joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100153e4
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0xc], ecx
mov eax, dword [0x1004a598]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + 0x14]
add edi, 0x14
mov eax, dword [esi + 0x10]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x100154a6
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x100154a6
cmp word [eax + ecx + 0x14], 0x60
jb 0x100154a6
cmp dword [eax + ecx + 0x74], 0
je 0x100154a6
mov edx, dword [eax + ecx + 0x78]
mov ecx, edx
mov dword [esp], edx
test edx, edx
je 0x100154a6
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x18]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x100154a6
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x20]
add ecx, eax
mov dword [esp + 8], ecx
lea ecx, [eax + 1]
mov dword [esp + 4], ecx
xor ebx, ebx
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + ebx*4]
mov dl, byte [eax + ecx]
test dl, dl
je 0x1001548e
add ecx, dword [esp + 4]
mov ebp, 0x811c9dc5
movsx edx, dl
xor edx, ebp
imul ebp, edx, 0x1000193
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x1001547a
jmp 0x10015493
mov ebp, 0x811c9dc5
cmp ebp, dword [esp + 0xc]
je 0x100154a2
inc ebx
cmp ebx, dword [esp + 0x10]
jne 0x10015463
jmp 0x100154a6
test eax, eax
jne 0x100154ba
mov esi, dword [esi]
cmp esi, edi
jne 0x10015400
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp]
mov ecx, dword [eax + edx + 0x24]
add ecx, eax
mov edx, dword [eax + edx + 0x1c]
add edx, eax
movzx ecx, word [ecx + ebx*2]
add eax, dword [edx + ecx*4]
jmp 0x100154b2

Function at 0x1001568c
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x28]
mov ecx, dword [0x1004a5d4]
test ecx, ecx
jne 0x10015756
mov esi, dword [0x1004a5cc]
test esi, esi
jne 0x100156be
mov ecx, 0xf8f45725
call fcn.10015761
mov esi, eax
mov dword [0x1004a5cc], eax
mov dword [esp + 0xe], 0x79784c7c
mov dword [esp + 0x12], 0x60437f63
mov word [esp + 0x16], 0x7474
mov byte [esp + 0x18], 0
mov word [esp + 0xc], 0x6253
xor eax, eax
inc eax
mov ecx, eax
add cl, 6
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xc
jne 0x100156e4
mov byte [esp + 0x18], 0
mov ecx, dword [0x1004a5d0]
test ecx, ecx
jne 0x10015713
mov ecx, 0x53b2070f
call fcn.10015761
mov ecx, eax
mov dword [0x1004a5d0], eax
mov dword [esp + 2], 0x676f677a
mov word [esp + 6], 0x3f3f
mov byte [esp + 8], 0
mov word [esp], 0x626b
xor eax, eax
inc eax
mov edx, eax
add dl, 6
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10015730
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a5d4], eax
push edi
call ecx
add esp, 0x1c
pop esi
pop edi
ret 4
Function at 0x10015761
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0xc], ecx
mov eax, dword [0x1004a5c8]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + 0x14]
add edi, 0x14
mov eax, dword [esi + 0x10]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x10015823
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x10015823
cmp word [eax + ecx + 0x14], 0x60
jb 0x10015823
cmp dword [eax + ecx + 0x74], 0
je 0x10015823
mov edx, dword [eax + ecx + 0x78]
mov ecx, edx
mov dword [esp], edx
test edx, edx
je 0x10015823
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x18]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x10015823
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x20]
add ecx, eax
mov dword [esp + 8], ecx
lea ecx, [eax + 1]
mov dword [esp + 4], ecx
xor ebx, ebx
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + ebx*4]
mov dl, byte [eax + ecx]
test dl, dl
je 0x1001580b
add ecx, dword [esp + 4]
mov ebp, 0x811c9dc5
movsx edx, dl
xor edx, ebp
imul ebp, edx, 0x1000193
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x100157f7
jmp 0x10015810
mov ebp, 0x811c9dc5
cmp ebp, dword [esp + 0xc]
je 0x1001581f
inc ebx
cmp ebx, dword [esp + 0x10]
jne 0x100157e0
jmp 0x10015823
test eax, eax
jne 0x10015837
mov esi, dword [esi]
cmp esi, edi
jne 0x1001577d
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp]
mov ecx, dword [eax + edx + 0x24]
add ecx, eax
mov edx, dword [eax + edx + 0x1c]
add edx, eax
movzx ecx, word [ecx + ebx*2]
add eax, dword [edx + ecx*4]
jmp 0x1001582f
Function at 0x1001585c
Capabilities:
Match known plugx module

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x644
mov edi, dword [esp + 0x65c]
lea eax, [edi + 0x10]
push 0x340
push 0
push eax
call fcn.10013ed4
add esp, 0xc
mov dword [esp], 0x340
mov bp, 0x41
lea esi, [esp + 0x44]
xor ebx, ebx
mov dword [edi + ebx + 0x10], 1
mov word [esp + 4], bp
mov dword [esp + 6], 0x3a
push 0x100
push esi
lea eax, [esp + 0xc]
push eax
call fcn.10015a28
test eax, eax
je 0x100159e1
movups xmm0, xmmword [0x1003fd2e]
movups xmmword [esp + 0x32], xmm0
movups xmm0, xmmword [str.DeviceFloppy]
movups xmmword [esp + 0x24], xmm0
lea esi, [esp + 0x24]
push esi
call fcn.10002bee
add eax, eax
push eax
push esi
lea esi, [esp + 0x4c]
push esi
call fcn.10001bfa
add esp, 0xc
test eax, eax
je 0x100159e1
mov dword [esp + 8], 0x5c
mov esi, edi
lea edi, [esp + 4]
push edi
call fcn.10015af4
mov edi, esi
mov dword [esi + ebx + 0x10], eax
cmp eax, 1
je 0x100159dd
xor eax, eax
mov word [esp + 0x444], ax
mov word [esp + 0x244], ax
sub esp, 0x20
lea eax, [esp + 0x264]
mov dword [esp + 0x18], eax
movaps xmm0, xmmword [0x1003fc40]
movups xmmword [esp + 8], xmm0
lea eax, [esp + 0x464]
mov dword [esp + 4], eax
lea esi, [esp + 0x24]
mov dword [esp], esi
mov dword [esp + 0x1c], 0x200
call fcn.10015bc6
test eax, eax
je 0x10015982
lea eax, [edi + ebx]
add eax, 0x24
lea ecx, [edi + ebx + 0x14]
lea edx, [edi + ebx + 0x1c]
push eax
push ecx
push edx
push esi
call fcn.10015cd0
mov esi, dword [esp]
mov word [edi + ebx + 0x2e], si
lea eax, [edi + esi]
add eax, 0x10
lea ecx, [esp + 0x244]
push ecx
mov ecx, 0x1003fd5e
push ecx
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [esi + eax*2]
lea eax, [esi + eax*2]
add eax, 2
mov word [edi + ebx + 0x2c], ax
lea eax, [edi + ecx + 0x12]
mov esi, ecx
lea ecx, [esp + 0x444]
push ecx
mov ecx, 0x1003fd5e
push ecx
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esi + eax*2]
add eax, 4
mov dword [esp], eax
lea esi, [esp + 0x44]
add ebx, 0x20
inc ebp
cmp ebx, 0x340
jne 0x10015891
mov dword [edi], 0x20190301
mov dword [edi + 4], 0x3000
mov eax, dword [esp]
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0
mov ecx, dword [esp + 0x658]
push 0x7530
push edi
call fcn.100241f0
add esp, 0x644
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10015a28
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebp, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov ecx, dword [0x1004a5e4]
test ecx, ecx
jne 0x10015ae5
mov esi, dword [0x1004a5dc]
test esi, esi
jne 0x10015a64
mov ecx, 0xf8f45725
call fcn.1001717e
mov esi, eax
mov dword [0x1004a5dc], eax
movaps xmm0, xmmword [0x1003fc50]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x70
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xf
jne 0x10015a73
mov byte [esp + 0x1b], 0
mov ecx, dword [0x1004a5e0]
test ecx, ecx
jne 0x10015aa2
mov ecx, 0x53b2070f
call fcn.1001717e
mov ecx, eax
mov dword [0x1004a5e0], eax
mov dword [esp + 2], 0x19111d00
mov word [esp + 6], 0x4545
mov byte [esp + 8], 0
mov word [esp], 0x146b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x70
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10015abf
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a5e4], eax
push ebp
push ebx
push edi
call ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x10015af4
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x28]
mov ecx, dword [0x1004a5e8]
test ecx, ecx
jne 0x10015bba
mov esi, dword [0x1004a5dc]
test esi, esi
jne 0x10015b26
mov ecx, 0xf8f45725
call fcn.1001717e
mov esi, eax
mov dword [0x1004a5dc], eax
mov dword [esp + 0xe], 0x1c063706
mov dword [esp + 0x12], 0x2c1200
mov dword [esp + 0x16], 0x2b1e0a
mov word [esp + 0xc], 0x1447
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x70
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xd
jne 0x10015b48
mov byte [esp + 0x19], 0
mov ecx, dword [0x1004a5e0]
test ecx, ecx
jne 0x10015b77
mov ecx, 0x53b2070f
call fcn.1001717e
mov ecx, eax
mov dword [0x1004a5e0], eax
mov dword [esp + 2], 0x19111d00
mov word [esp + 6], 0x4545
mov byte [esp + 8], 0
mov word [esp], 0x146b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x70
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10015b94
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a5e8], eax
push edi
call ecx
add esp, 0x1c
pop esi
pop edi
ret 4
Function at 0x10015bc6
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x54]
mov ebx, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
mov edi, dword [esp + 0x48]
mov ebp, dword [esp + 0x44]
mov esi, dword [esp + 0x40]
mov ecx, dword [0x1004a5ec]
test ecx, ecx
jne 0x10015cb6
mov esi, dword [0x1004a5dc]
test esi, esi
jne 0x10015c0e
mov ecx, 0xf8f45725
call fcn.1001717e
mov esi, eax
mov dword [0x1004a5dc], eax
mov dword [esp + 0x1c], 0xedede8f4
mov word [esp + 0x20], 0xd3
movaps xmm0, xmmword [0x1003fc60]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x70
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x15
jne 0x10015c2c
mov byte [esp + 0x21], 0
mov ecx, dword [0x1004a5e0]
test ecx, ecx
jne 0x10015c5b
mov ecx, 0x53b2070f
call fcn.1001717e
mov ecx, eax
mov dword [0x1004a5e0], eax
mov dword [esp + 2], 0x19111d00
mov word [esp + 6], 0x4545
mov byte [esp + 8], 0
mov word [esp], 0x146b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x70
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10015c78
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a5ec], eax
mov esi, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
mov ebx, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x4c]
push eax
push ebx
push edx
push edi
push ebp
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
call ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x20

Function at 0x10015cd0
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ecx, dword [0x1004a5f0]
test ecx, ecx
jne 0x10015d9d
mov esi, dword [0x1004a5dc]
test esi, esi
jne 0x10015d10
mov ecx, 0xf8f45725
call fcn.1001717e
mov esi, eax
mov dword [0x1004a5dc], eax
mov dword [esp + 0x1c], 0xd5f9c5
movaps xmm0, xmmword [0x1003fc70]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x70
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x13
jne 0x10015d27
mov byte [esp + 0x1f], 0
mov ecx, dword [0x1004a5e0]
test ecx, ecx
jne 0x10015d56
mov ecx, 0x53b2070f
call fcn.1001717e
mov ecx, eax
mov dword [0x1004a5e0], eax
mov dword [esp + 2], 0x19111d00
mov word [esp + 6], 0x4545
mov byte [esp + 8], 0
mov word [esp], 0x146b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x70
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10015d73
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a5f0], eax
mov eax, dword [esp + 0x34]
push edi
push ebp
push ebx
push eax
call ecx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x10016546
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x38]
mov ebp, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x1004a5f4]
test ecx, ecx
jne 0x1001661d
mov esi, dword [0x1004a5dc]
test esi, esi
jne 0x10016586
mov ecx, 0xf8f45725
call fcn.1001717e
mov esi, eax
mov dword [0x1004a5dc], eax
mov dword [esp + 0xe], 0x191d3506
mov dword [esp + 0x12], 0x14112313
mov word [esp + 0x16], 0x1f
mov word [esp + 0xc], 0x1447
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x70
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xb
jne 0x100165a7
mov byte [esp + 0x17], 0
mov ecx, dword [0x1004a5e0]
test ecx, ecx
jne 0x100165d6
mov ecx, 0x53b2070f
call fcn.1001717e
mov ecx, eax
mov dword [0x1004a5e0], eax
mov dword [esp + 2], 0x19111d00
mov word [esp + 6], 0x4545
mov byte [esp + 8], 0
mov word [esp], 0x146b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x70
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x100165f3
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a5f4], eax
mov eax, dword [esp + 0x2c]
push edi
push ebp
push ebx
push eax
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x1001662e
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x28]
mov ecx, dword [0x1004a5f8]
test ecx, ecx
jne 0x100166f8
mov esi, dword [0x1004a5dc]
test esi, esi
jne 0x10016660
mov ecx, 0xf8f45725
call fcn.1001717e
mov esi, eax
mov dword [0x1004a5dc], eax
mov dword [esp + 0xe], 0x111a3606
mov dword [esp + 0x12], 0x103e1139
mov word [esp + 0x16], 0x1e16
mov byte [esp + 0x18], 0
mov word [esp + 0xc], 0x1453
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x70
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xc
jne 0x10016686
mov byte [esp + 0x18], 0
mov ecx, dword [0x1004a5e0]
test ecx, ecx
jne 0x100166b5
mov ecx, 0x53b2070f
call fcn.1001717e
mov ecx, eax
mov dword [0x1004a5e0], eax
mov dword [esp + 2], 0x19111d00
mov word [esp + 6], 0x4545
mov byte [esp + 8], 0
mov word [esp], 0x146b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x70
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x100166d2
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a5f8], eax
push edi
call ecx
add esp, 0x1c
pop esi
pop edi
ret 4
Function at 0x10016704
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x2c]
mov ecx, dword [0x1004a5fc]
test ecx, ecx
jne 0x100167bc
mov esi, dword [0x1004a5dc]
test esi, esi
jne 0x10016736
mov ecx, 0xf8f45725
call fcn.1001717e
mov esi, eax
mov dword [0x1004a5dc], eax
mov byte [esp + 0x1c], 0
movaps xmm0, xmmword [0x1003fcb0]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x70
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x10
jne 0x1001674a
mov byte [esp + 0x1c], 0
mov ecx, dword [0x1004a5e0]
test ecx, ecx
jne 0x10016779
mov ecx, 0x53b2070f
call fcn.1001717e
mov ecx, eax
mov dword [0x1004a5e0], eax
mov dword [esp + 2], 0x19111d00
mov word [esp + 6], 0x4545
mov byte [esp + 8], 0
mov word [esp], 0x146b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x70
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10016796
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a5fc], eax
push edi
call ecx
add esp, 0x20
pop esi
pop edi
ret 4

