joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e520
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x44
mov eax, dword [0x1005fe78]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x54]
xor ebp, ebp
push edi
mov edi, dword [esp + 0x5c]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0
test edi, edi
je 0x1000e67b
lea eax, [esp + 0x10]
push eax
push 0x400
push dword [esi + 0x1c]
call fcn.1003a010
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x1000e661
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.MSVCR120.dll__stat64i32]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x28]
push 0x30
push eax
push esi
call fcn.1003bb30
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x1000e661
lea ebp, [eax + 0x30]
cmp dword [esp + 0x18], eax
jge 0x1000e5ac
mov ebx, 0x2711
jmp 0x1000e661
mov esi, dword [esp + 0x60]
test esi, esi
jle 0x1000e65d
push 0x1004e33c
push edi
call dword [sym.imp.MSVCR120.dll_fopen]
add esp, 8
mov dword [esp + 0x18], eax
test eax, eax
je 0x1000e65d
mov edi, 0x400
cmp esi, edi
push eax
cmovl edi, esi
push edi
push 1
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR120.dll_fread]
add esp, 0x10
mov dword [esp + 0x1c], eax
test eax, eax
jle 0x1000e63d
push edi
push dword [esp + 0x14]
push dword [esp + 0x1c]
call fcn.1003bb30
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x1000e650
add ebp, dword [esp + 0x1c]
sub esi, edi
test esi, esi
jle 0x1000e63d
push dword [esp + 0x18]
mov edi, 0x400
cmp esi, edi
cmovl edi, esi
push edi
push 1
push dword [esp + 0x1c]
call dword [sym.imp.MSVCR120.dll_fread]
add esp, 0x10
mov dword [esp + 0x1c], eax
test eax, eax
jg 0x1000e5f6
push 0x400
push 0
push dword [esp + 0x18]
call sub.MSVCR120.dll_memset
add esp, 0xc
push dword [esp + 0x18]
call dword [sym.imp.MSVCR120.dll_fclose]
add esp, 4
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1000e675
push eax
push dword [esi + 0x1c]
call fcn.10039ff0
add esp, 8
mov eax, ebx
test ebp, ebp
jne 0x1000e680
mov eax, 0x2711
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1004475d
add esp, 0x44
ret
Function at 0x100309b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x1005fe78]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov ebx, dword [eax + 8]
push esi
mov esi, dword [eax + 0xc]
cmp dword [ebx + 0x84], 3
je 0x100309ef
pop esi
pop ebp
mov eax, 0x2732
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1004475d
add esp, 0x14
ret
mov eax, dword [esp + 0x2c]
cmp eax, dword [esi + 8]
jae 0x10030a0f
pop esi
pop ebp
mov eax, 0x271b
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.1004475d
add esp, 0x14
ret
lea eax, [esp + 0xc]
push eax
push dword [ebx + 0x38]
call fcn.1000a240
xor edx, edx
add esp, 8
cmp dword [esi + 8], edx
jbe 0x10030a43
push edi
lea edi, [esp + 0x10]
sub edi, ebp
lea ecx, [ecx]
lea ecx, [edx + ebp]
mov al, byte [edi + ecx]
xor al, byte [ebx + edx + 0x40]
inc edx
mov byte [ecx], al
cmp edx, dword [esi + 8]
jb 0x10030a30
pop edi
mov ecx, dword [esp + 0x1c]
xor eax, eax
pop esi
pop ebp
mov dword [ebx + 0x84], 0
pop ebx
xor ecx, esp
call fcn.1004475d
add esp, 0x14
ret

Function at 0x10032250
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x20]
shr ebp, 3
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
test ebp, ebp
je 0x100322d3
mov eax, dword [esp + 0x18]
push ebx
push esi
mov esi, dword [esp + 0x24]
sub eax, esi
push edi
mov dword [esp + 0x24], eax
mov edi, dword [eax + esi]
mov ebx, dword [eax + esi + 4]
lea eax, [esp + 0x18]
push dword [esp + 0x30]
mov dword [esp + 0x1c], edi
push eax
mov dword [esp + 0x24], ebx
call dword [esp + 0x40]
mov ecx, dword [esp + 0x20]
lea esi, [esi + 8]
xor ecx, dword [esp + 0x18]
add esp, 8
mov eax, dword [esp + 0x1c]
mov edx, ebx
xor eax, dword [esp + 0x14]
mov dword [esi - 8], ecx
mov ecx, edi
mov dword [esi - 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edx
dec ebp
jne 0x10032281
mov eax, dword [esp + 0x34]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop ebp
add esp, 0x10
ret

Function at 0x100322e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x1c]
shr edi, 3
mov eax, dword [ebp]
mov ecx, dword [ebp + 4]
test edi, edi
je 0x10032345
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
sub ebx, esi
jmp 0x10032310
xor eax, dword [ebx + esi]
push dword [esp + 0x28]
xor ecx, dword [ebx + esi + 4]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], ecx
call dword [esp + 0x38]
mov eax, dword [esp + 0x18]
lea esi, [esi + 8]
mov ecx, dword [esp + 0x1c]
add esp, 8
mov dword [esi - 8], eax
mov dword [esi - 4], ecx
dec edi
jne 0x10032310
pop esi
pop ebx
mov dword [ebp], eax
xor eax, eax
pop edi
mov dword [ebp + 4], ecx
pop ebp
add esp, 8
ret
Function at 0x10034340
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x1005fe78]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, dword [esp + 0x1c]
cmp dword [esi + 0x98], 0
je 0x10034379
push 0
push 1
push dword [esi + 0x38]
lea eax, [esi + 8]
push eax
push dword [esi]
call fcn.100331a0
add esp, 0x14
test eax, eax
jne 0x1003443e
push 0x10
push dword [esi + 0x3c]
lea eax, [esp + 0xc]
push 0x10
push eax
call dword [sym.imp.MSVCR120.dll_memcpy_s]
add esp, 0x10
mov eax, 0xf
inc byte [esp + eax + 4]
jne 0x1003439c
dec eax
jns 0x10034393
push ebp
push 0x10
lea eax, [esp + 0xc]
push eax
lea ebp, [esi + 8]
push ebp
push dword [esi]
call fcn.100268f0
add esp, 0x10
test eax, eax
jne 0x1003443d
mov eax, 0xf
nop
inc byte [esp + eax + 8]
jne 0x100343c9
dec eax
jns 0x100343c0
push 0x10
lea eax, [esp + 0xc]
push eax
lea eax, [esi + 0x18]
push eax
push dword [esi]
call fcn.100268f0
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x1003443b
cmp dword [esi + 0x38], 0x10
jbe 0x10034414
mov eax, 0xf
nop
inc byte [esp + eax + 8]
jne 0x100343f9
dec eax
jns 0x100343f0
push 0x10
lea eax, [esp + 0xc]
push eax
lea eax, [esi + 0x28]
push eax
push dword [esi]
call fcn.100268f0
mov edx, eax
add esp, 0x10
test edx, edx
jne 0x1003443b
push edi
mov edi, dword [esp + 0x2c]
xor ecx, ecx
test edi, edi
jle 0x10034430
push ebx
mov ebx, dword [esp + 0x2c]
mov al, byte [ecx + ebx]
xor byte [ecx + ebp], al
inc ecx
cmp ecx, edi
jl 0x10034424
pop ebx
mov dword [esi + 0x98], 1
pop edi
mov eax, edx
pop ebp
mov ecx, dword [esp + 0x14]
pop esi
xor ecx, esp
call fcn.1004475d
add esp, 0x14
ret

Function at 0x10034680
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, 0x10
push ebx
push esi
push edi
mov edi, dword [eax + 0xc]
mov dword [esp + 0x10], 0
mov esi, dword [edi + 0x8c]
lea ebx, [edi + 0x50]
lea eax, [esi + 0x3f]
cdq
and edx, 0x3f
add eax, edx
and eax, 0xffffffc0
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp eax, ecx
cmovb eax, ecx
mov dword [edi + 0x38], eax
mov ecx, eax
lea eax, [edi + 8]
add eax, ecx
mov dword [edi + 0x3c], eax
lea eax, [ecx + 0x10]
push eax
lea eax, [esp + 0x14]
push eax
push ebx
push esi
push 0
push dword [edi + 4]
call fcn.1000e290
add esp, 0x18
test eax, eax
jne 0x10034773
cmp dword [edi + 0x90], eax
je 0x10034737
mov eax, dword [edi + 0x94]
mov ecx, dword [esp + 0x10]
cmp ecx, eax
cmova ecx, eax
xor eax, eax
mov dword [esp + 0x10], ecx
test ecx, ecx
jle 0x10034723
jmp 0x10034710
mov ecx, dword [edi + 0x90]
mov cl, byte [eax + ecx]
xor byte [ebx + eax], cl
inc eax
cmp eax, dword [esp + 0x10]
jl 0x10034710
mov dword [edi + 0x90], 0
mov dword [edi + 0x94], 0
push 0x30
lea eax, [edi + 8]
push 0
push eax
call sub.MSVCR120.dll_memset
mov eax, dword [edi + 0x38]
add eax, 0x10
mov dword [edi + 0x98], 1
push eax
push ebx
push edi
call fcn.10034340
add esp, 0x18
test eax, eax
jne 0x10034773
mov dword [edi + 0x80], 1
mov dword [edi + 0x84], eax
pop edi
pop esi
pop ebx
ret
Function at 0x10034910
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
mov eax, dword [0x1005fe78]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
mov edi, dword [esp + 0x24]
mov dword [esp + 8], 0
mov eax, dword [edi + 0x38]
lea esi, [edi + 0x50]
add eax, 0x10
push eax
lea eax, [esp + 0xc]
push eax
push esi
push dword [edi + 0x8c]
push 0
push dword [edi + 4]
call fcn.1000e290
add esp, 0x18
test eax, eax
jne 0x10034a7d
mov edx, dword [esp + 8]
cmp edx, dword [esp + 0x2c]
push ebx
cmova edx, dword [esp + 0x30]
xor ecx, ecx
mov dword [esp + 0xc], edx
test edx, edx
jle 0x1003497e
mov ebx, dword [esp + 0x2c]
mov al, byte [ecx + ebx]
xor byte [esi + ecx], al
inc ecx
cmp ecx, edx
jl 0x10034973
cmp dword [edi + 0x98], 0
mov eax, dword [edi + 0x38]
lea ebx, [eax + 0x10]
je 0x100349aa
push 0
push 1
push eax
lea eax, [edi + 8]
push eax
push dword [edi]
call fcn.100331a0
mov ecx, eax
add esp, 0x14
test ecx, ecx
jne 0x10034a66
push 0x10
push dword [edi + 0x3c]
lea eax, [esp + 0x18]
push 0x10
push eax
call dword [sym.imp.MSVCR120.dll_memcpy_s]
add esp, 0x10
mov eax, 0xf
inc byte [esp + eax + 0x10]
jne 0x100349cd
dec eax
jns 0x100349c4
push 0x10
lea eax, [esp + 0x14]
push eax
lea esi, [edi + 8]
push esi
push dword [edi]
call fcn.100268f0
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x10034a66
mov eax, 0xf
inc byte [esp + eax + 0x10]
jne 0x100349fa
dec eax
jns 0x100349f1
push 0x10
lea eax, [esp + 0x14]
push eax
lea eax, [edi + 0x18]
push eax
push dword [edi]
call fcn.100268f0
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x10034a66
cmp dword [edi + 0x38], 0x10
jbe 0x10034a44
mov eax, 0xf
inc byte [esp + eax + 0x10]
jne 0x10034a29
dec eax
jns 0x10034a20
push 0x10
lea eax, [esp + 0x14]
push eax
lea eax, [edi + 0x28]
push eax
push dword [edi]
call fcn.100268f0
mov ecx, eax
add esp, 0x10
test ecx, ecx
jne 0x10034a66
test ebx, ebx
jle 0x10034a5c
jmp 0x10034a50
mov al, byte [esi + 0x48]
lea esi, [esi + 1]
xor byte [esi - 1], al
dec ebx
jne 0x10034a50
mov dword [edi + 0x98], 1
mov eax, ecx
pop ebx
test ecx, ecx
jne 0x10034a7d
mov dword [edi + 0x80], 1
mov dword [edi + 0x84], ecx
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
call fcn.1004475d
add esp, 0x18
ret
Function at 0x10034e60
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x14]
cdq
and edx, 3
push ebx
push ebp
push esi
lea ebx, [edx + eax]
mov edx, dword [esp + 0x18]
sar ebx, 2
lea ebp, [edx + 0x10]
mov dword [esp + 0x10], ebp
mov dword [edx + 4], ebx
lea ecx, [ebx + 6]
mov dword [edx], ecx
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx]
mov dword [ebp], eax
mov eax, dword [ecx + 4]
mov dword [ebp + 4], eax
mov eax, dword [ecx + 8]
mov dword [ebp + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp + 0xc], eax
cmp ebx, 6
jl 0x10034ec4
mov eax, dword [ecx + 0x10]
mov dword [ebp + 0x10], eax
mov eax, dword [ecx + 0x14]
mov dword [ebp + 0x14], eax
cmp ebx, 8
jne 0x10034ec4
mov eax, dword [ecx + 0x18]
mov dword [ebp + 0x18], eax
mov eax, dword [ecx + 0x1c]
mov dword [ebp + 0x1c], eax
mov eax, dword [edx]
mov edx, ebp
mov dword [esp + 0x20], 0x10054298
lea esi, [eax*4 + 4]
lea eax, [ebx*4]
mov dword [esp + 0xc], esi
sub edx, eax
add eax, ebp
mov dword [esp + 0x1c], eax
mov eax, dword [eax - 4]
cmp ebx, esi
jge 0x10035009
mov esi, dword [esp + 0x1c]
push edi
lea edi, [ebx + 4]
add esi, 4
lea edi, [edx + edi*4]
sub edx, ebp
mov dword [esp + 0x20], edx
mov ebp, ebx
jmp 0x10034f10
movzx ecx, al
movzx edx, byte [ecx + str.cw]
mov ecx, eax
shr ecx, 0x18
shl edx, 8
movzx ecx, byte [ecx + str.cw]
or edx, ecx
mov ecx, eax
shr ecx, 0x10
shr eax, 8
movzx ecx, cl
movzx eax, al
shl edx, 8
movzx ecx, byte [ecx + str.cw]
movzx eax, byte [eax + str.cw]
or edx, ecx
mov ecx, dword [esp + 0x24]
shl edx, 8
or edx, eax
movzx eax, byte [ecx]
inc ecx
xor eax, edx
mov dword [esp + 0x24], ecx
xor eax, dword [edi - 0x10]
mov ecx, dword [esp + 0x20]
mov dword [esi - 4], eax
xor eax, dword [ecx + esi]
mov dword [esi], eax
xor eax, dword [edi - 8]
mov dword [esi + 4], eax
xor eax, dword [edi - 4]
mov dword [esi + 8], eax
cmp ebx, 6
jl 0x10034fed
jne 0x10034f8e
xor eax, dword [edi]
mov dword [esi + 0xc], eax
xor eax, dword [edi + 4]
mov dword [esi + 0x10], eax
jmp 0x10034fed
cmp ebp, 0x38
je 0x10035004
mov ecx, eax
shr ecx, 0x18
movzx edx, byte [ecx + str.cw]
mov ecx, eax
shr ecx, 0x10
movzx ecx, cl
shl edx, 8
movzx ecx, byte [ecx + str.cw]
or edx, ecx
mov ecx, eax
shr ecx, 8
movzx eax, al
movzx ecx, cl
shl edx, 8
movzx eax, byte [eax + str.cw]
movzx ecx, byte [ecx + str.cw]
or edx, ecx
shl edx, 8
or eax, edx
xor eax, dword [edi]
mov dword [esi + 0xc], eax
xor eax, dword [edi + 4]
mov dword [esi + 0x10], eax
xor eax, dword [edi + 8]
mov dword [esi + 0x14], eax
xor eax, dword [edi + 0xc]
mov dword [esi + 0x18], eax
lea ecx, [ebx*4]
add ebp, ebx
add esi, ecx
add edi, ecx
cmp ebp, dword [esp + 0x10]
jl 0x10034f10
mov ebp, dword [esp + 0x14]
pop edi
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx]
cmp ecx, 0xe
je 0x1003503f
shl ecx, 2
mov eax, dword [ebp + ecx*4]
mov dword [ebp + 0xe0], eax
mov eax, dword [ebp + ecx*4 + 4]
mov dword [ebp + 0xe4], eax
mov eax, dword [ebp + ecx*4 + 8]
mov dword [ebp + 0xe8], eax
mov eax, dword [ebp + ecx*4 + 0xc]
mov dword [ebp + 0xec], eax
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x100352d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x3c
mov eax, dword [0x1005fe78]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x44]
push ebx
push ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x5c]
push esi
mov esi, dword [esp + 0x5c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x54]
shr eax, 4
mov edx, dword [esi]
mov ebp, dword [esi + 4]
mov ebx, dword [esi + 8]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x54], eax
push edi
mov edi, dword [esi + 0xc]
mov dword [esp + 0x20], edi
test eax, eax
je 0x100353cf
mov esi, dword [esp + 0x58]
lea eax, [ecx + 8]
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x14], eax
add ecx, 8
mov edi, edi
mov eax, dword [ecx - 8]
mov ebp, dword [ecx - 4]
mov ebx, dword [ecx]
mov edi, dword [ecx + 4]
add ecx, 0x10
push dword [esp + 0x24]
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x44], ebp
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], edi
mov dword [esp + 0x30], ecx
call dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
add esp, 8
mov eax, dword [esp + 0x38]
xor eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x34]
mov dword [ecx - 8], eax
mov eax, dword [esp + 0x3c]
xor eax, dword [esp + 0x10]
mov dword [ecx - 4], eax
mov eax, dword [esp + 0x40]
xor eax, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, dword [esp + 0x44]
xor eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
add ecx, 0x10
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], edi
dec esi
jne 0x10035340
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x48]
xor eax, eax
mov dword [esi + 0xc], edi
pop edi
mov dword [esi + 4], ebp
mov dword [esi + 8], ebx
mov dword [esi], edx
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10003e90
add esp, 0x3c
ret
Function at 0x100353f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
mov eax, dword [0x1005fe78]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
push esi
mov esi, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x4c]
shr ebp, 4
mov ebx, dword [esi + 0xc]
mov ecx, dword [esi]
mov edx, dword [esi + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebx
push edi
mov edi, dword [esp + 0x40]
test ebp, ebp
je 0x100354b3
mov ebx, dword [esp + 0x3c]
add edi, 4
add ebx, 4
mov esi, eax
mov eax, dword [ebx - 4]
lea ebx, [ebx + 0x10]
push dword [esp + 0x18]
xor eax, ecx
mov dword [esp + 0x28], eax
mov eax, dword [ebx - 0xc]
xor eax, edx
mov dword [esp + 0x30], eax
mov eax, dword [ebx - 0x10]
xor eax, esi
mov dword [esp + 0x2c], eax
mov eax, dword [ebx - 8]
xor eax, dword [esp + 0x18]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x28]
push eax
call dword [esp + 0x28]
mov eax, dword [esp + 0x38]
lea edi, [edi + 0x10]
mov ecx, dword [esp + 0x2c]
add esp, 8
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov dword [edi - 0x14], ecx
mov dword [edi - 0xc], edx
mov dword [edi - 0x10], esi
mov dword [edi - 8], eax
mov dword [esp + 0x14], eax
dec ebp
jne 0x10035444
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
pop edi
mov dword [esi], ecx
mov ecx, dword [esp + 0x30]
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 0xc], ebx
mov dword [esi + 8], edx
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1004475d
add esp, 0x28
ret
Function at 0x10037350
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, esp
and esp, 0xfffffff0
sub esp, 0x20
mov dword [esp + 0x10], edx
mov dword [esp], 0xc0d0e0f
mov dword [esp + 4], 0x8090a0b
mov dword [esp + 8], 0x4050607
mov dword [esp + 0xc], 0x10203
movdqu xmm0, xmmword [esi]
movdqu xmm1, xmmword [ecx]
pshufb xmm0, xmmword [esp]
movdqu xmm4, xmmword [edi]
pshufb xmm4, xmmword [esp]
pxor xmm0, xmm4
add edi, 0x10
pshufd xmm7, xmm0, 0x4e
pxor xmm7, xmm0
movdqa xmm2, xmm0
pshufd xmm6, xmm1, 0x4e
pxor xmm6, xmm1
movdqa xmm3, xmm0
pclmulqdq xmm2, xmm1, 0
pclmulqdq xmm3, xmm1, 0x11
pclmulqdq xmm7, xmm6, 0
pxor xmm7, xmm2
pxor xmm7, xmm3
movdqa xmm6, xmm7
psrldq xmm7, 8
pxor xmm3, xmm7
pslldq xmm6, 8
pxor xmm2, xmm6
movdqa xmm6, xmm2
psrld xmm6, 0x1f
movdqa xmm7, xmm3
psrld xmm7, 0x1f
pslld xmm2, 1
pslld xmm3, 1
movdqa xmm5, xmm6
psrldq xmm5, 0xc
pslldq xmm6, 4
pslldq xmm7, 4
por xmm2, xmm6
por xmm3, xmm7
por xmm3, xmm5
movdqa xmm5, xmm2
pslld xmm5, 0x1f
movdqa xmm7, xmm2
pslld xmm7, 0x1e
pxor xmm5, xmm7
movdqa xmm7, xmm2
pslld xmm7, 0x19
pxor xmm5, xmm7
movdqa xmm7, xmm5
psrldq xmm7, 4
pslldq xmm5, 0xc
pxor xmm2, xmm5
pxor xmm3, xmm2
movdqa xmm0, xmm2
psrld xmm0, 1
pxor xmm0, xmm3
movdqa xmm5, xmm2
psrld xmm5, 2
pxor xmm0, xmm5
psrld xmm2, 7
pxor xmm0, xmm2
pxor xmm0, xmm7
sub eax, 0x10
jg 0x1003739b
pshufb xmm0, xmmword [esp]
movdqu xmmword [esi], xmm0
mov esp, dword [esp + 0x10]
mov esi, dword [esp]
mov edi, dword [esp + 4]
add esp, 8
ret
Function at 0x100fad49
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x100fad77
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x100fad7e
cmp ebx, dword [eax + 4]
jae 0x100fad7e
xor eax, eax
jmp 0x100faf6e
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x100fad8f
xor eax, eax
inc eax
jmp 0x100faf6d
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x100fada5
cmp ecx, edx
jae 0x100faeea
cmp dword [eax + 4], 0
je 0x100fadae
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x100fad96
cmp dword [ebp + 8], 0
je 0x100fadd0
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x100faeea
cmp eax, esi
jae 0x100faeea
mov eax, dword [0x1011d648]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x100fadf5
cmp dword [esi*4 + 0x1011d650], edi
je 0x100faeee
inc esi
cmp esi, eax
jl 0x100fade3
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call 0x101242bd
test eax, eax
je 0x100faf6a
cmp dword [ebp - 8], 0x1000000
jne 0x100faf6a
test byte [ebp - 0xc], 0xcc
je 0x100fae73
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x100faf6a
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x100faf6a
cmp word [eax + 0x18], 0x10b
jne 0x100faf6a
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x100faf6a
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x100fae73
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x100fae73
test byte [ecx + 0x27], 0x80
jne 0x100faeea
push 1
push 0x1011d690
inc edx
call 0x101242ac
test eax, eax
jne 0x100fad87
mov ecx, dword [0x1011d648]
test ecx, ecx
mov edx, ecx
jle 0x100faea7
lea eax, [ecx*4 + 0x1011d64c]
cmp dword [eax], edi
je 0x100faea7
dec edx
sub eax, 4
test edx, edx
jg 0x100fae9b
test edx, edx
jne 0x100faed8
push 0xf
pop ebx
cmp ecx, ebx
jg 0x100faeb4
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x100faecc
lea eax, [edx*4 + 0x1011d650]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x100faeba
cmp ecx, 0x10
jge 0x100faed8
inc ecx
mov dword [0x1011d648], ecx
push 0
push 0x1011d690
clc
call 0x101242ac
jmp 0x100fad87
xor eax, eax
jmp 0x100faf6d
test esi, esi
jle 0x100fad87
push 0x101236ac
pop ebx
push 1
push 0x1011d690
call ebx
test eax, eax
jne 0x100fad87
cmp dword [esi*4 + 0x1011d650], edi
je 0x100faf44
mov eax, dword [0x1011d648]
lea esi, [eax - 1]
test esi, esi
jl 0x100faf32
cmp dword [esi*4 + 0x1011d650], edi
je 0x100faf2e
dec esi
jns 0x100faf22
test esi, esi
jge 0x100faf42
cmp eax, 0x10
jge 0x100faf3d
inc eax
mov dword [0x1011d648], eax
lea esi, [eax - 1]
jmp 0x100faf44
je 0x100faf5c
xor ecx, ecx
test esi, esi
jl 0x100faf5c
lea eax, [ecx*4 + 0x1011d650]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x100faf4a
push 0
push 0x1011d690
call ebx
jmp 0x100fad87
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5e34ef
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x69badc7
aas
add bl, cl
jp 0x5e3514
mov edi, 0xf9940e1f
sbb al, 0x82
lds ecx, [edi]
and al, byte [edx]
or dword [edi + edx*4 + 0x3f0d4242], ecx
xor dword [edx - 7], 0xffffffa3
iretd
btr dword [ebp - 0x68d9b68], edx
mov bl, 0x95
cwde
jb 0x5e3513
sbb al, 1
insb byte es:[edi], dx
mov dword [ebp - 0x5236b961], ebp
lahf
lcall 0x9905, 0xd1f8f8a1
inc edx
invalid

Function at 0x5e443c
Capabilities:
Encode data using xor

Disassembly:
sar bh, 0x8a
xchg edi, eax
imul esi, dword [edx - 7], 0x1c
add edx, dword [ebp - 0x73]
or al, 0xbb
invalid
mov ebx, 0xf1deb8d
inc edi
stc
sbb al, 0x82
fld st(3)
sbb cl, 0xc3
mov al, 0x83
jb 0x5e43d7
stc
sbb al, 0x1b
lcall 0xb0c3, 0xd9821cf9
xor byte [edx - 7], 0x1c
mov dword [0x3bb0cdc5], eax
or dword [ebp - 0x523840e4], 0x993f069b
mov eax, dword [0xe5f29a9f]
invalid
lcall 0x4aec, 0x898fe5f2
jb 0x5e43c3
xchg esi, eax
sbb al, 0x82
jb 0x5e43fc
in eax, 0x53
fsubp st(3)
dec edx
jb 0x5e43cf
mov bl, byte [edx + eax*4]
jb 0x5e4408
in eax, 0x76
mov ecx, 0x1b724aeb
mov ebx, dword [edx + eax*4]
jb 0x5e4470
fdiv st(6)
aas
stc
sbb al, 0x82
daa
nop
sbb al, 0x82
jb 0x5e447c
xor byte [edx + 0x4e], 0xd8
div byte [edx - 7]
fdiv st(6)
jb 0x5e442b
sbb al, 0x82
lahf
add bl, cl
test byte [edi + 0x4b8222bb], 0x18
dec ebx
sbb byte [ecx - 0x63], bh
dec ebx
sbb byte [ecx - 0x63], bh
jb 0x5e4448
sub dword [edx - 0x2f], esi
xor esp, dword [eax]
pushfd
jb 0x5e4450
sub dword [edx - 6], edi
enter 0xffffffffffff821c, 0x72
pop eax
jb 0x5e44aa
pop ebx
invalid
invalid