joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10156c80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], esi
movzx edx, byte [ebx + 6]
mov dword [ebp - 4], ebx
movzx eax, byte [edi + 0x84]
movzx ecx, byte [edi + 0x85]
mov dword [esi + 0x38], eax
sub ecx, edx
mov eax, dword [edi + 0x6c]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x70]
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x74]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x78]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x7c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x80]
mov edi, 1
mov dword [esi + 0x30], eax
mov byte [esi + 5], 1
mov byte [esi + 6], cl
mov byte [esi + 7], dl
mov byte [esi + 0xc], 1
mov word [esi + 0x11], 0x1ff
mov byte [esi + 0x13], cl
mov byte [esi + 0x14], dl
movzx eax, byte [ebx + 0x1d]
mov dword [esi], eax
mov byte [esi + 0x16], 1
cmp dword [esi + 0x34], 2
jne 0x10156d08
lea ebx, [edi + 0xb]
jmp 0x10156d0a
xor ebx, ebx
mov eax, dword [ebp - 4]
cmp byte [eax + 0x19], 0
jne 0x10156d1a
add ebx, ebx
mov edi, 2
xor eax, eax
cmp dword [esi], eax
jle 0x10156d43
mov ecx, dword [ebp + 8]
lea edx, [esi + 0x6c]
cmp word [ecx + eax*2], bx
jle 0x10156d38
mov ecx, edi
neg ecx
mov word [edx], cx
mov ecx, dword [ebp + 8]
jmp 0x10156d3b
mov word [edx], di
inc eax
add edx, 2
cmp eax, dword [esi]
jl 0x10156d26
mov eax, dword [ebp - 4]
xor ecx, ecx
mov byte [esi + 0x1b], 1
cmp byte [eax + 0x1e], cl
jbe 0x10156d75
lea edx, [esi + 0x24c]
mov esi, eax
lea esp, [esp]
xor eax, eax
lea edx, [edx + 2]
mov word [edx - 2], ax
inc ecx
movzx eax, byte [esi + 0x1e]
cmp ecx, eax
jl 0x10156d60
mov esi, dword [ebp - 8]
push 0x30
lea eax, [esi + 0x3c]
push 0
push eax
call fcn.102dad40
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10157030
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
mov ecx, 1
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
sub ecx, edx
cmp dword [eax], ebx
jle 0x1015709b
push esi
push edi
lea edi, [eax + 0x6c]
lea esp, [esp]
movsx esi, word [edi]
lea edi, [edi + 2]
mov edx, esi
mov eax, esi
and edx, ecx
neg edx
sbb edx, edx
sar eax, cl
and edx, 0x1a82
add eax, 0x17
add edx, 0x4000
and esi, ecx
xor dx, ax
mov eax, dword [ebp - 4]
and dx, 0x3f
neg esi
sbb esi, esi
inc ebx
and esi, 0x1a82
add esi, 0x4000
xor dx, si
mov word [edi - 2], dx
cmp ebx, dword [eax]
jl 0x10157050
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10162f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0xc]
push esi
xor esi, esi
sub ecx, eax
mov dword [ebp + 0xc], ecx
je 0x10162fdf
push ebx
push edi
test edx, edx
je 0x10162f9f
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
cmp edi, ecx
jge 0x10162fdd
sub dword [ebp - 4], edx
lea ebx, [eax*4]
lea eax, [edx + edi*4]
mov dword [ebp - 0x10], ebx
sub ecx, edi
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
lea esp, [esp]
mov ecx, dword [ebp + 0xc]
mov dword [ebp + 8], ecx
mov ecx, dword [ebp - 4]
mov edi, dword [ecx + eax]
add edi, ebx
mov ebx, dword [eax]
add ebx, dword [ebp - 0x10]
mov eax, dword [ebx]
lea edi, [edi + 4]
mov edx, dword [edi - 4]
lea ebx, [ebx + 4]
mov ecx, eax
sar ecx, 0x1f
xor ecx, eax
mov eax, edx
sar eax, 0x1f
xor eax, edx
or ecx, eax
or esi, ecx
dec dword [ebp + 8]
jne 0x10162f63
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
add eax, 4
dec dword [ebp - 0xc]
mov dword [ebp - 8], eax
jne 0x10162f50
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0x10]
cmp ebx, dword [ebp + 0x14]
jge 0x10162fdd
lea edx, [eax*4]
mov dword [ebp + 8], edx
mov eax, dword [ebp - 4]
mov edi, ecx
mov eax, dword [eax + ebx*4]
add eax, edx
jmp 0x10162fc0
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
sar ecx, 0x1f
xor ecx, edx
or esi, ecx
dec edi
jne 0x10162fc0
mov ecx, dword [ebp + 0xc]
inc ebx
mov edx, dword [ebp + 8]
cmp ebx, dword [ebp + 0x14]
jl 0x10162fb1
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1016c870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], ecx
push edi
lea ebx, [edx - 1]
mov dword [ebp - 8], ebx
lea edi, [esi + 1]
cmp ebx, edi
jle 0x1016c8d4
sar edx, 1
lea ecx, [ecx]
mov eax, edx
xor esi, eax
test esi, eax
jne 0x1016c8a0
sar eax, 1
xor esi, eax
test esi, eax
je 0x1016c898
cmp esi, edi
jle 0x1016c8cf
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [ecx + edi*8]
mov eax, dword [eax + esi*8]
mov dword [ebx + edi*8], eax
mov eax, ebx
mov dword [eax + esi*8], ecx
mov ecx, dword [eax + edi*8 + 4]
mov eax, dword [eax + esi*8 + 4]
mov dword [ebx + edi*8 + 4], eax
mov eax, ebx
mov ebx, dword [ebp - 8]
mov dword [eax + esi*8 + 4], ecx
mov ecx, eax
inc edi
cmp edi, ebx
jl 0x1016c890
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101842e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x30]
xor dl, dl
shr ax, 3
push esi
mov esi, dword [esp + 0x28]
movzx eax, ax
mov dword [esp + 8], eax
xor al, al
mov byte [esp + 0x37], dl
mov byte [esp + 0x17], al
cmp byte [esi + 2], al
jbe 0x1018449e
push edi
lea ecx, [ecx]
movzx ecx, al
xor dh, dh
mov byte [esp + 0x23], dh
mov dword [esp + 0x14], ecx
cmp byte [ecx + esi + 5], dh
jbe 0x1018448e
xor al, al
mov byte [esp + 0x1f], al
cmp byte [esi], al
jbe 0x10184474
mov edx, dword [esp + 0x14]
mov ecx, edx
shl ecx, 4
sub ecx, edx
shl ecx, 3
mov dword [esp + 8], ecx
jmp 0x10184350
movzx edi, al
mov dword [esp + 0x10], edi
lea eax, [edi + ecx]
movzx eax, byte [eax + esi + 0x1aba]
sub eax, 0xe
je 0x1018436e
dec eax
jne 0x10184456
mov eax, dword [esp + 0x28]
movsd xmm0, qword [0x10336188]
mov byte [edi + eax + 0x27f0], 0
imul eax, edx, 0x33
mov byte [edi + esi + 0x27f0], 0
add eax, edi
movsx eax, word [esi + eax*2 + 0x1e84]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mulsd xmm1, qword [0x1033d2b8]
call fcn.102ddfd0
movzx edi, word [esi + edi*2 + 0x790]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
jmp 0x101843c0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x28]
movzx eax, word [esi + eax*2 + 0x792]
movzx ecx, word [edx + 0x7f8]
cmp ax, cx
jb 0x101843de
mov eax, ecx
movzx ecx, di
cmp ecx, eax
jge 0x1018444e
mov eax, dword [esp + 0xc]
movzx esi, byte [esp + 0x3b]
