joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10016fba
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x24]
mov ecx, dword [0x1004a610]
test ecx, ecx
jne 0x1001707d
mov esi, dword [0x1004a5dc]
test esi, esi
jne 0x10016fec
mov ecx, 0xf8f45725
call fcn.1001717e
mov esi, eax
mov dword [0x1004a5dc], eax
mov dword [esp + 0xa], 0x3111001d
mov dword [esp + 0xe], 0xd130413
mov word [esp + 0x12], 0xb15
mov byte [esp + 0x14], 0
mov word [esp + 8], 0x1d43
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x70
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0xc
jne 0x10017012
mov byte [esp + 0x14], 0
mov ecx, dword [0x1004a5e0]
test ecx, ecx
jne 0x10017041
mov ecx, 0x53b2070f
call fcn.1001717e
mov ecx, eax
mov dword [0x1004a5e0], eax
mov dword [esp + 2], 0x47470117
mov byte [esp + 6], 0
mov word [esp], 0x275
xor eax, eax
inc eax
mov edx, eax
add dl, 0x70
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x10017057
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a610], eax
push edi
call ecx
add esp, 0x18
pop esi
pop edi
ret 4

Function at 0x1001710c
Capabilities:
Match known plugx module

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
mov esi, esp
mov ecx, esi
call fcn.10013ddc
xor ebp, ebp
push ebp
push esi
call fcn.1001863c
add esp, 8
mov eax, dword [esi + 4]
add eax, 2
lea ecx, [ebx + 0x10]
push eax
push dword [esi]
push ecx
call fcn.10013fc8
add esp, 0xc
mov dword [ebx], 0x20190301
mov dword [ebx + 4], 0x300f
mov eax, dword [esi + 4]
add eax, 2
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], ebp
mov ecx, edi
push 0x7530
push ebx
call fcn.100241f0
mov edi, eax
mov ecx, esi
call fcn.10013eba
mov eax, edi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1001717e
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0xc], ecx
mov eax, dword [0x1004a5d8]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + 0x14]
add edi, 0x14
mov eax, dword [esi + 0x10]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x10017240
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x10017240
cmp word [eax + ecx + 0x14], 0x60
jb 0x10017240
cmp dword [eax + ecx + 0x74], 0
je 0x10017240
mov edx, dword [eax + ecx + 0x78]
mov ecx, edx
mov dword [esp], edx
test edx, edx
je 0x10017240
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x18]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x10017240
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x20]
add ecx, eax
mov dword [esp + 8], ecx
lea ecx, [eax + 1]
mov dword [esp + 4], ecx
xor ebx, ebx
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + ebx*4]
mov dl, byte [eax + ecx]
test dl, dl
je 0x10017228
add ecx, dword [esp + 4]
mov ebp, 0x811c9dc5
movsx edx, dl
xor edx, ebp
imul ebp, edx, 0x1000193
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10017214
jmp 0x1001722d
mov ebp, 0x811c9dc5
cmp ebp, dword [esp + 0xc]
je 0x1001723c
inc ebx
cmp ebx, dword [esp + 0x10]
jne 0x100171fd
jmp 0x10017240
test eax, eax
jne 0x10017254
mov esi, dword [esi]
cmp esi, edi
jne 0x1001719a
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp]
mov ecx, dword [eax + edx + 0x24]
add ecx, eax
mov edx, dword [eax + edx + 0x1c]
add edx, eax
movzx ecx, word [ecx + ebx*2]
add eax, dword [edx + ecx*4]
jmp 0x1001724c
Function at 0x10017778
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [0x1004aa20]
test ecx, ecx
jne 0x10017854
mov esi, dword [0x1004aa18]
test esi, esi
jne 0x100177b8
mov ecx, 0xf8f45725
call fcn.1001814c
mov esi, eax
mov dword [0x1004aa18], eax
mov dword [esp + 0xe], 0xbaaabcb9
mov dword [esp + 0x12], 0x8d8797a5
mov word [esp + 0x16], 0xb290
mov byte [esp + 0x18], 0
mov word [esp + 0xc], 0xa943
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xda
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xc
jne 0x100177de
mov byte [esp + 0x18], 0
mov ecx, dword [0x1004aa1c]
test ecx, ecx
jne 0x1001780d
mov ecx, 0x53b2070f
call fcn.1001814c
mov ecx, eax
mov dword [0x1004aa1c], eax
mov dword [esp + 2], 0xb3bbb3ae
mov word [esp + 6], 0xd3d3
mov byte [esp + 8], 0
mov word [esp], 0xbe6b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xda
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x1001782a
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004aa20], eax
mov eax, dword [esp + 0x30]
push edi
push ebp
push ebx
push eax
call ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x10017864
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
mov ecx, dword [0x1004aa24]
test ecx, ecx
jne 0x1001794a
mov esi, dword [0x1004aa18]
test esi, esi
jne 0x100178ac
mov ecx, 0xf8f45725
call fcn.1001814c
mov esi, eax
mov dword [0x1004aa18], eax
mov byte [esp + 0x1c], 0
movaps xmm0, xmmword [0x1003fdd0]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xda
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x10
jne 0x100178c0
mov byte [esp + 0x1c], 0
mov ecx, dword [0x1004aa1c]
test ecx, ecx
jne 0x100178ef
mov ecx, 0x53b2070f
call fcn.1001814c
mov ecx, eax
mov dword [0x1004aa1c], eax
mov dword [esp + 2], 0xb3bbb3ae
mov word [esp + 6], 0xd3d3
mov byte [esp + 8], 0
mov word [esp], 0xbe6b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xda
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x1001790c
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004aa24], eax
mov esi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov ebx, dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x48]
push eax
push ebx
push edx
push edi
push ebp
push esi
push dword [esp + 0x50]
push dword [esp + 0x50]
call ecx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 0x20
Function at 0x10017964
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov ecx, dword [0x1004aa28]
test ecx, ecx
jne 0x10017a21
mov esi, dword [0x1004aa18]
test esi, esi
jne 0x1001799b
mov ecx, 0xf8f45725
call fcn.1001814c
mov esi, eax
mov dword [0x1004aa18], eax
mov byte [esp + 0x1c], 0
movaps xmm0, xmmword [0x1003fde0]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xda
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x10
jne 0x100179af
mov byte [esp + 0x1c], 0
mov ecx, dword [0x1004aa1c]
test ecx, ecx
jne 0x100179de
mov ecx, 0x53b2070f
call fcn.1001814c
mov ecx, eax
mov dword [0x1004aa1c], eax
mov dword [esp + 2], 0xb3bbb3ae
mov word [esp + 6], 0xd3d3
mov byte [esp + 8], 0
mov word [esp], 0xbe6b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xda
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x100179fb
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004aa28], eax
push ebx
push edi
call ecx
add esp, 0x20
pop esi
pop edi
pop ebx
ret 8

Function at 0x10017a2e
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ecx, dword [0x1004aa2c]
test ecx, ecx
jne 0x10017afb
mov esi, dword [0x1004aa18]
test esi, esi
jne 0x10017a6e
mov ecx, 0xf8f45725
call fcn.1001814c
mov esi, eax
mov dword [0x1004aa18], eax
mov dword [esp + 0x1c], 0x98879f
movaps xmm0, xmmword [0x1003fdf0]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xda
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x13
jne 0x10017a85
mov byte [esp + 0x1f], 0
mov ecx, dword [0x1004aa1c]
test ecx, ecx
jne 0x10017ab4
mov ecx, 0x53b2070f
call fcn.1001814c
mov ecx, eax
mov dword [0x1004aa1c], eax
mov dword [esp + 2], 0xb3bbb3ae
mov word [esp + 6], 0xd3d3
mov byte [esp + 8], 0
mov word [esp], 0xbe6b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xda
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10017ad1
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004aa2c], eax
mov eax, dword [esp + 0x34]
push edi
push ebp
push ebx
push eax
call ecx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x10017b0c
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
mov esi, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [0x1004aa30]
test ecx, ecx
jne 0x10017bf8
mov esi, dword [0x1004aa18]
test esi, esi
jne 0x10017b54
mov ecx, 0xf8f45725
call fcn.1001814c
mov esi, eax
mov dword [0x1004aa18], eax
mov dword [esp + 0xe], 0xbaaabcb9
mov dword [esp + 0x12], 0x869089b4
mov word [esp + 0x16], 0x8185
mov byte [esp + 0x18], 0
mov word [esp + 0xc], 0xa943
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xda
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xc
jne 0x10017b7a
mov byte [esp + 0x18], 0
mov ecx, dword [0x1004aa1c]
test ecx, ecx
jne 0x10017ba9
mov ecx, 0x53b2070f
call fcn.1001814c
mov ecx, eax
mov dword [0x1004aa1c], eax
mov dword [esp + 2], 0xb3bbb3ae
mov word [esp + 6], 0xd3d3
mov byte [esp + 8], 0
mov word [esp], 0xbe6b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xda
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10017bc6
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004aa30], eax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x38]
push ebp
push ebx
push edi
push esi
push edx
push eax
call ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0x18

Function at 0x10017ea2
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
mov ebx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
mov ecx, dword [0x1004aa34]
test ecx, ecx
jne 0x10017f7b
mov esi, dword [0x1004aa18]
test esi, esi
jne 0x10017ee2
mov ecx, 0xf8f45725
call fcn.1001814c
mov esi, eax
mov dword [0x1004aa18], eax
mov dword [esp + 0x1c], 0x8e898188
mov word [esp + 0x20], 0x9c9a
mov byte [esp + 0x22], 0
movaps xmm0, xmmword [0x1003fe00]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xda
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x16
jne 0x10017f05
mov byte [esp + 0x22], 0
mov ecx, dword [0x1004aa1c]
test ecx, ecx
jne 0x10017f34
mov ecx, 0x53b2070f
call fcn.1001814c
mov ecx, eax
mov dword [0x1004aa1c], eax
mov dword [esp + 2], 0xb3bbb3ae
mov word [esp + 6], 0xd3d3
mov byte [esp + 8], 0
mov word [esp], 0xbe6b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xda
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10017f51
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004aa34], eax
mov eax, dword [esp + 0x38]
push edi
push ebp
push ebx
push eax
call ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x10017f8c
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push dword [ecx + 0x20]
call fcn.10001902
test eax, eax
je fcn.100013b0
xor eax, eax
ret
Function at 0x10017fa0
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov ecx, dword [0x1004aa38]
test ecx, ecx
jne 0x10018060
mov esi, dword [0x1004aa18]
test esi, esi
jne 0x10017fd7
mov ecx, 0xf8f45725
call fcn.1001814c
mov esi, eax
mov dword [0x1004aa18], eax
mov dword [esp + 0x1c], 0x98888f
movaps xmm0, xmmword [0x1003fe10]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xda
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x13
jne 0x10017fee
mov byte [esp + 0x1f], 0
mov ecx, dword [0x1004aa1c]
test ecx, ecx
jne 0x1001801d
mov ecx, 0x53b2070f
call fcn.1001814c
mov ecx, eax
mov dword [0x1004aa1c], eax
mov dword [esp + 2], 0xb3bbb3ae
mov word [esp + 6], 0xd3d3
mov byte [esp + 8], 0
mov word [esp], 0xbe6b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xda
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x1001803a
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004aa38], eax
push ebx
push edi
call ecx
add esp, 0x20
pop esi
pop edi
pop ebx
ret 8

Function at 0x1001806e
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push dword [esp + 4]
push dword [0x10051a18]
call fcn.1001823a
test eax, eax
je fcn.100013b0
xor eax, eax
ret

Function at 0x10018088
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push esi
sub esp, 0x18
mov ecx, dword [0x1004aa40]
test ecx, ecx
jne 0x10018145
mov esi, dword [0x1004aa18]
test esi, esi
jne 0x100180b5
mov ecx, 0xf8f45725
call fcn.1001814c
mov esi, eax
mov dword [0x1004aa18], eax
mov dword [esp + 2], 0x929b92a8
mov word [esp + 6], 0xb1a3
mov byte [esp + 8], 0
mov word [esp], 0xbe47
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xda
xor byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x100180d2
mov byte [esp + 8], 0
mov ecx, dword [0x1004aa1c]
test ecx, ecx
jne 0x10018100
mov ecx, 0x53b2070f
call fcn.1001814c
mov ecx, eax
mov dword [0x1004aa1c], eax
mov dword [esp + 0xe], 0xb3bbb3ae
mov word [esp + 0x12], 0xd3d3
mov byte [esp + 0x14], 0
mov word [esp + 0xc], 0xbe6b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xda
xor byte [esp + eax + 0xc], dl
inc eax
cmp eax, 8
jne 0x1001811e
lea eax, [esp + 0xc]
mov byte [eax + 8], 0
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004aa40], eax
call ecx
add esp, 0x18
pop esi
ret
Function at 0x1001814c
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0xc], ecx
mov eax, dword [0x1004a614]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + 0x14]
add edi, 0x14
mov eax, dword [esi + 0x10]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x1001820e
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x1001820e
cmp word [eax + ecx + 0x14], 0x60
jb 0x1001820e
cmp dword [eax + ecx + 0x74], 0
je 0x1001820e
mov edx, dword [eax + ecx + 0x78]
mov ecx, edx
mov dword [esp], edx
test edx, edx
je 0x1001820e
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x18]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x1001820e
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x20]
add ecx, eax
mov dword [esp + 8], ecx
lea ecx, [eax + 1]
mov dword [esp + 4], ecx
xor ebx, ebx
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + ebx*4]
mov dl, byte [eax + ecx]
test dl, dl
je 0x100181f6
add ecx, dword [esp + 4]
mov ebp, 0x811c9dc5
movsx edx, dl
xor edx, ebp
imul ebp, edx, 0x1000193
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x100181e2
jmp 0x100181fb
mov ebp, 0x811c9dc5
cmp ebp, dword [esp + 0xc]
je 0x1001820a
inc ebx
cmp ebx, dword [esp + 0x10]
jne 0x100181cb
jmp 0x1001820e
test eax, eax
jne 0x10018222
mov esi, dword [esi]
cmp esi, edi
jne 0x10018168
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp]
mov ecx, dword [eax + edx + 0x24]
add ecx, eax
mov edx, dword [eax + edx + 0x1c]
add edx, eax
movzx ecx, word [ecx + ebx*2]
add eax, dword [edx + ecx*4]
jmp 0x1001821a

Function at 0x1001823a
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [0x1004aa3c]
test ecx, ecx
jne 0x10018304
mov esi, dword [0x1004aa18]
test esi, esi
jne 0x10018271
mov ecx, 0xf8f45725
call fcn.1001814c
mov esi, eax
mov dword [0x1004aa18], eax
mov dword [esp + 0xe], 0xabbb8eaf
mov dword [esp + 0x12], 0x968e80b6
mov word [esp + 0x16], 0x81
mov word [esp + 0xc], 0xb754
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xda
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xb
jne 0x10018292
mov byte [esp + 0x17], 0
mov ecx, dword [0x1004aa1c]
test ecx, ecx
jne 0x100182c1
mov ecx, 0x53b2070f
call fcn.1001814c
mov ecx, eax
mov dword [0x1004aa1c], eax
mov dword [esp + 2], 0xb3bbb3ae
mov word [esp + 6], 0xd3d3
mov byte [esp + 8], 0
mov word [esp], 0xbe6b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xda
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x100182de
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004aa3c], eax
push ebx
push edi
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
ret 8
Function at 0x100183dc
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [0x100512e0]
test ecx, ecx
jne 0x1001848e
mov esi, dword [0x100512d8]
test esi, esi
jne 0x10018413
mov ecx, 0xf8f45725
call fcn.1001bba6
mov esi, eax
mov dword [0x100512d8], eax
mov dword [esp + 2], 0x3d21290f
mov dword [esp + 6], 0x24202a23
mov dword [esp + 0xa], 0x29152a34
mov byte [esp + 0xe], 0
mov word [esp], 0x2a43
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x44
xor byte [esp + eax], cl
inc eax
cmp eax, 0xe
jne 0x10018439
mov byte [esp + 0xe], 0
mov ecx, dword [0x100512dc]
test ecx, ecx
jne 0x10018467
mov ecx, 0x53b2070f
call fcn.1001bba6
mov ecx, eax
mov dword [0x100512dc], eax
lea eax, [esp + 0x10]
mov dword [eax + 2], 0x7a7423
mov word [eax], 0x296f
xor dword [eax + 1], 0x48474645
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100512e0], eax
push ebx
push edi
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
ret 8

Function at 0x1001849c
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
mov ecx, dword [0x100512e4]
test ecx, ecx
jne 0x10018561
mov esi, dword [0x100512d8]
test esi, esi
jne 0x100184d3
mov ecx, 0xf8f45725
call fcn.1001bba6
mov esi, eax
mov dword [0x100512d8], eax
mov dword [esp + 0x1c], 0x2f273b
mov byte [esp + 0x20], 0
movaps xmm0, xmmword [0x1003fe70]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x44
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x14
jne 0x100184ef
mov byte [esp + 0x20], 0
mov ecx, dword [0x100512dc]
test ecx, ecx
jne 0x1001851e
mov ecx, 0x53b2070f
call fcn.1001bba6
mov ecx, eax
mov dword [0x100512dc], eax
mov dword [esp + 2], 0x252d2934
mov word [esp + 6], 0x7979
mov byte [esp + 8], 0
mov word [esp], 0x206b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x44
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x1001853b
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100512e4], eax
push ebx
push edi
call ecx
add esp, 0x24
pop esi
pop edi
pop ebx
ret 8
Function at 0x1001856e
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov ecx, dword [0x100512e8]
test ecx, ecx
jne 0x1001862e
mov esi, dword [0x100512d8]
test esi, esi
jne 0x100185a5
mov ecx, 0xf8f45725
call fcn.1001bba6
mov esi, eax
mov dword [0x100512d8], eax
mov dword [esp + 0x1c], 0x12c26
movaps xmm0, xmmword [0x1003fe80]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x44
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x13
jne 0x100185bc
mov byte [esp + 0x1f], 0
mov ecx, dword [0x100512dc]
test ecx, ecx
jne 0x100185eb
mov ecx, 0x53b2070f
call fcn.1001bba6
mov ecx, eax
mov dword [0x100512dc], eax
mov dword [esp + 2], 0x252d2934
mov word [esp + 6], 0x7979
mov byte [esp + 8], 0
mov word [esp], 0x206b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x44
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10018608
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100512e8], eax
push ebx
push edi
call ecx
add esp, 0x20
pop esi
pop edi
pop ebx
ret 8

Function at 0x10018744
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x34]
mov ecx, dword [0x100512ec]
test ecx, ecx
jne 0x1001880d
mov esi, dword [0x100512d8]
test esi, esi
jne 0x10018780
mov ecx, 0xf8f45725
call fcn.1001bba6
mov esi, eax
mov dword [0x100512d8], eax
mov word [esp + 0x1c], 0x231
mov byte [esp + 0x1e], 0
movaps xmm0, xmmword [0x1003fe90]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x44
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x12
jne 0x1001879b
mov byte [esp + 0x1e], 0
mov ecx, dword [0x100512dc]
test ecx, ecx
jne 0x100187ca
mov ecx, 0x53b2070f
call fcn.1001bba6
mov ecx, eax
mov dword [0x100512dc], eax
mov dword [esp + 2], 0x252d2934
mov word [esp + 6], 0x7979
mov byte [esp + 8], 0
mov word [esp], 0x206b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x44
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x100187e7
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100512ec], eax
push ebp
push ebx
push edi
call ecx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x1001883c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push esi
sub esp, 0x18
mov eax, dword [0x100512f0]
test eax, eax
jne 0x100188e1
mov esi, dword [0x100512d8]
test esi, esi
jne 0x10018868
mov ecx, 0xf8f45725
call fcn.1001bba6
mov esi, eax
mov dword [0x100512d8], eax
mov dword [esp + 2], 0x27212913
mov dword [esp + 6], 0x2c253f23
mov dword [esp + 0xa], 0x342a2622
mov byte [esp + 0xe], 0
mov word [esp], 0x2a43
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x44
xor byte [esp + eax], cl
inc eax
cmp eax, 0xe
jne 0x1001888e
mov byte [esp + 0xe], 0
mov ecx, dword [0x100512dc]
test ecx, ecx
jne 0x100188bc
mov ecx, 0x53b2070f
call fcn.1001bba6
mov ecx, eax
mov dword [0x100512dc], eax
lea eax, [esp + 0x10]
mov dword [eax + 2], 0x7a7423
mov word [eax], 0x296f
xor dword [eax + 1], 0x48474645
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov dword [0x100512f0], eax
call eax
add esp, 0x18
pop esi
ret

Function at 0x10018934
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov ecx, dword [0x100512f4]
test ecx, ecx
jne 0x100189f1
mov esi, dword [0x100512d8]
test esi, esi
jne 0x1001896b
mov ecx, 0xf8f45725
call fcn.1001bba6
mov esi, eax
mov dword [0x100512d8], eax
mov byte [esp + 0x1c], 0
movaps xmm0, xmmword [0x1003fea0]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x44
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x10
jne 0x1001897f
mov byte [esp + 0x1c], 0
mov ecx, dword [0x100512dc]
test ecx, ecx
jne 0x100189ae
mov ecx, 0x53b2070f
call fcn.1001bba6
mov ecx, eax
mov dword [0x100512dc], eax
mov dword [esp + 2], 0x252d2934
mov word [esp + 6], 0x7979
mov byte [esp + 8], 0
mov word [esp], 0x206b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x44
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x100189cb
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100512f4], eax
push ebx
push edi
call ecx
add esp, 0x20
pop esi
pop edi
pop ebx
ret 8