joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004ccc0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100800dd
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movaps xmm0, xmmword [0x1008f930]
mov esi, 0x28
xor eax, eax
mov dword [ebp - 0x50], esi
movups xmmword [ebp - 0x4c], xmm0
mov word [ebp - 0x23], ax
movaps xmm0, xmmword [0x10090090]
mov byte [ebp - 0x21], al
lea eax, [esi + 1]
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x2c], 0x3f26593f
mov dword [ebp - 0x28], 0x2b3f285c
mov byte [ebp - 0x24], 0x2a
call fcn.1007cdb0
xor edx, edx
mov edi, esp
lea ecx, [edx + edi]
lea edi, [ebp - 0x4b]
sub edi, esp
sub esi, edx
mov dl, byte [ebp - 0x4c]
nop dword [eax]
mov al, byte [ecx + edi]
lea ecx, [ecx + 1]
xor al, dl
mov byte [ecx - 1], al
sub esi, 1
jne 0x1004cd40
mov esi, 0x28
mov dword [ebp - 0x20], 0xa
mov edi, esp
mov dword [ebp - 0x1c], 0x666f6401
mov dword [ebp - 0x18], 0x2f646f68
mov dword [ebp - 0x14], 0x6d6d65
lea eax, [esi - 0x1c]
mov byte [edi + esi], 0
call fcn.1007cd80
mov eax, esp
lea esi, [ebp - 0x1b]
mov ecx, eax
sub esi, eax
mov edx, 0xa
nop dword [eax]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, 1
mov byte [ecx - 1], al
sub edx, 1
jne 0x1004cd90
mov esi, esp
mov ecx, edi
sub esp, 0x18
mov dword [ebp - 0x5c], esp
mov byte [esi + 0xa], dl
lea eax, [ecx + 1]
mov edx, esp
mov dword [ebp - 0x54], eax
mov dword [edx], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1004cdd0
sub ecx, dword [ebp - 0x54]
push ecx
push edi
mov ecx, edx
call fcn.100109d0
sub esp, 0x18
mov dword [ebp - 4], 0
mov edx, esp
mov ecx, esi
mov dword [edx], 0
lea edi, [ecx + 1]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1004ce08
sub ecx, edi
push ecx
push esi
mov ecx, edx
call fcn.100109d0
mov dword [ebp - 4], 0xffffffff
call fcn.10078060
add esp, 0x30
lea esp, [ebp - 0x68]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret
Function at 0x1004e540
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x100ec5b8]
mov dword [ebp - 0x28], ecx
push ebx
push esi
push edi
test ax, ax
jne 0x1004e604
movaps xmm0, xmmword [0x1008ff10]
mov edi, 0x17
mov dword [ebp - 0x24], edi
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x686c5d60
lea eax, [edi + 1]
mov dword [ebp - 0xc], 0x647c4764
mov dword [ebp - 8], 0
call fcn.1007cdb0
mov ah, byte [ebp - 0x20]
lea ebx, [ebp - 0x1f]
mov edx, esp
xor esi, esi
sub ebx, edx
sub edi, esi
lea ecx, [esi + edx]
mov al, byte [ecx + ebx]
lea ecx, [ecx + 1]
xor al, ah
mov byte [ecx - 1], al
sub edi, 1
jne 0x1004e5a6
mov edi, 0x17
mov ecx, edx
mov byte [edx + edi], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1004e5c4
sub ecx, esi
lea esi, [ecx + 1]
mov ecx, 0x811c9dc5
test esi, esi
je 0x1004e5f3
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
sub esi, 1
jne 0x1004e5e0
mov dword [0x100ec5b4], ecx
call fcn.10040d60
mov word [0x100ec5b8], ax
movzx eax, ax
add eax, dword [ebp - 0x28]
lea esp, [ebp - 0x38]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret
Function at 0x1004fbb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x24], eax
call fcn.1004f6b0
movaps xmm0, xmmword [str.7G_VNREh_BEC]
mov esi, 0xb
mov dword [ebp - 0x1c], esi
movups xmmword [ebp - 0x18], xmm0
lea eax, [esi + 1]
call fcn.1007cdb0
mov edi, esp
lea ebx, [ebp - 0x17]
xor edx, edx
mov dword [ebp - 0x20], edi
sub ebx, edi
sub esi, edx
lea ecx, [edx + edi]
mov dl, byte [ebp - 0x18]
nop dword [eax]
mov al, byte [ecx + ebx]
lea ecx, [ecx + 1]
xor al, dl
mov byte [ecx - 1], al
sub esi, 1
jne 0x1004fc00
movaps xmm0, xmmword [0x1008e240]
mov ebx, 0xd
mov esi, 0xb
mov dword [ebp - 0x1c], ebx
movups xmmword [ebp - 0x18], xmm0
lea eax, [ebx + 1]
mov byte [edi + esi], 0
call fcn.1007cdb0
xor edx, edx
lea edi, [ebp - 0x17]
mov esi, esp
sub edi, esi
sub ebx, edx
lea ecx, [edx + esi]
mov dl, byte [ebp - 0x18]
mov al, byte [ecx + edi]
lea ecx, [ecx + 1]
xor al, dl
mov byte [ecx - 1], al
sub ebx, 1
jne 0x1004fc45
mov edi, dword [ebp - 0x20]
mov ebx, 0xd
xorps xmm1, xmm1
mov byte [esi + ebx], 0
movsd xmm0, qword [0x100eac70]
mov ebx, dword [ebp - 0x24]
ucomisd xmm0, xmm1
lahf
test ah, 0x44
jnp 0x1004fcb5
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x1004fca0
test cl, cl
je 0x1004fc9c
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x1004fca0
add eax, 2
add edi, 2
test cl, cl
jne 0x1004fc80
xor eax, eax
jmp 0x1004fca5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1004fcb2
mov ecx, ebx
call fcn.1004edd0
jmp 0x1004fd00
xorps xmm1, xmm1
movsd xmm0, qword [0x100eac78]
ucomisd xmm0, xmm1
lahf
test ah, 0x44
jnp 0x1004fd00
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 4]
nop
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x1004fcf0
test cl, cl
je 0x1004fcec
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x1004fcf0
add eax, 2
add esi, 2
test cl, cl
jne 0x1004fcd0
xor eax, eax
jmp 0x1004fcf5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1004fd00
mov ecx, ebx
call fcn.1004e800
lea esp, [ebp - 0x38]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret 4
Function at 0x10053af0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100806d0
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xf0
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
cvttsd2si eax, qword [0x100eb210]
push eax
call fcn.100525a0
mov edi, 9
mov dword [ebp - 0x2c], 0x1191e77
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x28], 0x18031912
mov dword [ebp - 0x24], 0xe05
lea eax, [edi + 1]
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x2b]
xor ecx, ecx
sub edi, esi
lea edx, [ecx + esi]
mov esi, 9
sub esi, ecx
mov cl, byte [ebp - 0x2c]
nop dword [eax]
mov al, byte [edx + edi]
lea edx, [edx + 1]
xor al, cl
mov byte [edx - 1], al
sub esi, 1
jne 0x10053b80
mov esi, esp
lea ecx, [ebp - 0x100]
sub esp, 0xc
mov edi, 9
push esi
mov byte [esi + edi], 0
call fcn.10010120
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov edi, dword [ebp - 0x3c]
push 0xc
movq qword [ebp - 0x48], xmm0
mov byte [ebp - 0x50], 2
mov esi, dword [edi + 4]
mov edi, dword [edi]
mov dword [ebp - 0x38], esi
movlpd qword [ebp - 0x20], xmm0
call fcn.1007ba14
lea ecx, [ebp - 0x15]
mov dword [ebp - 0x34], eax
add esp, 4
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
mov ecx, esi
mov dword [eax], 0
sub ecx, edi
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov eax, 0x2aaaaaab
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x3c], eax
je 0x10053c8c
cmp eax, 0xfffffff
ja 0x10053cdd
push eax
call fcn.10014b00
mov ecx, dword [ebp - 0x3c]
mov esi, eax
mov eax, dword [ebp - 0x34]
shl ecx, 4
add ecx, esi
mov dword [ebp - 0x3c], eax
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], ecx
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 3
cmp edi, dword [ebp - 0x38]
je 0x10053c87
xorps xmm0, xmm0
mov byte [esi], 0
mov edx, edi
movq qword [esi + 8], xmm0
mov ecx, esi
call fcn.100531e0
add esi, 0x10
add edi, 0x30
mov dword [ebp - 0x28], esi
cmp edi, dword [ebp - 0x38]
jne 0x10053c62
mov eax, dword [ebp - 0x34]
mov dword [eax + 4], esi
jmp 0x10053c8f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x40]
lea edx, [ebp - 0x50]
mov byte [ebp - 4], 4
call fcn.1000e840
push dword [ebp - 0x50]
lea ecx, [ebp - 0x48]
call fcn.10010470
lea ecx, [ebp - 0x100]
call fcn.1000dbc0
lea esp, [ebp - 0x10c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.100148d0
int3
Function at 0x10054c40
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008083d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movaps xmm0, xmmword [str._FIzPUADQ_WDQ_]
mov edi, 0xd
mov dword [ebp - 0x2c], edi
movups xmmword [ebp - 0x28], xmm0
lea eax, [edi + 1]
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x27]
xor edx, edx
mov dword [ebp - 0x30], esi
sub edi, esi
lea ecx, [edx + esi]
mov esi, 0xd
sub esi, edx
mov dl, byte [ebp - 0x28]
mov al, byte [ecx + edi]
lea ecx, [ecx + 1]
xor al, dl
mov byte [ecx - 1], al
sub esi, 1
jne 0x10054cb2
mov esi, esp
mov dword [ebp - 0x24], 0x5467680b
mov edi, 0xd
mov dword [ebp - 0x20], 0x6e7f6562
mov dword [ebp - 0x1c], 0x7b79
mov byte [esi + edi], 0
mov edi, 9
mov dword [ebp - 0x28], edi
lea eax, [edi + 1]
call fcn.1007cdb0
mov esi, esp
lea edi, [ebp - 0x23]
xor edx, edx
sub edi, esi
lea ecx, [edx + esi]
mov esi, 9
sub esi, edx
mov dl, byte [ebp - 0x24]
mov al, byte [ecx + edi]
lea ecx, [ecx + 1]
xor al, dl
mov byte [ecx - 1], al
sub esi, 1
jne 0x10054d08
mov eax, dword fs:[0x2c]
mov edi, 9
mov ecx, dword [0x100e42e0]
mov esi, esp
mov byte [esi + edi], 0
mov edi, dword [eax + ecx*4]
mov eax, dword [0x100f1878]
cmp eax, dword [edi + 4]
jle 0x10054d85
push 0x100f1878
call fcn.1007bfd7
add esp, 4
cmp dword [0x100f1878], 0xffffffff
jne 0x10054d85
push dword [ebp - 0x30]
mov dword [ebp - 4], 0
mov ecx, dword [0x100e898c]
mov eax, dword [ecx]
mov eax, dword [eax + 0x38]
call eax
push 0x100f1878
mov dword [0x100f1880], eax
mov dword [ebp - 4], 0xffffffff
call fcn.1007bf8d
add esp, 4
mov eax, dword [0x100f187c]
cmp eax, dword [edi + 4]
jle 0x10054dcf
push 0x100f187c
call fcn.1007bfd7
add esp, 4
cmp dword [0x100f187c], 0xffffffff
jne 0x10054dcf
mov dword [ebp - 4], 1
mov ecx, dword [0x100e898c]
push esi
mov eax, dword [ecx]
mov eax, dword [eax + 0x38]
call eax
push 0x100f187c
mov dword [0x100f1884], eax
call fcn.1007bf8d
add esp, 4
mov eax, dword [0x100f1884]
mov edx, dword [eax + 0x2c]
xor edx, eax
mov eax, dword [0x100f1880]
mov dword [ebp - 0x34], edx
movss xmm1, dword [ebp - 0x34]
mov dword [ebp - 0x34], edx
mov ecx, dword [eax + 0x2c]
xor ecx, eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [ebp - 0x34]
comiss xmm0, xmm1
movss dword [ebp - 0x30], xmm1
mov eax, dword [ebp - 0x30]
cmovae eax, edx
mov dword [ebp - 0x30], eax
movss xmm0, dword [ebp - 0x30]
lea esp, [ebp - 0x4c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x10055770
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x100ec5d0]
mov dword [ebp - 0x28], ecx
push ebx
push esi
push edi
test ax, ax
jne 0x10055834
movaps xmm0, xmmword [0x100902f0]
mov edi, 0x17
mov dword [ebp - 0x24], edi
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x10], 0x56496a5b
lea eax, [edi + 1]
mov dword [ebp - 0xc], 0x5d5c4d4d
mov dword [ebp - 8], 0
call fcn.1007cdb0
mov ah, byte [ebp - 0x20]
lea ebx, [ebp - 0x1f]
mov edx, esp
xor esi, esi
sub ebx, edx
sub edi, esi
lea ecx, [esi + edx]
mov al, byte [ecx + ebx]
lea ecx, [ecx + 1]
xor al, ah
mov byte [ecx - 1], al
sub edi, 1
jne 0x100557d6
mov edi, 0x17
mov ecx, edx
mov byte [edx + edi], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100557f4
sub ecx, esi
lea esi, [ecx + 1]
mov ecx, 0x811c9dc5
test esi, esi
je 0x10055823
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
sub esi, 1
jne 0x10055810
mov dword [0x100ec5c8], ecx
call fcn.10040d60
mov word [0x100ec5d0], ax
movzx eax, ax
add eax, dword [ebp - 0x28]
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret

Function at 0x10055850
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x100ec5c4]
mov dword [ebp - 0x30], ecx
push ebx
push esi
push edi
test ax, ax
jne 0x10055909
movaps xmm0, xmmword [0x1008f230]
mov edi, 0x1c
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x2c], edi
movaps xmm0, xmmword [0x1008dd20]
lea eax, [edi + 1]
movups xmmword [ebp - 0x18], xmm0
call fcn.1007cdb0
mov ah, byte [ebp - 0x28]
lea ebx, [ebp - 0x27]
mov edx, esp
xor esi, esi
sub ebx, edx
sub edi, esi
lea ecx, [esi + edx]
nop dword [eax]
mov al, byte [ecx + ebx]
lea ecx, [ecx + 1]
xor al, ah
mov byte [ecx - 1], al
sub edi, 1
jne 0x100558b0
mov edi, 0x1c
mov ecx, edx
mov byte [edx + edi], 0
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100558d0
sub ecx, esi
lea esi, [ecx + 1]
mov ecx, 0x811c9dc5
test esi, esi
je 0x100558f8
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
sub esi, 1
jne 0x100558e5
mov dword [0x100ec5d4], ecx
call fcn.10040d60
mov word [0x100ec5c4], ax
movzx eax, ax
add eax, dword [ebp - 0x30]
lea esp, [ebp - 0x3c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret
Function at 0x10055930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100808cd
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movaps xmm0, xmmword [0x100905e0]
mov esi, 0x19
mov dword [ebp - 0x30], esi
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], 0x716e716e
lea eax, [esi + 1]
mov dword [ebp - 0x18], 0x716e716e
mov dword [ebp - 0x14], 0x6967
call fcn.1007cdb0
xor edx, edx
mov edi, esp
lea ecx, [edx + edi]
lea edi, [ebp - 0x2b]
sub edi, esp
sub esi, edx
mov dl, byte [ebp - 0x2c]
nop dword [eax + eax]
mov al, byte [ecx + edi]
lea ecx, [ecx + 1]
xor al, dl
mov byte [ecx - 1], al
sub esi, 1
jne 0x100559a0
mov esi, 0x19
mov dword [ebp - 0x20], 0xa
mov edi, esp
mov dword [ebp - 0x1c], 0x383d3251
mov dword [ebp - 0x18], 0x7f253f34
mov dword [ebp - 0x14], 0x3d3d35
lea eax, [esi - 0xd]
mov byte [edi + esi], 0
call fcn.1007cd80
mov eax, esp
lea esi, [ebp - 0x1b]
mov ecx, eax
sub esi, eax
mov edx, 0xa
nop dword [eax]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, 0x51
mov byte [ecx - 1], al
sub edx, 1
jne 0x100559f0
mov esi, esp
mov ecx, edi
sub esp, 0x18
mov dword [ebp - 0x3c], esp
mov byte [esi + 0xa], dl
lea eax, [ecx + 1]
mov edx, esp
mov dword [ebp - 0x34], eax
mov dword [edx], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10055a30
sub ecx, dword [ebp - 0x34]
push ecx
push edi
mov ecx, edx
call fcn.100109d0
sub esp, 0x18
mov dword [ebp - 4], 0
mov edx, esp
mov ecx, esi
mov dword [edx], 0
lea edi, [ecx + 1]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10055a68
sub ecx, edi
push ecx
push esi
mov ecx, edx
call fcn.100109d0
mov dword [ebp - 4], 0xffffffff
call fcn.10078060
add esp, 0x30
lea esp, [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret
Function at 0x10056400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008093d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movaps xmm0, xmmword [0x1008edc0]
mov eax, 0x1c
mov dword [ebp - 0x30], 0x1a
mov byte [ebp - 0x2c], 0x2e
movups xmmword [ebp - 0x2b], xmm0
mov dword [ebp - 0x1b], 0x17680e6c
mov dword [ebp - 0x17], 0xe68680e
mov word [ebp - 0x13], 0x1b1f
mov byte [ebp - 0x11], 0
call fcn.1007cdb0
mov edi, esp
lea edx, [ebp - 0x12]
xor eax, eax
lea ecx, [edi + 0x19]
cmp edi, edx
ja 0x10056477
lea edx, [ebp - 0x2b]
cmp ecx, edx
jae 0x1005648e
movaps xmm0, xmmword [0x1008f350]
mov eax, 0x10
pxor xmm0, xmmword [0x1008edc0]
movups xmmword [edi], xmm0
lea esi, [ebp - 0x2b]
mov edx, 0x1a
sub esi, edi
lea ecx, [eax + edi]
sub edx, eax
nop dword [eax]
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, 0x2e
mov byte [ecx - 1], al
sub edx, 1
jne 0x100564a0
lea eax, [edx + 0xc]
mov byte [edi + 0x1a], dl
mov dword [ebp - 0x20], 0xa
mov dword [ebp - 0x1c], 0x343d3653
mov dword [ebp - 0x18], 0x7d363d3a
mov dword [ebp - 0x14], 0x3f3f37
call fcn.1007cd80
mov eax, esp
lea esi, [ebp - 0x1b]
mov ecx, eax
sub esi, eax
mov edx, 0xa
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, 0x53
mov byte [ecx - 1], al
sub edx, 1
jne 0x100564e5
mov esi, esp
mov ecx, edi
sub esp, 0x18
mov dword [ebp - 0x38], esp
mov byte [esi + 0xa], dl
lea eax, [ecx + 1]
mov edx, esp
mov dword [ebp - 0x34], eax
mov dword [edx], 0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10056520
sub ecx, dword [ebp - 0x34]
push ecx
push edi
mov ecx, edx
call fcn.100109d0
sub esp, 0x18
mov dword [ebp - 4], 0
mov edx, esp
mov ecx, esi
mov dword [edx], 0
lea edi, [ecx + 1]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10056558
sub ecx, edi
push ecx
push esi
mov ecx, edx
call fcn.100109d0
mov dword [ebp - 4], 0xffffffff
call fcn.10078060
add esp, 0x30
lea esp, [ebp - 0x44]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret
Function at 0x1005a6f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x14], eax
mov ebx, ecx
push edi
mov eax, 8
mov dword [ebp - 0x10], 6
mov dword [ebp - 0xc], 0x15030570
mov dword [ebp - 8], 0x141902
call fcn.1007cd80
mov edi, esp
lea esi, [ebp - 0xb]
mov ecx, edi
sub esi, edi
mov edx, 6
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, 0x70
mov byte [ecx - 1], al
sub edx, 1
jne 0x1005a738
mov eax, dword [0x100e8994]
mov ecx, dword [ebp - 0x14]
mov byte [edi + 6], dl
push edx
mov eax, dword [eax]
push edi
mov esi, dword [eax + 0x24]
mov eax, dword [ecx]
call dword [eax + 0x18]
mov ecx, dword [0x100e8994]
push eax
call esi
mov ecx, dword [0x100e8960]
push eax
mov edx, dword [ecx]
call dword [edx + 0xc]
mov ecx, dword [0x100e8ffc]
cmp eax, dword [ecx]
jne 0x1005a7d4
mov ecx, dword [0x100e8994]
mov eax, dword [ecx]
call dword [eax + 0x138]
push 0
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x24]
mov dword [ebp - 0x14], ecx
mov ecx, eax
call dword [ebp - 0x14]
mov ecx, dword [0x100e8968]
fstp dword [ebp - 0x14]
movss xmm0, dword [ebp - 0x14]
divss xmm0, dword [ecx + 0x20]
mov ecx, dword [ecx + 0x1c]
addss xmm0, dword [0x1008d574]
cvttss2si eax, xmm0
sub ecx, eax
push ecx
mov ecx, ebx
call fcn.1005a680
test eax, eax
je 0x1005a7d4
push eax
lea ecx, [ebx + 0x14]
call fcn.1005c5c0
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret 4
Function at 0x1005cdc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x100ec640]
mov dword [ebp - 0x28], ecx
push esi
push edi
test ax, ax
jne 0x1005cec9
movaps xmm0, xmmword [0x100906f0]
mov byte [ebp - 5], al
mov eax, 0x20
mov dword [ebp - 0x24], 0x1a
mov byte [ebp - 0x20], 0x1b
movups xmmword [ebp - 0x1f], xmm0
mov dword [ebp - 0xf], 0x7e7f7456
mov dword [ebp - 0xb], 0x7f755277
mov word [ebp - 7], 0x637e
call fcn.1007cdb0
mov edx, esp
lea esi, [ebp - 6]
xor eax, eax
lea ecx, [edx + 0x19]
cmp edx, esi
ja 0x1005ce43
lea esi, [ebp - 0x1f]
cmp ecx, esi
jae 0x1005ce5a
movaps xmm0, xmmword [str.eeeeeeeeeeeeeeeerd311111113_3er_]
mov eax, 0x10
pxor xmm0, xmmword [0x100906f0]
movups xmmword [edx], xmm0
lea edi, [ebp - 0x1f]
mov esi, 0x1a
sub edi, edx
lea ecx, [eax + edx]
sub esi, eax
nop dword [eax]
mov al, byte [edi + ecx]
lea ecx, [ecx + 1]
xor al, 0x1b
mov byte [ecx - 1], al
sub esi, 1
jne 0x1005ce70
mov ecx, edx
mov byte [edx + 0x1a], 0
lea esi, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005ce90
sub ecx, esi
lea esi, [ecx + 1]
mov ecx, 0x811c9dc5
test esi, esi
je 0x1005ceb8
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
sub esi, 1
jne 0x1005cea5
mov dword [0x100ec648], ecx
call fcn.10040d60
mov word [0x100ec640], ax
movzx eax, ax
add eax, dword [ebp - 0x28]
lea esp, [ebp - 0x30]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x1005cef0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10098010]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x100ec63c]
mov dword [ebp - 0x30], ecx
push ebx
push esi
push edi
test ax, ax
jne 0x1005cfa9
movaps xmm0, xmmword [0x1008ed80]
mov edi, 0x1b
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x2c], edi
movaps xmm0, xmmword [0x1008d9e0]
lea eax, [edi + 1]
movups xmmword [ebp - 0x18], xmm0
call fcn.1007cdb0
mov ah, byte [ebp - 0x28]
lea ebx, [ebp - 0x27]
mov edx, esp
xor esi, esi
sub ebx, edx
sub edi, esi
lea ecx, [esi + edx]
nop dword [eax]
mov al, byte [ecx + ebx]
lea ecx, [ecx + 1]
xor al, ah
mov byte [ecx - 1], al
sub edi, 1
jne 0x1005cf50
mov edi, 0x1b
mov ecx, edx
mov byte [edx + edi], 0
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1005cf70
sub ecx, esi
lea esi, [ecx + 1]
mov ecx, 0x811c9dc5
test esi, esi
je 0x1005cf98
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
sub esi, 1
jne 0x1005cf85
mov dword [0x100ec644], ecx
call fcn.10040d60
mov word [0x100ec63c], ax
movzx eax, ax
add eax, dword [ebp - 0x30]
lea esp, [ebp - 0x3c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007ba06
mov esp, ebp
pop ebp
ret