joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40616b
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call fcn.004063e6
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
test cl, 8
je 0x4061a2
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42f0a8], eax
jmp 0x4062fe
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
je 0x4061bc
test eax, eax
je 0x4062fe
test cl, 2
je 0x4062ba
mov esi, 0x42ca20
push ebx
push esi
call sub.KERNEL32.dll_lstrcpyA
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x4061de
push str..
push esi
call edi
jmp 0x4061e4
push ebx
call fcn.0040634d
push 0x409038
push ebx
call edi
push ebx
call sub.KERNEL32.dll_lstrlenA
mov edi, eax
lea eax, [ebp - 0x144]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4062b0
cmp byte [ebp - 0x118], 0x2e
jne 0x40622a
cmp byte [ebp - 0x117], 0x2e
je 0x406293
cmp byte [ebp - 0x117], 0
je 0x406293
lea eax, [ebp - 0x118]
push eax
push edi
call sub.KERNEL32.dll_lstrcpyA
mov eax, dword [ebp - 0x144]
test al, 0x10
je 0x406256
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x406293
push dword [ebp + 0xc]
push ebx
call fcn.0040616b
jmp 0x406293
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40628b
test byte [ebp + 0xc], 4
je 0x406283
push ebx
push 0xfffffffffffffff1
call fcn.00405bc1
push 0
push ebx
call fcn.0040653c
jmp 0x406293
inc dword [0x42f0a8]
jmp 0x406293
push ebx
push 0xfffffffffffffff2
call fcn.00405bc1
lea eax, [ebp - 0x144]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40620f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x4062ba
and byte [edi - 1], 0
xor esi, esi
cmp dword [ebp - 4], esi
je 0x4062fe
cmp dword [ebp + 8], esi
je 0x4062fe
push ebx
call fcn.00406305
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4062f6
test byte [ebp + 0xc], 4
je 0x4062ee
push ebx
push 0xfffffffffffffff1
call fcn.00405bc1
push esi
push ebx
call fcn.0040653c
jmp 0x4062fe
inc dword [0x42f0a8]
jmp 0x4062fe
push ebx
push 0xffffffffffffffe5
call fcn.00405bc1
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4063e6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42ce20
push esi
call sub.KERNEL32.dll_lstrcpyA
push esi
call fcn.00406399
test eax, eax
jne 0x406405
xor eax, eax
jmp 0x406454
test byte [0x42f030], 0x80
je 0x406419
mov cl, byte [eax]
test cl, cl
je 0x406401
cmp cl, 0x5c
je 0x406401
mov edi, eax
sub edi, esi
jmp 0x406433
call fcn.00406ae1
test eax, eax
je 0x40642d
test byte [eax], 0x10
je 0x406401
push esi
call fcn.0040634d
push esi
call sub.KERNEL32.dll_lstrlenA
cmp eax, edi
push esi
jg 0x40641f
call fcn.00406305
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x4064c5
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4064f4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x406538
test edi, edi
jne 0x4064ff
and byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x406532
Function at 0x40653c
Capabilities:
Get common file path
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
mov esi, dword [esp + 0x18]
je 0x406574
push str.MoveFileExA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406574
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x4066b9
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x42dba8], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x42dba8
je 0x4065b8
push 1
push 0
push esi
call fcn.004064c5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x4066bf
cmp eax, edi
jg 0x4066bf
mov esi, 0x42d7a8
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x4066bf
cmp eax, edi
jg 0x4066bf
push esi
push ebp
push str._s_s_r_n
push 0x42d3a8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebp, eax
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor edi, edi
push edi
push 0x8000080
push 4
push edi
push edi
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4066b9
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
lea eax, [esi + ebp + 0xa]
push eax
push edi
push 4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, edi
mov dword [esp + 0x14], eax
je 0x4066a1
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x406695
push str._Rename__r_n
push edi
call fcn.00406459
test eax, eax
jne 0x4066c6
lea eax, [edi + esi]
push str._Rename__r_n
push eax
call sub.KERNEL32.dll_lstrcpyA
add esi, 0xa
mov eax, esi
push ebp
add eax, edi
push 0x42d3a8
push eax
call fcn.004064a5
push edi
add esi, ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x42f0b0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
add eax, 0xa
push 0x409328
push eax
call fcn.00406459
test eax, eax
je 0x40667c
inc eax
lea edx, [edi + esi]
cmp eax, edx
mov ecx, eax
jae 0x4066ef
mov dl, byte [ecx]
mov byte [ecx + ebp], dl
inc ecx
lea edx, [edi + esi]
cmp ecx, edx
jb 0x4066e2
sub eax, edi
jmp 0x40667e
Function at 0x4066f3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406757
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406746
cmp dword [ebp + 0x14], 1
je 0x406748
cmp dword [ebp + 0x14], 2
je 0x406748
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
mov ecx, 0x73a80fbe
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x25d56084
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10006eb0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10209f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov dword [ebp - 0x30], ecx
movzx eax, word [ecx + 0x14]
lea ebx, [ecx + 0x18]
add ebx, eax
xor eax, eax
mov dword [ebp - 0x20], ebx
cmp ax, word [ecx + 6]
jae 0x10006ff9
nop word [eax + eax]
mov eax, ebx
mov dword [ebp - 0xc], 0
xorps xmm0, xmm0
mov dword [ebp - 8], 0
movups xmmword [ebp - 0x1c], xmm0
lea edx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10006f30
sub eax, edx
lea ecx, [ebp - 0x1c]
push eax
push ebx
call fcn.10016120
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
cmp ecx, 0xf
cmova eax, esi
cmp dword [ebp - 0xc], 5
jne 0x1000700e
cmp dword [eax], 0x7865742e
jne 0x1000700e
cmp byte [eax + 4], 0x74
jne 0x1000700e
mov edi, dword [ebx + 0xc]
xor ecx, ecx
add edi, dword [ebp - 0x28]
xor edx, edx
mov dword [ebp - 0x3c], ebx
mov ebx, dword [ebx + 8]
mov dword [ebp - 0x38], edi
test ebx, ebx
je 0x10006f9e
nop dword [eax]
movzx eax, byte [edi + edx]
inc edx
crc32 ecx, eax
cmp edx, ebx
jb 0x10006f90
mov edi, dword [ebp - 0x2c]
movq xmm0, qword [ebp - 0x3c]
movq qword [edi], xmm0
mov dword [edi + 8], ecx
mov ecx, dword [ebp - 8]
cmp ecx, 0xf
jbe 0x10006fda
inc ecx
mov eax, esi
cmp ecx, 0x1000
jb 0x10006fd0
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000703a
push ecx
push esi
call fcn.100f340e
add esp, 8
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
add ebx, 0x28
mov ecx, dword [ebp - 0x24]
inc ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ecx
movzx eax, word [eax + 6]
cmp ecx, eax
jl 0x10006f10
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100f3936
mov esp, ebp
pop ebp
ret 8
cmp ecx, 0xf
jbe 0x10006fdd
inc ecx
mov eax, esi
cmp ecx, 0x1000
jb 0x1000702e
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000703a
push ecx
push esi
call fcn.100f340e
add esp, 8
jmp 0x10006fdd
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x100084a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0x47], 0
je 0x10008634
movaps xmm5, xmmword [0x101fe310]
lea ecx, [ebx + 8]
movaps xmm6, xmmword [str.___abcdefghijkl]
mov edx, 0x64
movups xmm4, xmmword [0x101fe3b0]
mov dword [ebp - 8], ecx
sub edx, ebx
push esi
mov ecx, 0x62
mov dword [ebp - 4], 0x5d
sub ecx, ebx
mov dword [ebp - 0x14], edx
push edi
mov dword [ebp - 0xc], ecx
mov edi, 0x61
sub edi, ebx
mov esi, 0x63
sub esi, ebx
mov dword [ebp - 0x10], edi
mov ecx, 0x59
mov dword [ebp - 0x18], esi
sub ecx, ebx
xor eax, eax
sub dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
movd xmm0, eax
add ecx, ebx
pshufd xmm1, xmm0, 0
add edi, ebx
movd xmm0, dword [ebx - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
add eax, 0x10
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [ebp - 0x10]
andps xmm1, xmm4
movd xmm0, ecx
mov ecx, dword [ebp - 4]
packuswb xmm1, xmm1
add ecx, ebx
packuswb xmm1, xmm1
movd dword [ebx - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebx]
packuswb xmm1, xmm1
lea edx, [esi + ebx]
mov esi, dword [ebp - 0xc]
packuswb xmm1, xmm1
add esi, ebx
movd dword [ebx - 4], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm2, ecx
xorps xmm1, xmm0
mov ecx, dword [ebp - 0x1c]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [ebp - 0x14]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebx], xmm1
movd xmm0, dword [ebx + 4]
punpcklbw xmm0, xmm0
movd xmm1, esi
mov esi, dword [ebp - 0x18]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebx + 4], xmm3
add ebx, 0x10
cmp eax, 0x40
jb 0x10008514
mov ebx, dword [ebp - 0x20]
pop edi
pop esi
cmp eax, 0x46
jae 0x10008630
lea edx, [eax + ebx]
lea ecx, [eax + 0x5d]
inc eax
xor byte [edx], cl
cmp eax, 0x46
jb 0x10008622
mov byte [ebx + 0x47], 0
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015057d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x10209f80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
cmp byte [esi + 7], 0
je 0x10008692
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx + 0x5d]
inc edx
xor byte [ecx], al
cmp edx, 6
jb 0x10008680
mov byte [esi + 7], 0
lea eax, [ebp - 0xd]
push eax
lea eax, [esi + 6]
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.100157f0
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x100086b5
mov edi, dword [edi]
push eax
push edi
push 0
lea ecx, [ebp - 0x34]
call fcn.10018450
mov esi, dword [ebp - 0x14]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x20]
cmp ecx, 0xf
jbe 0x1000872f
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10008725
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10008725
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100f340e
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10008830
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, ecx
cmp byte [edi + 9], 0
je 0x100088a9
movups xmm4, xmmword [0x101fe3b0]
mov esi, 0x60
push ebx
lea ebx, [esi - 0x5e]
lea eax, [esi - 1]
movd xmm2, esi
lea edx, [esi - 3]
movd xmm0, eax
movd xmm3, edx
lea ecx, [esi - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + esi - 0x60]
punpcklbw xmm0, xmm0
movd xmm1, ecx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + esi - 0x60], xmm3
add esi, 4
sub ebx, 1
jne 0x10008850
pop ebx
mov byte [edi + 9], 0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [edi + 8]
push eax
push edi
call fcn.100157f0
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100088d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015057d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
push edi
mov eax, dword [0x10209f80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
cmp byte [esi + 0xa], 0
je 0x10008922
xor edx, edx
nop dword [eax]
lea ecx, [esi + edx]
lea eax, [edx + 0x5d]
inc edx
xor byte [ecx], al
cmp edx, 9
jb 0x10008910
mov byte [esi + 0xa], 0
lea eax, [ebp - 0xd]
push eax
lea eax, [esi + 9]
push eax
push esi
lea ecx, [ebp - 0x34]
call fcn.100157f0
mov dword [ebp - 4], 0
cmp dword [edi + 0x14], 0xf
mov eax, dword [edi + 0x10]
jbe 0x10008945
mov edi, dword [edi]
push eax
push edi
push 0
lea ecx, [ebp - 0x34]
call fcn.10018450
mov esi, dword [ebp - 0x14]
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x20]
cmp ecx, 0xf
jbe 0x100089bf
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100089b5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100089b5
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100f340e
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100089e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0x32], 0
je 0x10008b74
movaps xmm5, xmmword [0x101fe310]
lea ecx, [ebx + 8]
movaps xmm6, xmmword [str.___abcdefghijkl]
mov edx, 0x64
movups xmm4, xmmword [0x101fe3b0]
mov dword [ebp - 8], ecx
sub edx, ebx
push esi
mov ecx, 0x62
mov dword [ebp - 4], 0x5d
sub ecx, ebx
mov dword [ebp - 0x14], edx
push edi
mov dword [ebp - 0xc], ecx
mov edi, 0x61
sub edi, ebx
mov esi, 0x63
sub esi, ebx
mov dword [ebp - 0x10], edi
mov ecx, 0x59
mov dword [ebp - 0x18], esi
sub ecx, ebx
xor eax, eax
sub dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
movd xmm0, eax
