joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001220
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1005f040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xb
mov ebx, ecx
lea edi, [ebp - 0x34]
pop ecx
mov esi, str._pipediscord_ipc_0
rep movsd dword es:[edi], dword [esi]
push 0x30
pop eax
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor edi, edi
mov word [ebp - 0xa], ax
jmp 0x1000128c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10001272
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0x100012b9
inc ax
mov word [ebp - 0xa], ax
jmp 0x1000128c
cmp eax, 0xe7
jne 0x100012b9
push 0x2710
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x100012b9
push edi
push edi
push 3
push edi
push edi
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call esi
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x10001255
mov byte [ebx], 1
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004cba5
leave
ret
xor al, al
jmp 0x100012aa

Function at 0x10001415
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [ebp - 4], edi
mov eax, esi
test edx, edx
je 0x1000144a
cmp word [edx], di
je 0x1000144a
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push edx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10001473
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 1
push edi
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
mov edi, eax
test ecx, ecx
je 0x10001471
cmp ecx, esi
je 0x10001471
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x10001684
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ebx, ebx
mov dword [0x100d5a70], 0xea60
push esi
mov eax, 0x1f4
mov dword [0x100d5a6c], ebx
push edi
push ebx
mov dword [0x100d5a68], eax
mov dword [0x100d5a74], ebx
mov dword [0x100d5a78], eax
mov dword [0x100d5a7c], ebx
mov dword [0x100d5a80], ebx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov esi, eax
mov dword [0x100d5a94], edx
mov eax, 0x55555555
mov dword [0x100d5a90], esi
xor edi, edi
mov dword [0x100d6e10], eax
pop ecx
mov dword [0x100d6e14], eax
inc edi
push 0x5851f42d
mov ecx, edx
xor eax, eax
push 0x4c957f2d
shr ecx, 0x1e
xor eax, edx
xor ecx, esi
push eax
push ecx
call fcn.10050920
mov esi, eax
mov eax, 0x138
add esi, edi
mov dword [edi*8 + 0x100d5a90], esi
adc edx, ebx
mov dword [edi*8 + 0x100d5a94], edx
inc edi
cmp edi, eax
jb 0x100016e2
movaps xmm0, xmmword [0x1005a260]
pop edi
pop esi
mov dword [0x100d5a88], eax
mov eax, 0x100d5a68
movups xmmword [0x100d6e18], xmm0
pop ebx
ret 0x10
Function at 0x100019f9
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x10050e39
call fcn.1005062b
mov esi, dword [0x100f7e9c]
xor edi, edi
mov al, 1
xchg byte [esi], al
push 4
call fcn.1004cbb3
mov dword [ebp - 0x10], eax
mov dword [eax], esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], edi
push ecx
push edi
push eax
push 0x10002dff
push edi
push edi
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x1c
mov dword [ebp - 0x18], ecx
test ecx, ecx
je 0x10001a59
cmp dword [esi + 0x60], edi
je 0x10001a4a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call fcn.10050608
ret
push 6
mov dword [ebp - 0x14], edi
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x100021e2
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 6], 0
je 0x10002200
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x6c]
xor byte [ecx], al
inc ebx
cmp ebx, 5
jb 0x100021ed
pop ebx
mov byte [edx + 6], 0
mov eax, edx
ret

Function at 0x10002203
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 5], 0
je 0x10002221
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x6c]
xor byte [ecx], al
inc ebx
cmp ebx, 4
jb 0x1000220e
pop ebx
mov byte [edx + 5], 0
mov eax, edx
ret

Function at 0x10002224
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 8], 0
je 0x10002242
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x6c]
xor byte [ecx], al
inc ebx
cmp ebx, 7
jb 0x1000222f
pop ebx
mov byte [edx + 8], 0
mov eax, edx
ret

Function at 0x10002245
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xe], 0
je 0x10002263
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x6c]
xor byte [ecx], al
inc ebx
cmp ebx, 0xd
jb 0x10002250
pop ebx
mov byte [edx + 0xe], 0
mov eax, edx
ret

Function at 0x10002266
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 7], 0
je 0x10002284
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x6c]
xor byte [ecx], al
inc ebx
cmp ebx, 6
jb 0x10002271
pop ebx
mov byte [edx + 7], 0
mov eax, edx
ret

Function at 0x10002287
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x12], 0
je 0x100022a5
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x6c]
xor byte [ecx], al
inc ebx
cmp ebx, 0x11
jb 0x10002292
pop ebx
mov byte [edx + 0x12], 0
mov eax, edx
ret

Function at 0x100022a8
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x16], 0
je 0x100022c6
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x6c]
xor byte [ecx], al
inc ebx
cmp ebx, 0x15
jb 0x100022b3
pop ebx
mov byte [edx + 0x16], 0
mov eax, edx
ret

Function at 0x100022c9
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 3], 0
je 0x100022e7
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x6c]
xor byte [ecx], al
inc ebx
cmp ebx, 2
jb 0x100022d4
pop ebx
mov byte [edx + 3], 0
mov eax, edx
ret

Function at 0x100022ea
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 9], 0
je 0x10002308
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x6c]
xor byte [ecx], al
inc ebx
cmp ebx, 8
jb 0x100022f5
pop ebx
mov byte [edx + 9], 0
mov eax, edx
ret
Function at 0x100027a7
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x1005f040]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov ecx, 0x100d5a34
call fcn.1000199e
cmp dword [0x1010841c], 0
jne 0x10002810
cmp dword [0x10108204], 0
je 0x1000284d
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x263a2e2d
mov dword [esp + 0x10], 0x2a263826
mov dword [esp + 0x14], 0x3e393f2b
mov word [esp + 0x18], 0x36
mov byte [esp + 0x1a], 1
call fcn.10002245
mov ecx, eax
call fcn.10002336
jmp 0x1000284d
cmp dword [0x10108204], 0
jne 0x1000284d
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x263a2e2d
mov dword [esp + 0x10], 0x2a263826
mov dword [esp + 0x14], 0x3e393f2b
mov word [esp + 0x18], 0x36
mov byte [esp + 0x1a], 1
call fcn.10002245
mov ecx, eax
call fcn.10002377
cmp dword [0x10108420], 0
jne 0x10002889
cmp dword [0x10108208], 0
je 0x100028ba
movaps xmm0, xmmword [0x1005a0e0]
lea ecx, [esp + 0xc]
movups xmmword [esp + 0xc], xmm0
mov word [esp + 0x1c], 0x39
mov byte [esp + 0x1e], 1
call fcn.10002287
mov ecx, eax
call fcn.10002336
jmp 0x100028ba
cmp dword [0x10108208], 0
jne 0x100028ba
movaps xmm0, xmmword [0x1005a0e0]
lea ecx, [esp + 0xc]
movups xmmword [esp + 0xc], xmm0
mov word [esp + 0x1c], 0x39
mov byte [esp + 0x1e], 1
call fcn.10002287
mov ecx, eax
call fcn.10002377
cmp dword [0x10108424], 0
jne 0x100028fe
cmp dword [0x1010820c], 0
je 0x10002937
movaps xmm0, xmmword [0x1005a180]
lea ecx, [esp + 0xc]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], 0x2c3b282d
mov word [esp + 0x20], 0xd4
mov byte [esp + 0x22], 1
call fcn.100022a8
mov ecx, eax
call fcn.10002336
jmp 0x10002937
cmp dword [0x1010820c], 0
jne 0x10002937
movaps xmm0, xmmword [0x1005a180]
lea ecx, [esp + 0xc]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 0x1c], 0x2c3b282d
mov word [esp + 0x20], 0xd4
mov byte [esp + 0x22], 1
call fcn.100022a8
mov ecx, eax
call fcn.10002377
push 6
pop ecx
mov esi, 0x101081f8
mov edi, 0x10108410
rep movsd dword es:[edi], dword [esi]
push 0x100d5a34
call dword [sym.imp.MSVCP140.dll__Mtx_unlock]
pop ecx
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1004cba5
mov esp, ebp
pop ebp
ret

Function at 0x10002964
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0x10002981
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x6c]
xor byte [ecx], al
inc edx
cmp edx, 8
jb 0x1000296f
mov byte [esi + 9], 0
pop esi
ret

Function at 0x10002983
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x100029a0
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x6c]
xor byte [ecx], al
inc edx
cmp edx, 0x15
jb 0x1000298e
mov byte [esi + 0x16], 0
pop esi
ret

Function at 0x100029a2
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x12], 0
je 0x100029bf
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x6c]
xor byte [ecx], al
inc edx
cmp edx, 0x11
jb 0x100029ad
mov byte [esi + 0x12], 0
pop esi
ret
Function at 0x100029c1
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 7], 0
je 0x100029de
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x6c]
xor byte [ecx], al
inc edx
cmp edx, 6
jb 0x100029cc
mov byte [esi + 7], 0
pop esi
ret

Function at 0x100029e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xe], 0
je 0x100029fd
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x6c]
xor byte [ecx], al
inc edx
cmp edx, 0xd
jb 0x100029eb
mov byte [esi + 0xe], 0
pop esi
ret

Function at 0x100029ff
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x10002a1c
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x6c]
xor byte [ecx], al
inc edx
cmp edx, 7
jb 0x10002a0a
mov byte [esi + 8], 0
pop esi
ret

Function at 0x10002a1e
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x10002a3b
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x6c]
xor byte [ecx], al
inc edx
cmp edx, 4
jb 0x10002a29
mov byte [esi + 5], 0
pop esi
ret

Function at 0x10002a3d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 6], 0
je 0x10002a5a
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x6c]
xor byte [ecx], al
inc edx
cmp edx, 5
jb 0x10002a48
mov byte [esi + 6], 0
pop esi
ret

Function at 0x100035d4
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xc], 0
je 0x100035f2
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x6d]
xor byte [ecx], al
inc ebx
cmp ebx, 0xb
jb 0x100035df
pop ebx
mov byte [edx + 0xc], 0
mov eax, edx
ret

Function at 0x100035f5
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
je 0x10003612
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x6d]
xor byte [ecx], al
inc edx
cmp edx, 0xb
jb 0x10003600
mov byte [esi + 0xc], 0
pop esi
ret
Function at 0x1000534c
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xd], 0
je 0x1000536a
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x6e]
xor byte [ecx], al
inc ebx
cmp ebx, 0xc
jb 0x10005357
pop ebx
mov byte [edx + 0xd], 0
mov eax, edx
ret

Function at 0x10005432
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x854
mov eax, 0x10051025
call fcn.1005065e
mov edi, dword [ebp + 0xc]
push 0x4000
push ecx
lea ecx, [ebp - 0x85c]
call fcn.10004dd3
and dword [ebp - 4], 0
lea eax, [ebp - 0x85c]
mov ecx, eax
mov dword [ebp - 0x860], eax
call fcn.10005717
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x85c]
call fcn.10004e57
mov edx, 0x100535b4
lea ecx, [ebp - 0x85c]
call fcn.10005aed
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x22323a3d
mov dword [ebp - 0x1c], 0x373d2131
mov word [ebp - 0x18], 0x33
mov byte [ebp - 0x16], 1
call fcn.1000553b
mov ebx, eax
mov esi, ebx
lea eax, [esi + 1]
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x100054b1
push ecx
lea ecx, [ebp - 0x85c]
sub esi, eax
call fcn.10005846
push esi
push ebx
lea ecx, [ebp - 0x85c]
call fcn.1000591d
mov edx, 0x10053594
lea ecx, [ebp - 0x85c]
call fcn.10005aed
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x100054e8
sub esi, ecx
push ecx
lea ecx, [ebp - 0x85c]
call fcn.10005846
push esi
push edi
lea ecx, [ebp - 0x85c]
call fcn.1000591d
lea ecx, [ebp - 0x860]
call fcn.10004e29
mov esi, dword [ebp - 0x830]
sub esi, dword [ebp - 0x838]
push 0x808
push dword [ebp - 0x854]
call fcn.1004cf52
pop ecx
pop ecx
mov eax, esi
call fcn.1005061c
ret

Function at 0x1000553b
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xa], 0
je 0x10005559
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x6e]
xor byte [ecx], al
inc ebx
cmp ebx, 9
jb 0x10005546
pop ebx
mov byte [edx + 0xa], 0
mov eax, edx
ret

Function at 0x10005666
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x1a], 0
je 0x10005684
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x6e]
xor byte [ecx], al
inc ebx
cmp ebx, 0x19
jb 0x10005671
pop ebx
mov byte [edx + 0x1a], 0
mov eax, edx
ret

Function at 0x10005687
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a], 0
je 0x100056a4
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x6e]
xor byte [ecx], al
inc edx
cmp edx, 0x19
jb 0x10005692
mov byte [esi + 0x1a], 0
pop esi
ret

Function at 0x100056a6
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x100056c3
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x6e]
xor byte [ecx], al
inc edx
cmp edx, 9
jb 0x100056b1
mov byte [esi + 0xa], 0
pop esi
ret

Function at 0x100056c5
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x100056e2
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx + 0x6e]
xor byte [ecx], al
inc edx
cmp edx, 0xc
jb 0x100056d0
mov byte [esi + 0xd], 0
pop esi
ret
Function at 0x1000b1da
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x168
mov eax, dword [0x1005f040]
xor eax, esp
mov dword [esp + 0x164], eax
mov dword [esp + 8], ecx
mov ecx, dword [0x100d59a0]
push esi
push edi
mov eax, dword [ecx]
call dword [eax + 0xec]
mov ecx, eax
mov dword [esp + 0xc], eax
call fcn.10009f45
test eax, eax
je 0x1000b393
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov dword [esp + 8], ecx
cmp dword [eax + 0x17c], ecx
jbe 0x1000b393
mov eax, dword [eax + 0x174]
mov esi, dword [eax + ecx*4]
mov ecx, esi
mov dword [esp + 0x14], esi
call fcn.10009f45
test eax, eax
je 0x1000b37a
mov ecx, dword [esi + 0x10]
call fcn.10009f45
test eax, eax
je 0x1000b37a
mov esi, dword [esi + 0x10]
lea edi, [esp + 0x28]
add esi, 0x10
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1000a31e
test al, al
je 0x1000b37a
cvttss2si eax, dword [esp + 0x20]
sub eax, 0xf
cmp dword [esp + 0x10], 1
mov dword [esp + 0x18], eax
jne 0x1000b37a
mov esi, dword [esp + 0x14]
lea edi, [esp + 0x40]
mov eax, dword [0x100d59fc]
mov esi, dword [esi + 0x10]
add esi, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [eax + 0x13c]
lea edi, [esp + 0x34]
add esi, 0x10
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movss xmm1, dword [esp + 0x38]
movss xmm2, dword [esp + 0x34]
subss xmm2, dword [esp + 0x40]
subss xmm1, dword [esp + 0x44]
movss xmm0, dword [esp + 0x3c]
subss xmm0, dword [esp + 0x48]
mulss xmm2, xmm2
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm2, xmm1
addss xmm2, xmm0
cvtps2pd xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sqrt_precise
cvtsd2ss xmm0, xmm0
push 0x41
pop ecx
xor edx, edx
divss xmm0, dword [0x10059844]
cvtss2sd xmm0, xmm0
mov al, byte [edx + 0x100547a4]
xor al, cl
inc ecx
mov byte [esp + edx + 0x4c], al
and ecx, 0x800000ff
jns 0x1000b32f
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0x1a
jl 0x1000b312
push ecx
push ecx
movsd qword [esp], xmm0
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x74]
mov byte [esp + 0x72], 0
push eax
call fcn.10008821
lea eax, [esp + 0x78]
push eax
cvttss2si eax, dword [esp + 0x30]
push 0x101
push 0xff800080
push dword [esp + 0x34]
push eax
push dword [0x100d59f4]
push 1
call fcn.10009dc0
add esp, 0x2c
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
inc ecx
mov dword [esp + 8], ecx
cmp ecx, dword [eax + 0x17c]
jb 0x1000b231
mov ecx, dword [esp + 0x16c]
pop edi
pop esi
xor ecx, esp
call fcn.1004cba5
mov esp, ebp
pop ebp
ret
Function at 0x1000edeb
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x14], 0
je 0x1000ee09
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x6f]
xor byte [ecx], al
inc ebx
cmp ebx, 0x13
jb 0x1000edf6
pop ebx
mov byte [edx + 0x14], 0
mov eax, edx
ret

Function at 0x1000ee69
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x13], 0
je 0x1000ee87
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x6f]
xor byte [ecx], al
inc ebx
cmp ebx, 0x12
jb 0x1000ee74
pop ebx
mov byte [edx + 0x13], 0
mov eax, edx
ret

Function at 0x1000ee8a
Capabilities:
Get disk information

Disassembly:
push 0x40
mov eax, 0x100516bc
call fcn.1005065e
mov ebx, ecx
mov dword [ebp - 0x44], ebx
and dword [ebp - 4], 0
mov dword [ebp - 0x4c], ebx
and dword [ebp - 0x48], 0
push 0x10053593
call fcn.10007a7e
xor ecx, ecx
lea eax, [ebp - 0x44]
push ecx
push ecx
push ecx
push ecx
push eax
push ecx
push ecx
mov dword [ebp - 4], ecx
push 0x1005494c
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], ecx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x13]
xor edx, edx
dec ecx
push 0xa
pop esi
div esi
add dl, 0x30
mov byte [ecx], dl
test eax, eax
jne 0x1000eeda
lea edi, [ebp - 0x40]
stosd dword es:[edi], eax
push 0xf
pop esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x13]
and dword [ebp - 0x30], 0
and dword [ebp - 0x2c], 0
cmp ecx, eax
jne 0x1000ef0f
mov edx, esi
mov byte [ebp - 0x40], 0
mov dword [ebp - 0x2c], edx
jmp 0x1000ef21
lea eax, [ebp - 0x13]
sub eax, ecx
push eax
push ecx
lea ecx, [ebp - 0x40]
call fcn.10007eac
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x40]
cmp ebx, eax
je 0x1000ef53
mov edx, dword [ebx + 0x14]
cmp edx, esi
jbe 0x1000ef37
mov ecx, dword [ebx]
inc edx
call fcn.1000806a
push 6
xor eax, eax
mov dword [ebx + 0x14], esi
pop ecx
lea esi, [ebp - 0x40]
mov dword [ebx + 0x10], eax
mov edi, ebx
mov byte [ebx], al
rep movsd dword es:[edi], dword [esi]
push 0xf
pop esi
mov edx, esi
mov byte [ebp - 0x40], al
cmp edx, esi
jbe 0x1000ef60
mov ecx, dword [ebp - 0x40]
inc edx
call fcn.1000806a
mov eax, ebx
call fcn.1005061c
ret
Function at 0x1000fd3d
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xb], 0
je 0x1000fd5b
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x6f]
xor byte [ecx], al
inc ebx
cmp ebx, 0xa
jb 0x1000fd48
pop ebx
mov byte [edx + 0xb], 0
mov eax, edx
ret
Function at 0x1001462b
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x11], 0
je 0x10014649
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x6f]
xor byte [ecx], al
inc ebx
cmp ebx, 0x10
jb 0x10014636
pop ebx
mov byte [edx + 0x11], 0
mov eax, edx
ret

Function at 0x1001464c
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xf], 0
je 0x1001466a
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x6f]
xor byte [ecx], al
inc ebx
cmp ebx, 0xe
jb 0x10014657
pop ebx
mov byte [edx + 0xf], 0
mov eax, edx
ret

Function at 0x1001466d
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x1b], 0
je 0x1001468b
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x6f]
xor byte [ecx], al
inc ebx
cmp ebx, 0x1a
jb 0x10014678
pop ebx
mov byte [edx + 0x1b], 0
mov eax, edx
ret

Function at 0x1001468e
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x18], 0
je 0x100146ac
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx + 0x6f]
xor byte [ecx], al
inc ebx
cmp ebx, 0x17
jb 0x10014699
pop ebx
mov byte [edx + 0x18], 0
mov eax, edx
ret
Function at 0x1001add8
Capabilities:
Encode data using xor

Disassembly:
push 0x34
mov eax, 0x10051f60
call fcn.1005065e
cmp byte [0x100604a0], 0
je 0x1001af9c
movaps xmm0, xmmword [0x10059e90]
lea ecx, [ebp - 0x34]
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0x100a11b
xor ebx, ebx
call fcn.1000ee69
push eax
call fcn.1002d52f
pop ecx
mov ecx, 0x98
mov edx, ebx
mov al, byte [edx + 0x10054e60]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001ae38
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xb
jl 0x1001ae1b
mov byte [ebp - 0x11], bl
sub esp, 0xc
mov dword [ebp - 4], ebx
mov edx, 0x100604a4
lea ecx, [ebp - 0x1c]
call fcn.10033efa
movaps xmm0, xmmword [0x1005a600]
add esp, 0xc
movups xmmword [ebp - 0x40], xmm0
mov ecx, ebx
mov byte [ebp - 0x20], 1
movaps xmm0, xmmword [0x10059b60]
movups xmmword [ebp - 0x30], xmm0
lea eax, [ecx + 0x6f]
xor byte [ebp + ecx - 0x40], al
inc ecx
cmp ecx, 0x1f
jb 0x1001ae73
push 5
mov byte [ebp - 0x20], bl
mov edx, ebx
pop ecx
mov al, byte [edx + str._OX_Bjof]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001aea5
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 9
jl 0x1001ae88
mov byte [ebp - 0x13], bl
push ecx
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 1
push eax
mov edx, 0x100604a8
lea ecx, [ebp - 0x1c]
call fcn.100345b8
pop ecx
pop ecx
mov ecx, 0xfb
mov edx, ebx
mov al, byte [edx + 0x10054e78]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001aeed
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 8
jl 0x1001aed0
mov byte [ebp - 0x14], bl
sub esp, 0xc
mov dword [ebp - 4], 2
mov edx, 0x100604b0
lea ecx, [ebp - 0x1c]
call fcn.10033efa
add esp, 0xc
mov ecx, 0xde
mov edx, ebx
mov al, byte [edx + 0x10054e84]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001af34
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 8
jl 0x1001af17
mov byte [ebp - 0x14], bl
sub esp, 0xc
mov dword [ebp - 4], 3
mov edx, 0x100604b8
lea ecx, [ebp - 0x1c]
call fcn.10033efa
add esp, 0xc
mov edx, ebx
push 0x50
pop ecx
mov al, byte [edx + 0x10054e90]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x1c], al
and ecx, 0x800000ff
jns 0x1001af79
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xa
jl 0x1001af5c
mov byte [ebp - 0x12], bl
sub esp, 0xc
mov dword [ebp - 4], 4
mov edx, 0x100604ac
lea ecx, [ebp - 0x1c]
call fcn.10033efa
add esp, 0xc
call fcn.1005061c
ret