joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007da7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c5e9a], 0
jne 0x10007e19
push ebx
xor ebx, ebx
inc ebx
mov dword [ebp - 0x10], 0xa070c28
mov word [ebp - 0xc], 0x1b3d
mov byte [ebp - 0xa], bl
mov dword [ebp - 9], 0x140d05
xor ecx, ecx
mov al, byte [ecx + 0x100bf198]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100bf7af], al
cmp ecx, 0xa
jl 0x10007ddd
mov byte [0x100c5e9a], bl
call fcn.1000413e
test al, al
jne 0x10007e18
mov ecx, ebx
mov edx, 0xcd
dec edx
lea eax, [ecx + ebx]
lea ebx, [ecx]
mov ecx, eax
jns 0x10007e09
mov dword [0x100c57c0], eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf7b0
call fcn.1006dcab
leave
ret

Function at 0x10007e2a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c5e74], 0
jne 0x10007e93
call fcn.10004044
test al, al
jne 0x10007e5c
push 4
call fcn.1006cded
pop ecx
mov ecx, dword [0x100c57c0]
mov dword [eax], ecx
xor ecx, ecx
mov dword [ebp - 0x14], 0x1f04060e
mov dword [ebp - 0x10], 0x11c0102
mov dword [ebp - 0xc], 0x161f061e
mov byte [ebp - 8], cl
mov al, byte [ecx + 0x100bf198]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100bf5a7], al
cmp ecx, 0xc
jl 0x10007e76
mov byte [0x100c5e74], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf5a8
call fcn.1006dcab
leave
ret

Function at 0x10007ea4
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [0x100c57c0]
lea eax, [edx + 1]
imul eax, edx
and eax, 0x8000000f
jns 0x10007ecf
dec eax
or eax, 0xfffffff0
inc eax
xor ecx, ecx
cmp eax, 0xf
jne 0x10007ef8
push esi
mov esi, ecx
mov eax, dword [ebp + esi*4 - 0xe0]
imul eax, eax, 0xdf
add edx, eax
inc esi
cmp esi, 0xcc
jb 0x10007ed9
mov dword [0x100c57c0], edx
pop esi
cmp byte [0x100c5e36], cl
jne 0x10007f3b
mov dword [ebp - 0x14], 0x100c0f09
mov dword [ebp - 0x10], 0x411d4f1a
mov dword [ebp - 0xc], 0x181f0603
mov word [ebp - 8], 0x4640
mov byte [ebp - 6], cl
mov al, byte [ecx + 0x100bf198]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100bf273], al
cmp ecx, 0xe
jl 0x10007f1e
mov byte [0x100c5e36], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf274
call fcn.1006dcab
leave
ret

Function at 0x10007f4c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c5e39], 0
jne 0x10007fa2
xor ecx, ecx
mov dword [ebp - 0x14], 0x100c0f09
mov dword [ebp - 0x10], 0x411d4f1a
mov dword [ebp - 0xc], 0x181f0603
mov word [ebp - 8], 0x4140
mov byte [ebp - 6], cl
mov al, byte [ecx + 0x100bf198]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100bf29f], al
cmp ecx, 0xe
jl 0x10007f85
mov byte [0x100c5e39], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf2a0
call fcn.1006dcab
leave
ret
Function at 0x10007fb3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10003e3a
cmp byte [0x100c5e8b], 0
jne 0x10008008
xor ecx, ecx
mov dword [ebp - 0x14], 0x100c0f09
mov dword [ebp - 0x10], 0x411d4f1a
mov dword [ebp - 0xc], 0x181f0603
mov byte [ebp - 8], cl
mov al, byte [ecx + 0x100bf198]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100bf6e7], al
cmp ecx, 0xc
jl 0x10007feb
mov byte [0x100c5e8b], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf6e8
call fcn.1006dcab
leave
ret

Function at 0x10008019
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c5e75], 0
jne 0x1000806c
mov dword [ebp - 0x14], 0x7110608
mov dword [ebp - 0x10], 0x12c1014
mov dword [ebp - 0xc], 0x1a06150f
mov word [ebp - 8], 0x19
xor ecx, ecx
mov al, byte [ecx + 0x100bf198]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100bf5b7], al
cmp ecx, 0xd
jl 0x1000804f
mov byte [0x100c5e75], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf5b8
call fcn.1006dcab
leave
ret

