joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100bd990
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push ebx
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0xfd0]
mov ebx, dword [eax]
mov cl, byte [ebx + 0x9f]
movzx eax, cl
and eax, 7
mov byte [esp + 0xb], cl
cmp dword [edi + eax*4 + 0x1a9c], 0
jne 0x100bda96
mov eax, dword [esp + 0x20]
movzx eax, al
cmp byte [eax + 0x106569c0], 3
ja 0x100bda96
mov al, byte [esp + 0x14]
test al, al
jne 0x100bd9f5
mov ecx, dword [edi + 0xfec]
imul ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
add ecx, dword [edi + 0xfe8]
pop edi
pop ebx
mov al, byte [ecx + eax]
pop ecx
ret
test cl, cl
js 0x100bda18
cmp byte [ebx + 0x14], 0
jg 0x100bda18
movzx eax, byte [ebx + 6]
movzx eax, byte [eax + 0x1065c558]
mov cl, byte [eax + 0x106605a0]
xor eax, eax
mov byte [esp + 0x10], cl
jmp 0x100bda63
movzx eax, al
imul edx, eax, 0x538
mov eax, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [edx + edi + 0x18]
shl esi, cl
imul esi, dword [edi + 0xfec]
mov ecx, dword [edx + edi + 0x14]
shl eax, cl
add esi, eax
cmp byte [esp + 0xf], 0
mov eax, dword [edi + 0xfe8]
mov al, byte [esi + eax]
mov byte [esp + 0x14], al
pop esi
jl 0x100bda5e
cmp byte [ebx + 0x14], 0
jg 0x100bda5e
xor eax, eax
jmp 0x100bda63
mov eax, 1
push dword [esp + 0x24]
push eax
push dword [esp + 0x28]
call fcn.100bd6d0
movzx ecx, al
add esp, 0xc
movzx eax, byte [esp + 0x10]
xor edx, edx
shl ecx, 4
add ecx, eax
movzx eax, byte [esp + 0x10]
pop edi
pop ebx
cmp dword [ecx*4 + 0x106605c8], edx
cmove eax, edx
pop ecx
ret
pop edi
xor al, al
pop ebx
pop ecx
ret
Function at 0x100c07c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 8]
mov eax, 1
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor edx, edx
push esi
mov esi, dword [esp + 0x1c]
shl eax, cl
movzx ebx, byte [ebp + 0x31]
mov dword [esp + 0x14], eax
lea eax, [ecx - 4]
mov dword [esi], eax
mov dword [esp + 0x10], edx
push edi
mov edi, dword [esp + 0x1c]
mov dword [edi], edx
cmp ebx, 1
jbe 0x100c0846
movzx ecx, word [ebp + 0x20]
add ebp, 0x20
dec ebx
nop dword [eax]
lea eax, [ebp + 2]
movzx ecx, cx
lea ebp, [eax]
movzx eax, word [eax]
mov esi, eax
sub eax, ecx
mov ecx, dword [esp + 0x18]
cdq
xor eax, edx
sub eax, edx
sub ecx, eax
cmp eax, ecx
cmovl ecx, eax
mov eax, esi
cmp ecx, dword [esp + 0x14]
mov edx, ecx
cmovle edx, dword [esp + 0x14]
mov dword [esp + 0x14], edx
test ecx, ecx
jne 0x100c083a
inc dword [edi]
movzx eax, word [ebp]
movzx ecx, ax
sub ebx, 1
jne 0x100c0800
mov esi, dword [esp + 0x20]
lea eax, [edx + 1]
cmp eax, 2
jge 0x100c0852
xor edx, edx
jmp 0x100c0867
mov edx, 1
lea ecx, [edx + 1]
jbe 0x100c0867
nop dword [eax]
add ecx, ecx
inc edx
cmp ecx, eax
jb 0x100c0860
mov ecx, dword [esi]
pop edi
pop esi
pop ebp
pop ebx
cmp edx, ecx
jle 0x100c088f
cmp eax, 2
jge 0x100c087b
xor edx, edx
mov eax, edx
ret
mov edx, 1
lea ecx, [edx + 1]
jbe 0x100c088c
add ecx, ecx
inc edx
cmp ecx, eax
jb 0x100c0885
mov eax, edx
ret
mov eax, ecx
ret
Function at 0x100c0fa0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x48
mov eax, dword [0x10a78b80]
xor eax, esp
mov dword [esp + 0x44], eax
push ebx
push ebp
mov ebp, dword [esp + 0x54]
lea eax, [esp + 0x1c]
push esi
mov esi, dword [esp + 0x60]
push edi
movzx ebx, byte [ebp + 0x31]
push eax
lea eax, [esp + 0x48]
mov dword [esp + 0x14], ebp
push eax
push ebx
lea eax, [ebp + 0x10]
mov dword [esp + 0x28], ebx
push eax
push esi
push dword [esp + 0x74]
call fcn.100c08a0
mov edi, dword [esp + 0x80]
push 0
push edi
push eax
lea eax, [esp + 0x48]
push eax
call fcn.100c2f00
movzx edx, byte [ebp + 0x31]
add eax, esi
mov dword [esp + 0x48], eax
mov ecx, edi
mov eax, 1
add edi, 0xfffffffc
shl eax, cl
add esp, 0x28
xor ebp, ebp
mov dword [esp + 0x14], eax
xor esi, esi
mov dword [esp + 0x18], edi
cmp edx, 1
jbe 0x100c1079
mov edi, dword [esp + 0x10]
dec edx
add edi, 0x20
mov dword [esp + 0x10], edx
xor ebx, ebx
movzx ecx, word [edi]
nop
lea eax, [edi + 2]
movzx ecx, cx
lea edi, [eax]
movzx eax, word [eax]
mov esi, eax
sub eax, ecx
mov ecx, dword [esp + 0x14]
cdq
xor eax, edx
sub eax, edx
sub ecx, eax
cmp eax, ecx
cmovl ecx, eax
cmp ecx, ebp
mov eax, ecx
cmovle eax, ebp
test ecx, ecx
mov ebp, eax
mov ecx, esi
lea eax, [ebx + 1]
cmovne eax, ebx
sub dword [esp + 0x10], 1
mov ebx, eax
jne 0x100c1030
mov edi, dword [esp + 0x18]
mov esi, eax
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x1c]
lea ecx, [ebp + 1]
cmp ecx, 2
jge 0x100c1085
xor edx, edx
jmp 0x100c1097
mov edx, 1
lea eax, [edx + 1]
jbe 0x100c1097
nop
add eax, eax
inc edx
cmp eax, ecx
jb 0x100c1090
cmp edx, edi
jle 0x100c10b7
cmp ecx, 2
jge 0x100c10a4
xor edi, edi
jmp 0x100c10b7
mov edi, 1
lea eax, [edi + 1]
jbe 0x100c10b7
nop
add eax, eax
inc edi
cmp eax, ecx
jb 0x100c10b0
mov edx, dword [esp + 0x68]
lea eax, [ebx - 1]
lea ecx, [edi + 1]
imul ebx, edx
imul ecx, eax
pop edi
lea eax, [edx + 2]
sub ecx, esi
add eax, ecx
mov ecx, dword [esp + 0x50]
cmp eax, ebx
pop esi
cmovl ebx, eax
mov eax, dword [esp + 0x18]
inc eax
add eax, ebx
pop ebp
pop ebx
xor ecx, esp
shl eax, 9
call fcn.105116c0
add esp, 0x48
ret
Function at 0x100c34e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
cmp dword [esp + 0x14], 0
jle 0x100c35ae
mov eax, dword [esp + 0x18]
imul eax, dword [esp + 0x1c]
push ebp
xor ebp, ebp
mov dword [esp + 8], ebp
mov dword [esp + 0x1c], eax
test eax, eax
jle 0x100c35ad
mov ecx, dword [esp + 0x28]
mov eax, 4
push ebx
push esi
mov esi, dword [esp + 0x1c]
lea ecx, [ecx - 8]
shl eax, cl
push edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x30]
mov ebx, 1
movzx ecx, word [esi]
xor edi, edi
lea eax, [eax + ebp*2]
mov dword [esp + 0x10], eax
movsx eax, word [eax]
sub eax, ecx
cdq
mov ecx, eax
xor ecx, edx
sub ecx, edx
cmp dword [esp + 0x24], ebx
jle 0x100c3587
mov ebp, dword [esp + 0x20]
nop
movzx edx, word [ebp + ebx*2]
mov esi, ecx
mov ebp, dword [esp + 0x10]
movsx eax, word [ebp]
mov ebp, dword [esp + 0x20]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, ebx
cmp eax, ecx
cmovl ecx, eax
cmp eax, esi
cmovge edx, edi
inc ebx
mov edi, edx
cmp ebx, dword [esp + 0x24]
jl 0x100c3550
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x20]
cmp ecx, dword [esp + 0x18]
jg 0x100c3598
mov ecx, dword [esp + 0x10]
mov ax, word [esi + edi*2]
mov word [ecx], ax
add ebp, dword [esp + 0x2c]
mov dword [esp + 0x14], ebp
cmp ebp, dword [esp + 0x28]
jl 0x100c3523
pop edi
pop esi
pop ebx
pop ebp
add esp, 0xc
ret
Function at 0x100c3cb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x64
mov eax, dword [0x10a78b80]
xor eax, esp
mov dword [esp + 0x60], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [esp + 0x78]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0xb8]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0xbc]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0xc0]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0xc8]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xd0]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xd8]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xdc]
mov ebp, dword [esp + 0x9c]
mov ebx, ebp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xe0]
mov esi, dword [esp + 0x98]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0xa0]
mov dword [esp + 0x18], ebx
test eax, eax
jle 0x100c3d9f
xor eax, eax
cmp esi, ebp
setge al
jmp 0x100c3da6
xor eax, eax
cmp esi, ebp
setle al
test eax, eax
jne 0x100c3eea
xor edi, edi
mov dword [esp + 0x14], eax
mov byte [esp + 0x13], al
test esi, esi
jle 0x100c3df5
mov ecx, dword [esp + 0x94]
mov eax, dword [esp + 0x90]
sub ecx, eax
movzx ebp, ax
lea ebx, [ecx + ecx]
mov eax, ecx
add ecx, ebx
cdq
idiv esi
cdq
sub eax, edx
sar eax, 1
add eax, ebp
mov word [esp + edi*2 + 0x60], ax
inc edi
cmp edi, esi
jl 0x100c3dd2
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x9c]
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x60]
push 0x32
push esi
push dword [esp + 0xec]
push dword [esp + 0x28]
push eax
push edi
call fcn.100c0a30
push dword [esp + 0x100]
lea eax, [esp + 0x2f]
push eax
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x48]
lea eax, [esp + 0x88]
push dword [esp + 0x50]
push dword [esp + 0x58]
push dword [esp + 0x60]
push dword [esp + 0x68]
push dword [esp + 0x70]
push dword [esp + 0x78]
push dword [esp + 0x80]
push dword [esp + 0x88]
push dword [esp + 0x90]
push dword [esp + 0x98]
push dword [esp + 0xf4]
push dword [esp + 0x104]
push dword [esp + 0x104]
push esi
push eax
push edi
push dword [esp + 0xf0]
mov edi, dword [esp + 0xc4]
push dword [esp + 0xf0]
push dword [esp + 0xc0]
push dword [esp + 0xc8]
push edi
call fcn.100c35c0
mov ecx, dword [esp + 0xd8]
add esp, 0x7c
cmp byte [esp + 0x13], 0
mov dword [ecx], esi
jne 0x100c3ee8
cmp dword [esp + 0x14], 0
je 0x100c3ed1
mov eax, dword [esp + 0xa0]
mov ebx, esi
mov dword [esp + 0x18], ebx
add esi, eax
jmp 0x100c3d92
cmp dword [edi + 0x5cf94], 2
je 0x100c3eea
mov eax, dword [esp + 0xa0]
add esi, eax
jmp 0x100c3d92
mov dword [ecx], ebp
mov ecx, dword [esp + 0x70]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.105116c0
add esp, 0x64
ret
Function at 0x100c3f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x60
mov eax, dword [0x10a78b80]
xor eax, esp
mov dword [esp + 0x5c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [esp + 0x74]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x88]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x8c]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0xac]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0xb8]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0xbc]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xc0]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xc4]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xc8]
mov ebx, dword [esp + 0x94]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xcc]
mov ebp, dword [esp + 0x98]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xd0]
mov esi, dword [esp + 0x90]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x58], ecx
mov edi, ebx
mov dword [esp + 0x1c], eax
nop dword [eax + eax]
xor eax, eax
test ebp, ebp
jle 0x100c3fed
cmp esi, ebx
setge al
jmp 0x100c3ff2
cmp esi, ebx
setle al
test eax, eax
jne 0x100c40dc
mov dword [esp + 0x14], eax
mov byte [esp + 0x13], al
lea eax, [esi + esi]
push eax
push ecx
lea eax, [esp + 0x64]
push eax
call fcn.105137c0
push dword [esp + 0xe4]
lea eax, [esp + 0x23]
push eax
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x34]
lea eax, [esp + 0x78]
push dword [esp + 0x3c]
push dword [esp + 0x44]
push dword [esp + 0x4c]
push dword [esp + 0x54]
push dword [esp + 0x5c]
push dword [esp + 0x64]
push dword [esp + 0x6c]
push dword [esp + 0x74]
push dword [esp + 0x7c]
push dword [esp + 0x84]
push dword [esp + 0xe0]
push dword [esp + 0xf0]
push dword [esp + 0xf0]
push esi
push eax
push dword [esp + 0xa0]
push dword [esp + 0xe0]
push dword [esp + 0xe0]
push dword [esp + 0xb0]
push dword [esp + 0xb8]
push dword [esp + 0x84]
call fcn.100c35c0
mov eax, dword [esp + 0xc4]
add esp, 0x70
cmp byte [esp + 0x13], 0
mov dword [eax], esi
jne 0x100c40da
cmp dword [esp + 0x14], 0
je 0x100c40c2
mov ecx, dword [esp + 0x58]
mov edi, esi
add esi, ebp
jmp 0x100c3fe0
mov eax, dword [esp + 0x18]
cmp dword [eax + 0x5cf94], 2
je 0x100c40dc
mov ecx, dword [esp + 0x58]
add esi, ebp
jmp 0x100c3fe0
mov dword [eax], ebx
mov ecx, dword [esp + 0x6c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.105116c0
add esp, 0x60
ret
Function at 0x100c6350
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
push 0xb00
push 0
push 0x10a7abd0
mov ebx, 0x10a876e0
call fcn.10513d40
add esp, 0xc
mov esi, 0x10670d94
xor edi, edi
nop word [eax + eax]
mov ebp, dword [esi - 4]
test ebp, ebp
je 0x100c64a1
movzx eax, byte [edi + 0x106705f0]
xor ecx, ecx
movzx edx, byte [edi + 0x10670608]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
test ebp, ebp
jle 0x100c64a1
imul edx, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edx
nop word [eax + eax]
push dword [esp + 0x18]
mov edx, dword [esi]
add edx, dword [esp + 0x14]
push eax
push eax
mov eax, dword [esi + 4]
push ebx
push 0x40
movzx eax, byte [ecx + eax]
lea ecx, [eax + eax*2]
movzx eax, byte [edx]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi + 0x10670608]
imul eax, dword [edx + 8]
shl ecx, 6
sar eax, 3
sub ecx, eax
movzx eax, byte [edi + 0x106705f0]
imul eax, dword [edx + 4]
shl ecx, 6
sar eax, 3
sub ecx, eax
add ecx, 0x10a7bf00
push ecx
call dword [0x10b4964c]
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x2c]
push dword [esp + 0x30]
mov dword [eax + ecx*4], ebx
mov eax, dword [esp + 0x3c]
mov edx, dword [esi]
add edx, dword [esp + 0x2c]
push eax
push eax
mov eax, dword [esi + 4]
add ebx, dword [esp + 0x40]
push ebx
push 0x40
movzx eax, byte [ecx + eax]
xor eax, 1
lea ecx, [eax + eax*2]
movzx eax, byte [edx]
lea ecx, [eax + ecx*2]
movzx eax, byte [edi + 0x10670608]
imul eax, dword [edx + 8]
shl ecx, 6
sar eax, 3
sub ecx, eax
movzx eax, byte [edi + 0x106705f0]
imul eax, dword [edx + 4]
shl ecx, 6
sar eax, 3
sub ecx, eax
add ecx, 0x10a7bf00
push ecx
call dword [0x10b4964c]
mov ecx, dword [esp + 0x44]
add esp, 0x30
mov eax, dword [esi + 8]
add dword [esp + 0x10], 0xc
mov dword [eax + ecx*4 + 0x40], ebx
inc ecx
add ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
cmp ecx, ebp
jl 0x100c63c0
add esi, 0x10
inc edi
cmp esi, 0x10670ef4
jl 0x100c6380
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x10106ea0
Capabilities:
Enumerate pe sections

Disassembly:
push ecx
push ebx
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 0xfd0]
mov ebx, dword [eax]
mov cl, byte [ebx + 0x9f]
movzx eax, cl
and eax, 7
mov byte [esp + 0xb], cl
cmp dword [edi + eax*4 + 0x1a9c], 0
jne 0x10106fa6
mov eax, dword [esp + 0x20]
movzx eax, al
cmp byte [eax + 0x106cfce0], 3
ja 0x10106fa6
mov al, byte [esp + 0x14]
test al, al
jne 0x10106f05
mov ecx, dword [edi + 0xfec]
imul ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
add ecx, dword [edi + 0xfe8]
pop edi
pop ebx
mov al, byte [ecx + eax]
pop ecx
ret
test cl, cl
js 0x10106f28
cmp byte [ebx + 0x14], 0
jg 0x10106f28
movzx eax, byte [ebx + 6]
movzx eax, byte [eax + 0x106cfe14]
mov cl, byte [eax + 0x106cfe4c]
xor eax, eax
mov byte [esp + 0x10], cl
jmp 0x10106f73
movzx eax, al
imul edx, eax, 0x538
mov eax, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [edx + edi + 0x18]
shl esi, cl
imul esi, dword [edi + 0xfec]
mov ecx, dword [edx + edi + 0x14]
shl eax, cl
add esi, eax
cmp byte [esp + 0xf], 0
mov eax, dword [edi + 0xfe8]
mov al, byte [esi + eax]
mov byte [esp + 0x14], al
pop esi
jl 0x10106f6e
cmp byte [ebx + 0x14], 0
jg 0x10106f6e
xor eax, eax
jmp 0x10106f73
mov eax, 1
push dword [esp + 0x24]
push eax
push dword [esp + 0x28]
call fcn.10106de0
movzx ecx, al
add esp, 0xc
movzx eax, byte [esp + 0x10]
xor edx, edx
shl ecx, 4
add ecx, eax
movzx eax, byte [esp + 0x10]
pop edi
pop ebx
cmp dword [ecx*4 + 0x106cfe78], edx
cmove eax, edx
pop ecx
ret
pop edi
xor al, al
pop ebx
pop ecx
ret
Function at 0x1011e800
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
lea esi, [eax + eax]
xor ebx, ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], esi
lea ebp, [eax + eax]
cmp dword [esp + 0x38], ebx
jle 0x1011e997
mov eax, dword [esp + 0x28]
xorps xmm3, xmm3
mov edx, dword [esp + 0x34]
add eax, eax
mov dword [esp + 0x1c], eax
xorps xmm2, xmm2
mov eax, dword [esp + 0x30]
add eax, eax
mov dword [esp + 0x24], eax
push edi
xor ecx, ecx
test edx, edx
jle 0x1011e8b1
cmp edx, 8
jb 0x1011e8b1
cmp dword [0x10b47804], 2
jl 0x1011e8b1
mov edi, edx
lea eax, [ebp + 8]
mov ebx, esi
and edi, 0xfffffff8
sub ebx, ebp
nop word [eax + eax]
pmovzxwd xmm0, qword [eax - 8]
pmovzxwd xmm1, qword [esi + ecx*2]
psubd xmm1, xmm0
lea eax, [eax + 0x10]
pabsd xmm0, xmm1
add ecx, 8
paddd xmm3, xmm0
pmovzxwd xmm0, qword [eax - 0x10]
pmovzxwd xmm1, qword [ebx + eax - 0x10]
psubd xmm1, xmm0
pabsd xmm0, xmm1
paddd xmm2, xmm0
cmp ecx, edi
jl 0x1011e870
mov eax, dword [esp + 0x28]
xor edi, edi
xor ebx, ebx
cmp ecx, edx
jge 0x1011e954
mov eax, edx
sub eax, ecx
cmp eax, 2
jl 0x1011e927
lea eax, [edx - 1]
mov dword [esp + 0x1c], eax
lea eax, [ecx + 1]
lea eax, [esi + eax*2]
mov dword [esp + 0x30], eax
mov eax, ebp
sub eax, esi
mov esi, dword [esp + 0x30]
mov dword [esp + 0x18], eax
movzx eax, word [ebp + ecx*2]
lea esi, [esi + 4]
movzx edx, word [esi - 6]
add ecx, 2
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
add edi, eax
mov eax, dword [esp + 0x18]
movzx edx, word [eax + esi - 4]
movzx eax, word [esi - 4]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
add ebx, eax
mov eax, ecx
cmp ecx, dword [esp + 0x1c]
jl 0x1011e8e3
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x14]
cmp eax, edx
jge 0x1011e941
lea eax, [ecx + ecx]
movzx ecx, word [eax + ebp]
movzx eax, word [eax + esi]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x38]
add dword [esp + 0x10], eax
lea eax, [ebx + edi]
mov ebx, dword [esp + 0x10]
add ebx, eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], ebx
jmp 0x1011e958
mov ebx, dword [esp + 0x10]
add esi, dword [esp + 0x20]
add ebp, eax
sub dword [esp + 0x3c], 1
mov dword [esp + 0x14], esi
jne 0x1011e847
paddd xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
paddd xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
pop edi
paddd xmm2, xmm0
movd eax, xmm2
pop esi
pop ebp
add eax, ebx
pop ebx
add esp, 0x14
ret
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x14
ret
Function at 0x1011e9a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x24]
xor edx, edx
mov dword [esp], edx
push ebp
mov ebp, dword [esp + 0x24]
test eax, eax
jle 0x1011eafa
push ebx
mov ebx, dword [esp + 0x20]
xorps xmm3, xmm3
push esi
mov esi, dword [esp + 0x1c]
xorps xmm2, xmm2
push edi
nop word [eax + eax]
xor ecx, ecx
test ebp, ebp
jle 0x1011ea23
cmp ebp, 0x20
jb 0x1011ea23
mov edx, ebp
lea eax, [ebx + 0x10]
mov edi, esi
and edx, 0xffffffe0
sub edi, ebx
nop word [eax + eax]
movups xmm0, xmmword [eax - 0x10]
lea eax, [eax + 0x20]
movups xmm1, xmmword [ecx + esi]
add ecx, 0x20
psadbw xmm1, xmm0
movups xmm0, xmmword [eax - 0x20]
paddd xmm3, xmm1
movups xmm1, xmmword [edi + eax - 0x20]
psadbw xmm1, xmm0
paddd xmm2, xmm1
cmp ecx, edx
jl 0x1011e9f0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x34]
xor edi, edi
xor ebx, ebx
cmp ecx, ebp
jge 0x1011eabf
mov eax, ebp
sub eax, ecx
cmp eax, 2
jl 0x1011ea91
lea eax, [ebp - 1]
mov edx, esi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x28]
lea ebp, [eax + 1]
add ebp, ecx
sub edx, eax
mov dword [esp + 0x14], edx
movzx eax, byte [ebp - 1]
lea ebp, [ebp + 2]
movzx edx, byte [esi + ecx]
add ecx, 2
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
add edi, eax
mov eax, dword [esp + 0x14]
movzx edx, byte [eax + ebp - 2]
movzx eax, byte [ebp - 2]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
add ebx, eax
mov eax, ecx
cmp ecx, dword [esp + 0x18]
jl 0x1011ea50
mov ebp, dword [esp + 0x30]
cmp eax, ebp
jge 0x1011eaae
mov eax, dword [esp + 0x28]
movzx edx, byte [ecx + esi]
movzx eax, byte [ecx + eax]
sub edx, eax
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x10]
add edx, eax
jmp 0x1011eab2
mov edx, dword [esp + 0x10]
lea eax, [ebx + edi]
add edx, eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], edx
mov ebx, dword [esp + 0x28]
add ebx, dword [esp + 0x2c]
add esi, dword [esp + 0x24]
sub eax, 1
mov dword [esp + 0x28], ebx
mov dword [esp + 0x34], eax
jne 0x1011e9d0
paddd xmm2, xmm3
movaps xmm0, xmm2
pop edi
psrldq xmm0, 8
paddd xmm2, xmm0
pop esi
movd eax, xmm2
pop ebx
pop ebp
add eax, edx
add esp, 0xc
ret
mov eax, edx
pop ebp
add esp, 0xc
ret
Function at 0x1011ee80
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [0x10a78b80]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
push ebx
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x2c]
push 0x10720334
push esi
mov dword [esp + 0x14], eax
call fcn.1051c37b
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x1011eec8
push esi
push str.Unable_to_open__s
push 1
push edi
call fcn.1006e850
jmp 0x1011efe0
push ebx
push 1
lea eax, [esp + 0x18]
mov dword [edi], 0
push 9
push eax
call fcn.105272e5
add esp, 0x10
test eax, eax
je 0x1011efcd
lea ecx, [esp + 0x10]
mov eax, dword [ecx]
cmp eax, dword [str.filmgrn1E__lld__lld__d__hd__d_n]
jne 0x1011efcd
mov eax, dword [ecx + 4]
cmp eax, dword [0x107200cc]
jne 0x1011efcd
push ebp
push ebx
xor ebp, ebp
call fcn.105270e0
add esp, 4
test eax, eax
jne 0x1011efaf
nop dword [eax]
push 0x2a0
call fcn.1006eac0
mov esi, eax
add esp, 4
test esi, esi
je 0x1011ef9f
push 0x2a0
push 0
push esi
call fcn.10513d40
push esi
push edi
push ebx
call fcn.1011f000
add esp, 0x18
mov dword [esi + 0x298], 0
test ebp, ebp
je 0x1011ef5f
mov dword [ebp + 0x298], esi
mov eax, dword [esp + 0x10]
cmp dword [eax], 0
jne 0x1011ef6a
mov dword [eax], esi
mov dword [eax + 4], esi
mov ebp, esi
cmp dword [edi], 0
jne 0x1011efaf
push ebx
call fcn.105270e0
add esp, 4
test eax, eax
je 0x1011ef20
push ebx
call fcn.1051c5ce
mov eax, dword [edi]
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.105116c0
add esp, 0x14
ret
push str.Unable_to_allocate_grain_table_entry
push 2
push edi
call fcn.1006e850
add esp, 0xc
push ebx
call fcn.1051c5ce
mov eax, dword [edi]
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.105116c0
add esp, 0x14
ret
push str.Unable_to_read__or_invalid__file_magic
push 1
push edi
call fcn.1006e850
push ebx
call fcn.1051c5ce
mov eax, dword [edi]
add esp, 0x10
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.105116c0
add esp, 0x14
ret