joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x103c4120]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, 8
push edi
mov edi, dword [ebp + 8]
mov ebx, esi
sub ebx, edi
mov dword [ebp - 0x14], edi
mov byte [ebp - 0xd], 7
mov ecx, edi
add ebx, 0x40
mov edi, edi
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
add edx, 0xffff
test dx, dx
jne 0x10007270
lea eax, [ebp - 0xc]
sub esi, edi
sub eax, edi
add esi, 0x38
mov dword [ebp - 0x18], eax
mov dword [ebp + 0xc], esi
xor bh, bh
mov ecx, edi
lea edx, [ebp - 0xb]
mov esi, 4
movzx eax, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx - 1], al
movzx eax, byte [ecx + 3]
mov byte [edx], al
add edx, 2
dec esi
jne 0x100072a0
mov esi, edi
mov edi, 4
lea esp, [esp]
mov eax, dword [ebp - 0x18]
lea esi, [esi + 2]
movzx ecx, word [eax + esi - 2]
mov eax, ecx
shr eax, 8
mov dl, byte [eax + 0x101dbbf0]
movzx eax, cl
mov bl, byte [eax + 0x101dbbf0]
xor bl, dl
mov al, bl
rol al, 1
and al, 0xaa
xor bl, al
mov al, bl
rol al, 1
xor al, dl
movzx ecx, al
shl cx, 8
movzx eax, bl
or cx, ax
mov word [esi - 2], cx
dec edi
jne 0x100072c0
mov edi, dword [ebp - 0x14]
cmp bh, 2
jne 0x1000732b
mov esi, dword [ebp + 0xc]
mov edx, 8
mov eax, edi
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
add edx, 0xffff
test dx, dx
jne 0x10007315
jmp 0x10007355
xor esi, esi
mov eax, 8
cmp bh, 1
mov dl, 8
mov ecx, edi
cmove eax, esi
sub eax, edi
lea esi, [eax + 0x101dbcf0]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
add dl, 0xff
jne 0x10007344
mov esi, dword [ebp + 0xc]
inc bh
cmp bh, 3
jb 0x10007296
mov cl, byte [ebp - 0xd]
sub esi, 8
mov al, cl
mov dword [ebp + 0xc], esi
dec cl
mov byte [ebp - 0xd], cl
test al, al
jne 0x10007294
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret
Function at 0x10007390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x103c4120]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edi
sub esi, eax
mov dword [ebp - 0x24], edi
sub ecx, edi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], 8
xor bl, bl
mov byte [ebp - 0xd], bl
test bl, bl
jne 0x100073eb
mov edx, 8
mov eax, edi
mov cl, byte [ecx + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
add edx, 0xffff
mov ecx, dword [ebp - 0x14]
test dx, dx
jne 0x100073d2
jmp 0x10007415
xor esi, esi
mov eax, 8
cmp bl, 1
mov dl, 8
mov ecx, edi
cmove eax, esi
sub eax, edi
lea esi, [eax + 0x101dbcf0]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
add dl, 0xff
jne 0x10007404
mov esi, dword [ebp - 0x18]
lea edi, [ebp - 0xc]
mov dword [ebp - 0x1c], 4
nop
movzx ebx, word [esi + edi]
lea edi, [edi + 2]
mov al, bl
mov ecx, ebx
shr ecx, 8
rol al, 1
movzx edx, cl
movzx esi, al
mov ecx, esi
movzx eax, bl
and ecx, 0x55
xor esi, edx
xor ecx, eax
xor ecx, edx
movzx eax, byte [esi + 0x101dbbf0]
mov esi, dword [ebp - 0x18]
movzx ecx, byte [ecx + 0x101dbbf0]
shl ax, 8
or cx, ax
dec dword [ebp - 0x1c]
mov word [edi - 2], cx
jne 0x10007420
mov edi, dword [ebp - 0x24]
lea edx, [ebp - 0xb]
mov ecx, edi
mov esi, 4