Function at 0x100167c8
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x38]
mov ebp, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x1004a600]
test ecx, ecx
jne 0x1001689f
mov esi, dword [0x1004a5dc]
test esi, esi
jne 0x10016808
mov ecx, 0xf8f45725
call fcn.1001717e
mov esi, eax
mov dword [0x1004a5dc], eax
mov dword [esp + 0xe], 0x191d3506
mov dword [esp + 0x12], 0x14112313
mov word [esp + 0x16], 0x1f
mov word [esp + 0xc], 0x1453
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x70
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xb
jne 0x10016829
mov byte [esp + 0x17], 0
mov ecx, dword [0x1004a5e0]
test ecx, ecx
jne 0x10016858
mov ecx, 0x53b2070f
call fcn.1001717e
mov ecx, eax
mov dword [0x1004a5e0], eax
mov dword [esp + 2], 0x19111d00
mov word [esp + 6], 0x4545
mov byte [esp + 8], 0
mov word [esp], 0x146b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x70
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10016875
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a600], eax
mov eax, dword [esp + 0x2c]
push edi
push ebp
push ebx
push eax
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x10016a9e
Capabilities:
Match known plugx module

Disassembly:
push edi
push esi
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0xc]
lea eax, [edi + 0x10]
push 0
push eax
call fcn.10016ae8
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x10016ac0
call fcn.100013b0
mov dword [edi], 0x20190301
mov dword [edi + 4], 0x300a
mov dword [edi + 0xc], eax
mov dword [edi + 8], 0
mov ecx, esi
push 0x7530
push edi
call fcn.100241f0
pop esi
pop edi
ret
Function at 0x10016ae8
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov ecx, dword [0x1004a604]
test ecx, ecx
jne 0x10016ba5
mov esi, dword [0x1004a5dc]
test esi, esi
jne 0x10016b1f
mov ecx, 0xf8f45725
call fcn.1001717e
mov esi, eax
mov dword [0x1004a5dc], eax
mov byte [esp + 0x1c], 0
movaps xmm0, xmmword [0x1003fce0]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x70
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x10
jne 0x10016b33
mov byte [esp + 0x1c], 0
mov ecx, dword [0x1004a5e0]
test ecx, ecx
jne 0x10016b62
mov ecx, 0x53b2070f
call fcn.1001717e
mov ecx, eax
mov dword [0x1004a5e0], eax
mov dword [esp + 2], 0x19111d00
mov word [esp + 6], 0x4545
mov byte [esp + 8], 0
mov word [esp], 0x146b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x70
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10016b7f
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a604], eax
push ebx
push edi
call ecx
add esp, 0x20
pop esi
pop edi
pop ebx
ret 8

Function at 0x10016bb2
Capabilities:
Match known plugx module

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
lea eax, [ebx + 0x10]
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], edi
movaps xmm0, xmmword [0x1003fcf0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call fcn.100012a6
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x10016c01
test eax, eax
jne 0x10016bf6
call fcn.100013b0
mov edi, eax
jmp 0x10016c01
mov dword [esp], eax
call fcn.1000164e
sub esp, 4
mov dword [ebx], 0x20190301
mov dword [ebx + 4], 0x300b
mov dword [ebx + 0xc], edi
mov dword [ebx + 8], 0
mov dword [esp], ebx
mov dword [esp + 4], 0x7530
mov ecx, esi
call fcn.100241f0
add esp, 0x14
pop esi
pop edi
pop ebx
ret

Function at 0x10016c32
Capabilities:
Match known plugx module

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
xor ebx, ebx
mov eax, esp
mov dword [eax], ebx
mov ecx, dword [edi + 0x10]
mov dword [eax + 4], ecx
movzx ecx, word [edi + 0x14]
mov word [eax + 0x10], cx
movzx ecx, word [edi + 0x18]
lea ecx, [edi + ecx + 0x10]
mov dword [eax + 8], ecx
movzx ecx, word [edi + 0x1a]
lea ecx, [edi + ecx + 0x10]
mov dword [eax + 0xc], ecx
mov dword [eax + 0x1a], str.SHOPT
mov dword [eax + 0x12], ebx
mov dword [eax + 0x16], ebx
push eax
call fcn.10016ca4
mov dword [edi], 0x20190301
mov dword [edi + 4], 0x300d
mov dword [edi + 0xc], eax
mov dword [edi + 8], ebx
mov ecx, esi
push 0x7530
push edi
call fcn.100241f0
add esp, 0x20
pop esi
pop edi
pop ebx
ret
Function at 0x10016ca4
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x28]
mov ecx, dword [0x1004a608]
test ecx, ecx
jne 0x10016d57
mov esi, dword [0x1004a5dc]
test esi, esi
jne 0x10016cd6
mov ecx, 0xf8f45725
call fcn.1001717e
mov esi, eax
mov dword [0x1004a5dc], eax
mov byte [esp + 0x18], 0
movaps xmm0, xmmword [0x1003fd00]
movups xmmword [esp + 8], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x70
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0x10
jne 0x10016cea
mov byte [esp + 0x18], 0
mov ecx, dword [0x1004a5e0]
test ecx, ecx
jne 0x10016d19
mov ecx, 0x53b2070f
call fcn.1001717e
mov ecx, eax
mov dword [0x1004a5e0], eax
mov dword [esp + 2], 0x46181f17
mov word [esp + 6], 0x44
mov word [esp], 0x1973
xor eax, eax
inc eax
mov edx, eax
add dl, 0x70
xor byte [esp + eax], dl
inc eax
cmp eax, 7
jne 0x10016d31
mov eax, esp
mov byte [eax + 7], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a608], eax
push edi
call ecx
add esp, 0x1c
pop esi
pop edi
ret 4

Function at 0x10016ec2
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x40]
mov ebx, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x1004a60c]
test ecx, ecx
jne 0x10016fa8
mov esi, dword [0x1004a5dc]
test esi, esi
jne 0x10016f0a
mov ecx, 0xf8f45725
call fcn.1001717e
mov esi, eax
mov dword [0x1004a5dc], eax
mov dword [esp + 0xa], 0x10001217
mov dword [esp + 0xe], 0x120b1232
mov dword [esp + 0x12], 0x2a0c140e
mov byte [esp + 0x16], 0
mov word [esp + 8], 0x343
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x70
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0xe
jne 0x10016f31
mov byte [esp + 0x16], 0
mov ecx, dword [0x1004a5e0]
test ecx, ecx
jne 0x10016f60
mov ecx, 0x53b2070f
call fcn.1001717e
mov ecx, eax
mov dword [0x1004a5e0], eax
mov dword [esp + 2], 0x47470117
mov byte [esp + 6], 0
mov word [esp], 0x275
xor eax, eax
inc eax
mov edx, eax
add dl, 0x70
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x10016f76
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a60c], eax
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
push ebp
push ebx
push edi
push esi
push edx
push eax
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0x18