joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10116030
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f2a9b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1025f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
mov dword [edx], vtable.SkBlitter.0
mov dword [edx + 4], 0
mov dword [edx + 8], 0
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
mov dword [edx], vtable.SkRasterBlitter.0
movups xmm0, xmmword [eax]
movups xmmword [edx + 0xc], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [edx + 0x1c], xmm0
mov dword [ebp - 4], 2
mov eax, dword [ebp + 0xc]
mov dword [edx], vtable.SkARGB32_Blitter.0
mov ecx, dword [eax + 0x34]
mov edi, ecx
shr edi, 0x18
mov eax, ecx
shr eax, 0x10
mov dword [edx + 0x34], edi
movzx esi, al
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x2c], ecx
lea edx, [edi + 1]
imul esi, edx
mov dword [ebp + 8], ecx
shl edi, 8
shr esi, 8
mov dword [eax + 0x38], esi
or edi, esi
mov eax, ecx
shl edi, 8
shr eax, 8
movzx ecx, al
mov eax, dword [ebp - 0x10]
imul ecx, edx
shr ecx, 8
mov dword [eax + 0x3c], ecx
or edi, ecx
mov eax, dword [ebp + 8]
movzx eax, al
imul eax, edx
mov edx, dword [ebp - 0x10]
shl edi, 8
shr eax, 8
or edi, eax
mov dword [edx + 0x40], eax
mov dword [edx + 0x30], edi
mov dword [ebp - 4], 0xffffffff
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10117540
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [esp + 0x10]
push ebp
mov ebp, ecx
test dl, dl
je 0x10117613
cmp dword [ebp + 0x34], 0
je 0x10117613
mov ecx, dword [ebp + 0x14]
imul ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [ebp + 0x30]
push esi
lea esi, [ecx + eax*4]
add esi, dword [ebp + 0xc]
cmp dl, 0xff
je 0x101175aa
mov ecx, ebx
movzx edx, dl
mov eax, ebx
and ecx, 0xff00ff
inc edx
shr eax, 8
imul ecx, edx
and eax, 0xffff00ff
shr ebx, 8
imul eax, edx
and ebx, 0xff00ff
imul ebx, edx
shr ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor ebx, ecx
push edi
mov eax, ebx
mov edi, 0xff
shr eax, 0x18
sub edi, eax
mov eax, dword [ebp + 0x14]
mov ebp, dword [esp + 0x1c]
sub ebp, 1
mov dword [esp + 0x20], eax
js 0x10117610
nop word [eax + eax]
mov ecx, dword [esi]
mov edx, ecx
and edx, 0xff00ff
mov eax, ecx
imul edx, edi
shr eax, 8
and eax, 0xffff00ff
shr ecx, 8
imul eax, edi
and ecx, 0xff00ff
imul ecx, edi
shr edx, 8
xor edx, eax
and edx, 0xff00ff
xor edx, ecx
add edx, ebx
mov dword [esi], edx
add esi, dword [esp + 0x20]
sub ebp, 1
jns 0x101175d0
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x101176c0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ecx + 0x14]
imul edx, dword [esp + 8]
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
movsx esi, word [ebx]
lea ebp, [edx + eax*4]
mov dword [esp + 0x14], esi
add ebp, dword [ecx + 0xc]
test esi, esi
jle 0x101177ad
mov eax, dword [esp + 0x18]
push edi
nop dword [eax]
movzx eax, byte [eax]
test eax, eax
je 0x10117788
cmp eax, 0xff
jne 0x10117728
cmp esi, 0x12c
jle 0x10117717
mov ecx, esi
mov eax, 0xff000000
mov edi, ebp
rep stosd dword es:[edi], eax
jmp 0x10117788
push esi
push 0xff000000
push ebp
call fcn.100e32a0
