joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100eb57c
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x20]
mov ebp, 0x100000
mov eax, ebx
and eax, 4
shl eax, 0xf
test bl, 8
cmove ebp, eax
push 0x14
call fcn.10071f14
add esp, 4
test eax, eax
jne 0x100eb5af
mov eax, 0xc
jmp 0x100eb639
mov esi, eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
mov dword [esi], ecx
mov dword [esi + 4], eax
xor ecx, ecx
xor eax, eax
test edi, edi
sete al
mov dword [esi + 8], ecx
test ebp, ebp
mov dword [esi + 0xc], eax
lea edx, [eax*4 + 0x10000]
lea eax, [eax*4]
cmove edx, eax
test bl, 0x10
cmovne edx, eax
push ecx
push edx
push esi
push dword [0x104590e0]
push ebp
push ecx
call sub.KERNEL32.dll_CreateThread
test eax, eax
mov dword [esi + 0x10], eax
jne 0x100eb611
push esi
call fcn.1007274c
add esp, 4
mov eax, 0xffff
jmp 0x100eb639
test bl, 2
je 0x100eb61e
push 2
push eax
call sub.KERNEL32.dll_SetThreadPriority
test edi, edi
jne 0x100eb635
push dword [esi + 0x10]
call sub.KERNEL32.dll_ResumeThread
mov ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
je 0x100eb601
jmp 0x100eb639
xor eax, eax
mov dword [edi], esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x100ec5a4
Capabilities:
Write file on windows

Disassembly:
push esi
push eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov esi, esp
mov dword [esi], 0xffffffff
push 0
push esi
push edx
push ecx
push eax
call sub.KERNEL32.dll_WriteFile
xor ecx, ecx
cmp eax, 1
sbb ecx, ecx
or ecx, dword [esi]
mov eax, ecx
add esp, 4
pop esi
ret

Function at 0x100ecf13
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc6c
mov esi, dword [esp + 0xc88]
mov ebx, dword [esp + 0xc80]
mov ebp, dword [esp + 0xc84]
push esi
call fcn.100ecc15
add esp, 4
mov eax, esp
push eax
push ebp
call fcn.100ecc2a
add esp, 8
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.100ecc2a
add esp, 8
xor ebx, ebx
inc ebx
lea eax, [ebx + ebx*4]
lea ebp, [esp + eax*4 + 0x14]
lea eax, [esp + eax*4]
push ebp
push eax
call fcn.100ecc2a
add esp, 8
push ebp
call fcn.100ecbe6
add esp, 4
inc ebx
cmp ebx, 0x9e
jne 0x100ecf58
movsx ecx, word [0x104802dc]
xor eax, eax
xor ebx, ebx
inc ebx
lea ecx, [ecx + ecx*4]
lea ecx, [esp + ecx*4 + 0x14]
mov edx, dword [ecx + eax*4]
and edx, dword [esp + eax*4]
mov dword [esi + eax*4], edx
inc eax
cmp eax, 5
jne 0x100ecf91
mov eax, esp
push eax
call fcn.100ecbe6
add esp, 4
movsx eax, word [ebx + ebx + 0x104802dc]
movsx ecx, word [ebx + ebx + 0x10480556]
xor edx, edx
lea edi, [ecx + ecx*4]
lea ebp, [eax + eax*4]
lea edi, [esp + edi*4 + 0x14]
lea ebp, [esp + ebp*4 + 0x14]
mov edi, dword [edi + edx*4]
xor edi, dword [ebp + edx*4]
and edi, dword [esp + edx*4]
xor dword [esi + edx*4], edi
inc edx
cmp edx, 5
jne 0x100ecfbd
inc ebx
cmp ebx, 0x9e
jne 0x100ecfa0
add esp, 0xc6c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100ecff2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cmp ecx, 0x13d
je 0x100ed065
mov eax, ecx
mov ebx, 0x14
xorps xmm0, xmm0
mov dword [esp + 0x60], 0
shr eax, 5
movaps xmmword [esp + 0x50], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
cwde
sub ebx, eax
and cx, 0x1f
mov dword [esp], eax
mov dword [esp + 4], ebx
jne 0x100ed076
mov eax, 9
mov ecx, ebx
mov edx, dword [edi + eax*4]
movsx esi, cx
dec ecx
or dword [esp + esi*4 + 0x10], edx
test eax, eax
lea eax, [eax - 1]
jg 0x100ed051
jmp 0x100ed0c9
push dword [ebp + 0x10]
push edi
call fcn.100ecc67
add esp, 8
jmp 0x100ed12d
mov edx, 0x20
movzx eax, cx
mov esi, 9
sub edx, ecx
movsx ecx, bx
mov dword [esp + 0xc], eax
movzx eax, dx
mov edx, dword [esp + ecx*4 + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [esp + 0xc]
mov eax, dword [eax + esi*4]
mov edi, eax
shl edi, cl
movsx ecx, bx
dec ebx
or edi, edx
mov dword [esp + ecx*4 + 0x10], edi
mov ecx, dword [esp + 8]
shr eax, cl
movsx ecx, bx
or eax, dword [esp + ecx*4 + 0x10]
test esi, esi
lea esi, [esi - 1]
mov edx, eax
mov dword [esp + ecx*4 + 0x10], eax
jg 0x100ed097
cmp dword [esp], 0x14
mov ebx, dword [esp + 4]
ja 0x100ed10b
mov ax, 0x14
mov dx, 0xb
mov ecx, 0x14
movsx esi, dx
dec edx
dec eax
mov esi, dword [esp + esi*4 + 0x10]
movsx edi, dx
shr esi, 0x1d
or esi, dword [esp + ecx*4 + 0x10]
mov dword [esp + ecx*4 + 0x10], esi
mov edi, dword [esp + edi*4 + 0x10]
shl edi, 3
or edi, esi
mov dword [esp + ecx*4 + 0x10], edi
movsx ecx, ax
cmp ebx, ecx
jbe 0x100ed0e0
mov eax, dword [esp + 0x3c]
mov esi, dword [ebp + 0x10]
xor ecx, ecx
shl eax, 3
sar eax, 0x1f
mov edx, dword [esp + ecx*4 + 0x3c]
xor edx, eax
mov dword [esi + ecx*4], edx
inc ecx
cmp ecx, 0xa
jne 0x100ed11a
and byte [esi + 3], 0xf
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100edd03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffb
test ebx, ebx
je 0x100ede75
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x100ede75
cmp byte [ecx], 1
je 0x100ede75
mov esi, dword [ebp + 0x10]
xor eax, eax
test esi, esi
je 0x100ede75
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x100ede75
mov al, byte [ebx + 0x14]
mov edx, dword [ebp + 0x18]
shr edi, 4
cmp al, 2
je 0x100edde4
cmp al, 1
mov eax, 0xfffffffb
jne 0x100ede75
test edi, edi
je 0x100edd92
lea eax, [ecx + 0x54]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
push dword [eax + 0x4c]
push dword [esp + 0x10]
push edx
push esi
mov ebx, edx
call fcn.10237a5e
mov edx, ebx
add esp, 0x10
add esi, 0x10
add edx, 0x10
dec edi
jg 0x100edd71
mov ebx, dword [ebp + 0x14]
mov edi, 0x10
mov dword [esp + 0xc], edx
lea ecx, [esp + 0x10]
mov eax, ebx
and eax, 0xf
sub edi, eax
push eax
push esi
push ecx
mov esi, ecx
call fcn.10321d90
add esp, 0xc
mov eax, esi
sub eax, edi
add eax, 0x10
push edi
push edi
push eax
call fcn.10322310
add esp, 0xc
mov eax, dword [ebp + 0xc]
push dword [eax + 0x4c]
add eax, 0x54
push eax
push dword [esp + 0x14]
push esi
call fcn.10237a5e
add esp, 0x10
jmp 0x100ede6d
test edi, edi
je 0x100ede24
lea eax, [ecx + 0x54]
mov dword [esp + 0xc], eax
mov eax, ebx
movups xmm0, xmmword [esi]
movups xmm1, xmmword [eax]
mov ebx, edx
xorps xmm1, xmm0
movaps xmmword [esp + 0x10], xmm1
push dword [ecx + 0x4c]
push dword [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.10237a5e
mov ecx, dword [ebp + 0xc]
add esp, 0x10
add esi, 0x10
lea edx, [ebx + 0x10]
dec edi
mov eax, ebx
jg 0x100eddf1
mov eax, dword [ebp + 0x14]
mov edi, edx
and eax, 0xf
je 0x100ede3f
xor ecx, ecx
mov dl, byte [ebx + ecx]
xor dl, byte [esi + ecx]
mov byte [esp + ecx + 0x10], dl
inc ecx
cmp ecx, eax
jne 0x100ede30
mov cl, 0x10
sub cl, al
mov dl, byte [ebx + eax]
xor dl, cl
mov byte [esp + eax + 0x10], dl
inc eax
cmp eax, 0x10
jne 0x100ede43
mov ecx, dword [ebp + 0xc]
lea eax, [esp + 0x10]
push dword [ecx + 0x4c]
add ecx, 0x54
push ecx
push edi
push eax
call fcn.10237a5e
add esp, 0x10
mov ebx, dword [ebp + 0x14]
add ebx, 0x10
and ebx, 0xfffffff0
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10101344
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
push dword [esi]
call fcn.1024a244
add esp, 4
test eax, eax
jne 0x10101431
mov edx, dword [esi + 4]
mov eax, 0x16
cmp edx, 0x80
ja 0x10101431
mov ecx, dword [esi + 8]
cmp ecx, 0x80
jg 0x10101431
cmp edx, ecx
jg 0x10101431
xor eax, eax
cmp edx, ecx
jne 0x10101392
xor ecx, ecx
jmp 0x101013bd
lea ecx, [edx + 1]
mov dword [esi + 4], ecx
mov byte [esi + edx + 0xc], 0x80
xor ecx, ecx
mov edi, dword [esi + 4]
mov edx, dword [esi + 8]
inc ecx
jmp 0x101013b9
lea edx, [edi + 1]
mov dword [esi + 4], edx
mov byte [esi + edi + 0xc], 0
mov edi, dword [esi + 4]
mov edx, dword [esi + 8]
cmp edi, edx
jl 0x101013a8
test edx, edx
je 0x101013de
shl ecx, 7
add ecx, esi
mov dl, byte [eax + ecx + 0x10c]
xor dl, byte [esi + eax + 0x8c]
xor byte [esi + eax + 0xc], dl
inc eax
cmp eax, dword [esi + 8]
jb 0x101013c6
imul eax, dword [esi], 0x58
lea ebx, [esi + 0x210]
lea ecx, [esi + 0xc]
push ebx
push ecx
push ecx
call dword [eax + 0x104900d4]
add esp, 0xc
test eax, eax
jne 0x10101431
mov edi, dword [esp + 0x18]
imul eax, dword [esi], 0x58
push ebx
call dword [eax + 0x104900dc]
add esp, 4
xor eax, eax
cmp dword [esi + 8], 0
mov ecx, 0
je 0x1010142f
mov edx, dword [esp + 0x14]
xor ecx, ecx
cmp ecx, dword [edi]
jae 0x1010142f
mov bl, byte [esi + ecx + 0xc]
mov byte [edx + ecx], bl
inc ecx
cmp ecx, dword [esi + 8]
jb 0x1010141e
mov dword [edi], ecx
pop esi
pop edi
pop ebx
ret

Function at 0x10101d14
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov edi, 0xaaaaaaab
lea eax, [esi + 2]
mul edi
mov eax, 0x54
and edx, 0x7ffffffe
lea edx, [edx + edx + 1]
cmp dword [ecx], edx
jb 0x10101e12
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
mul edi
shr edx, 1
xor eax, eax
lea ebp, [edx + edx*2]
mov edx, ecx
test ebp, ebp
je 0x10101db7
movzx edi, byte [ebx]
add eax, 3
shr edi, 2
mov cl, byte [edi + 0x10437d68]
mov byte [edx], cl
movzx ecx, byte [ebx]
movzx edi, byte [ebx + 1]
shl ecx, 4
shr edi, 4
and ecx, 0x30
mov cl, byte [ecx + edi + 0x10437d68]
mov byte [edx + 1], cl
movzx ecx, byte [ebx + 1]
movzx edi, byte [ebx + 2]
shr edi, 6
and ecx, 0xf
mov cl, byte [edi + ecx*4 + 0x10437d68]
mov byte [edx + 2], cl
movzx ecx, byte [ebx + 2]
add ebx, 3
and ecx, 0x3f
mov cl, byte [ecx + 0x10437d68]
mov byte [edx + 3], cl
add edx, 4
cmp eax, ebp
jb 0x10101d5a
cmp eax, esi
jae 0x10101e05
movzx edi, byte [ebx]
inc eax
xor ebp, ebp
cmp eax, esi
jae 0x10101dc9
movzx ebp, byte [ebx + 1]
mov ecx, edi
shl edi, 4
mov ebx, ebp
shr ecx, 2
shr ebx, 4
and edi, 0x30
cmp eax, esi
mov al, byte [ecx + 0x10437d68]
mov byte [edx], al
mov al, byte [ebx + edi + 0x10437d68]
mov byte [edx + 1], al
mov al, 0x3d
jae 0x10101dfb
and ebp, 0xf
mov al, byte [ebp*4 + 0x10437d68]
mov byte [edx + 2], al
mov byte [edx + 3], 0x3d
add edx, 4
mov byte [edx], 0
mov ecx, dword [esp + 0x20]
sub edx, dword [esp + 0x1c]
xor eax, eax
mov dword [ecx], edx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x101107f4
Capabilities:
Read file on windows

Disassembly:
push esi
push eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov esi, esp
mov dword [esi], 0xffffffff
push 0
push esi
push edx
push ecx
push eax
call sub.KERNEL32.dll_ReadFile
xor ecx, ecx
cmp eax, 1
sbb ecx, ecx
or ecx, dword [esi]
mov eax, ecx
add esp, 4
pop esi
ret
Function at 0x10144864
Capabilities:
Print debug messages
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
push dword [esp + 0x1c]
call sub.KERNEL32.dll_OutputDebugStringA
push 0x10467b3c
call fcn.100d1b88
add esp, 4
test eax, eax
je 0x101448f6
mov esi, eax
push str.RegisterEventSourceA
push eax
call sub.KERNEL32.dll_GetProcAddress
mov ebp, eax
push str.ReportEventA
push esi
call sub.KERNEL32.dll_GetProcAddress
mov edi, eax
push str.DeregisterEventSource
push esi
call sub.KERNEL32.dll_GetProcAddress
test ebp, ebp
je 0x101448f0
test edi, edi
je 0x101448f0
mov ebx, eax
test eax, eax
je 0x101448f0
mov eax, dword [esp + 0x1c]
mov dword [esp], 0x10467b81
mov dword [esp + 4], eax
push str.hasplms
push 0
call ebp
test eax, eax
je 0x101448f0
mov ebp, eax
xor eax, eax
mov ecx, esp
push eax
push ecx
push eax
push 2
push eax
push 0xc0070003
push eax
push 1
push ebp
call edi
push ebp
call ebx
push esi
call sub.KERNEL32.dll_FreeLibrary
push 0x10467b97
call fcn.100d1b88
add esp, 4
test eax, eax
je 0x1014492d
mov esi, eax
push 0x10467ba2
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x10144927
push 0x10
push str.Sentinel_HASP
push dword [esp + 0x24]
push 0
call eax
push esi
call sub.KERNEL32.dll_FreeLibrary
call sub.KERNEL32.dll_GetCurrentProcess
push 1
push eax
call sub.KERNEL32.dll_TerminateProcess
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10150814
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
jle 0x10150902
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ecx]
mov ebx, dword [ecx + 0x14]
mov dword [esp + 0x14], edx
mov ebp, dword [ecx + 0xc]
mov esi, dword [ecx + 8]
mov edi, dword [ecx + 4]
mov edx, dword [ecx + 0x1c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], ebx
mov eax, dword [ecx + 0x18]
mov ebx, dword [ecx + 0x10]
mov ecx, dword [esp]
add ecx, esi
mov dword [esp], ecx
mov ecx, ebp
adc edi, ebp
shld ecx, esi, 0xd
shld esi, ebp, 0xd
mov ebp, edx
xor ecx, edi
xor esi, dword [esp]
add ebx, eax
mov dword [esp + 8], ecx
mov ecx, dword [esp + 4]
adc ecx, edx
shld ebp, eax, 0x10
shld eax, edx, 0x10
xor ebp, ecx
mov dword [esp + 0x18], ecx
mov ecx, edi
mov edi, dword [esp]
xor eax, ebx
add ecx, eax
mov edx, ebp
mov dword [esp], ecx
adc edi, ebp
shld edx, eax, 0x15
shld eax, ebp, 0x15
mov ebp, dword [esp + 8]
xor eax, ecx
xor edx, edi
add ebx, esi
mov ecx, dword [esp + 8]
mov dword [esp + 4], ebx
mov ebx, dword [esp + 0x18]
adc ebx, dword [esp + 8]
shld ebp, esi, 0x11
shld esi, ecx, 0x11
mov ecx, dword [esp + 0xc]
xor esi, dword [esp + 4]
inc ecx
xor ebp, ebx
cmp ecx, dword [esp + 0x14]
mov dword [esp + 0xc], ecx
jne 0x10150851
mov ecx, dword [esp + 0x10]
mov dword [ecx + 8], esi
mov esi, dword [esp]
mov dword [ecx + 0xc], ebp
mov dword [ecx + 4], edi
mov dword [ecx], esi
mov dword [ecx + 0x1c], edx
mov edx, dword [esp + 4]
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], edx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10150903
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x58
mov esi, ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x70]
mov edx, dword [esi + 0x160]
cmp dword [esi + 0x90], ecx
jne 0x10150934
lea ebx, [esi + 0x11c]
lea edi, [esi + 0x120]
jmp 0x1015093d
mov ebx, dword [esi + 0x128]
lea edi, [ebx + 4]
mov dword [esp + 0x10], edi
lea edi, [esi + 0x19c]
mov dword [esp + 0x30], edx
lea edx, [edx + 0x50]
mov dword [ebx], eax
mov dword [esp + 4], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x34], edx
Function at 0x1016a853
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
cmp dword [esi + 0x94], 1
jne 0x1016a8d5
mov eax, 0x20001
test bl, 3
jne 0x1016a925
test ebx, ebx
je 0x1016a8a3
xor ebp, ebp
lea ecx, [edi + ebp]
call fcn.1016a9ea
add dword [esi + 0x3c], eax
mov ecx, esi
call fcn.1016a9ed
mov ecx, esi
call fcn.1016aa2b
xor dword [esi + 0x10], eax
add ebp, 4
cmp ebp, ebx
jb 0x1016a880
add dword [esi + 0x3c], ebx
mov ecx, esi
call fcn.1016aa5b
mov ecx, esi
call fcn.1016b04b
mov ecx, esi
call fcn.1016b06b
xor eax, eax
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], 1
jmp 0x1016a925
mov ecx, esi
call fcn.1016b07b
mov eax, 0x20001
test bl, 3
jne 0x1016a925
test ebx, ebx
je 0x1016a90f
xor ebp, ebp
lea ecx, [edi + ebp]
call fcn.1016a9ea
add dword [esi + 0x3c], eax
mov ecx, esi
call fcn.1016a9ed
mov ecx, esi
call fcn.1016aa2b
xor dword [esi + 0x10], eax
add ebp, 4
cmp ebp, ebx
jb 0x1016a8ec
add dword [esi + 0x3c], ebx
mov ecx, esi
call fcn.1016aa5b
xor eax, eax
mov dword [esi + 0x90], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10219c3a
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x34]
push dword [edi]
call fcn.1024a244
add esp, 4
mov ecx, eax
test eax, eax
jne 0x10219c0b
mov ebx, dword [edi + 4]
mov ecx, 0x16
lea eax, [ebx - 1]
cmp eax, 0x7f
ja 0x10219c0b
mov esi, dword [esp + 0x30]
xor edx, edx
mov eax, esi
div ebx
and ebx, 3
or ebx, edx
jne 0x10219c0b
imul edx, dword [edi], 0x58
mov ebp, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
mov ecx, dword [edx + 0x104900f0]
test ecx, ecx
jne 0x10219c76
test esi, esi
jne 0x10219c15
xor ecx, ecx
mov eax, ecx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
lea eax, [edi + 0x88]
lea ecx, [esp + 4]
mov dword [esp], eax
push eax
push ecx
push ebx
call dword [edx + 0x104900d8]
add esp, 0xc
mov ecx, eax
test eax, eax
jne 0x10219c0b
mov ecx, dword [edi + 4]
xor eax, eax
test ecx, ecx
jle 0x10219c5a
mov ecx, dword [esp + eax + 4]
mov edx, dword [ebx + eax]
xor ecx, dword [edi + eax + 8]
mov dword [edi + eax + 8], edx
mov dword [ebp + eax], ecx
add eax, 4
mov ecx, dword [edi + 4]
cmp eax, ecx
jl 0x10219c3d
sub esi, ecx
je 0x10219c09
imul eax, dword [edi], 0x58
add ebp, ecx
add ebx, ecx
push dword [esp]
lea ecx, [esp + 8]
push ecx
push ebx
call dword [eax + 0x104900d8]
jmp 0x10219c2b
lea edx, [edi + 0x88]
add edi, 8
push edx
push edi
push eax
push ebp
push ebx
call ecx
add esp, 0x28
jmp 0x10219c10
Function at 0x10228399
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, dword [esp + 0x30]
push dword [ebx]
call fcn.1024a244
add esp, 4
test eax, eax
jne 0x102283b7
mov ecx, dword [ebx + 4]
mov eax, 0x16
lea edx, [ecx - 1]
cmp edx, 0x7f
ja 0x102283b7
test cl, 3
jne 0x102283b7
mov edx, dword [ebx + 8]
cmp edx, 0x80
ja 0x102283b7
mov esi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
cmp edx, ecx
jne 0x10228308
cmp ecx, esi
ja 0x10228308
imul eax, dword [ebx], 0x58
mov eax, dword [eax + 0x104900f4]
test eax, eax
je 0x10228308
lea edx, [ebx + 0x110]
mov dword [esp + 8], eax
mov eax, esi
mov dword [esp + 0xc], edx
mov edx, dword [ebx + 0xc]
mov dword [esp], edx
lea edx, [ebx + 0x10]
mov dword [esp + 4], edx
xor edx, edx
div ecx
push dword [esp + 0xc]
push dword [esp + 4]
push dword [esp + 0xc]
push eax
push ebp
push edi
call dword [esp + 0x20]
add esp, 0x18
test eax, eax
jne 0x102283b7
mov ecx, dword [ebx + 4]
mov eax, esi
xor edx, edx
div ecx
mov esi, edx
xor eax, eax
test esi, esi
je 0x102283b7
lea eax, [ebx + 0x110]
lea edx, [ebx + 0x10]
mov dword [esp + 8], eax
lea eax, [ebx + 0x90]
mov dword [esp], edx
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
cmp eax, ecx
jne 0x10228364
push ebx
call fcn.1015c514
add esp, 4
imul eax, dword [ebx], 0x58
push dword [esp + 8]
push dword [esp + 8]
push dword [esp + 8]
call dword [eax + 0x104900d4]
add esp, 0xc
test eax, eax
jne 0x102283b7
mov dword [ebx + 8], 0
mov ecx, dword [ebx + 4]
jmp 0x10228368
test eax, eax
jne 0x102283a0
xor eax, eax
cmp esi, ecx
jb 0x102283a0
xor eax, eax
test ecx, ecx
jle 0x1022838c
mov ecx, dword [ebx + eax + 0x90]
xor ecx, dword [edi + eax]
mov dword [ebp + eax], ecx
add eax, 4
mov ecx, dword [ebx + 4]
cmp eax, ecx
jl 0x10228374
add edi, ecx
add ebp, ecx
sub esi, ecx
mov dword [ebx + 8], ecx
xor eax, eax
test esi, esi
je 0x102283b7
mov ecx, dword [ebx + 4]
jmp 0x1022832c
mov cl, byte [edi]
lea edx, [eax + 1]
inc edi
dec esi
mov dword [ebx + 8], edx
xor cl, byte [ebx + eax + 0x90]
mov byte [ebp], cl
inc ebp
jmp 0x10228395
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10237965
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov eax, dword [esp + 0x14]
cmp eax, 2
jl 0x10237a58
mov ecx, dword [esp + 0x10]
xor edx, edx
inc edx
mov esi, edx
inc edx
shl esi, 4
movzx ebx, byte [ecx + esi + 1]
movzx edi, byte [ecx + esi]
mov ebx, dword [ebx*4 + 0x10475940]
xor ebx, dword [edi*4 + 0x10475540]
movzx edi, byte [ecx + esi + 2]
xor ebx, dword [edi*4 + 0x10475d40]
movzx edi, byte [ecx + esi + 3]
xor ebx, dword [edi*4 + 0x10476140]
mov dword [ecx + esi], ebx
movzx ebx, byte [ecx + esi + 5]
movzx edi, byte [ecx + esi + 4]
mov ebx, dword [ebx*4 + 0x10475940]
xor ebx, dword [edi*4 + 0x10475540]
movzx edi, byte [ecx + esi + 6]
xor ebx, dword [edi*4 + 0x10475d40]
movzx edi, byte [ecx + esi + 7]
xor ebx, dword [edi*4 + 0x10476140]
mov dword [ecx + esi + 4], ebx
movzx ebx, byte [ecx + esi + 9]
movzx edi, byte [ecx + esi + 8]
mov ebx, dword [ebx*4 + 0x10475940]
xor ebx, dword [edi*4 + 0x10475540]
movzx edi, byte [ecx + esi + 0xa]
xor ebx, dword [edi*4 + 0x10475d40]
movzx edi, byte [ecx + esi + 0xb]
xor ebx, dword [edi*4 + 0x10476140]
mov dword [ecx + esi + 8], ebx
movzx ebx, byte [ecx + esi + 0xd]
movzx edi, byte [ecx + esi + 0xc]
mov ebx, dword [ebx*4 + 0x10475940]
xor ebx, dword [edi*4 + 0x10475540]
movzx edi, byte [ecx + esi + 0xe]
xor ebx, dword [edi*4 + 0x10475d40]
movzx edi, byte [ecx + esi + 0xf]
xor ebx, dword [edi*4 + 0x10476140]
cmp edx, eax
mov dword [ecx + esi + 0xc], ebx
jne 0x1023797c
xor eax, eax
pop esi
pop edi
pop ebx
ret
Function at 0x10294ce4
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, dword [esp + 0x2c]
push dword [edi]
call fcn.1024a244
add esp, 4
mov ecx, eax
test eax, eax
jne 0x10294dce
mov esi, dword [edi + 4]
mov ecx, 0x16
lea eax, [esi - 1]
cmp eax, 0x7f
ja 0x10294dce
mov eax, dword [esp + 0x28]
mov ebx, esi
xor edx, edx
and ebx, 3
mov dword [esp + 8], eax
div esi
or ebx, edx
jne 0x10294dce
imul ecx, dword [edi], 0x58
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov ecx, dword [ecx + 0x104900ec]
test ecx, ecx
jne 0x10294d50
cmp dword [esp + 0x28], 0
jne 0x10294d65
xor ecx, ecx
jmp 0x10294dce
lea edx, [edi + 0x88]
add edi, 8
push edx
push edi
push eax
push ebp
push ebx
call ecx
add esp, 0x20
jmp 0x10294dd3
lea eax, [edi + 0x88]
lea ecx, [edi + 8]
mov dword [esp + 4], eax
mov dword [esp], ecx
xor eax, eax
test esi, esi
jle 0x10294d8a
mov ecx, dword [ebx + eax]
xor dword [edi + eax + 8], ecx
add eax, 4
cmp eax, dword [edi + 4]
jl 0x10294d7b
imul eax, dword [edi], 0x58
push dword [esp + 4]
push ebp
push dword [esp + 8]
call dword [eax + 0x104900d4]
add esp, 0xc
test eax, eax
je 0x10294da7
mov ecx, eax
jmp 0x10294dce
mov esi, dword [edi + 4]
xor eax, eax
test esi, esi
jle 0x10294dc2
mov ecx, dword [ebp + eax]
mov dword [edi + eax + 8], ecx
add eax, 4
mov esi, dword [edi + 4]
cmp eax, esi
jl 0x10294db0
add ebp, esi
add ebx, esi
xor ecx, ecx
sub dword [esp + 8], esi
jne 0x10294d75
mov eax, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x102e25e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x28]
push esi
call fcn.10146454
add esp, 4
mov edi, eax
test eax, eax
jne 0x102e274e
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
test ebx, ebx
mov dword [eax + 0x110], esi
jne 0x102e261e
mov edi, 0x20001
jmp 0x102e274e
imul ebp, esi, 0x64
mov eax, dword [ebp + 0x10483e24]
mov dword [esp + 8], eax
push dword [ebp + 0x10483e28]
call fcn.10071f14
add esp, 4
mov edi, 0xc
test eax, eax
mov dword [esp], eax
je 0x102e274e
mov dword [esp + 4], ebp
lea ebp, [ebp + 0x10483e28]
push dword [ebp]
call fcn.10071f14
add esp, 4
mov ecx, dword [esp + 0x24]
test eax, eax
mov dword [ecx + 0x228], eax
jne 0x102e2674
push dword [esp]
jmp 0x102e2746
mov edx, dword [ebp]
mov ecx, dword [esp + 0x2c]
cmp edx, ebx
jae 0x102e26bc
lea edi, [esp + 0xc]
mov dword [edi], edx
push edi
push eax
push ebx
push ecx
push esi
call fcn.10181c54
add esp, 0x14
mov esi, dword [esp]
mov ebx, dword [esp + 0x24]
mov edi, eax
test eax, eax
jne 0x102e2737
mov eax, dword [ebp]
mov edx, dword [esp + 8]
mov edi, ebx
mov ecx, eax
sub ecx, edx
jbe 0x102e26ea
add edx, dword [edi + 0x228]
push ecx
push edx
jmp 0x102e26df
push ebx
push ecx
push eax
call fcn.100e01c4
add esp, 0xc
mov eax, dword [ebp]
mov esi, dword [esp]
mov edi, dword [esp + 0x24]
mov ecx, eax
sub ecx, ebx
jbe 0x102e26ea
add ebx, dword [edi + 0x228]
push ecx
push ebx
call fcn.1014aff4
add esp, 8
mov eax, dword [ebp]
test eax, eax
je 0x102e2705
xor eax, eax
mov ecx, dword [edi + 0x228]
mov cl, byte [ecx + eax]
xor cl, 0x36
mov byte [esi + eax], cl
inc eax
cmp eax, dword [ebp]
jb 0x102e26f0
push edi
mov eax, dword [esp + 8]
call dword [eax + 0x10483e70]
add esp, 4
mov ebx, edi
mov edi, eax
test eax, eax
jne 0x102e2737
push dword [ebp]
push esi
push ebx
mov eax, dword [esp + 0x10]
call dword [eax + 0x10483e74]
add esp, 0xc
mov edi, eax
test eax, eax
jne 0x102e2737
xor edi, edi
jmp 0x102e2745
push dword [ebx + 0x228]
call fcn.1007274c
add esp, 4
push esi
call fcn.1007274c
add esp, 4
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret