joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b3bb0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
xor edx, edx
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
mov dword [eax + 0xd0], ecx
cmp ecx, edx
jne 0x100b3c38
mov dword [eax + 0x10], 0xf3bcc908
mov dword [eax + 0x14], 0x6a09e667
mov dword [eax + 0x18], 0x84caa73b
mov dword [eax + 0x1c], 0xbb67ae85
mov dword [eax + 0x20], 0xfe94f82b
mov dword [eax + 0x24], 0x3c6ef372
mov dword [eax + 0x28], 0x5f1d36f1
mov dword [eax + 0x2c], 0xa54ff53a
mov dword [eax + 0x30], 0xade682d1
mov dword [eax + 0x34], 0x510e527f
mov dword [eax + 0x38], 0x2b3e6c1f
mov dword [eax + 0x3c], 0x9b05688c
mov dword [eax + 0x40], 0xfb41bd6b
mov dword [eax + 0x44], 0x1f83d9ab
mov dword [eax + 0x48], 0x137e2179
mov dword [eax + 0x4c], 0x5be0cd19
ret
mov dword [eax + 0x10], 0xc1059ed8
mov dword [eax + 0x14], 0xcbbb9d5d
mov dword [eax + 0x18], 0x367cd507
mov dword [eax + 0x1c], 0x629a292a
mov dword [eax + 0x20], 0x3070dd17
mov dword [eax + 0x24], 0x9159015a
mov dword [eax + 0x28], 0xf70e5939
mov dword [eax + 0x2c], 0x152fecd8
mov dword [eax + 0x30], 0xffc00b31
mov dword [eax + 0x34], 0x67332667
mov dword [eax + 0x38], 0x68581511
mov dword [eax + 0x3c], 0x8eb44a87
mov dword [eax + 0x40], 0x64f98fa7
mov dword [eax + 0x44], 0xdb0c2e0d
mov dword [eax + 0x48], 0xbefa4fa4
mov dword [eax + 0x4c], 0x47b5481d
ret
Function at 0x100b8640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
xor cl, cl
test edi, edi
je 0x100b865e
push esi
mov esi, dword [ebp + 8]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
dec edi
jne 0x100b8652
pop esi
movzx eax, cl
pop edi
pop ebp
ret

Function at 0x100b97b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, eax
cmp dword [esi + 8], 0
push edi
je 0x100b9830
mov ecx, dword [esi + 0xec]
lea eax, [ecx + ecx]
lea edi, [eax + 1]
cmp edx, edi
jne 0x100b981f
movzx edx, byte [ebx]
cmp edx, eax
jne 0x100b981f
xor dl, dl
lea eax, [ebx + 1]
lea edi, [esi + 0xf0]
test ecx, ecx
je 0x100b9802
sub edi, eax
mov ebx, ecx
jmp 0x100b97f0
mov cl, byte [edi + eax]
xor cl, byte [eax]
inc eax
or dl, cl
dec ebx
jne 0x100b97f0
test dl, dl
jne 0x100b981f
mov ebx, dword [ebp + 8]
mov ecx, dword [esi + 0xec]
lea edx, [esi + 0xfc]
push edx
lea eax, [ecx + ebx + 1]
call fcn.100b8640
add esp, 4
test eax, eax
je 0x100b9840
push str.non_matching_renegotiation_info
push 0x42f
push 0x10428800
jmp 0x100b9856
cmp edx, 1
jne 0x100b9847
cmp byte [ebx], 0
jne 0x100b9847
mov dword [esi + 0xe8], edx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push str.non_zero_length_renegotiation_info
push 0x43c
push 0x10428850
push 1
push esi
call fcn.100a2610
add esp, 0x14
push 0x28
push 2
call fcn.100a80e0
add esp, 8
test eax, eax
jne 0x100b9876
mov eax, 0xffff8680
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100c01e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 8], 0
push edi
je 0x100c0232
mov ecx, dword [esi + 0xec]
lea edi, [ecx + 1]
cmp edx, edi
jne 0x100c0221
movzx edx, byte [eax]
cmp edx, ecx
jne 0x100c0221
inc eax
xor dl, dl
lea edi, [esi + 0xfc]
test ecx, ecx
je 0x100c0242
sub edi, eax
mov bl, byte [edi + eax]
xor bl, byte [eax]
inc eax
or dl, bl
dec ecx
jne 0x100c0212
test dl, dl
je 0x100c0242
push 0x10420c24
push 0xa0
push 0x10420cb8
jmp 0x100c0258
cmp edx, 1
jne 0x100c0249
cmp byte [eax], 0
jne 0x100c0249
mov dword [esi + 0xe8], edx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x10420c44
push 0xad
push 0x10420d08
push 1
push esi
call fcn.100a2610
add esp, 0x14
push 0x28
push 2
call fcn.100a80e0
add esp, 8
test eax, eax
jne 0x100c0278
mov eax, 0xffff8700
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x100c6c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebx + 1]
push eax
push 0
push esi
call sub.MSVCR100.dll_memset
xor edx, edx
add esp, 0xc
mov dword [ebp - 8], edx
test ebx, ebx
je 0x100c6cdd
movzx eax, byte [ebp + 0xc]
push edi
xor edi, edi
test eax, eax
je 0x100c6cd4
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 4]
mov cl, byte [edx + esi]
shl eax, 5
mov dword [ebp - 0xc], eax
mov byte [ebp - 1], cl
jmp 0x100c6c94
mov eax, dword [ebp - 0xc]
cmp eax, edx
ja 0x100c6c9c
xor eax, eax
jmp 0x100c6cb7
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ecx + 8]
mov eax, edx
shr eax, 5
mov eax, dword [ebx + eax*4]
mov ebx, dword [ebp + 8]
mov ecx, edx
and ecx, 0x1f
shr eax, cl
and eax, 1
mov ecx, edi
shl al, cl
inc edi
add edx, ebx
or byte [ebp - 1], al
movzx eax, byte [ebp + 0xc]
cmp edi, eax
jb 0x100c6c91
mov dl, byte [ebp - 1]
mov ecx, dword [ebp - 8]
mov byte [ecx + esi], dl
mov edx, ecx
inc edx
mov dword [ebp - 8], edx
cmp edx, ebx
jb 0x100c6c77
pop edi
mov ecx, 1
xor al, al
cmp ebx, ecx
jb 0x100c6d25
mov bl, byte [ecx + esi]
mov dl, bl
and dl, al
xor bl, al
mov byte [ebp - 1], dl
mov al, bl
and al, 1
mov dl, 1
sub dl, al
mov al, byte [ecx + esi - 1]
imul dl
mov byte [ebp - 2], al
mov byte [ecx + esi], bl
and al, bl
movzx ebx, byte [ebp - 2]
xor byte [ecx + esi], bl
or al, byte [ebp - 1]
shl dl, 7
or dl, byte [ecx + esi - 1]
inc ecx
mov byte [ecx + esi - 2], dl
cmp ecx, dword [ebp + 8]
jbe 0x100c6ce8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100c9cb0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov edi, 0x1029a7f8
mov esi, edi
test edx, edx
je 0x100c9d34
cmp dword [0x1029a7f8], 0
push ebx
je 0x100c9d26
mov eax, dword [edx + 4]
cmp dword [esi + 4], eax
jne 0x100c9d1c
mov edx, dword [edx + 8]
mov esi, dword [esi]
mov ecx, eax
cmp ecx, 4
jb 0x100c9cf5
mov ebx, dword [esi]
cmp ebx, dword [edx]
jne 0x100c9d19
sub ecx, 4
add edx, 4
add esi, 4
cmp ecx, 4
jae 0x100c9ce1
test ecx, ecx
je 0x100c9d2d
mov bl, byte [edx]
cmp bl, byte [esi]
jne 0x100c9d19
cmp ecx, 1
jbe 0x100c9d2d
mov bl, byte [edx + 1]
cmp bl, byte [esi + 1]
jne 0x100c9d19
cmp ecx, 2
jbe 0x100c9d2d
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
je 0x100c9d2d
mov edx, dword [ebp + 8]
add edi, 0x18
cmp dword [edi], 0
mov esi, edi
jne 0x100c9cd0
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x100c9d40
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
push edi
mov edi, 0x1029a948
mov esi, edi
test edx, edx
je 0x100c9dc4
cmp dword [0x1029a948], 0
push ebx
je 0x100c9db6
mov eax, dword [edx + 4]
cmp dword [esi + 4], eax
jne 0x100c9dac
mov edx, dword [edx + 8]
mov esi, dword [esi]
mov ecx, eax
cmp ecx, 4
jb 0x100c9d85
mov ebx, dword [esi]
cmp ebx, dword [edx]
jne 0x100c9da9
sub ecx, 4
add edx, 4
add esi, 4
cmp ecx, 4
jae 0x100c9d71
test ecx, ecx
je 0x100c9dbd
mov bl, byte [edx]
cmp bl, byte [esi]
jne 0x100c9da9
cmp ecx, 1
jbe 0x100c9dbd
mov bl, byte [edx + 1]
cmp bl, byte [esi + 1]
jne 0x100c9da9
cmp ecx, 2
jbe 0x100c9dbd
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
je 0x100c9dbd
mov edx, dword [ebp + 8]
add edi, 0x14
cmp dword [edi], 0
mov esi, edi
jne 0x100c9d60
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x100ca9b0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ecx, ecx
mov eax, 1
push edi
lea ecx, [ecx]
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
lea esi, [eax + eax]
and edx, 0x1b
mov dword [ebp + ecx*4 - 0x804], eax
mov dword [ebp + eax*4 - 0x404], ecx
xor edx, esi
xor eax, edx
inc ecx
and eax, 0xff
cmp ecx, 0x100
jl 0x100ca9d0
mov eax, 1
mov ecx, 0x10458f90
lea esp, [esp]
mov edx, eax
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
mov dword [ecx], eax
add eax, eax
and edx, 0x1b
xor eax, edx
add ecx, 4
and eax, 0xff
cmp ecx, 0x10458fb8
jl 0x100caa10
mov byte [0x10458690], 0x63
mov byte [0x1045a81b], 0
mov ebx, 1
jmp 0x100caa50
mov ecx, dword [ebp + ebx*4 - 0x404]
add ecx, ecx
add ecx, ecx
lea edx, [ebp - 0x408]
sub edx, ecx
mov eax, dword [edx]
mov ecx, eax
sar ecx, 7
lea edx, [eax + eax]
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
and edx, 0xff
xor eax, edx
mov ecx, edx
add edx, edx
sar ecx, 7
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
xor edx, 0x63
and edx, 0xff
xor eax, edx
mov byte [ebx + 0x10458690], al
mov byte [eax + 0x1045a7b8], bl
inc ebx
cmp ebx, 0x100
jl 0x100caa50
xor ecx, ecx
movzx esi, byte [ecx + 0x10458690]
mov edx, esi
and dl, 0x80
movsx edx, dl
neg edx
sbb edx, edx
and edx, 0x1b
lea eax, [esi + esi]
xor edx, eax
and edx, 0xff
mov eax, edx
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, edx
mov dword [ecx*4 + 0x1045a3b8], eax
rol eax, 8
mov dword [ecx*4 + 0x10459fb8], eax
rol eax, 8
mov dword [ecx*4 + 0x10459bb8], eax
rol eax, 8
mov dword [ecx*4 + 0x104597b8], eax
movzx eax, byte [ecx + 0x1045a7b8]
test eax, eax
je 0x100cab92
mov esi, dword [ebp + eax*4 - 0x404]
mov edx, dword [ebp - 0x3cc]
lea eax, [esi + edx]
cdq
mov edi, 0xff
idiv edi
mov eax, dword [ebp + edx*4 - 0x804]
mov edx, dword [ebp - 0x3e0]
mov dword [ebp - 0x808], eax
lea eax, [esi + edx]
cdq
idiv edi
mov eax, dword [ebp - 0x3d0]
add eax, esi
mov ebx, dword [ebp + edx*4 - 0x804]
cdq
idiv edi
mov edi, dword [ebp + edx*4 - 0x804]
mov edx, dword [ebp - 0x3d8]
lea eax, [esi + edx]
cdq
mov esi, 0xff
idiv esi
mov eax, dword [ebp - 0x808]
mov edx, dword [ebp + edx*4 - 0x804]
jmp 0x100cab9a
xor eax, eax
xor ebx, ebx
xor edi, edi
xor edx, edx
shl edx, 8
xor edx, edi
shl edx, 8
xor edx, ebx
shl edx, 8
xor edx, eax
mov dword [ecx*4 + 0x104593b8], edx
rol edx, 8
mov dword [ecx*4 + 0x10458fb8], edx
rol edx, 8
mov dword [ecx*4 + 0x10458b90], edx
rol edx, 8
mov dword [ecx*4 + 0x10458790], edx
inc ecx
cmp ecx, 0x100
jl 0x100caac4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x100cb170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x10415990]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x118
lea eax, [esp + 0x14]
push 0
push eax
mov edi, ecx
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + 0xc]
lea ecx, [esp + 0x1c]
push ebx
lea esi, [edi + 8]
push ecx
mov dword [edi + 4], esi
call fcn.100cabf0
add esp, 0x14
test eax, eax
jne 0x100cb363
mov ecx, dword [esp + 0x10]
mov dword [edi], ecx
shl ecx, 4
add ecx, dword [esp + 0x14]
add esi, 0x10
mov edx, dword [ecx]
mov dword [esi - 0x10], edx
mov edx, dword [ecx + 4]
mov dword [esi - 0xc], edx
mov edx, dword [ecx + 8]
mov dword [esi - 8], edx
mov edx, dword [ecx + 0xc]
mov dword [esi - 4], edx
mov edx, dword [edi]
dec edx
sub ecx, 0x10
test edx, edx
jle 0x100cb34d
jmp 0x100cb200
movzx edi, byte [ecx + 3]
movzx edi, byte [edi + 0x10458690]
mov edi, dword [edi*4 + 0x10458790]
movzx ebx, byte [ecx + 2]
movzx ebx, byte [ebx + 0x10458690]
xor edi, dword [ebx*4 + 0x10458b90]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [ebx + 0x10458690]
xor edi, dword [ebx*4 + 0x10458fb8]
mov ebx, dword [ecx]
and ebx, 0xff
movzx ebx, byte [ebx + 0x10458690]
xor edi, dword [ebx*4 + 0x104593b8]
dec edx
mov dword [esi], edi
mov edi, dword [ecx + 4]
movzx ebx, byte [ecx + 7]
movzx ebx, byte [ebx + 0x10458690]
and edi, 0xff
movzx edi, byte [edi + 0x10458690]
mov edi, dword [edi*4 + 0x104593b8]
xor edi, dword [ebx*4 + 0x10458790]
movzx ebx, byte [ecx + 6]
movzx ebx, byte [ebx + 0x10458690]
xor edi, dword [ebx*4 + 0x10458b90]
movzx ebx, byte [ecx + 5]
movzx ebx, byte [ebx + 0x10458690]
xor edi, dword [ebx*4 + 0x10458fb8]
add esi, 0x10
mov dword [esi - 0xc], edi
mov edi, dword [ecx + 8]
movzx ebx, byte [ecx + 0xb]
movzx ebx, byte [ebx + 0x10458690]
and edi, 0xff
movzx edi, byte [edi + 0x10458690]
mov edi, dword [edi*4 + 0x104593b8]
xor edi, dword [ebx*4 + 0x10458790]
movzx ebx, byte [ecx + 0xa]
movzx ebx, byte [ebx + 0x10458690]
xor edi, dword [ebx*4 + 0x10458b90]
movzx ebx, byte [ecx + 9]
movzx ebx, byte [ebx + 0x10458690]
xor edi, dword [ebx*4 + 0x10458fb8]
sub ecx, 0x10
mov dword [esi - 8], edi
mov edi, dword [ecx + 0x1c]
movzx ebx, byte [ecx + 0x1f]
movzx ebx, byte [ebx + 0x10458690]
and edi, 0xff
movzx edi, byte [edi + 0x10458690]
mov edi, dword [edi*4 + 0x104593b8]
xor edi, dword [ebx*4 + 0x10458790]
movzx ebx, byte [ecx + 0x1e]
movzx ebx, byte [ebx + 0x10458690]
xor edi, dword [ebx*4 + 0x10458b90]
movzx ebx, byte [ecx + 0x1d]
movzx ebx, byte [ebx + 0x10458690]
xor edi, dword [ebx*4 + 0x10458fb8]
mov dword [esi - 4], edi
test edx, edx
jg 0x100cb200
mov edx, dword [ecx]
mov dword [esi], edx
mov edx, dword [ecx + 4]
mov dword [esi + 4], edx
mov edx, dword [ecx + 8]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xc]
mov dword [esi + 0xc], ecx
mov ecx, 0x118
lea edx, [esp + 0x10]
lea esp, [esp]
mov byte [edx], 0
inc edx
dec ecx
jne 0x100cb370
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x100cbf10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, eax
mov eax, dword [ebp + 0x10]
test dl, 0xf
je 0x100cbf2b
mov eax, 0xffffffde
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0xc], 0
push ebx
jne 0x100cbfd4
test edx, edx
je 0x100cc0ae
mov ebx, eax
mov eax, edi
sub eax, esi
mov dword [ebp - 4], eax
lea eax, [edx - 1]
shr eax, 4
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
push esi
push ecx
mov eax, ebx
mov dword [ebp - 0x20], edx
call fcn.100cb950
mov eax, esi
add esp, 8
lea ecx, [edi + 2]
mov esi, 4
mov edx, dword [ebp - 4]
movzx edx, byte [edx + eax]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
dec esi
jne 0x100cbf81
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
sub dword [ebp - 4], 0x10
mov dword [edi], ecx
mov ecx, dword [ebp - 0x20]
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x1c]
add ebx, 0x10
dec dword [ebp - 8]
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov esi, eax
jne 0x100cbf51
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
test edx, edx
je 0x100cc0ae
mov ecx, edi
sub ecx, esi
mov dword [ebp - 8], ecx
mov ecx, edi
sub ecx, eax
mov dword [ebp - 4], ecx
lea ecx, [edx - 1]
shr ecx, 4
inc ecx
mov dword [ebp - 0x14], ecx
lea ecx, [edi + 3]
mov edx, esi
sub edx, eax
mov dword [ebp - 0xc], ecx
lea ecx, [esi + 1]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], 4
jmp 0x100cc013
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 4]
movzx ebx, byte [eax + ebx]
xor bl, byte [eax]
add eax, 4
mov byte [edx + eax - 4], bl
mov edx, dword [ebp - 8]
mov dl, byte [ecx + edx]
xor dl, byte [eax - 3]
add ecx, 4
mov byte [ecx - 4], dl
movzx ebx, byte [eax - 2]
mov edx, dword [ebp - 0xc]
xor bl, byte [edx - 1]
add edx, 4
mov byte [ecx - 3], bl
movzx ebx, byte [eax - 1]
xor bl, byte [edx - 4]
mov dword [ebp - 0xc], edx
mov byte [ecx - 2], bl
mov ebx, 1
sub dword [ebp - 0x10], ebx
jne 0x100cc010
push esi
cmp dword [ebp + 0xc], ebx
jne 0x100cc06c
mov eax, dword [ebp + 8]
push eax
mov ecx, esi
call fcn.100cb390
jmp 0x100cc077
mov ecx, dword [ebp + 8]
push ecx
mov eax, esi
call fcn.100cb950
mov edx, dword [esi]
mov dword [edi], edx
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], ecx
mov edx, dword [esi + 0xc]
mov ecx, 0x10
sub dword [ebp - 4], ecx
sub dword [ebp - 8], ecx
add eax, ecx
add esp, 8
add esi, ecx
sub dword [ebp - 0x14], ebx
mov dword [edi + 0xc], edx
mov dword [ebp + 0x10], eax
jne 0x100cbff4
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100cf690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [esi + 0x160], eax
mov dword [esi + 0x164], eax
mov dword [esi + 0x168], eax
push ebx
mov dword [esi + 0x16c], eax
push edi
lea edi, [esi + 0x160]
mov dword [esi + 0x170], eax
lea ebx, [esi + 0x170]
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [esi + 0x180], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], 0xd
mov dword [ebp - 0x24], eax
mov dword [esi + 0x140], eax
mov dword [esi + 0x144], eax
mov dword [esi + 0x148], eax
mov dword [esi + 0x14c], eax
cmp ecx, 0xc
jne 0x100cf723
mov eax, dword [edx]
mov dword [edi], eax
mov ecx, dword [edx + 4]
mov dword [edi + 4], ecx
mov edx, dword [edx + 8]
mov dword [edi + 8], edx
mov byte [esi + 0x16f], 1
jmp 0x100cf805
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ecx*8]
shr eax, 0x18
mov byte [ebp - 8], al
lea eax, [ecx*8]
shr eax, 0x10
mov byte [ebp - 7], al
lea eax, [ecx*8]
shr eax, 8
mov byte [ebp - 6], al
mov al, cl
add al, al
add al, al
add al, al
mov byte [ebp - 5], al
mov dword [ebp - 0x18], edx
test ecx, ecx
je 0x100cf7ba
jmp 0x100cf773
mov ecx, dword [ebp + 8]
cmp ecx, 0x10
jae 0x100cf77d
mov dword [ebp - 0x20], ecx
jmp 0x100cf787
mov dword [ebp - 0x20], 0x10
mov ecx, dword [ebp - 0x20]
xor eax, eax
test ecx, ecx
je 0x100cf79b
mov edx, dword [ebp - 0x18]
mov dl, byte [eax + edx]
xor byte [edi + eax], dl
inc eax
cmp eax, ecx
jb 0x100cf78d
push edi
mov ecx, edi
mov eax, esi
call fcn.100cf160
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
add dword [ebp - 0x18], ecx
sub eax, ecx
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
jne 0x100cf770
xor eax, eax
lea esp, [esp]
movzx ecx, byte [ebp + eax - 0x14]
movzx edx, byte [ebp + eax - 0x13]
xor byte [esi + eax + 0x160], cl
xor byte [esi + eax + 0x161], dl
movzx ecx, byte [ebp + eax - 0x12]
movzx edx, byte [ebp + eax - 0x11]
xor byte [esi + eax + 0x162], cl
xor byte [esi + eax + 0x163], dl
add eax, 4
cmp eax, 0x10
jb 0x100cf7c0
push edi
mov ecx, edi
mov eax, esi
call fcn.100cf160
add esp, 4
lea eax, [ebp - 0x24]
push eax
lea ecx, [esi + 0x150]
push ecx
push 0x10
push edi
push esi
call fcn.100b7f80
add esp, 0x14
test eax, eax
jne 0x100cf87d
mov ecx, dword [ebp + 0xc]
mov dword [esi + 0x148], 0xd
mov dword [esi + 0x14c], eax
mov dword [ebp - 0x18], ecx
jmp 0x100cf843
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
cmp edi, 0x10
jb 0x100cf850
mov edi, 0x10
xor eax, eax
test edi, edi
je 0x100cf861
mov dl, byte [eax + ecx]
xor byte [ebx + eax], dl
inc eax
cmp eax, edi
jb 0x100cf856
push ebx
mov ecx, ebx
mov eax, esi
call fcn.100cf160
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x18], edi
sub eax, edi
add esp, 4
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x100cf840
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x100cfa10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
mov eax, dword [esi + 0x140]
mov ebx, dword [esi + 0x14c]
push edi
mov edi, dword [esi + 0x144]
shld edi, eax, 3
add eax, eax
add eax, eax
add eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0x148]
shld ebx, eax, 3
add eax, eax
add eax, eax
add eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
lea edx, [eax - 4]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], ebx
cmp edx, 0xc
ja 0x100cfbb5
push eax
lea eax, [esi + 0x150]
push eax
push ecx
call sub.MSVCR100.dll_memcpy
mov ecx, dword [ebp - 0x28]
mov edx, ecx
add esp, 0xc
or edx, edi
jne 0x100cfa94
mov eax, dword [ebp - 0x20]
or eax, ebx
je 0x100cfba2
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov edx, ebx
shr edx, 0x18
mov byte [ebp - 0x14], dl
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0x1c]
mov byte [ebp - 0x11], al
mov edx, ebx
shr edx, 8
mov byte [ebp - 0x12], dl
mov edx, dword [ebp - 0x20]
mov eax, ebx
shrd edx, eax, 0x18
shr eax, 0x18
mov byte [ebp - 0x10], dl
mov edx, dword [ebp - 0x20]
mov eax, ebx
shrd edx, eax, 0x10
shr eax, 0x10
mov eax, dword [ebp - 0x20]
mov byte [ebp - 0xf], dl
mov edx, eax
shrd edx, ebx, 8
mov byte [ebp - 0xd], al
mov byte [ebp - 0xe], dl
mov eax, edi
shr eax, 0x18
mov byte [ebp - 0xc], al
mov edx, edi
shr edx, 0x10
mov byte [ebp - 0xb], dl
mov dl, byte [ebp - 0x24]
mov eax, edi
shr eax, 8
mov byte [ebp - 0xa], al
mov byte [ebp - 9], dl
mov edx, edi
mov eax, ecx
shrd eax, edx, 0x18
mov byte [ebp - 8], al
shr edx, 0x18
mov edx, edi
mov eax, ecx
shrd eax, edx, 0x10
mov byte [ebp - 7], al
mov eax, ecx
shrd eax, edi, 8
shr ebx, 8
shr edx, 0x10
shr edi, 8
mov byte [ebp - 6], al
mov byte [ebp - 5], cl
xor eax, eax
jmp 0x100cfb40
movzx ecx, byte [ebp + eax - 0x14]
movzx edx, byte [ebp + eax - 0x13]
xor byte [esi + eax + 0x170], cl
xor byte [esi + eax + 0x171], dl
movzx ecx, byte [ebp + eax - 0x12]
movzx edx, byte [ebp + eax - 0x11]
xor byte [esi + eax + 0x172], cl
xor byte [esi + eax + 0x173], dl
add eax, 4
cmp eax, 0x10
jb 0x100cfb40
lea edi, [esi + 0x170]
push edi
mov ecx, edi
mov eax, esi
call fcn.100cf160
mov esi, dword [ebp + 8]
add esp, 4
xor eax, eax
test esi, esi
je 0x100cfba2
mov dl, byte [edi + eax]
mov ecx, dword [ebp - 0x2c]
xor byte [ecx + eax], dl
inc eax
cmp eax, esi
jb 0x100cfb94
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0xffffffec
pop ebx
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
Function at 0x100cfbd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10415990]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], ecx
push eax
xor ecx, ecx
call fcn.100cf690
add esp, 8
test eax, eax
jne 0x100cfc81
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 0xc]
push ecx
push edi
push edx
call fcn.100cf890
add esp, 0xc
test eax, eax
jne 0x100cfc81
push ebx
lea ecx, [ebp - 0x18]
mov edx, esi
call fcn.100cfa10
add esp, 4
test eax, eax
jne 0x100cfc81
xor edx, edx
test ebx, ebx
je 0x100cfc7f
mov esi, dword [ebp + 0x18]
lea ecx, [ebp - 0x18]
sub esi, ecx
lea ebx, [ebx]
lea ecx, [ebp + eax - 0x18]
movzx edi, byte [esi + ecx]
movzx ecx, byte [ecx]
xor edi, ecx
inc eax
or edx, edi
cmp eax, ebx
jb 0x100cfc40
test edx, edx
je 0x100cfc7f
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
test eax, eax
je 0x100cfc69
mov byte [ecx], 0
inc ecx
dec eax
jne 0x100cfc62
mov eax, 0xffffffee
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1015eea7
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1015eea7
mov esp, ebp
pop ebp
ret