joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10165a70
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x1026e004]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
mov ebx, dword [esp + 0x90]
push ebp
push esi
push edi
mov eax, dword [ebx + 0xc]
mov edi, dword [eax + 0x318]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
lea eax, [esp + 0x18]
push eax
mov eax, dword [edi + 0x13c]
push 0
add eax, 4
push eax
push dword [edi + 0x148]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [edi + 0x130], 0
mov dword [edi + 0x134], eax
jne 0x10165af6
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea eax, [edi + 0xb0]
push eax
call fcn.100e1b00
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [edi + 0x130], eax
mov edx, dword [edi + 0x134]
cmp edx, 4
jge 0x10165b31
push str.Received_too_short_packet
push ebx
call fcn.1014d3d0
add esp, 8
mov dword [edi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100e04a9
add esp, 0x88
ret
mov eax, dword [edi + 0x148]
movzx ecx, byte [eax + 1]
movzx eax, byte [eax]
shl eax, 8
or ecx, eax
mov dword [edi + 0xc], ecx
add ecx, 0xfffffffd
cmp ecx, 3
ja case.default.0x10165b52
jmp dword [ecx*4 + 0x10165c70]
cmp edx, 4
jle case.0x10165b52.4
mov esi, dword [edi + 0x148]
movzx ecx, byte [esi + 2]
movzx eax, byte [esi + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x144]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x10165b52.4
lea eax, [edx - 4]
push eax
lea eax, [esi + 4]
push eax
push 1
push ebx
call fcn.1014d330
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10165bb3
push 5
push edi
call fcn.10166570
add esp, 8
mov eax, esi
jmp 0x10165b18
mov eax, dword [edi + 0x134]
sub eax, 4
cdq
add dword [ebx + 0x90], eax
adc dword [ebx + 0x94], edx
push dword [ebx + 0x94]
push dword [ebx + 0x90]
push ebx
call fcn.1014c1d0
jmp 0x10165c45
mov eax, dword [edi + 0x148]
lea esi, [edx - 4]
push esi
movzx ecx, byte [eax + 2]
lea ebp, [eax + 4]
movzx eax, byte [eax + 3]
shl ecx, 8
or ecx, eax
push ebp
mov dword [edi + 8], ecx
call fcn.101665e0
add esp, 8
cmp eax, esi
jae case.0x10165b52.4
push ebp
push str.TFTP_error:__s
push ebx
call fcn.1014d4a0
jmp 0x10165c45
lea eax, [edx - 2]
push eax
mov eax, dword [edi + 0x148]
add eax, 2
push eax
push edi
call fcn.10165800
add esp, 0xc
test eax, eax
je case.0x10165b52.4
jmp 0x10165b18
push str.Internal_error:_Unexpected_packet
push 0x10206738
push ebx
call fcn.1014d3d0
add esp, 0xc
push ebx
call fcn.1014c5d0
add esp, 4
test eax, eax
je 0x10165b16
push 5
push edi
call fcn.10166570
add esp, 8
mov eax, 0x2a
jmp 0x10165b18
Function at 0x10167940
Capabilities:
Query environment variable

Disassembly:
push ebx
push ebp
xor ebp, ebp
push esi
push edi
lea esi, [ebp + 1]
push esi
push ebp
call dword [0x1026e9f0]
mov edi, eax
add esp, 8
test edi, edi
je 0x10167997
nop word [eax + eax]
push esi
push edi
push dword [esp + 0x1c]
mov ebp, edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
je 0x101679af
cmp esi, ebx
je 0x101679af
cmp esi, 0x8000
ja 0x101679af
cmp esi, ebx
jb 0x101679a8
push esi
push edi
call dword [0x1026e9f0]
mov edi, eax
add esp, 8
test edi, edi
jne 0x10167960
push ebp
call dword [0x1026e9ec]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
push edi
call dword [0x1026e9ec]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1016f5b0
Capabilities:
Move file

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
call fcn.10142510
push dword [esp + 0x38]
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x18], xmm0
call fcn.100fded2
push dword [esp + 0x40]
mov edi, eax
call fcn.100fded2
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 0xc
mov esi, eax
push 1
push esi
push edi
call ebx
test eax, eax
jne 0x1016f645
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax + eax]
lea eax, [esp + 0x20]
push eax
call fcn.10142510
movups xmm0, xmmword [esp + 0x14]
sub esp, 0xc
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.101425c0
add esp, 0x20
test edx, edx
ja 0x1016f669
jb 0x1016f637
cmp eax, 0x3e8
ja 0x1016f669
push 1
call ebp
push 1
push esi
push edi
call ebx
test eax, eax
je 0x1016f600
test edi, edi
je 0x1016f652
push edi
call fcn.100e4a5c
add esp, 4
test esi, esi
je 0x1016f65f
push esi
call fcn.100e4a5c
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
test edi, edi
je 0x1016f676
push edi
call fcn.100e4a5c
add esp, 4
test esi, esi
je 0x1016f683
push esi
call fcn.100e4a5c
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20
ret
Function at 0x101725d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x1026e9e8]
mov edi, eax
add esp, 4
test edi, edi
jne 0x101725f7
pop edi
pop esi
pop ecx
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 8], eax
push ebp
cmp ebx, dword [esi + 0x10]
jbe 0x10172642
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [esp + 0x24]
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], ebx
jmp 0x10172646
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x28]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x101726a6
mov dword [esp + 0x10], eax
mov ebx, eax
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x24], al
lea eax, [esp + 0x24]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x10172665
mov ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0x10]
jae 0x101726d7
nop dword [eax + eax]
mov eax, dword [esi + 4]
push 1
push 0x101d630c
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x101d630d
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x101726b0
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x101726e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x20]
call fcn.1014e220
mov esi, dword [esp + 0x1c]
mov ebx, eax
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x14], ebx
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [0x1026e9e8]
mov edi, eax
add esp, 8
test edi, edi
je 0x10172848
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x1017275c
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push ebp
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov eax, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x10], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x18]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x101727c1
mov dword [esp + 0x18], eax
mov ebx, eax
nop dword [eax + eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x1c], al
lea eax, [esp + 0x1c]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x28], al
lea eax, [esp + 0x28]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x10172780
mov ebx, dword [esp + 0x18]
cmp ebx, dword [esi + 0x10]
jae 0x101727ed
mov eax, dword [esi + 4]
push 1
push 0x101d630c
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x101d630d
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x101727c6
push dword [esp + 0x28]
call fcn.1014e220
mov ecx, dword [edi]
push eax
