joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1029364c
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x103a276f
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x104cc790]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x104cc790]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
xor eax, eax
mov ebx, dword [esp + 0x6c]
mov dword [esp + 0x18], eax
lea edi, [esp + 0x38]
push 6
pop ecx
mov esi, 0x10413e00
mov dword [esp + 0x30], eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], eax
mov byte [esp + 0x20], al
lea eax, [esp + 0x38]
push 0x18
push eax
mov dword [esp + 0x24], ebx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x3c], 0xf
call fcn.1008109e
xor ebp, ebp
inc ebp
mov dword [esp + 0x64], ebp
lea ecx, [esp + 0x20]
mov esi, dword [esp + 0x34]
cmp esi, 0x10
mov edi, dword [esp + 0x20]
cmovae ecx, edi
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x20]
cmp esi, 0x10
cmovae edx, edi
add eax, edx
cmp eax, ecx
je 0x102936fe
xor byte [ecx], 0x12
inc ecx
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x20]
jmp 0x102936dc
cmp esi, 0x10
lea eax, [esp + 0x20]
push 0xc
cmovae eax, edi
mov ecx, ebx
push eax
call fcn.10080c59
mov dword [esp + 0x18], ebp
mov byte [esp + 0x64], 0
lea ecx, [esp + 0x20]
push 0
push ebp
call fcn.1008117f
mov eax, ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.1032ef46
add esp, 0x54
ret 4
Function at 0x102980be
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x103a110c
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x104cc790]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x104cc790]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
xor eax, eax
mov ebx, dword [esp + 0x64]
mov dword [esp + 0x14], eax
lea edi, [esp + 0x34]
push 5
pop ecx
mov esi, 0x1041416c
mov dword [esp + 0x2c], eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], eax
mov byte [esp + 0x1c], al
lea eax, [esp + 0x34]
push 0x14
push eax
mov dword [esp + 0x20], ebx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x38], 0xf
call fcn.1008109e
xor ebp, ebp
inc ebp
mov dword [esp + 0x5c], ebp
lea ecx, [esp + 0x1c]
mov esi, dword [esp + 0x30]
cmp esi, 0x10
mov edi, dword [esp + 0x1c]
cmovae ecx, edi
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x1c]
cmp esi, 0x10
cmovae edx, edi
add eax, edx
cmp eax, ecx
je 0x10298170
xor byte [ecx], 0x64
inc ecx
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x1c]
jmp 0x1029814e
cmp esi, 0x10
lea eax, [esp + 0x1c]
push 0xa
cmovae eax, edi
mov ecx, ebx
push eax
call fcn.10080c59
mov dword [esp + 0x14], ebp
mov byte [esp + 0x5c], 0
lea ecx, [esp + 0x1c]
push 0
push ebp
call fcn.1008117f
mov eax, ebx
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.1032ef46
add esp, 0x4c
ret 4

Function at 0x1029b97e
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x103b78bf
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x104cc790]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x104cc790]
xor eax, esp
push eax
lea eax, [esp + 0xa4]
mov dword fs:[0], eax
xor eax, eax
mov ebx, dword [esp + 0xb4]
mov dword [esp + 0x14], eax
lea edi, [esp + 0x34]
push 0x18
pop ecx
mov esi, 0x104142e8
mov dword [esp + 0x2c], eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], eax
mov byte [esp + 0x1c], al
lea eax, [esp + 0x34]
movsw word es:[edi], word [esi]
push 0x62
push eax
mov dword [esp + 0x20], ebx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x38], 0xf
call fcn.1008109e
xor ebp, ebp
inc ebp
mov dword [esp + 0xac], ebp
lea ecx, [esp + 0x1c]
mov esi, dword [esp + 0x30]
cmp esi, 0x10
mov edi, dword [esp + 0x1c]
cmovae ecx, edi
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x1c]
cmp esi, 0x10
cmovae edx, edi
add eax, edx
cmp eax, ecx
je 0x1029ba41
xor byte [ecx], 0x5f
inc ecx
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x1c]
jmp 0x1029ba1f
cmp esi, 0x10
lea eax, [esp + 0x1c]
push 0x31
cmovae eax, edi
mov ecx, ebx
push eax
call fcn.10080c59
mov dword [esp + 0x14], ebp
mov byte [esp + 0xac], 0
lea ecx, [esp + 0x1c]
push 0
push ebp
call fcn.1008117f
mov eax, ebx
mov ecx, dword [esp + 0xa4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.1032ef46
add esp, 0x9c
ret 4
Function at 0x102a88d7
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x103a276f
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x104cc790]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x104cc790]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
xor eax, eax
mov ebx, dword [esp + 0x6c]
mov dword [esp + 0x18], eax
lea edi, [esp + 0x38]
push 6
pop ecx
mov esi, 0x10414be8
mov dword [esp + 0x30], eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], eax
mov byte [esp + 0x20], al
lea eax, [esp + 0x38]
push 0x18
push eax
mov dword [esp + 0x24], ebx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x3c], 0xf
call fcn.1008109e
xor ebp, ebp
inc ebp
mov dword [esp + 0x64], ebp
lea ecx, [esp + 0x20]
mov esi, dword [esp + 0x34]
cmp esi, 0x10
mov edi, dword [esp + 0x20]
cmovae ecx, edi
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x20]
cmp esi, 0x10
cmovae edx, edi
add eax, edx
cmp eax, ecx
je 0x102a8989
xor byte [ecx], 0xbd
inc ecx
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x20]
jmp 0x102a8967
cmp esi, 0x10
lea eax, [esp + 0x20]
push 0xc
cmovae eax, edi
mov ecx, ebx
push eax
call fcn.10080c59
mov dword [esp + 0x18], ebp
mov byte [esp + 0x64], 0
lea ecx, [esp + 0x20]
push 0
push ebp
call fcn.1008117f
mov eax, ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.1032ef46
add esp, 0x54
ret 4

Function at 0x102a98b8
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x103a276f
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x104cc790]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x104cc790]
xor eax, esp
push eax
lea eax, [esp + 0x5c]
mov dword fs:[0], eax
xor eax, eax
mov ebx, dword [esp + 0x6c]
mov dword [esp + 0x18], eax
lea edi, [esp + 0x38]
push 6
pop ecx
mov esi, 0x10414c04
mov dword [esp + 0x30], eax
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], eax
mov byte [esp + 0x20], al
lea eax, [esp + 0x38]
push 0x18
push eax
mov dword [esp + 0x24], ebx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x3c], 0xf
call fcn.1008109e
xor ebp, ebp
inc ebp
mov dword [esp + 0x64], ebp
lea ecx, [esp + 0x20]
mov esi, dword [esp + 0x34]
cmp esi, 0x10
mov edi, dword [esp + 0x20]
cmovae ecx, edi
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x20]
cmp esi, 0x10
cmovae edx, edi
add eax, edx
cmp eax, ecx
je 0x102a996a
xor byte [ecx], 0xe9
inc ecx
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x20]
jmp 0x102a9948
cmp esi, 0x10
lea eax, [esp + 0x20]
push 0xc
cmovae eax, edi
mov ecx, ebx
push eax
call fcn.10080c59
mov dword [esp + 0x18], ebp
mov byte [esp + 0x64], 0
lea ecx, [esp + 0x20]
push 0
push ebp
call fcn.1008117f
mov eax, ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.1032ef46
add esp, 0x54
ret 4
Function at 0x102b03b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, edx
xor esi, esi
mov ebx, ecx
test edi, edi
jle 0x102b03dd
lea ecx, [ecx]
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x103f5620]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x102b03c0
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x102b0460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
mov ecx, 0x80
mov dword [ebp - 0xc], edi
lea eax, [esi*8]
cmp eax, 0x400
cmova esi, ecx
cmp esi, dword [edi]
jne 0x102b0491
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1051ae38]
test eax, eax
je 0x102b049c
call eax
lea eax, [esi*8]
push eax
call fcn.102acc00
mov ecx, dword [0x1051ae3c]
add esp, 4
mov ebx, eax
mov dword [ebp - 8], ebx
test ecx, ecx
je 0x102b04bd
call ecx
test ebx, ebx
je 0x102b0488
push dword [edi + 0xc]
call fcn.102acf00
add esp, 4
mov dword [edi + 0xc], ebx
push ebx
call dword [0x104fec64]
shr eax, 3
add esp, 4
mov dword [ebp - 4], eax
mov dword [edi], eax
lea ecx, [eax*8]
push ecx
push 0
push ebx
call fcn.10334af0
mov ebx, dword [edi + 8]
add esp, 0xc
mov dword [edi + 8], 0
test ebx, ebx
je 0x102b054e
mov ecx, dword [ebx + 0x10]
xor edi, edi
mov esi, dword [ebx + 0xc]
test ecx, ecx
jle 0x102b052d
mov edi, edi
movzx eax, byte [esi]
lea esi, [esi + 1]
dec ecx
movzx edx, byte [eax + 0x103f5620]
lea eax, [edi*8]
xor edx, eax
xor edi, edx
test ecx, ecx
jg 0x102b0510
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov eax, edi
mov esi, dword [ebx]
div dword [ebp - 4]
mov eax, dword [ebp - 8]
push ebx
lea edx, [eax + edx*8]
call fcn.102b03f0
add esp, 4
mov ebx, esi
test esi, esi
jne 0x102b0502
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x102b8290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x104cc790]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, edx
mov dword [ebp - 0x14], ebx
mov edx, dword [esi + 0x3c]
cmp dword [edx], ebx
jne 0x102b82da
mov eax, dword [esi + 0x78]
mov ecx, dword [esi]
or eax, 0x1e
push ebx
and eax, 0x87f7f
push eax
mov eax, dword [ecx + 0x18]
push edx
push ebx
push ecx
call eax
mov ebx, eax
add esp, 0x14
mov dword [ebp - 0x14], ebx
test ebx, ebx
jne 0x102b83b7
mov ecx, dword [esi + 0x18]
cmp ecx, dword [esi + 0x24]
jbe 0x102b8313
mov eax, dword [esi + 0x80]
push 0
cdq
push ecx
push edx
push eax
call fcn.10334a40
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x10]
push edx
push 5
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [esi + 0x18]
add esp, 0xc
mov dword [esi + 0x24], eax
test edi, edi
je 0x102b83b5
mov ebx, dword [edi + 0x14]
cmp ebx, dword [esi + 0x18]
ja 0x102b83a7
test byte [edi + 0x18], 0x20
jne 0x102b83a7
mov eax, dword [esi + 0x80]
lea ecx, [ebx - 1]
cdq
push edx
push eax
push 0
push ecx
call fcn.10334a40
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
cmp ebx, 1
jne 0x102b8353
mov ecx, edi
call fcn.102b7580
push dword [ebp - 0x14]
mov eax, dword [esi + 0x3c]
push dword [ebp - 0x18]
mov edx, dword [edi + 4]
push dword [esi + 0x80]
mov ecx, dword [eax]
push edx
push eax
mov dword [ebp - 0xc], edx
mov eax, dword [ecx + 0xc]
call eax
add esp, 0x14
mov dword [ebp - 0x14], eax
cmp ebx, 1
jne 0x102b8389
mov eax, dword [ebp - 0xc]
movdqu xmm0, xmmword [eax + 0x18]
movdqu xmmword [esi + 0x64], xmm0
cmp ebx, dword [esi + 0x20]
jbe 0x102b8391
mov dword [esi + 0x20], ebx
inc dword [esi + 0xa8]
mov edx, ebx
push dword [edi + 4]
mov ecx, dword [esi + 0x58]
call fcn.102c6f90
add esp, 4
mov ebx, dword [ebp - 0x14]
mov edi, dword [edi + 0xc]
test ebx, ebx
je 0x102b8313
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1032ef46
mov esp, ebp
pop ebp
ret
Function at 0x102e15f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov dword [ebp - 8], edx
xor ecx, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ecx
mov ebx, edx
push edi
test edx, edx
je 0x102e161d
cmp byte [edx], cl
je 0x102e1615
inc ebx
cmp byte [ebx], cl
jne 0x102e1610
sub ebx, edx
and ebx, 0x3fffffff
mov edi, dword [esi + 0x14]
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], edi
test edi, edi
jle 0x102e1707
mov edi, eax
cmp eax, 2
jge 0x102e163a
xor edi, 1
mov eax, dword [ebp + 8]
test eax, eax
je 0x102e169f
mov edx, eax
mov ecx, edi
mov eax, dword [esi + 0x10]
add ecx, ecx
mov esi, dword [eax + ecx*8]
mov eax, edx
mov al, byte [eax]
test al, al
je 0x102e167d
jmp 0x102e1660
movzx ecx, byte [esi]
movzx eax, al
mov al, byte [eax + 0x103f5620]
cmp al, byte [ecx + 0x103f5620]
jne 0x102e167d
mov al, byte [edx + 1]
inc edx
inc esi
test al, al
jne 0x102e1660
movzx eax, byte [esi]
movzx ecx, byte [eax + 0x103f5620]
movzx eax, byte [edx]
movzx eax, byte [eax + 0x103f5620]
sub eax, ecx
jne 0x102e1715
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0x10]
mov eax, dword [esi + 0x10]
add edi, edi
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
mov dword [ebp - 4], ecx
cmp dword [ecx + 0xc], 0
je 0x102e16e8
mov edi, edx
mov esi, ebx
xor edx, edx
test ebx, ebx
jle 0x102e16e0
mov edi, edi
movzx eax, byte [edi]
lea edi, [edi + 1]
dec esi
movzx ecx, byte [eax + 0x103f5620]
lea eax, [edx*8]
xor ecx, eax
xor edx, ecx
test esi, esi
jg 0x102e16c0
mov ecx, dword [ebp - 4]
mov eax, edx
xor edx, edx
div dword [ecx]
jmp 0x102e16ea
xor edx, edx
push edx
mov edx, dword [ebp - 8]
push ebx
call fcn.102b0560
add esp, 8
test eax, eax
je 0x102e170e
mov ecx, dword [eax + 8]
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x102e1718
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov dword [ebp - 4], ecx
jmp 0x102e1718
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp - 0x14]
jge 0x102e1705
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0x10]
jmp 0x102e1630
Function at 0x102e1840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor eax, eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, edx
push esi
push edi
test edx, edx
je 0x102e186d
cmp byte [edx], al
je 0x102e1865
jmp 0x102e1860
inc ebx
cmp byte [ebx], al
jne 0x102e1860
sub ebx, edx
and ebx, 0x3fffffff
mov esi, dword [ecx + 0x14]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], esi
test esi, esi
jle 0x102e1949
mov esi, dword [ecx + 0x10]
mov dword [ebp - 0x18], esi
mov eax, edi
cmp edi, 2
jge 0x102e1890
xor eax, 1
shl eax, 4
cmp dword [ebp + 8], 0
mov ecx, dword [eax + esi + 0xc]
mov dword [ebp - 0x10], ecx
je 0x102e18eb
mov ecx, dword [ebp + 8]
mov edx, ecx
mov esi, dword [eax + esi]
mov al, byte [ecx]
test al, al
je 0x102e18cd
mov edi, edi
movzx ecx, byte [esi]
movzx eax, al
mov al, byte [eax + 0x103f5620]
cmp al, byte [ecx + 0x103f5620]
jne 0x102e18cd
mov al, byte [edx + 1]
inc edx
inc esi
test al, al
jne 0x102e18b0
movzx eax, byte [esi]
movzx ecx, byte [eax + 0x103f5620]
movzx eax, byte [edx]
movzx eax, byte [eax + 0x103f5620]
sub eax, ecx
jne 0x102e1957
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
add ecx, 0x18
mov dword [ebp - 0x10], ecx
cmp dword [ecx + 0xc], 0
je 0x102e192c
mov edi, edx
mov esi, ebx
xor edx, edx
test ebx, ebx
jle 0x102e1921
movzx eax, byte [edi]
lea edi, [edi + 1]
dec esi
movzx ecx, byte [eax + 0x103f5620]
lea eax, [edx*8]
xor ecx, eax
xor edx, ecx
test esi, esi
jg 0x102e1901
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0xc]
mov eax, edx
xor edx, edx
div dword [ecx]
jmp 0x102e192e
xor edx, edx
push edx
mov edx, dword [ebp - 8]
push ebx
call fcn.102b0560
add esp, 8
test eax, eax
je 0x102e1950
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
test eax, eax
je 0x102e195a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x102e195a
mov eax, dword [ebp - 4]
inc edi
mov dword [ebp - 0xc], edi
cmp edi, dword [ebp - 0x14]
jge 0x102e1949
mov edx, dword [ebp - 8]
mov esi, dword [ebp - 0x18]
jmp 0x102e1886
Function at 0x102e1ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x24], ebx
push edi
test esi, esi
je 0x102e1e80
test ebx, ebx
je 0x102e1d0d
cmp dword [ebx + 0x1f0], 0
jne 0x102e1d1c
mov eax, 0xffff
add word [esi + 0x28], ax
jne 0x102e1e80
mov edi, dword [esi + 8]
mov dword [esp + 0x14], edi
test edi, edi
je 0x102e1e22
jmp 0x102e1d30
mov eax, dword [edi + 0x14]
mov dword [esp + 0x2c], eax
test ebx, ebx
je 0x102e1d48
cmp dword [ebx + 0x1f0], 0
jne 0x102e1df9
mov esi, dword [edi]
mov ecx, esi
mov dword [esp + 0x20], esi
test esi, esi
je 0x102e1d6e
cmp byte [esi], 0
je 0x102e1d66
lea esp, [esp]
inc ecx
cmp byte [ecx], 0
jne 0x102e1d60
sub ecx, esi
and ecx, 0x3fffffff
mov eax, dword [edi + 0x18]
add eax, 0x18
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov edx, dword [eax]
mov dword [esp + 0x24], edx
test edx, edx
je 0x102e1dcf
xor edi, edi
mov dword [esp + 0x1c], esi
mov ebx, ecx
test ecx, ecx
jle 0x102e1db9
mov ecx, esi
movzx eax, byte [ecx]
lea edx, [edi*8]
dec ebx
lea ecx, [ecx + 1]
movzx esi, byte [eax + 0x103f5620]
xor esi, edx
xor edi, esi
test ebx, ebx
jg 0x102e1d94
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x28]
mov eax, edi
mov edi, dword [esp + 0x14]
xor edx, edx
div dword [esp + 0x24]
mov eax, dword [esp + 0x10]
jmp 0x102e1dd1
xor edx, edx
push edx
mov dword [esp + 0x10], edx
mov edx, esi
push ecx
mov ecx, eax
call fcn.102b0560
add esp, 8
test eax, eax
je 0x102e1df9
push dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
mov edx, eax
call fcn.102b0610
add esp, 4
mov edx, dword [edi + 0x10]
mov ecx, ebx
call fcn.102acfa0
mov edx, edi
mov ecx, ebx
call fcn.102acfa0
mov eax, dword [esp + 0x2c]
mov edi, eax
mov dword [esp + 0x14], eax
test eax, eax
jne 0x102e1d30
mov esi, dword [esp + 0x18]
mov edx, esi
mov ecx, ebx
call fcn.102ed270
mov edx, esi
mov ecx, ebx
call fcn.102e1c60
mov edx, dword [esi]
mov ecx, ebx
call fcn.102acfa0
mov edx, dword [esi + 0x14]
mov ecx, ebx
call fcn.102acfa0
mov esi, dword [esi + 0xc]
test esi, esi
je 0x102e1e60
mov edx, esi
mov ecx, ebx
call fcn.102f5690
mov edx, esi
mov ecx, ebx
call fcn.102acfa0
mov esi, dword [esp + 0x18]
mov ecx, ebx
mov edx, dword [esi + 0x18]
call fcn.102da0a0
mov edx, esi
mov ecx, ebx
call fcn.10302260
mov edx, esi
mov ecx, ebx
call fcn.102acfa0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x102e3a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x104cc790]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add edx, edx
push ebx
mov ebx, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
push esi
mov eax, dword [ebx]
push edi
mov dword [ebp - 0x2c], ebx
mov eax, dword [eax + 0x10]
mov esi, dword [eax + edx*8]
mov eax, 1
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], eax
lea esp, [esp]
push eax
push 0x104173c0
lea eax, [ebp - 0x1c]
push eax
push 0x18
call fcn.102ae760
mov ecx, dword [ebx]
lea edx, [ebp - 0x1c]
add esp, 0x10
mov dword [ebp - 0x30], ecx
cmp byte [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
je 0x102e3ae6
lea esp, [esp]
inc edx
cmp byte [edx], 0
jne 0x102e3ae0
lea eax, [ebp - 0x1c]
xor ebx, ebx
sub edx, eax
mov dword [ebp - 0x34], ebx
mov eax, dword [ecx + 0x14]
and edx, 0x3fffffff
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x44], eax
test eax, eax
jle 0x102e3c21
mov edi, ebx
cmp ebx, 2
jge 0x102e3b11
xor edi, 1
test esi, esi
je 0x102e3b6f
mov ecx, dword [ecx + 0x10]
mov edx, edi
add edx, edx
mov eax, esi
mov esi, dword [ecx + edx*8]
mov ecx, dword [ebp - 0x24]
mov cl, byte [ecx]
test cl, cl
je 0x102e3b4d
lea ebx, [ebx]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x103f5620]
cmp cl, byte [edx + 0x103f5620]
jne 0x102e3b4d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x102e3b30
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x103f5620]
movzx ecx, byte [ecx + 0x103f5620]
sub eax, ecx
jne 0x102e3be3
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx + 0x10]
add edi, edi
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
mov dword [ebp - 0x20], ecx
cmp dword [ecx + 0xc], 0
je 0x102e3bbb
xor esi, esi
lea ebx, [ebp - 0x1c]
mov edi, edx
test edx, edx
jle 0x102e3bb0
nop
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x103f5620]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x102e3b90
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x34]
mov eax, esi
xor edx, edx
div dword [ecx]
jmp 0x102e3bbd
xor edx, edx
push edx
push dword [ebp - 0x28]
lea edx, [ebp - 0x1c]
call fcn.102b0560
add esp, 8
test eax, eax
je 0x102e3bdc
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x102e3c00
jmp 0x102e3be6
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x102e3be6
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
inc ebx
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x34], ebx
cmp ebx, dword [ebp - 0x44]
jl 0x102e3b07
test eax, eax
je 0x102e3c21
push dword [ebp - 0x3c]
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x1c]
push dword [ebp - 0x40]
mov ebx, dword [ebp - 0x2c]
push eax
push esi
push 0x10416e5c
push ebx
call fcn.102e1540
add esp, 0x18
jmp 0x102e3c24
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 3
jle 0x102e3ab0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1032ef46
mov esp, ebp
pop ebp
ret
Function at 0x102e6550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, edx
xor edx, edx
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x20], eax
mov esi, dword [eax]
push edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], edx
lea ecx, [ecx]
mov al, byte [edx + 0x103f5d8c]
mov byte [ebp - 1], al
test esi, esi
je 0x102e6613
cmp byte [esi], 0
mov ecx, esi
je 0x102e658e
inc ecx
cmp byte [ecx], 0
jne 0x102e6588
sub ecx, esi
lea eax, [ebx + 0x19c]
and ecx, 0x3fffffff
mov dword [ebp - 0x1c], eax
cmp dword [eax + 0xc], 0
mov dword [ebp - 0x10], ecx
je 0x102e65ea
xor edi, edi
mov dword [ebp - 0xc], esi
mov ebx, ecx
test ecx, ecx
jle 0x102e65d8
mov ecx, esi
movzx eax, byte [ecx]
lea edx, [edi*8]
dec ebx
lea ecx, [ecx + 1]
movzx esi, byte [eax + 0x103f5620]
xor esi, edx
xor edi, esi
test ebx, ebx
jg 0x102e65b5
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov eax, edi
xor edx, edx
div dword [ebx + 0x19c]
mov eax, dword [ebp - 0x1c]
jmp 0x102e65ec
xor edx, edx
push edx
push ecx
mov edx, esi
mov ecx, eax
call fcn.102b0560
add esp, 8
test eax, eax
je 0x102e6609
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 8]
mov al, byte [ebp - 1]
jmp 0x102e6616
mov edx, dword [ebp - 8]
xor ecx, ecx
mov al, byte [ebp - 1]
jmp 0x102e6616
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x102e6626
movzx eax, al
lea eax, [eax + eax*4]
lea ecx, [ecx + eax*4]
add ecx, 0xffffffec
cmp dword [ecx + 0xc], 0
jne 0x102e6645
inc edx
mov dword [ebp - 8], edx
cmp edx, 3
jl 0x102e6570
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x20]
xor eax, eax
movdqu xmm0, xmmword [ecx]
pop edi
pop esi
movdqu xmmword [edx], xmm0
mov dword [edx + 0x10], 0
pop ebx
mov esp, ebp
pop ebp
ret