joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10081830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x1008188c
cmp byte [esi + 1], 0
jne 0x100818ce
mov byte [esi + 1], 1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + edi + 2], al
inc edi
cmp edi, 0x37
jb 0x10081850
jmp 0x100818ce
xor edi, edi
nop
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + edi + 2]
xor al, bl
mov byte [esi + edi + 2], al
inc edi
cmp edi, 0x37
jb 0x10081890
lea ecx, [esi + 0x38]
lea eax, [esi + 2]
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
cmp eax, ecx
je 0x100818f9
push 0x36
push eax
mov ecx, esi
call fcn.10045f20
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10081ae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1025ab04]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10081b9c
cmp byte [esi + 0x3d], 0
je 0x10081b9c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10081b8a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10081b51
sub eax, 1
je 0x10081b55
sub eax, 2
jne 0x10081b8a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10104522
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10081b73
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10081b8a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10104522
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10104522
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10104522
mov esp, ebp
pop ebp
ret
Function at 0x100890a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1025ab04]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push 0x10261670
push eax
call fcn.10080f80
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov edx, dword [ebp - 8]
add esp, 0x10
cmp edx, 0x10
jb 0x1008910d
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10089103
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10089103
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.101041fa
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10104522
mov esp, ebp
pop ebp
ret
Function at 0x10096200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10251718], 0
push ebx
push esi
je 0x10096274
cmp byte [0x10251719], 0
jne 0x100962b8
mov byte [0x10251719], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10251734]
xor ebx, dword [0x10251730]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + str.H_c], al
inc esi
cmp esi, 0xf
jb 0x10096230
jmp 0x100962b8
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10251734]
xor ebx, dword [0x10251730]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + str.H_c], al
inc esi
cmp esi, 0xf
jb 0x10096276
mov esi, dword [ebp + 8]
mov ecx, esi
push 0xe
push str.H_c
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10045f20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100962f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x102516f8], 0
push ebx
push esi
je 0x10096364
cmp byte [0x102516f9], 0
jne 0x100963a8
mov byte [0x102516f9], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10251714]
xor ebx, dword [0x10251710]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102516fa], al
inc esi
cmp esi, 0x12
jb 0x10096320
jmp 0x100963a8
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10251714]
xor ebx, dword [0x10251710]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102516fa], al
inc esi
cmp esi, 0x12
jb 0x10096366
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x11
push 0x102516fa
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10045f20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100963e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10251738], 0
push ebx
push esi
je 0x10096454
cmp byte [0x10251739], 0
jne 0x10096498
mov byte [0x10251739], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1025174c]
xor ebx, dword [0x10251748]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + str.KU], al
inc esi
cmp esi, 0xb
jb 0x10096410
jmp 0x10096498
