joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a6b0
Capabilities:
Get file system object information

Disassembly:
push 0xffffffffffffffff
push 0x474ffc
mov eax, dword fs:[0]
push eax
sub esp, 0x2bc
mov eax, dword [0x496028]
xor eax, esp
mov dword [esp + 0x2b8], eax
push edi
mov eax, dword [0x496028]
xor eax, esp
push eax
lea eax, [esp + 0x2c4]
mov dword fs:[0], eax
mov eax, dword [esi + 0x2d4]
mov eax, dword [eax - 0xc]
lea edi, [esi + 0x2d4]
test eax, eax
je 0x45a70e
push edi
mov ecx, ebx
call dword [0x47c994]
mov eax, 1
jmp 0x45a7a1
lea ecx, [esp + 8]
call dword [0x47ce28]
mov dword [esp + 0x2cc], 0
mov edx, dword [esi + 0x28]
cmp dword [edx - 0xc], 0
lea ecx, [esi + 0x28]
jle 0x45a795
push 0
call dword [0x47c848]
movzx eax, ax
push eax
lea ecx, [esp + 0xc]
push str._c:_
push ecx
call dword [0x47cdfc]
mov eax, dword [esp + 0x14]
add esp, 0xc
push 0x200
push 0x2b4
lea edx, [esp + 0x14]
push edx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x45a795
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
call dword [0x47ce18]
push eax
mov ecx, edi
call dword [0x47c994]
lea ecx, [esp + 8]
call dword [0x47ce24]
mov eax, 1
jmp 0x45a7a1
lea ecx, [esp + 8]
call dword [0x47ce24]
xor eax, eax
mov ecx, dword [esp + 0x2c4]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x2b8]
xor ecx, esp
call fcn.004734e6
add esp, 0x2c8
ret
Function at 0x45bf80
Capabilities:
Get disk information

Disassembly:
sub esp, 0x28
mov eax, dword [0x496028]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x2c]
lea ecx, [eax + 0x28]
mov dword [esp + 4], 0
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
push 0
je 0x45c00b
mov edx, dword [0x47d680]
mov eax, dword [0x47d684]
mov dword [esp + 8], edx
mov dword [esp + 0xc], eax
call dword [0x47c848]
push 0xc
mov word [esp + 8], ax
xor eax, eax
lea edx, [esp + 0x10]
push edx
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov word [esp + 0x3e], ax
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
mov word [esp + 0x2c], cx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x45c009
lea ecx, [esp + 0xc]
push ecx
jmp 0x45c00b
push 0
mov ecx, esi
call dword [0x47ce1c]
mov ecx, dword [esp + 0x24]
xor ecx, esp
mov eax, esi
call fcn.004734e6
add esp, 0x28
ret 4

Function at 0x45cf60
Capabilities:
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x478d19
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x496028]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
jne 0x45cf92
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
je 0x45cfa2
mov esi, SysReAllocString
mov edi, 0x2000000
jmp 0x45cfb8
mov esi, 0x80
mov edi, 0x20000000
test eax, 0x4000
je 0x45cfb8
mov esi, 0x87
push 0x4878ac
lea ecx, [esp + 0x20]
call dword [0x47ce1c]
push ebx
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0
call dword [0x47c850]
mov eax, dword [esp + 0x1c]
push 0
push edi
push 3
push 0
push 7
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [esp + 0x1c]
mov esi, eax
call dword [0x47ce24]
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x460070
Capabilities:
Get volume information via ioctl

Disassembly:
push ecx
mov edx, dword [esi + 0xc]
push 0
lea eax, [esp + 4]
push eax
push 0x68
lea ecx, [esi + 0x18]
push ecx
push 0
push 0
push 0x90064
push edx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x4600c7
mov eax, dword [esi + 0x48]
mov dword [esi + 0xa0], eax
test edi, edi
je 0x4600ac
mov dword [edi], eax
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x44]
mov edx, dword [esi + 0x54]
push 0
push ecx
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x50]
push edx
push eax
call fcn.00474310
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0x460f60
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x478318
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x496028]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, ecx
mov dword [esp + 0x18], eax
add eax, 0xa8
mov dword [esp + 0x14], eax
inc dword [eax]
xor esi, esi
mov dword [esp + 0x28], esi
mov ecx, dword [eax]
mov edx, dword [eax]
cmp edx, 0x14
ja 0x46103b
mov edi, dword [ebp + 8]
cmp byte [edi + 7], 0
mov al, byte [edi + 6]
je 0x46100e
test al, al
je 0x46100e
movzx ebx, al
xor ecx, ecx
lea eax, [ebx + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00472d56
mov esi, eax
add esp, 4
test esi, esi
je 0x46103b
movzx eax, byte [edi + 7]
add ebx, ebx
push ebx
add eax, edi
push eax
push esi
call fcn.004741d2
xor ecx, ecx
add esp, 0xc
mov word [ebx + esi], cx
cmp word [esi], cx
jne 0x46100e
push esi
call fcn.00472d5c
add esp, 4
xor esi, esi
movzx eax, word [edi + 0x18]
mov edx, dword [ebp + 0xc]
mov ecx, dword [edi]
push edx
mov edx, dword [edi + 0x10]
push eax
movzx eax, word [edi + 0x14]
push esi
push ecx
mov ecx, dword [esp + 0x28]
push eax
push edx
push ecx
call fcn.00460ec0
test esi, esi
je 0x46103b
push esi
call fcn.00472d5c
add esp, 4
mov eax, dword [esp + 0x14]
dec dword [eax]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x461b40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
mov esi, ecx
movzx ecx, byte [esi + 0x20]
movzx eax, word [esi + 0x26]
movzx edx, word [esi + 0x1e]
imul eax, ecx
movzx ecx, word [esi + 0x1b]
add eax, edx
imul eax, ecx
cdq
mov dword [esp + 0xc], eax
movzx eax, word [esi + 0x21]
shl eax, 5
mov dword [esp + 0x10], edx
cdq
push edi
mov ebx, eax
mov dword [esp + 0x1c], edx
test edx, edx
ja 0x461c6c
cmp ebx, 0xffffffff
ja 0x461c6c
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
mov edx, dword [esi]
mov edi, eax
mov eax, dword [edx + 0x18]
mov ecx, esi
mov dword [esp + 0x24], 0
call eax
mov ecx, dword [esp + 0x24]
push ecx
push edi
push edx
push eax
call fcn.00474250
cmp dword [esp + 0x14], edx
jb 0x461bcd
ja 0x461c6c
cmp dword [esp + 0x10], eax
ja 0x461c6c
movzx eax, word [esi + 0x1b]
cdq
push edx
mov edx, dword [esp + 0x20]
push eax
push edx
push ebx
mov dword [esp + 0x1c], ebx
call fcn.00474290
test edx, edx
ja 0x461beb
test eax, eax
jbe 0x461c09
movzx edi, word [esi + 0x1b]
mov eax, edi
cdq
push edx
push eax
mov eax, dword [esp + 0x24]
push eax
push ebx
call fcn.00474290
sub edi, eax
add edi, ebx
mov ebx, edi
mov dword [esp + 0xc], ebx
push ebx
call fcn.00472d56
mov ebx, eax
xor eax, eax
add esp, 4
cmp ebx, eax
je 0x461c6c
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esi + 0x238]
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x14]
push edx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x461c77
push ebx
call fcn.0047284c
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp + 8]
mov edx, dword [esp + 0xc]
pop edi
pop esi
mov eax, ebx
mov dword [ecx], edx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4629b0
Capabilities:
Get disk information

Disassembly:
sub esp, 0x1c
mov eax, dword [0x496028]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
xor eax, eax
push 0xc
lea edx, [esp + 8]
push edx
push eax
push eax
push eax
push eax
push eax
push ecx
mov word [esp + 0x24], ax
mov dword [esp + 0x26], eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov word [esp + 0x3a], ax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x462a4a
mov esi, dword [0x47c42c]
lea eax, [esp + 4]
push 0x4878e8
push eax
call esi
add esp, 8
test eax, eax
je 0x462a35
lea ecx, [esp + 4]
push str.FAT32
push ecx
call esi
add esp, 8
test eax, eax
je 0x462a35
lea edx, [esp + 4]
push 0x4878d0
push edx
call esi
add esp, 8
test eax, eax
jne 0x462a4a
mov eax, 1
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004734e6
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.004734e6
add esp, 0x1c
ret

Function at 0x462ae0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
mov dword [esp], 0x200
cmp eax, 0xffffffff
je 0x462b2b
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 4]
push edx
push 0x200
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x462b2b
cmp dword [esp], 0x200
jne 0x462b2b
xor eax, eax
add esp, 0x18
ret
or eax, 0xffffffff
add esp, 0x18
ret

Function at 0x462b40
Capabilities:
Get disk size

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
push edi
mov ecx, esi
call edx
call fcn.00461ab0
cmp eax, 0xffffffff
je 0x462c36
lea eax, [esi + 0x10]
push eax
mov eax, dword [esi + 0x238]
call fcn.00462ae0
add esp, 4
cmp eax, 0xffffffff
je 0x462c36
cmp byte [esi + 0x1d], 0
je 0x462c36
cmp word [esi + 0x1b], 0
je 0x462c36
mov edx, dword [esi]
mov eax, dword [edx + 0x24]
mov ecx, esi
call eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
movzx edi, word [esi + 0x1b]
movzx ebx, byte [esi + 0x1d]
mov ecx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov eax, edi
imul eax, ebx
sub ecx, dword [esp + 0x20]
cdq
sbb ebp, dword [esp + 0x24]
push edx
push eax
push ebp
push ecx
call fcn.004741e0
mov dword [esi + 0x228], eax
movzx eax, word [esi + 0x26]
mov dword [esi + 0x22c], edx
movzx ecx, ax
test ax, ax
jne 0x462bf4
mov ecx, dword [esi + 0x34]
movzx edx, word [esi + 0x21]
shl edx, 5
lea eax, [edx + edi - 1]
cdq
idiv edi
movzx edx, byte [esi + 0x20]
imul edx, ecx
lea ecx, [ebx + ebx]
mov dword [esi + 0x234], 0
add eax, edx
movzx edx, word [esi + 0x1e]
sub eax, ecx
add eax, edx
imul eax, edi
mov dword [esi + 0x230], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
Function at 0x462c40
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push edi
call edx
push eax
mov dword [esi + 0x210], eax
call fcn.00472d56
add esp, 4
mov dword [esi + 0x218], eax
test eax, eax
jne 0x462c79
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
movzx ecx, word [esi + 0x1b]
mov edi, eax
movzx eax, word [esi + 0x1e]
imul eax, ecx
mov ecx, dword [esi + 0x210]
sub ecx, edi
add ecx, eax
cdq
mov ebp, eax
mov ebx, edx
xor eax, eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], 0
cmp ebx, eax
ja 0x462d08
jb 0x462cb6
cmp ebp, ecx
ja 0x462d08
mov ecx, dword [esi + 0x218]
add ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esi + 0x238]
lea eax, [esp + 0x1c]
push eax
push edi
push ecx
push edx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
add dword [esp + 0x10], edi
test eax, eax
je 0x462c6f
add ebp, edi
adc ebx, 0
xor eax, eax
cmp ebx, eax
jb 0x462cb6
ja 0x462d08
cmp ebp, dword [esp + 0x14]
jbe 0x462cb6
pop edi
mov eax, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x463750
Capabilities:
Get disk size

Disassembly:
sub esp, 0x20
mov eax, dword [0x496028]
xor eax, esp
mov dword [esp + 0x1c], eax
mov ecx, dword [0x47d680]
mov edx, dword [0x47d684]
mov eax, dword [esp + 0x24]
mov ax, word [eax]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10]
push edx
mov word [esp + 0x1c], ax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x4637e8
mov eax, dword [esp + 8]
mul dword [esp + 0x10]
mov dword [esi + 0x260], eax
mov eax, dword [esp + 4]
sub eax, dword [esp + 0xc]
mov dword [esi + 0x264], edx
mov dword [esi + 0x268], eax
xor eax, eax
mov dword [esi + 0x26c], eax
mov dword [esi + 0x270], eax
mov dword [esi + 0x274], eax
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004734e6
add esp, 0x20
ret 4
mov ecx, dword [esp + 0x1c]
xor ecx, esp
or eax, 0xffffffff
call fcn.004734e6
add esp, 0x20
ret 4
Function at 0x4734e6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x496028]
jne 0x4734f0
repz ret
jmp fcn.00473a8e
Function at 0x10002ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x10002fb7
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x10002f36
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.10002b00
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x10002f04
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x10003070
call fcn.10002f48
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x1000300f
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.10002b00
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x10002fc8
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x10003070
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.10002b00
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x1000306b
jmp 0x10003070
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10003100
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x10003200
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x1000317f
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.10002c60
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1000314d
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x100032b9
call fcn.10003191
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x10003258
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.10002d90
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x10003211
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x100032b9
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.10002d90
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x100032b4
jmp 0x100032b9
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10038f70
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x10038f90
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x1003d580
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x1003d686
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x1003d5fd
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.1003cd40
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1003d5c3
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x1003d74f
call fcn.1003d60f
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x1003d6e6
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.1003d160
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1003d697
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x1003d74f
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.1003d160
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x1003d74a
jmp 0x1003d74f
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1003e460
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [edx]
shl ecx, 4
movups xmm1, xmmword [edx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
movups xmm0, xmmword [edx + 0x20]
lea edx, [edx + ecx + 0x20]
neg ecx
add ecx, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [edx + ecx]
add ecx, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [edx + ecx - 0x10]
jne 0x1003e47e
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
ret