joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100375d0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test esi, esi
jbe 0x100375e8
mov dl, byte [eax + ecx]
xor dl, 0xd1
shr dl, 1
dec dl
mov byte [eax + ecx], dl
inc eax
cmp eax, esi
jb 0x100375d6
ret

Function at 0x10049850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1014ade0]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, 0x65
mov cl, 0x6c
mov dl, 0x72
mov byte [ebp - 8], cl
mov byte [ebp - 7], cl
mov cl, 0x74
mov byte [ebp - 0xe], al
mov byte [ebp - 0x2f], al
mov byte [ebp - 0x2a], al
mov byte [ebp - 0x20], al
mov byte [ebp - 0x1e], al
mov byte [ebp - 0x17], al
lea eax, [ebp - 0x30]
mov byte [ebp - 0x2e], cl
mov byte [ebp - 0x18], cl
mov byte [ebp - 0x15], cl
mov byte [ebp - 0xd], dl
mov byte [ebp - 0x2b], dl
mov byte [ebp - 0x21], dl
mov dl, 0x6e
push eax
lea ecx, [ebp - 0x10]
push ecx
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xc], 0x33
mov byte [ebp - 0xb], 0x32
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 9], 0x64
mov byte [ebp - 6], 0
mov byte [ebp - 0x30], 0x53
mov byte [ebp - 0x2d], 0x54
mov byte [ebp - 0x2c], 0x68
mov byte [ebp - 0x29], 0x61
mov byte [ebp - 0x28], 0x64
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x70
mov byte [ebp - 0x25], 0x69
mov byte [ebp - 0x24], 0x41
mov byte [ebp - 0x23], 0x77
mov byte [ebp - 0x22], 0x61
mov byte [ebp - 0x1f], dl
mov byte [ebp - 0x1d], 0x73
mov byte [ebp - 0x1c], 0x73
mov byte [ebp - 0x1b], 0x43
mov byte [ebp - 0x1a], 0x6f
mov byte [ebp - 0x19], dl
mov byte [ebp - 0x16], 0x78
mov byte [ebp - 0x14], 0
call fcn.100da690
test eax, eax
je 0x1004991c
push esi
call eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10072162
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.10072162
mov esp, ebp
pop ebp
ret
Function at 0x100543d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e7c40
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x1014ade0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov al, 0x6f
mov byte [ebp - 0x1a], al
mov byte [ebp - 0x44], al
mov byte [ebp - 0x42], al
mov byte [ebp - 0x3a], al
mov byte [ebp - 0x2c], al
mov byte [ebp - 0x2a], al
mov byte [ebp - 0x22], al
lea eax, [ebp - 0x1c]
push eax
mov dl, 0x73
mov cl, 0x20
mov bl, 0x69
push 0
push 0x1f0001
mov byte [ebp - 0x1c], 0x56
mov byte [ebp - 0x1b], 0x42
mov byte [ebp - 0x19], 0x78
mov byte [ebp - 0x18], 0x54
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x61
mov byte [ebp - 0x15], 0x79
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x48], 0x4d
mov byte [ebp - 0x47], bl
mov byte [ebp - 0x46], 0x63
mov byte [ebp - 0x45], 0x72
mov byte [ebp - 0x43], dl
mov byte [ebp - 0x41], 0x66
mov byte [ebp - 0x40], 0x74
mov byte [ebp - 0x3f], cl
mov byte [ebp - 0x3e], 0x57
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x6e
mov byte [ebp - 0x3b], 0x64
mov byte [ebp - 0x39], 0x77
mov byte [ebp - 0x38], dl
mov byte [ebp - 0x37], cl
mov byte [ebp - 0x36], 0x58
mov byte [ebp - 0x35], 0x50
mov byte [ebp - 0x34], 0
mov byte [ebp - 0x30], 0x4d
mov byte [ebp - 0x2f], bl
mov byte [ebp - 0x2e], 0x63
mov byte [ebp - 0x2d], 0x72
mov byte [ebp - 0x2b], dl
mov byte [ebp - 0x29], 0x66
mov byte [ebp - 0x28], 0x74
mov byte [ebp - 0x27], cl
mov byte [ebp - 0x26], 0x57
mov byte [ebp - 0x25], bl
mov byte [ebp - 0x24], 0x6e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x21], 0x77
mov byte [ebp - 0x20], dl
mov byte [ebp - 0x1f], cl
mov byte [ebp - 0x1e], 0x37
mov byte [ebp - 0x1d], 0
call fcn.10035d82

Function at 0x10054f80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100e99d1
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x1014ade0]
xor eax, esp
mov dword [esp + 0x278], eax
push ebx
push esi
push edi
mov eax, dword [0x1014ade0]
xor eax, esp
push eax
lea eax, [esp + 0x290]
mov dword fs:[0], eax
mov esi, ecx
call fcn.100db720
mov ecx, esi
call fcn.1006cb0b
mov eax, dword [esi + 0x44]
mov dword [0x10168fd8], eax
call fcn.10058fa0
xor ebx, ebx
push 0x101151b0
mov esi, eax
mov dword [esp + 0x28], ebx
jmp fcn.103fd1c6

Function at 0x10093590
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10093300
Function at 0x1009a2d0
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x1009a3b3
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
movzx edx, byte [esi]
jl 0x1009a34e
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
inc ecx
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x1009a3a0
shl edx, 0x10
cmp edi, 2
jne 0x1009a35f
movzx eax, byte [esi + 1]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edi, 1
jne 0x1009a38d
lea edx, [edi + 0x3c]
jmp 0x1009a39a
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x1009a2f0
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret

Function at 0x1009aee0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x1009af27
mov al, byte [edx]
test al, al
je 0x1009af27
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x1009aef7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x100a3940
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.1007acb0
mov eax, dword [0x1014ade0]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x34]
push ebp
mov ebp, dword [esp + 0x30]
dec ebp
lea edx, [ebp - 0x29]
cmp ebx, edx
push edi
Function at 0x100a4150
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x100a421c
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x100a4171
cmp al, 0x6b
jne 0x100a421c
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x100a41dd
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x100a4191
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x100a4191
cmp al, 0xbb
jne 0x100a41ba
inc ecx
cmp ecx, esi
jl 0x100a4181
sub esi, ecx
test ecx, ecx
jne 0x100a41e0
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push pe_nt_image_headers32
push 4
call fcn.1009a0f0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push pe_nt_image_headers32
push 4
call fcn.1009a0f0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x100a4209
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push pe_nt_image_headers32
push 4
call fcn.1009a0f0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.1007ae10
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push pe_nt_image_headers32
push 4
call fcn.1009a0f0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x100ae3e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.1007acb0
mov eax, dword [0x1014ade0]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0x14], ecx
test ebp, ebp
je 0x100ae42f
mov eax, 1
mov dword [esi], ebp
jmp 0x100ae431
mov ebp, dword [esi]
test ecx, ecx
je 0x100ae514
push ebp
call fcn.100afbd0
mov ebx, eax
add esp, 4
cmp ebx, 0x80
jle 0x100ae460
push str.j____int_sizeof_ctx__key_
push 0x52
push str..cryptohmachmac.c
call fcn.10099530
add esp, 0xc
mov edi, dword [esp + 0xa8]
cmp ebx, edi
jge 0x100ae4b7
mov ecx, dword [esp + 0x10]
push ecx
lea ebx, [esi + 4]
push ebp
push ebx
call fcn.100a6240
add esp, 0xc
test eax, eax
je 0x100ae5b6
mov edx, dword [esp + 0x14]
push edi
push edx
push ebx
call fcn.100a63f0
add esp, 0xc
test eax, eax
je 0x100ae5b6
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.100a6400
add esp, 0xc
test eax, eax
je 0x100ae5b6
jmp 0x100ae4f1
cmp edi, 0x80
jbe 0x100ae4d3
push str.len_0__len__int_sizeof_ctx__key_
push 0x5f
push str..cryptohmachmac.c
call fcn.10099530
add esp, 0xc
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea edx, [esi + 0x50]
push edx
call fcn.1007ae10
mov eax, dword [esp + 0xb4]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], eax
mov edi, dword [edi]
cmp edi, 0x80
je 0x100ae51c
mov ecx, pe_nt_image_headers32
sub ecx, edi
push ecx
lea edx, [edi + esi + 0x50]
push 0
push edx
call fcn.10078c00
add esp, 0xc
jmp 0x100ae51c
test eax, eax
je 0x100ae5a2
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x100ae520
mov edi, dword [esp + 0x10]
push edi
lea ebx, [esi + 0x1c]
push ebp
push ebx
call fcn.100a6240
add esp, 0xc
test eax, eax
je 0x100ae5b6
push ebp
call fcn.100afbd0
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.100a63f0
add esp, 0x10
test eax, eax
je 0x100ae5b6
xor eax, eax
mov cl, byte [esi + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x100ae564
push edi
lea ebx, [esi + 0x34]
push ebp
push ebx
call fcn.100a6240
add esp, 0xc
test eax, eax
je 0x100ae5b6
push ebp
call fcn.100afbd0
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.100a63f0
add esp, 0x10
test eax, eax
je 0x100ae5b6
lea eax, [esi + 0x1c]
push eax
add esi, 4
push esi
call fcn.100a6560
add esp, 8
test eax, eax
jne 0x100ae5ba
xor eax, eax
jmp 0x100ae5bf
mov eax, 1
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10072162
add esp, 0x8c
ret
Function at 0x100b30d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.1007acb0
mov eax, dword [esp + 0x38]
push ebx
push edi
xor edi, edi
push eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edi
call fcn.100a6830
mov ebx, eax
add esp, 4
cmp ebx, edi
jl 0x100b3311
push esi
mov esi, dword [esp + 0x48]
cmp esi, 0xffffffff
jne 0x100b3197
mov esi, ebx
mov edi, dword [esp + 0x38]
mov ecx, dword [edi + 0x10]
push ebp
push ecx
call fcn.10096560
mov ebp, eax
dec ebp
and ebp, 7
push edi
mov dword [esp + 0x24], ebp
call fcn.10097730
add esp, 8
mov edi, eax
mov dword [esp + 0x18], eax
test ebp, ebp
jne 0x100b3149
mov eax, dword [esp + 0x40]
mov byte [eax], 0
inc eax
dec edi
mov dword [esp + 0x40], eax
mov dword [esp + 0x18], edi
cmp esi, 0xfffffffe
jne 0x100b31cb
mov esi, edi
sub esi, ebx
sub esi, 2
test esi, esi
jle 0x100b3209
push 0xda
push str..crypto_rsa_rsa_pss.c
push esi
call fcn.10098b40
mov ebp, eax
add esp, 0xc
mov dword [esp + 0x10], ebp
test ebp, ebp
jne 0x100b31f7
push 0xde
push str..crypto_rsa_rsa_pss.c
push 0x41
push 0x7d
push 4
call fcn.1009a0f0
add esp, 0x14
jmp 0x100b32f4
cmp esi, 0xfffffffe
jne 0x100b31a1
jmp 0x100b310d
jge 0x100b310d
push 0xc3
push str..crypto_rsa_rsa_pss.c
push 0x88
push 0x7d
push 4
call fcn.1009a0f0
add esp, 0x14
pop esi
mov eax, edi
pop edi
pop ebx
add esp, 0x28
ret
lea edx, [ebx + esi + 2]
cmp edi, edx
jge 0x100b3155
push 0xd5
push str..crypto_rsa_rsa_pss.c
push 0x6e
push 0x7d
push 4
call fcn.1009a0f0
add esp, 0x14
mov eax, dword [esp + 0x14]
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x28
ret
push esi
push ebp
call fcn.100a04a0
add esp, 8
test eax, eax
jle 0x100b32f0
lea eax, [esp + 0x20]
sub edi, ebx
push eax
lea ebp, [edi - 1]
call fcn.100a61f0
mov ecx, dword [esp + 0x4c]
push 0
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.100a6240
push 8
lea eax, [esp + 0x34]
push 0x10108f14
push eax
call fcn.100a63f0
mov ecx, dword [esp + 0x60]
push ebx
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.100a63f0
add esp, 0x28
test esi, esi
je 0x100b3264
mov eax, dword [esp + 0x10]
push esi
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.100a63f0
add esp, 0xc
mov edx, dword [esp + 0x40]
lea eax, [edx + ebp]
push 0
push eax
lea eax, [esp + 0x28]
push eax
call fcn.100a6530
lea ecx, [esp + 0x2c]
push ecx
call fcn.100a6480
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x50]
push edx
push ebx
add eax, ebp
push eax
push ebp
mov ebp, dword [esp + 0x60]
push ebp
call fcn.100a37e0
add esp, 0x24
test eax, eax
jne 0x100b32f0
sub edi, esi
xor byte [edi + ebp - 2], 1
lea eax, [edi + ebp - 2]
inc eax
test esi, esi
jle 0x100b32c6
xor ecx, ecx
test esi, esi
jle 0x100b32c6
mov edx, dword [esp + 0x10]
mov dl, byte [ecx + edx]
xor byte [eax], dl
inc ecx
inc eax
cmp ecx, esi
jl 0x100b32b7
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x100b32df
mov ecx, 8
sub ecx, eax
mov eax, 0xff
sar eax, cl
and byte [ebp], al
mov ecx, dword [esp + 0x18]
mov byte [ecx + ebp - 1], 0xbc
mov dword [esp + 0x14], 1
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x100b31eb
push ebp
call fcn.10098ce0
mov eax, dword [esp + 0x18]
add esp, 4
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x28
ret
mov eax, edi
pop edi
pop ebx
add esp, 0x28
ret
Function at 0x100be260
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x130
call fcn.1007acb0
mov eax, dword [0x1014ade0]
xor eax, esp
mov dword [esp + 0x12c], eax
mov eax, dword [esp + 0x13c]
push ebx
push ebp
mov ebp, dword [esp + 0x158]
push esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x154]
push edi
mov edi, dword [esp + 0x144]
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], eax
mov ebx, 1
call fcn.100a6830
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
test esi, esi
jge 0x100be2c3
xor eax, eax
jmp 0x100be44d
lea ecx, [esp + 0x2c]
push ecx
call fcn.100ae6a0
mov edx, dword [esp + 0x160]
add esp, 4
mov dword [esp + 0x18], edx
test edi, edi
jne 0x100be2e8
mov dword [esp + 0x148], edi
jmp 0x100be312
cmp dword [esp + 0x148], 0xffffffff
jne 0x100be312
mov eax, edi
lea ecx, [eax + 1]
mov dword [esp + 0x10], ecx
jmp 0x100be300
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100be300
sub eax, dword [esp + 0x10]
mov dword [esp + 0x148], eax
test edx, edx
je 0x100be43b
jmp 0x100be328
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
cmp edx, esi
jg 0x100be32e
mov esi, edx
mov edx, ebx
shr edx, 0x18
mov eax, ebx
shr eax, 0x10
push 0
mov byte [esp + 0x18], dl
mov edx, dword [esp + 0x20]
push edx
mov byte [esp + 0x1d], al
mov eax, dword [esp + 0x150]
mov ecx, ebx
shr ecx, 8
push eax
mov byte [esp + 0x22], cl
lea ecx, [esp + 0x38]
push edi
push ecx
mov byte [esp + 0x2b], bl
call fcn.100ae3e0
mov edx, dword [esp + 0x164]
mov eax, dword [esp + 0x38]
push edx
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.100ae5e0
push 4
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x54]
push eax
call fcn.100ae5e0
push 0
lea ecx, [esp + 0x12c]
push ecx
lea edx, [esp + 0x60]
push edx
call fcn.100ae5f0
push esi
lea eax, [esp + 0x138]
push eax
push ebp
call fcn.1007ae10
mov eax, dword [esp + 0x198]
add esp, 0x44
cmp eax, 1
jle 0x100be426
dec eax
mov dword [esp + 0x10], eax
jmp 0x100be3d0
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x100]
push ecx
push edx
mov edx, dword [esp + 0x28]
mov eax, ecx
mov ecx, dword [esp + 0x154]
push eax
push ecx
push edi
push edx
call fcn.100ae780
add esp, 0x1c
test esi, esi
jle 0x100be41f
lea ecx, [esp + 0xfc]
mov eax, ebp
sub ecx, ebp
mov edi, esi
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub edi, 1
jne 0x100be410
mov edi, dword [esp + 0x28]
sub dword [esp + 0x10], 1
jne 0x100be3d0
mov eax, dword [esp + 0x18]
sub eax, esi
inc ebx
add ebp, esi
mov dword [esp + 0x18], eax
test eax, eax
jne 0x100be320
lea eax, [esp + 0x2c]
push eax
call fcn.100ae740
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10072162
add esp, 0x130
ret
Function at 0x100cc4c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x100cc4d9
mov esi, edi
mov edi, eax
jmp 0x100cc4db
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x100cc4eb
mov eax, ebx
jmp 0x100cc4f5
push eax
push ebx
call fcn.100967a0
add esp, 8
test eax, eax
jne 0x100cc4fd
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x100cc519
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x100cc504
cmp eax, dword [esi + 4]
jge 0x100cc530
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x100cc520
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x100cc551
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x100cc54e
dec eax
test eax, eax
jg 0x100cc540
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x100dc400
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x100dc415
xor eax, eax
jmp 0x100dc48a
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x100dc442
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x100dc485
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x100dc483
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x100dc47f
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x100dc483
xor eax, eax
jmp 0x100dc48a
jmp 0x100dc439
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x100dcee0
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100db760
add esp, 0xc
mov dword [ebp - 0x10], 0
cmp dword [0x101550d0], 0
jne 0x100dcf1d
cmp dword [0x101550cc], 0
je 0x100dcf1d
mov eax, dword [0x101550cc]
mov dword [0x101550d0], eax
cmp dword [0x101550d0], 0
je 0x100dcf9a
mov ecx, dword [0x101550d0]
cmp dword [ecx + 8], 0
je 0x100dcf9a
mov edx, dword [0x101550d0]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 8]
jb 0x100dcf9a
mov ecx, dword [0x101550d0]
mov edx, dword [ecx + 8]
cmp edx, dword [ebp - 0xc]
ja 0x100dcf9a
mov eax, dword [0x101550d0]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 8]
jb 0x100dcf69
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
jbe 0x100dcf70
xor eax, eax
jmp 0x100dd0bd
mov ecx, dword [0x101550d0]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x40]
mov dword [ecx + 8], eax
push 0x48
push 0xcc
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.10078c00
add esp, 0xc
mov eax, dword [ebp - 0x10]
jmp 0x100dd0bd
mov edx, dword [0x101550cc]
mov dword [0x101550d0], edx
jmp 0x100dcfb6
mov eax, dword [0x101550d0]
mov ecx, dword [eax + 4]
mov dword [0x101550d0], ecx
cmp dword [0x101550d0], 0
je 0x100dcff6
cmp dword [0x101550d0], 0
je 0x100dcff4
mov edx, dword [0x101550d0]
cmp dword [edx + 8], 0
je 0x100dcff4
mov eax, dword [0x101550d0]
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jb 0x100dcff4
mov edx, dword [0x101550d0]
mov eax, dword [edx + 8]
cmp eax, dword [ebp - 0xc]
ja 0x100dcff4
jmp 0x100dcf4e
jmp 0x100dcfa8
mov ecx, dword [ebp + 8]
and ecx, 0xffff
mov edx, dword [ebp + 8]
sub edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100db840
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100dd0bb
mov eax, dword [ebp - 4]
mov dword [0x101550d0], eax
mov ecx, dword [0x101550d0]
mov dword [ecx], 0x52727464
mov edx, dword [0x101550d0]
mov dword [edx + 8], 0
mov eax, dword [0x101550d0]
mov ecx, dword [0x101550cc]
mov dword [eax + 4], ecx
mov edx, dword [0x101550d0]
mov dword [0x101550cc], edx
mov dword [ebp - 0x14], 0
mov eax, dword [0x101550d0]
add eax, 0x48
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], 0x38c
jmp 0x100dd087
mov ecx, dword [ebp - 0x18]
sub ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 1
jle 0x100dd0ab
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + edx + 0x40], ecx
mov edx, dword [ebp - 0x18]
imul edx, edx, 0x48
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
jmp 0x100dd07e
mov eax, dword [0x101550d0]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 8], ecx
jmp 0x100dcf4e
xor eax, eax
mov esp, ebp
pop ebp
ret