joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c05a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10319faa
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0
mov eax, dword fs:[0x2c]
mov edx, dword [0x104c14e0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x106118ac]
cmp eax, dword [edx + 4]
jg 0x100c062b
mov eax, dword [0x10611778]
add eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x106118ac
call fcn.102bba07
add esp, 4
cmp dword [0x106118ac], 0xffffffff
jne 0x100c0606
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x2c]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x2c], xmm0
push 0x12
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x30], 1
call fcn.1001a120
mov esi, 0x103f6a88
jmp 0x100c0680
mov al, byte [esi]
lea ecx, [ebp - 0x2c]
xor al, 0xa5
movzx eax, al
push eax
call fcn.1001a280
add esi, 2
cmp esi, 0x103f6aa8
jne 0x100c0680
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
cmovae esi, dword [ebp - 0x2c]
test edi, edi
je 0x100c0747
push edi
push 0
push esi
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
je 0x100c0747
sub eax, esi
cmp eax, 0xffffffff
je 0x100c0747
jmp 0x100c06d2
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
mov edx, 1
lea ecx, [ebp - 0x2c]
cmovae esi, dword [ebp - 0x2c]
add esi, eax
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
sub esi, eax
mov eax, edi
sub eax, esi
cmp eax, edx
cmovb edx, eax
cmp dword [ebp - 0x18], 0x10
cmovae ecx, dword [ebp - 0x2c]
sub edi, edx
add ecx, esi
mov eax, edi
sub eax, esi
inc eax
push eax
lea eax, [ecx + edx]
push eax
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
cmovae esi, dword [ebp - 0x2c]
test edi, edi
je 0x100c0747
push edi
push 0
push esi
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
je 0x100c0747
sub eax, esi
cmp eax, 0xffffffff
jne 0x100c06d2
jmp 0x100c0747
mov edi, dword [ebp - 0x34]
lea esi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
mov ecx, edi
cmovae esi, dword [ebp - 0x2c]
mov eax, dword [edi]
mov eax, dword [eax + 0x44]
call eax
mov edx, esi
mov ecx, eax
call fcn.100d0060
mov ecx, dword [ebp - 0x18]
mov dword [0x10611778], eax
cmp ecx, 0x10
jb 0x100c07a4
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100c0798
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100c0798
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.102bb95a
add esp, 8
jmp 0x100c07a4
push 0x106118ac
call fcn.102bb9b6
add esp, 4
jmp 0x100c0606
Function at 0x100c07c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1031a00a
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0
mov eax, dword fs:[0x2c]
mov edx, dword [0x104c14e0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x10611990]
cmp eax, dword [edx + 4]
jg 0x100c084b
mov eax, dword [0x106119ec]
add eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x10611990
call fcn.102bba07
add esp, 4
cmp dword [0x10611990], 0xffffffff
jne 0x100c0826
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x2c]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x2c], xmm0
push 0x11
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x30], 1
call fcn.1001a120
mov esi, 0x103f61f4
jmp 0x100c08a0
mov al, byte [esi]
lea ecx, [ebp - 0x2c]
xor al, 0xa5
movzx eax, al
push eax
call fcn.1001a280
add esi, 2
cmp esi, 0x103f6212
jne 0x100c08a0
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
cmovae esi, dword [ebp - 0x2c]
test edi, edi
je 0x100c0967
push edi
push 0
push esi
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
je 0x100c0967
sub eax, esi
cmp eax, 0xffffffff
je 0x100c0967
jmp 0x100c08f2
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
mov edx, 1
lea ecx, [ebp - 0x2c]
cmovae esi, dword [ebp - 0x2c]
add esi, eax
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
sub esi, eax
mov eax, edi
sub eax, esi
cmp eax, edx
cmovb edx, eax
cmp dword [ebp - 0x18], 0x10
cmovae ecx, dword [ebp - 0x2c]
sub edi, edx
add ecx, esi
mov eax, edi
sub eax, esi
inc eax
push eax
lea eax, [ecx + edx]
push eax
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
cmovae esi, dword [ebp - 0x2c]
test edi, edi
je 0x100c0967
push edi
push 0
push esi
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
je 0x100c0967
sub eax, esi
cmp eax, 0xffffffff
jne 0x100c08f2
jmp 0x100c0967
mov edi, dword [ebp - 0x34]
lea esi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
mov ecx, edi
cmovae esi, dword [ebp - 0x2c]
mov eax, dword [edi]
mov eax, dword [eax + 0x44]
call eax
mov edx, esi
mov ecx, eax
call fcn.100d0060
mov ecx, dword [ebp - 0x18]
mov dword [0x106119ec], eax
cmp ecx, 0x10
jb 0x100c09c4
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100c09b8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100c09b8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.102bb95a
add esp, 8
jmp 0x100c09c4
push 0x10611990
call fcn.102bb9b6
add esp, 4
jmp 0x100c0826
Function at 0x100c10e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1031a141
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x44], ecx
mov eax, dword fs:[0x2c]
mov edx, dword [0x104c14e0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x1061173c]
cmp eax, dword [edx + 4]
jg 0x100c115d
mov eax, dword [0x10611974]
mov edx, dword [ebp - 0x44]
mov ecx, dword [0x1060b274]
mov edx, dword [eax + edx]
mov eax, dword [ecx]
push edx
call dword [eax + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
ret
push 0x1061173c
call fcn.102bba07
add esp, 4
cmp dword [0x1061173c], 0xffffffff
jne 0x100c112a
mov dword [ebp - 4], 0
cmp byte [0x104ab510], 0
jne 0x100c11e9
mov byte [0x104ab510], 1
xor esi, esi
jmp 0x100c1190
xor edx, edx
mov ebx, esi
xor edx, dword [0x104ab524]
xor ebx, dword [0x104ab520]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104ab511]
xor cl, bl
mov byte [esi + 0x104ab511], cl
inc esi
cmp esi, 0xf
jb 0x100c1190
jmp 0x100c11e9
push ecx
push 0x104ab51f
push 0x104ab511
lea ecx, [ebp - 0x40]
call fcn.1001a620
mov byte [ebp - 4], 1
lea edi, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae edi, dword [ebp - 0x40]
cmp byte [0x104aba20], 0
jne 0x100c1279
mov byte [0x104aba20], 1
xor esi, esi
jmp 0x100c1220
xor edx, edx
mov ebx, esi
xor edx, dword [0x104aba34]
xor ebx, dword [0x104aba30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + str._rp_]
xor cl, bl
mov byte [esi + str._rp_], cl
inc esi
cmp esi, 0xd
jb 0x100c1220
jmp 0x100c1279
push ecx
push 0x104aba2d
push str._rp_
lea ecx, [ebp - 0x28]
call fcn.1001a620
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push 0
cmovae eax, dword [ebp - 0x28]
push edi
push eax
call fcn.10171b70
lea ecx, [ebp - 0x28]
mov dword [0x10611974], eax
call fcn.10019dd0
lea ecx, [ebp - 0x40]
call fcn.10019dd0
push 0x1061173c
mov dword [ebp - 4], 0xffffffff
call fcn.102bb9b6
add esp, 4
jmp 0x100c112a
Function at 0x100c12e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1031a191
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x44], ebx
mov eax, dword fs:[0x2c]
mov edx, dword [0x104c14e0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x10611a28]
cmp eax, dword [edx + 4]
jg 0x100c1352
mov eax, dword [0x10611798]
movss xmm0, dword [eax + ebx]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
ret
push 0x10611a28
call fcn.102bba07
add esp, 4
cmp dword [0x10611a28], 0xffffffff
jne 0x100c132c
mov dword [ebp - 4], 0
cmp byte [0x104a9d60], 0
jne 0x100c13dc
mov byte [0x104a9d60], 1
xor esi, esi
jmp 0x100c1383
xor edx, edx
mov ebx, esi
xor edx, dword [0x104a9d7c]
xor ebx, dword [0x104a9d78]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104a9d61]
xor cl, bl
mov byte [esi + 0x104a9d61], cl
inc esi
cmp esi, 0x10
jb 0x100c1383
jmp 0x100c13dc
push ecx
push 0x104a9d70
push 0x104a9d61
lea ecx, [ebp - 0x40]
call fcn.1001a620
mov byte [ebp - 4], 1
lea edi, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae edi, dword [ebp - 0x40]
cmp byte [0x104a9c70], 0
jne 0x100c146b
mov byte [0x104a9c70], 1
xor esi, esi
jmp 0x100c1412
xor edx, edx
mov ebx, esi
xor edx, dword [0x104a9c84]
xor ebx, dword [0x104a9c80]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104a9c71]
xor cl, bl
mov byte [esi + 0x104a9c71], cl
inc esi
cmp esi, 0xd
jb 0x100c1412
jmp 0x100c146b
push ecx
push 0x104a9c7d
push 0x104a9c71
lea ecx, [ebp - 0x28]
call fcn.1001a620
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push 0
cmovae eax, dword [ebp - 0x28]
push edi
push eax
call fcn.10171b70
lea ecx, [ebp - 0x28]
mov dword [0x10611798], eax
call fcn.10019dd0
lea ecx, [ebp - 0x40]
call fcn.10019dd0
push 0x10611a28
call fcn.102bb9b6
mov eax, dword [0x10611798]
add esp, 4
mov ecx, dword [ebp - 0x44]
movss xmm0, dword [eax + ecx]
jmp 0x100c1336
Function at 0x100c14d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1031a1e1
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x44], ebx
mov eax, dword fs:[0x2c]
mov edx, dword [0x104c14e0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x10611958]
cmp eax, dword [edx + 4]
jg 0x100c1542
mov eax, dword [0x10611930]
movss xmm0, dword [eax + ebx]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
ret
push 0x10611958
call fcn.102bba07
add esp, 4
cmp dword [0x10611958], 0xffffffff
jne 0x100c151c
mov dword [ebp - 4], 0
cmp byte [0x104a95b0], 0
jne 0x100c15cc
mov byte [0x104a95b0], 1
xor esi, esi
jmp 0x100c1573
xor edx, edx
mov ebx, esi
xor edx, dword [0x104a95cc]
xor ebx, dword [0x104a95c8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104a95b1]
xor cl, bl
mov byte [esi + 0x104a95b1], cl
inc esi
cmp esi, 0x14
jb 0x100c1573
jmp 0x100c15cc
push ecx
push 0x104a95c4
push 0x104a95b1
lea ecx, [ebp - 0x40]
call fcn.1001a620
mov byte [ebp - 4], 1
lea edi, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae edi, dword [ebp - 0x40]
cmp byte [0x104abfa0], 0
jne 0x100c165b
mov byte [0x104abfa0], 1
xor esi, esi
jmp 0x100c1602
xor edx, edx
mov ebx, esi
xor edx, dword [0x104abfb4]
xor ebx, dword [0x104abfb0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104abfa1]
xor cl, bl
mov byte [esi + 0x104abfa1], cl
inc esi
cmp esi, 0xd
jb 0x100c1602
jmp 0x100c165b
push ecx
push 0x104abfad
push 0x104abfa1
lea ecx, [ebp - 0x28]
call fcn.1001a620
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push 0
cmovae eax, dword [ebp - 0x28]
push edi
push eax
call fcn.10171b70
lea ecx, [ebp - 0x28]
mov dword [0x10611930], eax
call fcn.10019dd0
lea ecx, [ebp - 0x40]
call fcn.10019dd0
push 0x10611958
call fcn.102bb9b6
mov eax, dword [0x10611930]
add esp, 4
mov ecx, dword [ebp - 0x44]
movss xmm0, dword [eax + ecx]
jmp 0x100c1526
Function at 0x100c16c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1031a231
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x44], ebx
mov eax, dword fs:[0x2c]
mov edx, dword [0x104c14e0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x106116cc]
cmp eax, dword [edx + 4]
jg 0x100c1732
mov eax, dword [0x10611868]
movss xmm0, dword [eax + ebx]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
ret
push 0x106116cc
call fcn.102bba07
add esp, 4
cmp dword [0x106116cc], 0xffffffff
jne 0x100c170c
mov dword [ebp - 4], 0
cmp byte [0x104ab600], 0
jne 0x100c17bc
mov byte [0x104ab600], 1
xor esi, esi
jmp 0x100c1763
xor edx, edx
mov ebx, esi
xor edx, dword [0x104ab614]
xor ebx, dword [0x104ab610]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104ab601]
xor cl, bl
mov byte [esi + 0x104ab601], cl
inc esi
cmp esi, 0xb
jb 0x100c1763
jmp 0x100c17bc
push ecx
push 0x104ab60b
push 0x104ab601
lea ecx, [ebp - 0x40]
call fcn.1001a620
mov byte [ebp - 4], 1
lea edi, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae edi, dword [ebp - 0x40]
cmp byte [0x104a9650], 0
jne 0x100c184b
mov byte [0x104a9650], 1
xor esi, esi
jmp 0x100c17f2
xor edx, edx
mov ebx, esi
xor edx, dword [0x104a9664]
xor ebx, dword [0x104a9660]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104a9651]
xor cl, bl
mov byte [esi + 0x104a9651], cl
inc esi
cmp esi, 0xd
jb 0x100c17f2
jmp 0x100c184b
push ecx
push 0x104a965d
push 0x104a9651
lea ecx, [ebp - 0x28]
call fcn.1001a620
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push 0
cmovae eax, dword [ebp - 0x28]
push edi
push eax
call fcn.10171b70
lea ecx, [ebp - 0x28]
mov dword [0x10611868], eax
call fcn.10019dd0
lea ecx, [ebp - 0x40]
call fcn.10019dd0
push 0x106116cc
call fcn.102bb9b6
mov eax, dword [0x10611868]
add esp, 4
mov ecx, dword [ebp - 0x44]
movss xmm0, dword [eax + ecx]
jmp 0x100c1716
Function at 0x100c18b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1031a281
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x44], ebx
mov eax, dword fs:[0x2c]
mov edx, dword [0x104c14e0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x10611a0c]
cmp eax, dword [edx + 4]
jg 0x100c1922
mov eax, dword [0x10611710]
movss xmm0, dword [eax + ebx]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
ret
push 0x10611a0c
call fcn.102bba07
add esp, 4
cmp dword [0x10611a0c], 0xffffffff
jne 0x100c18fc
mov dword [ebp - 4], 0
cmp byte [0x104ac350], 0
jne 0x100c19ac
mov byte [0x104ac350], 1
xor esi, esi
jmp 0x100c1953
xor edx, edx
mov ebx, esi
xor edx, dword [0x104ac364]
xor ebx, dword [0x104ac360]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104ac351]
xor cl, bl
mov byte [esi + 0x104ac351], cl
inc esi
cmp esi, 0xf
jb 0x100c1953
jmp 0x100c19ac
push ecx
push 0x104ac35f
push 0x104ac351
lea ecx, [ebp - 0x40]
call fcn.1001a620
mov byte [ebp - 4], 1
lea edi, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae edi, dword [ebp - 0x40]
cmp byte [0x104aaae0], 0
jne 0x100c1a3b
mov byte [0x104aaae0], 1
xor esi, esi
jmp 0x100c19e2
xor edx, edx
mov ebx, esi
xor edx, dword [0x104aaaf4]
xor ebx, dword [0x104aaaf0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104aaae1]
xor cl, bl
mov byte [esi + 0x104aaae1], cl
inc esi
cmp esi, 0xd
jb 0x100c19e2
jmp 0x100c1a3b
push ecx
push 0x104aaaed
push 0x104aaae1
lea ecx, [ebp - 0x28]
call fcn.1001a620
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push 0
cmovae eax, dword [ebp - 0x28]
push edi
push eax
call fcn.10171b70
lea ecx, [ebp - 0x28]
mov dword [0x10611710], eax
call fcn.10019dd0
lea ecx, [ebp - 0x40]
call fcn.10019dd0
push 0x10611a0c
call fcn.102bb9b6
mov eax, dword [0x10611710]
add esp, 4
mov ecx, dword [ebp - 0x44]
movss xmm0, dword [eax + ecx]
jmp 0x100c1906
Function at 0x100c1aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1031a2d1
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x44], ebx
mov eax, dword fs:[0x2c]
mov edx, dword [0x104c14e0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x1061182c]
cmp eax, dword [edx + 4]
jg 0x100c1b10
mov eax, dword [0x1061178c]
mov al, byte [eax + ebx]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
ret
push 0x1061182c
call fcn.102bba07
add esp, 4
cmp dword [0x1061182c], 0xffffffff
jne 0x100c1aec
mov dword [ebp - 4], 0
cmp byte [0x104ab400], 0
jne 0x100c1b9a
mov byte [0x104ab400], 1
xor esi, esi
jmp 0x100c1b41
xor edx, edx
mov ebx, esi
xor edx, dword [0x104ab414]
xor ebx, dword [0x104ab410]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104ab401]
xor cl, bl
mov byte [esi + 0x104ab401], cl
inc esi
cmp esi, 0xf
jb 0x100c1b41
jmp 0x100c1b9a
push ecx
push 0x104ab40f
push 0x104ab401
lea ecx, [ebp - 0x40]
call fcn.1001a620
mov byte [ebp - 4], 1
lea edi, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae edi, dword [ebp - 0x40]
cmp byte [0x104ab3c0], 0
jne 0x100c1c29
mov byte [0x104ab3c0], 1
xor esi, esi
jmp 0x100c1bd0
xor edx, edx
mov ebx, esi
xor edx, dword [0x104ab3d4]
xor ebx, dword [0x104ab3d0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104ab3c1]
xor cl, bl
mov byte [esi + 0x104ab3c1], cl
inc esi
cmp esi, 0xd
jb 0x100c1bd0
jmp 0x100c1c29
push ecx
push 0x104ab3cd
push 0x104ab3c1
lea ecx, [ebp - 0x28]
call fcn.1001a620
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push 0
cmovae eax, dword [ebp - 0x28]
push edi
push eax
call fcn.10171b70
lea ecx, [ebp - 0x28]
mov dword [0x1061178c], eax
call fcn.10019dd0
lea ecx, [ebp - 0x40]
call fcn.10019dd0
push 0x1061182c
call fcn.102bb9b6
mov eax, dword [0x1061178c]
add esp, 4
mov ecx, dword [ebp - 0x44]
mov al, byte [eax + ecx]
jmp 0x100c1af4