push dword [esp + 0x2c]
push dword [edi + 4]
mov eax, dword [ecx + 4]
call eax
mov esi, dword [esp + 0x3c]
add esp, 0x10
mov ebx, dword [edi]
test esi, esi
jne 0x10172818
mov esi, dword [ebx + 0xc]
add esi, dword [edi + 8]
push dword [edi + 4]
mov eax, dword [ebx + 8]
push esi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push esi
push dword [edi + 8]
call eax
push dword [edi + 8]
mov eax, dword [ebx + 8]
push esi
call eax
push edi
call dword [0x1026e9ec]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 0x1b
pop ebx
pop ecx
ret
Function at 0x1017b010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.1010c570
lea eax, [ebp - 0x1c]
push eax
call fcn.1010c570
mov edi, dword [ebp + 8]
add edi, 0x4c
push 0
push edi
call fcn.1010c4d0
add esp, 0x10
cmp eax, 1
je 0x1017b049
mov eax, 0xffffb080
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
mov esi, dword [ebp + 0xc]
push 0
push esi
call fcn.1010c4d0
mov ecx, dword [ebp + 0x1c]
test eax, eax
push esi
sete al
mov byte [ecx], al
lea eax, [ebp - 0x10]
push eax
call fcn.1010ac20
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x1017b163
push esi
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.1010deb0
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x1017b163
mov eax, dword [ebp + 0x1c]
movzx eax, byte [eax]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.1010d6e0
mov ebx, eax
add esp, 0xc
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x1017b163
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push ebx
push esi
call fcn.100e19a0
add esp, 0xc
test edi, edi
je 0x1017b10d
movzx eax, byte [ebp + 0x18]
mov dword [ebp + 8], eax
xor esi, esi
test eax, eax
je 0x1017b105
mov edi, ebx
nop word [eax + eax]
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.1010c4d0
add edi, dword [ebp + 0x14]
mov ecx, esi
shl al, cl
inc esi
mov ecx, dword [ebp + 0x10]
add esp, 8
or byte [ecx + ebx], al
mov eax, dword [ebp + 8]
cmp esi, eax
jb 0x1017b0e0
mov edi, dword [ebp + 0x14]
inc ebx
cmp ebx, edi
jb 0x1017b0d2
mov esi, dword [ebp + 0x10]
xor al, al
mov byte [ebp + 0xb], al
cmp edi, 1
jb 0x1017b160
mov bh, byte [esi]
nop dword [eax]
mov dl, byte [esi + 1]
inc esi
mov dh, bh
mov bl, 1
mov bh, dl
movzx ecx, dh
and dl, byte [ebp + 0xb]
xor bh, al
mov al, bh
and al, 1
sub bl, al
movzx eax, bl
imul ecx, eax
mov al, bh
shl bl, 7
or bl, dh
and al, cl
xor bh, cl
or al, dl
mov byte [esi], bh
mov byte [ebp + 0xb], al
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x10], esi
mov byte [eax], bl
mov al, byte [ebp + 0xb]
sub edi, 1
jne 0x1017b120
mov ebx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
push eax
call fcn.1010bdf0
lea eax, [ebp - 0x10]
push eax
call fcn.1010bdf0
add esp, 8
mov eax, ebx
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10181740
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0x10209b9c
push dword [ebp + 8]
call fcn.100e999d
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x10181762
mov eax, 0xffffc200
pop ebx
pop ebp
ret
push edi
push 2
push 0
push ebx
call fcn.100eb59a
push ebx
call fcn.100eb2ba
mov edi, eax
add esp, 0x10
cmp edi, 0xffffffff
jne 0x1018178f
push ebx
call fcn.100e9749
add esp, 4
mov eax, 0xffffc200
pop edi
pop ebx
pop ebp
ret
push esi
push 0
push 0
push ebx
call fcn.100eb59a
mov esi, dword [ebp + 0x10]
add esp, 0xc
mov dword [esi], edi
add edi, 1
je 0x10181824
push edi
push 1
call fcn.100e934a
mov ecx, dword [ebp + 0xc]
add esp, 8
mov dword [ecx], eax
test eax, eax
je 0x10181824
push ebx
push dword [esi]
push 1
push eax
call fcn.100eb781
mov esi, dword [esi]
mov edi, eax
push ebx
call fcn.100e9749
add esp, 0x14
cmp edi, esi
je 0x101817fa
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push dword [eax]
push dword [ebx]
call fcn.101115e0
push dword [ebx]
call fcn.100e4a5c
add esp, 0xc
mov eax, 0xffffc200
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
push str._____BEGIN
mov ecx, dword [edx]
mov eax, dword [ebx]
mov byte [ecx + eax], 0
push dword [edx]
call fcn.100e23c0
add esp, 8
test eax, eax
je 0x1018181d
inc dword [ebx]
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
push ebx
call fcn.100e9749
add esp, 4
mov eax, 0xffffc080
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10189eb0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [esi], 0x61707865
mov dword [esi + 4], 0x3320646e
mov dword [esi + 8], 0x79622d32
mov dword [esi + 0xc], 0x6b206574
movzx ecx, byte [edx + 3]
shl ecx, 8
movzx eax, byte [edx + 2]
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x10], ecx
movzx ecx, byte [edx + 7]
shl ecx, 8
movzx eax, byte [edx + 6]
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x14], ecx
movzx ecx, byte [edx + 0xb]
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x18], ecx
movzx ecx, byte [edx + 0xf]
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x1c], ecx
movzx ecx, byte [edx + 0x13]
movzx eax, byte [edx + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x20], ecx
movzx ecx, byte [edx + 0x17]
movzx eax, byte [edx + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x24], ecx
movzx ecx, byte [edx + 0x1b]
movzx eax, byte [edx + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x19]
shl ecx, 8
or ecx, eax
shl ecx, 8
movzx eax, byte [edx + 0x18]
or ecx, eax
mov dword [esi + 0x28], ecx
movzx ecx, byte [edx + 0x1f]
movzx eax, byte [edx + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1c]
shl ecx, 8
or ecx, eax
xor eax, eax
mov dword [esi + 0x2c], ecx
pop esi
pop ebp
ret
Function at 0x1018a090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 4], ecx
push esi
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x1018a0ea
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
sub eax, edx
mov esi, dword [edi + 0x80]
mov dword [ebp + 0xc], eax
nop dword [eax]
cmp esi, 0x40
jae 0x1018a0e4
mov al, byte [eax + edx]
inc ecx
xor al, byte [esi + edi + 0x40]
mov byte [edx], al
inc edx
inc dword [edi + 0x80]
mov esi, dword [edi + 0x80]
mov eax, dword [ebp + 0xc]
sub ebx, 1
jne 0x1018a0c0
mov dword [ebp - 4], ecx
mov dword [ebp + 0xc], ebx
cmp ebx, 0x40
jb 0x1018a1a9
lea eax, [edi + 0x41]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov edx, eax
sub edx, dword [ebp + 0x14]
mov dword [ebp - 0x10], edx
lea esi, [eax + 2]
mov eax, ebx
add esi, ecx
shr eax, 6
mov dword [ebp - 8], eax
lea eax, [edi + 0x40]
push eax
push edi
call fcn.10189b70
inc dword [edi + 0x30]
add esp, 8
mov eax, dword [ebp - 4]
mov edi, 8
mov edx, dword [ebp - 0xc]
add eax, dword [ebp + 0x14]
mov ebx, dword [ebp - 0x10]
movzx ecx, byte [eax + ebx]
lea eax, [eax + 8]
xor cl, byte [edx - 1]
lea edx, [edx + 8]
mov byte [eax - 8], cl
movzx ecx, byte [esi - 1]
xor cl, byte [edx - 8]
mov byte [eax - 7], cl
movzx ecx, byte [edx - 7]
xor cl, byte [esi]
mov byte [eax - 6], cl
movzx ecx, byte [edx - 6]
xor cl, byte [esi + 1]
mov byte [eax - 5], cl
movzx ecx, byte [edx - 5]
xor cl, byte [esi + 2]
mov byte [eax - 4], cl
movzx ecx, byte [edx - 4]
xor cl, byte [esi + 3]
mov byte [eax - 3], cl
movzx ecx, byte [edx - 3]
xor cl, byte [esi + 4]
mov byte [eax - 2], cl
movzx ecx, byte [edx - 2]
xor cl, byte [esi + 5]
add esi, 8
mov byte [eax - 1], cl
sub edi, 1
jne 0x1018a132
mov ebx, dword [ebp + 0xc]
add dword [ebp - 4], 0x40
sub ebx, 0x40
sub dword [ebp - 8], 1
mov edi, dword [ebp + 8]
mov dword [ebp + 0xc], ebx
jne 0x1018a111
test ebx, ebx
je 0x1018a1ec
lea esi, [edi + 0x40]
push esi
push edi
call fcn.10189b70
inc dword [edi + 0x30]
add esp, 8
mov ecx, dword [ebp + 0x14]
xor edx, edx
mov edi, dword [ebp - 4]
sub dword [ebp + 0x10], ecx
add edi, ecx
nop word [eax + eax]
mov eax, dword [ebp + 0x10]
lea ecx, [edi + edx]
mov al, byte [eax + ecx]
xor al, byte [esi + edx]
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x1018a1d0
mov edi, dword [ebp + 8]
mov dword [edi + 0x80], ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1018a450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
lea ebx, [ebp - 0x14]
push edi
mov edi, dword [ebp + 0x24]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
push eax
push dword [ebp + 0x18]
push ecx
push edx
push ebx
push 1
push esi
call fcn.1018a200
add esp, 0x24
test eax, eax
jne 0x1018a549
mov eax, dword [ebp + 0x1c]
lea esi, [ebp - 0x14]
mov edx, eax
xor ecx, ecx
sub edx, esi
xorps xmm4, xmm4
xorps xmm3, xmm3
lea esi, [eax + 4]
nop dword [eax]
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
add eax, ecx
movd xmm2, dword [edx + eax]
movd xmm1, dword [eax]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [eax + 4]
por xmm4, xmm2
punpcklbw xmm1, xmm0
movd xmm2, dword [esi + ecx]
add ecx, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp ecx, 0x10
jb 0x1018a4b0
por xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd eax, xmm3
test eax, eax
je 0x1018a547
push ebx
push edi
call fcn.101115e0
add esp, 8
mov eax, 0xffffffaa
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e04a9
mov esp, ebp
pop ebp
ret

Function at 0x1018a7d0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10189eb0
Function at 0x1018a8a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x30], ebx
push eax
push 0x10
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
push ebx
movups xmmword [ebp - 0x14], xmm0
call fcn.10180070
add esp, 0x14
test eax, eax
jne 0x1018aa8b
movzx eax, byte [ebp - 0x13]
xor edx, edx
movzx ecx, byte [ebp - 0x10]
push esi
movzx esi, byte [ebp - 0x14]
shl esi, 8
or esi, eax
shl ecx, 8
movzx eax, byte [ebp - 0x12]
shl esi, 8
or esi, eax
mov dword [ebx + 0xc0], 0
movzx eax, byte [ebp - 0x11]
shl esi, 8
or esi, eax
mov dword [ebx + 0xc4], 0
movzx eax, byte [ebp - 0xf]
or ecx, eax
mov dword [ebx + 0x104], esi
movzx eax, byte [ebp - 0xe]
shl ecx, 8
or ecx, eax
mov dword [ebx + 0x40], 0
movzx eax, byte [ebp - 0xd]
shl ecx, 8
or ecx, eax
mov dword [ebx + 0x44], 0
movzx eax, byte [ebp - 0xb]
or edx, ecx
movzx ecx, byte [ebp - 8]
push edi
movzx edi, byte [ebp - 0xc]
shl edi, 8
or edi, eax
shl ecx, 8
movzx eax, byte [ebp - 0xa]
shl edi, 8
or edi, eax
mov dword [ebp - 0x1c], edx
movzx eax, byte [ebp - 9]
xor edx, edx
shl edi, 8
or edi, eax
mov dword [ebp - 0x20], 4
movzx eax, byte [ebp - 7]
or ecx, eax
mov dword [ebx + 0x84], edi
movzx eax, byte [ebp - 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 5]
shl ecx, 8
or ecx, eax
or edx, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edx
mov dword [ebx + 0x80], edx
mov dword [ebx + 0x100], ecx
shrd dword [ebp - 0x18], edi, 1
shl ecx, 0x1f
and edx, 1
shr edi, 1
xor eax, eax
or dword [ebp - 0x18], eax
or edi, ecx
mov ecx, dword [ebp - 0x1c]
shrd ecx, esi, 1
imul edx, edx, 0xe1000000
xor ecx, eax
shr esi, 1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
xor esi, edx
mov edx, dword [ebp - 0x18]
mov dword [ebx + eax*8 + 0x40], edx
mov dword [ebx + eax*8 + 0x44], edi
mov dword [ebx + eax*8 + 0xc0], ecx
mov dword [ebx + eax*8 + 0xc4], esi
sar eax, 1
mov dword [ebp - 0x20], eax
test eax, eax
jg 0x1018a9b1
mov ecx, 2
mov dword [ebp - 0x20], ecx
nop dword [eax + eax]
lea edi, [ecx + 0x18]
mov eax, dword [ebx + edi*8]
lea edi, [ebx + edi*8]
mov dword [ebp - 0x1c], eax
lea edx, [ecx + 8]
mov eax, dword [edi + 4]
lea edx, [ebx + edx*8]
mov dword [ebp - 0x18], eax
mov eax, dword [edx]
mov dword [ebp - 0x28], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x2c], eax
cmp ecx, 1
jle 0x1018aa7d
lea eax, [ebx + 0x48]
sub edi, edx
lea esi, [edx + 8]
lea ebx, [ecx - 1]
mov edx, dword [eax + 0x80]
lea eax, [eax + 8]
mov ecx, dword [eax + 0x7c]
lea esi, [esi + 8]
xor edx, dword [ebp - 0x1c]
xor ecx, dword [ebp - 0x18]
mov dword [edi + esi - 8], edx
mov dword [edi + esi - 4], ecx
mov edx, dword [eax - 8]
mov ecx, dword [eax - 4]
xor edx, dword [ebp - 0x28]
xor ecx, dword [ebp - 0x2c]
mov dword [esi - 8], edx
mov dword [esi - 4], ecx
sub ebx, 1
jne 0x1018aa43
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x30]
add ecx, ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 8
jle 0x1018aa10
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
Function at 0x1018ac70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1026e004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x2c]
push ebx
mov ebx, dword [ebp + 0x20]
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 0x28]
push eax
push dword [ebp + 0x14]
mov dword [ebp - 0x18], edx
push ecx
push 0
push esi
call fcn.1018b080
add esp, 0x18
test eax, eax
jne 0x1018adbf
push dword [ebp - 0x18]
push edi
push dword [ebp + 0xc]
push esi
call fcn.1018b260
add esp, 0x10
test eax, eax
jne 0x1018adbf
mov edi, dword [ebp + 0x24]
lea eax, [ebp - 0x14]
push edi
push eax
push esi
call fcn.1018ae20
add esp, 0xc
test eax, eax
jne 0x1018adbf
xor esi, esi
test edi, edi
je 0x1018adbd
cmp edi, 8
jb 0x1018ad71
mov ecx, edi
xorps xmm4, xmm4
and ecx, 0xfffffff8
xorps xmm3, xmm3
nop
movd xmm2, dword [ebx + eax]
xorps xmm0, xmm0
movd xmm1, dword [ebp + eax - 0x14]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [ebp + eax - 0x10]
por xmm4, xmm2
punpcklbw xmm1, xmm0
movd xmm2, dword [ebx + eax + 4]
add eax, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp eax, ecx
jb 0x1018ad00
por xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd esi, xmm3
cmp eax, edi
jae 0x1018ad95
lea ecx, [ebp - 0x14]
sub ebx, ecx
nop word [eax + eax]
lea ecx, [ebp - 0x14]
add ecx, eax
inc eax
movzx edx, byte [ebx + ecx]
movzx ecx, byte [ecx]
xor edx, ecx
or esi, edx
cmp eax, edi
jb 0x1018ad80
test esi, esi
je 0x1018adbd
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call fcn.101115e0
add esp, 8
mov eax, 0xffffffee
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e04a9
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e04a9
mov esp, ebp
pop ebp
ret