push dword [esp + 0x1f]
movzx eax, ax
push dword [esp + 0x1f]
imul esi, eax
mov eax, dword [esp + 0x38]
push edx
add esi, ecx
movss xmm0, dword [eax + esi*4]
mov eax, dword [esp + 0x40]
mulss xmm0, xmm1
movss dword [eax + esi*4], xmm0
call fcn.101842a0
push dword [esp + 0x2b]
mov dl, al
push dword [esp + 0x2b]
push dword [esp + 0x40]
call fcn.101844b0
add esp, 0x18
cmp al, dl
je 0x10184444
mov eax, dword [esp + 0x34]
xorps xmm0, xmmword [0x10346fd0]
movss dword [eax + esi*4], xmm0
mov esi, dword [esp + 0x2c]
inc edi
jmp 0x101843c0
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x14]
mov al, byte [esp + 0x1f]
add al, 1
mov byte [esp + 0x1f], al
cmp al, byte [esi]
jb 0x10184350
mov dl, byte [esp + 0x3b]
mov ecx, dword [esp + 0x14]
mov dh, byte [esp + 0x23]
inc dh
inc dl
mov byte [esp + 0x3b], dl
mov byte [esp + 0x23], dh
cmp dh, byte [ecx + esi + 5]
jb 0x10184327
mov al, byte [esp + 0x1b]
add al, 1
mov byte [esp + 0x1b], al
cmp al, byte [esi + 2]
jb 0x10184310
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x10196c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x48
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ecx*4]
mov dword [esp + 0x14], eax
mov eax, dword [edi]
cmp dword [eax + ecx*4], 0
jne 0x10196e4a
mov eax, dword [edi + 4]
mov esi, 1
shl esi, cl
mov dword [esp + 0x20], esi
mov eax, dword [eax + ecx*4]
movd xmm0, esi
pshufd xmm0, xmm0, 0
movdqa xmmword [esp + 0x30], xmm0
test eax, eax
je 0x10196ca5
push eax
call fcn.102d6d32
add esp, 4
mov eax, esi
cdq
sub eax, edx
mov esi, eax
sar esi, 1
shl esi, 2
push esi
call fcn.102d6fbe
mov ecx, dword [edi]
mov edi, dword [ebp + 0xc]
push esi
mov dword [ecx + edi*4], eax
call fcn.102d6fbe
mov edx, dword [ebp + 8]
add esp, 8
xor esi, esi
mov ecx, dword [edx + 4]
mov dword [ecx + edi*4], eax
mov edi, dword [esp + 0x20]
sar edi, 1
mov dword [esp + 0x2c], edi
test edi, edi
jle 0x10196e4a
mov ecx, dword [esp + 0x14]
cmp edi, 2
jb 0x10196dc1
mov eax, dword [edx]
mov eax, dword [eax + ecx]
mov dword [esp + 0x10], eax
mov eax, dword [edx + 4]
lea edx, [edi - 1]
mov eax, dword [eax + ecx]
mov dword [esp + 0x18], eax
lea edx, [eax + edx*4]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], edx
mov edx, dword [ebp + 8]
lea eax, [eax + edi*4]
add eax, 0xfffffffc
cmp dword [esp + 0x18], eax
ja 0x10196d30
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x10]
jae 0x10196dc1
mov eax, edi
and eax, 0x80000001
jns 0x10196d3e
dec eax
or eax, 0xfffffffe
inc eax
cvtdq2pd xmm1, qword [esp + 0x30]
mov ecx, edi
sub ecx, eax
mov dword [esp + 0x28], ecx
mov edi, ecx
movaps xmmword [esp + 0x40], xmm1
movd xmm0, esi
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x103d56a0]
cvtdq2pd xmm0, xmm0
mulpd xmm0, xmmword [0x10366170]
divpd xmm0, xmm1
movaps xmmword [esp + 0x30], xmm0
call fcn.102df890
mov eax, dword [esp + 0x10]
cvtpd2ps xmm1, xmm0
movaps xmm0, xmmword [esp + 0x30]
movsd qword [eax + esi*4], xmm1
call fcn.102df8a0
xorpd xmm0, xmmword [0x103592e0]
mov eax, dword [esp + 0x18]
movaps xmm1, xmmword [esp + 0x40]
cvtpd2ps xmm0, xmm0