Function at 0x1000807d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x100c57c0]
mov eax, esi
imul eax, esi
push edi
push 0x12
cdq
pop ecx
idiv ecx
xor ebx, ebx
cmp edx, 6
jne 0x100080dd
push 0x28
call fcn.1006cc68
pop ecx
mov edi, eax
mov esi, ebx
call fcn.1006e318
add eax, dword [0x100c57c0]
mov dword [edi + esi*4], eax
inc esi
cmp esi, 0xa
jl 0x100080b4
mov eax, dword [edi + 0x24]
push edi
mov dword [0x100c57c0], eax
call fcn.1006e46d
mov esi, dword [0x100c57c0]
pop ecx
call fcn.10004086
test al, al
jne 0x10008140
mov eax, esi
cdq
sub eax, edx
mov edi, eax
mov dword [ebp - 0x14], 0x69
mov eax, dword [ebp - 0x14]
mov ecx, ebx
sar edi, 1
test edi, edi
jle 0x1000813b
mov eax, esi
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [ebp - 0x18], eax
mov edx, ebx
mov esi, edi
mov dword [ebp - 0x1c], edi
test eax, eax
jle 0x1000812a
mov esi, dword [ebp - 0x18]
mov eax, edx
add dword [ebp - 0x14], eax
dec eax
dec esi
jne 0x1000811d
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
add edx, ecx
dec esi
mov dword [ebp - 0x1c], esi
jne 0x10008114
mov esi, dword [0x100c57c0]
mov eax, dword [ebp - 0x14]
inc ecx
cmp ecx, eax
jl 0x100080fb
cmp byte [0x100c5e30], bl
jne 0x1000817a
mov dword [ebp - 0x10], 0x7160608
mov dword [ebp - 0xc], 0x1e120f2e
mov dword [ebp - 8], 0x190e05
mov al, byte [ebx + 0x100bf198]
xor al, byte [ebp + ebx - 0x10]
inc ebx
mov byte [ebx + 0x100bf227], al
cmp ebx, 0xb
jl 0x1000815d
mov byte [0x100c5e30], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0x100bf228
pop ebx
call fcn.1006dcab
leave
ret
Function at 0x1000818e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c5e2f], 0
jne 0x10008207
push ebx
xor ebx, ebx
inc ebx
xor ecx, ecx
mov word [ebp - 0xc], 0x2f08
mov byte [ebp - 0xa], 0x1c
mov byte [ebp - 9], bl
mov byte [ebp - 8], 0x18
mov byte [ebp - 7], bl
mov word [ebp - 6], cx
mov al, byte [ecx + 0x100bf198]
xor al, byte [ebp + ecx - 0xc]
inc ecx
mov byte [ecx + 0x100bf21f], al
cmp ecx, 7
jl 0x100081c5
mov byte [0x100c5e2f], bl
call fcn.100040aa
test al, al
jne 0x10008206
mov ecx, dword [0x100c57c0]
cmp ecx, ebx
jle 0x10008200
mov eax, ecx
cdq
idiv ebx
inc ebx
add ebx, edx
cmp ebx, ecx
jl 0x100081f4
mov dword [0x100c57c0], ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf220
call fcn.1006dcab
leave
ret

Function at 0x10008218
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c5e82], 0
jne 0x10008264
mov dword [ebp - 0x10], 0x1f01070b
mov dword [ebp - 0xc], 0xf1a1008
mov word [ebp - 8], 0x1d
xor ecx, ecx
mov al, byte [ecx + 0x100bf198]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100bf663], al
cmp ecx, 9
jl 0x10008247
mov byte [0x100c5e82], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf664
call fcn.1006dcab
leave
ret

Function at 0x10008275
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x540
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c5ea5], 0
jne 0x1000834b
mov ecx, dword [0x100c57c0]
push ebx
lea eax, [ecx + 1]
imul eax, ecx
push 0x12
cdq
pop ecx
idiv ecx
xor ebx, ebx
mov dword [ebp - 0x10], 0x5e01070b
mov dword [ebp - 0xc], 0x5011b1d
mov word [ebp - 8], 0x140d
mov byte [ebp - 6], bl
cmp edx, 5
jne 0x1000832d
push esi
push edi
mov esi, ebx
mov edi, 0xa6
call fcn.1006e318
movd xmm0, eax
cvtdq2pd xmm0, xmm0
inc esi
movsd qword [ebp + esi*8 - 0x548], xmm0
cmp esi, edi
jb 0x100082cf
mov eax, ebx
mov edx, 0xa5
mov ecx, edx
cmp eax, edx
jge 0x10008326
movsd xmm0, qword [ebp + ecx*8 - 0x540]
movsd xmm1, qword [ebp + ecx*8 - 0x548]
comisd xmm0, xmm1
jbe 0x10008321
movsd qword [ebp + ecx*8 - 0x540], xmm1
movsd qword [ebp + ecx*8 - 0x548], xmm0
dec ecx
cmp ecx, eax
jg 0x100082f7
inc eax
cmp eax, edi
jl 0x100082f1
pop edi
pop esi
mov al, byte [ebx + 0x100bf198]
xor al, byte [ebp + ebx - 0x10]
inc ebx
mov byte [ebx + 0x100bf84b], al
cmp ebx, 0xa
jl 0x1000832d
mov byte [0x100c5ea5], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf84c
call fcn.1006dcab
leave
ret
Function at 0x1000835c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c5e85], 0
jne 0x100083db
push ebx
mov dword [ebp - 0x10], 0x3f100c33
mov dword [ebp - 0xc], 0xf1a1008
mov word [ebp - 8], 0x1d
xor ebx, ebx
call fcn.10003fad
test al, al
jne 0x100083bd
mov eax, dword [0x100c57c0]
mov ecx, eax
sub ecx, ebx
je 0x100083b3
dec ecx
je 0x100083ab
inc eax
mov dword [0x100c57c0], eax
jmp 0x100083bd
mov dword [0x100c57c0], ebx
jmp 0x100083bd
mov dword [0x100c57c0], 2
mov al, byte [ebx + 0x100bf198]
xor al, byte [ebp + ebx - 0x10]
inc ebx
mov byte [ebx + 0x100bf68f], al
cmp ebx, 9
jl 0x100083bd
mov byte [0x100c5e85], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf690
call fcn.1006dcab
leave
ret

Function at 0x100083ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c5ea1], 0
jne 0x10008435
xor ecx, ecx
mov dword [ebp - 0x10], 0x1d040b29
mov dword [ebp - 0xc], 0x293e0716
mov byte [ebp - 8], cl
mov al, byte [ecx + 0x100bf198]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100bf817], al
cmp ecx, 8
jl 0x10008418
mov byte [0x100c5ea1], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf818
call fcn.1006dcab
leave
ret

Function at 0x10008446
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c5e7c], 0
jne 0x10008492
mov dword [ebp - 0x10], 0x122e3733
mov dword [ebp - 0xc], 0x71c0303
mov word [ebp - 8], 0xb
xor ecx, ecx
mov al, byte [ecx + 0x100bf198]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100bf60f], al
cmp ecx, 9
jl 0x10008475
mov byte [0x100c5e7c], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf610
call fcn.1006dcab
leave
ret
Function at 0x100084a3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x100c57c0]
mov eax, esi
imul eax, esi
imul eax, esi
push 0xc
cdq
pop ecx
idiv ecx
push 0xa
pop eax
xor ebx, ebx
cmp edx, eax
jne 0x100084f0
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [0x1008b0ac]
push ebx
push ebx
call dword [0x1008b0b0]
mov esi, dword [0x100c57c0]
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
push edi
push 6
cdq
pop edi
idiv edi
cmp edx, 5
jne 0x10008518
mov edi, ebx
mov ebx, esi
inc edi
dec ebx
cmp edi, 0x64
jb 0x1000850c
xor ebx, ebx
lea ecx, [esi + 1]
imul ecx, esi
mov eax, ecx
push 0xa
cdq
pop ecx
idiv ecx
pop edi
cmp edx, 8
jne 0x10008541
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [0x1008b0ac]
push ebx
push ebx
call dword [0x1008b0b0]
push 0xa
pop ecx
cmp byte [0x100c5e93], 0
jne 0x10008583
mov byte [ebp - 0x14], 0x32
mov byte [ebp - 0x13], cl
mov dword [ebp - 0x12], 0x339140b
mov dword [ebp - 0xe], 0x1517201c
mov dword [ebp - 0xa], 0x1e1004
mov al, byte [ebx + 0x100bf198]
xor al, byte [ebp + ebx - 0x14]
inc ebx
mov byte [ebx + 0x100bf753], al
cmp ebx, 0xd
jl 0x10008566
mov byte [0x100c5e93], 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 0x100bf754
pop ebx
call fcn.1006dcab
leave
ret

Function at 0x10008596
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c5ea6], 0
jne 0x100085e6
xor ecx, ecx
mov dword [ebp - 0x14], 0x4000a3c
mov dword [ebp - 0x10], 0x1f000321
mov dword [ebp - 0xc], 0x171f0819
mov byte [ebp - 8], cl
mov al, byte [ecx + 0x100bf198]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100bf857], al
cmp ecx, 0xc
jl 0x100085c9
mov byte [0x100c5ea6], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf858
call fcn.1006dcab
leave
ret

Function at 0x100085f7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c5e3d], 0
jne 0x10008670
push ebx
xor ebx, ebx
inc ebx
xor ecx, ecx
mov word [ebp - 0x14], 0xa3c
mov byte [ebp - 0x12], bl
mov dword [ebp - 0x11], 0x204f1e16
mov dword [ebp - 0xd], 0x1f02180d
mov word [ebp - 9], 0x5c5e
mov byte [ebp - 7], cl
mov al, byte [ecx + 0x100bf198]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100bf2d3], al
cmp ecx, 0xd
jl 0x10008636
mov byte [0x100c5e3d], bl
call fcn.10003fad
test al, al
jne 0x1000866f
push 0x52
mov ecx, ebx
pop edx
dec edx
lea eax, [ecx + ebx]
lea ebx, [ecx]
mov ecx, eax
jns 0x10008660
mov dword [0x100c57c0], eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf2d4
call fcn.1006dcab
leave
ret
Function at 0x10008681
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c5e6b], 0
jne 0x100086ed
call fcn.10003e18
test al, al
jne 0x100086b9
call fcn.1006e318
mov ecx, dword [0x100c57c0]
cmp ecx, eax
jne 0x100086b9
dec ecx
mov dword [0x100c57c0], ecx
mov dword [ebp - 0x10], 0x16010a3c
mov dword [ebp - 0xc], 0xd204f1e
mov dword [ebp - 8], 0x1f0218
xor ecx, ecx
mov al, byte [ecx + 0x100bf198]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100bf537], al
cmp ecx, 0xb
jl 0x100086d0
mov byte [0x100c5e6b], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf538
call fcn.1006dcab
leave
ret

Function at 0x100086fe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c5e42], 0
jne 0x1000874d
xor ecx, ecx
mov dword [ebp - 0x10], 0x70c0d3f
mov dword [ebp - 0xc], 0x181a1522
mov word [ebp - 8], 0xf0d
mov byte [ebp - 6], cl
mov al, byte [ecx + 0x100bf198]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100bf31f], al
cmp ecx, 0xa
jl 0x10008730
mov byte [0x100c5e42], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf320
call fcn.1006dcab
leave
ret

Function at 0x1000875e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c5e70], 0
jne 0x100087aa
mov dword [ebp - 0x10], 0x1607163e
mov dword [ebp - 0xc], 0x9050322
mov word [ebp - 8], 0x1c
xor ecx, ecx
mov al, byte [ecx + 0x100bf198]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100bf57b], al
cmp ecx, 9
jl 0x1000878d
mov byte [0x100c5e70], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf57c
call fcn.1006dcab
leave
ret

Function at 0x100087bb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10003d37
test al, al
jne 0x100087de
call fcn.1006e318
mov dword [0x100c57c0], eax
cmp byte [0x100c5e4b], 0
jne 0x1000883e
push ebx
mov dword [ebp - 0xc], 0x1601133e
mov dword [ebp - 8], 0xe10
xor ebx, ebx
call fcn.100040aa
test al, al
jne 0x10008820
push esi
push 4
call fcn.1006cded
mov esi, eax
call fcn.1006e318
mov dword [esi], eax
push esi
mov dword [0x100c57c0], eax
call fcn.1006ce3c
pop ecx
pop ecx
pop esi
mov al, byte [ebx + 0x100bf198]
xor al, byte [ebp + ebx - 0xc]
inc ebx
mov byte [ebx + 0x100bf393], al
cmp ebx, 7
jl 0x10008820
mov byte [0x100c5e4b], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf394
call fcn.1006dcab
leave
ret
Function at 0x1000884f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c5e51], 0
jne 0x1000889c
mov dword [ebp - 0x10], 0x27000b3e
xor ecx, ecx
mov dword [ebp - 0xc], 0x3f160004
mov dword [ebp - 8], 0xa0907
mov al, byte [ecx + 0x100bf198]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100bf3df], al
cmp ecx, 0xb
jl 0x1000887f
mov byte [0x100c5e51], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf3e0
call fcn.1006dcab
leave
ret

Function at 0x100088ad
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c5e31], 0
jne 0x1000890b
call fcn.100040ec
test al, al
jne 0x100088d5
dec dword [0x100c57c0]
xor ecx, ecx
mov dword [ebp - 0x10], 0x27000b3e
mov dword [ebp - 0xc], 0x27160004
mov word [ebp - 8], 0x1307
mov byte [ebp - 6], cl
mov al, byte [ecx + 0x100bf198]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100bf233], al
cmp ecx, 0xa
jl 0x100088ee
mov byte [0x100c5e31], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf234
call fcn.1006dcab
leave
ret

Function at 0x1000891c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c5e8c], 0
jne 0x1000899d
mov ecx, dword [0x100c57c0]
mov eax, ecx
imul eax, ecx
imul eax, ecx
push 0x13
cdq
pop ecx
idiv ecx
cmp edx, 0xd
jne 0x10008969
push esi
xor esi, esi
xor eax, eax
push 0x4f
inc esi
inc eax
pop edx
dec edx
lea ecx, [eax + esi]
lea esi, [eax]
mov eax, ecx
jns 0x10008958
mov dword [0x100c57c0], ecx
pop esi
mov dword [ebp - 0x10], 0x1f0a0c29
mov dword [ebp - 0xc], 0x1e0a2e5c
mov dword [ebp - 8], 0x1e0407
xor ecx, ecx
mov al, byte [ecx + 0x100bf198]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100bf6f7], al
cmp ecx, 0xb
jl 0x10008980
mov byte [0x100c5e8c], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100bf6f8
call fcn.1006dcab
leave
ret
Function at 0x1000a48d
Capabilities:
Get geographical location

Disassembly:
push 0x5ac
mov eax, 0x10086134
call fcn.1006dde6
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x5a4], esi
mov dword [ebp - 0x5b8], eax
mov dword [ebp - 0x518], 0xf
mov dword [ebp - 0x51c], ebx
mov byte [ebp - 0x52c], bl
mov ecx, dword [0x100c57c0]
push 0x15
lea edx, [ecx + 2]
lea eax, [ecx + 1]
imul eax, edx
imul eax, ecx
cdq
pop ecx
idiv ecx
mov dword [ebp - 4], ebx
cmp edx, 0x14
jne 0x1000a554
mov esi, ebx
call fcn.1006e318
movd xmm0, eax
cvtdq2pd xmm0, xmm0
inc esi
movsd qword [ebp + esi*8 - 0x51c], xmm0
cmp esi, 0xa0
jb 0x1000a4eb
mov eax, ebx
mov edx, 0x9f
mov ecx, edx
cmp eax, edx
jge 0x1000a546
movsd xmm0, qword [ebp + ecx*8 - 0x514]
movsd xmm1, qword [ebp + ecx*8 - 0x51c]
comisd xmm0, xmm1
jbe 0x1000a541
movsd qword [ebp + ecx*8 - 0x514], xmm1
movsd qword [ebp + ecx*8 - 0x51c], xmm0
dec ecx
cmp ecx, eax
jg 0x1000a517
inc eax
cmp eax, 0xa0
jl 0x1000a511
mov esi, dword [ebp - 0x5a4]
lea ecx, [ebp - 0x59c]
mov byte [ebp - 0x59d], bl
mov byte [ebp - 4], 1
call fcn.10010125
push ebx
lea ecx, [ebp - 0x5b4]
mov byte [ebp - 4], 2
call fcn.100126bc
push 1
lea eax, [ebp - 0x5b4]
push eax
push edi
lea ecx, [ebp - 0x59c]
mov byte [ebp - 4], 3
call fcn.1001146d
test al, al
jne 0x1000a5ce
mov esi, str.error_parse
push esi
call fcn.1006dc20
pop ecx
push eax
push esi
lea ecx, [ebp - 0x52c]
call fcn.1000130e
lea ecx, [ebp - 0x5b4]
mov byte [ebp - 4], 2
call fcn.100127e2
lea ecx, [ebp - 0x59c]
call fcn.10002f68
jmp 0x1000a6a0
mov edi, str.country_name
push edi
lea ecx, [ebp - 0x5b4]
call fcn.10013021
test al, al
je 0x1000a68a
push edi
lea ecx, [ebp - 0x5b4]
call fcn.10012983
mov ecx, eax
call fcn.1001304c
test al, al
je 0x1000a68a
push str.country_code
lea ecx, [ebp - 0x5b4]
call fcn.10012983
mov ecx, eax
call fcn.10012bc6
push 0x100c5794
lea ecx, [ebp - 0x5a4]
mov dword [esi], eax
call fcn.10001561
push edi
lea ecx, [ebp - 0x5b4]
mov byte [ebp - 4], 4
call fcn.10012983
mov ecx, eax
call fcn.10012bc3
push eax
lea ecx, [ebp - 0x5a4]
call fcn.10001db3
lea ecx, [ebp - 0x5a4]
call fcn.1000358a
mov esi, dword [eax]
push esi
call fcn.100014b2
pop ecx
mov ecx, dword [ebp - 0x5b8]
push eax
push esi
call fcn.1000130e
mov ecx, dword [ebp - 0x5a4]
mov bl, 1
lea ecx, [ecx - 0x10]
mov byte [ebp - 0x59d], bl
call fcn.10001d6e
jmp 0x1000a5af
mov esi, str.error_json_not_valid_update_from_version
jmp 0x1000a59b
lea ecx, [ebp - 0x52c]
call fcn.1000102f
mov al, bl
call fcn.1006dd38
ret
Function at 0x1000cccc
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x100c4370]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push ebx
push edi
mov dword [ebp - 0x88], eax
call fcn.1006ecd0
pop ecx
pop ecx
test eax, eax
jne 0x1000cd05
push 4
pop eax
jmp 0x1000ce48
push esi
push 0x1008c45c
lea eax, [ebp - 0x80]
push edi
xor esi, esi
push eax
mov dword [ebp - 0x80], esi
call fcn.10070df0
add esp, 0xc
test eax, eax
jne 0x1000ce44
cmp dword [ebp - 0x80], esi
je 0x1000ce44
push 0x1008c460
lea eax, [ebp - 0x84]
push ebx
push eax
mov dword [ebp - 0x84], esi
call fcn.10070df0
add esp, 0xc
test eax, eax
jne 0x1000ce3f
cmp dword [ebp - 0x84], esi
je 0x1000ce3f
push dword [ebp - 0x88]
call fcn.1006dc20
dec eax
pop ecx
mov dword [ebp - 0x8c], eax
cmp eax, 0x1f
ja 0x1000ce3b
push 2
push esi
push dword [ebp - 0x80]
call fcn.10071133
push dword [ebp - 0x80]
call fcn.1007150b
push esi
push esi
push dword [ebp - 0x80]
mov edi, eax
call fcn.10071133
push edi
call fcn.1006e7a5
push dword [ebp - 0x80]
mov ebx, eax
push 1
push edi
push ebx
call fcn.10070ff8
push dword [ebp - 0x80]
call fcn.10070ca0
add esp, 0x34
mov edx, esi
mov ecx, esi
test edi, edi
je 0x1000cddd
mov eax, dword [ebp - 0x88]
mov al, byte [eax + ecx]
xor byte [edx + ebx], al
cmp ecx, dword [ebp - 0x8c]
jne 0x1000cdd7
mov ecx, esi
jmp 0x1000cdd8
inc ecx
inc edx
cmp edx, edi
jne 0x1000cdbf
push dword [ebp - 0x84]
push 1
push edi
push ebx
call fcn.100716ca
mov edi, dword [0x100c57c0]
add esp, 0x10
lea ecx, [edi + 1]
lea eax, [edi + 2]
imul eax, ecx
imul eax, edi
push 0x18
cdq
pop ecx
idiv ecx
cmp edx, 3
jne 0x1000ce24
mov eax, dword [ebp + esi*4 - 0x7c]
imul eax, eax, 0x91
add edi, eax
inc esi
cmp esi, 0x78
jb 0x1000ce0c
mov dword [0x100c57c0], edi
push dword [ebp - 0x84]
call fcn.10070ca0
push ebx
call fcn.1006ed9a
pop ecx
pop ecx
xor eax, eax
jmp 0x1000ce47
push 3
jmp 0x1000ce41
push 2
pop eax
jmp 0x1000ce47
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1006dcab
leave
ret