joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10161120
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x30]
push ebx
push ebp
push esi
mov ebp, dword [eax + 0x1b58]
add eax, 0xe0
mov esi, dword [esp + 0x64]
push edi
push dword [esp + 0x58]
mov edi, dword [esp + 0x48]
push dword [esp + 0x58]
mov dword [esp + 0x24], eax
push dword [esp + 0x58]
mov eax, dword [eax + 0x1008]
push dword [esp + 0x58]
push dword [esp + 0x58]
mov ebx, dword [eax + 0x8c]
push edi
push esi
push dword [esp + 0x88]
shr ebx, 3
and ebx, 1
push ebx
push ebp
call fcn.101072e0
push dword [esp + 0x84]
push esi
push edi
push ebx
push ebp
push dword [esp + 0xac]
push 0
call fcn.1015b4b0
mov edx, dword [esp + 0xb4]
add esp, 0x44
movzx ecx, dl
mov edi, 1
mov eax, ecx
shl eax, 7
mov ecx, dword [ecx*4 + 0x107fb050]
lea ebx, [eax + 0x107edf00]
mov eax, 2
mov dword [esp + 0x18], ebx
mov cl, byte [ecx + 0x107fabe8]
shl edi, cl
xor ecx, ecx
cmp dl, 3
cmove eax, ecx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x20]
push eax
push ecx
push ecx
push ecx
push edx
call fcn.101071f0
mov esi, dword [esp + 0x54]
add esp, 0x14
mov ebp, dword [esp + 0x60]
mov eax, dword [esi + 0x10e8]
test byte [eax + 0x8c], 8
lea eax, [esp + 0x20]
push eax
push ebx
mov ebx, dword [esp + 0x6c]
lea eax, [esp + 0x18]
push eax
push ebx
push ebp
push esi
push edi
push dword [esp + 0x78]
je 0x10161238
call fcn.1007c690
push dword [esi + 0x1b58]
mov esi, dword [esp + 0xa4]
push esi
push edi
push ebx
push dword [esp + 0x8c]
call dword [0x10b48604]
add esp, 0x34
jmp 0x10161257
call fcn.1007d200
mov esi, dword [esp + 0xa0]
push esi
push edi
push ebx
push dword [esp + 0x88]
call dword [0x10b486d0]
add esp, 0x30
mov edi, dword [esp + 0x14]
mov ecx, edi
call fcn.10511c50
mov ecx, eax
test edx, edx
jl 0x1016126f
jg 0x10161276
cmp ecx, 1
ja 0x10161276
mov ecx, 1
xor edx, edx
mov eax, dword [esp + 0x7c]
mov dword [eax], ecx
mov ecx, edi
mov dword [eax + 4], edx
mov eax, dword [esi]
mov edx, dword [esi + 4]
call fcn.10511c50
test edx, edx
jl 0x10161296
jg 0x1016129d
cmp eax, 1
ja 0x1016129d
mov eax, 1
xor edx, edx
movzx ecx, word [esp + 0x10]
mov dword [esi], eax
mov dword [esi + 4], edx
mov esi, 1
test ecx, ecx
je 0x101612ec
mov edi, dword [esp + 0x18]
mov ebx, ecx
mov edi, dword [edi]
nop dword [eax + eax]
movsx eax, word [edi]
lea edi, [edi + 2]
mov eax, dword [ebp + eax*4]
cdq
xor eax, edx
sub eax, edx
xor edx, edx
lea ecx, [eax + 1]
bsr ecx, ecx
cmp edx, eax
sbb eax, eax
neg eax
inc eax
add eax, ecx
add esi, eax
sub ebx, 1
jne 0x101612c0
movzx ecx, word [esp + 0x10]
mov eax, dword [esp + 0x78]
shl esi, 9
cmp dword [esp + 0x74], 0
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
je 0x10161323
push 0
push ecx
push dword [esp + 0x50]
push dword [esp + 0x50]
push dword [esp + 0x70]
push 0
push 0
push dword [esp + 0x70]
push dword [esp + 0x2c]
call fcn.1015ad50
add esp, 0x24
add esp, 0x2c
ret
Function at 0x10161640
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
mov ecx, edi
mov eax, edi
shr ecx, 1
mov edx, ecx
xor edx, 0x82f63b78
test al, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0x82f63b78
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0x82f63b78
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0x82f63b78
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0x82f63b78
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0x82f63b78
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0x82f63b78
test cl, 1
cmove edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, 0x82f63b78
test dl, 1
cmove eax, ecx
mov dword [esi + edi*4], eax
inc edi
cmp edi, 0x100
jl 0x10161648
lea eax, [esi + 0x800]
mov edi, 0x100
mov edx, dword [eax - 0x800]
lea eax, [eax + 4]
movzx ecx, dl
shr edx, 8
xor edx, dword [esi + ecx*4]
movzx ecx, dl
mov dword [eax - 0x404], edx
shr edx, 8
xor edx, dword [esi + ecx*4]
movzx ecx, dl
mov dword [eax - 4], edx
shr edx, 8
xor edx, dword [esi + ecx*4]
movzx ecx, dl
mov dword [eax + 0x3fc], edx
shr edx, 8
xor edx, dword [esi + ecx*4]
movzx ecx, dl
mov dword [eax + 0x7fc], edx
shr edx, 8
xor edx, dword [esi + ecx*4]
movzx ecx, dl
mov dword [eax + 0xbfc], edx
shr edx, 8
xor edx, dword [esi + ecx*4]
movzx ecx, dl
mov dword [eax + 0xffc], edx
shr edx, 8
xor edx, dword [esi + ecx*4]
mov dword [eax + 0x13fc], edx
sub edi, 1
jne 0x101616f3
pop edi
pop esi
ret

Function at 0x10161910
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
xor eax, eax
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
xor edi, edi
mov dword [esi], 0
test ebx, ebx
je 0x1016195a
mov ecx, dword [esi + 8]
add ecx, 0xfffffff8
mov dword [esp + 0x14], ecx
mov edx, eax
shr edx, cl
mov ecx, eax
xor dl, byte [edi + ebp]
inc edi
shl ecx, 8
movzx eax, dl
mov dword [esi], ecx
mov eax, dword [esi + eax*4 + 0xc]
xor eax, ecx
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
cmp edi, ebx
jb 0x10161938
and eax, dword [esi + 0x40c]
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x101926b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffe0
sub esp, 0xb8
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp + 8]
vmovdqu ymm3, ymmword [0x1083af60]
mov ecx, dword [ebp + 0x10]
sub edx, 3
vmovdqu xmm0, xmmword [eax]
mov eax, 0x1083ae00
push esi
mov esi, dword [ebp + 0x18]
push edi
vmovdqu ymm6, ymmword [eax]
mov edi, dword [ebp + 0xc]
mov eax, 0x1083ae20
vpsraw xmm0, xmm0, 1
vpacksswb xmm0, xmm0, xmm0
vmovdqa xmmword [esp + 0x20], xmm0
vmovdqu ymm7, ymmword [eax]
vbroadcasti128 ymm0, xmmword [esp + 0x20]
vpshufb ymm4, ymm0, ymmword [0x1083afa0]
vpshufb ymm5, ymm0, ymmword [0x1083afe0]
lea eax, [edi + edi]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x14]
add eax, eax
mov dword [esp + 0x1c], eax
vmovdqu ymmword [esp + 0xa0], ymm3
vmovdqu ymmword [esp + 0x80], ymm4
vmovdqu ymmword [esp + 0x40], ymm5
vmovdqu ymmword [esp + 0x60], ymm6
vmovdqu ymmword [esp + 0x20], ymm7
cmp esi, 1
jbe 0x101927b5
lea eax, [esi - 2]
shr eax, 1
inc eax
nop word [eax + eax]
vmovdqu xmm1, xmmword [edx]
vinserti128 ymm2, ymm1, xmmword [edx + edi], 1
mov edi, dword [ebp + 0x14]
sub esi, 2
add edx, dword [esp + 0x18]
vpshufb ymm0, ymm2, ymm6
vpmaddubsw ymm1, ymm0, ymm4
vpshufb ymm0, ymm2, ymm7
vpmaddubsw ymm0, ymm0, ymm5
vpaddsw ymm0, ymm0, ymm1
vpaddsw ymm0, ymm0, ymm3
vpsraw ymm0, ymm0, 6
vpackuswb ymm0, ymm0, ymm0
vmovq qword [ecx], xmm0
vextractf128 xmm0, ymm0, 1
vmovq qword [ecx + edi], xmm0
add ecx, dword [esp + 0x1c]
mov edi, dword [ebp + 0xc]
sub eax, 1
jne 0x10192760
test esi, esi
je 0x101927fa
vmovdqu xmm2, xmmword [edx]
vpshufb xmm0, xmm2, xmmword [esp + 0x20]
vpmaddubsw xmm1, xmm0, xmmword [esp + 0x40]
vpshufb xmm0, xmm2, xmmword [esp + 0x60]
vpmaddubsw xmm0, xmm0, xmmword [esp + 0x80]
vpaddsw xmm0, xmm1, xmm0
vpaddsw xmm0, xmm0, xmmword [esp + 0xa0]
vpsraw xmm1, xmm0, 6
vpxor xmm0, xmm0, xmm0
vpackuswb xmm0, xmm1, xmm0
vmovq qword [ecx], xmm0
vzeroupper
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x101e39d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x24
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
lea ebx, [eax + eax]
mov edi, dword [ebp + 0x18]
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ebx
cmp dword [ebp + 0x1c], edx
jle 0x101e3b42
mov eax, dword [ebp + 0xc]
xorps xmm4, xmm4
movups xmm5, xmmword [0x10856be0]
add eax, eax
mov dword [esp + 0x1c], eax
xorps xmm3, xmm3
mov eax, dword [ebp + 0x10]
xor ecx, ecx
test edi, edi
jle 0x101e3af8
cmp edi, 8
jb 0x101e3ab8
cmp dword [0x10b47804], 2
jl 0x101e3ab8
mov esi, edi
mov edx, eax
and esi, 0xfffffff8
mov dword [esp + 0x18], esi
mov esi, dword [ebp + 0x14]
add esi, 0x10
sub edx, dword [ebp + 0x14]
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0xc]
mov edi, dword [esp + 0x14]
movups xmm1, xmmword [esi - 0x10]
lea esi, [esi + 0x20]
movups xmm2, xmmword [eax + ecx*4]
pmovzxwd xmm0, qword [ebx + ecx*2]
pmulld xmm0, xmm1
movups xmm1, xmmword [esi - 0x20]
psubd xmm2, xmm0
pabsd xmm0, xmm2
movups xmm2, xmmword [edi + esi - 0x20]
paddd xmm0, xmm5
psrad xmm0, 0xc
paddd xmm4, xmm0
pmovzxwd xmm0, qword [ebx + ecx*2 + 8]
pmulld xmm0, xmm1
psubd xmm2, xmm0
add ecx, 8
pabsd xmm0, xmm2
paddd xmm0, xmm5
psrad xmm0, 0xc
paddd xmm3, xmm0
cmp ecx, dword [esp + 0x18]
jl 0x101e3a51
mov edi, dword [ebp + 0x18]
cmp ecx, edi
jge 0x101e3af8
mov ebx, dword [ebp + 0x14]
lea esi, [eax + ecx*4]
sub ebx, eax
mov eax, dword [esp + 0x10]
lea esi, [esi + 4]
movzx edx, word [eax + ecx*2]
inc ecx
imul edx, dword [ebx + esi - 4]
mov eax, dword [esi - 4]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0xc]
add eax, 0x800
sar eax, 0xc
add edx, eax
mov dword [esp + 0xc], edx
cmp ecx, edi
jl 0x101e3ac0
mov ebx, dword [esp + 0x10]
mov eax, dword [ebp + 0x10]
add ebx, dword [esp + 0x1c]
lea ecx, [edi*4]
add dword [ebp + 0x14], ecx
add eax, ecx
sub dword [ebp + 0x1c], 1
mov dword [esp + 0x10], ebx
mov dword [ebp + 0x10], eax
jne 0x101e3a11
paddd xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
paddd xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
paddd xmm3, xmm0
movd eax, xmm3
add eax, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101e3dc0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x28]
push edi
xor edi, edi
mov dword [esp + 8], edi
test eax, eax
jle 0x101e3fd5
movups xmm4, xmmword [0x10856be0]
mov edx, dword [esp + 0x28]
xorps xmm5, xmm5
xorps xmm3, xmm3
push ebx
mov ebx, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x2c]
xor ecx, ecx
test ebp, ebp
jle 0x101e3e96
cmp ebp, 8
jb 0x101e3e96
cmp dword [0x10b47804], 2
jl 0x101e3e96
mov edi, ebp
lea eax, [edx + 0x10]
mov ebp, esi
and edi, 0xfffffff8
sub ebp, edx
mov dword [esp + 0x14], ebp
mov ebp, dword [esp + 0x34]
mov edx, dword [esp + 0x14]
nop
movups xmm1, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm2, xmmword [esi + ecx*4]
pmovzxbd xmm0, dword [ebx + ecx]
pmulld xmm0, xmm1
movups xmm1, xmmword [eax - 0x20]
psubd xmm2, xmm0
pabsd xmm0, xmm2
movups xmm2, xmmword [edx + eax - 0x20]
paddd xmm0, xmm4
psrad xmm0, 0xc
paddd xmm5, xmm0
pmovzxbd xmm0, dword [ebx + ecx + 4]
pmulld xmm0, xmm1
psubd xmm2, xmm0
add ecx, 8
pabsd xmm0, xmm2
paddd xmm0, xmm4
psrad xmm0, 0xc
paddd xmm3, xmm0
cmp ecx, edi
jl 0x101e3e30
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x38]
xor edi, edi
xor ebx, ebx
cmp ecx, ebp
jge 0x101e3f7b
mov eax, ebp
sub eax, ecx
cmp eax, 2
jl 0x101e3f37
lea eax, [ebp - 1]
mov ebp, dword [esp + 0x30]
mov dword [esp + 0x1c], eax
mov edx, ebp
lea eax, [ecx + 1]
sub edx, esi
lea eax, [esi + eax*4]
mov dword [esp + 0x18], edx
mov esi, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov eax, dword [eax - 4]
movzx edx, byte [ecx + esi]
imul edx, dword [ebp + ecx*4]
mov ebp, dword [esp + 0x18]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
movzx edx, byte [ecx + esi + 1]
add eax, 0x800
add ecx, 2
sar eax, 0xc
add edi, eax
mov eax, dword [esp + 0x14]
imul edx, dword [eax + ebp]
mov eax, dword [eax]
mov ebp, dword [esp + 0x30]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, ecx
add eax, 0x800
sar eax, 0xc
add ebx, eax
mov eax, dword [esp + 0x14]
add eax, 8
mov dword [esp + 0x14], eax
cmp ecx, dword [esp + 0x1c]
jl 0x101e3ed0
mov ebp, dword [esp + 0x34]
mov esi, dword [esp + 0x2c]
cmp edx, ebp
jge 0x101e3f64
mov edx, dword [esp + 0x24]
lea eax, [ecx*4]
movzx ecx, byte [ecx + edx]
mov edx, dword [esp + 0x30]
imul ecx, dword [eax + edx]
mov eax, dword [eax + esi]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add eax, 0x800
sar eax, 0xc
add dword [esp + 0x10], eax
mov edx, dword [esp + 0x30]
lea eax, [ebx + edi]
mov edi, dword [esp + 0x10]
add edi, eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], edi
jmp 0x101e3f7f
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x24]
lea ecx, [ebp*4]
add ebx, dword [esp + 0x28]
add esi, ecx
add edx, ecx
mov dword [esp + 0x24], ebx
sub eax, 1
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], edx
mov dword [esp + 0x38], eax
jne 0x101e3df6
paddd xmm3, xmm5
movaps xmm0, xmm3
psrldq xmm0, 8
paddd xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
paddd xmm3, xmm0
pop esi
movd eax, xmm3
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0x10
ret
mov eax, edi
pop edi
pop ebp
add esp, 0x10
ret
Function at 0x101e8fa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x10]
add ecx, ecx
vmovdqu ymm3, ymmword [0x10865fe0]
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
sub edi, eax
imul eax, dword [esp + 0x20]
vpxor xmm2, xmm2, xmm2
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x14]
sub edx, eax
mov dword [esp + 0x18], edx
nop word [eax + eax]
vpmovzxwd ymm0, xmmword [ecx + esi*2]
vpmaddwd ymm1, ymm0, ymmword [edx + eax]
vmovdqu ymm0, ymmword [eax]
add eax, 0x20
add esi, 8
mov dword [esp + 0x14], eax
mov eax, esi
cdq
idiv dword [esp + 0x1c]
vpsubd ymm0, ymm0, ymm1
vpabsd ymm0, ymm0
vpaddd ymm0, ymm0, ymm3
vpsrld ymm0, ymm0, 0xc
vpaddd ymm2, ymm0, ymm2
test edx, edx
jne 0x101e901d
lea ecx, [ecx + edi*2]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
cmp esi, dword [esp + 0xc]
jl 0x101e8fe0
vextracti128 xmm0, ymm2, 1
vpaddd xmm0, xmm0, xmm2
vphaddd xmm0, xmm0, xmm0
vphaddd xmm0, xmm0, xmm0
pop edi
pop esi
vmovd eax, xmm0
vzeroupper
ret

Function at 0x101e9050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
vmovdqu ymm3, ymmword [0x10865fe0]
mov edx, dword [esp + 8]
add eax, eax
push esi
sar ecx, 1
xor esi, esi
push edi
mov edi, dword [esp + 0x1c]
shl ecx, 3
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
sub edi, eax
vpxor xmm2, xmm2, xmm2
mov dword [esp + 0x20], ecx
nop word [eax + eax]
mov ecx, dword [esp + 0x14]
lea eax, [eax + 0x20]
vpxor xmm0, xmm0, xmm0
vpinsrd xmm0, xmm0, dword [edx], 0
add esi, 8
vpinsrd xmm0, xmm0, dword [ecx + edx], 1
add edx, dword [esp + 8]
vpmovzxbd ymm0, xmm0
vpmaddwd ymm1, ymm0, ymmword [edi + eax - 0x20]
vmovdqu ymm0, ymmword [eax - 0x20]
vpsubd ymm0, ymm0, ymm1
vpabsd ymm0, ymm0
vpaddd ymm0, ymm0, ymm3
vpsrld ymm0, ymm0, 0xc
vpaddd ymm2, ymm0, ymm2
cmp esi, dword [esp + 0x20]
jl 0x101e9090
vextracti128 xmm0, ymm2, 1
vpaddd xmm0, xmm0, xmm2
vphaddd xmm0, xmm0, xmm0
vphaddd xmm0, xmm0, xmm0
pop edi
pop esi
vmovd eax, xmm0
vzeroupper
pop ecx
ret

Function at 0x101e9100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
vmovdqu ymm3, ymmword [0x10865fe0]
push esi
mov esi, dword [esp + 0x18]
xor ecx, ecx
sub dword [esp + 0xc], esi
push edi
mov edi, dword [esp + 0xc]
lea edx, [esi - 1]
imul esi, dword [esp + 0x20]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x14]
sub dword [esp + 0x18], edx
vpxor xmm2, xmm2, xmm2
mov eax, dword [esp + 0x18]
lea edx, [edx + 0x20]
vpmovzxbd ymm0, qword [ecx + edi]
add ecx, 8
