joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009eb10
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ae503
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101bf2c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0xc]
mov dword [esi], 0x10002ba4
mov dword [ecx], 0
mov byte [ebp - 4], 1
mov dword [esi + 4], 1
call fcn.100a91c0
fld dword [0x10035f6c]
mov eax, esi
fst dword [esi + 0x10]
fstp dword [esi + 0x14]
fld dword [0x100358bc]
fst dword [esi + 0x18]
fstp dword [esi + 0x1c]
mov dword [esi + 0x20], 0
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], 0x100015a8
mov dword [esi + 0x2c], 0
mov dword [esi], 0x10002bf0
mov dword [esi + 0x28], 0x10002bec
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100a64e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101aeb60
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x101bf2c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, ebx
mov dword [ebp - 4], 0
mov edx, dword [esi + 4]
mov eax, dword [edx + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
Function at 0x100a97e0
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ae503
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101bf2c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0xc]
mov dword [esi], 0x10003810
mov dword [ecx], 0
mov byte [ebp - 4], 1
mov dword [esi + 4], 1
call fcn.1003b960
fld1
mov eax, esi
mov byte [esi + 0x40], 1
fst dword [esi + 0x2c]
fst dword [esi + 0x28]
fldz
fst dword [esi + 0x14]
fst dword [esi + 0x10]
fst dword [esi + 0x1c]
fst dword [esi + 0x18]
fst dword [esi + 0x24]
fstp dword [esi + 0x20]
fst dword [esi + 0x34]
fst dword [esi + 0x30]
fst dword [esi + 0x3c]
fstp dword [esi + 0x38]
mov dword [esi + 0x44], 0x100015a8
mov dword [esi + 0x48], 0
mov dword [esi], 0x1000385c
mov dword [esi + 0x44], 0x10003858
mov dword [esi + 0x4c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100e0260
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b0908
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push esi
mov eax, dword [0x101bf2c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [ebp + 8], 0
je 0x100e039b
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov eax, dword [ecx + 4]
lea ecx, [ebp - 0x14]
push ecx
push 8
push eax
mov esi, dword [eax]
mov esi, dword [esi + 0x1d8]
mov ecx, esi
call dword [0x101c43b0]
call esi
test eax, eax
js 0x100e037d
mov eax, dword [ebp - 0x14]
push 1
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x18]
mov ecx, esi
call dword [0x101c43b0]
call esi
test eax, eax
jns 0x100e02e4
push eax
call dword [sym.imp.PhotoBase.dll_void___stdcall_Base::Throw_long_int_]
lea ecx, [ebp - 0x4c]
call fcn.1004c470
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x100e0300
call dword [sym.imp.PhotoBase.dll_void___stdcall_Base::ThrowLastError_void_]
mov eax, dword [ebp - 0x14]
push 1
push 0
push 0
mov esi, dword [eax]
push eax
mov esi, dword [esi + 0x1c]
mov ecx, esi
call dword [0x101c43b0]
call esi
cmp eax, 1
jne 0x100e037d
mov edi, edi
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x100e02fa
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
sbb eax, dword [ebp - 0x40]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
fild qword [ebp - 0x24]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
fild qword [ebp - 0x4c]
fstp qword [ebp - 0x2c]
fdiv qword [ebp - 0x2c]
fcomp qword [0x10035c28]
fnstsw ax
test ah, 0x41
je 0x100e037d
mov eax, dword [ebp - 0x14]
push 1
push 0
push 0
mov esi, dword [eax]
push eax
mov esi, dword [esi + 0x1c]
mov ecx, esi
call dword [0x101c43b0]
call esi
cmp eax, 1
je 0x100e0320
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x100e039b
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x101c43b0]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100eee30
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b1b91
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x101bf2c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx + 4], 0x10003d78
mov dword [ebx], 0x100062c4
mov dword [ebx + 4], 0x100062a8
mov dword [ebx + 8], 0xffffffff
mov byte [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
lea ecx, [ebx + 0x6c]
mov byte [ebx + 0x5c], 0
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x68], 0
call fcn.10048910
mov word [ebx + 0xb4], 0
mov word [ebx + 0xea], 0
mov byte [ebx + 0xec], 0
mov dword [ebx + 0xf0], 0
mov word [ebx + 0xf4], 0
mov dword [ebx + 0xf8], 0
mov dword [ebx + 0xfc], 0
mov dword [ebx + 0x100], 0
mov dword [ebx + 0x104], 0
mov word [ebx + 0x108], 0
mov dword [ebx + 0x10c], 0
mov dword [ebx + 0x110], 0
mov dword [ebx + 0x114], 0
mov dword [ebx + 0x118], 0
fldz
fst dword [ebx + 0x120]
fst dword [ebx + 0x124]
fst dword [ebx + 0x128]
fst dword [ebx + 0x12c]
fst dword [ebx + 0x130]
fst dword [ebx + 0x134]
fst dword [ebx + 0x138]
fst dword [ebx + 0x13c]
fst dword [ebx + 0x140]
fst dword [ebx + 0x144]
fst dword [ebx + 0x148]
fst dword [ebx + 0x14c]
fst dword [ebx + 0x150]
fst dword [ebx + 0x154]
fst dword [ebx + 0x158]
fstp dword [ebx + 0x15c]
mov dword [ebx + 0x160], 0
mov dword [ebx + 0x164], 0
mov dword [ebx + 0x168], 0
push 1
push 0x24
mov byte [ebp - 4], 7
call dword [sym.imp.PhotoBase.dll_void____cdecl_BasePrivate::New_unsigned_int__bool_]
mov edi, eax
add esp, 8
mov dword [ebp - 0x14], edi
test edi, edi
je 0x100ef04d
mov dword [edi + 4], 0
mov dword [edi + 0x18], 0x100015a8
mov dword [edi + 0x1c], 0
mov dword [edi], 0x10006360
mov eax, dword [edi]
push edi
mov dword [edi + 0x18], 0x1000635c
mov dword [edi + 0x20], 0
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x101c43b0]
call esi
jmp 0x100ef04f
xor edi, edi
mov dword [edi + 4], ebx
mov dword [ebx + 0x34], edi
mov eax, dword [edi]
push edi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x101c43b0]
call esi
mov eax, dword [edi]
push edi
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x101c43b0]
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100f9a48
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x101c308c]
push esi
push edi
test eax, eax
jne 0x100f9a61
call fcn.100f9af6
test eax, eax
je 0x100f9aad
mov eax, dword [0x101c308c]
cmp eax, 1
jne 0x100f9a7d
push 0xd
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x100f9aad
jmp 0x100f9af3
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov ecx, eax
test ecx, ecx
je 0x100f9a96
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, ecx
jmp 0x100f9af3
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x100f9ab1
xor eax, eax
jmp 0x100f9af3
mov eax, dword [esi]
push dword [0x101c308c]
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov edi, eax
test edi, edi
je 0x100f9ad7
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x100f9af3
lea edi, [esi + 0xff0]
push esi
push dword [0x101c308c]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x100f9add
mov eax, esi
pop edi
pop esi
ret

Function at 0x100fa866
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push 0x2000000
xor edi, edi
push edi
push 0x10022ee4
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100fa8d1
push esi
lea eax, [ebp - 8]
push eax
push 0x101bf370
lea eax, [ebp - 0xc]
push eax
push edi
push 0x10022f28
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x100fa8cd
cmp dword [ebp - 0xc], 4
jne 0x100fa8cd
inc edi
mov eax, edi
jmp 0x100fa8d3
xor eax, eax
pop edi
leave
ret 8
Function at 0x100faa44
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
test eax, eax
jne 0x100faa5a
mov eax, 0x8876086c
jmp 0x100faacf
push edi
xor edi, edi
push edi
push 0x10000000
push 3
push edi
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
mov dword [esi], eax
call dword [sym.imp.PhotoBase.dll_void___cdecl_BasePrivate::Delete_void__]
cmp dword [esi], 0xffffffff
pop ecx
je 0x100faac3
push edi
push edi
push edi
push 2
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x100faac3
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x100faac3
test eax, eax
je 0x100faad4
push edi
push edi
push edi
push 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
cmp eax, edi
jne 0x100faad7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x88760b59
pop edi
pop esi
pop ebp
ret 8
mov dword [esi + 8], edi
xor eax, eax
jmp 0x100faace
Function at 0x100fe6e0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x14
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, ecx
mov dword [ebp + 0x14], eax
cmp ecx, eax
jae 0x100fe821
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
lea edx, [ecx + eax*4]
mov eax, dword [ebp + 0x14]
lea esi, [edi + edi]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], ebx
cmp ecx, edx
jae 0x100fe807
lea eax, [ecx + 4]
mov dword [ebp - 4], eax
mov eax, edx
sub eax, ecx
mov ecx, dword [ebp - 4]
dec eax
shr eax, 3
inc eax
mov dword [ebp - 0xc], eax
mov esi, dword [ecx + edi]
mov edx, 0xffc03fc0
mov edi, dword [edi + ecx - 4]
mov eax, esi
mov ebx, dword [ecx - 4]
mov ecx, dword [ecx]
shr eax, 2
and eax, edx
shr ecx, 2
and ecx, edx
add ecx, eax
mov eax, edi
shr eax, 2
and eax, edx
add ecx, eax
mov eax, ebx
shr eax, 2
add ecx, 0xff800080
and edx, eax
mov eax, dword [ebp - 4]
add edx, ecx
mov ecx, dword [eax]
mov eax, esi
and eax, 0xff00ff
shr esi, 2
and ecx, 0xff00ff
and esi, 0x3fc03fc0
add ecx, eax
mov eax, edi
and eax, 0xff00ff
shr edi, 2
add ecx, eax
mov eax, ebx
and eax, 0xff00ff
shr ebx, 2
add ecx, 0x20002
add eax, ecx
mov ecx, dword [ebp - 4]
shr eax, 2
xor edx, eax
and edx, 0xff00ff
mov eax, dword [ecx]
add ecx, 8
shr eax, 2
and eax, 0x3fc03fc0
mov dword [ebp - 4], ecx
add eax, esi
mov esi, 0x3fc03fc0
and edi, esi
and ebx, esi
add edi, 0x800080
add eax, edi
mov edi, dword [ebp + 0x18]
add eax, ebx
xor edx, eax
mov eax, dword [ebp - 8]
mov dword [eax], edx
add eax, 4
sub dword [ebp - 0xc], 1
mov dword [ebp - 8], eax
jne 0x100fe739
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp - 0x14]
add ebx, dword [ebp + 0x1c]
add ecx, esi
add edx, esi
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x10], edx
cmp ecx, eax
jb 0x100fe719
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18
Function at 0x100feb6b
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
push ebx
mov dword [ebp - 0x10], ecx
mov ebx, dword [eax + 0x20]
mov eax, dword [edx + 0x6c]
imul eax, dword [edx + 0x60]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ecx
add eax, ecx
mov dword [ebp - 0x24], eax
cmp ecx, eax
jae 0x100fecab
push esi
push edi
mov eax, dword [edx + 0x68]
mov edi, ecx
mov esi, dword [edx + 0x60]
add esi, ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
lea eax, [ecx + eax*2]
mov dword [ebp - 8], esi
mov dword [ebp - 0x20], eax
cmp ecx, eax
jae 0x100fec8b
mov eax, dword [ebp - 4]
movzx edx, word [esi + 2]
movzx esi, word [esi]
and edx, 0xf81f
movzx edi, word [edi + 2]
movzx ebx, word [eax]
mov eax, esi
and eax, 0xf81f
mov ecx, ebx
and ecx, 0xf81f
add ecx, eax
mov eax, edi
and eax, 0xf81f
add eax, 0x1002
add ecx, eax
mov eax, esi
add edx, ecx
and eax, 0x7e0
mov ecx, ebx
shr edx, 2
and ecx, 0x7e0
add ecx, eax
mov eax, edi
and eax, 0x7e0
add ecx, eax
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 8]
movzx eax, word [ecx + 2]
mov ecx, dword [ebp - 0x1c]
and eax, 0x7e0
add ecx, 0x40
add eax, ecx
mov ecx, 0xf81f
shr eax, 2
and esi, ecx
xor edx, eax
and ebx, ecx
add ebx, esi
and edi, ecx
mov esi, dword [ebp - 8]
add ebx, edi
mov edi, dword [ebp - 4]
and edx, 0x7e0
add edi, 4
mov dword [ebp - 4], edi
movzx eax, word [esi + 2]
add esi, 4
and eax, ecx
mov dword [ebp - 8], esi
add eax, 0x1002
add eax, ebx
shr eax, 2
xor edx, eax
mov eax, dword [ebp - 0xc]
mov word [eax], dx
add eax, 2
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0x20]
jb 0x100febbf
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov edx, dword [eax]
jmp 0x100fec8e
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
add ebx, dword [eax + 0x60]
mov eax, dword [edx + 0x60]
mov dword [ebp - 0x14], ebx
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x18], ecx
cmp ecx, dword [ebp - 0x24]
jb 0x100feb9e
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x100fedbf
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
push ebx
mov dword [ebp - 0x10], ecx
mov ebx, dword [eax + 0x20]
mov eax, dword [edx + 0x6c]
imul eax, dword [edx + 0x60]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ecx
add eax, ecx
mov dword [ebp - 0x24], eax
cmp ecx, eax
jae 0x100fef02
push esi
push edi
mov eax, dword [edx + 0x68]
mov edi, ecx
mov esi, dword [edx + 0x60]
add esi, ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
lea eax, [ecx + eax*2]
mov dword [ebp - 8], esi
mov dword [ebp - 0x20], eax
cmp ecx, eax
jae 0x100feee2
mov eax, dword [ebp - 4]
movzx edx, word [esi + 2]
movzx esi, word [esi]
and edx, 0x7c1f
movzx edi, word [edi + 2]
movzx ebx, word [eax]
mov eax, esi
and eax, 0x7c1f
mov ecx, ebx
and ecx, 0x7c1f
add ecx, eax
mov eax, edi
and eax, 0x7c1f
add eax, 0x802
add ecx, eax
mov eax, esi
add edx, ecx
and eax, 0x83e0
mov ecx, ebx
shr edx, 2
and ecx, 0x83e0
add ecx, eax
mov eax, edi
and eax, 0x83e0
add ecx, eax
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 8]
movzx eax, word [ecx + 2]
mov ecx, dword [ebp - 0x1c]
and eax, 0x83e0
add ecx, 0x10040
add eax, ecx
mov ecx, 0x83e0
shr eax, 2
and esi, ecx
xor edx, eax
and ebx, ecx
add ebx, esi
and edi, ecx
mov esi, dword [ebp - 8]
add ebx, edi
mov edi, dword [ebp - 4]
and edx, 0x7c1f
add edi, 4
mov dword [ebp - 4], edi
movzx eax, word [esi + 2]
add esi, 4
and eax, ecx
mov dword [ebp - 8], esi
add eax, 0x10040
add eax, ebx
shr eax, 2
xor edx, eax
mov eax, dword [ebp - 0xc]
mov word [eax], dx
add eax, 2
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0x20]
jb 0x100fee13
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov edx, dword [eax]
jmp 0x100feee5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
add ebx, dword [eax + 0x60]
mov eax, dword [edx + 0x60]
mov dword [ebp - 0x14], ebx
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x18], ecx
cmp ecx, dword [ebp - 0x24]
jb 0x100fedf2
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x100fef07
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
push ebx
mov dword [ebp - 0x10], ecx
mov ebx, dword [eax + 0x20]
mov eax, dword [edx + 0x6c]
imul eax, dword [edx + 0x60]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ecx
add eax, ecx
mov dword [ebp - 0x24], eax
cmp ecx, eax
jae 0x100ff04a
push esi
push edi
mov eax, dword [edx + 0x68]
mov edi, ecx
mov esi, dword [edx + 0x60]
add esi, ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
lea eax, [ecx + eax*2]
mov dword [ebp - 8], esi
mov dword [ebp - 0x20], eax
cmp ecx, eax
jae 0x100ff02a
mov eax, dword [ebp - 4]
movzx edx, word [esi + 2]
movzx esi, word [esi]
and edx, 0xf0f
movzx edi, word [edi + 2]
movzx ebx, word [eax]
mov eax, esi
and eax, 0xf0f
mov ecx, ebx
and ecx, 0xf0f
add ecx, eax
mov eax, edi
and eax, 0xf0f
add eax, 0x202
add ecx, eax
mov eax, esi
add edx, ecx
and eax, 0xf0f0
mov ecx, ebx
shr edx, 2
and ecx, 0xf0f0
add ecx, eax
mov eax, edi
and eax, 0xf0f0
add ecx, eax
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 8]
movzx eax, word [ecx + 2]
mov ecx, dword [ebp - 0x1c]
and eax, 0xf0f0
add ecx, 0x2020
add eax, ecx
mov ecx, 0xf0f0
shr eax, 2
and esi, ecx
xor edx, eax
and ebx, ecx
add ebx, esi
and edi, ecx
mov esi, dword [ebp - 8]
add ebx, edi
mov edi, dword [ebp - 4]
and edx, 0xf0f
add edi, 4
mov dword [ebp - 4], edi
movzx eax, word [esi + 2]
add esi, 4
and eax, ecx
mov dword [ebp - 8], esi
add eax, 0x2020
add eax, ebx
shr eax, 2
xor edx, eax
mov eax, dword [ebp - 0xc]
mov word [eax], dx
add eax, 2
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0x20]
jb 0x100fef5b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov edx, dword [eax]
jmp 0x100ff02d
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
add ebx, dword [eax + 0x60]
mov eax, dword [edx + 0x60]
mov dword [ebp - 0x14], ebx
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x18], ecx
cmp ecx, dword [ebp - 0x24]
jb 0x100fef3a
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x100ff04f
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
push ebx
mov dword [ebp - 0x14], ecx
mov ebx, dword [eax + 0x20]
mov eax, dword [edx + 0x6c]
imul eax, dword [edx + 0x60]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ecx
add eax, ecx
mov dword [ebp - 0x24], eax
cmp ecx, eax
jae 0x100ff173
push esi
push edi
mov eax, dword [edx + 0x68]
mov edi, ecx
mov esi, dword [edx + 0x60]
add eax, ecx
add esi, ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], eax
cmp ecx, eax
jae 0x100ff153
movzx edx, byte [esi + 1]
mov eax, dword [ebp - 4]
movzx esi, byte [esi]
movzx edi, byte [edi + 1]
mov dword [ebp - 8], edx
and edx, 0xe3
movzx ebx, byte [eax]
mov eax, esi
and eax, 0xe3
mov ecx, ebx
and ecx, 0xe3
add ecx, eax
mov eax, edi
and eax, 0xe3
add eax, 0x42
add ecx, eax
mov eax, esi
and eax, 0x1c
add edx, ecx
mov ecx, ebx
shr edx, 2
and ecx, 0x1c
add ecx, eax
mov eax, edi
and eax, 0x1c
add ecx, eax
mov eax, dword [ebp - 8]
and eax, 0x1c
add eax, 8
add eax, ecx
mov ecx, 0xe3
shr eax, 2
and esi, ecx
xor dl, al
and ebx, ecx
mov eax, dword [ebp - 8]
add ebx, esi
mov esi, dword [ebp - 0x10]
and eax, ecx
and edi, ecx
add eax, 0x42
add ebx, edi
and dl, 0x1c
mov edi, dword [ebp - 4]
add eax, ebx
shr eax, 2
add edi, 2
xor dl, al
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0xc]
add esi, 2
mov dword [ebp - 0x10], esi
mov byte [eax], dl
inc eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0x20]
jb 0x100ff0a2
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov edx, dword [eax]
jmp 0x100ff156
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
add ebx, dword [eax + 0x60]
mov eax, dword [edx + 0x60]
mov dword [ebp - 0x18], ebx
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x1c], ecx
cmp ecx, dword [ebp - 0x24]
jb 0x100ff082
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x100ff216
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
push ebx
mov dword [ebp - 0x10], ecx
mov ebx, dword [eax + 0x20]
mov eax, dword [edx + 0x6c]
imul eax, dword [edx + 0x60]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ecx
add eax, ecx
mov dword [ebp - 0x24], eax
cmp ecx, eax
jae 0x100ff357
push esi
push edi
mov eax, dword [edx + 0x68]
mov edi, ecx
mov esi, dword [edx + 0x60]
add esi, ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
lea eax, [ecx + eax*2]
mov dword [ebp - 8], esi
mov dword [ebp - 0x20], eax
cmp ecx, eax
jae 0x100ff337
mov eax, dword [ebp - 4]
movzx edx, word [esi + 2]
movzx esi, word [esi]
and edx, 0xe3
movzx edi, word [edi + 2]
movzx ebx, word [eax]
mov eax, esi
and eax, 0xe3
mov ecx, ebx
and ecx, 0xe3
add ecx, eax
mov eax, edi
and eax, 0xe3
add eax, 0x42
add ecx, eax
mov eax, esi
add edx, ecx
and eax, 0xff1c
mov ecx, ebx
shr edx, 2
and ecx, 0xff1c
add ecx, eax
mov eax, edi
and eax, 0xff1c
add ecx, eax
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 8]
movzx eax, word [ecx + 2]
mov ecx, dword [ebp - 0x1c]
and eax, 0xff1c
add ecx, 0x208
add eax, ecx
mov ecx, 0xff1c
shr eax, 2
and esi, ecx
xor edx, eax
and ebx, ecx
add ebx, esi
and edi, ecx
mov esi, dword [ebp - 8]
add ebx, edi
mov edi, dword [ebp - 4]
and edx, 0xe3
add edi, 4
mov dword [ebp - 4], edi
movzx eax, word [esi + 2]
add esi, 4
and eax, ecx
mov dword [ebp - 8], esi
add eax, 0x208
add eax, ebx
shr eax, 2
xor edx, eax
mov eax, dword [ebp - 0xc]
mov word [eax], dx
add eax, 2
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0x20]
jb 0x100ff26a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov edx, dword [eax]
jmp 0x100ff33a
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
add ebx, dword [eax + 0x60]
mov eax, dword [edx + 0x60]
mov dword [ebp - 0x14], ebx
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x18], ecx
cmp ecx, dword [ebp - 0x24]
jb 0x100ff249
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret