joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009f520
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x10284f40]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1009f559
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e40d6
mov esp, ebp
pop ebp
ret
push ebx
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0x2b0
call fcn.100f426e
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x1009f58c
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e40d6
mov esp, ebp
pop ebp
ret
push esi
push edi
test bl, 3
jne 0x1009f5b3
lea eax, [ebx + 0x2b0]
cmp eax, ebx
sbb ecx, ecx
and ecx, 0xffffff54
add ecx, 0xac
je 0x1009f5c3
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
jmp 0x1009f5c3
push 0x2b0
push 0
push ebx
call fcn.100e6b10
add esp, 0xc
push 0x4000
mov dword [ebx + 0x7c], 0x1009cbb0
mov dword [ebx + 0x84], 0x1009cbe0
mov dword [ebx + 0x98], 1
mov dword [ebx + 0x9c], 0
mov dword [ebx + 0xa0], 0
mov word [ebx + 0xb2], 0
mov dword [ebx + 0x20c], 8
mov dword [ebx + 0x224], 0
mov byte [ebx + 0x228], 0
mov dword [ebx + 0x22c], 1
mov dword [ebx + 0x230], 1
mov dword [ebx + 0xd4], 0xffffffff
mov dword [ebx + 0x23c], 0x4000
call fcn.100f426e
push 0x4000
mov dword [ebx + 0x238], eax
mov dword [ebx + 0x250], 0x4000
call fcn.100f426e
push 0x100
mov dword [ebx + 0x24c], eax
mov dword [ebx + 0x264], 0x20
call fcn.100f426e
lea edi, [ebx + 0x294]
mov dword [ebx + 0x260], eax
push edi
call fcn.100a1330
lea esi, [ebx + 0x2a0]
push esi
call fcn.100a1330
add esp, 0x14
cmp dword [ebx + 0x238], 0
je 0x1009f6d2
cmp dword [ebx + 0x24c], 0
je 0x1009f6d2
cmp dword [ebx + 0x260], 0
je 0x1009f6d2
test edi, edi
je 0x1009f6d2
cmp dword [ebx + 0x29c], 0
je 0x1009f6d2
test esi, esi
je 0x1009f6d2
cmp dword [ebx + 0x2a8], 0
jne 0x1009f6dd
push ebx
call fcn.1009ef30
add esp, 4
xor ebx, ebx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e40d6
mov esp, ebp
pop ebp
ret
Function at 0x100a0f90
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x10284f40]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x100a0fc8
cmp dword [edi + 0xd4], 0xffffffff
jne 0x100a0fda
lea eax, [edi + 0x294]
push str.invalid_socket_n
push eax
call fcn.100a14d0
add esp, 8
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e40d6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x100a100e
cmp byte [edi + 0x274], 0
je 0x100a100e
push edi
call fcn.100a93c0
add esp, 4
test al, al
je 0x100a100b
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e40d6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov ecx, dword [ebp + 0x10]
mov esi, dword [edi + 0xd4]
test eax, eax
jne 0x100a1028
test ecx, ecx
je 0x100a10fa
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x108], 0
test eax, eax
je 0x100a1050
mov dword [ebp - 0x208], esi
mov dword [ebp - 0x20c], 1
test ecx, ecx
je 0x100a1064
mov dword [ebp - 0x104], esi
mov dword [ebp - 0x108], 1
mov eax, ebx
mov dword [ebp - 0x30c], esi
and eax, dword [ebp + 0x18]
mov dword [ebp - 0x310], 1
cmp eax, 0xffffffff
jne 0x100a1082
xor eax, eax
jmp 0x100a10bf
push 0
call fcn.100fb0ee
add esp, 4
mov ecx, eax
cmp dword [ebp + 0x18], edx
jl 0x100a10a5
jg 0x100a1099
cmp ebx, ecx
jbe 0x100a10a5
mov eax, ebx
sub eax, ecx
mov dword [ebp - 0x318], eax
jmp 0x100a10af
mov dword [ebp - 0x318], 0
mov dword [ebp - 0x314], 0
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [esi + 1]
push eax
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jns 0x100a113c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
jne 0x100a110f
mov eax, dword [ebp + 0xc]
jmp 0x100a1013
xor esi, esi
mov eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e40d6
mov esp, ebp
pop ebp
ret
push 0x100
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.100a8b30
push eax
lea eax, [edi + 0x294]
push str.select___failed:__s_n
push eax
call fcn.100a14d0
add esp, 0x18
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.100e40d6
mov esp, ebp
pop ebp
ret
Function at 0x100a6c70
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x10284f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x274], 0
je 0x100a6caf
push dword [ebp + 0x10]
push eax
push esi
call fcn.100a9200
add esp, 0xc
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e40d6
mov esp, ebp
pop ebp
ret
push ebx
push edi
xor edi, edi
push edi
push dword [ebp + 0x10]
push eax
push dword [esi + 0xd4]
call dword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test ebx, ebx
jns 0x100a6d23
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
mov ecx, edi
sub ecx, 0x2714
je 0x100a6d23
sub ecx, 0x1f
je 0x100a6d23
sub ecx, 0x13
je 0x100a6d0f
push 0x100
lea eax, [ebp - 0x104]
push eax
push edi
call fcn.100a8b30
push eax
lea eax, [esi + 0x294]
push str.could_not_receive_data_from_server:__s_n
push eax
call fcn.100a14d0
add esp, 0x18
jmp 0x100a6d23
lea ecx, [esi + 0x294]
push str.server_closed_the_connection_unexpectedly_n_tThis_probably_means_the_server_terminated_abnormally_n_tbefore_or_while_processing_the_request._n
push ecx
call fcn.100a14d0
add esp, 8
push edi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.100e40d6
mov esp, ebp
pop ebp
ret

Function at 0x100a6d40
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x10284f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x274], 0
je 0x100a6d7f
push dword [ebp + 0x10]
push eax
push edi
call fcn.100a93e0
add esp, 0xc
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e40d6
mov esp, ebp
pop ebp
ret
push ebx
push esi
xor esi, esi
push esi
push dword [ebp + 0x10]
push eax
push dword [edi + 0xd4]
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
test ebx, ebx
jns 0x100a6e00
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jg 0x100a6dbb
je 0x100a6e00
cmp esi, 0x20
je 0x100a6dec
cmp esi, 0x2714
jne 0x100a6dc3
jmp 0x100a6e00
cmp esi, 0x2746
je 0x100a6dec
push 0x100
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.100a8b30
push eax
lea eax, [edi + 0x294]
push str.could_not_send_data_to_server:__s_n
push eax
call fcn.100a14d0
add esp, 0x18
jmp 0x100a6e00
lea ecx, [edi + 0x294]
push str.server_closed_the_connection_unexpectedly_n_tThis_probably_means_the_server_terminated_abnormally_n_tbefore_or_while_processing_the_request._n
push ecx
call fcn.100a14d0
add esp, 8
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.100e40d6
mov esp, ebp
pop ebp
ret
Function at 0x100a6e20
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x10284f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push esi
push dword [ebp + 0x10]
push eax
push dword [edi + 0xd4]
call dword [sym.imp.WS2_32.dll_recv]
mov ebx, eax
test ebx, ebx
jns 0x100a6eae
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
mov ecx, esi
sub ecx, 0x2714
je 0x100a6eae
sub ecx, 0x1f
je 0x100a6eae
sub ecx, 0x13
je 0x100a6e9a
push 0x100
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.100a8b30
push eax
lea eax, [edi + 0x294]
push str.could_not_receive_data_from_server:__s_n
push eax
call fcn.100a14d0
add esp, 0x18
jmp 0x100a6eae
lea eax, [edi + 0x294]
push str.server_closed_the_connection_unexpectedly_n_tThis_probably_means_the_server_terminated_abnormally_n_tbefore_or_while_processing_the_request._n
push eax
call fcn.100a14d0
add esp, 8
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e40d6
mov esp, ebp
pop ebp
ret

Function at 0x100a6ed0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x10284f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push esi
push dword [ebp + 0x10]
push eax
push dword [edi + 0xd4]
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
test ebx, ebx
jns 0x100a6f6b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jg 0x100a6f26
je 0x100a6f6b
cmp esi, 0x20
je 0x100a6f57
cmp esi, 0x2714
jne 0x100a6f2e
jmp 0x100a6f6b
cmp esi, 0x2746
je 0x100a6f57
push 0x100
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.100a8b30
push eax
lea eax, [edi + 0x294]
push str.could_not_send_data_to_server:__s_n
push eax
call fcn.100a14d0
add esp, 0x18
jmp 0x100a6f6b
lea eax, [edi + 0x294]
push str.server_closed_the_connection_unexpectedly_n_tThis_probably_means_the_server_terminated_abnormally_n_tbefore_or_while_processing_the_request._n
push eax
call fcn.100a14d0
add esp, 8
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e40d6
mov esp, ebp
pop ebp
ret
Function at 0x100a7670
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x10284f40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 1
xor edi, edi
mov dword [ebp - 0x10c], 0x101
call dword [0x10282014]
add esp, 4
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x100a76d2
test esi, esi
je 0x100a76f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.user_name_lookup_failure:_error_code__lu_n
push esi
call fcn.100a14d0
add esp, 0xc
jmp 0x100a76f9
lea eax, [ebp - 0x108]
push eax
call fcn.100fef59
mov edi, eax
add esp, 4
test edi, edi
jne 0x100a76f9
test esi, esi
je 0x100a76f9
push str.out_of_memory_n
push esi
call fcn.100a14d0
add esp, 8
push 0
call dword [0x10282014]
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, edi
xor ecx, ebp
pop edi
pop esi
call fcn.100e40d6
mov esp, ebp
pop ebp
ret

Function at 0x100a7c20
Capabilities:
Get outbound credentials handle via credssp

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi + 0x288], 0
mov eax, dword [esi + 0xc8]
lea ecx, [eax + eax*4]
mov eax, dword [esi + 0xcc]
mov edi, dword [eax + ecx*4 + 4]
je 0x100a7c51
push str.duplicate_SSPI_authentication_request_n
jmp 0x100a7d39
push 8
call fcn.100f426e
add esp, 4
mov dword [esi + 0x284], eax
test eax, eax
je 0x100a7d34
cmp dword [ebp + 0xc], 0
lea ecx, [ebp - 8]
push ecx
push eax
push 0
push 0
push 0
push 0
mov ecx, str.kerberos
mov eax, str.negotiate
push 2
cmove eax, ecx
push eax
push 0
call sub.Secur32.dll_AcquireCredentialsHandleA
test eax, eax
je 0x100a7cc2
push eax
push str.could_not_acquire_SSPI_credentials
push esi
call fcn.100a7b90
push dword [esi + 0x284]
call fcn.100f385c
add esp, 0x10
mov dword [esi + 0x284], 0
or eax, 0xffffffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x100a7d2d
cmp byte [edi], 0
je 0x100a7d2d
mov ecx, dword [esi + 0x6c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100a7cd1
sub ecx, edx
mov edx, edi
push ebx
lea ebx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x100a7ce0
sub edx, ebx
lea eax, [ecx + 2]
add eax, edx
push eax
call fcn.100f426e
add esp, 4
mov dword [esi + 0x28c], eax
pop ebx
test eax, eax
je 0x100a7d34
push edi
push dword [esi + 0x6c]
push str._s__s
push eax
call fcn.101d48d0
push dword [ebp + 0x10]
mov dword [esi + 0x290], 1
push esi
call fcn.100a79d0
add esp, 0x18
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push str.host_name_must_be_specified_n
jmp 0x100a7d39
push str.out_of_memory_n
lea eax, [esi + 0x294]
push eax
call fcn.100a14d0
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x101058bb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10105731

Function at 0x1010ab33
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1010a686

Function at 0x1011061a
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1011059c

Function at 0x10174ba0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x10174bb4
mov dword [esp + 0x18], fcn.10173380
jmp fcn.1016c6f0
mov dword [esp + 0x18], fcn.10172620
jmp fcn.1016c3f0
Function at 0x101d3070
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
add ecx, ebx
push esi
xor esi, esi
mov dword [ebp + 8], ecx
push edi
mov edi, 2
cmp ebx, ecx
jae 0x101d314d
movzx edx, byte [ebx]
lea ecx, [edi*8]
shl edx, cl
inc ebx
or esi, edx
sub edi, 1
jns 0x101d30f3
mov ecx, esi
mov edi, 2
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov ecx, esi
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
mov ecx, esi
shr ecx, 6
and esi, 0x3f
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
movzx ecx, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 3], cl
add eax, 4
xor esi, esi
cmp ebx, dword [ebp + 8]
jb 0x101d3093
cmp edi, 2
je 0x101d314d
mov ecx, esi
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov ecx, esi
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], cl
test edi, edi
jne 0x101d3142
shr esi, 6
and esi, 0x3f
pop edi
mov cl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], cl
mov byte [eax + 3], 0x3d
add eax, 4
sub eax, dword [ebp + 0x10]
pop esi
pop ebx
pop ebp
ret
mov cl, 0x3d
mov byte [eax + 2], cl
mov byte [eax + 3], cl
add eax, 4
sub eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x101d3160
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
add edx, ecx
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp + 0xc], edx
xor edi, edi
xor esi, esi
cmp ecx, edx
jae 0x101d322b
mov dl, byte [ecx]
inc ecx
mov dword [ebp + 8], ecx
cmp dl, 0x20
je 0x101d3223
cmp dl, 9
je 0x101d3223
cmp dl, 0xa
je 0x101d3223
cmp dl, 0xd
je 0x101d3223
cmp dl, 0x3d
jne 0x101d31c9
test esi, esi
jne 0x101d31c5
cmp edi, 2
jne 0x101d31bd
lea esi, [edi - 1]
xor ecx, ecx
jmp 0x101d31df
cmp edi, 3
jne 0x101d3223
lea esi, [edi - 1]
xor ecx, ecx
jmp 0x101d31df
lea ecx, [edx - 1]
cmp cl, 0x7d
ja 0x101d3223
movzx ecx, dl
movsx ecx, byte [ecx + 0x10255e88]
test ecx, ecx
js 0x101d3223
shl ebx, 6
inc edi
add ebx, ecx
cmp edi, 4
jne 0x101d3213
mov ecx, ebx
shr ecx, 0x10
mov byte [eax], cl
inc eax
test esi, esi
je 0x101d31fb
cmp esi, 1
jle 0x101d3207
mov ecx, ebx
shr ecx, 8
mov byte [eax], cl
inc eax
test esi, esi
je 0x101d320c
cmp esi, 2
jle 0x101d320f
mov byte [eax], bl
inc eax
xor ebx, ebx
xor edi, edi
mov ecx, dword [ebp + 8]
cmp ecx, dword [ebp + 0xc]
jb 0x101d3182
test edi, edi
je 0x101d322b
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
sub eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x101d36a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [0x10284f40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xd8], esi
cmp edi, 0x40
jle 0x101d36ff
lea eax, [ebp - 0xd4]
push eax
call fcn.101d4490
push edi
lea eax, [ebp - 0xd4]
push ebx
push eax
call fcn.101d44a0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.101d44b0
add esp, 0x18
lea ebx, [ebp - 0x24]
mov edi, 0x20
push 0x40
lea eax, [ebp - 0x64]
push 0x36
push eax
call fcn.100e6b10
push 0x40
add esi, 0x70
push 0x5c
push esi
call fcn.100e6b10
add esp, 0x18
test edi, edi
jle 0x101d373b
lea ecx, [ebp - 0x64]
mov eax, ecx
sub ebx, eax
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
lea esi, [esi + 1]
xor byte [esi - 1], al
sub edi, 1
jne 0x101d3727
mov esi, dword [ebp - 0xd8]
push esi
call fcn.101d4490
push 0x40
lea eax, [ebp - 0x64]
push eax
push esi
call fcn.101d44a0
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100e40d6
mov esp, ebp
pop ebp
ret
Function at 0x101d37e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10284f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, edx
mov dword [ebp - 0x120], edx
lea ecx, [edi + 1]
nop word [eax + eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x101d3810
sub edi, ecx
mov dword [ebp - 0x11c], 0x1000000
push edi
push edx
lea eax, [ebp - 0x114]
push eax
call fcn.101d36a0
push dword [ebp + 0x10]
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.101d44a0
push 4
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.101d44a0
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.101d44b0
lea eax, [ebp - 0x114]
push eax
call fcn.101d4490
push 0x40
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.101d44a0
push 0x20
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.101d44a0
add esp, 0x48
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.101d44b0
movups xmm0, xmmword [ebp - 0x44]
mov eax, dword [ebp + 0x14]
add esp, 8
movups xmmword [ebx], xmm0
movups xmm0, xmmword [ebp - 0x34]
movups xmmword [ebx + 0x10], xmm0
cmp eax, 2
jl 0x101d39c6
lea esi, [ebp - 0x24]
sub esi, ebx
dec eax
mov dword [ebp - 0x118], eax
nop word [eax + eax]
push edi
push dword [ebp - 0x120]
lea eax, [ebp - 0x114]
push eax
call fcn.101d36a0
push 0x20
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.101d44a0
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.101d44b0
lea eax, [ebp - 0x114]
push eax
call fcn.101d4490
push 0x40
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.101d44a0
push 0x20
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.101d44a0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.101d44b0
lea eax, [ebp - 5]
add esp, 0x44
cmp ebx, eax
ja 0x101d3983
lea ecx, [ebp - 0x24]
lea eax, [ebx + 0x1f]
cmp eax, ecx
jb 0x101d3983
mov eax, ebx
mov edx, 0x20
mov cl, byte [eax + esi]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x101d3973
jmp 0x101d39a9
mov eax, ebx
mov ecx, 2
nop word [eax + eax]
lea eax, [eax + 0x10]
movups xmm0, xmmword [eax - 0x10]
movups xmm1, xmmword [esi + eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
sub ecx, 1
jne 0x101d3990
sub dword [ebp - 0x118], 1
movups xmm0, xmmword [ebp - 0x24]
movups xmmword [ebp - 0x44], xmm0
movups xmm0, xmmword [ebp - 0x14]
movups xmmword [ebp - 0x34], xmm0
jne 0x101d38e0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e40d6
mov esp, ebp
pop ebp
ret
Function at 0x101d4930
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x10284f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
test eax, eax
jne 0x101d496c
call fcn.100fa3e1
mov dword [eax], 0x16
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e40d6
mov esp, ebp
pop ebp
ret
push ebx
push esi
lea esi, [ebp - 0x404]
mov dword [ebp - 0x410], eax
push edx
mov dword [ebp - 0x41c], esi
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x418], esi
lea esi, [ebp - 4]
push ecx
push eax
mov dword [ebp - 0x414], esi
mov dword [ebp - 0x40c], 0
mov byte [ebp - 0x408], 0
call fcn.101d4c50
mov esi, dword [ebp - 0x41c]
add esp, 0xc
mov eax, dword [ebp - 0x418]
sub esi, eax
mov bl, byte [ebp - 0x408]
test bl, bl
jne 0x101d49f6
test esi, esi
je 0x101d49f6
push dword [ebp - 0x410]
push esi
push 1
push eax
call fcn.100fc451
mov ecx, dword [ebp - 0x40c]
add esp, 0x10
add ecx, eax
movzx ebx, bl
cmp eax, esi
mov edx, 1
cmovne ebx, edx
jmp 0x101d49fc
mov ecx, dword [ebp - 0x40c]
or eax, 0xffffffff
test bl, bl
pop esi
cmovne ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100e40d6
mov esp, ebp
pop ebp
ret
Function at 0x101d5510
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
cmp ebx, 1
jne 0x101d554e
mov esi, dword [ebp + 0x10]
mov eax, dword [esi + 8]
test eax, eax
je 0x101d5541
cmp dword [esi], eax
jb 0x101d5541
cmp dword [esi + 0xc], 0
jne 0x101d5538
inc dword [esi + 0x10]
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.101d5a40
add esp, 4
mov ecx, dword [esi]
mov al, byte [ebp + 8]
mov byte [ecx], al
inc dword [esi]
pop esi
pop ebx
pop ebp
ret
test ebx, ebx
jle 0x101d55c2
mov esi, dword [ebp + 0x10]
push edi
mov eax, dword [esi + 8]
test eax, eax
je 0x101d5561
sub eax, dword [esi]
jmp 0x101d5563
mov eax, ebx
test eax, eax
jg 0x101d559c
mov eax, dword [esi + 0xc]
test eax, eax
je 0x101d55be
cmp byte [esi + 0x14], 0
mov ecx, dword [esi + 4]
jne 0x101d5595
mov edi, dword [esi]
sub edi, ecx
je 0x101d5595
push eax
push edi
push 1
push ecx
call fcn.100fc451
add dword [esi + 0x10], eax
add esp, 0x10
cmp eax, edi
je 0x101d5595
mov byte [esi + 0x14], 1
mov eax, dword [esi + 4]
mov dword [esi], eax
jmp 0x101d55b5
cmp eax, ebx
mov edi, ebx
cmovl edi, eax
push edi
push dword [ebp + 8]
push dword [esi]
call fcn.100e6b10
add dword [esi], edi
add esp, 0xc
sub ebx, edi
test ebx, ebx
jg 0x101d5556
pop edi
pop esi
pop ebx
pop ebp
ret
add dword [esi + 0x10], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x101d55d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
cmp ebx, 1
jne 0x101d5610
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov bl, byte [eax]
mov eax, dword [esi + 8]
test eax, eax
je 0x101d5606
cmp dword [esi], eax
jb 0x101d5606
cmp dword [esi + 0xc], 0
jne 0x101d55fd
inc dword [esi + 0x10]
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.101d5a40
add esp, 4
mov eax, dword [esi]
mov byte [eax], bl
inc dword [esi]
pop esi
pop ebx
pop ebp
ret
test ebx, ebx
jle 0x101d5697
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov dword [ebp + 0xc], ecx
push edi
mov eax, dword [esi + 8]
test eax, eax
je 0x101d562d
sub eax, dword [esi]
jmp 0x101d562f
mov eax, ebx
test eax, eax
jg 0x101d566b
mov eax, dword [esi + 0xc]
test eax, eax
je 0x101d5693
cmp byte [esi + 0x14], 0
mov ecx, dword [esi + 4]
jne 0x101d5661
mov edi, dword [esi]
sub edi, ecx
je 0x101d5661
push eax
push edi
push 1
push ecx
call fcn.100fc451
add dword [esi + 0x10], eax
add esp, 0x10
cmp eax, edi
je 0x101d5661
mov byte [esi + 0x14], 1
mov eax, dword [esi + 4]
mov ecx, dword [ebp + 0xc]
mov dword [esi], eax
jmp 0x101d568a
cmp eax, ebx
mov edi, ebx
cmovl edi, eax
push edi
push ecx
push dword [esi]
call fcn.100e6590
mov ecx, dword [ebp + 0xc]
add esp, 0xc
add dword [esi], edi
add ecx, edi
mov dword [ebp + 0xc], ecx
sub ebx, edi
test ebx, ebx
jg 0x101d5622
pop edi
pop esi
pop ebx
pop ebp
ret
add dword [esi + 0x10], ebx
pop edi
pop esi
pop ebx
pop ebp
ret