movzx eax, byte [edx - 1]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
movzx eax, byte [edx]
add edx, 2
mov byte [ecx + 3], al
dec esi
jne 0x10007472
mov bl, byte [ebp - 0xd]
mov ecx, dword [ebp - 0x14]
inc bl
mov esi, dword [ebp - 0x18]
mov byte [ebp - 0xd], bl
cmp bl, 3
jb 0x100073c7
add ecx, 8
dec dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
jne 0x100073c2
mov eax, dword [ebp + 0xc]
mov ecx, 8
sub eax, edi
mov dword [ebp + 0xc], eax
jmp 0x100074c0
mov al, byte [eax + edi + 0x40]
lea edi, [edi + 1]
xor byte [edi - 1], al
add ecx, 0xffff
mov eax, dword [ebp + 0xc]
test cx, cx
jne 0x100074c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret
Function at 0x100074f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x103c4120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
movdqu xmm0, xmmword [eax]
mov dword [ebp - 0x24], ecx
xor eax, eax
mov esi, str.__ra_
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x28], 9
xor bl, bl
sub esi, ecx
push edi
movdqu xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0x30], esi
mov ecx, eax
mov dl, 8
and ecx, 1
mov eax, dword [ebp + ecx*8 - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + ecx*8 - 0x18]
lea ecx, [ebp - 0xc]
mov dword [ebp - 8], eax
jmp 0x10007550
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
add dl, 0xff
jne 0x10007550
lea ecx, [ebp - 0xc]
mov edx, 8
jmp 0x10007570
movzx eax, byte [ecx]
lea ecx, [ecx + 1]
mov al, byte [eax + 0x101dbbf0]
mov byte [ecx - 1], al
dec edx
jne 0x10007570
mov eax, dword [ebp - 0x20]
lea edi, [ebp - 0x1c]
shl eax, 3
not eax
mov dword [ebp - 0x2c], 8
and eax, 8
add eax, edi
mov dword [ebp - 0x34], eax
mov edi, eax
mov edi, edi
lea eax, [ebp - 0xc]
mov esi, 8
mov dl, byte [eax]
lea eax, [eax + 1]
mov cl, dl
add bl, bl
shr cl, 7
add dl, dl
or bl, cl
mov byte [eax - 1], dl
dec esi
jne 0x100075a8
xor byte [edi], bl
inc edi
dec dword [ebp - 0x2c]
jne 0x100075a0
mov edi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x30]
add esi, 8
mov dword [ebp - 0x30], esi
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
add edi, 8
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x24], edi
dec dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
jne 0x10007530
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret
Function at 0x1000cd80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov edx, 0x101e01e8
push ebx
sub edx, eax
mov dword [ebp - 4], 0x10
push esi
lea ecx, [eax + 0xe]
mov dword [ebp - 8], edx
push edi
mov bl, byte [eax + 0xf]
mov edi, 0xe
mov al, byte [ecx]
mov dl, byte [edx + ecx]
mov byte [ecx + 1], al
test al, al
je 0x1000cde8
test dl, dl
je 0x1000cde8
movzx eax, al
movzx esi, byte [eax + 0x103c5d28]
movzx eax, dl
movzx eax, byte [eax + 0x103c5d28]
add esi, eax
mov eax, 0x80808081
mul esi
shr edx, 7
imul eax, edx, 0xff
sub esi, eax
mov al, byte [esi + 0x103c5c28]
jmp 0x1000cdea
xor al, al
mov edx, dword [ebp - 8]
xor bl, al
dec ecx
dec edi
jns 0x1000cda8
dec dword [ebp - 4]
mov eax, dword [ebp + 8]
mov byte [eax], bl
lea ecx, [eax + 0xe]
jne 0x1000cda0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000ce10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov edx, 0x101e01e8
push ebx
sub edx, eax
mov dword [ebp - 4], 0x10
push esi
mov dword [ebp - 8], edx
push edi
lea ecx, [ecx]
mov bl, byte [eax]
mov edi, 0xf
mov cl, byte [eax + 1]
lea esi, [eax + 1]
mov dl, byte [edx + eax]
mov byte [eax], cl
test cl, cl
je 0x1000ce7a
test dl, dl
je 0x1000ce7a
movzx eax, cl
movzx ecx, byte [eax + 0x103c5d28]
movzx eax, dl
movzx eax, byte [eax + 0x103c5d28]
add ecx, eax
mov eax, 0x80808081
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov al, byte [ecx + 0x103c5c28]
jmp 0x1000ce7c
xor al, al
mov edx, dword [ebp - 8]
xor bl, al
mov eax, esi
dec edi
jne 0x1000ce37
dec dword [ebp - 4]
mov eax, dword [ebp + 8]
mov byte [eax + 0xf], bl
jne 0x1000ce30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000f670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov cl, byte [edx]
mov byte [ebp - 1], cl
test cl, cl
je 0x1000f6c7
mov eax, dword [edi + 4]
push ebx
movzx ebx, cl
push esi
shl ebx, 3
nop
mov edx, dword [edx + 1]
lea ebx, [ebx - 8]
mov esi, dword [edi]
mov ecx, esi
and ecx, 0x1f
sub eax, dword [ebx + edx + 0xc]
mov edx, dword [ebp + 0xc]
ror eax, cl
xor eax, esi
mov dword [edi + 4], eax
mov ecx, eax
mov edx, dword [edx + 1]
and ecx, 0x1f
sub esi, dword [ebx + edx + 8]
mov edx, dword [ebp + 0xc]
ror esi, cl
xor esi, eax
dec byte [ebp - 1]
mov dword [edi], esi
jne 0x1000f690
pop esi
pop ebx
mov eax, dword [edx + 1]
mov eax, dword [eax + 4]
sub dword [edi + 4], eax
mov eax, dword [edx + 1]
mov eax, dword [eax]
sub dword [edi], eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x1000f6e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 1]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
add dword [eax], ecx
mov ecx, dword [edi + 1]
mov ecx, dword [ecx + 4]
add dword [eax + 4], ecx
xor cl, cl
mov ebx, dword [eax + 4]
mov byte [ebp + 0xf], cl
cmp byte [edi], cl
jbe 0x1000f741
push esi
mov edx, dword [eax]
movzx esi, cl
xor edx, ebx
mov ecx, ebx
and ecx, 0x1f
rol edx, cl
mov ecx, dword [edi + 1]
mov ecx, dword [ecx + esi*8 + 8]
add edx, ecx
mov ecx, edx
mov dword [eax], edx
and ecx, 0x1f
xor ebx, edx
rol ebx, cl
mov ecx, dword [edi + 1]
add ebx, dword [ecx + esi*8 + 0xc]
mov cl, byte [ebp + 0xf]
inc cl
mov dword [eax + 4], ebx
mov byte [ebp + 0xf], cl
cmp cl, byte [edi]
jb 0x1000f708
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000f750
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x103c4120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
movzx esi, word [ebp + 0xc]
mov dword [ebp - 0x28], eax
push edi
mov edi, dword [ebp + 0x10]
lea eax, [esi + 0x1f]
cdq
and edx, 0x1f
add eax, edx
mov byte [edi], 0x14
sar eax, 5
movzx ebx, ax
mov eax, 0x100
mov dword [edi + 1], 0x103c8e28
cmp word [ebp + 0xc], ax
ja 0x1000f873
mov eax, ebx
mov dword [ebp - 0x34], eax
shl eax, 2
push eax
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.101c6a70
lea eax, [esi + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0x24]
push eax
call fcn.101c6b90
mov eax, 4
mov dword [0x103c8e28], 0xb7e15163
add esp, 0x18
lea esi, [eax + 0x25]
lea ebx, [ebx]
mov edx, dword [edi + 1]
lea eax, [eax + 4]
mov ecx, dword [edx + eax - 8]
sub ecx, 0x61c88647
mov dword [edx + eax - 4], ecx
dec esi
jne 0x1000f7e0
mov eax, 0x2a
mov dword [ebp - 0x30], esi
cmp ax, bx
mov ecx, ebx
cmova ecx, eax
xor edx, edx
mov ax, cx
xor ebx, ebx
add cx, cx
add ax, cx
xor ecx, ecx
movzx eax, ax
cmp dx, ax
jae 0x1000f873
mov dword [ebp - 0x2c], eax
mov eax, dword [edi + 1]
movzx edx, cx
lea ecx, [eax + edx*4]
mov eax, dword [ecx]
add eax, ebx
add eax, esi
rol eax, 3
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
movzx esi, cx
lea ecx, [ebx + eax]
mov dword [ebp - 0x28], eax
and ecx, 0x1f
add ebx, dword [ebp + esi*4 - 0x24]
add ebx, eax
lea eax, [edx + 1]
rol ebx, cl
mov ecx, 0x2a
cdq
idiv ecx
lea eax, [esi + 1]
mov dword [ebp + esi*4 - 0x24], ebx
movzx ecx, dx
cdq
idiv dword [ebp - 0x34]
dec dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
movzx eax, dx
mov dword [ebp - 0x30], eax
jne 0x1000f821
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret
Function at 0x1000f940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx edx, byte [edi]
mov ecx, dword [edi + 1]
mov ecx, dword [ecx + edx*8 + 0xc]
sub dword [eax + 8], ecx
movzx edx, byte [edi]
mov ecx, dword [edi + 1]
mov ecx, dword [ecx + edx*8 + 8]
sub dword [eax], ecx
mov dl, byte [edi]
mov byte [ebp - 1], dl
test dl, dl
je 0x1000fa1e
mov ecx, dword [eax + 8]
push ebx
mov ebx, dword [eax + 4]
movzx edx, dl
shl edx, 3
push esi
mov esi, dword [eax + 0xc]
mov dword [ebp - 0xc], edx
mov edx, dword [eax]
mov dword [eax + 0xc], ecx
mov dword [ebp - 0x10], ecx
mov ecx, ebx
mov dword [eax + 8], ecx
mov dword [ebp - 8], ecx
lea ecx, [edx*2 + 1]
imul ecx, edx
mov dword [eax], esi
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], edx
mov edx, dword [edi + 1]
mov edi, dword [ebp - 0xc]
rol ecx, 5
lea ebx, [eax*2 + 1]
imul ebx, eax
mov eax, dword [ebp - 8]
sub eax, dword [edi + edx + 4]
mov edi, dword [ebp + 0xc]
mov edx, eax
mov dword [ebp - 0x14], ecx
movzx ecx, cl
and ecx, 0x1f
rol ebx, 5
ror edx, cl
xor edx, ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
movzx ecx, bl
mov ebx, dword [ebp - 0xc]
and ecx, 0x1f
mov dword [ebp - 8], edx
mov dword [eax + 8], edx
mov edx, dword [edi + 1]
sub esi, dword [ebx + edx]
sub ebx, 8
ror esi, cl
mov cl, byte [ebp - 1]
xor esi, dword [ebp - 0x14]
dec cl
mov dword [eax], esi
test cl, cl
mov esi, dword [ebp - 0x10]
mov byte [ebp - 1], cl
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0x18]
jne 0x1000f987
pop esi
pop ebx
mov ecx, dword [edi + 1]
mov ecx, dword [ecx + 4]
sub dword [eax + 0xc], ecx
mov ecx, dword [edi + 1]
pop edi
mov ecx, dword [ecx]
sub dword [eax + 4], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000fa40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dl, 1
push esi
push edi
mov edi, dword [ebp + 0xc]
mov byte [ebp + 0xf], dl
mov ecx, dword [edi + 1]
mov ecx, dword [ecx]
add dword [eax + 4], ecx
mov ecx, dword [edi + 1]
mov ecx, dword [ecx + 4]
add dword [eax + 0xc], ecx
mov esi, dword [eax + 0xc]
mov dword [ebp - 0xc], esi
cmp byte [edi], dl
jb 0x1000faf8
mov ecx, dword [eax + 8]
push ebx
mov ebx, dword [eax + 4]
mov dword [ebp - 4], ebx
mov dword [ebp + 8], ecx
nop
lea ecx, [ebx*2 + 1]
imul ecx, ebx
lea ebx, [esi*2 + 1]
imul ebx, esi
movzx esi, dl
mov edx, dword [eax]
rol ecx, 5
mov dword [ebp - 8], ecx
xor edx, dword [ebp - 8]
rol ebx, 5
xor dword [ebp + 8], ebx
movzx ecx, bl
mov ebx, dword [ebp + 8]
and ecx, 0x1f
rol edx, cl
mov ecx, dword [edi + 1]
mov ecx, dword [ecx + esi*8]
add edx, ecx
mov ecx, dword [ebp - 8]
movzx ecx, cl
mov dword [eax], edx
and ecx, 0x1f
rol ebx, cl
mov ecx, dword [edi + 1]
add ebx, dword [ecx + esi*8 + 4]
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax + 8], esi
mov dword [eax + 0xc], edx
mov dword [ebp + 8], esi
mov esi, edx
mov dword [ebp - 0xc], edx
mov dl, byte [ebp + 0xf]
inc dl
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov dword [ebp - 4], ebx
mov byte [ebp + 0xf], dl
cmp dl, byte [edi]
jbe 0x1000fa80
pop ebx
movzx edx, byte [edi]
mov ecx, dword [edi + 1]
mov ecx, dword [ecx + edx*8 + 8]
add dword [eax], ecx
movzx edx, byte [edi]
mov ecx, dword [edi + 1]
pop edi
pop esi
mov ecx, dword [ecx + edx*8 + 0xc]
add dword [eax + 8], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000fb20
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x103c4120]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
xor esi, esi
mov dword [ebp - 0x30], eax
cmp byte [ebp + 0x10], 0x7d
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x2c], esi
jbe 0x1000fb5b
pop esi
mov al, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret
mov ax, word [ebp + 0xc]
mov ecx, 0x100
mov dword [ebx + 1], 0x103c8ed0
cmp ax, cx
ja 0x1000fcef
push edi
movzx edi, ax
lea eax, [edi + 0x1f]
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
movzx eax, ax
shl eax, 2
push eax
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.101c6a70
lea eax, [edi + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
push eax
push dword [ebp - 0x30]
lea eax, [ebp - 0x24]
push eax
call fcn.101c6b90
mov al, byte [ebp + 0x10]
add esp, 0x18
mov byte [ebx], al
mov ax, word [ebp + 0xc]
shr ax, 5
movzx ecx, ax
mov eax, edi
mov dword [ebp - 0x34], ecx
and eax, 0x8000001f
jns 0x1000fbd3
dec eax
or eax, 0xffffffe0
inc eax
je 0x1000fc14
cdq
inc ecx
and edx, 7
mov dword [ebp - 0x34], ecx
add edx, eax
sar edx, 3
and edi, 0x80000007
jns 0x1000fbef
dec edi
or edi, 0xfffffff8
inc edi
je 0x1000fbf3
inc dl
test dl, dl
je 0x1000fc1b
movzx eax, cx
lea ecx, [ebp + eax*4 - 0x28]
movzx eax, dl
push eax
push ecx
lea eax, [ebp - 0x2c]
push eax
call fcn.101c6b90
mov esi, dword [ebp - 0x2c]
add esp, 0xc
jmp 0x1000fc1b
movzx eax, cx
mov esi, dword [ebp + eax*4 - 0x28]
movzx eax, byte [ebp + 0x10]
mov dl, 1
mov dword [0x103c8ed0], 0xb7e15163
lea edi, [eax*2 + 4]
mov dword [ebp - 0x3c], edi
cmp edi, 1
jle 0x1000fc59
mov ecx, 1
nop
mov eax, dword [ebx + 1]
inc dl
lea ecx, [eax + ecx*4]
mov eax, dword [ecx - 4]
sub eax, 0x61c88647
mov dword [ecx], eax
movzx ecx, dl
cmp ecx, edi
jl 0x1000fc40
mov eax, dword [ebp - 0x34]
xor cl, cl
movzx eax, ax
xor edx, edx
mov dword [ebp - 0x2c], eax
xor ebx, ebx
cmp dword [ebp - 0x2c], edi
mov eax, edi
mov edi, dword [ebp - 0x2c]
cmovg eax, edi
mov dword [ebp - 0x30], 1
mov byte [ebp - 0x25], cl
lea eax, [eax + eax*2]
movzx eax, ax
cmp word [ebp - 0x30], ax
ja 0x1000fcee
dec edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x44], edi
mov eax, dword [ebp - 0x38]
add ebx, edx
movzx edi, byte [ebp - 0x25]
movzx ecx, cl
mov dword [ebp - 0x40], ecx
mov eax, dword [eax + 1]
add ebx, dword [eax + ecx*4]
rol ebx, 3
mov dword [eax + ecx*4], ebx
lea ecx, [edx + ebx]
and ecx, 0x1f
cmp edi, dword [ebp - 0x44]
jne 0x1000fcc1
lea eax, [edx + ebx]
add esi, eax
rol esi, cl
mov eax, esi
jmp 0x1000fccf
mov eax, dword [ebp + edi*4 - 0x24]
add eax, edx
add eax, ebx
rol eax, cl
mov dword [ebp + edi*4 - 0x24], eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x40]
inc eax
cdq
idiv dword [ebp - 0x3c]
lea eax, [edi + 1]
mov cl, dl
cdq
idiv dword [ebp - 0x2c]
dec dword [ebp - 0x34]
mov byte [ebp - 0x25], dl
mov edx, dword [ebp - 0x30]
jne 0x1000fc90
pop edi
mov ecx, dword [ebp - 4]
xor al, al
pop esi
xor ecx, ebp
pop ebx
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret
Function at 0x10010390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x103c4120]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov edx, 0x10
push esi
mov esi, dword [ebp + 0xc]
mov ecx, ebx
add esi, 0x200
mov dword [ebp - 0x20], ebx
push edi
sub esi, ebx
jmp 0x100103c0
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
add edx, 0xffff
test dx, dx
jne 0x100103c0
mov ecx, dword [0x1029e8ec]
lea esi, [ebp - 0x14]
mov eax, esi
mov dword [ebp - 0x1c], ecx
sub ebx, eax
mov edi, 4
lea esp, [esp]
lea eax, [ebx + esi]
push eax
push esi
call ecx
mov ecx, dword [ebp - 0x1c]
add esp, 8
inc esi
dec edi
jne 0x100103f0
mov ebx, dword [ebp - 0x20]
mov edx, 0x10
movdqu xmm0, xmmword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
mov ecx, ebx
add esi, 0x1f0
movdqu xmmword [ebx], xmm0
sub esi, ebx
nop
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
add edx, 0xffff
test dx, dx
jne 0x10010420
mov eax, ebx
mov byte [ebp - 0x15], 0x1e
lea ecx, [ebp - 0x14]
sub eax, ecx
mov dword [ebp - 0x1c], eax
mov esi, dword [ebx + 4]
mov edi, 4
mov ecx, dword [ebx + 8]
mov eax, esi
mov edx, dword [ebx + 0xc]
shl eax, 7
rol ecx, 0xa
xor ecx, eax
mov eax, dword [ebx]
ror eax, 5
xor ecx, edx
xor eax, edx
ror edx, 7
xor eax, esi
ror esi, 1
mov dword [ebx], eax
xor esi, dword [ebx]
shl eax, 3
xor esi, ecx
xor edx, eax
mov dword [ebx + 4], esi
mov eax, ecx
lea esi, [ebp - 0x14]
ror eax, 3
xor edx, ecx
mov dword [ebx + 8], eax
mov eax, dword [ebx]
ror eax, 0xd
mov dword [ebx], eax
movzx eax, byte [ebp - 0x15]
and eax, 7
mov dword [ebx + 0xc], edx
mov ebx, dword [eax*4 + 0x1029e8d0]
lea ecx, [ecx]
mov eax, dword [ebp - 0x1c]
add eax, esi
push eax
push esi
call ebx
add esp, 8
inc esi
dec edi
jne 0x100104a0
mov ebx, dword [ebp - 0x20]
lea edx, [edi + 0x10]
movsx ecx, byte [ebp - 0x15]
mov eax, ebx
movdqu xmm0, xmmword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
shl ecx, 4
sub ecx, ebx
movdqu xmmword [ebx], xmm0
add esi, ecx
nop
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
add edx, 0xffff
test dx, dx
jne 0x100104d0
dec byte [ebp - 0x15]
jns 0x10010442
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret
Function at 0x10010500
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x103c4120]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x14]
mov eax, edi
mov dword [ebp - 0x24], edi
sub eax, ecx
mov dword [ebp - 0x18], 0x1f
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
sub ecx, edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ecx
jmp 0x10010540
mov edx, 0x10
mov eax, edi
mov cl, byte [ecx + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
add edx, 0xffff
mov ecx, dword [ebp - 0x20]
test dx, dx
jne 0x10010547
and ebx, 7
lea esi, [ebp - 0x14]
mov edi, dword [ebx*4 + 0x1029e8b0]
mov ebx, 4
mov eax, dword [ebp - 0x1c]
add eax, esi
push eax
push esi
call edi
add esp, 8
inc esi
dec ebx
jne 0x10010570
mov edi, dword [ebp - 0x24]
movdqu xmm0, xmmword [ebp - 0x14]
mov ebx, dword [ebp - 0x28]
inc ebx
movdqu xmmword [edi], xmm0
mov edx, dword [edi]
mov esi, dword [edi + 8]
rol edx, 0xd
rol esi, 3
mov ecx, esi
mov dword [ebp - 0x28], ebx
xor ecx, edx
xor ecx, dword [edi + 4]
lea eax, [edx*8]
xor eax, dword [edi + 0xc]
xor eax, esi
rol ecx, 1
rol eax, 7
mov dword [edi + 0xc], eax
xor eax, ecx
xor eax, edx
mov dword [edi + 4], ecx
mov dword [edi], eax
mov eax, ecx
mov ecx, dword [ebp - 0x20]
shl eax, 7
add ecx, 0x10
xor eax, dword [edi + 0xc]
xor eax, esi
mov dword [ebp - 0x20], ecx
mov dword [edi + 8], eax
mov eax, dword [edi]
rol eax, 5
mov dword [edi], eax
mov eax, dword [edi + 8]
ror eax, 0xa
dec dword [ebp - 0x18]
mov dword [edi + 8], eax
jne 0x10010540
mov esi, dword [ebp + 0xc]
mov edx, 0x10
mov ecx, edi
sub esi, edi
lea ecx, [ecx]
mov al, byte [esi + ecx + 0x1f0]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
add edx, 0xffff
test dx, dx
jne 0x10010600
mov ecx, dword [0x1029e8cc]
lea esi, [ebp - 0x14]
mov eax, esi
mov dword [ebp - 0x18], ecx
sub edi, eax
mov ebx, 4
lea ecx, [ecx]
lea eax, [edi + esi]
push eax
push esi
call ecx
mov ecx, dword [ebp - 0x18]
add esp, 8
inc esi
dec ebx
jne 0x10010630
mov edi, dword [ebp - 0x24]
mov ecx, 0x10
mov eax, dword [ebp + 0xc]
movdqu xmm0, xmmword [ebp - 0x14]
sub eax, edi
mov dword [ebp + 0xc], eax
movdqu xmmword [edi], xmm0
lea ebx, [ebx]
mov al, byte [eax + edi + 0x200]
lea edi, [edi + 1]
xor byte [edi - 1], al
add ecx, 0xffff
mov eax, dword [ebp + 0xc]
test cx, cx
jne 0x10010660
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret