joyce8/EMBER2024-capa huggingface dataset:
Function at 0x445fbc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x445ff4]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x445fd5
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x445fe4
or bl, 4
test esi, 0x20000000
je 0x445fef
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44c5f8
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x44c60a
add esp, 0xfffffff0
call fcn.00403804
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b1a0
mov eax, dword [0x451ca0]
mov dword [eax + 4], ebx
mov dword [eax], 0x44c99c
mov eax, dword [0x451cac]
mov dword [eax + 4], ebx
mov dword [eax], 0x44c9a8
mov eax, ebx
call fcn.0044c9b4
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411200]
call fcn.00403488
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411200]
call fcn.00403488
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x411200]
call fcn.00403488
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x411200]
call fcn.00403488
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x411200]
call fcn.00403488
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x448e7c
push eax
push 0
push 0
mov eax, dword [0x451dc0]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41cb30]
call fcn.0041df34
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41cb30]
call fcn.0041df34
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41cb30]
call fcn.0041df34
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0044cdd4
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44ccb0
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44ccb0
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44ccb0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44c747
call fcn.0040385c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44ca94
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44cc3f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44cc20
mov dl, 1
mov eax, dword [0x4116f0]
call fcn.00403488
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.0040420c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44cc0f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043a6b8
test al, al
je 0x44cc02
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44cc50
lea eax, [ebp - 0x254]
call fcn.00408cec
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44cc02
xor eax, eax
push ebp
push 0x44cbfb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44cc88
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44cbe4
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404474
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44cbe4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404474
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44cc02
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44cb05
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00415838
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44cc46
lea eax, [ebp - 0x260]
call fcn.0040420c
ret

Function at 0x44d574
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x452bfc]
cmp byte [eax + 0xa5], 0
jne 0x44d5e5
cmp dword [0x452c14], 0
jne 0x44d5a6
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44d530
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x452c14], eax
cmp dword [0x452c10], 0
jne 0x44d5c1
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x452c10], eax
cmp dword [0x452c18], 0
jne 0x44d5e5
push esp
push 0
push 0
push 0x44d4d4
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x452c18], eax
pop edx
ret
Function at 0x44d6dc
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44d6f3
add esp, 0xfffffff0
call fcn.00403804
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b1a0
mov eax, dword [0x451db0]
cmp word [eax + 2], 0
jne 0x44d71b
mov eax, dword [0x451db0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044eda0
mov eax, dword [0x451e34]
cmp word [eax + 2], 0
jne 0x44d735
mov eax, dword [0x451e34]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044ef98
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411200]
call fcn.00403488
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411200]
call fcn.00403488
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41d2e0]
call fcn.00422eec
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44d8bc
mov eax, dword [0x451cf4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004232bc
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44f508
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x451cf4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040a568
test eax, eax
je 0x44d82a
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408648
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040a590
test eax, eax
je 0x44d83e
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404474
mov eax, dword [0x451c20]
cmp byte [eax], 0
jne 0x44d872
mov eax, ebx
call fcn.0044d9e4
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044f6e4
mov eax, ebx
call fcn.00450024
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44d8b2
call fcn.0040385c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44dc58
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x452bfc]
cmp dword [eax + 0x30], 0
je 0x44dd02
cmp dword [ebx + 0x94], 0
jne 0x44dcfc
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44dbe8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44dcfc
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44dcc2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44dcfc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004138a0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44dcd1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44e7e0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44e815
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004042fc
jmp 0x44e822
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404260
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44f8c0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44f901
mov eax, esi
call fcn.00435e34
test al, al
je 0x44f901
mov eax, dword [ebx + 0x84]
call fcn.00435b30
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44f901
push 0
mov eax, dword [ebx + 0x84]
call fcn.00435b30
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x10001110
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1000112e
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
ret

Function at 0x100011f0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x10001212
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
ret

Function at 0x10001300
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
movups xmm1, xmmword [edx + 0x10]
shl ecx, 4
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
nop dword [eax]
add ecx, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1000132a
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
ret

Function at 0x10001470
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm3, xmm1
lea edx, [edx + ecx + 0x20]
neg ecx
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [edx + ecx]
add ecx, 0x10
jmp 0x100014cf

Function at 0x10002e60
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x10003380
test edx, edx
je 0x10003380
call fcn.10002e77
mov eax, 0xffffffff
pop ebx
pop ebp
ret
Function at 0x100033d0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.10002e60
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x10003441
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x10003406
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x10006bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
call fcn.10006bc9
Function at 0x10048f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0xc
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [eax + 4]
mov esi, dword [ebx + 4]
cmp edi, esi
jle 0x10048f60
mov eax, dword [eax]
mov edx, edi
sub edx, esi
lea eax, [eax + esi*4]
or ecx, dword [eax]
lea eax, [eax + 4]
sub edx, 1
jne 0x10048f54
cmp edi, esi
jge 0x10048f7a
mov eax, dword [ebx]
mov edx, esi
sub edx, edi
lea eax, [eax + edi*4]
nop dword [eax + eax]
or ecx, dword [eax]
lea eax, [eax + 4]
sub edx, 1
jne 0x10048f70
cmp esi, edi
cmovge esi, edi
xor edx, edx
test esi, esi
jle 0x10049020
cmp esi, 8
jb 0x10049007
mov edi, dword [ebp + 0xc]
mov eax, esi
and eax, 0x80000007
jns 0x10048f9f
dec eax
or eax, 0xfffffff8
inc eax
mov ebx, dword [ebx]
xorps xmm3, xmm3
mov edi, dword [edi]
xorps xmm2, xmm2
mov dword [ebp - 4], esi
sub dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movups xmm0, xmmword [ebx + edx*4]
movups xmm1, xmmword [edi + edx*4]
pxor xmm1, xmm0
movups xmm0, xmmword [ebx + edx*4 + 0x10]
por xmm3, xmm1
movups xmm1, xmmword [edi + edx*4 + 0x10]
add edx, 8
pxor xmm1, xmm0
por xmm2, xmm1
cmp edx, eax
jl 0x10048fb2
mov ebx, dword [ebp + 8]
por xmm2, xmm3
mov edi, dword [ebp + 0xc]
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd eax, xmm2
or ecx, eax
cmp edx, esi
jge 0x10049023
mov eax, dword [ebp + 0xc]
mov edi, dword [ebx]
mov ebx, dword [eax]
nop
mov eax, dword [ebx + edx*4]
xor eax, dword [edi + edx*4]
inc edx
or ecx, eax
cmp edx, esi
jl 0x10049010
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx + 0xc]
xor eax, dword [edi + 0xc]
or eax, ecx
neg eax
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004b8b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x1004ba58
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 8], esi
cmp edi, 0x10
jb 0x1004b937
mov ecx, edi
shr ecx, 4
mov dword [ebp - 0xc], ecx
nop dword [eax]
mov ecx, ebx
sub esi, eax
sub ecx, eax
mov edx, 4
mov dword [ebp - 0x10], ecx
mov edi, ecx
mov ecx, dword [eax]
lea eax, [eax + 4]
xor ecx, dword [esi + eax - 4]
mov dword [edi + eax - 4], ecx
sub edx, 1
jne 0x1004b8f0
push dword [ebp + 0x14]
push ebx
push ebx
call dword [ebp + 0x1c]
mov edi, dword [ebp + 0x10]
mov eax, ebx
mov esi, dword [ebp - 8]
sub edi, 0x10
add esi, 0x10
mov dword [ebp + 0x10], edi
add esp, 0xc
mov dword [ebp - 8], esi
add ebx, 0x10
mov ecx, edi
sub dword [ebp - 0xc], 1
jne 0x1004b8e0
mov dword [ebp + 0x10], ecx
test ecx, ecx
je 0x1004ba4d
lea ecx, [ebx + 2]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
mov edi, ebx
mov ecx, dword [ebp - 8]
xor edx, edx
sub dword [ebp - 0xc], ecx
sub edi, ecx
mov dword [ebp - 0x18], edi
inc esi
mov edi, 1
sub edi, ecx
mov dword [ebp - 0x1c], edi
mov edi, 2
sub edi, ecx
mov ecx, eax
sub ecx, ebx
mov dword [ebp - 0x20], edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], ecx
mov ecx, ebx
not ecx
mov dword [ebp - 0x14], ecx
cmp edx, edi
jae 0x1004b9fd
mov edi, dword [ebp - 4]
mov cl, byte [esi - 1]
xor cl, byte [edx + eax]
mov byte [edi - 2], cl
mov ecx, edi
add ecx, dword [ebp - 0x14]
mov edi, dword [ebp + 0x10]
cmp ecx, edi
jae 0x1004b9f7
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x18]
mov cl, byte [esi + ecx]
xor cl, byte [esi]
mov byte [esi + edi], cl
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp + 0x10]
add ecx, esi
cmp ecx, edi
jae 0x1004b9f2
mov ecx, dword [ebp - 4]
mov edi, dword [ebp - 0x10]
mov cl, byte [edi + ecx]
mov edi, dword [ebp - 4]
xor cl, byte [esi + 1]
mov byte [edi], cl
mov ecx, dword [ebp - 0x20]
mov edi, dword [ebp + 0x10]
add ecx, esi
cmp ecx, edi
jae 0x1004b9ed
mov cl, byte [esi + 2]
add esi, 4
mov edi, dword [ebp - 4]
xor cl, byte [edx + eax + 3]
add edx, 4
add dword [ebp - 4], 4
mov byte [edi + 1], cl
mov edi, dword [ebp + 0x10]
cmp edx, 0x10
jb 0x1004b975
jmp 0x1004ba21
add edx, 3
jmp 0x1004b9f8
add edx, 2
jmp 0x1004b9f8
inc edx
cmp edx, 0x10
jae 0x1004ba21
mov edi, dword [ebp - 0x10]
lea ecx, [edx + ebx]
mov esi, 0x10
sub esi, edx
nop word [eax + eax]
mov al, byte [edi + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub esi, 1
jne 0x1004ba10
mov edi, dword [ebp + 0x10]
push dword [ebp + 0x14]
push ebx
push ebx
call dword [ebp + 0x1c]
add esp, 0xc
mov eax, ebx
cmp edi, 0x10
jbe 0x1004ba4d
mov esi, dword [ebp - 8]
sub edi, 0x10
add esi, 0x10
mov dword [ebp + 0x10], edi
add ebx, 0x10
mov dword [ebp - 8], esi
test edi, edi
jne 0x1004b937
movups xmm0, xmmword [eax]
mov eax, dword [ebp + 0x18]
pop esi
pop ebx
movups xmmword [eax], xmm0
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1004ba60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push esi
mov eax, dword [ecx + 0x150]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 0x154]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0x38]
or eax, dword [ecx + 0x3c]
jne 0x1004bb57
mov esi, dword [ebp + 0x10]
xor edx, edx
mov eax, esi
add eax, dword [ecx + 0x30]
adc edx, dword [ecx + 0x34]
cmp edx, 0x20000000
ja 0x1004bb57
jb 0x1004baab
test eax, eax
jne 0x1004bb57
push ebx
mov dword [ecx + 0x34], edx
mov edx, dword [ecx + 0x164]
mov dword [ecx + 0x30], eax
mov dword [ebp - 4], edx
push edi
mov edi, dword [ebp + 0xc]
test edx, edx
je 0x1004bb06
test esi, esi
je 0x1004baf4
mov al, byte [edi]
dec esi
xor byte [edx + ecx + 0x40], al
inc edi
inc edx
and edx, 0xf
mov dword [ebp - 4], edx
jne 0x1004bac3
lea eax, [ecx + 0x50]
lea ebx, [ecx + 0x40]
mov dword [ebp - 0xc], eax
push eax
push ebx
call dword [ebp - 8]
mov eax, dword [ebp - 4]
add esp, 8
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], eax
jmp 0x1004bb0c
pop edi
pop ebx
mov dword [ecx + 0x164], edx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ecx + 0x50]
lea ebx, [ecx + 0x40]
mov eax, esi
and eax, 0xfffffff0
mov dword [ebp - 0xc], eax
je 0x1004bb26
push eax
push edi
push edx
push ebx
call dword [ebp - 0x10]
add edi, dword [ebp - 0xc]
add esp, 0x10
sub esi, dword [ebp - 0xc]
test esi, esi
je 0x1004bb3f
mov dword [ebp - 4], esi
nop dword [eax]
mov al, byte [edi]
lea edi, [edi + 1]
xor byte [ebx], al
lea ebx, [ebx + 1]
sub esi, 1
jne 0x1004bb30
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
pop edi
pop ebx
mov dword [eax + 0x164], ecx
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004c4a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100f529c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
cmp dword [esi + 0x160], 0
mov ecx, dword [esi + 0x150]
mov dword [ebp - 0x18], ecx
jne 0x1004c4db
cmp dword [esi + 0x164], 0
jne 0x1004c4db
lea ebx, [esi + 0x40]
jmp 0x1004c4e8
lea eax, [esi + 0x50]
push eax
lea ebx, [esi + 0x40]
push ebx
call ecx
add esp, 8
mov ecx, dword [esi + 0x30]
lea edx, [ebp - 0x14]
mov eax, dword [esi + 0x34]
shld eax, ecx, 3
push edi
shl ecx, 3
mov edi, 4
bswap ecx
bswap eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [esi + 0x38]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x3c]
shld eax, ecx, 3
shl ecx, 3
bswap ecx
bswap eax
mov dword [ebp - 8], ecx
mov ecx, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [edx]
lea edx, [edx + 4]
xor dword [ecx], eax
lea ecx, [ecx + 4]
sub edi, 1
jne 0x1004c521
lea eax, [esi + 0x50]
push eax
push ebx
call dword [ebp - 0x18]
add esp, 8
lea edx, [edi + 4]
mov eax, ebx
pop edi
mov ecx, dword [eax - 0x20]
lea eax, [eax + 4]
xor dword [eax - 4], ecx
sub edx, 1
jne 0x1004c541
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x1004c57e
mov eax, dword [ebp + 0x10]
cmp eax, 0x10
ja 0x1004c57e
push eax
push ecx
push ebx
call fcn.1006c260
add esp, 0xc
neg eax
sbb eax, eax
inc eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a69cd
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.100a69cd
mov esp, ebp
pop ebp
ret
Function at 0x100519a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
mov eax, dword [0x100f529c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1b8], eax
test edi, edi
je 0x10051be8
push ebx
push esi
call fcn.10086d60
mov edx, dword [ebp + 0x10]
mov ebx, eax
xorps xmm0, xmm0
lea eax, [ebp - 0x54]
xor ecx, ecx
sub edx, eax
movups xmmword [ebp - 0x54], xmm0
movups xmmword [ebp - 0x44], xmm0
lea eax, [ebp - 0x54]
add eax, ecx
add ecx, 0x10
movups xmm0, xmmword [eax]
movups xmm1, xmmword [edx + eax]
pxor xmm1, xmm0
movups xmmword [eax], xmm1
cmp ecx, 0x20
jb 0x100519e6
push 1
call fcn.10078360
mov esi, eax
add esp, 4
test esi, esi
jne 0x10051afe
push 0x130
call fcn.1006c4c0
mov esi, eax
add esp, 4
test esi, esi
je 0x10051a3c
push 0x100667b0
push esi
push 1
call fcn.10078400
add esp, 0xc
test eax, eax
jne 0x10051a42
lea esi, [ebp - 0x1b4]
lea eax, [ebp - 0x84]
mov dword [esi + 0x124], 0
push 0x30
push eax
call fcn.10086d00
movups xmm0, xmmword [ebp - 0x84]
add esp, 8
xor eax, eax
movups xmmword [ebp - 0x34], xmm0
movups xmm0, xmmword [ebp - 0x74]
movups xmmword [ebp - 0x24], xmm0
movups xmm0, xmmword [ebp - 0x64]
movups xmmword [ebp - 0x14], xmm0
nop word [eax + eax]
movups xmm0, xmmword [ebp + eax - 0x34]
movups xmm1, xmmword [eax + 0x100c7ff0]
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x34], xmm1
add eax, 0x10
cmp eax, 0x30
jb 0x10051a80
push 0x20
lea eax, [ebp - 0x34]
push eax
lea eax, [esi + 0xf4]
push eax
push 0
push esi
call fcn.100546e0
movups xmm0, xmmword [ebp - 0x14]
mov dword [esi + 0xf8], eax
add esp, 0x14
movups xmmword [esi + 0xfc], xmm0
mov dword [esi + 0x110], 1
mov dword [esi + 0x114], 0
mov dword [esi + 0x120], 0
mov dword [esi + 0x118], 0xc0ffee
mov dword [esi + 0x11c], 0
mov dword [esi + 0x128], ebx
cmp dword [esi + 0x120], 0x1000
jae 0x10051b27
cmp dword [esi + 0x118], 0xc0ffee
jne 0x10051b27
cmp dword [esi + 0x11c], 0
jne 0x10051b27
cmp dword [esi + 0x128], ebx
je 0x10051b81
lea eax, [ebp - 0x34]
push 0x30
push eax
call fcn.10086d00
push 0x30
lea eax, [ebp - 0x34]
push eax
push esi
call fcn.1005ad40
add esp, 0x14
test eax, eax
je 0x10051bf7
mov dword [esi + 0x110], 1
mov dword [esi + 0x114], 0
mov dword [esi + 0x120], 0
mov dword [esi + 0x118], 0xc0ffee
mov dword [esi + 0x11c], 0
mov dword [esi + 0x128], ebx
mov eax, 1
mov ecx, 0x10000
nop dword [eax + eax]
cmp edi, 0x10000
mov ebx, edi
cmova ebx, ecx
shl eax, 5
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push dword [ebp - 0x1b8]
push esi
call fcn.1004cb90
add esp, 0x14
test eax, eax
je 0x10051bf7
add dword [ebp - 0x1b8], ebx
xor eax, eax
inc dword [esi + 0x120]
mov ecx, 0x10000
sub edi, ebx
jne 0x10051b90
lea eax, [ebp - 0x1b4]
cmp esi, eax
jne 0x10051be6
push 0x118
push esi
call fcn.1006c330
add esp, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.100a69cd
mov esp, ebp
pop ebp
ret
call fcn.100a8e30
int3