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1025174c]
xor ebx, dword [0x10251748]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + str.KU], al
inc esi
cmp esi, 0xb
jb 0x10096456
mov esi, dword [ebp + 8]
mov ecx, esi
push 0xa
push str.KU
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10045f20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100993f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1025bc84]
push esi
mov esi, ecx
test al, 1
jne 0x10099412
mov ecx, dword [0x1025bc60]
or eax, 1
mov dword [0x1025bc84], eax
mov dword [0x1025bc80], ecx
jmp 0x10099418
mov ecx, dword [0x1025bc80]
mov eax, dword [0x10192080]
test byte [ecx + eax], 1
je 0x1009942f
mov eax, dword [esi]
cmp eax, 3
jg 0x10099435
inc eax
mov dword [esi], eax
jmp 0x10099435
mov dword [esi], 0
mov ecx, esi
call fcn.10099630
mov ecx, esi
call fcn.100974a0
mov ecx, esi
call fcn.10097730
mov ecx, esi
pop esi
jmp fcn.10097a30
Function at 0x1009d260
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor edx, eax
movzx eax, byte [edi + 2]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 3]
imul ecx, edx, 0x1000193
mov edx, dword [ebx + 4]
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [ebx + 0xc]
mov dword [ebp + 8], ecx
mov esi, dword [eax + ecx*8 + 4]
cmp esi, edx
je 0x1009d417
mov ecx, dword [eax + ecx*8]
mov eax, dword [edi]
cmp eax, dword [esi + 8]
je 0x1009d2d2
cmp esi, ecx
je 0x1009d417
mov esi, dword [esi + 4]
cmp eax, dword [esi + 8]
jne 0x1009d2c2
test esi, esi
je 0x1009d417
mov ecx, dword [ebp + 8]
mov edi, dword [ebx + 0xc]
mov eax, dword [edi + ecx*8]
cmp dword [edi + ecx*8 + 4], esi
jne 0x1009d2ff
cmp eax, esi
jne 0x1009d2f6
mov dword [edi + ecx*8], edx
mov dword [edi + ecx*8 + 4], edx
jmp 0x1009d308
mov edx, dword [esi + 4]
mov dword [edi + ecx*8 + 4], edx
jmp 0x1009d308
cmp eax, esi
jne 0x1009d308
mov eax, dword [esi]
mov dword [edi + ecx*8], eax
mov ecx, dword [esi]
dec dword [ebx + 8]
mov eax, dword [esi + 4]
mov dword [eax], ecx
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov ecx, dword [esi + 0x88]
cmp ecx, 0x10
jb 0x1009d34f
mov eax, dword [esi + 0x74]
inc ecx
cmp ecx, 0x1000
jb 0x1009d345
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009d411
mov eax, edx
push ecx
push eax
call fcn.101041fa
add esp, 8
mov byte [esi + 0x74], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0xf
mov ecx, dword [esi + 0x70]
cmp ecx, 0x10
jb 0x1009d39b
mov eax, dword [esi + 0x5c]
inc ecx
cmp ecx, 0x1000
jb 0x1009d391
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009d411
mov eax, edx
push ecx
push eax
call fcn.101041fa
add esp, 8
mov byte [esi + 0x5c], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x70], 0xf
mov eax, dword [esi + 0x50]
test eax, eax
je 0x1009d3f5
mov ecx, dword [esi + 0x58]
sub ecx, eax
and ecx, 0xfffffff0
cmp ecx, 0x1000
jb 0x1009d3d6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1009d411
mov eax, edx
push ecx
push eax
call fcn.101041fa
mov dword [esi + 0x50], 0
add esp, 8
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
push 0x98
push esi
call fcn.101041fa
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1009db30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push dword [ebp + 0x10]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x43800000
push 0
push 0
push eax
push dword [ebp + 8]
mov dword [ebp - 4], 0x42000000
call fcn.1009dbd0
test al, al
je 0x1009dbad
test byte [ebp + 0x10], 1
jne 0x1009dbad
push 4
call fcn.101041ca
add esp, 4
test eax, eax
je 0x1009db76
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x1009db78
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x1009db00
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 8], eax
test eax, eax
je 0x1009dbc0
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x1009dbb3
push ecx
push eax
call sub.MSVCP140.dll__Thrd_detach
add esp, 8
test eax, eax
jne 0x1009dbba
mov esp, ebp
pop ebp
ret 0xc
push 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
push 6
mov dword [ebp - 4], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x100c2860
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov edx, 0xcbf29ce4
xor esi, esi
mov dword [ebp - 4], edx
mov ecx, 0x84222325
cmp byte [edi], 0
je 0x100c2887
nop
inc esi
cmp byte [esi + edi], 0
jne 0x100c2880
xor ebx, ebx
test esi, esi
je 0x100c28b5
nop dword [eax]
movsx eax, byte [ebx + edi]
push 0x100
cdq
xor edx, dword [ebp - 4]
xor eax, ecx
push 0x1b3
push edx
push eax
call fcn.10104bc0
inc ebx
mov dword [ebp - 4], edx
mov ecx, eax
cmp ebx, esi
jb 0x100c2890
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c98b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10192005], 0
mov dword [ebp - 4], ecx
je 0x100c9a3b
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, eax
xor esi, esi
mov edi, 0x84222325
mov ecx, 0xcbf29ce4
cmp byte [ebx], 0
je 0x100c98eb
inc esi
cmp byte [esi + ebx], 0
jne 0x100c98e4
xor eax, eax
mov dword [ebp - 8], eax
test esi, esi
je 0x100c9a38
nop dword [eax + eax]
movsx eax, byte [eax + ebx]
push 0x100
cdq
push 0x1b3
xor edx, ecx
xor eax, edi
push edx
push eax
call fcn.10104bc0
mov edi, eax
mov ecx, edx
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, esi
jb 0x100c9900
cmp ecx, 0x3943e50e
ja 0x100c9a1d
jb 0x100c9943
cmp edi, 0x2bb2e9fe
ja 0x100c9a1d
cmp edi, 0x2bb2e9fe
jne 0x100c99d5
cmp ecx, 0x3943e50e
jne 0x100c99d5
mov ecx, dword [0x10192080]
test ecx, ecx
je 0x100c9a38
mov eax, dword [0x1025bc0c]
test al, 1
jne 0x100c9982
or eax, 1
mov dword [0x1025bc0c], eax
mov eax, dword [0x1025bc04]
mov dword [0x1025bc08], eax
jmp 0x100c9987
mov eax, dword [0x1025bc08]
cmp dword [eax + ecx], 0
jne 0x100c9a38
mov eax, dword [0x1025bc14]
test al, 1
jne 0x100c99ae
or eax, 1
mov dword [0x1025bc14], eax
mov eax, dword [0x1025bc00]
mov dword [0x1025bc10], eax
jmp 0x100c99b3
mov eax, dword [0x1025bc10]
cmp dword [eax + ecx], 0
jle 0x100c9a38
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
cmp ecx, dword [eax + 0xc]
je 0x100c9a38
cmp byte [ecx], 0
jne 0x100c9a38
pop edi
pop esi
mov byte [ecx], 1
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp edi, 0x5de24d68
jne 0x100c99f9
cmp ecx, 0x4251ee7
jne 0x100c99f9
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.100c9420
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp edi, 0xedb6640
jne 0x100c9a38
cmp ecx, 0x1baa64fb
jne 0x100c9a38
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.100ca6d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp edi, 0xb118f470
jne 0x100c9a38
cmp ecx, 0xd089c265
jne 0x100c9a38
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.100c9fa0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100ca6d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1025ab04]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x20], ebx
lea edi, [ebx + 0x13fc]
lea eax, [edi + 0x104]
cmp eax, edi
sbb ecx, ecx
and ecx, 0xffffffbf
add ecx, 0x41
cmp edi, eax
ja 0x100ca706
xor eax, eax
rep stosd dword es:[edi], eax
lea ecx, [ebx + 0xb0]
lea edx, [ecx + 0x134c]
cmp ecx, edx
je 0x100ca7b7
add ecx, 0x44
nop dword [eax]
mov eax, dword [ecx - 0x40]
cmp eax, dword [ecx - 0x3c]
je 0x100ca72b
mov dword [ecx - 0x3c], eax
cmp byte [ecx - 0x34], 0
je 0x100ca79c
mov dword [ecx - 0x34], 0
mov word [ecx - 0x30], 0
mov byte [ecx - 0x2e], 0
mov dword [ecx - 0x2c], 0xffffffff
mov dword [ecx - 0x28], 0
mov dword [ecx - 0x24], 0
mov dword [ecx - 0x18], 0
mov dword [ecx - 0x20], 0
mov dword [ecx - 0x1c], 0
mov dword [ecx - 0x14], 0
mov dword [ecx - 0x10], 0
mov dword [ecx - 0xc], 0
mov dword [ecx - 8], 0
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx - 4], 0
cmp dword [ecx - 0x44], 0
je 0x100ca7a9
mov dword [ecx - 0x44], 0
add ecx, 0x4c
lea eax, [ecx - 0x44]
cmp eax, edx
jne 0x100ca720
mov al, byte [0x10192012]
mov edx, 1
test al, al
movzx ecx, al
cmove ecx, edx
test byte [0x1024e8a4], 4
mov byte [0x10192012], cl
je 0x100ca8f4
cmp byte [0x102562a8], 0
mov edi, dword [0x102618bc]
je 0x100ca844
cmp byte [0x102562a9], 0
jne 0x100ca88b
mov byte [0x102562a9], dl
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102562e4]
xor ebx, dword [0x102562e0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 0x24], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102562aa], al
inc esi
cmp esi, 0x30
jb 0x100ca800
jmp 0x100ca888
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102562e4]
xor ebx, dword [0x102562e0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 0x24], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102562aa], al
inc esi
cmp esi, 0x30
jb 0x100ca846
mov ebx, dword [ebp - 0x20]
push 0x2f
push 0x102562aa
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
call fcn.10045f20
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
call fcn.100f4da0
mov edx, dword [ebp - 8]
cmp edx, 0x10
jb 0x100ca8f4
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100ca8ea
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100ca8ea
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.101041fa
add esp, 8
lea esi, [ebx + 8]
push esi
push dword [esi + 4]
push dword [esi]
call fcn.100c7d80
mov eax, dword [esi]
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [esi + 4], eax
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10104522
mov esp, ebp
pop ebp
ret 4
Function at 0x100e0140
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
mov eax, ecx
push ebx
push esi
push edi
cmp dword [edx + 0x14], 0x10
mov edi, edx
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], eax
jb 0x100e015e
mov edi, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
test ebx, ebx
je 0x100e0184
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x100e0170
mov eax, dword [ebp - 4]
push esi
push edx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, eax
call fcn.100df0c0
pop edi
pop esi
pop ebx
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 8]
test ecx, ecx
jne 0x100e01a4
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x100e02c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x100e031c
cmp byte [esi + 1], 0
jne 0x100e035e
mov byte [esi + 1], 1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + edi + 2], al
inc edi
cmp edi, 0x3a
jb 0x100e02e0
jmp 0x100e035e
xor edi, edi
nop
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + edi + 2]
xor al, bl
mov byte [esi + edi + 2], al
inc edi
cmp edi, 0x3a
jb 0x100e0320
lea ecx, [esi + 0x3b]
lea eax, [esi + 2]
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
cmp eax, ecx
je 0x100e0389
push 0x39
push eax
mov ecx, esi
call fcn.10045f20
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100e03a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x100e03fc
cmp byte [esi + 1], 0
jne 0x100e043e
mov byte [esi + 1], 1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + edi + 2], al
inc edi
cmp edi, 0x3b
jb 0x100e03c0
jmp 0x100e043e
xor edi, edi
nop
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + edi + 2]
xor al, bl
mov byte [esi + edi + 2], al
inc edi
cmp edi, 0x3b
jb 0x100e0400
lea ecx, [esi + 0x3c]
lea eax, [esi + 2]
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
cmp eax, ecx
je 0x100e0469
push 0x3a
push eax
mov ecx, esi
call fcn.10045f20
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100e0480
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x100e04dc
cmp byte [esi + 1], 0
jne 0x100e051e
mov byte [esi + 1], 1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + edi + 2], al
inc edi
cmp edi, 0x3d
jb 0x100e04a0
jmp 0x100e051e
xor edi, edi
nop
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + edi + 2]
xor al, bl
mov byte [esi + edi + 2], al
inc edi
cmp edi, 0x3d
jb 0x100e04e0
lea ecx, [esi + 0x3e]
lea eax, [esi + 2]
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
cmp eax, ecx
je 0x100e0549
push 0x3c
push eax
mov ecx, esi
call fcn.10045f20
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4