movsd qword [eax + esi*4], xmm0
add esi, 2
cmp esi, edi
jl 0x10196d53
mov edi, dword [esp + 0x2c]
mov edx, dword [ebp + 8]
mov ecx, dword [esp + 0x14]
cmp esi, edi
jge 0x10196e4a
mov eax, dword [edx]
movd xmm1, dword [esp + 0x20]
cvtdq2pd xmm1, xmm1
mov eax, dword [eax + ecx]
mov dword [esp + 0x2c], eax
mov eax, dword [edx + 4]
movsd qword [esp + 0x18], xmm1
mov eax, dword [eax + ecx]
mov dword [esp + 0x28], eax
lea esp, [esp]
movd xmm0, esi
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x10366140]
divsd xmm0, xmm1
movsd qword [esp + 0x20], xmm0
call fcn.102df500
mov eax, dword [esp + 0x2c]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x20]
movss dword [eax + esi*4], xmm1
call fcn.102df6c0
xorpd xmm0, xmmword [0x103592e0]
mov eax, dword [esp + 0x28]
movsd xmm1, qword [esp + 0x18]
cvtsd2ss xmm0, xmm0
movss dword [eax + esi*4], xmm0
inc esi
cmp esi, edi
jl 0x10196df0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10196e50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, dword [esp + 0x14]
cmp ebp, 9
jg 0x10196ea9
cmp ebp, 1
jl 0x10196ea7
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push ebx
call fcn.10196c50
push ebp
push dword [esp + 0x1c]
push ebx
call fcn.10197370
push ebp
push dword [esp + 0x2c]
push ebx
call fcn.10197370
mov ecx, ebp
mov eax, 1
shl eax, cl
push eax
mov eax, dword [ebx + 4]
push dword [eax + ebp*4]
mov eax, dword [ebx]
push dword [eax + ebp*4]
push dword [esp + 0x40]
push dword [esp + 0x40]
call fcn.10197020
add esp, 0x34
pop ebx
pop ebp
ret
push 0x10366148
call fcn.102d7cbd
add eax, 0x40
push eax
call fcn.102d86cf
add esp, 8
push 1
call fcn.102e011a
int3

Function at 0x10197420
Capabilities:
Terminate process

Disassembly:
sub esp, 0x804
mov eax, dword [0x10411ce0]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
mov ebx, dword [esp + 0x810]
push ebp
mov ebp, dword [esp + 0x810]
push edi
mov edi, dword [esp + 0x81c]
cmp edi, 8
jg 0x101974ad
push esi
mov esi, 1
mov ecx, edi
mov eax, esi
shl eax, cl
shl eax, 3
push eax
lea eax, [esp + 0x14]
push 0
push eax
call fcn.102dad40
push edi
lea eax, [esp + 0x20]
push eax
push ebx
push ebp
call fcn.10196e50
lea ecx, [edi - 1]
shl esi, cl
lea eax, [esp + 0x2c]
shl esi, 3
push esi
push eax
lea eax, [esi + ebx]
push eax
call fcn.102da6f0
mov ecx, dword [esp + 0x838]
add esp, 0x28
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.102d6d23
add esp, 0x804
ret
push str.rfft_size_too_big_n
call fcn.102d7cbd
add eax, 0x40
push eax
call fcn.102d86cf
add esp, 8
push 1
call fcn.102e011a
int3
Function at 0x101a3a70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
cmp ebp, 8
jl 0x101a3ae0
push 8
push 0x4c
push esi
call fcn.101a4550
sub ebp, 8
add esp, 0xc
mov dword [esp + 0x18], ebp
cmp ebp, 8
jl 0x101a3ae0
push 8
push 0x41
push esi
call fcn.101a4550
sub ebp, 8
add esp, 0xc
mov dword [esp + 0x18], ebp
cmp ebp, 8
jl 0x101a3ae0
push 8
push 0x4d
push esi
call fcn.101a4550
sub ebp, 8
add esp, 0xc
mov dword [esp + 0x18], ebp
cmp ebp, 8
jl 0x101a3ae0
push 8
push 0x45
push esi
call fcn.101a4550