add esp, 0xc
jmp 0x10117788
mov ecx, eax
mov ebx, 0x100
shl ecx, 0x18
mov edi, esi
mov dword [esp + 0x14], ecx
sub ebx, eax
mov esi, ecx
nop dword [eax]
mov ecx, dword [ebp + edi*4 - 4]
dec edi
mov edx, ecx
mov eax, ecx
and edx, 0xff00ff
shr eax, 8
imul edx, ebx
and eax, 0xffff00ff
shr ecx, 8
imul eax, ebx
and ecx, 0xff00ff
imul ecx, ebx
shr edx, 8
xor edx, eax
and edx, 0xff00ff
xor edx, ecx
add edx, esi
mov dword [ebp + edi*4], edx
test edi, edi
jg 0x10117740
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
lea ebx, [ebx + esi*2]
add eax, esi
mov dword [esp + 0x20], ebx
lea ebp, [ebp + esi*4]
mov dword [esp + 0x1c], eax
movsx esi, word [ebx]
mov dword [esp + 0x18], esi
test esi, esi
jg 0x101176f0
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x1011a520
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sar dword [esp + 4], 3
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
mov ebp, ecx
push edi
sub ebp, edx
movzx eax, word [edx]
lea edx, [edx + 2]
movzx ecx, word [edx + ebp - 2]
mov esi, eax
and esi, 0x7e0
mov edi, ecx
and edi, 0x7e0
shl esi, 0x10
shl edi, 0x10
or esi, eax
or edi, ecx
and esi, 0xfffff81f
and edi, 0xfffff81f
dec ebx
sub edi, esi
imul edi, dword [esp + 0x14]
shr edi, 5
add edi, esi
mov eax, edi
shr eax, 0x10
xor eax, edi
and eax, 0x7e0
xor eax, edi
mov word [edx - 2], ax
test ebx, ebx
jg 0x1011a531
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x1011a920
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
mov eax, ecx
push edi
mov dword [esp + 8], eax
cmp dword [ebx + 0x18], 0
lea edi, [eax + 0xc]
jne 0x1011a950
push dword [esp + 0x18]
mov edx, ebx
mov ecx, edi
call fcn.1011a600
add esp, 4
pop edi
pop ebx
add esp, 8
ret 8
mov edx, dword [esp + 0x18]
mov eax, dword [edi + 8]
push ebp
mov ebp, dword [ebx + 0x14]
mov ecx, dword [edx]
push esi
mov esi, dword [edx + 4]
imul eax, esi
mov dword [esp + 0x20], ebp
lea eax, [eax + ecx*2]
add eax, dword [edi]
mov edi, esi
sub edi, dword [ebx + 8]
imul edi, ebp
mov ebp, dword [edx + 0xc]
sub ebp, esi
sub edi, dword [ebx + 4]
add edi, dword [ebx]
mov ebx, dword [edx + 8]
add edi, ecx
mov edx, dword [esp + 0x10]
sub ebx, ecx
mov dword [esp + 0x14], ebx
mov edx, dword [edx + 0x14]
lea ecx, [ebx + ebx]
sub edx, ecx
sub dword [esp + 0x20], ebx
mov dword [esp + 0x1c], edx
nop
movzx ecx, word [eax]
movzx edx, byte [edi]
mov esi, ecx
and esi, 0x7e0
inc edi
shl esi, 0x10
or esi, ecx
mov ecx, 0x100
sub ecx, edx
and esi, 0xfffff81f
shr ecx, 3
imul esi, ecx
shr esi, 5
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
and ecx, 0x7e0
xor ecx, esi
mov word [eax], cx
add eax, 2
sub ebx, 1
jne 0x1011a9a0
add eax, dword [esp + 0x1c]
add edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
sub ebp, 1
jne 0x1011a9a0
pop esi
pop ebp
pop edi
pop ebx
add esp, 8
ret 8

Function at 0x1011aa00
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ecx + 0x14]
imul edx, dword [esp + 8]
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x14]
push esi
lea esi, [edx + eax*2]
movsx edx, word [ebx]
add esi, dword [ecx + 0xc]
test edx, edx
jle 0x1011aa56
push ebp
