joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101dd770
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.100bab40
mov eax, dword [esp + 0x2c]
push esi
mov esi, dword [eax]
test esi, esi
jns 0x101dd790
mov dword [eax], 0xffffffff
pop esi
add esp, 0x14
ret
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x30]
test esi, esi
je 0x101dd7bc
mov ecx, dword [esp + 0x38]
test edi, edi
je 0x101dd7bc
mov al, byte [esi + ecx]
dec edi
xor al, byte [ebp]
inc esi
mov byte [ebx], al
inc ebp
inc ebx
and esi, 0xf
jne 0x101dd7a7
mov edx, dword [esp + 0x40]
cmp edi, 0x10
jb 0x101dd855
mov ecx, dword [esp + 0x38]
mov eax, ebx
sub eax, ecx
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, ecx
mov dword [esp + 0x18], eax
mov eax, edi
shr eax, 4
mov dword [esp + 0x10], eax
shl eax, 4
add ebx, eax
add ebp, eax
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x20], ebp
mov ebp, dword [esp + 0x18]
jmp 0x101dd804
mov ecx, dword [esp + 0x38]
push dword [esp + 0x34]
push ecx
push ecx
call edx
add esp, 0xc
cmp esi, 0x10
jae 0x101dd837
mov eax, dword [esp + 0x38]
mov edx, 0xf
sub edx, esi
add eax, esi
shr edx, 2
inc edx
mov ecx, dword [eax + ebp]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [ebx + eax - 4], ecx
sub edx, 1
jne 0x101dd825
mov edx, dword [esp + 0x40]
sub edi, 0x10
add ebx, 0x10
add ebp, 0x10
xor esi, esi
sub dword [esp + 0x10], 1
jne 0x101dd800
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
test edi, edi
je 0x101dd887
push dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
push eax
push eax
call edx
mov eax, dword [esp + 0x44]
add esp, 0xc
sub ebp, eax
sub ebx, eax
lea ecx, [esi + eax]
add esi, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
sub edi, 1
jne 0x101dd875
mov eax, dword [esp + 0x3c]
pop edi
pop ebp
pop ebx
mov dword [eax], esi
pop esi
add esp, 0x14
ret
Function at 0x101de030
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.100bab40
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 0x38]
or eax, dword [ebp + 0x3c]
je 0x101de04f
mov eax, 0xfffffffe
pop ebp
pop ecx
ret
push esi
mov esi, dword [esp + 0x18]
xor ecx, ecx
mov eax, esi
add eax, dword [ebp + 0x30]
adc ecx, dword [ebp + 0x34]
cmp ecx, 0x20000000
ja 0x101de120
jb 0x101de074
test eax, eax
jne 0x101de120
push ebx
mov dword [ebp + 0x34], ecx
mov ecx, dword [ebp + 0x170]
mov dword [ebp + 0x30], eax
mov dword [esp + 0x14], ecx
push edi
mov edi, dword [esp + 0x1c]
test ecx, ecx
je 0x101de0c3
nop
test esi, esi
je 0x101de112
mov al, byte [edi]
dec esi
xor byte [ecx + ebp + 0x40], al
inc edi
inc ecx
and ecx, 0xf
mov dword [esp + 0x18], ecx
jne 0x101de090
lea eax, [ebp + 0x60]
push eax
mov eax, dword [ebp + 0x168]
lea ebx, [ebp + 0x40]
push ebx
call eax
mov eax, dword [esp + 0x20]
add esp, 8
mov dword [esp + 0x18], eax
jmp 0x101de0c6
lea ebx, [ebp + 0x40]
mov eax, esi
lea ecx, [ebp + 0x60]
and eax, 0xfffffff0
mov dword [esp + 0x10], eax
je 0x101de0eb
push eax
mov eax, dword [ebp + 0x164]
push edi
push ecx
push ebx
call eax
add edi, dword [esp + 0x20]
add esp, 0x10
sub esi, dword [esp + 0x10]
test esi, esi
je 0x101de10e
mov ecx, esi
mov al, byte [edi]
lea edi, [edi + 1]
xor byte [ebx], al
lea ebx, [ebx + 1]
sub esi, 1
jne 0x101de0f1
pop edi
pop ebx
pop esi
mov dword [ebp + 0x170], ecx
xor eax, eax
pop ebp
pop ecx
ret
mov ecx, dword [esp + 0x18]
pop edi
pop ebx
pop esi
mov dword [ebp + 0x170], ecx
xor eax, eax
pop ebp
pop ecx
ret
pop esi
or eax, 0xffffffff
pop ebp
pop ecx
ret
Function at 0x101df130
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esi + 0x30], 0
lea ebp, [esi + 0x40]
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x170], 0
mov dword [esi + 0x16c], 0
cmp ebx, 0xc
jne 0x101df195
mov eax, dword [esp + 0x18]
lea edi, [ebx - 0xb]
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x1000000
jmp 0x101df292
mov edi, dword [esp + 0x18]
lea edx, [esi + 0x60]
mov dword [ebp], 0
mov dword [ebp + 4], 0
mov dword [esi + 0x48], 0
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x4c], 0
cmp ebx, 0x10
jb 0x101df22d
mov eax, ebx
lea ecx, [esi + 0x41]
shr eax, 4
mov dword [esp + 0x14], eax
nop dword [eax]
lea edx, [edi + 2]
mov eax, ecx
mov ebp, 4
nop word [eax + eax]
movzx ecx, byte [edx - 2]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 5]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 4]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 2], cl
sub ebp, 1
jne 0x101df1e0
lea eax, [esi + 0x60]
push eax
mov eax, dword [esi + 0x168]
lea ebp, [esi + 0x40]
push ebp
call eax
add esp, 8
lea ecx, [esi + 0x41]
add edi, 0x10
sub ebx, 0x10
sub dword [esp + 0x14], 1
jne 0x101df1d0
lea edx, [esi + 0x60]
test ebx, ebx
je 0x101df24f
mov ecx, ebp
mov al, byte [edi]
lea edi, [edi + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub ebx, 1
jne 0x101df233
mov eax, dword [esi + 0x168]
push edx
push ebp
call eax
add esp, 8
mov eax, dword [esp + 0x1c]
xor ecx, ecx
shld ecx, eax, 3
shl eax, 3
bswap eax
xor dword [esi + 0x4c], eax
lea eax, [esi + 0x60]
push eax
mov eax, dword [esi + 0x168]
bswap ecx
xor dword [esi + 0x48], ecx
push ebp
call eax
mov edi, dword [esi + 0x4c]
add esp, 8
mov eax, dword [ebp]
mov ecx, dword [ebp + 4]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
mov dword [esi + 8], eax
bswap edi
mov dword [esi + 0xc], ecx
mov dword [ebp], 0
lea eax, [esi + 0x20]
mov dword [ebp + 4], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
push dword [esi + 0x178]
push eax
mov eax, dword [esi + 0x174]
push esi
call eax
add esp, 0xc
inc edi
bswap edi
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x101dfae0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x30
call fcn.100bab40
mov eax, dword [0x102db080]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x3c]
push ebx
push ebp
mov ebp, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
push edi
mov edi, dword [esp + 0x50]
mov al, byte [esi]
mov ebx, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov byte [esp + 0x13], al
lea eax, [esi + 0x10]
test byte [esp + 0x13], 0x40
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
jne 0x101dfb3f
push ecx
push eax
push esi
call ebx
mov edx, dword [esp + 0x20]
add esp, 0xc
movzx eax, byte [esp + 0x13]
mov ebx, 0xf
and eax, 7
xor ecx, ecx
sub ebx, eax
mov byte [esi], al
mov dword [esp + 0x28], ebx
cmp ebx, 0xf
jae 0x101dfb73
nop dword [eax + eax]
movzx eax, byte [esi + ebx]
or ecx, eax
mov byte [esi + ebx], 0
inc ebx
shl ecx, 8
cmp ebx, 0xf
jb 0x101dfb60
movzx eax, byte [esi + 0xf]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, edi
je 0x101dfb97
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100b9f43
add esp, 0x30
ret
mov ebx, edi
shr ebx, 4
test ebx, ebx
je 0x101dfbd3
lea eax, [esi + 0x10]
push eax
push esi
push dword [esp + 0x20]
push ebx
push edx
push ebp
call dword [esp + 0x38]
shl ebx, 4
add esp, 0x18
add dword [esp + 0x14], ebx
add ebp, ebx
sub edi, ebx
je 0x101dfc2d
shr ebx, 4
push ebx
push esi
call fcn.101e0510
mov ebx, dword [esp + 0x1c]
add esp, 8
jmp 0x101dfbdd
mov ebx, dword [esp + 0x14]
mov eax, edi
test eax, eax
je 0x101dfc2d
push dword [esp + 0x18]
lea eax, [esp + 0x30]
push eax
push esi
call dword [esp + 0x28]
add esp, 0xc
test edi, edi
je 0x101dfc18
lea ecx, [esp + 0x2c]
mov eax, ecx
lea edx, [esi + 0x10]
sub ebp, eax
sub ebx, eax
nop
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [ebx + ecx - 1], al
xor byte [edx - 1], al
sub edi, 1
jne 0x101dfc00
mov ebp, dword [esp + 0x18]
lea ebx, [esi + 0x10]
mov edi, dword [esp + 0x1c]
push ebp
push ebx
push ebx
call edi
add esp, 0xc
jmp 0x101dfc38
mov edi, dword [esp + 0x1c]
lea ebx, [esi + 0x10]
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
cmp ecx, 0x10
jae 0x101dfc57
mov eax, 0x10
sub eax, ecx
push eax
lea eax, [ecx + esi]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push ebp
lea eax, [esp + 0x30]
push eax
push esi
call edi
mov eax, dword [esp + 0x38]
add esp, 0xc
xor dword [ebx], eax
mov eax, dword [esp + 0x30]
xor dword [ebx + 4], eax
mov eax, dword [esp + 0x34]
xor dword [esi + 0x18], eax
mov eax, dword [esp + 0x38]
xor dword [esi + 0x1c], eax
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x3c]
pop edi
mov byte [esi], al
xor eax, eax
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100b9f43
add esp, 0x30
ret
Function at 0x101e1b30
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.100bab40
mov edx, dword [esp + 0x1c]
xor ecx, ecx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x28]
test edx, edx
je 0x101e1c95
push ebx
push ebp
mov ebp, dword [esp + 0x28]
cmp edx, 8
jb 0x101e1c78
lea eax, [ebp - 1]
lea ebx, [edi - 1]
add eax, edx
add ebx, edx
cmp edi, eax
ja 0x101e1b77
cmp ebx, ebp
jae 0x101e1c78
lea eax, [edx - 1]
add eax, esi
cmp edi, eax
ja 0x101e1b88
cmp ebx, esi
jae 0x101e1c78
cmp edx, 0x40
jb 0x101e1c30
mov ebx, edx
mov eax, edx
and ebx, 0x3f
mov edx, esi
sub eax, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
mov ebx, esi
lea eax, [edi + 0x20]
sub ebx, ebp
mov dword [esp + 0x10], eax
mov ebp, edi
mov eax, dword [esp + 0x28]
sub ebp, eax
sub edx, edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x14], edx
lea edx, [eax + 0x10]
movups xmm0, xmmword [edx - 0x10]
mov eax, dword [esp + 0x14]
lea edx, [edx + 0x40]
movups xmm1, xmmword [ecx + esi]
lea edi, [edi + 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [edx - 0x40]
movups xmmword [edi - 0x60], xmm1
movups xmm1, xmmword [ebx + edx - 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [edx - 0x30]
movups xmmword [edx + ebp - 0x40], xmm1
movups xmm1, xmmword [eax + edi - 0x40]
mov eax, dword [esp + 0x28]
pxor xmm1, xmm0
movups xmm0, xmmword [edx - 0x20]
movups xmmword [edi - 0x40], xmm1
movups xmm1, xmmword [ecx + esi + 0x30]
add ecx, 0x40
pxor xmm1, xmm0
movups xmmword [edi - 0x30], xmm1
cmp ecx, dword [esp + 0x18]
jb 0x101e1bc4
cmp dword [esp + 0x1c], 8
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
jb 0x101e1c70
jmp 0x101e1c3c
mov eax, dword [esp + 0x28]
mov ebx, esi
sub ebx, ebp
mov ebp, edi
sub ebp, eax
mov dword [esp + 0x2c], edx
and dword [esp + 0x2c], 0xfffffff8
add eax, ecx
nop word [eax + eax]
movq xmm1, qword [eax + ebx]
lea eax, [eax + 8]
movq xmm0, qword [eax - 8]
add ecx, 8
pxor xmm1, xmm0
movq qword [eax + ebp - 8], xmm1
cmp ecx, dword [esp + 0x2c]
jb 0x101e1c50
cmp ecx, edx
jae 0x101e1c93
mov ebp, dword [esp + 0x28]
sub esi, ebp
lea eax, [ecx + ebp]
sub edi, ebp
sub edx, ecx
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [edi + eax - 1], cl
sub edx, 1
jne 0x101e1c81
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x101e1db0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.100bab40
mov ecx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
lea ebp, [ecx + 0x40]
mov esi, dword [ecx + 0x14]
cmp edi, esi
jbe 0x101e1e5a
mov edx, dword [ecx + 0x18]
cmp edi, edx
jb 0x101e1e0d
mov eax, edi
sub eax, edx
add eax, 4
and eax, 0xfffffffc
add eax, edx
push 0x71
mov dword [ecx + 0x18], eax
push str.cryptomodesocb128.c
shl eax, 4
push eax
push dword [ebp]
call fcn.10103530
add esp, 0x10
test eax, eax
jne 0x101e1e0a
pop edi
pop esi
pop ebp
add esp, 8
ret
mov dword [ebp], eax
mov eax, esi
shl eax, 4
mov dword [esp + 0x10], eax
mov eax, edi
mov edi, dword [esp + 0x10]
sub eax, esi
mov dword [esp + 0xc], eax
push ebx
mov eax, dword [ebp]
add eax, edi
mov bl, byte [eax]
lea esi, [eax + 0x10]
push esi
shr bl, 7
push 1
neg bl
push eax
and bl, 0x87
call fcn.101e1aa0
xor byte [esi + 0xf], bl
add esp, 0xc
add edi, 0x10
sub dword [esp + 0x10], 1
jne 0x101e1e23
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
pop ebx
mov dword [eax + 0x14], edi
shl edi, 4
add edi, dword [ebp]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 8
ret
Function at 0x101e5c00
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x101e5c14
mov dword [esp + 0x18], fcn.101e43d0
jmp fcn.101dd5b0
mov dword [esp + 0x18], fcn.101e3670
jmp fcn.101dd2b0
Function at 0x101e7ff0
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.101d8690
add esp, 4
test eax, eax
jne 0x101e8004
pop esi
ret
lea eax, [esi + 0x5c]
pop esi
mov dword [esp + 4], eax
jmp fcn.1010f240
Function at 0x101eddc0
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0xa8
push 0
lea eax, [esi + 0x40]
push eax
call sub.VCRUNTIME140.dll_memset
mov edx, dword [esp + 0x18]
add esp, 0xc
mov dword [esi], 0xf3bcc908
mov dword [esi + 4], 0x6a09e667
mov dword [esi + 8], 0x84caa73b
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0xfe94f82b
mov dword [esi + 0x14], 0x3c6ef372
mov dword [esi + 0x18], 0x5f1d36f1
mov dword [esi + 0x1c], 0xa54ff53a
mov dword [esi + 0x20], 0xade682d1
mov dword [esi + 0x24], 0x510e527f
mov dword [esi + 0x28], 0x2b3e6c1f
mov dword [esi + 0x2c], 0x9b05688c
mov dword [esi + 0x30], 0xfb41bd6b
mov dword [esi + 0x34], 0x1f83d9ab
mov dword [esi + 0x38], 0x137e2179
mov dword [esi + 0x3c], 0x5be0cd19
movzx eax, byte [edx]
mov dword [esi + 0xe4], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
xor ecx, 0xf3bcc908
mov dword [esi], ecx
xor eax, 0x6a09e667
mov dword [esi + 4], eax
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
xor ecx, 0x84caa73b
mov dword [esi + 8], ecx
xor eax, 0xbb67ae85
mov dword [esi + 0xc], eax
mov ecx, dword [edx + 0x10]
mov eax, dword [edx + 0x14]
xor ecx, 0xfe94f82b
mov dword [esi + 0x10], ecx
xor eax, 0x3c6ef372
mov dword [esi + 0x14], eax
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x1c]
xor ecx, 0x5f1d36f1
mov dword [esi + 0x18], ecx
xor eax, 0xa54ff53a
mov dword [esi + 0x1c], eax
mov ecx, dword [edx + 0x20]
mov eax, dword [edx + 0x24]
xor ecx, 0xade682d1
mov dword [esi + 0x20], ecx
xor eax, 0x510e527f
mov dword [esi + 0x24], eax
mov ecx, dword [edx + 0x28]
mov eax, dword [edx + 0x2c]
xor ecx, 0x2b3e6c1f
xor eax, 0x9b05688c
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov ecx, dword [edx + 0x30]
mov eax, dword [edx + 0x34]
xor ecx, 0xfb41bd6b
xor eax, 0x1f83d9ab
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
mov ecx, dword [edx + 0x38]
mov eax, dword [edx + 0x3c]
xor ecx, 0x137e2179
xor eax, 0x5be0cd19
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
pop esi
ret
Function at 0x101efc70
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x58
push 0
lea eax, [esi + 0x20]
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
movzx eax, byte [ecx]
mov dword [esi + 0x74], eax
mov eax, dword [ecx]
xor eax, 0x6a09e667
mov dword [esi], eax
mov eax, dword [ecx + 4]
xor eax, 0xbb67ae85
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
xor eax, 0x3c6ef372
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
xor eax, 0xa54ff53a
mov dword [esi + 0xc], eax
mov eax, dword [ecx + 0x10]
xor eax, 0x510e527f
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 0x14]
xor eax, 0x9b05688c
mov dword [esi + 0x14], eax
mov eax, dword [ecx + 0x18]
xor eax, 0x1f83d9ab
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 0x1c]
xor eax, 0x5be0cd19
mov dword [esi + 0x1c], eax
pop esi
ret
Function at 0x1020d6e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
cmp dword [ebx + 0x84], 0xffffffff
je 0x1020d7b4
push dword [ebx]
call fcn.10107390
mov esi, eax
add esp, 4
test esi, esi
js 0x1020d7b4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1020d711
mov dword [eax], esi
push ebp
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x1020d7ab
mov ecx, dword [ebx + 0x84]
push edi
cmp ecx, esi
jne 0x1020d74a
test esi, esi
jle 0x1020d789
mov edx, ebp
lea ecx, [ebx + 4]
mov edi, esi
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub edi, 1
jne 0x1020d734
jmp 0x1020d789
mov eax, esi
mov byte [ecx + ebx + 0x64], 0x80
sub eax, ecx
cmp eax, 1
jle 0x1020d76a
dec eax
push eax
lea eax, [ebx + 0x65]
add eax, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test esi, esi
jle 0x1020d789
mov edx, ebp
lea ecx, [ebx + 0x24]
mov edi, esi
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub edi, 1
jne 0x1020d775
push esi
push ebp
push ebp
push dword [ebx]
call fcn.10107ce0
add esp, 0x10
pop edi
test eax, eax
jg 0x1020d7ab
push esi
push ebp
call fcn.10001320
add esp, 8
xor eax, eax
pop ebp
pop esi
pop ebx
ret
pop ebp
pop esi
mov eax, 1
pop ebx
ret
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10219ef0
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
xor ebp, ebp
push esi
test eax, eax
je 0x10219f08
test byte [eax + 0x5c], 2
mov ebx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x10219f0d
mov ebx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov esi, dword [esp + 0x1c]
test esi, esi
jle 0x10219fe5
mov edx, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
inc edi
movzx eax, byte [edi - 1]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
cmp esi, 3
jb 0x10219f79
movzx ecx, byte [edi]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 1]
shl eax, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
mov ecx, eax
shr ecx, 6
and ecx, 0x3f
and eax, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 2], cl
mov cl, byte [eax + ebx]
lea eax, [edx + 3]
jmp 0x10219fc5
shl eax, 0x10
cmp esi, 2
jne 0x10219f89
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
cmp esi, 1
jne 0x10219fac
mov al, 0x3d
jmp 0x10219fb5
shr eax, 6
and eax, 0x3f
mov al, byte [eax + ebx]
mov ecx, dword [esp + 0x18]
mov byte [ecx + 2], al
mov cl, 0x3d
mov eax, dword [esp + 0x14]
add eax, 3
sub esi, 3
mov byte [eax], cl
add ebp, 4
lea edx, [eax + 1]
add edi, 3
test esi, esi
jg 0x10219f23
pop edi
pop esi
mov eax, ebp
mov byte [edx], 0
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x14]
pop esi
mov byte [eax], 0
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x1021e1d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.100bab40
mov edx, dword [esp + 0x18]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x34]
or ecx, 0xffffffff
push ebp
mov ebp, dword [esp + 0x34]
cmp ebp, 1
push esi
mov esi, dword [edx]
setne al
add eax, ebx
mov dword [esp + 0x1c], esi
cmp eax, esi
jbe 0x1021e209
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
cmp ebp, 1
je 0x1021e2d4
mov ecx, dword [esp + 0x2c]
dec ecx
add ecx, esi
cmp dword [esp + 0x40], 0
mov dword [esp + 0x10], ecx
mov cl, byte [ecx]
mov byte [esp + 0xf], cl
movzx ebp, cl
je 0x1021e240
sub esi, ebp
mov eax, 1
sub esi, ebx
dec esi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
lea ecx, [eax + ebp]
mov ebx, esi
sub ebx, ecx
mov eax, esi
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, 0x100
xor ebx, esi
shr ebx, 0x1f
dec ebx
cmp esi, eax
push edi
cmovb eax, esi
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
je 0x1021e2b7
mov esi, dword [esp + 0x14]
mov edx, ebp
shr edx, 0x1f
mov dword [esp + 0x1c], edx
mov ecx, ebp
lea esi, [esi - 1]
sub ecx, edi
mov eax, edi
shr ecx, 0x1f
inc edi
shr eax, 0x1f
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [esp + 0x13]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [esi + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x1c]
cmp edi, dword [esp + 0x18]
jb 0x1021e277
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
not ebx
lea eax, [ebp + 1]
mov ebp, dword [esp + 0x3c]
movzx ecx, bl
mov ebx, dword [esp + 0x40]
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub esi, eax
mov dword [edx], esi
pop edi
push dword [esp + 0x44]
push ecx
push ebx
push ebp
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x44]
push edx
call fcn.1021dea0
add esp, 0x24
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x1021e800
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x30
call fcn.100bab40
mov eax, dword [0x102db080]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x44]
push esi
push edi
mov edi, dword [esp + 0x44]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x30]
test eax, eax
je 0x1021e912
movups xmm0, xmmword [edi + 0x10]
mov ebx, dword [esp + 0x50]
lea esi, [edi + 0x10]
dec eax
mov dword [esp + 0x10], ebx
movups xmmword [esp + 0x2c], xmm0
and byte [esp + 0x38], 0x7f
lea ecx, [esp + 0x2c]
push 1
mov dword [edi + 0x30], eax
push ecx
psrldq xmm0, 8
movd eax, xmm0
push 0
push 0
and al, 0x7f
mov byte [esp + 0x44], al
mov eax, dword [edi + 0x20]
push 0
push eax
mov dword [esp + 0x30], eax
call fcn.1011b210
add esp, 0x18
test eax, eax
je 0x1021e912
push dword [esp + 0x10]
lea eax, [esp + 0x14]
push dword [esp + 0x18]
push eax
push ebp
push dword [esp + 0x28]
call fcn.1011bc80
add esp, 0x14
test eax, eax
je 0x1021e912
push ebx
push ebp
lea eax, [esp + 0x24]
push eax
push edi
call fcn.1021ed10
add esp, 0x10
test eax, eax
je 0x1021e912
lea eax, [esi + 0xf]
xor edx, edx
lea ecx, [esp + 0x1c]
cmp ecx, eax
ja 0x1021e8e3
lea eax, [esp + 0x2b]
cmp eax, esi
jb 0x1021e8e3
mov eax, ecx
sub esi, eax
lea ecx, [esp + 0x1c]
add ecx, edx
inc edx
mov al, byte [esi + ecx]
xor byte [ecx], al
cmp edx, 0x10
jl 0x1021e8d0
jmp 0x1021e8f4
movups xmm1, xmmword [esp + 0x1c]
movups xmm0, xmmword [esi]
pxor xmm1, xmm0
movups xmmword [esp + 0x1c], xmm1
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
or ecx, dword [esp + 0x24]
or eax, dword [esp + 0x28]
or ecx, eax
je 0x1021e927
push ebx
push ebp
call fcn.10001320
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100b9f43
add esp, 0x30
ret
mov ecx, dword [esp + 0x3c]
mov eax, ebx
mov dword [edi + 0x2c], 0
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100b9f43
add esp, 0x30
ret