joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e7d8
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x80000000
jb 0x42e820
cmp dword [ebp - 0x10], 0xa0000000
jae 0x42e820
cmp byte [0x43696c], 1
ja 0x42e820
mov eax, dword [ebp - 0x10]
sub eax, 0x80000000
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], eax
jmp 0x42e8c5
mov eax, dword [ebp - 0x10]
shr eax, 0x16
shl eax, 2
add eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
test byte [ebp - 0x14], 1
je 0x42e8c5
mov eax, dword [ebp - 0x14]
and eax, 0x80
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x42e864
mov eax, dword [ebp - 0x14]
and eax, 0xffc00000
mov edx, dword [ebp - 0x10]
and edx, 0x3fffff
add eax, edx
mov dword [ebp - 0x1c], eax
jmp 0x42e8bf
push 0x1000
mov eax, dword [ebp - 0x14]
and eax, 0xfffff000
push eax
push 0
push 4
mov eax, dword [0x4349c0]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
and eax, 0x3ff000
shr eax, 0xc
shl eax, 2
add eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
test byte [ebp - 0x18], 1
je 0x42e8c5
mov eax, dword [ebp - 0x18]
and eax, 0xfffff000
mov edx, dword [ebp - 0x10]
and edx, 0xfff
add eax, edx
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x42e8cc
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
mov eax, dword [0x4349bc]
call fcn.0042e7d8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42e989
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
push 0x1000
mov eax, dword [ebp - 0x10]
and eax, 0xfffff000
push eax
push 0
push 6
mov eax, dword [0x4349c0]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42e989
xor eax, eax
push ebp
push 0x42e982
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x42e961
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
and eax, 0xfff
shr eax, 2
shl eax, 2
add eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42e96b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42e989
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42ed88
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov eax, dword [ebp - 0xc]
call sub.rtl60.bpl__System__GetMem_qqri
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryA
mov dword [ebp - 8], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 0
je 0x42edd7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wininet.dll_DeleteUrlCacheEntry
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__FreeMem_qqrpv
cmp dword [ebp - 0x10], 0x103
je 0x42ee4b
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_FindNextUrlCacheEntryA
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x42ee42
mov eax, dword [ebp - 0xc]
call sub.rtl60.bpl__System__GetMem_qqri
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_FindNextUrlCacheEntryA
test eax, eax
je 0x42ee3a
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wininet.dll_DeleteUrlCacheEntry
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__FreeMem_qqrpv
cmp dword [ebp - 0x10], 0x103
jne 0x42ede8
mov esp, ebp
pop ebp
ret

Function at 0x42ee50
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42eeb7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x24], 0x20
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x18]
shr eax, 0xa
shr eax, 0xa
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x28]
call sub.rtl60.bpl__Sysutils_IntToStr_qqrj
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
mov ecx, 0x42eecc
call sub.rtl60.bpl__System__LStrCat3_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42eebe
lea eax, [ebp - 0x28]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret
Function at 0x45b6e9
Capabilities:
Query environment variable

Disassembly:
jmp 0x4f4f60
mov edi, edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4f4f74
xor edi, edi
jmp 0x4f4fb8
push ebx
push esi
call fcn.004f4e59
push 0x40
mov ebx, eax
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
sub ebx, esi
and ebx, 0xfffffffe
push 2
push ebx
call fcn.0045c940
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4f4fa5
push ebx
push esi
push edi
call fcn.0045ca8a
add esp, 0xc
push 2
push 0
call fcn.0045c558
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
pop ebx
mov eax, edi
pop edi
pop esi
ret

Function at 0x45c607
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x5122f0
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x54335c], 1
jge 0x51235f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x512335
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x512335
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x512312
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x51234b
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x512352
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x51244f
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x512420
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x512415
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x512409
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x512410
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x51244f
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x51244a
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x512433
mov eax, dword [ebx + 8]
jmp 0x51244f
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x512441
xor eax, eax
jmp 0x51244f
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x51237f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10002480
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [esp + 0x50]
mov ebx, dword [esp + 0x58]
mov eax, dword [esp + 0x5c]
mov esi, dword [esp + 0x54]
add edi, 0x10
mov dword [esp + 0x24], edi
mov edi, dword [esp + 0x50]
add eax, ebx
mov dword [esp + 0x20], eax
add edi, 0x30
cmp ebx, eax
mov dword [esp + 0x2c], edi
jae 0x1000251b
lea esi, [esi]
lea esi, [esi]
mov eax, dword [esp + 0x50]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x10002528
mov ecx, dword [esp + 0x20]
mov ebp, 0x10
mov edi, dword [esp + 0x24]
sub ebp, eax
add ebp, ebx
mov edx, dword [esp + 0x50]
add edi, eax
cmp ecx, ebp
cmovbe ebp, ecx
mov ecx, ebp
sub ecx, ebx
add eax, ecx
and eax, 0xf
cmp ebx, ebp
mov dword [edx + 0x20], eax
jae 0x10002513
xor eax, eax
lea esi, [esi]
movzx edx, byte [ebx + eax]
xor dl, byte [edi + eax]
mov byte [esi + eax], dl
inc eax
cmp ecx, eax
jne 0x10002500
add esi, ecx
mov ebx, ebp
mov eax, dword [esp + 0x20]
cmp ebx, eax
jb 0x100024c0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
xor edx, edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x50]
mov ecx, 1
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sym.avutil_lav_57.dll_mv_aes_crypt
mov eax, dword [esp + 0x50]
mov edi, dword [esp + 0x50]
movzx eax, byte [eax + 0xf]
mov byte [esp + 0x2b], al
inc al
mov byte [edi + 0xf], al
mov eax, edi
jne 0x10002603
movzx eax, byte [edi + 0xe]
mov edi, dword [esp + 0x50]
mov byte [esp + 0x2b], al
inc al
mov byte [edi + 0xe], al
mov eax, edi
jne 0x10002603
movzx eax, byte [edi + 0xd]
mov byte [esp + 0x2b], al
mov dl, al
mov eax, dword [esp + 0x50]
inc dl
mov byte [eax + 0xd], dl
mov eax, dword [eax + 0x20]
jne 0x100024cb
movzx ecx, byte [edi + 0xc]
mov byte [esp + 0x2b], cl
mov dl, cl
inc dl
mov byte [edi + 0xc], dl
jne 0x100024cb
movzx ecx, byte [edi + 0xb]
mov byte [esp + 0x2b], cl
mov dl, cl
inc dl
mov byte [edi + 0xb], dl
jne 0x100024cb
movzx ecx, byte [edi + 0xa]
mov byte [esp + 0x2b], cl
mov dl, cl
inc dl
mov byte [edi + 0xa], dl
jne 0x100024cb
movzx ecx, byte [edi + 9]
mov byte [esp + 0x2b], cl
mov dl, cl
inc dl
mov byte [edi + 9], dl
jne 0x100024cb
inc byte [edi + 8]
jmp 0x100024cb
mov eax, dword [eax + 0x20]
jmp 0x100024cb
Function at 0x100078d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
push ebx
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
cmp ecx, 0x3ffffffe
ja 0x10007a10
lea edx, [ecx + 2]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
shl edx, 2
cmp edx, dword [esp + 0x18]
jge 0x10007a10
cmp ecx, 3
jle 0x10007a28
mov edi, ebx
mov eax, dword [esi]
sub ecx, 3
add edi, 4
add esi, 3
mov dl, al
mov ebp, eax
shr dl, 2
bswap ebp
shr eax, 0x10
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi - 4], dl
mov edx, ebp
shr edx, 0x14
shr ebp, 0xe
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and ebp, 0x3f
mov byte [edi - 3], dl
movzx edx, byte [ebp + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi - 2], dl
cmp ecx, 3
mov byte [edi - 1], al
jg 0x10007910
cmp ecx, 1
movzx edx, byte [esi]
je 0x10007987
movzx eax, byte [esi + 1]
shl edx, 8
add edx, eax
cmp ecx, 2
je 0x10007987
movzx eax, byte [esi + 2]
shl edx, 8
add edx, eax
lea eax, [ecx*8]
mov esi, edx
shl esi, 6
mov cl, al
mov ebp, esi
shr ebp, cl
mov ecx, ebp
mov ebp, esi
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], cl
lea ecx, [eax - 6]
shr ebp, cl
mov ecx, ebp
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 1], cl
lea ecx, [eax - 0xc]
test ecx, ecx
jle 0x10007a20
shr esi, cl
and esi, 0x3f
cmp eax, 0x12
movzx ecx, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 2], cl
jle 0x10007a38
lea eax, [edi + 4]
and edx, 0x3f
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi + 3], cl
jmp 0x100079f4
mov byte [eax], 0x3d
inc eax
mov edx, eax
sub edx, ebx
test dl, 3
jne 0x100079f0
mov byte [eax], 0
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
pop ebx
xor eax, eax
pop esi
pop edi
pop ebp
ret
lea eax, [edi + 2]
jmp 0x100079f4
test ecx, ecx
jne 0x10007a3d
mov eax, ebx
nop
jmp 0x100079fd
lea eax, [edi + 3]
jmp 0x100079f4
mov edi, ebx
nop
jmp 0x10007968
Function at 0x1000fa00
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
push ebx
mov ebx, eax
lea esi, [esi]
lea esi, [esi]
mov eax, esi
mov edx, esi
shr edx, 1
and eax, 1
neg eax
and eax, ecx
xor eax, edx
mov edx, eax
and eax, 1
shr edx, 1
neg eax
and eax, ecx
xor edx, eax
mov eax, edx
and edx, 1
shr eax, 1
neg edx
and edx, ecx
xor eax, edx
mov edx, eax
and eax, 1
shr edx, 1
neg eax
and eax, ecx
xor edx, eax
mov eax, edx
and edx, 1
shr eax, 1
neg edx
and edx, ecx
xor eax, edx
mov edx, eax
and eax, 1
shr edx, 1
neg eax
and eax, ecx
xor edx, eax
mov eax, edx
and edx, 1
shr eax, 1
neg edx
and edx, ecx
xor eax, edx
mov edx, eax
and eax, 1
shr edx, 1
neg eax
and eax, ecx
xor edx, eax
mov dword [ebx + esi*4], edx
inc esi
cmp esi, 0x100
jne 0x1000fa10
mov eax, 1
mov edx, ebx
mov dword [ebx + 0x400], eax
lea ecx, [ebx + 0x400]
lea esi, [esi]
mov eax, dword [edx]
add edx, 4
movzx esi, al
shr eax, 8
xor eax, dword [ebx + esi*4]
mov dword [edx + 0x3fc], eax
movzx esi, al
shr eax, 8
xor eax, dword [ebx + esi*4]
mov dword [edx + 0x7fc], eax
movzx esi, al
shr eax, 8
xor eax, dword [ebx + esi*4]
mov dword [edx + 0xbfc], eax
cmp ecx, edx
jne 0x1000faa0
pop ebx
xor eax, eax
pop esi
ret

Function at 0x1000fae0
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov ebx, eax
mov eax, edx
mov edx, ecx
mov ecx, 0x20
sub ecx, eax
xor eax, eax
shl edx, cl
xor ecx, ecx
jmp 0x1000fb60
mov eax, ecx
mov esi, ecx
shl eax, 0x18
sar eax, 0x1f
shl esi, 0x19
and eax, edx
xor eax, esi
mov esi, eax
add eax, eax
sar esi, 0x1f
and esi, edx
xor esi, eax
mov eax, esi
add esi, esi
sar eax, 0x1f
and eax, edx
xor eax, esi
mov esi, eax
add eax, eax
sar esi, 0x1f
and esi, edx
xor esi, eax
mov eax, esi
add esi, esi
sar eax, 0x1f
and eax, edx
xor eax, esi
mov esi, eax
add eax, eax
sar esi, 0x1f
and esi, edx
xor esi, eax
mov eax, esi
add esi, esi
sar eax, 0x1f
and eax, edx
xor eax, esi
mov esi, eax
add eax, eax
sar esi, 0x1f
and esi, edx
xor eax, esi
bswap eax
mov dword [ebx + ecx*4], eax
inc ecx
cmp ecx, 0x100
jne 0x1000fb00
mov eax, 1
mov edx, ebx
mov dword [ebx + 0x400], eax
lea ecx, [ebx + 0x400]
nop
mov eax, dword [edx]
add edx, 4
movzx esi, al
shr eax, 8
xor eax, dword [ebx + esi*4]
mov dword [edx + 0x3fc], eax
movzx esi, al
shr eax, 8
xor eax, dword [ebx + esi*4]
mov dword [edx + 0x7fc], eax
movzx esi, al
shr eax, 8
xor eax, dword [ebx + esi*4]
mov dword [edx + 0xbfc], eax
cmp edx, ecx
jne 0x1000fb80
pop ebx
xor eax, eax
pop esi
ret
Function at 0x1000fbc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xc
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
lea edx, [ecx - 8]
cmp edx, 0x18
ja 0x1000fda1
mov dword [esp], eax
movzx edi, cl
xor edx, edx
mov dword [esp + 4], edx
shr edi, 5
and edi, 1
mov edx, dword [esp + 4]
mov esi, edi
shl edi, cl
xor esi, 1
shl esi, cl
cmp eax, esi
sbb edx, edi
jge 0x1000fda1
cmp dword [esp + 0x30], 0x404
je 0x1000fc24
cmp dword [esp + 0x30], 0x1000
jne 0x1000fda1
mov edx, 0x20
mov esi, eax
sub edx, ecx
mov cl, dl
shl esi, cl
xor ecx, ecx
lea esi, [esi]
lea esi, [esi]
test ebp, ebp
je 0x1000fce0
mov edx, ecx
mov edi, ecx
shr edi, 1
and edx, 1
neg edx
and edx, eax
xor edx, edi
mov edi, edx
and edx, 1
shr edi, 1
neg edx
and edx, eax
xor edi, edx
mov edx, edi
and edi, 1
shr edx, 1
neg edi
and edi, eax
xor edx, edi
mov edi, edx
and edx, 1
shr edi, 1
neg edx
and edx, eax
xor edi, edx
mov edx, edi
and edi, 1
shr edx, 1
neg edi
and edi, eax
xor edx, edi
mov edi, edx
and edx, 1
shr edi, 1
neg edx
and edx, eax
xor edi, edx
mov edx, edi
and edi, 1
shr edx, 1
neg edi
and edi, eax
xor edx, edi
mov edi, edx
and edx, 1
shr edi, 1
neg edx
and edx, eax
xor edi, edx
mov dword [ebx + ecx*4], edi
inc ecx
cmp ecx, 0x100
jne 0x1000fc40
cmp dword [esp + 0x30], 0x1000
mov ebp, 1
mov dword [ebx + 0x400], ebp
je 0x1000fd4a
xor eax, eax
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, ecx
mov edx, ecx
shl eax, 0x18
sar eax, 0x1f
shl edx, 0x19
and eax, esi
xor eax, edx
lea edx, [eax + eax]
sar eax, 0x1f
and eax, esi
xor edx, eax
lea eax, [edx + edx]
sar edx, 0x1f
and edx, esi
xor eax, edx
lea edx, [eax + eax]
sar eax, 0x1f
and eax, esi
xor edx, eax
lea eax, [edx + edx]
sar edx, 0x1f
and edx, esi
xor eax, edx
lea edx, [eax + eax]
sar eax, 0x1f
and eax, esi
xor edx, eax
lea eax, [edx + edx]
sar edx, 0x1f
and edx, esi
xor eax, edx
lea edx, [eax + eax]
sar eax, 0x1f
and eax, esi
xor eax, edx
bswap eax
mov dword [ebx + ecx*4], eax
inc ecx
cmp ecx, 0x100
jne 0x1000fce0
jmp 0x1000fcbe
lea ecx, [ebx + 0x400]
mov edx, ebx
lea esi, [esi]
lea esi, [esi]
mov eax, dword [edx]
add edx, 4
movzx esi, al
mov edi, dword [ebx + esi*4]
shr eax, 8
xor eax, edi
mov dword [edx + 0x3fc], eax
movzx esi, al
mov ebp, dword [ebx + esi*4]
shr eax, 8
xor eax, ebp
mov dword [edx + 0x7fc], eax
movzx esi, al
mov edi, dword [ebx + esi*4]
shr eax, 8
xor eax, edi
mov dword [edx + 0xbfc], eax
cmp edx, ecx
jne 0x1000fd60
jmp 0x1000fcd3
mov eax, 0xffffffea
jmp 0x1000fcd5
Function at 0x100101d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 4
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ebp, dword [ebx + 0x400]
add esi, edx
test ebp, ebp
je 0x10010235
cmp edx, esi
jae 0x10010215
lea esi, [esi]
nop
movzx ecx, byte [edx]
inc edx
xor cl, al
shr eax, 8
movzx ecx, cl
mov edi, dword [ebx + ecx*4]
xor eax, edi
cmp esi, edx
jne 0x10010200
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret
cmp edx, esi
jae 0x1001023a
movzx ecx, byte [edx]
inc edx
xor cl, al
shr eax, 8
movzx ecx, cl
mov edi, dword [ebx + ecx*4]
xor eax, edi
test dl, 3
jne 0x10010220
lea ecx, [esi - 3]
cmp edx, ecx
jae 0x100101f3
mov dword [esp], esi
mov ebp, edx
mov dword [esp + 0x20], edx
lea esi, [esi]
mov edx, dword [ebp]
add ebp, 4
xor eax, edx
mov edx, eax
shr eax, 0x10
mov edi, edx
shr edi, 0x18
movzx esi, al
movzx eax, dl
movzx edx, dh
mov eax, dword [ebx + eax*4 + 0xc00]
xor eax, dword [ebx + edi*4]
mov edi, dword [ebx + edx*4 + 0x800]
mov edx, dword [ebx + esi*4 + 0x400]
xor eax, edi
xor eax, edx
cmp ebp, ecx
jb 0x10010250
mov esi, dword [esp]
mov edx, dword [esp + 0x20]
lea ecx, [esi - 4]
sub ecx, edx
shr ecx, 2
lea edx, [edx + ecx*4 + 4]
jmp 0x100101f3
Function at 0x10010980
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, edx
push esi
xor edx, edx
push ebx
mov esi, eax
sub esp, 0x34
xor eax, eax
mov dword [esp + 0x2c], ecx
mov ebx, 0x100b41c0
mov cl, 6
jmp 0x100109a3
movzx ecx, byte [ebx]
shld edx, eax, 1
add eax, eax
mov dword [esp + 8], eax
mov eax, esi
inc ebx
mov dword [esp + 0xc], edx
shrd eax, edi, cl
mov edx, edi
shr edx, cl
test cl, 0x20
cmovne eax, edx
mov edx, dword [esp + 0xc]
and eax, 1
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [esp + 8]
add eax, dword [esp]
adc edx, dword [esp + 4]
cmp ebx, 0x100b4200
jne 0x100109a0
mov dword [esp + 0x10], eax
xor edi, edi
mov dword [esp + 0x14], edx
mov dword [esp + 8], edi
lea esi, [esi]
lea esi, [esi]
mov eax, dword [esp + 8]
mov edi, dword [esp + 0x2c]
mov edx, dword [esp + 0x10]
xor eax, 0xf
mov ebx, dword [edi + eax*8 + 4]
mov ecx, dword [edi + eax*8]
mov ebp, edx
mov edi, edx
ror ebp, 3
ror edi, 7
mov dword [esp + 4], ebx
mov eax, edi
mov dword [esp], ecx
shrd ecx, ebx, 6
mov ebx, dword [esp + 4]
xor ebp, ecx
mov ecx, dword [esp]
and ebp, 0x3f
shrd ecx, ebx, 0xc
mov ebx, dword [esp + 4]
xor eax, ecx
mov ecx, dword [esp]
mov esi, eax
mov eax, dword [ebp*4 + 0x100b3f40]
and esi, 0x3f
mov ebp, dword [esi*4 + 0x100b3e40]
mov esi, edx
rol esi, 1
xor esi, ecx
shrd ecx, ebx, 0x12
and esi, 0x3f
mov ebx, dword [esp + 4]
or eax, ebp
mov ebp, edx
mov edi, dword [esi*4 + 0x100b4040]
ror ebp, 0xb
mov esi, dword [esp + 4]
xor ebp, ecx
mov ecx, dword [esp]
and ebp, 0x3f
or eax, edi
mov edi, dword [ebp*4 + 0x100b3d40]
mov ebp, edx
ror ebp, 0xf
shrd ecx, ebx, 0x18
mov ebx, dword [esp + 4]
shr esi, 4
xor ebp, ecx
mov ecx, dword [esp]
and ebp, 0x3f
or eax, edi
mov edi, dword [ebp*4 + 0x100b3c40]
mov ebp, edx
rol ebp, 0xd
shrd ecx, ebx, 0x1e
mov ebx, dword [esp + 0x10]
xor ebp, ecx
mov ecx, edx
and ebp, 0x3f
or eax, edi
mov edi, dword [ebp*4 + 0x100b3b40]
rol ecx, 9
mov dword [esp + 0x1c], ebx
xor ecx, esi
mov esi, dword [esp + 0x1c]
or eax, edi
and ecx, 0x3f
mov edi, dword [esp + 0x14]
mov ebp, dword [ecx*4 + 0x100b3a40]
rol edx, 5
mov ecx, dword [esp + 4]
mov dword [esp + 0x18], edi
mov ebx, dword [esp + 0x18]
or eax, ebp
shr ecx, 0xa
xor edx, ecx
and edx, 0x3f
mov ecx, dword [edx*4 + 0x100b3940]
xor edx, edx
xor edx, esi
or eax, ecx
xor eax, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
inc dword [esp + 8]
mov eax, dword [esp + 8]
cmp eax, 0x10
jne 0x10010a00
mov edi, dword [esp + 0x10]
xor esi, esi
mov cl, 0x39
mov dword [esp], esi
mov eax, dword [esp + 0x14]
mov ebp, 0x100b41ff
mov edx, edi
xor edi, edi
mov dword [esp + 4], edi
jmp 0x10010b54
movzx ecx, byte [ebp]
mov edi, eax
xor ebx, ebx
mov dword [esp + 0x24], ebx
and edi, 1
dec ebp
mov dword [esp + 0x20], edi
mov esi, dword [esp + 0x24]
xor edi, edi
mov ebx, dword [esp + 0x20]
shld esi, ebx, cl
shl ebx, cl
test cl, 0x20
cmovne esi, ebx
cmovne ebx, edi
or dword [esp], ebx
shrd eax, edx, 1
or dword [esp + 4], esi
shr edx, 1
cmp ebp, 0x100b41bf
jne 0x10010b50
mov esi, dword [esp]
mov edi, dword [esp + 4]
add esp, 0x34
pop ebx
mov eax, esi
pop esi
mov edx, edi
pop edi
pop ebp
ret