add ecx, ebx
pshufd xmm1, xmm0, 0
add edi, ebx
movd xmm0, dword [ebx - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
add eax, 0x10
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [ebp - 0x10]
andps xmm1, xmm4
movd xmm0, ecx
mov ecx, dword [ebp - 4]
packuswb xmm1, xmm1
add ecx, ebx
packuswb xmm1, xmm1
movd dword [ebx - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebx]
packuswb xmm1, xmm1
lea edx, [esi + ebx]
mov esi, dword [ebp - 0xc]
packuswb xmm1, xmm1
add esi, ebx
movd dword [ebx - 4], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm2, ecx
xorps xmm1, xmm0
mov ecx, dword [ebp - 0x1c]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [ebp - 0x14]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebx], xmm1
movd xmm0, dword [ebx + 4]
punpcklbw xmm0, xmm0
movd xmm1, esi
mov esi, dword [ebp - 0x18]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebx + 4], xmm3
add ebx, 0x10
cmp eax, 0x30
jb 0x10008a54
mov ebx, dword [ebp - 0x20]
pop edi
pop esi
cmp eax, 0x31
jae 0x10008b70
lea edx, [eax + ebx]
lea ecx, [eax + 0x5d]
inc eax
xor byte [edx], cl
cmp eax, 0x31
jb 0x10008b62
mov byte [ebx + 0x32], 0
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10008c70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x10008c92
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax + 0x5d]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x10008c80
mov byte [esi + 8], 0
mov eax, esi
pop esi
ret
Function at 0x10008ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x10], 0
je 0x10008d27
movups xmm4, xmmword [0x101fe3b0]
push ebx
mov ebx, 0x60
lea eax, [ebx - 0x54]
lea ecx, [ebx - 1]
movd xmm2, ebx
lea esi, [ebx - 3]
movd xmm0, ecx
movd xmm3, esi
lea edx, [ebx - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + ebx - 0x60]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + ebx - 0x60], xmm3
add ebx, 4
cmp ebx, 0x6c
jb 0x10008cc0
pop ebx
lea edx, [edi + eax]
lea ecx, [eax + 0x5d]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x10008d15
mov byte [edi + 0x10], 0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [edi + 0xf]
push eax
push edi
call fcn.100157f0
mov eax, dword [ebp + 8]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10008d50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0x44], 0
je 0x10008ee4
movaps xmm5, xmmword [0x101fe310]
lea ecx, [ebx + 8]
movaps xmm6, xmmword [str.___abcdefghijkl]
mov edx, 0x64
movups xmm4, xmmword [0x101fe3b0]
mov dword [ebp - 8], ecx
sub edx, ebx
push esi
mov ecx, 0x62
mov dword [ebp - 4], 0x5d
sub ecx, ebx
mov dword [ebp - 0x14], edx
push edi
mov dword [ebp - 0xc], ecx
mov edi, 0x61
sub edi, ebx
mov esi, 0x63
sub esi, ebx
mov dword [ebp - 0x10], edi
mov ecx, 0x59
mov dword [ebp - 0x18], esi
sub ecx, ebx
xor eax, eax
sub dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
movd xmm0, eax
add ecx, ebx
pshufd xmm1, xmm0, 0
add edi, ebx
movd xmm0, dword [ebx - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
add eax, 0x10
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [ebp - 0x10]
andps xmm1, xmm4
movd xmm0, ecx
mov ecx, dword [ebp - 4]
packuswb xmm1, xmm1
add ecx, ebx
packuswb xmm1, xmm1
movd dword [ebx - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebx]
packuswb xmm1, xmm1
lea edx, [esi + ebx]
mov esi, dword [ebp - 0xc]
packuswb xmm1, xmm1
add esi, ebx
movd dword [ebx - 4], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm2, ecx
xorps xmm1, xmm0
mov ecx, dword [ebp - 0x1c]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [ebp - 0x14]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebx], xmm1
movd xmm0, dword [ebx + 4]
punpcklbw xmm0, xmm0
movd xmm1, esi
mov esi, dword [ebp - 0x18]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebx + 4], xmm3
add ebx, 0x10
cmp eax, 0x40
jb 0x10008dc4
mov ebx, dword [ebp - 0x20]
pop edi
pop esi
cmp eax, 0x43
jae 0x10008ee0
lea edx, [eax + ebx]
lea ecx, [eax + 0x5d]
inc eax
xor byte [edx], cl
cmp eax, 0x43
jb 0x10008ed2
mov byte [ebx + 0x44], 0
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret