joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2f31d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movdqu xmm4, xmmword [ecx]
movdqu xmm3, xmmword [ecx + 0x10]
movdqu xmm2, xmmword [ecx + 0x20]
movdqu xmm1, xmmword [ecx + 0x30]
movd xmm0, dword [ebp + 0x10]
pxor xmm0, xmm4
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x40
jb 0x2f3292
movdqa xmm4, xmmword [0x10311140]
movdqa xmm5, xmmword [0x10311150]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
movdqa xmm6, xmm3
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm6
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
movdqu xmm6, xmmword [ecx]
pxor xmm0, xmm6
movdqu xmm6, xmmword [ecx + 0x10]
pxor xmm3, xmm6
movdqu xmm6, xmmword [ecx + 0x20]
pxor xmm2, xmm6
movdqu xmm6, xmmword [ecx + 0x30]
pxor xmm1, xmm6
add eax, 0xffffffc0
add ecx, 0x40
cmp eax, 0x3f
ja 0x2f3214
movdqa xmm4, xmmword [0x10311160]
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm3
movdqa xmm3, xmmword [0x10311170]
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm5, xmm0
pclmulqdq xmm5, xmm4, 0
pxor xmm5, xmm2
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm5
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
cmp eax, 0x10
jb 0x2f3316
movdqu xmm1, xmmword [ecx]
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm3, 0x11
pxor xmm0, xmm2
add ecx, 0x10
add eax, 0xfffffff0
cmp eax, 0xf
ja 0x2f32ef
movdqa xmm1, xmmword [0x10311170]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm2, xmm2
pxor xmm1, xmm1
pblendw xmm1, xmm0, 3
psrldq xmm0, 4
pclmulqdq xmm1, xmmword [0x10311180], 0
pxor xmm1, xmm0
pxor xmm0, xmm0
pblendw xmm0, xmm1, 3
pclmulqdq xmm0, xmmword [0x10311190], 0x10
pblendw xmm0, xmm2, 0xfc
pclmulqdq xmm0, xmmword [0x103111a0], 0
pxor xmm0, xmm1
pextrd eax, xmm0, 1
pop ebp
ret
Function at 0x31ed90
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov eax, dword [0x10376020]
xor eax, ebp
mov dword [esp + 0x40], eax
movsd xmm0, qword [0x1038b9c8]
xorpd xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x31edbb
jnp 0x31ede0
movsd qword [esp + 0x18], xmm0
fld qword [esp + 0x18]
fstp xword [esp + 0xc]
mov ecx, dword [esp + 0x40]
xor ecx, ebp
call fcn.002a5ceb
fld xword [esp + 0xc]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [0x1036f598]
call esi
push eax
call dword [0x1036f664]
mov dword [esp + 0xc], eax
call esi
push 2
push eax
call dword [0x1036f7e0]
mov eax, dword [0x1038b9d8]
mov ecx, dword [0x1037aac8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x31ef15
mov eax, dword [0x1038b9e8]
mov ecx, dword [0x1037aac8]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x31ef4e
rdtsc
mov dword [esp + 8], eax
mov dword [esp + 4], edx
xor eax, eax
lea edi, [esp + 0x38]
mov dword [edi + 4], eax
mov dword [edi], eax
push edi
call dword [0x1036f758]
mov esi, dword [edi]
mov ebx, dword [edi + 4]
call dword [0x1036f598]
push dword [esp + 0xc]
push eax
call dword [0x1036f7e0]
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi], eax
push edi
call dword [0x1036f75c]
sub esi, dword [0x1038b9e0]
sbb ebx, dword [0x1038b9e4]
movd xmm0, ebx
movd xmm1, esi
punpckldq xmm1, xmm0
movq qword [esp + 0x28], xmm1
fild qword [esp + 0x28]
fstp qword [esp + 0x20]
movsd xmm1, qword [esp + 0x20]
fild qword [esp + 0x38]
fstp qword [esp + 0x30]
divsd xmm1, qword [esp + 0x30]
pxor xmm0, xmm0
movsd xmm2, qword [0x10321d48]
ucomisd xmm2, xmm1
ja 0x31edbb
mov eax, dword [esp + 8]
sub eax, dword [0x1038b9d0]
mov ecx, dword [esp + 4]
sbb ecx, dword [0x1038b9d4]
movd xmm2, ecx
movd xmm0, eax
punpckldq xmm0, xmm2
punpckldq xmm0, xmmword [0x1030f700]
subpd xmm0, xmmword [0x1030f710]
haddpd xmm0, xmm0
divsd xmm0, xmm1
movsd qword [0x1038b9c8], xmm0
jmp 0x31edbb
push 0x1038b9d8
call fcn.002a54b7
add esp, 4
cmp dword [0x1038b9d8], 0xffffffff
jne 0x31ee1f
rdtsc
mov dword [0x1038b9d0], eax
mov dword [0x1038b9d4], edx
push 0x1038b9d8
call fcn.002a552d
add esp, 4
jmp 0x31ee1f
push 0x1038b9e8
call fcn.002a54b7
add esp, 4
cmp dword [0x1038b9e8], 0xffffffff
jne 0x31ee40
xor eax, eax
lea esi, [esp + 0x38]
mov dword [esi + 4], eax
mov dword [esi], eax
push esi
call dword [0x1036f758]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
mov dword [0x1038b9e4], ecx
mov dword [0x1038b9e0], eax
push 0x1038b9e8
call fcn.002a552d
add esp, 4
jmp 0x31ee40
Function at 0x336690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.003366a0

Function at 0x336770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00336780

Function at 0x34bd30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [0x10376020]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, byte [0x1038bc2c]
cmp eax, 3
je 0x34be43
mov esi, edx
mov ebx, ecx
xor edi, edi
xor ecx, ecx
dec ecx
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x3c], edi
lea eax, [edi*8 + 0x103232b8]
mov ecx, edx
push eax
mov edi, edx
call fcn.002f7c80
movzx eax, byte [ebp - 0x11]
test al, al
js 0x34bd8f
and eax, 0x7f
jmp 0x34bd95
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x24]
push eax
push edi
call fcn.002d86d0
movzx eax, byte [ebp - 0x11]
test al, al
mov edi, dword [ebp - 0x3c]
js 0x34bdaf
and eax, 0x7f
jmp 0x34bdb2
mov eax, dword [ebp - 0x18]
cmp esi, eax
cmovb eax, esi
lea ecx, [ebp - 0x2c]
push eax
push ebx
call fcn.002d86d0
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x20]
jne 0x34bdf1
test eax, eax
je 0x34bde4
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov ebx, dword [ebp - 0x24]
movzx esi, word [ecx + edx*2]
cmp si, word [ebx + edx*2]
jne 0x34bdf1
inc edx
cmp eax, edx
jne 0x34bdd5
movzx eax, byte [ebp - 0x11]
test al, al
js 0x34bdfb
and eax, 0x7f
jmp 0x34bdfe
xor ebx, ebx
xor ecx, ecx
dec ecx
lea edx, [ebp - 0x1c]
jmp 0x34be09
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
xor ecx, ecx
dec ecx
lea edx, [ebp - 0x1c]
mov bl, 1
cmp byte [ebp - 0x11], 0
js 0x34be47
test bl, bl
je 0x34be2a
mov esi, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.002a5ceb
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
inc edi
movzx eax, byte [0x1038bc2c]
xor eax, 3
cmp edi, eax
mov esi, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x34]
jb 0x34bd65
xor esi, esi
jmp 0x34be16
push dword [ebp - 0x1c]
mov esi, edx
call fcn.002a5449
mov edx, esi
xor ecx, ecx
dec ecx
add esp, 4
jmp 0x34be0f
Function at 0x350600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp edx, eax
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebp - 0x14], edx
cmovb ebx, edx
xor eax, eax
test ebx, ebx
je 0x350665
xor esi, esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ebx
mov edx, dword [edi + esi*4]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx + esi*4]
mov ebx, ecx
xor ebx, edx
mov edi, ecx
sub edi, edx
lea edx, [ebx - 1]
xor edi, ecx
or edi, ebx
not ebx
and edx, ebx
mov ebx, dword [ebp - 0x1c]
xor edi, ecx
mov ecx, dword [ebp - 0x18]
sar edx, 0x1f
sar edi, 0x1f
or edi, 1
xor eax, edi
and eax, edx
xor eax, edi
mov edi, dword [ebp + 8]
inc esi
cmp ebx, esi
jne 0x35062a
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
cmp edx, esi
jb 0x350679
ja 0x350693
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
xor ecx, ecx
or ecx, dword [edi + edx*4]
inc edx
cmp esi, edx
jne 0x35067b
mov edx, ecx
not edx
dec ecx
and ecx, edx
sar ecx, 0x1f
not ecx
or eax, ecx
jmp 0x350671
mov edx, ecx
xor esi, esi
mov ecx, dword [ebp - 0x10]
or esi, dword [edx + ecx*4]
inc ecx
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x14], ecx
jne 0x350697
mov ecx, esi
not ecx
dec esi
and esi, ecx
sar esi, 0x1f
xor eax, 1
and eax, esi
xor eax, 1
jmp 0x350671

Function at 0x350740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edi, dword [ecx + 4]
mov esi, dword [eax + 4]
xor edx, edx
cmp edi, esi
jge 0x350766
mov eax, dword [eax]
xor edx, edx
mov ebx, edi
or edx, dword [eax + ebx*4]
inc ebx
cmp esi, ebx
jne 0x35075e
cmp esi, edi
jge 0x350776
mov eax, dword [ecx]
mov ebx, esi
or edx, dword [eax + ebx*4]
inc ebx
cmp edi, ebx
jne 0x35076e
cmp edi, esi
cmovl esi, edi
test esi, esi
jle 0x350795
mov edi, dword [ecx]
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
xor eax, eax
mov ecx, dword [ebx + eax*4]
xor ecx, dword [edi + eax*4]
or edx, ecx
inc eax
cmp esi, eax
jne 0x350788
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
xor ecx, dword [eax + 0xc]
xor eax, eax
or ecx, edx
sete al
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x3550e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
xor edx, edx
cmp dword [ecx + 4], 2
mov ecx, 0
jl 0x3550fe
mov ecx, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
xor ebx, ebx
inc ebx
mov esi, 0x40
xor eax, eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], esi
and ebx, 1
neg ebx
mov ecx, 0
sbb ecx, ecx
mov edi, dword [ebp - 0x1c]
and edi, ecx
and ebx, dword [ebp - 0x18]
mov esi, edi
xor esi, eax
and edi, eax
mov eax, ebx
xor eax, dword [ebp - 0x10]
and ebx, dword [ebp - 0x10]
shrd eax, esi, 1
shr esi, 1
add ebx, eax
adc edi, esi
mov esi, dword [ebp - 0x20]
and ecx, 0x80000000
shrd dword [ebp - 0x14], edx, 1
shr edx, 1
or edx, ecx
mov dword [ebp - 0x10], ebx
mov eax, edi
dec esi
jne 0x35511a
mov eax, dword [ebp - 0x14]
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x355c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
test ecx, ecx
jle 0x355da6
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor esi, esi
xor eax, eax
xor edi, edi
xor edx, edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax + ecx*4]
mov ecx, edx
shl ecx, 0x10
mov eax, ecx
not eax
dec ecx
and ecx, eax
sar ecx, 0x1f
mov dword [ebp - 0x24], ecx
mov eax, edx
shr eax, 0x10
xor eax, edx
and eax, ecx
xor eax, edx
mov esi, eax
shl esi, 0x18
mov ecx, esi
dec esi
not ecx
and esi, ecx
mov ecx, eax
shr ecx, 8
sar esi, 0x1f
mov dword [ebp - 0x20], esi
xor ecx, eax
and ecx, esi
xor ecx, eax
mov eax, ecx
shl eax, 0x1c
mov esi, eax
not esi
dec eax
and eax, esi
sar eax, 0x1f
mov edi, ecx
shr edi, 4
mov esi, eax
xor edi, ecx
and edi, eax
xor edi, ecx
mov ecx, edi
shl ecx, 0x1e
mov eax, ecx
dec ecx
not eax
and ecx, eax
mov eax, edi
shr eax, 2
sar ecx, 0x1f
mov ebx, ecx
xor eax, edi
and eax, ecx
lea ecx, [edx - 1]
not edx
and ecx, edx
xor eax, edi
shl eax, 0x1f
mov edx, eax
not edx
dec eax
and eax, edx
mov edx, dword [ebp - 0x24]
and edx, 0x10
shr eax, 0x1f
or eax, edx
mov edx, dword [ebp - 0x20]
and edx, 8
or eax, edx
and esi, 4
or eax, esi
mov esi, dword [ebp - 0x28]
sar ecx, 0x1f
and ebx, 2
or eax, ebx
mov edx, ecx
not edx
mov edi, dword [ebp - 0x1c]
or ecx, edi
or edx, edi
add eax, esi
not ecx
and ecx, eax
mov eax, dword [ebp - 0x2c]
or eax, ecx
mov ecx, dword [ebp - 0x18]
inc dword [ebp - 0x10]
add esi, 0x20
mov edi, edx
mov edx, dword [ebp - 0x10]
cmp ecx, edx
jne 0x355cb7
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x355d9e
Function at 0x35e040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x58
mov dword [ebp - 0x64], edx
mov edx, ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x10376020]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
lea ecx, [eax + 4]
mov ebx, ecx
shr ebx, 5
mov dword [ebp - 0x5c], edx
mov esi, dword [edx + 0xec]
mov edi, 0
cmp ebx, esi
jae 0x35e084
mov edx, dword [ebp + 0xc]
mov edi, dword [edx + ebx*4]
shr edi, cl
shl edi, 5
and edi, 0x20
lea ecx, [eax + 3]
mov edx, ecx
shr edx, 5
mov dword [ebp - 0x58], esi
cmp edx, esi
mov esi, 0
jae 0x35e0a6
mov esi, dword [ebp + 0xc]
mov esi, dword [esi + edx*4]
shr esi, cl
shl esi, 4
and esi, 0x10
or esi, edi
lea edx, [eax + 2]
mov ecx, edx
shr ecx, 5
xor edi, edi
mov ebx, 0
cmp ecx, dword [ebp - 0x58]
jae 0x35e0cc
mov ebx, dword [ebp + 0xc]
mov ebx, dword [ebx + ecx*4]
mov ecx, edx
shr ebx, cl
shl ebx, 3
and ebx, 8
or esi, ebx
mov ebx, esi
lea ecx, [eax + 1]
mov edx, ecx
shr edx, 5
mov esi, dword [ebp - 0x58]
cmp edx, esi
jae 0x35e0f0
mov esi, dword [ebp + 0xc]
mov edi, dword [esi + edx*4]
mov esi, dword [ebp - 0x58]
shr edi, cl
shl edi, 2
and edi, 4
or ebx, edi
mov ecx, eax
shr ecx, 5
xor edi, edi
cmp ecx, esi
jae 0x35e10c
mov edx, dword [ebp + 0xc]
mov edi, dword [edx + ecx*4]
mov ecx, eax
shr edi, cl
add edi, edi
and edi, 2
or ebx, edi
test eax, eax
je 0x35e12e
dec eax
mov edx, eax
shr edx, 5
xor ecx, ecx
cmp edx, esi
jae 0x35e12c
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + edx*4]
xor ecx, ecx
bt edx, eax
setb cl
or ebx, ecx
mov edi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 5
lea eax, [ecx - 1]
neg ecx
and eax, ebx
xor ebx, 0x3f
mov dword [ebp - 0x60], ecx
and ebx, ecx
or ebx, eax
mov eax, ebx
shr eax, 1
and ebx, 1
add ebx, eax
mov dword [ebp - 0x58], ebx
push 0xcc
push 0
mov esi, dword [ebp - 0x64]
push esi
call fcn.002a95c0
add esp, 0xc
xor ebx, ebx
mov eax, ebx
xor eax, dword [ebp - 0x58]
dec eax
sar eax, 0x1f
push esi
push edi
push eax
push esi
push dword [ebp - 0x5c]
call fcn.0035a980
add esp, 0x14
inc ebx
add edi, 0xcc
cmp ebx, 0x11
jne 0x35e168
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x54]
movdqu xmmword [eax + 0x30], xmm0
movdqu xmmword [eax + 0x20], xmm0
movdqu xmmword [eax + 0x10], xmm0
movdqu xmmword [eax], xmm0
mov dword [eax + 0x40], 0xffffffff
add esi, 0x44
push esi
push eax
mov edi, dword [ebp - 0x5c]
push edi
call fcn.0035d060
add esp, 0xc
mov eax, dword [edi + 0x11c]
test eax, eax
mov ebx, dword [ebp - 0x60]
je 0x35e1f2
mov ecx, ebx
not ecx
mov dword [ebp - 0x5c], ecx
xor edx, edx
mov edi, dword [ebp + edx*4 - 0x54]
and edi, ebx
mov ecx, eax
mov eax, ebx
mov ebx, dword [esi + edx*4]
and ebx, dword [ebp - 0x5c]
or ebx, edi
mov dword [esi + edx*4], ebx
mov ebx, eax
mov eax, ecx
inc edx
cmp ecx, edx
jne 0x35e1d4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.002a5ceb
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x35f920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [0x10376020]
xor ecx, ebp
mov dword [ebp - 0x10], ecx
cmp eax, 0x30
ja 0x35f9c4
mov ecx, dword [ebp + 0xc]
movups xmm0, xmmword [ecx + 0x20]
movups xmmword [ebp - 0x20], xmm0
movups xmm0, xmmword [ecx]
movups xmm1, xmmword [ecx + 0x10]
movups xmmword [ebp - 0x30], xmm1
movups xmmword [ebp - 0x40], xmm0
test eax, eax
jne 0x35f9c8
mov esi, dword [ebp + 8]
xor eax, eax
mov cl, byte [eax + 0x10323c37]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp eax, 0x30
jne 0x35f963
lea eax, [esi + 0xf4]
lea edi, [ebp - 0x40]
xor ebx, ebx
push 0x20
push edi
push eax
push ebx
push esi
call fcn.00357930
add esp, 0x14
mov dword [esi + 0xf8], eax
movups xmm0, xmmword [edi + 0x20]
movups xmmword [esi + 0xfc], xmm0
mov dword [esi + 0x114], ebx
mov dword [esi + 0x110], 1
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.002a5ceb
mov eax, esi
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x35f9b0
mov ecx, dword [ebp + 0x10]
xor edx, edx
mov bl, byte [ecx + edx]
xor byte [ebp + edx - 0x40], bl
inc edx
cmp eax, edx
je 0x35f95e
jmp 0x35f9cd

Function at 0x35f9e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [0x10376020]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp ebx, 0x30
ja 0x35faf7
mov edi, edx
mov esi, ecx
pcmpeqd xmm0, xmm0
lea eax, [ebp - 0x20]
movdqu xmmword [eax], xmm0
movdqu xmmword [eax - 0x10], xmm0
movdqu xmmword [eax - 0x20], xmm0
lea eax, [ecx + 0xfc]
mov dword [ebp - 0x44], eax
mov ecx, dword [ecx + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
lea eax, [esi + 0xf4]
mov dword [ebp - 0x48], eax
call dword [0x10391000]
lea eax, [ebp - 0x40]
push esi
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x10391000]
push esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
mov ecx, dword [esi + 0xf4]
mov eax, dword [esi + 0x108]
bswap eax
inc eax
bswap eax
mov dword [esi + 0x108], eax
call dword [0x10391000]
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x44]
call ecx
add esp, 0xc
test ebx, ebx
je 0x35faba
xor eax, eax
mov cl, byte [edi + eax]
xor byte [ebp + eax - 0x40], cl
inc eax
cmp ebx, eax
jne 0x35faae
push 0x20
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x48]
push 0
push esi
call fcn.00357930
add esp, 0x14
mov dword [esi + 0xf8], eax
lea eax, [ebp - 0x20]
movups xmm0, xmmword [eax]
mov eax, dword [ebp - 0x44]
movups xmmword [eax], xmm0
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.002a5ceb
mov eax, esi
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
xor esi, esi
jmp 0x35fae3
Function at 0x36b470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, edx
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
movups xmmword [eax + 0x50], xmm0
movups xmmword [eax + 0x40], xmm0
movups xmmword [eax + 0x30], xmm0
movups xmmword [eax + 0x20], xmm0
movups xmmword [eax + 0x10], xmm0
movups xmmword [eax], xmm0
add eax, 0x20
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
lea eax, [ecx - 1]
mov dword [ebp - 0x14], eax
xor esi, esi
mov edi, esi
xor edi, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
mov edx, edi
push ecx
push ebx
call fcn.0036b3b0
add esp, 8
lea eax, [ebx + 0x20]
mov ecx, dword [ebp - 0x18]
mov edx, edi
push ecx
push eax
call fcn.0036b3b0
add esp, 8
inc esi
add ebx, 0x40
cmp esi, 0xf
jne 0x36b4a9
mov ecx, dword [ebp + 8]
add ecx, 0x40
mov edx, dword [ebp - 0x10]
push 0x103254e4
push ecx
call fcn.0036b3b0
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x36f8a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x36f8b8
cmp dword [ebp + 0x10], 0
jne 0x36f8b4
call fcn.003a1b60
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0036f390

Function at 0x36fc60
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0036f980

Function at 0x370c80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
xor eax, eax
mov ecx, 0xedb88320
mov esi, eax
shr esi, 1
mov edx, eax
and edx, 1
neg edx
and edx, ecx
xor edx, esi
mov edi, edx
shr edi, 1
mov esi, eax
shl esi, 0x1e
sar esi, 0x1f
and esi, ecx
xor esi, edi
mov ebx, eax
shl ebx, 0x1d
sar ebx, 0x1f
and ebx, 0x76dc419
mov edi, eax
shl edi, 0x1c
sar edi, 0x1f
and edi, 0xedb8832
xor edi, ebx
mov ebx, eax
shl ebx, 0x1b
sar ebx, 0x1f
and ebx, 0x1db71064
xor ebx, edi
mov edi, eax
shl edi, 0x1a
sar edi, 0x1f
and edi, 0x3b6e20c8
xor edi, ebx
mov ebx, esi
shr ebx, 6
xor edi, ebx
shl edx, 0x1a
sar edx, 0x1f
and edx, 0x76dc4190
xor edx, edi
shl esi, 0x1a
sar esi, 0x1f
and esi, ecx
xor esi, edx
mov dword [eax*4 + 0x1038c590], esi
inc eax
cmp eax, 0x100
jne 0x370c8d
mov eax, 0xffffe400
mov ecx, dword [eax + 0x1038e190]
movzx edx, cl
shr ecx, 8
xor ecx, dword [edx*4 + 0x1038c590]
mov dword [eax + 0x1038e590], ecx
add eax, 4
jne 0x370d21
mov eax, 0x1027aef0
mov dword [0x1038e590], eax
mov dword [0x1038c58c], eax
mov dword [0x1038e594], 0x1027afa0
call fcn.003a6830
test eax, eax
jne 0x370d6b
mov dword [0x1038c58c], 0x1027afa0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x383200
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
cmp byte [edx + 0xb], 0
jns 0x383219
mov edx, dword [edx]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x383231
cmp byte [esi + 0x28], 0
jne 0x38329a
or ebx, 0x20000000
test bl, 8
jne 0x3832ab
mov dword [ebp - 0x10], 0
cmp byte [esi + 0x30], 0
mov eax, 0
je 0x38324b
mov eax, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x383259
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x18], eax
cmp byte [esi + 0x1c], 0
jne 0x3832d7
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 0
jne 0x3832c7
test ecx, ecx
jne 0x3832ed
xor ecx, ecx
inc ecx
push dword [ebp - 0x18]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push ecx
push edx
call dword [0x1036fb4c]
mov esi, eax
test eax, eax
jne 0x3832a2
test esi, esi
sete al
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
or ebx, 0x80000000
jmp 0x383231
push esi
call dword [0x1036f7cc]
jmp 0x38328b
cmp byte [esi + 0x34], 0
je 0x3832bc
or ebx, 0x40000000
jmp 0x383236
or ebx, 0x10000000
jmp 0x383236
mov ecx, esi
mov esi, edx
call fcn.002f46a0
mov ecx, dword [ebp + 0xc]
mov edx, esi
jmp 0x38326d
lea ecx, [esi + 0x10]
mov dword [ebp - 0x14], edx
call fcn.002f46a0
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
jmp 0x383262
cmp ecx, 4
jne 0x3832fc
mov ecx, 6
jmp 0x383274
mov esi, ecx
add ecx, 0xfffffffe
cmp ecx, 2
jae 0x383310
mov ecx, 7
jmp 0x383274
cmp esi, 1
jne 0x38331f
mov ecx, 4
jmp 0x383274
xor ecx, ecx
jmp 0x383274

Function at 0x383330
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov eax, dword [ebp + 0x10]
mov ebx, eax
and ebx, 0xfffffff
test al, 4
je 0x38335a
cmp byte [esi + 0x28], 0
jne 0x3833dc
or ebx, 0x20000000
test bl, 8
jne 0x383407
xor eax, eax
cmp byte [esi + 0x30], 0
mov ecx, 0
je 0x383373
mov ecx, dword [esi + 0x2c]
cmp byte [esi + 0x24], 0
mov edi, 0
je 0x383381
mov edi, dword [esi + 0x20]
mov dword [ebp - 0x14], ecx
cmp byte [esi + 0x1c], 0
jne 0x3833e7
mov dword [ebp - 0x10], eax
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp byte [esi + 0xc], 0
jne 0x3833fa
mov ecx, dword [ebp + 8]
cmp edx, 4
jne 0x3833cb
mov edx, 6
push dword [ebp - 0x14]
push edi
push dword [ebp - 0x10]
push eax
push ebx
push edx
push ecx
call dword [0x1036fb50]
mov esi, eax
test eax, eax
jne 0x3833f1
test esi, esi
sete al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov esi, edx
add edx, 0xfffffffe
cmp edx, 2
jae 0x383423
mov edx, 7
jmp 0x3833a5
or ebx, 0x80000000
jmp 0x38335a
lea ecx, [esi + 0x10]
call fcn.002f46a0
jmp 0x38338a
push esi
call dword [0x1036f7cc]
jmp 0x3833bc
mov ecx, esi
mov esi, edx
call fcn.002f46a0
mov edx, esi
jmp 0x383398
cmp byte [esi + 0x34], 0
je 0x383418
or ebx, 0x40000000
jmp 0x383363
or ebx, 0x10000000
jmp 0x383363
test esi, esi
jne 0x38342f
xor edx, edx
inc edx
jmp 0x3833a5
mov edx, esi
cmp esi, 1
jne 0x383440
mov edx, 4
jmp 0x3833a5
xor edx, edx
jmp 0x3833a5
Function at 0x38acb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x38acdc
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
xor ebx, ebx
mov al, byte [ecx + esi]
xor al, byte [edx + esi]
or bl, al
inc esi
cmp edi, esi
jne 0x38acc7
movzx eax, bl
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x38acd7
Function at 0x39afc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ecx, ecx
je 0x39afed
mov edx, dword [ebp + 0xc]
xor esi, esi
movzx edi, al
movzx ebx, byte [edx + esi]
xor ebx, edi
shr eax, 8
xor eax, dword [ebx*4 + 0x1035c768]
inc esi
cmp ecx, esi
jne 0x39afd5
pop esi
pop edi
pop ebx
pop ebp
ret