joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e0880
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
push 0
push ebx
push eax
push ebp
push esi
call fcn.100e26f0
mov edi, eax
add esp, 0x14
test edi, edi
je 0x100e08dd
movzx ecx, word [ebp]
push ecx
push esi
call fcn.100da540
add esp, 8
test eax, eax
je 0x100e08bf
mov eax, dword [eax + 0x1c]
jmp 0x100e08c4
mov eax, str.unknown_tagname
push 0
push eax
push str.TIFFFetchStripThing
push edi
push esi
call fcn.100e2f00
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp dword [ebp + 0xc], 0
ja 0x100e09e4
jb 0x100e08f2
cmp dword [ebp + 8], ebx
jae 0x100e09e4
movzx eax, word [ebp]
push eax
push esi
call fcn.100da540
push str.LIBTIFF_STRILE_ARRAY_MAX_RESIZE_COUNT
mov edi, eax
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov ecx, eax
add esp, 0xc
mov eax, 0xf4240
test ecx, ecx
je 0x100e0922
push ecx
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
test edi, edi
je 0x100e092b
mov ecx, dword [edi + 0x1c]
jmp 0x100e0930
mov ecx, str.unknown_tagname
push ecx
cmp ebx, eax
jbe 0x100e0959
push str.Incorrect_count_for___s_
push str.TIFFFetchStripThing
push esi
call fcn.100dd770
push dword [esp + 0x2c]
push esi
call fcn.100cf410
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
push str.Incorrect_count_for___s___tag_ignored
push str.TIFFFetchStripThing
push esi
call fcn.100dd4c0
push str.for_strip_array
push 8
push ebx
push esi
call fcn.100de380
mov edi, eax
add esp, 0x20
test edi, edi
jne 0x100e0994
push dword [esp + 0x1c]
push esi
call fcn.100cf410
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [ebp + 8]
mov eax, ecx
or eax, dword [ebp + 0xc]
je 0x100e09b3
lea eax, [ecx*8]
push eax
push dword [esp + 0x20]
push edi
call fcn.100423a0
add esp, 0xc
mov eax, dword [ebp + 8]
sub ebx, eax
shl ebx, 3
push ebx
push 0
lea eax, [edi + eax*8]
push eax
call fcn.100d6a70
push dword [esp + 0x28]
push esi
call fcn.100cf410
mov eax, dword [esp + 0x34]
add esp, 0x14
mov dword [eax], edi
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov dword [eax], edi
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1010a150
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 8]
not eax
push esi
mov esi, dword [esp + 0x10]
push edi
cmp esi, 8
jbe 0x1010a226
test bl, 7
je 0x1010a189
nop
movzx ecx, byte [ebx]
dec esi
movzx edx, al
inc ebx
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101d37a8]
test bl, 7
jne 0x1010a170
mov edi, esi
and esi, 7
and edi, 0xfffffff8
add edi, ebx
cmp ebx, edi
jae 0x1010a226
nop dword [eax + eax]
xor eax, dword [ebx]
add ebx, 4
mov dword [esp + 0x18], ebx
add dword [esp + 0x18], 4
mov ebx, dword [ebx]
mov ecx, ebx
shr ecx, 0x10
movzx edx, cl
mov ecx, ebx
shr ecx, 8
movzx ecx, cl
mov edx, dword [edx*4 + 0x101d3ba8]
xor edx, dword [ecx*4 + 0x101d3fa8]
mov ecx, eax
shr ecx, 0x10
movzx ecx, cl
xor edx, dword [ecx*4 + 0x101d4ba8]
mov ecx, eax
shr ecx, 8
movzx ecx, cl
xor edx, dword [ecx*4 + 0x101d4fa8]
mov ecx, ebx
shr ecx, 0x18
xor edx, dword [ecx*4 + 0x101d37a8]
mov ecx, eax
shr ecx, 0x18
movzx eax, al
xor edx, dword [ecx*4 + 0x101d47a8]
movzx ecx, bl
mov ebx, dword [esp + 0x18]
xor edx, dword [ecx*4 + 0x101d43a8]
xor edx, dword [eax*4 + 0x101d53a8]
mov eax, edx
cmp ebx, edi
jb 0x1010a1a0
test esi, esi
je 0x1010a24a
nop word [eax + eax]
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101d37a8]
sub esi, 1
jne 0x1010a230
pop edi
pop esi
not eax
pop ebx
ret
Function at 0x10111790
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
push edi
mov eax, dword [esi + 0x1e4]
mov edx, dword [esi + 0xa94]
add eax, 0x355
and edx, dword [esp + 0x20]
shl eax, 4
add eax, edx
lea ecx, [esi + eax*2]
mov eax, dword [esi + 0x20]
cmp ebx, 0xffffffff
jne 0x101118fb
mov ebx, dword [esp + 0x14]
mov dword [esi + eax*4 + 0x28], 0
mov eax, dword [esi + 0x20]
push ebp
mov dword [esi + eax*4 + 0xfc], ecx
mov ebp, dword [esi + 0x20]
inc ebp
mov dword [esi + 0x20], ebp
mov edi, dword [ebx]
mov eax, edi
mov edx, dword [ebx + 0x18]
sub eax, edx
mov ecx, dword [ebx + 0x14]
mov dword [esp + 0x14], edx
movzx edx, byte [eax + ecx - 1]
mov ecx, 8
sub cl, byte [esi + 0xa98]
mov eax, dword [esi + 0xa9c]
and eax, dword [esp + 0x24]
shr edx, cl
mov ecx, dword [esi + 0xa98]
shl eax, cl
add edx, eax
mov eax, edi
sub eax, dword [ebx + 0x18]
imul ecx, edx, 0x600
mov edx, dword [ebx + 0x14]
movzx edx, byte [eax + edx]
add ecx, 0xaa0
add ecx, esi
cmp dword [esi + 0x1e4], 7
mov dword [esp + 0x24], ecx
jge 0x1011184e
push edx
push 8
push ecx
push esi
call fcn.10112a70
add esp, 0x10
jmp 0x101118af
sub edi, dword [esi + 0x1e8]
sub edi, dword [esp + 0x14]
mov eax, dword [ebx + 0x14]
mov ebx, 0x100
add edx, ebx
movzx edi, byte [edi + eax - 1]
mov eax, edx
add edi, edi
shr eax, 7
mov ecx, ebx
and eax, 1
and ecx, edi
mov dword [esi + ebp*4 + 0x28], eax
add ecx, ebx
mov eax, edx
add edx, edx
shr eax, 8
add eax, ecx
mov ecx, dword [esp + 0x24]
lea ecx, [ecx + eax*2]
mov eax, dword [esi + 0x20]
mov dword [esi + eax*4 + 0xfc], ecx
mov eax, edi
inc dword [esi + 0x20]
xor eax, edx
mov ebp, dword [esi + 0x20]
not eax
and ebx, eax
cmp edx, 0x10000
jb 0x10111867
mov ebx, dword [esp + 0x18]
mov eax, dword [esi + 0x1e4]
pop ebp
cmp eax, 3
jg 0x101118ce
xor eax, eax
mov dword [esi + 0x1e4], eax
mov eax, dword [esp + 0x1c]
sub dword [ebx + 0x18], eax
pop edi
pop esi
pop ebx
ret
cmp eax, 9
jg 0x101118e7
add eax, 0xfffffffd
mov dword [esi + 0x1e4], eax
mov eax, dword [esp + 0x1c]
sub dword [ebx + 0x18], eax
pop edi
pop esi
pop ebx
ret
add eax, 0xfffffffa
mov dword [esi + 0x1e4], eax
mov eax, dword [esp + 0x1c]
sub dword [ebx + 0x18], eax
pop edi
pop esi
pop ebx
ret
mov edi, dword [esp + 0x1c]
mov dword [esi + eax*4 + 0x28], 1
mov eax, dword [esi + 0x20]
push edi
mov dword [esi + eax*4 + 0xfc], ecx
mov eax, dword [esi + 0x20]
inc eax
mov dword [esi + 0x20], eax
mov ecx, dword [esi + 0x1e4]
add ecx, 0x3610
lea eax, [esi + eax*4]
lea ecx, [esi + ecx*2]
cmp ebx, 4
jae 0x1011195a
mov dword [eax + 0x28], 1
mov eax, dword [esi + 0x20]
push ebx
push edx
push esi
mov dword [esi + eax*4 + 0xfc], ecx
inc dword [esi + 0x20]
call fcn.10112d90
mov eax, dword [esp + 0x24]
add esp, 0x10
sub dword [eax + 0x18], edi
pop edi
pop esi
pop ebx
ret
mov dword [eax + 0x28], 0
mov eax, dword [esi + 0x20]
mov dword [esi + eax*4 + 0xfc], ecx
lea eax, [ebx - 4]
inc dword [esi + 0x20]
push eax
push edx
push esi
call fcn.10112920
mov eax, dword [esp + 0x24]
add esp, 0x10
sub dword [eax + 0x18], edi
pop edi
pop esi
pop ebx
ret
Function at 0x10111cc0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x1c]
push esi
push edi
xor esi, esi
mov edi, dword [ebx + 0x4804]
mov dword [ebx + eax*4 + 0x4808], edi
movzx ecx, word [ebx]
mov eax, ecx
mov dword [esp + 0xc], edi
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
movzx eax, byte [eax + 0x101d77a8]
movzx edx, byte [ecx + 0x101d77a8]
movzx ecx, word [ebx + 2]
mov dword [esp + 0x10], eax
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
movzx eax, byte [eax + 0x101d77a8]
add eax, edx
mov dword [esp + 0x14], eax
movzx eax, byte [ecx + 0x101d77a8]
mov ecx, dword [esp + 0x28]
add eax, edx
mov dword [esp + 0x1c], eax
imul eax, ecx, 0x440
add eax, 0x404
add eax, ebx
mov dword [esp + 0x24], eax
test edi, edi
je 0x10111e6c
lea eax, [ecx*8]
push ebp
mov dword [esp + 0x1c], eax
mov ebp, eax
nop dword [eax + eax]
cmp esi, 8
jae 0x10111dbd
xor edi, edi
lea edx, [esi + 8]
lea ebp, [ecx*8]
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
shr ecx, 4
lea eax, [edx + ebp]
and ecx, 0x7f
movzx eax, word [ebx + eax*2 + 4]
shr eax, 4
xor eax, ecx
movzx eax, byte [eax + 0x101d77a8]
add edi, eax
cmp edx, 1
jne 0x10111d71
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
add eax, edi
mov edi, dword [esp + 0x10]
mov dword [ecx + esi*4], eax
inc esi
mov ecx, dword [esp + 0x2c]
cmp esi, edi
jb 0x10111d60
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret
cmp esi, edi
jae 0x10111e6b
cmp esi, 0x10
jae 0x10111e1d
xor edi, edi
mov edx, esi
nop
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
shr ecx, 4
lea eax, [edx + ebp]
and ecx, 0x7f
movzx eax, word [ebx + eax*2 + 0x104]
shr eax, 4
xor eax, ecx
movzx eax, byte [eax + 0x101d77a8]
add edi, eax
cmp edx, 1
jne 0x10111dd0
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
add eax, edi
mov dword [ecx + esi*4], eax
inc esi
cmp esi, dword [esp + 0x10]
jb 0x10111dc5
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret
mov ebp, dword [esp + 0x28]
xor edi, edi
lea eax, [esi + 0xf0]
nop dword [eax]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x204]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
movzx ecx, byte [ecx + 0x101d77a8]
add edi, ecx
cmp eax, 1
jne 0x10111e30
mov eax, dword [esp + 0x20]
add eax, edi
mov dword [ebp + esi*4], eax
inc esi
cmp esi, dword [esp + 0x10]
jb 0x10111e21
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x10114b70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x24]
mov edx, 0x3700
mov dword [esp + 0x24], edx
lea esi, [edi + 0x10598]
lea ebp, [edi + 0x10194]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebp
nop dword [eax + eax]
mov eax, dword [edi + 0x10d94]
xor ebx, ebx
test eax, eax
je 0x10114c04
nop dword [eax]
mov ebp, dword [esp + 0x24]
lea eax, [ebx + 0x40]
xor esi, esi
nop dword [eax]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
lea ecx, [eax + ebp]
and edx, 0x7f
movzx ecx, word [edi + ecx*2]
shr ecx, 4
xor ecx, edx
movzx ecx, byte [ecx + 0x101d77a8]
add esi, ecx
cmp eax, 1
jne 0x10114bc0
mov ebp, dword [esp + 0x10]
mov dword [ebp + ebx*4], esi
inc ebx
mov eax, dword [edi + 0x10d94]
cmp ebx, eax
jb 0x10114bb0
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x14]
mov ecx, 0xe
cmp eax, ecx
jbe 0x10114c27
nop dword [eax]
mov eax, ecx
shr eax, 1
shl eax, 4
sub eax, 0x50
add dword [ebp + ecx*4], eax
inc ecx
cmp ecx, dword [edi + 0x10d94]
jb 0x10114c10
mov eax, dword [ebp]
add edx, 0x40
mov dword [esi - 4], eax
mov eax, dword [ebp + 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
add ebp, 0x100
mov dword [esi + 8], eax
add esi, 0x200
mov dword [esp + 0x24], edx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], esi
cmp edx, 0x3800
jb 0x10114ba0
mov ebp, 4
lea eax, [edi + 0x107a4]
mov dword [esp + 0x24], ebp
mov dword [esp + 0x18], eax
nop dword [eax + eax]
movzx ebx, byte [ebp + 0x101d7828]
mov eax, ebx
mov edx, ebx
shr eax, 1
and edx, 1
dec eax
or edx, 2
mov ecx, eax
mov dword [esp + 0x10], eax
shl edx, cl
mov eax, 1
mov ecx, dword [esp + 0x24]
sub ebp, edx
mov dword [esp + 0x1c], edx
xor esi, esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], ecx
sub eax, ebx
mov edx, ebp
add eax, dword [esp + 0x1c]
and edx, 1
shr ebp, 1
movzx ecx, word [edi + eax*2 + 0x6ffe]
mov eax, edx
neg eax
shr ecx, 4
shr eax, 4
and eax, 0x7f
xor ecx, eax
movzx eax, byte [ecx + 0x101d77a8]
add esi, eax
sub dword [esp + 0x10], 1
mov eax, dword [esp + 0x14]
lea eax, [edx + eax*2]
mov dword [esp + 0x14], eax
jne 0x10114cb5
mov edx, dword [esp + 0x18]
mov eax, dword [edi + ebx*4 + 0x10194]
mov ebp, dword [esp + 0x24]
add eax, esi
inc ebp
mov dword [edx - 0x200], eax
mov eax, dword [edi + ebx*4 + 0x10294]
add eax, esi
mov dword [esp + 0x24], ebp
mov dword [edx], eax
mov eax, dword [edi + ebx*4 + 0x10394]
add eax, esi
mov dword [edx + 0x200], eax
mov eax, dword [edi + ebx*4 + 0x10494]
add eax, esi
mov dword [edx + 0x400], eax
add edx, 4
mov dword [esp + 0x18], edx
cmp ebp, 0x80
jb 0x10114c80
mov dword [edi + 0x10d98], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x10114d60
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ecx, 8
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
mov edx, dword [edi + 0xa98]
lea ebp, [edi + 0xaa0]
mov eax, dword [edi + 0xa9c]
sub ecx, edx
and eax, dword [esp + 0x18]
shr esi, cl
mov ecx, edx
shl eax, cl
add esi, eax
imul eax, esi, 0x600
add ebp, eax
cmp byte [esp + 0x20], bl
jne 0x10114db5
push dword [esp + 0x28]
push 8
push ebp
call fcn.101164c0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret
mov edx, dword [esp + 0x28]
mov esi, 0x100
mov edi, dword [esp + 0x24]
add edx, esi
add edi, edi
mov ecx, esi
and ecx, edi
mov eax, edx
shr eax, 8
add ecx, esi
add eax, ecx
movzx ecx, word [ebp + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
shr eax, 4
and eax, 0x7f
xor ecx, eax
movzx eax, byte [ecx + 0x101d77a8]
mov ecx, edi
xor ecx, edx
add ebx, eax
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x10114dc4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x101164c0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, 1
shl eax, cl
mov ecx, dword [esp + 0xc]
push esi
push edi
xor edi, edi
add ecx, eax
mov eax, dword [esp + 0xc]
nop dword [eax]
mov esi, ecx
shr ecx, 1
and esi, 1
neg esi
shr esi, 4
movzx edx, word [eax + ecx*2]
and esi, 0x7f
shr edx, 4
xor edx, esi
movzx edx, byte [edx + 0x101d77a8]
add edi, edx
cmp ecx, 1
jne 0x101164e0
mov eax, edi
pop edi
pop esi
ret
Function at 0x1012d000
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
mov eax, dword [ebx - 4]
test ebp, ebp
jle 0x1012d06a
mov ecx, dword [esp + 0xc]
sub ecx, ebx
push esi
mov dword [esp + 0x10], ecx
push edi
nop dword [eax]
mov esi, dword [ecx + ebx]
lea ebx, [ebx + 4]
mov ecx, eax
mov edi, esi
and edi, 0xffff00ff
and ecx, 0xffff00ff
add edi, ecx
mov edx, esi
movzx ecx, ax
and edx, 0xff00
add edx, ecx
and eax, 0xff00ffff
mov ecx, dword [esp + 0x14]
xor edi, edx
and esi, 0xff00ff00
and edi, 0xff00ff
add eax, esi
xor eax, edi
mov dword [ebx - 4], eax
sub ebp, 1
jne 0x1012d020
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x1012da20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
lea edi, [esi + eax*4]
cmp esi, edi
jae 0x1012da73
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [esi]
lea eax, [eax + 2]
mov edx, ebx
mov ecx, ebx
shr edx, 0x10
add esi, 4
shr ecx, 0xd
xor dl, cl
mov ecx, ebx
and dl, 7
shr ecx, 0x10
xor dl, cl
mov ecx, ebx
mov byte [eax - 2], dl
mov edx, ebx
shr edx, 5
shr ecx, 3
xor dl, cl
shr ebx, 5
and dl, 0x1f
xor dl, bl
mov byte [eax - 1], dl
cmp esi, edi
jb 0x1012da36
pop ebx
pop edi
pop esi
ret

Function at 0x1012da80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
push edi
lea edi, [esi + eax*4]
cmp esi, edi
jae 0x1012dac9
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [esi]
lea eax, [eax + 2]
mov edx, ebx
mov ecx, ebx
shr ecx, 0xc
add esi, 4
shr edx, 0x10
xor dl, cl
mov ecx, ebx
shr ecx, 0x10
and dl, 0xf
xor dl, cl
mov ecx, ebx
shr ecx, 0x1c
and bl, 0xf0
or cl, bl
mov byte [eax - 2], dl
mov byte [eax - 1], cl
cmp esi, edi
jb 0x1012da96
pop ebx
pop edi
pop esi
ret
Function at 0x10135b30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x38
mov eax, dword [0x101e900c]
xor eax, esp
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x3c]
push ebx
push esi
mov dword [esp + 0x1c], eax
mov ebx, dword [eax + 0x28]
mov esi, dword [eax + 0x2c]
mov eax, esi
imul eax, ebx
push 1
mov dword [esp + 0x14], ebx
cdq
push edx
push eax
call fcn.1011cfd0
add esp, 0xc
mov dword [esp + 0x28], eax
test eax, eax
je 0x10135d05
push ebp
dec esi
lea ebp, [ebx - 1]
mov dword [esp + 0x24], ebp
cmp esi, 1
jle 0x10135cfb
inc eax
lea ecx, [ebx*8]
add eax, ebx
mov dword [esp + 0x10], ecx
dec esi
mov dword [esp + 0x18], eax
lea edx, [ecx + 8]
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], edx
mov dword [esp + 0xc], esi
push edi
cmp ebp, 1
jle 0x10135c78
mov esi, eax
mov edi, edx
dec ebp
mov eax, dword [esp + 0x24]
xorps xmm0, xmm0
movups xmmword [esp + 0x34], xmm0
mov edx, dword [eax + 0x588c]
add edx, edi
mov ecx, edx
sub ecx, dword [esp + 0x14]
mov ebx, dword [edx]
shr ebx, 5
mov eax, dword [ecx - 8]
and ebx, 3
shr eax, 5
and eax, 3
inc dword [esp + eax*4 + 0x34]
mov eax, dword [ecx]
shr eax, 5
and eax, 3
inc dword [esp + eax*4 + 0x34]
mov eax, dword [ecx + 8]
shr eax, 5
and eax, 3
mov ecx, dword [esp + 0x14]
inc dword [esp + eax*4 + 0x34]
mov eax, dword [edx - 8]
shr eax, 5
and eax, 3
inc dword [esp + eax*4 + 0x34]
mov eax, dword [edx + 8]
shr eax, 5
and eax, 3
inc dword [esp + eax*4 + 0x34]
mov eax, dword [ecx + edx - 8]
shr eax, 5
and eax, 3
inc dword [esp + eax*4 + 0x34]
mov eax, dword [ecx + edx]
shr eax, 5
and eax, 3
inc dword [esp + eax*4 + 0x34]
mov eax, dword [ecx + edx + 8]
shr eax, 5
and eax, 3
inc dword [esp + eax*4 + 0x34]
xor eax, eax
cmp dword [esp + eax*4 + 0x34], 5
jge 0x10135c53
inc eax
cmp eax, 4
jl 0x10135c44
jmp 0x10135c55
mov ebx, eax
mov byte [esi], bl
add edi, 8
inc esi
sub ebp, 1
jne 0x10135bb3
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x28]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
add eax, ebx
add edx, ecx
sub esi, 1
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x10], esi
jne 0x10135ba5
mov eax, ebx
lea edi, [ecx + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], edi
nop
mov edx, 1
cmp ebp, edx
jle 0x10135ce7
mov esi, edi
mov edi, dword [esp + 0x24]
nop
mov ebp, dword [esp + 0x30]
lea eax, [ebx + edx]
mov ecx, dword [edi + 0x588c]
lea esi, [esi + 8]
inc edx
movzx eax, byte [eax + ebp]
mov ebp, dword [esp + 0x28]
shl eax, 5
xor eax, dword [ecx + esi - 8]
and eax, 0x60
xor dword [ecx + esi - 8], eax
cmp edx, ebp
jl 0x10135cb0
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
add edi, ecx
add ebx, eax
sub dword [esp + 0x2c], 1
mov dword [esp + 0x10], edi
jne 0x10135ca0
mov eax, dword [esp + 0x30]
pop edi
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
pop ebp
mov ecx, dword [esp + 0x3c]
pop esi
pop ebx
xor ecx, esp
call fcn.101044b9
add esp, 0x38
ret
Function at 0x10153810
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [0x101e900c]
xor eax, esp
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
movaps xmm0, xmmword [0x1016eb30]
push ebx
push ebp
mov ebx, dword [ecx + 0x18]
mov ebp, 1
mov dword [esp + 0x14], ecx
push esi
mov esi, ebp
mov dword [esp + 0x10], esi
movups xmmword [esp + 0x1c], xmm0
cmp ebx, 4
jge 0x10153852
cmp ebx, ebp
jle 0x1015395a
jmp 0x10153857
mov ebx, 4
push edi
lea eax, [ecx + 0x480]
lea edi, [ecx + 0x72c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], edi
nop dword [eax]
xor edx, edx
test ebp, ebp
jle 0x101538a1
mov eax, dword [edi - 4]
add ecx, 0x444
nop
cmp eax, dword [ecx - 4]
jne 0x1015388e
mov eax, dword [edi]
cmp eax, dword [ecx]
je 0x1015389b
mov eax, dword [edi - 4]
inc edx
add ecx, 0x2e8
cmp edx, ebp
jl 0x10153880
jmp 0x101538a3
mov dword [esp + esi*4 + 0x20], edx
jmp 0x101538d6
xor edx, edx
lea eax, [esp + 0x20]
mov dword [eax + esi*4], edx
lea eax, [eax + esi*4]
mov eax, dword [esp + 0x10]
cmp ebp, esi
je 0x101538cc
lea esi, [edi - 0x2ac]
mov ecx, 0xba
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
inc ebp
add eax, 0x2e8
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x1c]
inc esi
add edi, 0x2e8
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
cmp esi, ebx
jl 0x10153870
cmp ebp, ebx
jge 0x10153959
mov edi, ecx
mov esi, dword [edi + 0x2c]
imul esi, dword [edi + 0x28]
test esi, esi
jle 0x10153929
nop
mov eax, dword [edi + 0x588c]
dec esi
mov ecx, dword [eax + esi*8]
lea edx, [eax + esi*8]
mov eax, ecx
shr eax, 5
and eax, 3
mov eax, dword [esp + eax*4 + 0x20]
shl eax, 5
xor eax, ecx
and eax, 0x60
xor eax, ecx
mov dword [edx], eax
test esi, esi
jg 0x10153900
imul eax, ebp, 0x2e8
mov dword [edi + 0x18], ebp
lea edx, [eax + edi]
add eax, 0x198
add eax, edi
sub ebx, ebp
nop
mov edi, eax
lea esi, [edx - 0x150]
mov ecx, 0xba
add eax, 0x2e8
rep movsd dword es:[edi], dword [esi]
sub ebx, 1
jne 0x10153940
pop edi
mov ecx, dword [esp + 0x2c]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101044b9
add esp, 0x24
ret
Function at 0x10154ef0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 4]
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [ebp]
lea eax, [eax + esi*2]
add eax, esi
imul ecx, eax, 0x2c
mov eax, dword [ebp + 4]
add ecx, dword [ebp + 0x14]
test eax, eax
jns 0x10154f2c
mov eax, dword [ecx]
cmp eax, 0xfffe0000
jb 0x10154f20
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
pop esi
mov dword [ecx], eax
xor eax, eax
pop ebp
ret
cmp esi, eax
jg 0x10155087
push ebx
push edi
mov edi, 2
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, 0xfffe0000
jb 0x10154f51
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10001
mov dword [ecx], eax
mov eax, dword [ebp + 8]
movsx edx, word [eax + esi*2]
test edx, edx
jne 0x10154f99
mov eax, dword [ecx + 4]
inc esi
cmp eax, 0xfffe0000
jb 0x10154f76
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
mov dword [ecx + 4], eax
movzx eax, byte [esi + 0x101dce60]
imul ecx, eax, 0x84
mov eax, dword [ebp + 8]
movsx edx, word [eax + esi*2]
add ecx, dword [ebp + 0x14]
test edx, edx
je 0x10154f63
mov eax, dword [ecx + 4]
inc esi
cmp eax, 0xfffe0000
jb 0x10154fac
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10001
lea ebx, [edx + 1]
cmp edi, ebx
mov dword [ecx + 4], eax
mov eax, dword [ecx + 8]
sbb edi, edi
neg edi
cmp eax, 0xfffe0000
jb 0x10154fcf
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
add eax, edi
mov dword [ecx + 8], eax
cmp ebx, 2
ja 0x10154ff3
movzx eax, byte [esi + 0x101dce60]
imul ecx, eax, 0x84
add ecx, 0x2c
jmp 0x10155074
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, 0x43
cmp eax, 0x43
cmovg eax, edx
xor edi, edi
movzx ebx, word [eax*4 + 0x101de874]
shr ebx, 1
movzx edx, word [eax*4 + 0x101de876]
mov dword [esp + 0x14], edx
je 0x10155064
mov ebp, dword [esp + 0x14]
lea edx, [ecx + 0xc]
test bl, 1
je 0x10155058
mov ecx, edi
mov eax, 2
shl eax, cl
mov ecx, dword [edx]
and eax, ebp
neg eax
sbb eax, eax
neg eax
cmp ecx, 0xfffe0000
jb 0x1015504f
inc ecx
shr ecx, 1
and ecx, 0x7fff7fff
add eax, 0x10000
add eax, ecx
mov dword [edx], eax
inc edi
add edx, 4
sar ebx, 1
jne 0x10155026
mov ebp, dword [esp + 0x18]
movzx eax, byte [esi + 0x101dce60]
imul ecx, eax, 0x84
add ecx, 0x58
add ecx, dword [ebp + 0x14]
mov edi, 2
cmp esi, dword [ebp + 4]
jle 0x10154f40
pop edi
pop ebx
cmp esi, 0x10
jge 0x101550a4
mov eax, dword [ecx]
cmp eax, 0xfffe0000
jb 0x1015509d
inc eax
shr eax, 1
and eax, 0x7fff7fff
add eax, 0x10000
mov dword [ecx], eax
pop esi
mov eax, 1
pop ebp
ret