joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006cae0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016a203
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x10d412c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx + 8], 0
mov dword [ebp - 4], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x1c], 0
mov byte [ebp - 4], 1
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x28], 0
mov byte [ebp - 4], 2
mov eax, 0xffff
mov word [ecx + 0x3e], ax
xor eax, eax
mov dword [ecx + 0x10], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x3a], 0xffffffff
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov word [ecx + 0x38], ax
mov byte [ecx + 0x40], al
mov dword [ecx + 0x44], 0x3f800000
mov dword [ecx + 0x4c], eax
mov dword [ecx + 0x48], eax
mov dword [ecx + 0x50], eax
mov word [ecx + 0x54], ax
mov dword [ebp - 4], 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10074830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x10074857
push eax
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.10060d20
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1007487c
push eax
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.10060d20
add esp, 4
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x100748a1
push eax
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.10060d20
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x44]
test eax, eax
je 0x100748e2
push eax
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.10060d20
add esp, 4
mov dword [esi + 0x44], 0
mov eax, dword [esi + 0x50]
test eax, eax
je 0x10074907
push eax
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.10060d20
add esp, 4
mov dword [esi + 0x50], 0
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x1007492c
push eax
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.10060d20
add esp, 4
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.1006fd40
Function at 0x1007d7a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016a48d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x10d412c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.1005e020
mov esi, eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x1007d972
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x1007d972
push 0x38
call fcn.10060cf0
mov edi, eax
add esp, 4
mov dword [ebp - 0x3c], edi
lea eax, [ebp - 0x21]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x1007d828
push 0x38
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x1007d82a
xor edi, edi
mov dword [ebp - 4], 0xffffffff
or dword [esi + 4], 6
mov edx, dword [ebp + 8]
mov dword [esi + 0xbc], edi
mov dword [esi + 0xb4], str.imgui_impl_win32
mov dword [edi], edx
mov byte [edi + 0x25], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], ecx
mov dword [edi + 0x20], 9
mov dword [esi + 0xd8], edx
mov dword [esi + 0x2c], 9
mov dword [esi + 0x30], 0x25
mov dword [esi + 0x34], 0x27
mov dword [esi + 0x38], 0x26
mov dword [esi + 0x3c], 0x28
mov dword [esi + 0x40], 0x21
mov dword [esi + 0x44], 0x22
mov dword [esi + 0x48], 0x24
mov dword [esi + 0x4c], 0x23
mov dword [esi + 0x50], 0x2d
mov dword [esi + 0x54], 0x2e
mov dword [esi + 0x58], 8
mov dword [esi + 0x5c], 0x20
mov dword [esi + 0x60], 0xd
mov dword [esi + 0x64], 0x1b
mov dword [esi + 0x68], 0xd
mov dword [esi + 0x6c], 0x41
mov dword [esi + 0x70], 0x43
mov dword [esi + 0x74], 0x56
mov dword [esi + 0x78], 0x58
mov dword [esi + 0x7c], 0x59
mov dword [esi + 0x80], 0x5a
xor esi, esi
mov dword [ebp - 0x38], str.xinput1_4.dll
mov dword [ebp - 0x34], str.xinput1_3.dll
mov dword [ebp - 0x30], str.xinput9_1_0.dll
mov dword [ebp - 0x2c], str.xinput1_2.dll
mov dword [ebp - 0x28], str.xinput1_1.dll
push dword [ebp + esi*4 - 0x38]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
jne 0x1007d94f
inc esi
cmp esi, 5
jl 0x1007d935
mov al, 1
jmp 0x1007d974
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.XInputGetCapabilities
push ebx
mov dword [edi + 0x28], ebx
call esi
push str.XInputGetState
push ebx
mov dword [edi + 0x2c], eax
call esi
mov dword [edi + 0x30], eax
mov al, 1
jmp 0x1007d974
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101153a3
mov esp, ebp
pop ebp
ret
Function at 0x10097270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10d412c0]
xor eax, ebp
mov dword [ebp - 4], eax
movaps xmm0, xmmword [0x101e4cf0]
movups xmm2, xmmword [0x10406a00]
push ebx
movaps xmm1, xmmword [0x101e4d00]
movd eax, xmm0
movups xmmword [ebp - 0x28], xmm0
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], 0xa1a0a986
movd xmm0, eax
mov eax, 0x10
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
mov dword [ebp - 0x14], 0x100a9bd
xorps xmm1, xmm0
movd xmm0, dword [ebp - 0x24]
andps xmm1, xmm2
punpcklbw xmm0, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebp - 0x28], xmm1
movaps xmm1, xmmword [0x101e4d10]
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, dword [ebp - 0x20]
andps xmm1, xmm2
punpcklbw xmm0, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebp - 0x24], xmm1
movaps xmm1, xmmword [0x101e4d20]
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, dword [ebp - 0x1c]
andps xmm1, xmm2
punpcklbw xmm0, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebp - 0x20], xmm1
movaps xmm1, xmmword [0x101e4d30]
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebp - 0x1c], xmm1
nop
lea ecx, [eax - 0x45]
xor byte [ebp + eax - 0x28], cl
inc eax
cmp eax, 0x16
jb 0x10097360
push 0x101e3e6c
mov byte [ebp - 0x11], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [ebp + 0x10]
mov ebx, eax
lea eax, [ebp - 8]
mov dword [ebp - 0x10], esi
push eax
push 0x40
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test edi, edi
je 0x100973c0
mov ecx, dword [ebp + 0xc]
sub ecx, esi
mov al, byte [ecx + esi]
lea esi, [esi + 1]
mov byte [esi - 1], al
sub edi, 1
jne 0x100973b2
mov esi, dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 8]
push ecx
push esi
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push eax
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101153a3
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100973f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x10d412c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [eax]
lea eax, [ebp - 8]
add edi, dword [ebp + 0x10]
push eax
push 0x40
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0xc]
mov dword [edi], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.101153a3
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10097440
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ecx + 0xe], 0
je 0x100974b2
movups xmm4, xmmword [0x10406a00]
push esi
push edi
mov edi, 0xffffffc0
lea eax, [edi - 1]
movd xmm2, edi
lea esi, [edi - 3]
movd xmm0, eax
movd xmm3, esi
lea edx, [edi - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [ecx + edi + 0x40]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ecx + edi + 0x40], xmm3
add edi, 4
cmp edi, 0xffffffcc
jb 0x10097454
xor byte [ecx + 0xc], 0xc9
pop edi
pop esi
mov byte [ecx + 0xe], 0
mov eax, ecx
ret
Function at 0x10098890
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016aa7e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x10d412c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 1
call fcn.1011504c
lea edi, [esi + 4]
mov dword [ebp - 0x14], eax
push edi
push 0
push eax
push 0x10099450
push 0
push 0
mov dword [ebp - 0x18], 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x1009893c
mov ecx, 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], ecx
and ecx, 0xfffffffe
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101153a3
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x10099ee0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1016ad98
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10d412c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
mov esi, dword [0x10d4301c]
mov dword [ebp - 0x14], esi
test esi, esi
je 0x10099f56
mov byte [ebp - 4], 2
lea ecx, [esi + 0x278]
call fcn.1001ceb0
mov byte [ebp - 4], 1
lea ecx, [esi + 0x5c]
call fcn.1001ceb0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x10]
call fcn.1000f600
push 0x298
push esi
call fcn.1011507c
add esp, 8
mov esi, dword [0x10d42730]
mov dword [ebp - 0x14], esi
test esi, esi
je 0x10099f98
mov byte [ebp - 4], 5
lea ecx, [esi + 0x278]
call fcn.1001ceb0
mov byte [ebp - 4], 4
lea ecx, [esi + 0x5c]
call fcn.1001ceb0
mov byte [ebp - 4], 0
lea ecx, [esi + 0x10]
call fcn.1000f600
push 0x298
push esi
call fcn.1011507c
add esp, 8
mov esi, dword [0x10d43028]
push 0xc
push esi
call fcn.1011507c
add esp, 8
test esi, esi
je 0x10099fb7
mov dword [0x10d43028], 0x8123
mov esi, dword [0x10d4302c]
push 0xc
push esi
call fcn.1011507c
add esp, 8
test esi, esi
je 0x10099fd6
mov dword [0x10d4302c], 0x8123
mov esi, dword [0x10d43050]
push 0xc
push esi
call fcn.1011507c
add esp, 8
test esi, esi
je 0x10099ff5
mov dword [0x10d43050], 0x8123
mov eax, dword [0x10d42418]
mov edi, dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push dword [eax + 0x6c]
call edi
mov eax, dword [0x10d42418]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [eax + 0x6c]
call esi
mov eax, dword [0x10d42418]
push 0
push dword [eax + 0x60]
call edi
mov eax, dword [0x10d42418]
push dword [eax + 0x60]
call esi
mov eax, dword [0x10d42418]
push 0
push dword [eax + 0x70]
call edi
mov eax, dword [0x10d42418]
push dword [eax + 0x70]
call esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebx + 8]
call fcn.1000f600
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1009bac0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x10d412c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x10d43f38]
push ebx
push edi
call fcn.100cc4f0
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, dword [ebp + 8]
mov ebx, eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x4c], 0xe92d4ff0
push eax
push 0x40
push 0x45
add edi, 0x3a48ba8
mov dword [ebp - 0x48], 0xe59f0010
push edi
push ebx
mov dword [ebp - 0x44], 0xe3a01001
mov dword [ebp - 0x40], 0xe08f0000
mov dword [ebp - 0x3c], 0xebd7159e
mov dword [ebp - 0x38], 0xe3a00000
mov dword [ebp - 0x34], 0xe8bd8ff0
mov dword [ebp - 0x30], 0xc
mov dword [ebp - 0x2c], 0x7461642f
mov dword [ebp - 0x28], 0x6f6c2f61
mov dword [ebp - 0x24], 0x2f6c6163
mov dword [ebp - 0x20], 0x2f706d74
mov dword [ebp - 0x1c], 0x72646e61
mov dword [ebp - 0x18], 0x2f64696f
mov dword [ebp - 0x14], 0x6862696c
mov dword [ebp - 0x10], 0x65706c65
mov dword [ebp - 0xc], 0x6f732e72
mov byte [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push 0
push 0x45
lea eax, [ebp - 0x4c]
push eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push dword [ebp - 0x50]
push 0x45
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop ebx
call fcn.101153a3
mov esp, ebp
pop ebp
ret
Function at 0x100a69e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 6], 0
je 0x100a6a02
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax - 0x3d]
inc eax
xor byte [edx], cl
cmp eax, 5
jb 0x100a69f0
mov byte [esi + 6], 0
mov eax, esi
pop esi
ret

Function at 0x100a6a10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x100a6a32
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax - 0x3d]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x100a6a20
mov byte [esi + 8], 0
mov eax, esi
pop esi
ret

Function at 0x100a6a40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, ecx
cmp byte [edi + 9], 0
je 0x100a6aba
movups xmm4, xmmword [0x10406a00]
push ebx
push esi
mov eax, 0xffffffc6
mov ebx, 2
nop dword [eax]
lea ecx, [eax - 1]
movd xmm2, eax
lea esi, [eax - 3]
movd xmm0, ecx
movd xmm3, esi
lea edx, [eax - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + eax + 0x3a]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + eax + 0x3a], xmm3
add eax, 4
sub ebx, 1
jne 0x100a6a60
pop esi
pop ebx
mov byte [edi + 9], 0
mov eax, edi
pop edi
ret

Function at 0x100a6ac0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, ecx
cmp byte [edi + 0x10], 0
je 0x100a6b48
movups xmm4, xmmword [0x10406a00]
push ebx
push esi
mov ebx, 0xffffffc6
mov eax, 0xc
nop dword [eax]
lea ecx, [ebx - 1]
movd xmm2, ebx
lea esi, [ebx - 3]
movd xmm0, ecx
movd xmm3, esi
lea edx, [ebx - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + ebx + 0x3a]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + ebx + 0x3a], xmm3
add ebx, 4
cmp ebx, 0xffffffd2
jb 0x100a6ae0
pop esi
pop ebx
lea edx, [edi + eax]
lea ecx, [eax - 0x3d]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x100a6b36
mov byte [edi + 0x10], 0
mov eax, edi
pop edi
ret
Function at 0x100a6cf0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x100a6dc9
movd xmm0, dword [esi]
mov eax, 0x10
movups xmm2, xmmword [0x10406a00]
movaps xmm1, xmmword [0x101e4d20]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
movd xmm0, dword [esi + 4]
movaps xmm1, xmmword [0x101e4d30]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 4], xmm1
movd xmm0, dword [esi + 8]
movaps xmm1, xmmword [0x1024ba80]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 8], xmm1
movd xmm0, dword [esi + 0xc]
movaps xmm1, xmmword [0x1024ba90]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 0xc], xmm1
lea edx, [esi + eax]
lea ecx, [eax - 0x3d]
inc eax
xor byte [edx], cl
cmp eax, 0x13
jb 0x100a6db7
mov byte [esi + 0x14], 0
mov eax, esi
pop esi
ret

Function at 0x100a6dd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x100a6ea9
movd xmm0, dword [esi]
mov eax, 0x10
movups xmm2, xmmword [0x10406a00]
movaps xmm1, xmmword [0x101e4d20]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
movd xmm0, dword [esi + 4]
movaps xmm1, xmmword [0x101e4d30]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 4], xmm1
movd xmm0, dword [esi + 8]
movaps xmm1, xmmword [0x1024ba80]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 8], xmm1
movd xmm0, dword [esi + 0xc]
movaps xmm1, xmmword [0x1024ba90]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 0xc], xmm1
lea edx, [esi + eax]
lea ecx, [eax - 0x3d]
inc eax
xor byte [edx], cl
cmp eax, 0x14
jb 0x100a6e97
mov byte [esi + 0x15], 0
mov eax, esi
pop esi
ret
Function at 0x100a6eb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x100a6f89
movd xmm0, dword [esi]
mov eax, 0x10
movups xmm2, xmmword [0x10406a00]
movaps xmm1, xmmword [0x101e4d20]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
movd xmm0, dword [esi + 4]
movaps xmm1, xmmword [0x101e4d30]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 4], xmm1
movd xmm0, dword [esi + 8]
movaps xmm1, xmmword [0x1024ba80]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 8], xmm1
movd xmm0, dword [esi + 0xc]
movaps xmm1, xmmword [0x1024ba90]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 0xc], xmm1
lea edx, [esi + eax]
lea ecx, [eax - 0x3d]
inc eax
xor byte [edx], cl
cmp eax, 0x15
jb 0x100a6f77
mov byte [esi + 0x16], 0
mov eax, esi
pop esi
ret

Function at 0x100a6f90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x100a7069
movd xmm0, dword [esi]
mov eax, 0x10
movups xmm2, xmmword [0x10406a00]
movaps xmm1, xmmword [0x101e4d20]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
movd xmm0, dword [esi + 4]
movaps xmm1, xmmword [0x101e4d30]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 4], xmm1
movd xmm0, dword [esi + 8]
movaps xmm1, xmmword [0x1024ba80]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 8], xmm1
movd xmm0, dword [esi + 0xc]
movaps xmm1, xmmword [0x1024ba90]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 0xc], xmm1
lea edx, [esi + eax]
lea ecx, [eax - 0x3d]
inc eax
xor byte [edx], cl
cmp eax, 0x17
jb 0x100a7057
mov byte [esi + 0x18], 0
mov eax, esi
pop esi
ret
Function at 0x100a7070
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a], 0
je 0x100a7149
movd xmm0, dword [esi]
mov eax, 0x10
movups xmm2, xmmword [0x10406a00]
movaps xmm1, xmmword [0x101e4d20]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
movd xmm0, dword [esi + 4]
movaps xmm1, xmmword [0x101e4d30]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 4], xmm1
movd xmm0, dword [esi + 8]
movaps xmm1, xmmword [0x1024ba80]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 8], xmm1
movd xmm0, dword [esi + 0xc]
movaps xmm1, xmmword [0x1024ba90]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 0xc], xmm1
lea edx, [esi + eax]
lea ecx, [eax - 0x3d]
inc eax
xor byte [edx], cl
cmp eax, 0x19
jb 0x100a7137
mov byte [esi + 0x1a], 0
mov eax, esi
pop esi
ret

Function at 0x100a7150
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
je 0x100a7172
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax - 0x3d]
inc eax
xor byte [edx], cl
cmp eax, 0xb
jb 0x100a7160
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
ret

Function at 0x100a7180
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, ecx
cmp byte [edi + 0xd], 0
je 0x100a71fa
movups xmm4, xmmword [0x10406a00]
push ebx
push esi
mov eax, 0xffffffc6
mov ebx, 3
nop dword [eax]
lea ecx, [eax - 1]
movd xmm2, eax
lea esi, [eax - 3]
movd xmm0, ecx
movd xmm3, esi
lea edx, [eax - 2]
punpckldq xmm3, xmm0
movd xmm0, dword [edi + eax + 0x3a]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + eax + 0x3a], xmm3
add eax, 4
sub ebx, 1
jne 0x100a71a0
pop esi
pop ebx
mov byte [edi + 0xd], 0
mov eax, edi
pop edi
ret