test dword [esp + 0x1c], ecx
vpmaddwd ymm1, ymm0, ymmword [eax + edx - 0x20]
vmovdqu ymm0, ymmword [edx - 0x20]
mov eax, dword [esp + 0x10]
vpsubd ymm0, ymm0, ymm1
vpabsd ymm0, ymm0
vpaddd ymm0, ymm0, ymm3
lea eax, [eax + edi]
cmovne eax, edi
mov edi, eax
vpsrld ymm0, ymm0, 0xc
vpaddd ymm2, ymm0, ymm2
cmp ecx, esi
jl 0x101e9130
vextracti128 xmm0, ymm2, 1
vpaddd xmm0, xmm0, xmm2
vphaddd xmm0, xmm0, xmm0
vphaddd xmm0, xmm0, xmm0
pop edi
pop esi
vmovd eax, xmm0
vzeroupper
ret
Function at 0x10220430
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push ebx
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0xfd0]
mov ebx, dword [eax]
mov cl, byte [ebx + 0x9f]
movzx eax, cl
and eax, 7
mov byte [esp + 0xb], cl
cmp dword [edi + eax*4 + 0x1a9c], 0
jne 0x10220536
mov eax, dword [esp + 0x20]
movzx eax, al
cmp byte [eax + 0x108b61d8], 3
ja 0x10220536
mov al, byte [esp + 0x14]
test al, al
jne 0x10220495
mov ecx, dword [edi + 0xfec]
imul ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
add ecx, dword [edi + 0xfe8]
pop edi
pop ebx
mov al, byte [ecx + eax]
pop ecx
ret
test cl, cl
js 0x102204b8
cmp byte [ebx + 0x14], 0
jg 0x102204b8
movzx eax, byte [ebx + 6]
movzx eax, byte [eax + 0x108b6c0c]
mov cl, byte [eax + 0x108b6c44]
xor eax, eax
mov byte [esp + 0x10], cl
jmp 0x10220503
movzx eax, al
imul edx, eax, 0x538
mov eax, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [edx + edi + 0x18]
shl esi, cl
imul esi, dword [edi + 0xfec]
mov ecx, dword [edx + edi + 0x14]
shl eax, cl
add esi, eax
cmp byte [esp + 0xf], 0
mov eax, dword [edi + 0xfe8]
mov al, byte [esi + eax]
mov byte [esp + 0x14], al
pop esi
jl 0x102204fe
cmp byte [ebx + 0x14], 0
jg 0x102204fe
xor eax, eax
jmp 0x10220503
mov eax, 1
push dword [esp + 0x24]
push eax
push dword [esp + 0x28]
call fcn.10220340
movzx ecx, al
add esp, 0xc
movzx eax, byte [esp + 0x10]
xor edx, edx
shl ecx, 4
add ecx, eax
movzx eax, byte [esp + 0x10]
pop edi
pop ebx
cmp dword [ecx*4 + 0x108b6c70], edx
cmove eax, edx
pop ecx
ret
pop edi
xor al, al
pop ebx
pop ecx
ret
Function at 0x10229890
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x58
mov eax, dword [0x10a78b80]
xor eax, esp
mov dword [esp + 0x54], eax
mov edx, dword [esp + 0x64]
mov eax, dword [esp + 0x60]
push ebx
push ebp
movzx ecx, byte [edx + 0x108b5d10]
mov ebp, dword [esp + 0x64]
sub ecx, 4
mov bl, byte [edx + 0x108b5e30]
push esi
push edi
mov edi, 1
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x10b0]
shl edi, cl
push edi
push 0
push dword [ebp + 0x10c8]
mov esi, dword [eax]
mov dword [esp + 0x20], edx
mov byte [esp + 0x28], bl
call fcn.10513d40
movzx eax, bl
add esp, 0xc
mov cl, al
mov dword [esp + 0x20], eax
movzx ecx, cl
xor eax, eax
imul ecx, ecx, 0x1010101
mov dword [esi + 0x8a], ecx
mov dword [esi + 0x8e], ecx
mov dword [esi + 0x92], ecx
mov dword [esi + 0x96], ecx
mov byte [esi + 0x89], bl
test edi, edi
jle 0x1022992d
or byte [eax + ebp + 0x23b81], 1
inc eax
cmp eax, edi
jl 0x10229920
mov ebx, dword [esp + 0x10]
mov byte [ebx + 0x20], 1
mov eax, dword [ebp + 0x10e8]
test byte [eax + 0x8c], 8
je 0x1022996a
mov ecx, dword [ebp + 0x1b58]
mov eax, 1
lea ecx, [ecx*2 - 0x10]
shl eax, cl
sar eax, 1
cdq
add eax, dword [esp + 0x78]
adc edx, dword [esp + 0x7c]
call fcn.10511c50
jmp 0x10229972
mov edx, dword [esp + 0x7c]
mov eax, dword [esp + 0x78]
mov esi, dword [esp + 0x14]
shld edx, eax, 4
shl eax, 4
mov dword [ebx + 0x18], eax
mov dword [ebx + 8], eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x48]
mov dword [ebx + 0x1c], edx
push eax
lea eax, [ebp + 0xf0]
mov dword [ebx + 0xc], edx
push eax
push esi
call fcn.1007f100
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x5c]
push eax
push 0
push dword [esp + 0x3c]
push esi
call fcn.10225660
mov edi, dword [esp + 0x48]
add esp, 0x28
movzx edx, byte [esi + 0x108b5ce0]
movzx ecx, byte [edi + 0x108b61d8]
movzx eax, byte [edi + 0x108b61c4]
inc ecx
add eax, ecx
movzx ecx, byte [edi*4 + 0x108b6088]
shr eax, 1
movzx eax, al
imul eax, eax, 0x3b0
shr edx, cl
movzx ecx, byte [edi*4 + 0x108b5fe8]
pop edi
add eax, dword [esp + 0x10]
imul edx, dword [ebp + eax*8 + 0xa988]
movzx eax, byte [esi + 0x108b5cc8]
shr eax, cl
mov ecx, dword [esp + 0x60]
pop esi
imul edx, eax
pop ebp
mov dword [ebx], edx
pop ebx
xor ecx, esp
call fcn.105116c0
add esp, 0x58
ret

Function at 0x10229db0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x7c
mov eax, dword [0x10a78b80]
xor eax, esp
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x80]
mov dl, byte [esp + 0x94]
push ebx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0xa4]
push ebp
mov ebp, dword [esp + 0xa4]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0xac]
push esi
movzx ecx, byte [ebp + 0x108b5ce0]
mov esi, dword [esp + 0xd4]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0xb4]
push edi
mov edi, dword [esp + 0x94]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0xbc]
Function at 0x10272180
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x10]
push edi
lea edi, [eax*8]
test edi, edi
jle 0x1027225b
mov ecx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
lea eax, [ecx + 0x20]
lea edx, [esi + 0x60]
sub esi, ecx
lea ecx, [edi - 1]
shr ecx, 3
inc ecx
nop dword [eax]
lea eax, [eax + 0x100]
lea edx, [edx + 0x100]
vmovdqu ymm0, ymmword [edx - 0x160]
vpaddd ymm0, ymm0, ymm0
vmovdqu ymmword [eax - 0x120], ymm0
vmovdqu ymm0, ymmword [esi + eax - 0x100]
vpaddd ymm0, ymm0, ymm0
vmovdqu ymmword [eax - 0x100], ymm0
vmovdqu ymm0, ymmword [edx - 0x120]
vpaddd ymm0, ymm0, ymm0
vmovdqu ymmword [eax - 0xe0], ymm0
vmovdqu ymm0, ymmword [edx - 0x100]
vpaddd ymm0, ymm0, ymm0
vmovdqu ymmword [eax - 0xc0], ymm0
vmovdqu ymm0, ymmword [edx - 0xe0]
vpaddd ymm0, ymm0, ymm0
vmovdqu ymmword [eax - 0xa0], ymm0
vmovdqu ymm0, ymmword [edx - 0xc0]
vpaddd ymm0, ymm0, ymm0
vmovdqu ymmword [eax - 0x80], ymm0
