joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10055490
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov esi, edx
mov edi, ecx
not eax
nop dword [eax]
movzx ecx, byte [edi]
lea edi, [edi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101f8c80]
sub esi, 1
jne 0x100554a0
pop edi
pop esi
not eax
ret

Function at 0x100554c0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x1005551e
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10055502
cmp edi, 2
jb 0x10055502
cmp byte [esi], cl
jne 0x10055502
cmp byte [esi + 1], cl
jne 0x10055502
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101f8c80]
jmp 0x100554d3
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x101f8c80]
test edi, edi
jne 0x100554d3
pop edi
pop esi
not eax
pop ebx
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1005554d
cmp cl, 0x23
jne 0x10055534
cmp byte [esi], cl
jne 0x10055534
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x101f8c80]
test cl, cl
jne 0x10055525
pop edi
pop esi
not eax
pop ebx
ret

Function at 0x100556c0
Capabilities:
Read file on windows

Disassembly:
push edx
push dword [esp + 0x10]
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
xor edx, edx
ret

Function at 0x100556e0
Capabilities:
Write file on windows

Disassembly:
push edx
push dword [esp + 0x10]
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
xor edx, edx
ret
Function at 0x10069140
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
push ebx
mov ebx, ecx
mov dword [esp + 8], 0xffffffff
push ebp
push esi
push edi
movq xmm0, qword [ebx + 0x70]
lea ecx, [esp + 0x1c]
mov eax, dword [ebx + 0x78]
mov edi, edx
xor edx, edx
mov dword [esp + 0x10], ebx
movq qword [esp + 0x1c], xmm0
mov dword [esp + 0x24], eax
call fcn.10067690
call fcn.10067650
test al, al
jne 0x10069196
mov edx, edi
lea ecx, [esp + 0x1c]
call fcn.100676b0
call fcn.10067650
movzx eax, al
mov dword [esp + 0x14], eax
jmp 0x100691fb
cmp al, 3
jne 0x100691fb
mov edx, 2
lea ecx, [esp + 0x1c]
call fcn.100676c0
mov edx, 2
lea ecx, [esp + 0x1c]
mov ebp, eax
call fcn.100676c0
xor esi, esi
mov ebx, eax
test ebp, ebp
jle 0x100691f7
lea ecx, [esp + 0x1c]
call fcn.10067650
movzx eax, al
lea ecx, [esp + 0x1c]
mov edx, 2
mov dword [esp + 0x18], eax
call fcn.100676c0
cmp edi, ebx
jl 0x100691e6
cmp edi, eax
jl 0x100691ef
inc esi
mov ebx, eax
cmp esi, ebp
jl 0x100691c0
jmp 0x100691f7
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x10]
movq xmm0, qword [ebx + 0x64]
sub esp, 0xc
mov eax, dword [ebx + 0x6c]
mov edx, esp
mov ecx, dword [esp + 0x20]
movq qword [edx], xmm0
mov dword [edx + 8], eax
lea eax, [esp + 0x28]
push eax
call fcn.10067a00
add esp, 4
mov ecx, esp
sub esp, 0xc
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ecx], xmm0
movq xmm0, qword [ebx + 0x34]
mov dword [ecx + 8], eax
mov ecx, esp
mov eax, dword [ebx + 0x3c]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea eax, [esp + 0x40]
push eax
call fcn.10067c60
mov edx, dword [esp + 0x54]
add esp, 0x1c
movq xmm0, qword [eax]
mov ecx, dword [eax + 8]
mov eax, edx
pop edi
pop esi
pop ebp
movq qword [edx], xmm0
mov dword [edx + 8], ecx
pop ebx
add esp, 0x24
ret
Function at 0x1006d3f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x1006d413
mov dword [esi + 4], 0
mov dword [esi], 0
call fcn.10057ad0
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x1006d434
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
call fcn.10057ad0
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1006d455
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
call fcn.10057ad0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x1006d492
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
call fcn.10057ad0
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x1006d4b3
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
call fcn.10057ad0
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x1006d4d4
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
call fcn.10057ad0
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10070ca0
Function at 0x10071f50
Capabilities:
Enumerate pe sections

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
cmp esi, 8
ja 0x1007205f
test byte [edi], 2
jne 0x1007205f
mov eax, dword [edi + 0x460]
lea esi, [esi + esi*2]
mov ecx, dword [edi + 0x48]
movss xmm2, dword [esi*8 + 0x10334990]
movss xmm4, dword [esi*8 + 0x10334994]
lea edx, [eax*8]
sub edx, eax
movzx eax, word [ecx + edx*4 + 4]
movd xmm5, eax
movzx eax, word [ecx + edx*4 + 6]
cvtdq2ps xmm5, xmm5
movd xmm3, eax
addss xmm5, dword [esi*8 + 0x10334988]
mov eax, dword [esp + 0x14]
cvtdq2ps xmm3, xmm3
movaps xmm1, xmm5
addss xmm3, dword [esi*8 + 0x1033498c]
movss dword [eax + 4], xmm4
movss dword [eax], xmm2
mov ecx, dword [esi*8 + 0x10334998]
mov edx, dword [esi*8 + 0x1033499c]
mov eax, dword [esp + 0x10]
addss xmm4, xmm3
movaps xmm0, xmm3
mov dword [eax], ecx
mov dword [eax + 4], edx
mulss xmm1, dword [edi + 0x24]
mov eax, dword [esp + 0x18]
mulss xmm0, dword [edi + 0x28]
movss dword [eax], xmm1
movaps xmm1, xmm2
movss dword [eax + 4], xmm0
addss xmm1, xmm5
addss xmm5, dword [0x1022c8b8]
movaps xmm0, xmm4
mulss xmm0, dword [edi + 0x28]
mulss xmm1, dword [edi + 0x24]
movss dword [eax + 0xc], xmm0
movaps xmm0, xmm5
addss xmm5, xmm2
movss dword [eax + 8], xmm1
mov eax, dword [esp + 0x1c]
mulss xmm0, dword [edi + 0x24]
mulss xmm3, dword [edi + 0x28]
movss dword [eax], xmm0
movss dword [eax + 4], xmm3
mulss xmm5, dword [edi + 0x24]
mulss xmm4, dword [edi + 0x28]
movss dword [eax + 8], xmm5
movss dword [eax + 0xc], xmm4
mov al, 1
pop edi
pop esi
ret 0x14
pop edi
xor al, al
pop esi
ret 0x14
Function at 0x10075ba0
Capabilities:
Compute adler32 checksum

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
mov eax, 0x5e6ea9af
push esi
push edi
mov edi, edx
xor esi, esi
mul ebx
mov ecx, 1
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, ebx
sub edx, eax
mov dword [esp + 0xc], edx
test ebx, ebx
je 0x10075cbe
push ebp
xor ebx, ebx
cmp edx, 7
jbe 0x10075c2e
mov ebp, 7
sub ebp, edi
movzx eax, byte [edi]
add ebx, 8
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add edi, 8
add esi, ecx
add ecx, eax
add esi, ecx
lea eax, [edi + ebp]
cmp eax, edx
jb 0x10075be2
xor ebp, ebp
cmp ebx, edx
jae 0x10075c82
mov eax, edx
sub eax, ebx
cmp eax, 2
jb 0x10075c73
sub edx, ebx
sub edx, 2
shr edx, 1
inc edx
lea eax, [ebx + edx*2]
mov ebx, ebp
mov dword [esp + 0x18], eax
nop
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add ebp, ecx
add edi, 2
add ecx, eax
add ebx, ecx
sub edx, 1
jne 0x10075c50
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x10]
jae 0x10075c7d
jmp 0x10075c75
mov ebx, ebp
movzx eax, byte [edi]
add ecx, eax
add esi, ecx
inc edi
lea eax, [ebx + ebp]
add esi, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul eax, edx, 0xffff000f
mov edx, dword [esp + 0x10]
add esi, eax
sub dword [esp + 0x24], edx
mov edx, 0x15b0
mov dword [esp + 0x10], edx
jne 0x10075bd4
pop ebp
shl esi, 0x10
pop edi
lea eax, [ecx + esi]
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x10083d60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 4], 2
jmp fcn.10083e20
Function at 0x1008d060
Capabilities:
Create thread

Disassembly:
sub dword [esp + 8], 1
jne 0x1008d08a
push 0
push 0
push dword [esp + 0x14]
push 0x1008a900
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [0x10335fa0]
mov ecx, dword [esp + 4]
mov dword [eax + 8], ecx
mov eax, 1
ret 0xc
Function at 0x10097c50
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword fs:[0x2c]
movaps xmm2, xmm3
mov ecx, dword [0x103357d4]
movaps xmm0, xmm2
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
mov ecx, dword [eax + ecx*4]
mulss xmm0, dword [ebx]
push esi
push edi
movss dword [esp + 0x10], xmm2
movss dword [ebp], xmm0
movaps xmm0, xmm2
mulss xmm0, dword [ebx + 4]
movss dword [ebp + 4], xmm0
mov eax, dword [0x10337cc4]
cmp eax, dword [ecx + 4]
jle 0x10097d17
push 0x10337cc4
call fcn.1014be59
add esp, 4
cmp dword [0x10337cc4], 0xffffffff
jne 0x10097d17
mov eax, dword [0x10335868]
mov edi, dword [eax + 0x30]
test edi, edi
je 0x10097d02
nop dword [eax]
mov edx, dword [edi + 0xc]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10097cc8
sub ecx, esi
lea esi, [ecx + 1]
mov ecx, 0x4fa38bcd
test esi, esi
je 0x10097cfb
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub esi, 1
jne 0x10097ce0
cmp ecx, 0x84616929
je 0x10097d04
mov edi, dword [edi + 4]
test edi, edi
jne 0x10097cc0
xor edi, edi
push 0x10337cc4
mov dword [0x10337cc0], edi
call fcn.1014be08
add esp, 4
mov ecx, dword [0x10337cc0]
movss xmm2, dword [ebx + 8]
movaps xmm1, xmm2
pop edi
mov eax, dword [ecx + 0x1c]
pop esi
mov eax, dword [eax + 0x2c]
xor eax, ecx
mov dword [esp + 0x14], eax
movss xmm0, dword [esp + 0x14]
mulss xmm0, dword [0x1022c6b8]
mulss xmm0, dword [esp + 8]
subss xmm1, xmm0
addss xmm2, xmm1
mulss xmm2, dword [0x1022c6cc]
mulss xmm2, dword [esp + 8]
movss dword [ebp + 8], xmm2
pop ebp
movss dword [ebx + 8], xmm1
pop ebx
pop ecx
ret 0xc
Function at 0x1009a7d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x103357d4]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10337cec]
cmp eax, dword [ecx + 4]
jle 0x1009a867
push 0x10337cec
call fcn.1014be59
add esp, 4
cmp dword [0x10337cec], 0xffffffff
jne 0x1009a867
mov eax, dword [0x10335868]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x1009a852
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009a818
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x1009a84b
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x1009a830
cmp ecx, 0x5c260c2a
je 0x1009a854
mov esi, dword [esi + 4]
test esi, esi
jne 0x1009a810
xor esi, esi
push 0x10337cec
mov dword [0x10337cf4], esi
call fcn.1014be08
add esp, 4
mov eax, dword [0x10337cf4]
pop edi
pop esi
ret

Function at 0x1009c810
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101a7fdd
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10242040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 1
call fcn.1014ba5d
mov dword [ebp - 0x10], eax
lea edi, [esi + 4]
mov dword [ebp - 4], 0
push edi
push 0
push eax
push 0x1009c9e0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x1009c87c
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [edi], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1009cb20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x103357d4]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10337d1c]
cmp eax, dword [ecx + 4]
jle 0x1009cbb7
push 0x10337d1c
call fcn.1014be59
add esp, 4
cmp dword [0x10337d1c], 0xffffffff
jne 0x1009cbb7
mov eax, dword [0x10335868]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x1009cba2
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009cb68
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x1009cb9b
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x1009cb80
cmp ecx, 0xee8b9a11
je 0x1009cba4
mov esi, dword [esi + 4]
test esi, esi
jne 0x1009cb60
xor esi, esi
push 0x10337d1c
mov dword [0x10337d2c], esi
call fcn.1014be08
add esp, 4
mov eax, dword [0x10337d2c]
pop edi
pop esi
ret
Function at 0x1009cbc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x103357d4]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10337d18]
cmp eax, dword [ecx + 4]
jle 0x1009cc57
push 0x10337d18
call fcn.1014be59
add esp, 4
cmp dword [0x10337d18], 0xffffffff
jne 0x1009cc57
mov eax, dword [0x10335868]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x1009cc42
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009cc08
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x1009cc3b
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x1009cc20
cmp ecx, 0xbaadee37
je 0x1009cc44
mov esi, dword [esi + 4]
test esi, esi
jne 0x1009cc00
xor esi, esi
push 0x10337d18
mov dword [0x10337d34], esi
call fcn.1014be08
add esp, 4
mov eax, dword [0x10337d34]
pop edi
pop esi
ret

Function at 0x1009cc60
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x103357d4]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10337d38]
cmp eax, dword [ecx + 4]
jle 0x1009ccf7
push 0x10337d38
call fcn.1014be59
add esp, 4
cmp dword [0x10337d38], 0xffffffff
jne 0x1009ccf7
mov eax, dword [0x10335868]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x1009cce2
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009cca8
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x1009ccdb
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x1009ccc0
cmp ecx, 0xad013136
je 0x1009cce4
mov esi, dword [esi + 4]
test esi, esi
jne 0x1009cca0
xor esi, esi
push 0x10337d38
mov dword [0x10337d30], esi
call fcn.1014be08
add esp, 4
mov eax, dword [0x10337d30]
pop edi
pop esi
ret

Function at 0x1009cd00
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x103357d4]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10337d20]
cmp eax, dword [ecx + 4]
jle 0x1009cd97
push 0x10337d20
call fcn.1014be59
add esp, 4
cmp dword [0x10337d20], 0xffffffff
jne 0x1009cd97
mov eax, dword [0x10335868]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x1009cd82
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009cd48
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x1009cd7b
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x1009cd60
cmp ecx, 0x84616929
je 0x1009cd84
mov esi, dword [esi + 4]
test esi, esi
jne 0x1009cd40
xor esi, esi
push 0x10337d20
mov dword [0x10337d3c], esi
call fcn.1014be08
add esp, 4
mov eax, dword [0x10337d3c]
pop edi
pop esi
ret
Function at 0x1009cda0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x103357d4]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10337d28]
cmp eax, dword [ecx + 4]
jle 0x1009ce37
push 0x10337d28
call fcn.1014be59
add esp, 4
cmp dword [0x10337d28], 0xffffffff
jne 0x1009ce37
mov eax, dword [0x10335868]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x1009ce22
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009cde8
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x1009ce1b
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x1009ce00
cmp ecx, 0xb5599648
je 0x1009ce24
mov esi, dword [esi + 4]
test esi, esi
jne 0x1009cde0
xor esi, esi
push 0x10337d28
mov dword [0x10337d24], esi
call fcn.1014be08
add esp, 4
mov eax, dword [0x10337d24]
pop edi
pop esi
ret
Function at 0x100ab9d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x100aba1f
lea edx, [esi + 8]
mov edi, eax
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x100ab9e2
mov eax, dword [esi]
jmp 0x100abb05
cmp eax, 0x4e0
jb 0x100abb05
push ebx
mov ebx, dword [esi + 0x9c4]
lea edi, [esi + 0x9c4]
push ebp
mov ebp, 0xe3
nop dword [eax]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x630]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebp, 1
jne 0x100aba40
mov ebx, dword [esi + 0xd50]
lea edi, [esi + 0xd50]
mov ebp, 0x18c
nop dword [eax]
mov eax, ebx
lea edi, [edi + 4]
mov ebx, dword [edi]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi - 0xd50]
xor eax, ecx
mov dword [edi - 0x9c4], eax
sub ebp, 1
jne 0x100aba90
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
pop ebx
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret
Function at 0x100b6b20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x103357d4]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10339208]
cmp eax, dword [ecx + 4]
jle 0x100b6bb7
push 0x10339208
call fcn.1014be59
add esp, 4
cmp dword [0x10339208], 0xffffffff
jne 0x100b6bb7
mov eax, dword [0x10335868]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x100b6ba2
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100b6b68
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x100b6b9b
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x100b6b80
cmp ecx, 0xbbefcb72
je 0x100b6ba4
mov esi, dword [esi + 4]
test esi, esi
jne 0x100b6b60
xor esi, esi
push 0x10339208
mov dword [0x103391dc], esi
call fcn.1014be08
add esp, 4
mov eax, dword [0x103391dc]
pop edi
pop esi
ret
Function at 0x100b9450
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x103357d4]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x103392a8]
cmp eax, dword [ecx + 4]
jle 0x100b94e7
push 0x103392a8
call fcn.1014be59
add esp, 4
cmp dword [0x103392a8], 0xffffffff
jne 0x100b94e7
mov eax, dword [0x10335868]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x100b94d2
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100b9498
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x100b94cb
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x100b94b0
cmp ecx, 0x77798729
je 0x100b94d4
mov esi, dword [esi + 4]
test esi, esi
jne 0x100b9490
xor esi, esi
push 0x103392a8
mov dword [0x103392b0], esi
call fcn.1014be08
add esp, 4
mov ecx, dword [0x103392b0]
mov eax, dword [ecx + 0x1c]
mov eax, dword [eax + 0x30]
xor eax, ecx
jne 0x100b9533
mov eax, dword [0x10335fb8]
cmp byte [eax + 0x17da], 0
je 0x100b9533
mov eax, dword [0x10336270]
mov ecx, dword [eax + 8]
mov eax, dword [ecx + 0x25c]
sub eax, 8
je 0x100b9533
sub eax, 1
je 0x100b9533
sub eax, 1
je 0x100b9533
test byte [ecx + 0x104], 1
jne 0x100b9533
mov eax, dword [esp + 0xc]
and dword [eax + 0x30], 0xfffffffd
pop edi
pop esi
ret 4

Function at 0x100bb410
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov edx, ecx
mov dword [esp + 4], edx
push ebx
push ebp
push esi
push edi
test eax, eax
jne 0x100bb42f
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
xor esi, esi
xor ebx, ebx
mov dword [esp + 0x10], esi
cmp dword [eax + 4], ebx
jle 0x100bb4c5
mov ecx, dword [esp + 0x20]
xor ebp, ebp
mov edi, dword [eax]
mov eax, dword [edi + ebp + 0x28]
add edi, ebp
test eax, eax
je 0x100bb474
cmp dword [eax + 4], 0
jle 0x100bb474
push 0
push ecx
push eax
mov ecx, edx
call fcn.100bb410
mov ecx, eax
test ecx, ecx
je 0x100bb474
mov eax, dword [edi + 0x2c]
add eax, ecx
add esi, eax
mov dword [esp + 0x10], esi
mov edx, dword [edi]
mov eax, edx
lea esi, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100bb480
sub eax, esi
mov esi, 0x4fa38bcd
lea ecx, [eax + 1]
test ecx, ecx
je 0x100bb4a8
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, esi
imul esi, eax, 0xf1546419
sub ecx, 1
jne 0x100bb495
mov ecx, dword [esp + 0x20]
cmp esi, ecx
je 0x100bb4d1
mov eax, dword [esp + 0x1c]
inc ebx
mov esi, dword [esp + 0x10]
add ebp, 0x3c
mov edx, dword [esp + 0x14]
cmp ebx, dword [eax + 4]
jl 0x100bb446
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov eax, dword [edi + 0x2c]
add eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x100bb4f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [ecx + 4]
push esi
push edi
mov edi, dword [ecx]
cmp edi, ebp
je 0x100bb545
nop dword [eax]
mov ebx, dword [edi]
test ebx, ebx
je 0x100bb53e
mov edx, dword [ebx + 0xc]
mov eax, edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100bb510
sub eax, esi
mov ecx, 0x4fa38bcd
lea esi, [eax + 1]
test esi, esi
je 0x100bb538
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub esi, 1
jne 0x100bb525
cmp ecx, dword [esp + 0x14]
je 0x100bb54e
add edi, 4
cmp edi, ebp
jne 0x100bb500
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 4