add esp, 0xc
sub ebp, 8
mov dword [esp + 0x18], ebp
cmp ebp, 0x20
jl 0x101a3b31
call fcn.101a5c90
mov ebx, eax
xor edi, edi
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x101a3af3
sub ecx, edx
test ecx, ecx
jle 0x101a3b31
cmp ebp, 8
jl 0x101a3b2d
movsx eax, byte [edi + ebx]
sub ebp, 8
push 8
push eax
push esi
call fcn.101a4550
mov ecx, ebx
add esp, 0xc
inc edi
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x101a3b20
sub ecx, edx
cmp edi, ecx
jl 0x101a3b00
mov dword [esp + 0x18], ebp
cmp ebp, 1
jl 0x101a3c3f
lea ebx, [ebx]
mov eax, dword [esi + 0xcba8]
mov ebx, 1
mov ebp, eax
lea ecx, [ecx]
cmp dword [esi + 0x12c], 0
jne 0x101a3be7
inc dword [esi + 0x128]
mov dword [esi + 0x12c], 8
mov eax, dword [esi + 0xcba4]
lea eax, [eax + eax*2]
add eax, eax
mov eax, dword [esi + eax*8 + 0x9ba0]
cmp eax, dword [esi + 0x124]
jne 0x101a3bd7
mov eax, dword [esi + 0xcba4]
push dword [esi + 0x18]
lea eax, [eax + eax*2]
shl eax, 4
add eax, 0x9ba8
add eax, esi
push eax
mov eax, dword [esi + 0x128]
add eax, dword [esi + 0x11c]
push eax
call fcn.102da6f0
mov eax, dword [esi + 0x18]
add esp, 0xc
add dword [esi + 0x128], eax
shl eax, 3
add dword [esi + 0x124], eax
mov eax, dword [esi + 0xcba4]
inc eax
and eax, 0xff
mov dword [esi + 0xcba4], eax
mov ecx, dword [esi + 0x128]
mov eax, dword [esi + 0x11c]
mov byte [ecx + eax], 0
mov edi, dword [esi + 0x12c]
mov eax, ebp
mov edx, dword [esi + 0x128]
cmp ebx, edi
cmovl edi, ebx
add edx, dword [esi + 0x11c]
sub dword [esi + 0x12c], edi
sub ebx, edi
mov ecx, ebx
sar eax, cl
mov ecx, dword [esi + 0x12c]
shl al, cl
or byte [edx], al
add dword [esi + 0x124], edi
test ebx, ebx
jg 0x101a3b50
xor eax, eax
cmp dword [esi + 0x90], eax
sete al
xor dword [esi + 0xcba8], eax
dec dword [esp + 0x18]
jne 0x101a3b40
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x101b3290
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
test edi, edi
jle 0x101b32ca
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
movzx edx, word [esi]
movzx ecx, byte [eax + ebx]
inc eax
xor ecx, edx
shr dx, 8
and ecx, 0xff
xor dx, word [ecx*4 + 0x10368e60]
mov word [esi], dx
cmp eax, edi
jl 0x101b32a5
pop esi
pop ebx
pop edi
ret
Function at 0x101b9230
Capabilities:
Terminate process

Disassembly:
sub esp, 0xcc
mov eax, dword [0x10411ce0]
xor eax, esp
mov dword [esp + 0xc8], eax
mov eax, dword [esp + 0xd4]
mov ecx, 0x200
push ebx
mov ebx, dword [esp + 0xdc]
push ebp
push esi
push edi
mov edi, dword [esp + 0xe0]
mov ebp, 0x400
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x28], ebx
mov eax, dword [edi + 0x10]
mov dword [esp + 0x34], eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ecx
mov edx, dword [eax + 0x12ac]
mov eax, edx
mov dword [esp + 0x1c], edx
mov esi, edx
mov dword [esp + 0x18], eax
cmp edx, ecx
jg 0x101b93b0
mov edx, dword [esp + 0x20]
sub edx, ebx
mov dword [esp + 0x24], edx
lea edx, [esp + 0x3c]
sub edx, ebx
mov dword [esp + 0x38], edx
mov ebp, dword [esp + 0x1c]
lea esi, [ecx + eax]
mov eax, dword [edi + 0x10]
sar esi, 1
xor edx, edx
movss xmm0, dword [eax + 0x129c]
movss dword [esp + 0x2c], xmm0
lea edi, [edx + 0x27]
nop
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + ebx]
mov eax, 0xff
sub ecx, ebp
add ecx, esi
cmp ecx, dword [ebx]
cmovl ecx, dword [ebx]
lea ebx, [ebx + 4]
cmp ecx, 0xff
cmovg ecx, eax
mov eax, dword [esp + 0x38]
cmp edx, ecx
cmovl edx, ecx
mov dword [eax + ebx - 4], ecx
dec edi
jne 0x101b92d0
mov edi, dword [esp + 0x30]
lea eax, [esp + 0x3c]
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x10]
push edx
push ebx
push eax
mov eax, dword [edi]
push edi
call eax
push dword [edi + 0x10]
push dword [edi + 0xc]
call fcn.101b4d40
add esp, 0x18
test eax, eax
jne 0x101b93de
push edi
call fcn.101b8f30
push 0
push dword [edi + 0x10]
push dword [edi + 0xc]
call fcn.101b43a0
mov ecx, dword [edi + 0x10]
add esp, 0x10
movss xmm0, dword [esp + 0x2c]
mov dword [ecx + 0x12a0], eax
mov eax, dword [edi + 0x10]
mov ecx, dword [eax + 0x12a0]
movss dword [eax + 0x129c], xmm0
test ecx, ecx
je 0x101b9393
mov eax, dword [esp + 0x34]
mov eax, dword [eax + 0x12ec]
add eax, ecx
cmp eax, dword [esp + 0xec]
jl 0x101b9393
mov ecx, dword [esp + 0x14]
lea eax, [esi + 1]
mov dword [esp + 0x18], eax
cmp ebp, 0x400
jne 0x101b93a4
jmp 0x101b939e
mov eax, dword [esp + 0x18]
lea ecx, [esi - 1]
mov dword [esp + 0x14], ecx
mov ebp, esi
mov dword [esp + 0x10], ebp
cmp eax, ecx
jle 0x101b92b0
mov edx, dword [esp + 0x1c]
cmp ebp, esi
je 0x101b93c5
sub ebp, edx
push ebp
push ebx
push dword [esp + 0x28]
push edi
call fcn.101b99c0
add esp, 0x10
mov ecx, dword [esp + 0xd8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.102d6d23
add esp, 0xcc
ret
push str.INTERNAL_ERROR_IN_VBR_NEW_CODE__986___please_send_bug_report_n
push dword [edi + 0xc]
call fcn.101a8970
add esp, 8
push 0xffffffffffffffff
call fcn.102e011a
int3
Function at 0x101b99c0
Capabilities:
Terminate process

Disassembly:
sub esp, 0xb0
mov eax, dword [0x10411ce0]
xor eax, esp
mov dword [esp + 0xac], eax
push ebx
mov ebx, dword [esp + 0xc0]
xor edx, edx
push ebp
mov ebp, dword [esp + 0xc0]
push esi
mov esi, dword [esp + 0xc0]
sub ebp, ebx
push edi
mov dword [esp + 0x10], esi
mov edi, ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [esi + 0x10]
movss xmm0, dword [eax + 0x129c]
lea eax, [esp + 0x20]
sub eax, ebx
movss dword [esp + 0x18], xmm0
lea ebx, [edx + 0x27]
mov esi, eax
jmp 0x101b9a20
mov ecx, dword [edi + ebp]
mov eax, 0xff
add ecx, dword [esp + 0xd0]
cmp ecx, dword [edi]
cmovl ecx, dword [edi]
lea edi, [edi + 4]
cmp ecx, 0xff
cmovg ecx, eax
cmp edx, ecx
mov dword [esi + edi - 4], ecx
cmovl edx, ecx
dec ebx
jne 0x101b9a20
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x20]
mov ebx, dword [esp + 0x1c]
push edx
push ebx
push eax
mov eax, dword [esi]
push esi
call eax
push dword [esi + 0x10]
push dword [esi + 0xc]
call fcn.101b4d40
add esp, 0x18
test eax, eax
jne 0x101b9ac1
push esi
call fcn.101b8f30
push 0
push dword [esi + 0x10]
push dword [esi + 0xc]
call fcn.101b43a0
mov ecx, dword [esi + 0x10]
add esp, 0x10
movss xmm0, dword [esp + 0x18]