vmovdqu ymm0, ymmword [edx - 0xa0]
vpaddd ymm0, ymm0, ymm0
vmovdqu ymmword [eax - 0x60], ymm0
vmovdqu ymm0, ymmword [edx - 0x80]
vpaddd ymm0, ymm0, ymm0
vmovdqu ymmword [eax - 0x40], ymm0
sub ecx, 1
jne 0x102721b0
pop esi
pop edi
vzeroupper
ret
Function at 0x102c5b00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 0x14]
movzx eax, cl
cmp eax, 0xe
ja case.0x102c5b13.1
movzx eax, byte [eax + 0x102c5bb8]
jmp dword [eax*4 + 0x102c5ba0]
mov dword [esp + 0x14], ecx
jmp fcn.102cb9f0
mov dword [esp + 0x14], ecx
jmp fcn.102cbbf0
mov dword [esp + 0x14], ecx
jmp fcn.102cbe90
mov dword [esp + 0x14], ecx
jmp fcn.102cb410
mov dword [esp + 0x14], ecx
jmp fcn.102caf90
mov edx, dword [esp + 0x10]
movzx eax, dl
cmp eax, 0xf
ja case.0x102c5b5a.0
movzx eax, byte [eax + 0x102c5bdc]
jmp dword [eax*4 + 0x102c5bc8]
push ecx
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.102c5270
add esp, 0x10
ret
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
jmp fcn.102c4980
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
jmp fcn.102c5bf0
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
jmp fcn.102cc110
Function at 0x10449f90
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
lea ecx, [eax + eax*8]
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x18]
lea edx, [eax + ecx*8]
mov dword [esp + 0xc], 0
movzx ecx, byte [esp + 0x24]
movzx eax, byte [esp + 0x28]
shl ecx, 4
add ecx, eax
push edi
mov eax, dword [ecx*8 + 0x107edf00]
mov ecx, dword [esp + 0x24]
mov ebp, ecx
mov dword [esp + 0x28], eax
mov eax, dword [edx + 0x10]
shl ebp, 6
add ebp, dword [edx + 8]
movzx ebx, word [eax + ecx*2]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x20], ebx
lea edi, [ebx - 2]
movsx eax, word [ecx + ebx*2 - 2]
mov eax, dword [ebp + eax*4]
cdq
mov esi, eax
xor esi, edx
sub esi, edx
shl esi, 0xb
sub esi, 0x800
mov dword [esp + 0x2c], esi
test edi, edi
js 0x1044a0a6
lea eax, [edi + 1]
mov ebx, 0xe
cmp eax, 2
jl 0x1044a07a
xor esi, esi
movsx eax, word [ecx + edi*2]
mov ecx, ebx
mov eax, dword [ebp + eax*4]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xe
cmovl ecx, eax
mov eax, dword [esp + 0x28]
movsx eax, word [eax + edi*2 - 2]
add esi, dword [ecx*4 + 0x10990090]
mov ecx, ebx
mov eax, dword [ebp + eax*4]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xe
cmovl ecx, eax
mov eax, dword [esp + 0x10]
sub edi, 2
add eax, dword [ecx*4 + 0x10990090]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], eax
cmp edi, 1
jge 0x1044a021
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x2c]
test edi, edi
js 0x1044a098
movsx eax, word [ecx + edi*2]
mov eax, dword [ebp + eax*4]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0xe
cmovl ebx, eax
add esi, dword [ebx*4 + 0x10990090]
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x20]
add esi, eax
imul eax, ebx, 0x4e3
add esi, 0xfffffb1d
pop edi
add eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret