joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10032e04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, ecx
pop ebp
ret 4

Function at 0x10032f64
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
cmp ebx, 0xf
ja 0x10032f7e
movsx eax, byte [ebp + 0xc]
push ebx
push eax
push edi
mov dword [edi + 0x10], ebx
call fcn.10079280
add esp, 0xc
mov byte [ebx + edi], 0
mov eax, edi
pop edi
pop ebx
pop ebp
ret 8
cmp ebx, 0x7fffffff
ja 0x10032fd9
mov eax, ebx
or eax, 0xf
cmp eax, 0x7fffffff
jbe 0x10032f99
mov eax, 0x7fffffff
jmp 0x10032fa3
mov ecx, 0x16
cmp eax, ecx
cmovb eax, ecx
mov dword [ebp + 8], eax
mov ecx, edi
push esi
inc eax
push eax
call fcn.1000fad0
movsx ecx, byte [ebp + 0xc]
mov esi, eax
mov eax, dword [ebp + 8]
push ebx
push ecx
push esi
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], eax
call fcn.10079280
add esp, 0xc
mov byte [esi + ebx], 0
mov dword [edi], esi
mov eax, edi
pop esi
pop edi
pop ebx
pop ebp
ret 8
call fcn.1000b930
int3
Function at 0x10033124
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [ebp + 0x14]
push esi
push edi
mov dword [esp + 0xc], ecx
mov edx, dword [eax + 0x14]
and edx, 0x3000
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0xf
mov byte [esp + 0x20], 0
cmp edx, 0x3000
jne 0x10033117
or edi, 0xffffffff
mov dword [esp + 0x14], edi
lea esi, [edi + 0xe]
jmp 0x1003319d
mov ecx, dword [eax + 0x1c]
mov edi, dword [eax + 0x18]
test ecx, ecx
jl 0x1003312b
jg 0x10033127
test edi, edi
je 0x1003312b
mov esi, edi
jmp 0x10033143
mov eax, edi
or eax, ecx
jne 0x1003313e
test edx, edx
jne 0x1003313a
lea esi, [eax + 1]
jmp 0x1003319d
xor esi, esi
jmp 0x10033143
mov esi, 6
cmp edx, 0x2000
jne 0x1003319d
movsd xmm1, qword [ebp + 0x1c]
movaps xmm0, xmm1
andps xmm0, xmmword [0x101b1450]
comisd xmm0, xmmword [0x101afd30]
jbe 0x1003319d
lea eax, [esp + 0x10]
push eax
sub esp, 8
movsd qword [esp], xmm1
call fcn.100a82ee
mov eax, dword [esp + 0x1c]
add esp, 0xc
cdq
fstp st(0)
xor eax, edx
sub eax, edx
imul ecx, eax, 0x7597
mov eax, 0x14f8b589
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
add esi, eax
mov eax, dword [esp + 0x30]
lea ecx, [esi + 0x32]
cmp ecx, eax
ja 0x100331c0
cmp dword [esp + 0x34], 0x10
lea eax, [esp + 0x20]
mov dword [esp + 0x30], ecx
cmovae eax, dword [esp + 0x20]
mov byte [eax + ecx], 0
jmp 0x100331ce
sub ecx, eax
push 0
push ecx
lea ecx, [esp + 0x28]
call fcn.100237b0
mov esi, dword [ebp + 0x14]
lea eax, [esp + 0x18]
push dword [esi + 0x14]
push 0x4c
push eax
push dword [esp + 0x18]
call fcn.10034840
cmp dword [esp + 0x44], 0x10
lea ecx, [esp + 0x30]
movsd xmm0, qword [ebp + 0x1c]
cmovae ecx, dword [esp + 0x30]
add esp, 8
movsd qword [esp], xmm0
push edi
push eax
push dword [esp + 0x40]
push ecx
call fcn.10031820
cmp dword [esp + 0x4c], 0x10
lea ecx, [esp + 0x38]
push eax
cmovae ecx, dword [esp + 0x3c]
push ecx
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
push esi
push dword [esp + 0x40]
call fcn.10034410
mov edx, dword [esp + 0x6c]
add esp, 0x38
cmp edx, 0x10
jb 0x10033267
mov ecx, dword [esp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1003325d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10033271
push edx
push ecx
call fcn.1007739f
add esp, 8
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
call fcn.10084c47
int3
Function at 0x10033244
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [ebp + 0x14]
push esi
push edi
mov dword [esp + 0xc], ecx
mov edx, dword [eax + 0x14]
and edx, 0x3000
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0xf
mov byte [esp + 0x20], 0
cmp edx, 0x3000
jne 0x10033117
or edi, 0xffffffff
mov dword [esp + 0x14], edi
lea esi, [edi + 0xe]
jmp 0x1003319d
mov ecx, dword [eax + 0x1c]
mov edi, dword [eax + 0x18]
test ecx, ecx
jl 0x1003312b
jg 0x10033127
test edi, edi
je 0x1003312b
mov esi, edi
jmp 0x10033143
mov eax, edi
or eax, ecx
jne 0x1003313e
test edx, edx
jne 0x1003313a
lea esi, [eax + 1]
jmp 0x1003319d
xor esi, esi
jmp 0x10033143
mov esi, 6
cmp edx, 0x2000
jne 0x1003319d
movsd xmm1, qword [ebp + 0x1c]
movaps xmm0, xmm1
andps xmm0, xmmword [0x101b1450]
comisd xmm0, xmmword [0x101afd30]
jbe 0x1003319d
lea eax, [esp + 0x10]
push eax
sub esp, 8
movsd qword [esp], xmm1
call fcn.100a82ee
mov eax, dword [esp + 0x1c]
add esp, 0xc
cdq
fstp st(0)
xor eax, edx
sub eax, edx
imul ecx, eax, 0x7597
mov eax, 0x14f8b589
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
add esi, eax
mov eax, dword [esp + 0x30]
lea ecx, [esi + 0x32]
cmp ecx, eax
ja 0x100331c0
cmp dword [esp + 0x34], 0x10
lea eax, [esp + 0x20]
mov dword [esp + 0x30], ecx
cmovae eax, dword [esp + 0x20]
mov byte [eax + ecx], 0
jmp 0x100331ce
sub ecx, eax
push 0
push ecx
lea ecx, [esp + 0x28]
call fcn.100237b0
mov esi, dword [ebp + 0x14]
lea eax, [esp + 0x18]
push dword [esi + 0x14]
push 0x4c
push eax
push dword [esp + 0x18]
call fcn.10034840
cmp dword [esp + 0x44], 0x10
lea ecx, [esp + 0x30]
movsd xmm0, qword [ebp + 0x1c]
cmovae ecx, dword [esp + 0x30]
add esp, 8
movsd qword [esp], xmm0
push edi
push eax
push dword [esp + 0x40]
push ecx
call fcn.10031820
cmp dword [esp + 0x4c], 0x10
lea ecx, [esp + 0x38]
push eax
cmovae ecx, dword [esp + 0x3c]
push ecx
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
push esi
push dword [esp + 0x40]
call fcn.10034410
mov edx, dword [esp + 0x6c]
add esp, 0x38
cmp edx, 0x10
jb 0x10033267
mov ecx, dword [esp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1003325d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10033271
push edx
push ecx
call fcn.1007739f
add esp, 8
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
call fcn.10084c47
int3
Function at 0x100335c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
movzx eax, byte [esp + 5]
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, 0x2b
push edi
mov edi, ecx
mov byte [esp + 0x10], 0x25
mov ecx, dword [esi + 0x14]
mov edx, ecx
and edx, 0x20
cmovne eax, ebx
test edx, 0x20
mov byte [esp + 0x11], al
lea ebx, [esp + 0x12]
lea eax, [esp + 0x11]
cmovne eax, ebx
test cl, 8
je 0x10033549
mov byte [eax], 0x23
inc eax
mov edx, ecx
mov word [eax], 0x3649
and edx, 0xe00
mov byte [eax + 2], 0x34
cmp edx, 0x400
jne 0x10033566
mov cl, 0x6f
jmp 0x1003357d
cmp edx, 0x800
je 0x10033572
mov cl, 0x64
jmp 0x1003357d
shl cl, 3
not cl
and cl, 0x20
or cl, 0x58
push dword [ebp + 0x20]
mov byte [eax + 3], cl
push dword [ebp + 0x1c]
mov byte [eax + 4], 0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push pe_nt_image_headers32
push eax
call fcn.10031820
add esp, 0x14
push eax
lea eax, [esp + 0x1c]
push eax
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
push esi
push edi
call fcn.10033fb0
add esp, 0x20
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x10033624
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
movzx eax, byte [esp + 5]
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, 0x2b
push edi
mov edi, ecx
mov byte [esp + 0x10], 0x25
mov ecx, dword [esi + 0x14]
mov edx, ecx
and edx, 0x20
cmovne eax, ebx
test edx, 0x20
mov byte [esp + 0x11], al
lea ebx, [esp + 0x12]
lea eax, [esp + 0x11]
cmovne eax, ebx
test cl, 8
je 0x10033619
mov byte [eax], 0x23
inc eax
mov edx, ecx
mov byte [eax], 0x6c
and edx, 0xe00
cmp edx, 0x400
jne 0x10033630
mov cl, 0x6f
jmp 0x10033647
cmp edx, 0x800
je 0x1003363c
mov cl, 0x75
jmp 0x10033647
shl cl, 3
not cl
and cl, 0x20
or cl, 0x58
push dword [ebp + 0x1c]
mov byte [eax + 1], cl
mov byte [eax + 2], 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push pe_nt_image_headers32
push eax
call fcn.10031820
push eax
lea eax, [esp + 0x2c]
push eax
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
push esi
push edi
call fcn.10033fb0
add esp, 0x30
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x100336f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
movzx eax, byte [esp + 5]
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, 0x2b
push edi
mov edi, ecx
mov byte [esp + 0x10], 0x25
mov ecx, dword [esi + 0x14]
mov edx, ecx
and edx, 0x20
cmovne eax, ebx
test edx, 0x20
mov byte [esp + 0x11], al
lea ebx, [esp + 0x12]
lea eax, [esp + 0x11]
cmovne eax, ebx
test cl, 8
je 0x100336d9
mov byte [eax], 0x23
inc eax
mov edx, ecx
mov byte [eax], 0x6c
and edx, 0xe00
cmp edx, 0x400
jne 0x100336f0
mov cl, 0x6f
jmp 0x10033707
cmp edx, 0x800
je 0x100336fc
mov cl, 0x64
jmp 0x10033707
shl cl, 3
not cl
and cl, 0x20
or cl, 0x58
push dword [ebp + 0x1c]
mov byte [eax + 1], cl
mov byte [eax + 2], 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push pe_nt_image_headers32
push eax
call fcn.10031820
push eax
lea eax, [esp + 0x2c]
push eax
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
push esi
push edi
call fcn.10033fb0
add esp, 0x30
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x10033734
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
movzx eax, byte [esp + 5]
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, 0x2b
push edi
mov edi, ecx
mov byte [esp + 0x10], 0x25
mov ecx, dword [esi + 0x14]
mov edx, ecx
and edx, 0x20
cmovne eax, ebx
test edx, 0x20
mov byte [esp + 0x11], al
lea ebx, [esp + 0x12]
lea eax, [esp + 0x11]
cmovne eax, ebx
test cl, 8
je 0x100336d9
mov byte [eax], 0x23
inc eax
mov edx, ecx
mov byte [eax], 0x6c
and edx, 0xe00
cmp edx, 0x400
jne 0x100336f0
mov cl, 0x6f
jmp 0x10033707
cmp edx, 0x800
je 0x100336fc
mov cl, 0x64
jmp 0x10033707
shl cl, 3
not cl
and cl, 0x20
or cl, 0x58
push dword [ebp + 0x1c]
mov byte [eax + 1], cl
mov byte [eax + 2], 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push pe_nt_image_headers32
push eax
call fcn.10031820
push eax
lea eax, [esp + 0x2c]
push eax
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
push esi
push edi
call fcn.10033fb0
add esp, 0x30
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10033784
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
push esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [esp + 0x14], ecx
test dword [edi + 0x14], 0x4000
jne 0x1003378d
movzx eax, byte [ebp + 0x1c]
mov edx, dword [ecx]
mov esi, dword [ebp + 8]
push eax
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [edx + 0x24]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [edi + 0x30]
mov esi, dword [eax + 4]
mov ecx, esi
mov dword [esp + 0x1c], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [esp + 0x18]
push eax
call fcn.10035550
add esp, 4
mov dword [esp + 0x18], eax
test esi, esi
je 0x100337cc
mov edx, dword [esi]
mov ecx, esi
mov edx, dword [edx + 8]
call edx
test eax, eax
je 0x100337c8
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov eax, dword [esp + 0x18]
cmp byte [ebp + 0x1c], 0
lea ecx, [esp + 0x40]
mov edx, dword [eax]
push ecx
mov ecx, eax
je 0x100337e0
call dword [edx + 0x1c]
jmp 0x100337e3
call dword [edx + 0x18]
cmp dword [edi + 0x24], 0
movaps xmm0, xmmword [esp + 0x40]
mov esi, dword [edi + 0x20]
movaps xmmword [esp + 0x20], xmm0
movq xmm0, qword [esp + 0x50]
movq qword [esp + 0x30], xmm0
mov eax, dword [esp + 0x30]
jl 0x10033814
jg 0x1003380c
test esi, esi
je 0x10033814
cmp esi, eax
jbe 0x10033814
sub esi, eax
jmp 0x10033816
xor esi, esi
mov eax, dword [edi + 0x14]
and eax, 0x1c0
cmp eax, 0x40
je 0x1003384d
push esi
push dword [ebp + 0x18]
lea eax, [esp + 0x20]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [esp + 0x28]
call fcn.10033ec0
add esp, 0x18
xor esi, esi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
jmp 0x10033853
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push dword [esp + 0x30]
cmp dword [esp + 0x38], 0x10
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
push eax
push edx
push ecx
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x28]
call fcn.10033f30
push esi
push dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push eax
push ecx
push esi
push dword [esp + 0x40]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], eax
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
call fcn.10033ec0
mov eax, dword [esp + 0x64]
add esp, 0x30
cmp eax, 0x10
jb 0x100338d9
mov ecx, dword [esp + 0x20]
lea edx, [eax + 1]
mov eax, ecx
cmp edx, 0x1000
jb 0x100338cf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100338e3
push edx
push ecx
call fcn.1007739f
add esp, 8
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
call fcn.10084c47
int3
Function at 0x100337f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
push esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [esp + 0x14], ecx
test dword [edi + 0x14], 0x4000
jne 0x1003378d
movzx eax, byte [ebp + 0x1c]
mov edx, dword [ecx]
mov esi, dword [ebp + 8]
push eax
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [edx + 0x24]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [edi + 0x30]
mov esi, dword [eax + 4]
mov ecx, esi
mov dword [esp + 0x1c], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [esp + 0x18]
push eax
call fcn.10035550
add esp, 4
mov dword [esp + 0x18], eax
test esi, esi
je 0x100337cc
mov edx, dword [esi]
mov ecx, esi
mov edx, dword [edx + 8]
call edx
test eax, eax
je 0x100337c8
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov eax, dword [esp + 0x18]
cmp byte [ebp + 0x1c], 0
lea ecx, [esp + 0x40]
mov edx, dword [eax]
push ecx
mov ecx, eax
je 0x100337e0
call dword [edx + 0x1c]
jmp 0x100337e3
call dword [edx + 0x18]
cmp dword [edi + 0x24], 0
movaps xmm0, xmmword [esp + 0x40]
mov esi, dword [edi + 0x20]
movaps xmmword [esp + 0x20], xmm0
movq xmm0, qword [esp + 0x50]
movq qword [esp + 0x30], xmm0
mov eax, dword [esp + 0x30]
jl 0x10033814
jg 0x1003380c
test esi, esi
je 0x10033814
cmp esi, eax
jbe 0x10033814
sub esi, eax
jmp 0x10033816
xor esi, esi
mov eax, dword [edi + 0x14]
and eax, 0x1c0
cmp eax, 0x40
je 0x1003384d
push esi
push dword [ebp + 0x18]
lea eax, [esp + 0x20]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [esp + 0x28]
call fcn.10033ec0
add esp, 0x18
xor esi, esi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
jmp 0x10033853
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push dword [esp + 0x30]
cmp dword [esp + 0x38], 0x10
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
push eax
push edx
push ecx
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x28]
call fcn.10033f30
push esi
push dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push eax
push ecx
push esi
push dword [esp + 0x40]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], eax
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
call fcn.10033ec0
mov eax, dword [esp + 0x64]
add esp, 0x30
cmp eax, 0x10
jb 0x100338d9
mov ecx, dword [esp + 0x20]
lea edx, [eax + 1]
mov eax, ecx
cmp edx, 0x1000
jb 0x100338cf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100338e3
push edx
push ecx
call fcn.1007739f
add esp, 8
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
call fcn.10084c47
int3
Function at 0x10033834
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
push esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [esp + 0x14], ecx
test dword [edi + 0x14], 0x4000
jne 0x1003378d
movzx eax, byte [ebp + 0x1c]
mov edx, dword [ecx]
mov esi, dword [ebp + 8]
push eax
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [edx + 0x24]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [edi + 0x30]
mov esi, dword [eax + 4]
mov ecx, esi
mov dword [esp + 0x1c], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [esp + 0x18]
push eax
call fcn.10035550
add esp, 4
mov dword [esp + 0x18], eax
test esi, esi
je 0x100337cc
mov edx, dword [esi]
mov ecx, esi
mov edx, dword [edx + 8]
call edx
test eax, eax
je 0x100337c8
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov eax, dword [esp + 0x18]
cmp byte [ebp + 0x1c], 0
lea ecx, [esp + 0x40]
mov edx, dword [eax]
push ecx
mov ecx, eax
je 0x100337e0
call dword [edx + 0x1c]
jmp 0x100337e3
call dword [edx + 0x18]
cmp dword [edi + 0x24], 0
movaps xmm0, xmmword [esp + 0x40]
mov esi, dword [edi + 0x20]
movaps xmmword [esp + 0x20], xmm0
movq xmm0, qword [esp + 0x50]
movq qword [esp + 0x30], xmm0
mov eax, dword [esp + 0x30]
jl 0x10033814
jg 0x1003380c
test esi, esi
je 0x10033814
cmp esi, eax
jbe 0x10033814
sub esi, eax
jmp 0x10033816
xor esi, esi
mov eax, dword [edi + 0x14]
and eax, 0x1c0
cmp eax, 0x40
je 0x1003384d
push esi
push dword [ebp + 0x18]
lea eax, [esp + 0x20]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [esp + 0x28]
call fcn.10033ec0
add esp, 0x18
xor esi, esi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
jmp 0x10033853
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push dword [esp + 0x30]
cmp dword [esp + 0x38], 0x10
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
push eax
push edx
push ecx
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x28]
call fcn.10033f30
push esi
push dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push eax
push ecx
push esi
push dword [esp + 0x40]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], eax
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
call fcn.10033ec0
mov eax, dword [esp + 0x64]
add esp, 0x30
cmp eax, 0x10
jb 0x100338d9
mov ecx, dword [esp + 0x20]
lea edx, [eax + 1]
mov eax, ecx
cmp edx, 0x1000
jb 0x100338cf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100338e3
push edx
push ecx
call fcn.1007739f
add esp, 8
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
call fcn.10084c47
int3
Function at 0x100338a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
push esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [esp + 0x14], ecx
test dword [edi + 0x14], 0x4000
jne 0x1003378d
movzx eax, byte [ebp + 0x1c]
mov edx, dword [ecx]
mov esi, dword [ebp + 8]
push eax
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call dword [edx + 0x24]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [edi + 0x30]
mov esi, dword [eax + 4]
mov ecx, esi
mov dword [esp + 0x1c], esi
mov eax, dword [esi]
call dword [eax + 4]
lea eax, [esp + 0x18]
push eax
call fcn.10035550
add esp, 4
mov dword [esp + 0x18], eax
test esi, esi
je 0x100337cc
mov edx, dword [esi]
mov ecx, esi
mov edx, dword [edx + 8]
call edx
test eax, eax
je 0x100337c8
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov eax, dword [esp + 0x18]
cmp byte [ebp + 0x1c], 0
lea ecx, [esp + 0x40]
mov edx, dword [eax]
push ecx
mov ecx, eax
je 0x100337e0
call dword [edx + 0x1c]
jmp 0x100337e3
call dword [edx + 0x18]
cmp dword [edi + 0x24], 0
movaps xmm0, xmmword [esp + 0x40]
mov esi, dword [edi + 0x20]
movaps xmmword [esp + 0x20], xmm0
movq xmm0, qword [esp + 0x50]
movq qword [esp + 0x30], xmm0
mov eax, dword [esp + 0x30]
jl 0x10033814
jg 0x1003380c
test esi, esi
je 0x10033814
cmp esi, eax
jbe 0x10033814
sub esi, eax
jmp 0x10033816
xor esi, esi
mov eax, dword [edi + 0x14]
and eax, 0x1c0
cmp eax, 0x40
je 0x1003384d
push esi
push dword [ebp + 0x18]
lea eax, [esp + 0x20]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push dword [esp + 0x28]
call fcn.10033ec0
add esp, 0x18
xor esi, esi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], edx
jmp 0x10033853
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push dword [esp + 0x30]
cmp dword [esp + 0x38], 0x10
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
push eax
push edx
push ecx
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x28]
call fcn.10033f30
push esi
push dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push eax
push ecx
push esi
push dword [esp + 0x40]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x10], eax
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
call fcn.10033ec0
mov eax, dword [esp + 0x64]
add esp, 0x30
cmp eax, 0x10
jb 0x100338d9
mov ecx, dword [esp + 0x20]
lea edx, [eax + 1]
mov eax, ecx
cmp edx, 0x1000
jb 0x100338cf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100338e3
push edx
push ecx
call fcn.1007739f
add esp, 8
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
call fcn.10084c47
int3
Function at 0x10033944
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
mov esi, dword [edi]
mov eax, dword [esi]
mov eax, dword [eax + 4]
cmp dword [eax + esi + 0xc], 0
jne 0x1003397d
test byte [eax + esi + 0x14], 2
je 0x1003397d
mov ecx, dword [eax + esi + 0x38]
mov eax, dword [ecx]
call dword [eax + 0x34]
cmp eax, 0xffffffff
jne 0x1003397d
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + esi + 0xc]
add ecx, esi
push ecx
or eax, 4
push eax
call fcn.1000fd30
mov ecx, dword [edi]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov ecx, dword [eax + ecx + 0x38]
test ecx, ecx
je 0x10033991
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
pop ecx
ret

Function at 0x10033984
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
mov esi, dword [edi]
mov eax, dword [esi]
mov eax, dword [eax + 4]
cmp dword [eax + esi + 0xc], 0
jne 0x1003397d
test byte [eax + esi + 0x14], 2
je 0x1003397d
mov ecx, dword [eax + esi + 0x38]
mov eax, dword [ecx]
call dword [eax + 0x34]
cmp eax, 0xffffffff
jne 0x1003397d
mov eax, dword [esi]
mov ecx, dword [eax + 4]
mov eax, dword [ecx + esi + 0xc]
add ecx, esi
push ecx
or eax, 4
push eax
call fcn.1000fd30
mov ecx, dword [edi]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov ecx, dword [eax + ecx + 0x38]
test ecx, ecx
je 0x10033991
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
pop ecx
ret

Function at 0x100339c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [esi], edi
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, dword [eax + edi + 0x38]
test ecx, ecx
je 0x100339c3
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [edi]
mov eax, dword [edx + 4]
cmp dword [eax + edi + 0xc], 0
lea ecx, [eax + edi]
je 0x100339df
xor al, al
mov byte [esi + 4], al
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ecx + 0x3c]
test ecx, ecx
je 0x10033a09
cmp ecx, edi
je 0x10033a09
call fcn.10034990
mov eax, dword [edi]
mov eax, dword [eax + 4]
cmp dword [eax + edi + 0xc], 0
sete al
mov byte [esi + 4], al
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
mov al, 1
mov byte [esi + 4], al
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4