mov ebp, dword [esp + 0x18]
push edi
movzx eax, byte [ebp]
lea ebx, [ebx + edx*2]
add ebp, edx
lea edi, [edx + edx]
test eax, eax
je 0x1011aa4b
cmp eax, 0xff
jne 0x1011aa5b
lea eax, [edx + edx]
push eax
push 0
push esi
call fcn.101b5530
add esp, 0xc
add esi, edi
movsx edx, word [ebx]
test edx, edx
jg 0x1011aa25
pop edi
pop ebp
pop esi
pop ebx
ret 0x10
mov edi, 0x100
sub edi, eax
shr edi, 3
movzx eax, word [esi]
mov ecx, eax
and ecx, 0x7e0
shl ecx, 0x10
or ecx, eax
and ecx, 0xfffff81f
imul ecx, edi
shr ecx, 5
mov eax, ecx
shr eax, 0x10
xor eax, ecx
and eax, 0x7e0
xor eax, ecx
mov word [esi], ax
add esi, 2
sub edx, 1
jne 0x1011aa65
jmp 0x1011aa4d
Function at 0x1011ab30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x18]
mov eax, dword [ecx + 0x14]
push ebx
mov ebx, dword [ecx + 0x30]
imul eax, edx
push ebp
mov ebp, dword [esp + 0x1c]
mov dword [esp + 0x10], ebx
mov bl, byte [ecx + 0x3e]
push esi
mov byte [esp + 0x24], bl
lea esi, [eax + ebp*2]
movzx eax, word [ecx + 0x3a]
add esi, dword [ecx + 0xc]
test bl, bl
movzx ecx, word [ecx + 0x3c]
mov ebx, 0
setne bl
mov dword [esp + 0x20], eax
xor ebp, edx
mov dword [esp + 0x18], ebx
mov edx, dword [esp + 0x2c]
and ebp, ebx
mov dword [esp + 0x10], ecx
movsx ebx, word [edx]
test ebx, ebx
jle 0x1011ac3e
movzx eax, ax
test ebp, ebp
movzx ecx, cx
cmove ecx, eax
mov eax, dword [esp + 0x20]
push edi
movzx edi, cx
movzx ecx, ax
mov eax, dword [esp + 0x14]
movzx eax, ax
cmove ecx, eax
mov dword [esp + 0x10], edi
movzx eax, cx
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x2c]
lea edx, [edx + ebx*2]
lea ebp, [ebx + ebx]
mov dword [esp + 0x30], edx
movzx eax, byte [ecx]
add ecx, ebx
mov dword [esp + 0x2c], ecx
test eax, eax
je 0x1011abf2
cmp eax, 0xff
jne 0x1011ac7a
cmp byte [esp + 0x28], 0
je 0x1011ac47
push ebx
push dword [esp + 0x28]
mov edx, edi
mov ecx, esi
call fcn.1011a590
add esp, 8
add esi, ebp
mov ebp, dword [esp + 0x10]
mov edi, ebx
and edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
movzx eax, ax
movzx ecx, bp
cmove ecx, eax
mov eax, dword [esp + 0x30]
movzx edx, cx
test edi, edi
movsx ebx, word [eax]
mov eax, dword [esp + 0x24]
movzx ecx, ax
movzx eax, bp
cmove ecx, eax
mov eax, edx
mov edx, dword [esp + 0x30]
movzx edi, cx
mov dword [esp + 0x10], edi
mov dword [esp + 0x24], eax
test ebx, ebx
jg 0x1011abb4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10
cmp ebx, 0x12c
jle 0x1011ac6a
mov eax, edi
mov ecx, ebx
movzx edx, ax
mov edi, esi
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
jmp 0x1011abf2
push ebx
push edi
push esi
call fcn.100e3230
add esp, 0xc
jmp 0x1011abf2
inc eax
mov ebp, 0x20
shr eax, 3
mov edx, ebx
mov edi, eax
imul edi, dword [esp + 0x18]
sub ebp, eax
nop
movzx eax, word [esi]
mov ecx, eax
and ecx, 0x7e0
shl ecx, 0x10
or ecx, eax
and ecx, 0xfffff81f
imul ecx, ebp
add ecx, edi
shr ecx, 5
mov eax, ecx
shr eax, 0x10
xor eax, ecx
and eax, 0x7e0
xor eax, ecx
mov word [esi], ax
add esi, 2
sub edx, 1
jne 0x1011ac90
jmp 0x1011abf4
Function at 0x1011afa0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push edi
mov ebp, ecx
cmp dword [ebx + 0x18], 0
jne 0x1011afd1
movzx eax, word [ebp + 0x38]
lea ecx, [ebp + 0xc]
push eax
push dword [esp + 0x20]
mov edx, ebx
call fcn.1011acd0
add esp, 8
pop edi
pop ebp
pop ebx
add esp, 8
ret 8
mov edx, dword [esp + 0x1c]
mov edi, dword [ebx + 0x14]
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x1c], edi
mov ecx, dword [edx]
push esi
mov esi, dword [edx + 4]
mov edi, esi
sub edi, dword [ebx + 8]
imul edi, dword [esp + 0x20]
imul eax, esi
sub edi, dword [ebx + 4]
add edi, dword [ebx]
mov ebx, dword [edx + 8]
add edi, ecx
sub ebx, ecx
lea eax, [eax + ecx*2]
mov dword [esp + 0x14], ebx
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp + 0x14]
sub ecx, esi
add eax, dword [ebp + 0xc]
mov ebp, dword [ebp + 0x30]
mov dword [esp + 0x1c], ecx
lea ecx, [ebx + ebx]
sub edx, ecx
sub dword [esp + 0x20], ebx
mov dword [esp + 0x10], edx
movzx ecx, word [eax]
movzx esi, byte [edi]
mov edx, ecx
and edx, 0x7e0
inc esi
shl edx, 0x10
inc edi
or edx, ecx
shr esi, 3
and edx, 0xfffff81f
mov ecx, ebp
sub ecx, edx
imul esi, ecx
shr esi, 5
add esi, edx
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
and ecx, 0x7e0
xor ecx, esi
mov word [eax], cx
add eax, 2
sub ebx, 1
jne 0x1011b024
add eax, dword [esp + 0x10]
add edi, dword [esp + 0x20]
sub dword [esp + 0x1c], 1
mov ebx, dword [esp + 0x14]
jne 0x1011b024
pop esi
pop edi
pop ebp
pop ebx
add esp, 8
ret 8

Function at 0x1011b090
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, 0x20
movzx ecx, byte [esp + 0x1c]
inc ecx
push edi
mov edx, dword [esi + 0x14]
imul edx, dword [esp + 0x18]
mov edi, dword [esi + 0x30]
mov ebp, dword [esi + 0x14]
shr ecx, 3
imul edi, ecx
lea eax, [edx + eax*2]
add eax, dword [esi + 0xc]
sub ebx, ecx
mov esi, dword [esp + 0x1c]
movzx ecx, word [eax]
mov edx, ecx
and edx, 0x7e0
shl edx, 0x10
or edx, ecx
and edx, 0xfffff81f
imul edx, ebx
add edx, edi
shr edx, 5
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
and ecx, 0x7e0
xor ecx, edx
mov word [eax], cx
add eax, ebp
sub esi, 1
jne 0x1011b0c5
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x1011b110
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 0x14]
imul eax, dword [esp + 0x14]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x28]
push edi
movzx edi, word [ecx + 0x38]
dec esi
lea ebx, [eax + ebp*2]
movzx edx, di
add ebx, dword [ecx + 0xc]
cmp byte [ecx + 0x3e], 0
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], edx
je 0x1011b22b
xor ebp, dword [esp + 0x24]
movzx edx, word [ecx + 0x3c]
and ebp, 1
test esi, esi
js 0x1011b26e
movzx eax, di
test ebp, ebp
mov ecx, edx
cmove ecx, eax
mov eax, dword [esp + 0x20]
movzx edi, cx
movzx ecx, ax
mov eax, edx
cmove ecx, eax
mov dword [esp + 0x14], edi
movzx ecx, cx
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x28]
mov ebp, ebx
movzx edx, cx
mov dword [esp + 0x20], edx
movzx edx, di
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], edx
test eax, eax
jle 0x1011b204
test bl, 2
je 0x1011b1bf
movzx edx, cx
lea ebp, [ebx + 2]
dec eax
movzx ecx, di
mov word [ebx], di
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x20], ecx
mov ecx, eax
movzx edx, dx
mov eax, dword [esp + 0x20]
movzx eax, ax
shl eax, 0x10
sar ecx, 1
or eax, edx
cmp ecx, 0x12c
jle 0x1011b1e4
mov edi, ebp
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x14]
jmp 0x1011b1ef
push ecx
push eax
push ebp
call fcn.100e32a0
add esp, 0xc
mov eax, dword [esp + 0x2c]
test al, 1
je 0x1011b200
mov ecx, dword [esp + 0x10]
mov word [ebp + eax*2 - 2], cx
mov ecx, dword [esp + 0x24]
add ebx, dword [esp + 0x18]
sub esi, 1
movzx eax, cx
movzx ecx, di
mov edi, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], edi
jns 0x1011b185
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
test esi, esi
js 0x1011b26e
mov ebp, dword [esp + 0x28]
cmp ebp, 0x12c
jle 0x1011b256
mov eax, edx
mov ecx, ebp
movzx edx, ax
mov edi, ebx
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
jmp 0x1011b261
push ebp
push edx
push ebx
call fcn.100e3230
add esp, 0xc
add ebx, dword [esp + 0x18]
sub esi, 1
mov edx, dword [esp + 0x14]
jns 0x1011b233
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x10
Function at 0x1011b4d0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ecx + 0x14]
imul edx, dword [esp + 8]
mov eax, dword [esp + 4]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [ecx + 0x34]
movsx esi, word [ebp]
lea eax, [edx + eax*2]
mov dword [esp + 0x10], edi
add eax, dword [ecx + 0xc]
mov edx, dword [ecx + 0x30]
mov dword [esp + 0x14], edx
test esi, esi
jle 0x1011b57d
push ebx
mov ebx, dword [esp + 0x1c]
movzx edx, byte [ebx]
lea ebp, [ebp + esi*2]
add ebx, esi
lea ecx, [esi + esi]
mov dword [esp + 0x1c], ebx
test edx, edx
je 0x1011b572
lea ecx, [edx + 1]
mov ebx, 0x20
imul ecx, edi
shr ecx, 0xb
mov edi, ecx
imul edi, dword [esp + 0x18]
sub ebx, ecx
nop
movzx ecx, word [eax]
mov edx, ecx
and edx, 0x7e0
shl edx, 0x10
or edx, ecx
and edx, 0xfffff81f
imul edx, ebx
add edx, edi
shr edx, 5
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
and ecx, 0x7e0
xor ecx, edx
mov word [eax], cx
add eax, 2
sub esi, 1
jne 0x1011b530
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
jmp 0x1011b574
add eax, ecx
movsx esi, word [ebp]
test esi, esi
jg 0x1011b504
pop ebx
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x1011bd00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
mov ebx, ecx
push edi
cmp dword [ebp + 0x18], 0
jne 0x1011bd3a
movzx eax, word [ebx + 0x38]
lea ecx, [ebx + 0xc]
push eax
mov eax, 0x100
mov edx, ebp
sub eax, dword [ebx + 0x34]
push eax
push dword [esp + 0x2c]
call fcn.1011b760
add esp, 0xc
pop edi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov edx, dword [esp + 0x24]
mov edi, dword [ebp + 0x14]
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x24], edi
mov ecx, dword [edx]
push esi
mov esi, dword [edx + 4]
mov edi, esi
sub edi, dword [ebp + 8]
imul edi, dword [esp + 0x28]
imul eax, esi
sub edi, dword [ebp + 4]
add edi, dword [ebp]
mov ebp, dword [edx + 8]
add edi, ecx
sub ebp, ecx
mov dword [esp + 0x14], ebp
lea eax, [eax + ecx*2]
mov ebp, dword [edx + 0xc]
mov edx, dword [esp + 0x14]
sub ebp, esi
mov esi, dword [ebx + 0x14]
add eax, dword [ebx + 0xc]
mov dword [esp + 0x24], ebp
lea ecx, [edx + edx]
sub esi, ecx
mov ecx, dword [ebx + 0x30]
sub dword [esp + 0x28], edx
mov dword [esp + 0x1c], esi
mov esi, dword [ebx + 0x34]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], esi
nop dword [eax]
mov ebp, dword [esp + 0x18]
mov ebx, edx
movzx edx, byte [edi]
inc edi
movzx ecx, word [eax]
inc edx
imul edx, esi
mov esi, ecx
and esi, 0x7e0
shl esi, 0x10
or esi, ecx
mov ecx, 0x20
and esi, 0xfffff81f
shr edx, 0xb
sub ecx, edx
imul edx, ebp
imul esi, ecx
add esi, edx
shr esi, 5
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
and ecx, 0x7e0
xor ecx, esi
mov esi, dword [esp + 0x10]
mov word [eax], cx
add eax, 2
sub ebx, 1
jne 0x1011bda6
add eax, dword [esp + 0x1c]
add edi, dword [esp + 0x28]
sub dword [esp + 0x24], 1
mov edx, dword [esp + 0x14]
jne 0x1011bda0
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x1011be20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, 0x20
movzx ecx, byte [esp + 0x1c]
inc ecx
push edi
mov edx, dword [esi + 0x14]
imul edx, dword [esp + 0x18]
imul ecx, dword [esi + 0x34]
mov edi, dword [esi + 0x30]
mov ebp, dword [esi + 0x14]
shr ecx, 0xb
imul edi, ecx
lea eax, [edx + eax*2]
add eax, dword [esi + 0xc]
sub ebx, ecx
mov esi, dword [esp + 0x1c]
nop dword [eax]
movzx ecx, word [eax]
mov edx, ecx
and edx, 0x7e0
shl edx, 0x10
or edx, ecx
and edx, 0xfffff81f
imul edx, ebx
add edx, edi
shr edx, 5
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
and ecx, 0x7e0
xor ecx, edx
mov word [eax], cx
add eax, ebp
sub esi, 1
jne 0x1011be60
pop edi
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x1011c240
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov eax, dword [ecx + 0x38]
mov edx, dword [ecx + 0x34]
mov dword [esp], eax
mov eax, dword [ecx + 0x14]
imul eax, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x28]
push ebp
push esi
push edi
mov dword [esp + 0x14], edx
lea ebp, [eax + ebx*2]
mov eax, dword [edx]
add ebp, dword [ecx + 0xc]
mov ecx, edx
mov dword [esp + 0x18], ebp
mov eax, dword [eax + 8]
call eax
mov ecx, dword [esp + 0x40]
movzx edx, al
movsx esi, word [ecx]
mov dword [esp + 0x1c], esi
cmp edx, 0xff
jne 0x1011c313
test esi, esi
jle 0x1011c40c
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x34], eax
nop dword [eax]
movzx edi, byte [eax]
cmp edi, 0xff
jne 0x1011c2bd
mov ecx, dword [esp + 0x14]
push esi
push ebp
push dword [esp + 0x40]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
jmp 0x1011c2e7
test edi, edi
je 0x1011c2eb
mov ecx, dword [esp + 0x14]
push esi
push dword [esp + 0x14]
push dword [esp + 0x40]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
mov ecx, dword [esp + 0x10]
lea eax, [edi + 1]
push esi
push eax
mov edx, ebp
call fcn.1011a520
add esp, 8
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x34]
lea ecx, [ecx + esi*2]
add eax, esi
mov dword [esp + 0x40], ecx
add ebx, esi
mov dword [esp + 0x34], eax
lea ebp, [ebp + esi*2]
movsx esi, word [ecx]
test esi, esi
jg 0x1011c2a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x10
inc edx
mov dword [esp + 0x2c], edx
test esi, esi
jle 0x1011c40c
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x3c], eax
nop dword [eax + eax]
movzx edi, byte [eax]
imul edi, edx
shr edi, 8
test edi, edi
je 0x1011c3dc
mov ecx, dword [esp + 0x14]
push esi
push dword [esp + 0x14]
push dword [esp + 0x40]
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
lea eax, [edi + 1]
mov dword [esp + 0x20], esi
shr eax, 3
mov ebx, ebp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
sub eax, ebp
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x28], eax
movzx ecx, word [eax + ebx]
lea ebx, [ebx + 2]
movzx eax, word [ebx - 2]
mov edi, ecx
mov edx, eax
and edi, 0x7e0
shl edi, 0x10
and edx, 0x7e0
or edi, ecx
shl edx, 0x10
or edx, eax
and edi, 0xfffff81f
and edx, 0xfffff81f
dec esi
sub edi, edx
imul edi, ebp
shr edi, 5
add edi, edx
mov eax, edi
shr eax, 0x10
xor eax, edi
and eax, 0x7e0
xor eax, edi
mov word [ebx - 2], ax
mov eax, dword [esp + 0x28]
test esi, esi
jg 0x1011c372
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x34]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x2c]
lea eax, [esi + esi]
add ebx, esi
add ecx, eax
mov dword [esp + 0x34], ebx
mov eax, dword [esp + 0x3c]
lea ebp, [ebp + esi*2]
add eax, esi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x40], ecx
movsx esi, word [ecx]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x1c], esi
test esi, esi
jg 0x1011c330
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x10
Function at 0x1011d0c0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f2d34
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1025f074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push dword [ebp + 0x18]
call fcn.100b45d0
mov dword [ebp - 4], 0
lea esi, [edi + 0x30]
mov dword [edi], vtable.SkLightingShaderImpl.0
push 0x34
push 0
push esi
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
call fcn.101b5530
add esp, 0xc
mov ecx, esi
push dword [ebp + 8]
call fcn.1009c7e0
mov byte [ebp - 4], 1
lea esi, [edi + 0x64]
push 0x34
push 0
push esi
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
call fcn.101b5530
add esp, 0xc
mov ecx, esi
push dword [ebp + 0xc]
call fcn.1009c7e0
mov byte [ebp - 4], 2
mov eax, 1
mov edx, dword [ebp + 0x10]
lea ecx, [edx + 4]
lock xadd dword [ecx], eax
lea eax, [edi + 0x98]
mov dword [ebp + 0x18], eax
mov dword [eax], edx
mov byte [ebp - 4], 4
lea esi, [edi + 0x9c]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
mov dword [edi + 0xc4], eax
mov eax, dword [ecx + 4]
mov dword [edi + 0xc8], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x1011d1da
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esi + 0x10], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esi + 0x20], xmm0
jmp 0x1011d21f
mov dword [esi + 0x20], 0x3f800000
mov dword [esi + 0x10], 0x3f800000
mov dword [esi], 0x3f800000
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 4], 0
mov dword [esi + 0x24], 0x10
test byte [esi + 0x24], 0x80
je 0x1011d232
mov ecx, esi
call fcn.100b5420
movzx eax, al
mov dword [esi + 0x24], eax
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18