joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006970
Capabilities:
Hash data using djb2

Disassembly:
sub esp, 8
push ebx
mov ebx, ecx
mov edx, 0x1505
mov dword [esp + 4], ebx
push esi
mov esi, ebx
test ebx, ebx
jne 0x1000698e
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
movsx ecx, byte [ebx]
test ecx, ecx
je 0x100069a8
mov eax, edx
lea esi, [esi + 1]
shl edx, 5
add edx, ecx
movsx ecx, byte [esi]
add edx, eax
test ecx, ecx
jne 0x10006995
push ebp
test edx, edx
mov ebp, 1
mov ecx, ebp
mov eax, 0xc0906d
cmovne ecx, edx
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3fd
push edi
push 0x100c6e20
sub ecx, eax
cmovne ebp, ecx
mov esi, ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x100c6e10]
mov ecx, dword [eax + esi*8]
test ecx, ecx
je 0x10006ad0
lea edi, [eax + esi*8]
cmp ecx, ebp
jne 0x10006a2d
mov ecx, dword [edi + 4]
mov eax, ebx
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10006a20
test dl, dl
je 0x10006a1c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10006a20
add eax, 2
add ecx, 2
test dl, dl
jne 0x10006a00
xor eax, eax
jmp 0x10006a25
sbb eax, eax
or eax, 1
test eax, eax
je 0x10006b37
push dword [edi + 4]
push ebx
push str.hash_collision___s_vs__s_
push str.htab_hash
push 4
push 0
call fcn.100064b0
mov eax, 0x14191f7
add esp, 0x18
mul ebp
mov eax, ebp
sub eax, edx
shr eax, 1
add eax, edx
mov edx, ebp
shr eax, 9
imul eax, eax, 0x3fb
sub edx, eax
inc edx
mov dword [esp + 0x14], edx
mov ecx, esi
sub ecx, edx
cmp esi, edx
lea eax, [ecx + 0x3fd]
cmova eax, ecx
mov esi, eax
mov edi, esi
cmp edi, ebp
je 0x10006acc
mov eax, dword [0x100c6e10]
mov ebx, dword [eax + edi*8]
cmp ebx, ebp
jne 0x10006ac0
mov eax, dword [eax + edi*8 + 4]
mov ecx, dword [esp + 0x10]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10006ab3
test dl, dl
je 0x10006aaf
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10006ab3
add ecx, 2
add eax, 2
test dl, dl
jne 0x10006a93
xor eax, eax
jmp 0x10006ab8
sbb eax, eax
or eax, 1
test eax, eax
je 0x10006ac8
mov edx, dword [esp + 0x14]
mov esi, edi
test ebx, ebx
je 0x10006acc
jmp 0x10006a68
mov esi, edi
jmp 0x10006b37
mov ebx, dword [esp + 0x10]
cmp dword [0x100c6e04], 0x3fd
jb 0x10006afb
push 0x3fd
push str.hash_table_is_full___lu_entries_
push str.htab_hash
push 1
push 0
call fcn.100064b0
add esp, 0x14
xor esi, esi
jmp 0x10006b37
push ebx
call fcn.100940e0
mov ecx, eax
add esp, 4
mov eax, dword [0x100c6e10]
mov dword [eax + esi*8 + 4], ecx
lea eax, [eax + esi*8]
test ecx, ecx
jne 0x10006b2f
push str.could_not_duplicate_string_for_hash_table
push str.htab_hash
push 1
push ecx
call fcn.100064b0
add esp, 0x10
xor esi, esi
jmp 0x10006b37
inc dword [0x100c6e04]
mov dword [eax], ebp
push 0x100c6e20
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop ebp
mov eax, esi
pop esi
pop ebx
add esp, 8
ret
Function at 0x10007270
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x100c6e38]
push ebx
inc eax
xor bl, bl
mov dword [0x100c6e38], eax
push esi
mov esi, dword [esp + 0xc]
push edi
cmp eax, 1
jne 0x10007398
call fcn.10006be0
mov dword [0x100c6cc0], eax
test eax, eax
jne 0x100072ba
push str.failed_to_detect_Windows_version
push str.windows_init
push 1
push esi
call fcn.100064b0
add esp, 0x10
mov edi, 0xfffffff4
jmp 0x10007423
cmp eax, 4
jge 0x100072c6
push str.Windows_version_is_too_old
jmp 0x100072a0
cmp dword [0x100c6e10], 0
je 0x10007320
push str.program_assertion_failed___hash_table_already_allocated
push str.htab_create
push 1
push esi
call fcn.100064b0
add esp, 0x10
push esi
call fcn.10009050
mov edi, eax
add esp, 4
test edi, edi
jne 0x10007423
push esi
mov bl, 1
call fcn.10010e20
add esp, 4
test eax, eax
jne 0x10007383
push str.UsbDk_backend_is_available
push str.windows_init
push 4
push esi
call fcn.100064b0
mov byte [0x100c6e00], bl
jmp 0x10007395
push 0x100c6e20
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x3fd
push str.using__lu_entries_hash_table
push str.htab_create
push 4
push esi
call fcn.100064b0
push 8
push 0x3fe
mov dword [0x100c6e04], 0
call fcn.10091108
add esp, 0x1c
mov dword [0x100c6e10], eax
test eax, eax
jne 0x100072e4
push str.could_not_allocate_space_for_hash_table
push str.htab_create
push 1
push esi
call fcn.100064b0
add esp, 0x10
mov edi, 0xfffffff5
jmp 0x10007423
push str.UsbDk_backend_is_not_available
push str.windows_init
push 3
push esi
call fcn.100064b0
add esp, 0x10
push 1
push 0
push 0
push 0xffffffffffffffff
mov dword [esi + fcn.10009050], 0x100bc070
mov edi, 0xfffffff5
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [esi + 0x12c], eax
test eax, eax
jne 0x100073de
xor ecx, ecx
call fcn.10006760
push eax
push str.failed_to_create_I_O_completion_port:__s
push str.windows_init
push 1
push esi
call fcn.100064b0
add esp, 0x14
jmp 0x10007423
push 0
push 0
push esi
push 0x10007020
push 0
push 0
call fcn.1009404f
add esp, 0x18
mov dword [esi + 0x130], eax
test eax, eax
jne 0x10007421
push str.failed_to_create_I_O_completion_port_thread
push str.windows_init
push 1
push esi
call fcn.100064b0
add esp, 0x10
push dword [esi + 0x12c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10007423
xor edi, edi
cmp dword [0x100c6e38], 1
jne 0x10007472
test edi, edi
je 0x10007472
cmp byte [0x100c6e00], 0
je 0x1000745a
mov eax, dword [0x100c6fa4]
test eax, eax
je 0x10007453
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x100c6fa4], 0
mov byte [0x100c6e00], 0
test bl, bl
je 0x10007467
push esi
call fcn.100090d0
add esp, 4
call fcn.10006920
dec dword [0x100c6e38]
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x1002b2f0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push edi
push 0
call fcn.100022a0
mov edi, eax
test edi, edi
jne 0x1002b304
xor al, al
pop edi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x20]
lea eax, [ebx + 0x10]
push eax
push 1
call fcn.10091108
mov edx, eax
add esp, 8
test edx, edx
jne 0x1002b343
call fcn.100910f5
push dword [eax]
push str.Unable_to_allocate_buffer_for_libusb_control_transfer._Error:__d.
push dword [esp + 0x18]
push 2
call fcn.1002ad30
add esp, 0x10
push edi
call fcn.100022f0
pop ebx
xor al, al
pop edi
pop ecx
ret
mov eax, dword [esp + 0x24]
push esi
lea esi, [ebx + 8]
add esi, edx
test eax, eax
je 0x1002b353
mov dword [esi], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 4], eax
mov al, byte [esp + 0x18]
mov byte [edx + 1], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0xd], al
mov byte [esp + 0xc], cl
movzx eax, word [esp + 0xc]
mov ecx, dword [esp + 0x20]
mov word [edx + 2], ax
mov eax, ecx
shr eax, 8
mov byte [esp + 0xd], al
mov byte [esp + 0xc], cl
movzx eax, word [esp + 0xc]
mov word [edx + 4], ax
mov eax, ebx
shr eax, 8
mov byte [esp + 0xd], al
mov byte [edx], 0xc0
mov byte [esp + 0xc], bl
movzx eax, word [esp + 0xc]
mov word [edx + 6], ax
mov eax, dword [esp + 0x14]
push edi
mov eax, dword [eax + 8]
mov dword [edi], eax
mov word [edi + 5], 0
mov dword [edi + 8], 0
mov dword [edi + 0x20], edx
movzx eax, word [edx + 6]
mov ecx, eax
mov dword [edi + 0x1c], esi
and ecx, 0xffffff00
movzx eax, al
or ecx, eax
mov dword [edi + 0x18], 0x1002b0e0
add ecx, 8
mov byte [edi + 4], 2
mov dword [edi + 0x10], ecx
call fcn.10002670
mov esi, eax
call fcn.100910f5
test esi, esi
mov dword [eax], esi
pop esi
jne 0x1002b337
pop ebx
mov al, 1
pop edi
pop ecx
ret
Function at 0x1002c220
Capabilities:
Create thread

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0
push 0
push esi
push 0x1002c1b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], eax
call fcn.100910f5
pop esi
mov dword [eax], 0
mov al, 1
ret
Function at 0x10044b90
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x10044be7
nop dword [eax]
add ecx, ecx
movsx eax, byte [ecx + esi + 2]
movd xmm1, eax
movsx eax, byte [ecx + esi + 1]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
xor eax, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
inc ecx
xor eax, 1
add ecx, eax
mov al, byte [ecx + esi]
mov byte [esi + edx], al
mov edx, ecx
cmp ecx, edi
jl 0x10044bb0
cmp ecx, edi
jne 0x10044bfa
test bl, 1
jne 0x10044bfa
mov al, byte [esi + ebx - 1]
mov byte [esi + edx], al
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x10044c39
mov edi, dword [esp + 0x20]
lea ecx, [edx - 1]
sar ecx, 1
mov bl, byte [ecx + esi]
movsx eax, bl
movd xmm1, eax
movsx eax, byte [edi]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
jbe 0x10044c2f
mov byte [edx + esi], bl
mov edx, ecx
cmp ebp, ecx
jl 0x10044c02
mov al, byte [edi]
pop edi
mov byte [edx + esi], al
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov al, byte [eax]
mov byte [edx + esi], al
pop esi
pop ebp
pop ebx
ret

Function at 0x10044c50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x10044ca7
nop dword [eax]
add ecx, ecx
movzx eax, byte [ecx + esi + 2]
movd xmm1, eax
movzx eax, byte [ecx + esi + 1]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
xor eax, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
inc ecx
xor eax, 1
add ecx, eax
mov al, byte [ecx + esi]
mov byte [esi + edx], al
mov edx, ecx
cmp ecx, edi
jl 0x10044c70
cmp ecx, edi
jne 0x10044cba
test bl, 1
jne 0x10044cba
mov al, byte [esi + ebx - 1]
mov byte [esi + edx], al
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x10044cf9
mov edi, dword [esp + 0x20]
lea ecx, [edx - 1]
sar ecx, 1
mov bl, byte [ecx + esi]
movzx eax, bl
movd xmm1, eax
movzx eax, byte [edi]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
jbe 0x10044cef
mov byte [edx + esi], bl
mov edx, ecx
cmp ebp, ecx
jl 0x10044cc2
mov al, byte [edi]
pop edi
mov byte [edx + esi], al
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov al, byte [eax]
mov byte [edx + esi], al
pop esi
pop ebp
pop ebx
ret
Function at 0x10044d10
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x10044d69
nop dword [eax]
add ecx, ecx
movsx eax, word [esi + ecx*2 + 4]
movd xmm1, eax
movsx eax, word [esi + ecx*2 + 2]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
xor eax, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
inc ecx
xor eax, 1
add ecx, eax
mov ax, word [esi + ecx*2]
mov word [esi + edx*2], ax
mov edx, ecx
cmp ecx, edi
jl 0x10044d30
cmp ecx, edi
jne 0x10044d7e
test bl, 1
jne 0x10044d7e
mov ax, word [esi + ebx*2 - 2]
mov word [esi + edx*2], ax
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x10044dc1
mov ebx, dword [esp + 0x20]
lea ecx, [edx - 1]
sar ecx, 1
movzx edi, word [esi + ecx*2]
movsx eax, di
movd xmm1, eax
movsx eax, word [ebx]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
jbe 0x10044db5
mov word [esi + edx*2], di
mov edx, ecx
cmp ebp, ecx
jl 0x10044d86
mov ax, word [ebx]
pop edi
mov word [esi + edx*2], ax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov ax, word [eax]
mov word [esi + edx*2], ax
pop esi
pop ebp
pop ebx
ret

Function at 0x10044de0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x10044e39
nop dword [eax]
add ecx, ecx
movzx eax, word [esi + ecx*2 + 4]
movd xmm1, eax
movzx eax, word [esi + ecx*2 + 2]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
xor eax, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
inc ecx
xor eax, 1
add ecx, eax
mov ax, word [esi + ecx*2]
mov word [esi + edx*2], ax
mov edx, ecx
cmp ecx, edi
jl 0x10044e00
cmp ecx, edi
jne 0x10044e4e
test bl, 1
jne 0x10044e4e
mov ax, word [esi + ebx*2 - 2]
mov word [esi + edx*2], ax
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x10044e8e
mov ebx, dword [esp + 0x20]
movzx eax, word [ebx]
lea ecx, [edx - 1]
sar ecx, 1
movd xmm0, eax
movzx edi, word [esi + ecx*2]
cvtdq2pd xmm0, xmm0
movd xmm1, edi
cvtdq2pd xmm1, xmm1
comisd xmm1, xmm0
jbe 0x10044e82
mov word [esi + edx*2], di
mov edx, ecx
cmp ebp, ecx
jl 0x10044e56
mov ax, word [ebx]
pop edi
mov word [esi + edx*2], ax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov ax, word [eax]
mov word [esi + edx*2], ax
pop esi
pop ebp
pop ebx
ret
Function at 0x10044ea0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
lea ebp, [eax - 1]
push edi
mov edi, ebp
mov ebx, edx
sar edi, 1
cmp edx, edi
jge 0x10044ef5
nop
add ecx, ecx
xor eax, eax
movd xmm1, dword [esi + ecx*4 + 8]
movd xmm0, dword [esi + ecx*4 + 4]
cvtdq2pd xmm1, xmm1
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
xor eax, 1
inc eax
add ecx, eax
mov eax, dword [esi + ecx*4]
mov dword [esi + edx*4], eax
mov edx, ecx
cmp ecx, edi
jl 0x10044ec0
mov eax, dword [esp + 0x1c]
cmp ecx, edi
jne 0x10044f06
test al, 1
jne 0x10044f06
mov eax, dword [esi + eax*4 - 4]
mov dword [esi + edx*4], eax
mov edx, ebp
cmp ebx, edx
jge 0x10044f41
mov edi, dword [esp + 0x20]
nop
movd xmm0, dword [edi]
lea eax, [edx - 1]
sar eax, 1
cvtdq2pd xmm0, xmm0
mov ecx, dword [esi + eax*4]
movd xmm1, ecx
cvtdq2pd xmm1, xmm1
comisd xmm1, xmm0
jbe 0x10044f37
mov dword [esi + edx*4], ecx
mov edx, eax
cmp ebx, eax
jl 0x10044f10
mov eax, dword [edi]
pop edi
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov eax, dword [eax]
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret

Function at 0x10044f50
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, edx
push edi
lea edi, [ebx - 1]
sar edi, 1
cmp edx, edi
jge 0x10044fbd
nop dword [eax]
add ecx, ecx
mov eax, dword [esi + ecx*4 + 8]
movd xmm1, eax
shr eax, 0x1f
cvtdq2pd xmm1, xmm1
addsd xmm1, qword [eax*8 + 0x100ad510]
mov eax, dword [esi + ecx*4 + 4]
movd xmm0, eax
shr eax, 0x1f
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x100ad510]
xor eax, eax
comisd xmm1, xmm0
seta al
xor eax, 1
inc eax
add ecx, eax
mov eax, dword [esi + ecx*4]
mov dword [esi + edx*4], eax
mov edx, ecx
cmp ecx, edi
jl 0x10044f70
cmp ecx, edi
jne 0x10044fd0
test bl, 1
jne 0x10044fd0
mov eax, dword [esi + ebx*4 - 4]
mov dword [esi + edx*4], eax
lea edx, [ebx - 1]
cmp ebp, edx
jge 0x10045025
mov ebx, dword [esp + 0x20]
lea ecx, [edx - 1]
sar ecx, 1
mov edi, dword [esi + ecx*4]
mov eax, edi
shr eax, 0x1f
movd xmm1, edi
cvtdq2pd xmm1, xmm1
addsd xmm1, qword [eax*8 + 0x100ad510]
mov eax, dword [ebx]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x100ad510]
comisd xmm1, xmm0
jbe 0x1004501b
mov dword [esi + edx*4], edi
mov edx, ecx
cmp ebp, ecx
jl 0x10044fd8
mov eax, dword [ebx]
pop edi
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov eax, dword [eax]
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret
Function at 0x10045040
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, edx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
lea ebp, [eax - 1]
push edi
mov edi, ebp
mov ebx, edx
sar edi, 1
cmp edx, edi
jge 0x10045093
nop
add ecx, ecx
xor eax, eax
movss xmm1, dword [esi + ecx*4 + 8]
movss xmm0, dword [esi + ecx*4 + 4]
cvtps2pd xmm1, xmm1
cvtps2pd xmm0, xmm0
comisd xmm1, xmm0
seta al
xor eax, 1
inc eax
add ecx, eax
mov eax, dword [esi + ecx*4]
mov dword [esi + edx*4], eax
mov edx, ecx
cmp ecx, edi
jl 0x10045060
mov eax, dword [esp + 0x1c]
cmp ecx, edi
jne 0x100450a4
test al, 1
jne 0x100450a4
mov eax, dword [esi + eax*4 - 4]
mov dword [esi + edx*4], eax
mov edx, ebp
cmp ebx, edx
jge 0x100450df
mov ecx, dword [esp + 0x20]
nop dword [eax]
movss xmm0, dword [ecx]
lea eax, [edx - 1]
sar eax, 1
cvtps2pd xmm0, xmm0
movss xmm2, dword [esi + eax*4]
cvtps2pd xmm1, xmm2
comisd xmm1, xmm0
jbe 0x100450d5
movss dword [esi + edx*4], xmm2
mov edx, eax
cmp ebx, eax
jl 0x100450b0
mov eax, dword [ecx]
pop edi
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x20]
pop edi
mov eax, dword [eax]
mov dword [esi + edx*4], eax
pop esi
pop ebp
pop ebx
ret

Function at 0x100450f0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, edx
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, edx
push edi
lea edi, [ecx - 1]
sar edi, 1
cmp edx, edi
jge 0x1004513e
nop dword [eax]
lea ecx, [eax + eax]
xor eax, eax
movsd xmm0, qword [esi + ecx*8 + 0x10]
comisd xmm0, xmmword [esi + ecx*8 + 8]
seta al
xor eax, 1
inc eax
add eax, ecx
movsd xmm0, qword [esi + eax*8]
movsd qword [esi + edx*8], xmm0
mov edx, eax
cmp eax, edi
jl 0x10045110
mov ecx, dword [esp + 0x18]
cmp eax, edi
jne 0x10045155
test cl, 1
jne 0x10045155
movsd xmm0, qword [esi + ecx*8 - 8]
movsd qword [esi + edx*8], xmm0
lea edx, [ecx - 1]
cmp ebx, edx
jge 0x10045188
mov ecx, dword [esp + 0x1c]
nop dword [eax]
lea eax, [edx - 1]
sar eax, 1
movsd xmm0, qword [esi + eax*8]
comisd xmm0, xmmword [ecx]
jbe 0x1004517b
movsd qword [esi + edx*8], xmm0
mov edx, eax
cmp ebx, eax
jl 0x10045160
movsd xmm0, qword [ecx]
pop edi
movsd qword [esi + edx*8], xmm0
pop esi
pop ebx
ret
mov eax, dword [esp + 0x1c]
pop edi
movsd xmm0, qword [eax]
movsd qword [esi + edx*8], xmm0
pop esi
pop ebx
ret
Function at 0x100856a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 0x18
test eax, eax
je 0x1008587e
mov edx, dword [esp + 0x30]
or ecx, 0xffffffff
cmp edx, 1
jne 0x100856cd
cmp eax, 2
jne 0x100856c4
xor ecx, ecx
jmp 0x100856d7
cmp eax, 1
jne 0x100856d7
mov ecx, eax
jmp 0x100856d7
cmp edx, 2
jne 0x100856d7
cmp eax, edx
cmove ecx, edx
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
cmp eax, 5
jne 0x10085792
mov ebp, dword [esp + 0x30]
xor edx, edx
cmp ecx, 2
sete dl
xor eax, eax
inc edx
cmp ecx, 1
mov ecx, dword [esp + 0x38]
setne al
mov dword [esp + 0x10], edx
inc eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x14], eax
test ecx, ecx
je 0x1008587a
mov esi, dword [esp + 0x34]
nop word [eax + eax]
mov ebx, edx
cmp edx, eax
ja 0x10085778
lea ecx, [esi - 1]
mov dword [esp + 0x18], ecx
nop dword [eax]
mov eax, ecx
cmp eax, ebx
jl 0x10085763
mov edi, dword [ebp + eax*4]
mov esi, edi
mov ecx, dword [ebp + eax*4 - 4]
sub edi, dword [ebp + eax*4 - 4]
and ecx, 0xff800000
sub esi, ecx
xor edi, esi
and edi, 0x7fffff
xor edi, esi
mov dword [ebp + eax*4], edi
dec eax
cmp eax, ebx
jge 0x10085736
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
inc ebx
cmp ebx, eax
jle 0x10085730
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x3c]
mov esi, dword [esp + 0x34]
lea ebx, [esi*4]
add ebp, ebx
sub ecx, 1
mov dword [esp + 0x3c], ecx
jne 0x10085720
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
cmp eax, 6
jne 0x1008587a
mov edx, dword [esp + 0x30]
xor ebx, ebx
cmp ecx, 2
mov dword [esp + 0x3c], edx
sete bl
xor eax, eax
inc ebx
cmp ecx, 1
mov ecx, dword [esp + 0x38]
setne al
mov dword [esp + 0x24], ebx
inc eax
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
test ecx, ecx
je 0x1008587a
mov esi, dword [esp + 0x34]
mov dword [esp + 0x14], ebx
mov ebp, ebx
cmp ebx, eax
ja 0x10085860
lea ecx, [esi - 1]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], ecx
cmp ecx, ebp
jl 0x10085847
nop
mov esi, dword [edx + ecx*8 - 4]
mov eax, esi
mov edi, dword [edx + ecx*8]
and eax, 0xfffff
mov ebx, dword [edx + ecx*8 + 4]
mov edx, edi
mov ebp, dword [esp + 0x3c]
sub edx, dword [ebp + ecx*8 - 8]
mov ecx, ebx
sbb ecx, eax
and esi, 0xfff00000
sub edi, 0
sbb ebx, esi
xor eax, eax
xor ebx, ecx
xor eax, edx
and ebx, 0xfff00000
mov edx, ebp
mov ebp, dword [esp + 0x14]
xor ebx, ecx
mov ecx, dword [esp + 0x10]
mov dword [edx + ecx*8], eax
mov dword [edx + ecx*8 + 4], ebx
dec ecx
mov dword [esp + 0x10], ecx
cmp ecx, ebp
jge 0x100857f0
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
inc ebp
mov dword [esp + 0x14], ebp
cmp ebp, eax
jle 0x100857e6
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x34]
lea ebp, [esi*8]
add edx, ebp
sub ecx, 1
mov dword [esp + 0x3c], edx
mov dword [esp + 0x18], ecx
jne 0x100857d1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x100916a4
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100916e3
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100916e3
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100916e3
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100916e3
cmp dword [ecx + 0x74], 0xe
jbe 0x100916e3
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1009e5ae
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100b2384
push 0x100b237c
push str.FlsAlloc
push 0x1f
call fcn.1009e42d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1009e5e2
push dword [ebp + 8]
mov ecx, esi
call dword [0x100ac200]
call esi
jmp 0x1009e5e8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1009e62c
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100b2394
push 0x100b238c
push str.FlsGetValue
push 0x21
call fcn.1009e42d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1009e663
push dword [ebp + 8]
mov ecx, esi
call dword [0x100ac200]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1009e66b
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100b239c
push 0x100b2394
push str.FlsSetValue
push 0x22
call fcn.1009e42d
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1009e6a5
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x100ac200]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]