mov dword [ecx + 0x12a0], eax
mov ecx, dword [esi + 0x10]
pop edi
pop esi
pop ebp
mov eax, dword [ecx + 0x12a0]
movss dword [ecx + 0x129c], xmm0
mov ecx, dword [esp + 0xb0]
pop ebx
xor ecx, esp
call fcn.102d6d23
add esp, 0xb0
ret
push str.INTERNAL_ERROR_IN_VBR_NEW_CODE__986___please_send_bug_report_n
push dword [esi + 0xc]
call fcn.101a8970
add esp, 8
push 0xffffffffffffffff
call fcn.102e011a
int3

Function at 0x101b9ae0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
push dword [esp + 0x14]
push dword [esp + 0x14]
mov eax, dword [esi + 0x10]
push dword [esp + 0x14]
push esi
movss xmm0, dword [eax + 0x129c]
mov eax, dword [esi]
movss dword [esp + 0x18], xmm0
call eax
push dword [esi + 0x10]
push dword [esi + 0xc]
call fcn.101b4d40
add esp, 0x18
test eax, eax
jne 0x101b9b57
push esi
call fcn.101b8f30
push 0
push dword [esi + 0x10]
push dword [esi + 0xc]
call fcn.101b43a0
mov ecx, dword [esi + 0x10]
add esp, 0x10
movss xmm0, dword [esp + 8]
mov dword [ecx + 0x12a0], eax
mov ecx, dword [esi + 0x10]
pop esi
mov eax, dword [ecx + 0x12ec]
add eax, dword [ecx + 0x12a0]
movss dword [ecx + 0x129c], xmm0
ret
push str.INTERNAL_ERROR_IN_VBR_NEW_CODE__986___please_send_bug_report_n
push dword [esi + 0xc]
call fcn.101a8970
add esp, 8
push 0xffffffffffffffff
call fcn.102e011a
int3
Function at 0x101bd4b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x10]
push esi
movzx esi, ax
cmp ebx, 0x20
jb 0x101bd551
push ebp
mov ebp, ebx
push edi
shr ebp, 5
lea ecx, [ecx]
lea eax, [esp + 0x14]
push 0x20
push eax
call fcn.101bd670
mov edi, eax
add esp, 8
shr eax, 0x10
sub ebx, 0x20
xor eax, esi
shl esi, 8
shr eax, 8
and eax, 0xff
movzx edx, word [eax*2 + 0x1036c3a0]
mov eax, edi
shr eax, 8
xor edx, esi
xor eax, edx
shl edx, 8
shr eax, 8
and eax, 0xff
movzx ecx, word [eax*2 + 0x1036c3a0]
mov eax, edi
xor ecx, edx
xor eax, ecx
shl ecx, 8
shr eax, 8
and eax, 0xff
movzx edx, word [eax*2 + 0x1036c3a0]
xor edx, ecx
mov eax, edx
shl edx, 8
shr eax, 8
xor eax, edi
and eax, 0xff
movzx esi, word [eax*2 + 0x1036c3a0]
xor esi, edx
dec ebp
jne 0x101bd4d0
pop edi
pop ebp
mov eax, ebx
shr eax, 3
dec eax
je 0x101bd5b9
dec eax
je 0x101bd58e
dec eax
jne 0x101bd5e7
lea eax, [esp + 0xc]
push 8
push eax
call fcn.101bd670
mov ecx, eax
add esp, 8
mov eax, esi
shl esi, 8
shr eax, 8
xor ecx, eax
and ecx, 0xff
movzx eax, word [ecx*2 + 0x1036c3a0]
xor esi, eax
lea eax, [esp + 0xc]
push 8
push eax
call fcn.101bd670
mov ecx, eax
add esp, 8
mov eax, esi
shl esi, 8
shr eax, 8
xor ecx, eax
and ecx, 0xff
movzx eax, word [ecx*2 + 0x1036c3a0]
xor esi, eax
lea eax, [esp + 0xc]
push 8
push eax
call fcn.101bd670
mov ecx, eax
add esp, 8
mov eax, esi
shl esi, 8
shr eax, 8
xor ecx, eax
and ecx, 0xff
movzx eax, word [ecx*2 + 0x1036c3a0]
xor esi, eax
and ebx, 7
test ebx, ebx
je 0x101bd61a
jmp 0x101bd5f0
lea eax, [esp + 0xc]
dec ebx
push 1
push eax
call fcn.101bd670
mov ecx, eax
add esp, 8
mov eax, esi
add esi, esi
shr eax, 0xf
xor ecx, eax
test cl, 1
je 0x101bd616
xor esi, 0x8005
test ebx, ebx
jne 0x101bd5f0
mov ax, si
pop esi
pop ebx
ret