub edi, esi
mov cl, byte [ebx + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub edi, 1
jne 0x10039556
pop ebx
pop edi
movzx eax, dl
pop esi
mov esp, ebp
pop ebp
ret
pop edi
movzx eax, dl
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003a710
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x54], eax
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov esi, ecx
push 0x40
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x44]
push ebx
push eax
mov dword [ebp - 0x50], edx
call fcn.10046690
mov eax, dword [ebp - 0x48]
add esp, 0xc
mov dword [ebp - 0x4c], ebx
mov ecx, dword [eax]
test ecx, ecx
jne 0x1003a754
xor cl, cl
jmp 0x1003a757
mov cl, byte [ecx + 8]
movzx edx, cl
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x60], edx
test ecx, ecx
je 0x1003a8bf
push edi
nop dword [eax]
cmp ecx, edx
mov edi, edx
cmovb edi, ecx
mov ecx, dword [eax]
mov dword [ebp - 0x58], edi
test ecx, ecx
je 0x1003a8b9
push dword [eax + 4]
mov eax, dword [ecx + 0x10]
call eax
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x1003a8be
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
test ecx, ecx
je 0x1003a8b9
push dword [ebp + 0xc]
push dword [ebp - 0x54]
push dword [eax + 4]
mov eax, dword [ecx + 0x14]
call eax
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x1003a8be
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
test ecx, ecx
je 0x1003a8b9
push 4
lea edx, [ebp - 0x4c]
push edx
push dword [eax + 4]
mov eax, dword [ecx + 0x14]
call eax
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x1003a8be
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
test ecx, ecx
je 0x1003a8b9
lea edx, [ebp - 0x44]
push edx
push dword [eax + 4]
mov eax, dword [ecx + 0x18]
call eax
mov ebx, eax
add esp, 8
mov dword [ebp - 0x5c], ebx
test ebx, ebx
jne 0x1003a8be
xor ecx, ecx
test edi, edi
je 0x1003a8a0
cmp edi, 0x40
jb 0x1003a894
lea edx, [esi - 1]
lea eax, [ebp + edi - 0x45]
add edx, edi
cmp esi, eax
ja 0x1003a835
lea eax, [ebp - 0x44]
cmp edx, eax
jae 0x1003a894
mov eax, edi
lea ebx, [ebp - 0x24]
and eax, 0xffffffc0
lea edi, [ebp - 0x44]
movups xmm0, xmmword [esi]
lea edx, [ebp - 0x14]
movups xmm1, xmmword [edi + ecx]
xorps xmm1, xmm0
movups xmmword [esi], xmm1
movups xmm0, xmmword [esi + 0x10]
movups xmm1, xmmword [ebp + ecx - 0x34]
xorps xmm1, xmm0
movups xmmword [esi + 0x10], xmm1
movups xmm0, xmmword [esi + 0x20]
movups xmm1, xmmword [ebx + ecx]
xorps xmm1, xmm0
movups xmmword [esi + 0x20], xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x40
movups xmm0, xmmword [esi + 0x30]
mov edx, ecx
xorps xmm1, xmm0
movups xmmword [esi + 0x30], xmm1
add esi, 0x40
cmp ecx, eax
jb 0x1003a840
mov edi, dword [ebp - 0x58]
mov ebx, dword [ebp - 0x5c]
cmp edx, edi
jae 0x1003a8a0
mov al, byte [ebp + ecx - 0x44]
inc ecx
xor byte [esi], al
inc esi
cmp ecx, edi
jb 0x1003a894
mov ecx, dword [ebp - 0x50]
inc byte [ebp - 0x49]
sub ecx, edi
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x60]
mov dword [ebp - 0x50], ecx
jne 0x1003a770
jmp 0x1003a8be
mov ebx, 0xffffaf00
pop edi
mov ecx, dword [fcn.10046690]
lea eax, [ebp - 0x44]
push 0x40
push 0
push eax
call ecx
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, ebx
xor ecx, ebp
pop esi
pop ebx
call fcn.10045387
mov esp, ebp
pop ebp
ret
Function at 0x1003c4c0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 8], ecx
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
push edi
test esi, esi
je 0x1003c64f
mov edi, dword [ebp + 0xc]
xor edx, edx
cmp byte [eax + edi], 0x20
jne 0x1003c4f4
inc eax
inc edx
cmp eax, esi
jb 0x1003c4e8
cmp eax, esi
je 0x1003c566
mov ecx, esi
sub ecx, eax
cmp ecx, 2
jb 0x1003c50e
cmp byte [eax + edi], 0xd
jne 0x1003c50e
cmp byte [eax + edi + 1], 0xa
je 0x1003c55e
mov cl, byte [eax + edi]
cmp cl, 0xa
je 0x1003c55e
test edx, edx
jne 0x1003c632
cmp cl, 0x3d
jne 0x1003c52d
inc ebx
cmp ebx, 2
ja 0x1003c632
cmp cl, 0x7f
ja 0x1003c632
movzx ecx, cl
mov cl, byte [ecx + 0x10067048]
cmp cl, 0x7f
je 0x1003c632
cmp cl, 0x40
jae 0x1003c555
test ebx, ebx
jne 0x1003c632
mov ecx, dword [ebp - 4]
inc ecx
mov dword [ebp - 4], ecx
jmp 0x1003c561
mov ecx, dword [ebp - 4]
inc eax
cmp eax, esi
jb 0x1003c4e6
test ecx, ecx
je 0x1003c64f
and ecx, 7
lea ecx, [ecx + ecx*2]
lea edx, [ecx*2 + 7]
mov ecx, dword [ebp - 4]
shr ecx, 3
shr edx, 3
lea ecx, [ecx + ecx*2]
lea ecx, [edx + ecx*2]
mov edx, dword [ebp - 8]
sub ecx, ebx
test edx, edx
je 0x1003c63e
cmp dword [ebp - 0xc], ecx
jb 0x1003c63e
xor ecx, ecx
mov dword [ebp - 4], 3
xor ebx, ebx
mov dword [ebp + 0x10], ecx
mov esi, edx
test eax, eax
je 0x1003c622
mov cl, byte [edi]
cmp cl, 0xd
je 0x1003c619
cmp cl, 0xa
je 0x1003c619
cmp cl, 0x20
je 0x1003c619
movzx ecx, cl
mov dl, byte [ecx + 0x10067048]
xor ecx, ecx
cmp dl, 0x40
sete cl
shl ebx, 6
sub dword [ebp - 4], ecx
movzx ecx, dl
mov edx, dword [ebp + 0x10]
and ecx, 0x3f
inc edx
or ebx, ecx
mov dword [ebp + 0x10], edx
cmp edx, 4
jne 0x1003c619
mov edx, dword [ebp - 4]
xor ecx, ecx
mov dword [ebp + 0x10], ecx
test edx, edx
je 0x1003c604
mov ecx, ebx
shr ecx, 0x10
mov byte [esi], cl
inc esi
cmp edx, 1
jbe 0x1003c611
mov ecx, ebx
shr ecx, 8
mov byte [esi], cl
inc esi
cmp edx, 2
jbe 0x1003c619
mov byte [esi], bl
inc esi
inc edi
sub eax, 1
jne 0x1003c5b4
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
sub esi, edx
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffffd4
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov eax, 0xffffffd6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword [eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1003d520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, edx
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
push esi
push edi
test dl, 7
je 0x1003d542
mov eax, 0xffffffce
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
je 0x1003d68a
cmp eax, 1
jne 0x1003d605
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
lea ecx, [edx + 2]
sub edx, eax
lea esi, [eax + 2]
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
sub edx, 2
dec eax
mov dword [ebp - 0xc], edx
shr eax, 3
inc eax
mov dword [ebp + 8], eax
nop dword [eax + eax]
movzx eax, byte [esi - 2]
lea edi, [esi + edx]
xor al, byte [ebx]
mov edx, edi
mov byte [edi], al
movzx eax, byte [esi - 1]
xor al, byte [ebx + 1]
mov byte [ecx - 1], al
movzx eax, byte [ebx + 2]
xor al, byte [esi]
mov byte [ecx], al
movzx eax, byte [esi + 1]
xor al, byte [ebx + 3]
mov byte [ecx + 1], al
movzx eax, byte [esi + 2]
xor al, byte [ebx + 4]
mov byte [ecx + 2], al
movzx eax, byte [esi + 3]
xor al, byte [ebx + 5]
mov byte [ecx + 3], al
movzx eax, byte [esi + 4]
xor al, byte [ebx + 6]
mov byte [ecx + 4], al
movzx eax, byte [esi + 5]
xor al, byte [ebx + 7]
mov byte [ecx + 5], al
mov ecx, dword [ebp - 8]
push edi
call fcn.1003cbd0
mov ecx, dword [edi + 4]
lea esi, [esi + 8]
mov eax, dword [edi]
add esp, 4
mov edx, dword [ebp - 0xc]
mov dword [ebx + 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 8
mov dword [ebx], eax
sub dword [ebp + 8], 1
mov dword [ebp - 4], ecx
jne 0x1003d580
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
sub ebx, eax
sub ebx, 2
lea ecx, [eax + 2]
mov dword [ebp - 0xc], ebx
lea eax, [edx - 1]
mov dword [ebp + 8], ecx
shr eax, 3
inc eax
mov dword [ebp - 4], eax
mov edi, dword [ecx + ebx]
lea edx, [ecx + ebx]
mov ebx, dword [edx + 4]
lea esi, [ecx - 2]
mov ecx, dword [ebp - 8]
push esi
call fcn.1003cbd0
mov edx, dword [ebp + 0xc]
add esp, 4
mov ecx, dword [ebp + 8]
movzx eax, byte [edx]
xor byte [esi], al
movzx eax, byte [edx + 1]
xor byte [ecx - 1], al
movzx eax, byte [edx + 2]
xor byte [ecx], al
movzx eax, byte [edx + 3]
xor byte [ecx + 1], al
movzx eax, byte [edx + 4]
xor byte [ecx + 2], al
movzx eax, byte [edx + 5]
xor byte [ecx + 3], al
movzx eax, byte [edx + 6]
xor byte [ecx + 4], al
movzx eax, byte [edx + 7]
xor byte [ecx + 5], al
add ecx, 8
sub dword [ebp - 4], 1
mov dword [edx + 4], ebx
mov ebx, dword [ebp - 0xc]
mov dword [edx], edi
mov dword [ebp + 8], ecx
jne 0x1003d623
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003f0a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov eax, edx
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
push esi
push edi
test dl, 7
je 0x1003f0c2
mov eax, 0xffffffce
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
je 0x1003f20a
cmp eax, 1
jne 0x1003f185
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
lea ecx, [edx + 2]
sub edx, eax
lea esi, [eax + 2]
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
sub edx, 2
dec eax
mov dword [ebp - 0xc], edx
shr eax, 3
inc eax
mov dword [ebp + 8], eax
nop dword [eax + eax]
movzx eax, byte [esi - 2]
lea edi, [esi + edx]
xor al, byte [ebx]
mov edx, edi
mov byte [edi], al
movzx eax, byte [esi - 1]
xor al, byte [ebx + 1]
mov byte [ecx - 1], al
movzx eax, byte [ebx + 2]
xor al, byte [esi]
mov byte [ecx], al
movzx eax, byte [esi + 1]
xor al, byte [ebx + 3]
mov byte [ecx + 1], al
movzx eax, byte [esi + 2]
xor al, byte [ebx + 4]
mov byte [ecx + 2], al
movzx eax, byte [esi + 3]
xor al, byte [ebx + 5]
mov byte [ecx + 3], al
movzx eax, byte [esi + 4]
xor al, byte [ebx + 6]
mov byte [ecx + 4], al
movzx eax, byte [esi + 5]
xor al, byte [ebx + 7]
mov byte [ecx + 5], al
mov ecx, dword [ebp - 8]
push edi
call fcn.1003d6a0
mov ecx, dword [edi + 4]
lea esi, [esi + 8]
mov eax, dword [edi]
add esp, 4
mov edx, dword [ebp - 0xc]
mov dword [ebx + 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 8
mov dword [ebx], eax
sub dword [ebp + 8], 1
mov dword [ebp - 4], ecx
jne 0x1003f100
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
sub ebx, eax
sub ebx, 2
lea ecx, [eax + 2]
mov dword [ebp - 0xc], ebx
lea eax, [edx - 1]
mov dword [ebp + 8], ecx
shr eax, 3
inc eax
mov dword [ebp - 4], eax
mov edi, dword [ecx + ebx]
lea edx, [ecx + ebx]
mov ebx, dword [edx + 4]
lea esi, [ecx - 2]
mov ecx, dword [ebp - 8]
push esi
call fcn.1003d6a0
mov edx, dword [ebp + 0xc]
add esp, 4
mov ecx, dword [ebp + 8]
movzx eax, byte [edx]
xor byte [esi], al
movzx eax, byte [edx + 1]
xor byte [ecx - 1], al
movzx eax, byte [edx + 2]
xor byte [ecx], al
movzx eax, byte [edx + 3]
xor byte [ecx + 1], al
movzx eax, byte [edx + 4]
xor byte [ecx + 2], al
movzx eax, byte [edx + 5]
xor byte [ecx + 3], al
movzx eax, byte [edx + 6]
xor byte [ecx + 4], al
movzx eax, byte [edx + 7]
xor byte [ecx + 5], al
add ecx, 8
sub dword [ebp - 4], 1
mov dword [edx + 4], ebx
mov ebx, dword [ebp - 0xc]
mov dword [edx], edi
mov dword [ebp + 8], ecx
jne 0x1003f1a3
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100416b0
Capabilities:
Enumerate pe sections

Disassembly:
push edi
mov edi, ecx
test edi, edi
je 0x1004182b
test edx, edx
je 0x1004182b
movzx eax, byte [edx + 2]
push esi
movzx esi, byte [edx + 3]
shl esi, 8
or esi, eax
movzx eax, byte [edx]
shl esi, 0x10
or esi, eax
movzx eax, byte [edx + 1]
shl eax, 8
and esi, 0xfffffff
or esi, eax
mov dword [edi], esi
movzx ecx, byte [edx + 7]
shl ecx, 8
movzx eax, byte [edx + 6]
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 0x10
or ecx, eax
movzx eax, byte [edx + 5]
and ecx, 0xffffffc
shl eax, 8
or ecx, eax
mov dword [edi + 4], ecx
movzx ecx, byte [edx + 0xb]
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 0x10
or ecx, eax
movzx eax, byte [edx + 9]
and ecx, 0xffffffc
shl eax, 8
or ecx, eax
mov dword [edi + 8], ecx
movzx ecx, byte [edx + 0xf]
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
shl ecx, 0x10
or ecx, eax
movzx eax, byte [edx + 0xd]
and ecx, 0xffffffc
shl eax, 8
or ecx, eax
mov dword [edi + 0xc], ecx
movzx ecx, byte [edx + 0x13]
movzx eax, byte [edx + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x10], ecx
movzx ecx, byte [edx + 0x17]
movzx eax, byte [edx + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x14], ecx
movzx ecx, byte [edx + 0x1b]
movzx eax, byte [edx + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x18]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x18], ecx
movzx ecx, byte [edx + 0x1f]
movzx eax, byte [edx + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1c]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x20], 0
push 0x10
lea eax, [edi + 0x34]
mov dword [edi + 0x1c], ecx
push 0
push eax
mov eax, dword [fcn.10046690]
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call eax
add esp, 0xc
mov dword [edi + 0x44], 0
xor eax, eax
pop esi
pop edi
ret
mov eax, 0xffffffa9
pop edi
ret
Function at 0x10041920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 8], 0x10
mov ecx, dword [ebp + 8]
mov eax, edx
push edi
mov dword [ebp - 0x10], eax
mov edi, esi
push ebx
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 4], ecx
xor eax, dword [edi]
lea edi, [edi + 4]
mov edx, eax
mov dword [ebp - 0xc], eax
mov ebx, eax
shr edx, 8
mov ecx, edx
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
mov eax, dword [esi + eax*4 + 0x48]
add eax, dword [esi + ecx*4 + 0x448]
movzx ecx, dl
mov edx, ebx
xor eax, dword [esi + ecx*4 + 0x848]
movzx ecx, bl
add eax, dword [esi + ecx*4 + 0xc48]
xor eax, dword [ebp - 4]
sub dword [ebp - 8], 1
mov dword [ebp - 4], edx
jne 0x10041943
mov ecx, dword [esi + 0x44]
xor ecx, edx
mov edx, dword [ebp - 0x10]
pop ebx
pop edi
mov dword [edx], ecx
mov ecx, dword [esi + 0x40]
xor ecx, eax
mov eax, dword [ebp + 8]
pop esi
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret

Function at 0x100419b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
movzx eax, byte [edi]
movzx esi, byte [edi + 1]
movzx ecx, byte [edi + 3]
shl eax, 8
or eax, esi
movzx esi, byte [edi + 2]
shl eax, 8
or eax, esi
movzx esi, byte [edi + 4]
shl esi, 8
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 5]
or esi, ecx
mov dword [ebp + 8], eax
movzx ecx, byte [edi + 6]
shl esi, 8
or esi, ecx
movzx ecx, byte [edi + 7]
shl esi, 8
or esi, ecx
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
test edx, edx
jne 0x10041a76
mov edi, dword [ebp - 0xc]
mov esi, ebx
mov dword [ebp - 4], 0x10
lea ecx, [esi + 0x44]
mov dword [ebp + 8], ecx
nop word [eax + eax]
xor eax, dword [ecx]
mov edx, eax
mov dword [ebp - 0xc], eax
mov ebx, eax
shr edx, 8
mov ecx, edx
shr ecx, 8
mov eax, ecx
movzx ecx, cl
shr eax, 8
mov eax, dword [esi + eax*4 + 0x48]
add eax, dword [esi + ecx*4 + 0x448]
movzx ecx, dl
xor eax, dword [esi + ecx*4 + 0x848]
movzx ecx, bl
add eax, dword [esi + ecx*4 + 0xc48]
mov ecx, dword [ebp + 8]
xor eax, edi
sub ecx, 4
mov edi, ebx
sub dword [ebp - 4], 1
mov dword [ebp + 8], ecx
jne 0x10041a20
mov edx, dword [esi]
xor edx, ebx
mov ebx, dword [esi + 4]
xor ebx, eax
jmp 0x10041a8d
lea eax, [ebp - 4]
mov ecx, ebx
push eax
lea edx, [ebp + 8]
call fcn.10041920
mov edx, dword [ebp + 8]
add esp, 4
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov eax, edx
shr eax, 0x18
pop edi
pop esi
mov byte [ecx], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 1], al
mov eax, edx
shr eax, 8
mov byte [ecx + 2], al
mov eax, ebx
shr eax, 0x18
mov byte [ecx + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 5], al
mov eax, ebx
shr eax, 8
mov byte [ecx + 6], al
xor eax, eax
mov byte [ecx + 7], bl
mov byte [ecx + 3], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10041ad0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, edx
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 4], eax
test dl, 7
je 0x10041aef
mov eax, 0xffffffe8
mov esp, ebp
pop ebp
ret
test edx, edx
je 0x10041c41
push ebx
push esi
push edi
test eax, eax
jne 0x10041b97
mov ecx, dword [ebp + 0x14]
lea eax, [edx - 1]
mov ebx, dword [ebp + 0x10]
add ecx, 2
shr eax, 3
inc eax
mov dword [ebp - 4], ecx
mov dword [ebp + 8], ebx
mov dword [ebp - 8], eax
nop dword [eax + eax]
mov edi, dword [ebx]
lea esi, [ecx - 2]
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov ebx, dword [ebx + 4]
push esi
push dword [ebp + 8]
call fcn.100419b0
mov edx, dword [ebp + 0xc]
add esp, 8
mov ecx, dword [ebp - 4]
movzx eax, byte [edx]
xor byte [esi], al
movzx eax, byte [edx + 1]
xor byte [ecx - 1], al
movzx eax, byte [edx + 2]
xor byte [ecx], al
movzx eax, byte [edx + 3]
xor byte [ecx + 1], al
movzx eax, byte [edx + 4]
xor byte [ecx + 2], al
movzx eax, byte [edx + 5]
xor byte [ecx + 3], al
movzx eax, byte [edx + 6]
xor byte [ecx + 4], al
movzx eax, byte [edx + 7]
xor byte [ecx + 5], al
add ecx, 8
mov dword [edx + 4], ebx
mov ebx, dword [ebp + 8]
add ebx, 8
mov dword [edx], edi
sub dword [ebp - 8], 1
mov dword [ebp + 8], ebx
mov dword [ebp - 4], ecx
jne 0x10041b20
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
lea ecx, [edx + 2]
sub edx, eax
lea esi, [eax + 2]
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
sub edx, 2
dec eax
mov dword [ebp - 0x10], edx
shr eax, 3
inc eax
mov dword [ebp + 8], eax
nop dword [eax]
movzx eax, byte [esi - 2]
lea edi, [edx + esi]
xor al, byte [ebx]
mov byte [edi], al
movzx eax, byte [esi - 1]
xor al, byte [ebx + 1]
mov byte [ecx - 1], al
movzx eax, byte [esi]
xor al, byte [ebx + 2]
mov byte [ecx], al
movzx eax, byte [esi + 1]
xor al, byte [ebx + 3]
mov edx, dword [ebp - 4]
mov byte [ecx + 1], al
movzx eax, byte [esi + 2]
xor al, byte [ebx + 4]
mov byte [ecx + 2], al
movzx eax, byte [esi + 3]
xor al, byte [ebx + 5]
mov byte [ecx + 3], al
movzx eax, byte [esi + 4]
xor al, byte [ebx + 6]
mov byte [ecx + 4], al
movzx eax, byte [esi + 5]
xor al, byte [ebx + 7]
mov byte [ecx + 5], al
mov ecx, dword [ebp - 0xc]
push edi
push edi
call fcn.100419b0
mov ecx, dword [edi + 4]
lea esi, [esi + 8]
mov eax, dword [edi]
add esp, 8
mov edx, dword [ebp - 0x10]
mov dword [ebx + 4], ecx
mov ecx, dword [ebp - 8]
add ecx, 8
mov dword [ebx], eax
sub dword [ebp + 8], 1
mov dword [ebp - 8], ecx
jne 0x10041bc0
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10041c50
Capabilities:
Encrypt data using camellia

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ecx]
mov ecx, dword [ecx + 4]
xor ecx, dword [edx + 4]
xor ebx, dword [edx]
mov eax, ecx
shr eax, 0x18
push esi
push edi
movzx esi, byte [eax + 0x10069a18]
mov eax, ecx
shr eax, 0x10
movzx eax, al
movzx edi, byte [eax + 0x10069918]
mov eax, esi
shl eax, 8
or edi, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl edi, 8
movzx eax, byte [eax + 0x100696b8]
or edi, eax
movzx eax, cl
shl edi, 8
mov ecx, dword [ebp + 8]
movzx eax, byte [eax + 0x10069818]
or edi, eax
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + 0x10069a18]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + 0x10069818]
shl eax, 8
or edx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + 0x10069918]
or edx, eax
movzx eax, bl
shl edx, 8
movzx eax, byte [eax + 0x100696b8]
or edx, eax
mov eax, edi
shl eax, 8
or eax, esi
xor edx, eax
mov eax, edx
ror eax, 0x10
xor edi, eax
mov eax, edi
ror eax, 8
xor edx, eax
mov eax, edx
ror eax, 8
xor eax, dword [ecx]
xor eax, edi
xor dword [ecx + 4], edx
pop edi
pop esi
mov dword [ecx], eax
pop ebx
pop ebp
ret