joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100725b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101bf0a7
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x101d32d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push 1
push 0x8c
call dword [sym.imp.PhotoBase.dll_void____cdecl_BasePrivate::New_unsigned_int__bool_]
mov edi, eax
add esp, 8
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x100727d0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
fld1
lea ebx, [edi + 0x18]
fstp dword [edi + 0xc]
mov dword [edi], 0x10002710
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 2
call dword [sym.imp.PhotoBase.dll_public:_static_class_ATL::CAtlStringMgr____stdcall_Base::String::GetBaseStringManager_void_]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
jne 0x10072650
push 0x80004005
call dword [sym.imp.PhotoBase.dll_void___stdcall_ATL::BaseAtlThrow_long_int_]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x101d83dc]
mov ecx, dword [ebp - 0x14]
call esi
add eax, 0x10
mov dword [ebx], eax
mov eax, 0x10012354
mov byte [ebp - 4], 3
mov ecx, ebx
test eax, 0xffff0000
jne 0x10072684
movzx eax, ax
push eax
call fcn.1003eee0
jmp 0x10072690
push 0x11
push 0x10012354
call fcn.1003f2f0
mov byte [edi + 0x1c], 1
mov dword [edi + 0x20], 0
mov byte [edi + 0x24], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 4], 3
mov dword [edi + 0x34], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x80], 0x1000168c
mov dword [edi + 0x84], 0
mov dword [edi], 0x10002610
mov dword [edi + 0x80], 0x1000260c
mov dword [edi + 0x88], 0
test edi, edi
je 0x100727b9
mov eax, dword [edi]
push edi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x101d83dc]
call esi
mov eax, dword [ebp - 0x10]
push edi
mov dword [eax], edi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x101d83dc]
call esi
mov eax, dword [edi]
push edi
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x101d83dc]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov dword [eax], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100a49b0
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101bf9f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101d32d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0xc]
mov dword [esi], 0x10002c88
mov dword [ecx], 0
mov byte [ebp - 4], 1
mov dword [esi + 4], 1
call fcn.100af440
fld dword [0x10036158]
mov eax, esi
fst dword [esi + 0x10]
fstp dword [esi + 0x14]
fld dword [0x10035ab4]
fst dword [esi + 0x18]
fstp dword [esi + 0x1c]
mov dword [esi + 0x20], 0
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], 0x1000168c
mov dword [esi + 0x2c], 0
mov dword [esi], 0x10002cd4
mov dword [esi + 0x28], 0x10002cd0
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100afbd0
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101bf9f8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101d32d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0xc]
mov dword [esi], 0x100038f4
mov dword [ecx], 0
mov byte [ebp - 4], 1
mov dword [esi + 4], 1
call fcn.1003c450
fld1
mov eax, esi
mov byte [esi + 0x40], 1
fst dword [esi + 0x2c]
fst dword [esi + 0x28]
fldz
fst dword [esi + 0x14]
fst dword [esi + 0x10]
fst dword [esi + 0x1c]
fst dword [esi + 0x18]
fst dword [esi + 0x24]
fstp dword [esi + 0x20]
fst dword [esi + 0x34]
fst dword [esi + 0x30]
fst dword [esi + 0x3c]
fstp dword [esi + 0x38]
mov dword [esi + 0x44], 0x1000168c
mov dword [esi + 0x48], 0
mov dword [esi], 0x10003940
mov dword [esi + 0x44], 0x1000393c
mov dword [esi + 0x4c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100e4b00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp - 0x66c]
call dword [ebp - 0x680]
cmp dword [ebp - 0x6cc], 0
je 0x100e58d4
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.100e36b2
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x100e4b4e
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x100e4b97
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x100e4b41
call fcn.100e3741
or bh, byte [esi + edx*2 + 0xb]
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
test ebp, ebx
clc
invalid
call [esi + eax*8 - 0x7b]
fdivp st(0)
invalid
call dword [ecx - 0x3a]
test edi, ebx
clc
invalid
jmp [ebp - 0x3a]
test eax, esp
clc
invalid
dec dword [edi - 0x3a]
test ecx, esp
clc
invalid
call dword [edx - 0x3a]
test edx, esp
clc
invalid
dec dword [ecx - 0x3a]
test ebx, esp
clc
invalid
call [eax - 0x3a]
test esp, esp
clc
invalid
call [esi - 0x3a]
test ebp, esp
clc
invalid
dec dword [ecx - 0x3a]
test esi, esp
clc
invalid
invalid
cmp eax, 0xffeb17e8
jmp [ebp - 0x4b]
xchg byte [ebp - 0x73], ah
test esp, edx
clc
invalid
call dword [eax - 0x18]
pop ss
jmp 0x100e4c38
call [ecx + 0x50]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100e3706
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.100e3741
lcall 0xe885, 0x8d18b66c
clc
invalid
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100ea1a0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c291d
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push esi
mov eax, dword [0x101d32d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [ebp + 8], 0
je 0x100ea2db
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov esi, dword [eax + 0x1d8]
lea eax, [ebp - 0x14]
push eax
push 8
push ecx
mov ecx, esi
call dword [0x101d83dc]
call esi
test eax, eax
js 0x100ea2bd
mov eax, dword [ebp - 0x14]
push 1
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x18]
mov ecx, esi
call dword [0x101d83dc]
call esi
test eax, eax
jns 0x100ea224
push eax
call dword [sym.imp.PhotoBase.dll_void___stdcall_Base::Throw_long_int_]
lea ecx, [ebp - 0x4c]
call fcn.1004da20
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x100ea240
call dword [sym.imp.PhotoBase.dll_void___stdcall_Base::ThrowLastError_void_]
mov eax, dword [ebp - 0x14]
push 1
push 0
push 0
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x1c]
mov ecx, esi
call dword [0x101d83dc]
call esi
cmp eax, 1
jne 0x100ea2bd
mov edi, edi
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x100ea23a
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
sbb eax, dword [ebp - 0x40]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
fild qword [ebp - 0x24]
fstp qword [ebp - 0x2c]
fld qword [ebp - 0x2c]
fild qword [ebp - 0x4c]
fstp qword [ebp - 0x2c]
fdiv qword [ebp - 0x2c]
fcomp qword [0x10035e20]
fnstsw ax
test ah, 0x41
je 0x100ea2bd
mov eax, dword [ebp - 0x14]
push 1
push 0
push 0
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x1c]
mov ecx, esi
call dword [0x101d83dc]
call esi
cmp eax, 1
je 0x100ea260
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x100ea2db
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x101d83dc]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100f9470
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c3f86
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x101d32d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebx + 4], 0x10003e5c
mov dword [ebx], 0x100063a8
mov dword [ebx + 4], 0x1000638c
mov dword [ebx + 8], 0xffffffff
mov byte [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
lea esi, [ebx + 0x3c]
mov byte [ebp - 4], 6
mov edi, 4
mov edi, edi
mov ecx, esi
call fcn.10044f30
add esi, 8
sub edi, 1
jne 0x100f9520
lea ecx, [ebx + 0x6c]
mov byte [ebx + 0x5c], 0
mov dword [ebx + 0x60], edi
mov dword [ebx + 0x64], edi
mov dword [ebx + 0x68], edi
call fcn.10049c00
mov word [ebx + 0xb4], di
lea esi, [ebx + 0xb8]
mov byte [ebp - 4], 7
mov edi, 4
lea ebx, [ebx]
mov ecx, esi
call fcn.10044f30
add esi, 8
sub edi, 1
jne 0x100f9560
mov word [ebx + 0xea], di
mov byte [ebx + 0xec], 0
mov dword [ebx + 0xf0], edi
mov word [ebx + 0xf4], di
mov dword [ebx + 0xf8], edi
mov dword [ebx + 0xfc], edi
mov dword [ebx + 0x100], edi
mov dword [ebx + 0x104], edi
mov word [ebx + 0x108], di
mov dword [ebx + 0x10c], edi
mov dword [ebx + 0x110], edi
mov dword [ebx + 0x114], edi
mov dword [ebx + 0x118], edi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], edi
lea ecx, [ebx + 0x120]
mov dword [ebp - 0x20], edi
push eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.100543d0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], edi
lea ecx, [ebx + 0x140]
mov dword [ebp - 0x20], edi
push eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.100543d0
mov dword [ebx + 0x160], edi
mov dword [ebx + 0x164], edi
mov dword [ebx + 0x168], edi
push 1
push 0x24
mov byte [ebp - 4], 0xb
call dword [sym.imp.PhotoBase.dll_void____cdecl_BasePrivate::New_unsigned_int__bool_]
mov edi, eax
add esp, 8
mov dword [ebp - 0x10], edi
test edi, edi
je 0x100f965e
mov dword [edi + 4], 0
mov dword [edi + 0x18], 0x1000168c
mov dword [edi + 0x1c], 0
mov dword [edi], 0x10006444
mov dword [edi + 0x18], 0x10006440
mov dword [edi + 0x20], 0
mov eax, dword [edi]
push edi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x101d83dc]
call esi
jmp 0x100f9660
xor edi, edi
mov dword [edi + 4], ebx
mov dword [ebx + 0x34], edi
mov eax, dword [edi]
push edi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x101d83dc]
call esi
mov eax, dword [edi]
push edi
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x101d83dc]
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10104a1e
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x101d70ec]
push esi
push edi
test eax, eax
jne 0x10104a37
call fcn.10104ace
test eax, eax
je 0x10104a7f
mov eax, dword [0x101d70ec]
cmp eax, 1
jne 0x10104a4f
push 0xd
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x10104ac5
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov ecx, eax
test ecx, ecx
je 0x10104a68
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, ecx
jmp 0x10104ac5
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x10104a83
xor eax, eax
jmp 0x10104ac5
mov eax, dword [esi]
push dword [0x101d70ec]
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov edi, eax
test edi, edi
je 0x10104aa9
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x10104ac5
lea edi, [esi + 0xff0]
push esi
push dword [0x101d70ec]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x10104aaf
mov eax, esi
pop edi
pop esi
ret

Function at 0x101058db
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push 0x2000000
xor edi, edi
push edi
push 0x10023194
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10105946
push esi
lea eax, [ebp - 8]
push eax
push 0x101d3378
lea eax, [ebp - 0xc]
push eax
push edi
push 0x100231d8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x10105942
cmp dword [ebp - 0xc], 4
jne 0x10105942
inc edi
mov eax, edi
jmp 0x10105948
xor eax, eax
pop edi
leave
ret 8
Function at 0x10105ad2
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
test eax, eax
jne 0x10105ae8
mov eax, 0x8876086c
jmp 0x10105b5d
push edi
xor edi, edi
push edi
push 0x10000000
push 3
push edi
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
mov dword [esi], eax
call dword [sym.imp.PhotoBase.dll_void___cdecl_BasePrivate::Delete_void__]
cmp dword [esi], 0xffffffff
pop ecx
je 0x10105b51
push edi
push edi
push edi
push 2
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x10105b51
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x10105b51
test eax, eax
je 0x10105b62
push edi
push edi
push edi
push 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
cmp eax, edi
jne 0x10105b65
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x88760b59
pop edi
pop esi
pop ebp
ret 8
mov dword [esi + 8], edi
xor eax, eax
jmp 0x10105b5c
Function at 0x10109c20
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x14
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, ecx
mov dword [ebp + 0x14], eax
cmp ecx, eax
jae 0x10109d61
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
lea edx, [ecx + eax*4]
mov eax, dword [ebp + 0x14]
lea esi, [edi + edi]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], ebx
cmp ecx, edx
jae 0x10109d47
lea eax, [ecx + 4]
mov dword [ebp - 4], eax
mov eax, edx
sub eax, ecx
mov ecx, dword [ebp - 4]
dec eax
shr eax, 3
inc eax
mov dword [ebp - 0xc], eax
mov esi, dword [ecx + edi]
mov edx, 0xffc03fc0
mov edi, dword [edi + ecx - 4]
mov eax, esi
mov ebx, dword [ecx - 4]
mov ecx, dword [ecx]
shr eax, 2
and eax, edx
shr ecx, 2
and ecx, edx
add ecx, eax
mov eax, edi
shr eax, 2
and eax, edx
add ecx, eax
mov eax, ebx
shr eax, 2
add ecx, 0xff800080
and edx, eax
mov eax, dword [ebp - 4]
add edx, ecx
mov ecx, dword [eax]
mov eax, esi
and eax, 0xff00ff
shr esi, 2
and ecx, 0xff00ff
and esi, 0x3fc03fc0
add ecx, eax
mov eax, edi
and eax, 0xff00ff
shr edi, 2
add ecx, eax
mov eax, ebx
and eax, 0xff00ff
shr ebx, 2
add ecx, 0x20002
add eax, ecx
mov ecx, dword [ebp - 4]
shr eax, 2
xor edx, eax
and edx, 0xff00ff
mov eax, dword [ecx]
add ecx, 8
shr eax, 2
and eax, 0x3fc03fc0
mov dword [ebp - 4], ecx
add eax, esi
mov esi, 0x3fc03fc0
and edi, esi
and ebx, esi
add edi, 0x800080
add eax, edi
mov edi, dword [ebp + 0x18]
add eax, ebx
xor edx, eax
mov eax, dword [ebp - 8]
mov dword [eax], edx
add eax, 4
sub dword [ebp - 0xc], 1
mov dword [ebp - 8], eax
jne 0x10109c79
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp - 0x14]
add ebx, dword [ebp + 0x1c]
add ecx, esi
add edx, esi
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x10], edx
cmp ecx, eax
jb 0x10109c59
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18
Function at 0x1010a0b7
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x20], ebx
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
mov esi, dword [eax + 0x20]
mov eax, dword [edx + 0x6c]
imul eax, dword [edx + 0x60]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], ecx
add eax, ecx
mov dword [ebp - 0x24], eax
cmp ecx, eax
jae 0x1010a1f1
push edi
mov eax, dword [edx + 0x68]
mov edi, dword [edx + 0x60]
add edi, ecx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], ecx
lea eax, [ecx + eax*2]
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], eax
cmp ecx, eax
jae 0x1010a1d3
movzx ebx, word [ecx]
mov eax, dword [ebp - 4]
movzx edx, word [edi + 2]
movzx edi, word [ecx + 2]
and edx, 0xf81f
mov ecx, ebx
movzx esi, word [eax]
and ecx, 0xf81f
mov eax, esi
and eax, 0xf81f
add ecx, eax
mov eax, edi
and eax, 0xf81f
add eax, 0x1002
add ecx, eax
mov eax, esi
add edx, ecx
and eax, 0x7e0
mov ecx, ebx
shr edx, 2
and ecx, 0x7e0
add ecx, eax
mov eax, edi
and eax, 0x7e0
add ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 4]
movzx eax, word [ecx + 2]
mov ecx, dword [ebp - 0x18]
and eax, 0x7e0
add ecx, 0x40
add eax, ecx
mov ecx, 0xf81f
and ebx, ecx
shr eax, 2
and esi, ecx
and edi, ecx
xor edx, eax
add ebx, esi
add ebx, edi
and edx, 0x7e0
mov edi, dword [ebp - 4]
movzx eax, word [edi + 2]
add edi, 4
and eax, ecx
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 8]
add eax, 0x1002
add eax, ebx
add ecx, 4
shr eax, 2
xor edx, eax
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 0xc]
mov word [eax], dx
add eax, 2
mov dword [ebp - 0xc], eax
cmp ecx, dword [ebp - 0x1c]
jb 0x1010a10b
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x10]
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
add esi, dword [eax + 0x60]
mov eax, dword [edx + 0x60]
mov dword [ebp - 0x10], esi
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x14], ecx
cmp ecx, dword [ebp - 0x24]
jb 0x1010a0ec
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x1010a30c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x20], ebx
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
mov esi, dword [eax + 0x20]
mov eax, dword [edx + 0x6c]
imul eax, dword [edx + 0x60]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], ecx
add eax, ecx
mov dword [ebp - 0x24], eax
cmp ecx, eax
jae 0x1010a449
push edi
mov eax, dword [edx + 0x68]
mov edi, dword [edx + 0x60]
add edi, ecx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], ecx
lea eax, [ecx + eax*2]
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], eax
cmp ecx, eax
jae 0x1010a42b
movzx ebx, word [ecx]
mov eax, dword [ebp - 4]
movzx edx, word [edi + 2]
movzx edi, word [ecx + 2]
and edx, 0x7c1f
mov ecx, ebx
movzx esi, word [eax]
and ecx, 0x7c1f
mov eax, esi
and eax, 0x7c1f
add ecx, eax
mov eax, edi
and eax, 0x7c1f
add eax, 0x802
add ecx, eax
mov eax, esi
add edx, ecx
and eax, 0x83e0
mov ecx, ebx
shr edx, 2
and ecx, 0x83e0
add ecx, eax
mov eax, edi
and eax, 0x83e0
add ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 4]
movzx eax, word [ecx + 2]
mov ecx, dword [ebp - 0x18]
and eax, 0x83e0
add ecx, 0x10040
add eax, ecx
mov ecx, 0x83e0
and ebx, ecx
shr eax, 2
and esi, ecx
and edi, ecx
xor edx, eax
add ebx, esi
add ebx, edi
and edx, 0x7c1f
mov edi, dword [ebp - 4]
movzx eax, word [edi + 2]
add edi, 4
and eax, ecx
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 8]
add eax, 0x10040
add eax, ebx
add ecx, 4
shr eax, 2
xor edx, eax
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 0xc]
mov word [eax], dx
add eax, 2
mov dword [ebp - 0xc], eax
cmp ecx, dword [ebp - 0x1c]
jb 0x1010a360
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x10]
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
add esi, dword [eax + 0x60]
mov eax, dword [edx + 0x60]
mov dword [ebp - 0x10], esi
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x14], ecx
cmp ecx, dword [ebp - 0x24]
jb 0x1010a341
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x1010a455
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x20], ebx
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
mov esi, dword [eax + 0x20]
mov eax, dword [edx + 0x6c]
imul eax, dword [edx + 0x60]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], ecx
add eax, ecx
mov dword [ebp - 0x24], eax
cmp ecx, eax
jae 0x1010a592
push edi
mov eax, dword [edx + 0x68]
mov edi, dword [edx + 0x60]
add edi, ecx
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], ecx
lea eax, [ecx + eax*2]
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], eax
cmp ecx, eax
jae 0x1010a574
movzx ebx, word [ecx]
mov eax, dword [ebp - 4]
movzx edx, word [edi + 2]
movzx edi, word [ecx + 2]
and edx, 0xf0f
mov ecx, ebx
movzx esi, word [eax]
and ecx, 0xf0f
mov eax, esi
and eax, 0xf0f
add ecx, eax
mov eax, edi
and eax, 0xf0f
add eax, 0x202
add ecx, eax
mov eax, esi
add edx, ecx
and eax, 0xf0f0
mov ecx, ebx
shr edx, 2
and ecx, 0xf0f0
add ecx, eax
mov eax, edi
and eax, 0xf0f0
add ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 4]
movzx eax, word [ecx + 2]
mov ecx, dword [ebp - 0x18]
and eax, 0xf0f0
add ecx, 0x2020
add eax, ecx
mov ecx, 0xf0f0
and ebx, ecx
shr eax, 2
and esi, ecx
and edi, ecx
xor edx, eax
add ebx, esi
add ebx, edi
and edx, 0xf0f
mov edi, dword [ebp - 4]
movzx eax, word [edi + 2]
add edi, 4
and eax, ecx
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 8]
add eax, 0x2020
add eax, ebx
add ecx, 4
shr eax, 2
xor edx, eax
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 0xc]
mov word [eax], dx
add eax, 2
mov dword [ebp - 0xc], eax
cmp ecx, dword [ebp - 0x1c]
jb 0x1010a4a9
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x10]
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
add esi, dword [eax + 0x60]
mov eax, dword [edx + 0x60]
mov dword [ebp - 0x10], esi
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x14], ecx
cmp ecx, dword [ebp - 0x24]
jb 0x1010a48a
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret