joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a0d8
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [0x1005133c]
test ecx, ecx
jne 0x1001a18b
mov esi, dword [0x100512d8]
test esi, esi
jne 0x1001a118
mov ecx, 0xf8f45725
call fcn.1001bba6
mov esi, eax
mov dword [0x100512d8], eax
mov word [esp + 0x10], 0x2631
mov byte [esp + 0x12], 0
movaps xmm0, xmmword [str.E3]
movups xmmword [esp], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x44
xor byte [esp + eax], cl
inc eax
cmp eax, 0x12
jne 0x1001a132
mov byte [esp + 0x12], 0
mov ecx, dword [0x100512dc]
test ecx, ecx
jne 0x1001a160
mov ecx, 0x53b2070f
call fcn.1001bba6
mov ecx, eax
mov dword [0x100512dc], eax
lea eax, [esp + 0x14]
mov dword [eax + 2], 0x213727
mov word [eax], 0x3670
xor dword [eax + 1], 0x48474645
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1005133c], eax
mov eax, dword [esp + 0x30]
push edi
push ebp
push ebx
push eax
call ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x1001a19c
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ecx, dword [0x10051340]
test ecx, ecx
jne 0x1001a250
mov esi, dword [0x100512d8]
test esi, esi
jne 0x1001a1dc
mov ecx, 0xf8f45725
call fcn.1001bba6
mov esi, eax
mov dword [0x100512d8], eax
mov dword [esp + 0x10], 0x2e1031
mov byte [esp + 0x14], 0
movaps xmm0, xmmword [0x1003fe90]
movups xmmword [esp], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x44
xor byte [esp + eax], cl
inc eax
cmp eax, 0x14
jne 0x1001a1f7
mov byte [esp + 0x14], 0
mov ecx, dword [0x100512dc]
test ecx, ecx
jne 0x1001a225
mov ecx, 0x53b2070f
call fcn.1001bba6
mov ecx, eax
mov dword [0x100512dc], eax
lea eax, [esp + 0x18]
mov dword [eax + 2], 0x213727
mov word [eax], 0x3670
xor dword [eax + 1], 0x48474645
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10051340], eax
mov eax, dword [esp + 0x34]
push edi
push ebp
push ebx
push eax
call ecx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x1001a348
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
push esi
sub esp, 0x10
mov edi, dword [esp + 0x1c]
mov dword [esp + 0xb], 0x737365
mov dword [esp + 8], 0x65636f72
mov dword [esp + 4], 0x50343677
mov dword [esp], 0x6f577349
mov esi, dword [0x100512d4]
test esi, esi
jne 0x1001a394
call fcn.1001a3b0
mov ecx, esp
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [0x100512d4], eax
test eax, eax
je 0x1001a3a1
call fcn.100196ce
push edi
push eax
call esi
test eax, eax
jne 0x1001a3a7
mov dword [edi], 0
xor eax, eax
add esp, 0x10
pop esi
pop edi
ret
Function at 0x1001a3b0
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
sub esp, 0xc
mov eax, dword [0x10051344]
test eax, eax
jne 0x1001a410
mov ecx, dword [0x100512dc]
test ecx, ecx
jne 0x1001a3d7
mov ecx, 0x53b2070f
call fcn.1001bba6
mov ecx, eax
mov dword [0x100512dc], eax
mov dword [esp + 2], 0x252d2934
mov word [esp + 6], 0x7979
mov byte [esp + 8], 0
mov word [esp], 0x206b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x44
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x1001a3f4
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
mov dword [0x10051344], eax
add esp, 0xc
ret

Function at 0x1001a4e4
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [0x10051348]
test ecx, ecx
jne 0x1001a598
mov esi, dword [0x100512d8]
test esi, esi
jne 0x1001a528
mov ecx, 0xf8f45725
call fcn.1001bba6
mov esi, eax
mov dword [0x100512d8], eax
mov byte [esp + 0x10], 0
movaps xmm0, xmmword [0x1003ff90]
movups xmmword [esp], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x44
xor byte [esp + eax], cl
inc eax
cmp eax, 0x10
jne 0x1001a53b
mov byte [esp + 0x10], 0
mov ecx, dword [0x100512dc]
test ecx, ecx
jne 0x1001a569
mov ecx, 0x53b2070f
call fcn.1001bba6
mov ecx, eax
mov dword [0x100512dc], eax
lea eax, [esp + 0x14]
mov dword [eax + 2], 0x7a7423
mov word [eax], 0x296f
xor dword [eax + 1], 0x48474645
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10051348], eax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
push ebx
push edi
push ebp
push edx
push eax
call ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0x14

Function at 0x1001aafc
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov ecx, dword [0x1005134c]
test ecx, ecx
jne 0x1001abc0
mov esi, dword [0x100512d8]
test esi, esi
jne 0x1001ab33
mov ecx, 0xf8f45725
call fcn.1001bba6
mov esi, eax
mov dword [0x100512d8], eax
mov word [esp + 0x1c], 0x227
mov byte [esp + 0x1e], 0
movaps xmm0, xmmword [0x1003ffc0]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x44
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x12
jne 0x1001ab4e
mov byte [esp + 0x1e], 0
mov ecx, dword [0x100512dc]
test ecx, ecx
jne 0x1001ab7d
mov ecx, 0x53b2070f
call fcn.1001bba6
mov ecx, eax
mov dword [0x100512dc], eax
mov dword [esp + 2], 0x252d2934
mov word [esp + 6], 0x7979
mov byte [esp + 8], 0
mov word [esp], 0x206b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x44
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x1001ab9a
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1005134c], eax
push ebx
push edi
call ecx
add esp, 0x20
pop esi
pop edi
pop ebx
ret 8
Function at 0x1001abce
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x24]
mov ecx, dword [0x10051350]
test ecx, ecx
jne 0x1001ac76
mov esi, dword [0x100512d8]
test esi, esi
jne 0x1001ac00
mov ecx, 0xf8f45725
call fcn.1001bba6
mov esi, eax
mov dword [0x100512d8], eax
mov dword [esp + 2], 0x3d2d002a
mov dword [esp + 6], 0x3e3e2e1c
mov dword [esp + 0xa], 0x3e2027
mov word [esp], 0x3152
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x44
xor byte [esp + eax], cl
inc eax
cmp eax, 0xd
jne 0x1001ac21
mov byte [esp + 0xd], 0
mov ecx, dword [0x100512dc]
test ecx, ecx
jne 0x1001ac4f
mov ecx, 0x53b2070f
call fcn.1001bba6
mov ecx, eax
mov dword [0x100512dc], eax
lea eax, [esp + 0x10]
mov dword [eax + 2], 0x242b22
mov word [eax], 0x316e
xor dword [eax + 1], 0x48474645
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10051350], eax
push edi
call ecx
add esp, 0x18
pop esi
pop edi
ret 4

Function at 0x1001ac82
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x2c]
mov ecx, dword [0x10051354]
test ecx, ecx
jne 0x1001ad26
mov esi, dword [0x100512d8]
test esi, esi
jne 0x1001acb4
mov ecx, 0xf8f45725
call fcn.1001bba6
mov esi, eax
mov dword [0x100512d8], eax
mov dword [esp + 0x10], 0x38242711
mov word [esp + 0x14], 0x2a
movaps xmm0, xmmword [0x1003ffd0]
movups xmmword [esp], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x44
xor byte [esp + eax], cl
inc eax
cmp eax, 0x15
jne 0x1001acd1
mov byte [esp + 0x15], 0
mov ecx, dword [0x100512dc]
test ecx, ecx
jne 0x1001acff
mov ecx, 0x53b2070f
call fcn.1001bba6
mov ecx, eax
mov dword [0x100512dc], eax
lea eax, [esp + 0x18]
mov dword [eax + 2], 0x242b22
mov word [eax], 0x316e
xor dword [eax + 1], 0x48474645
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10051354], eax
push edi
call ecx
add esp, 0x20
pop esi
pop edi
ret 4

Function at 0x1001ae38
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x24]
mov ecx, dword [0x10051358]
test ecx, ecx
jne 0x1001aef7
mov esi, dword [0x100512d8]
test esi, esi
jne 0x1001ae6a
mov ecx, 0xf8f45725
call fcn.1001bba6
mov esi, eax
mov dword [0x100512d8], eax
mov dword [esp + 0xa], 0x3a272f32
mov dword [esp + 0xe], 0x2335293e
mov dword [esp + 0x12], 0x35222f
mov word [esp + 8], 0x2067
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x44
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0xd
jne 0x1001ae8c
mov byte [esp + 0x15], 0
mov ecx, dword [0x100512dc]
test ecx, ecx
jne 0x1001aebb
mov ecx, 0x53b2070f
call fcn.1001bba6
mov ecx, eax
mov dword [0x100512dc], eax
mov dword [esp + 2], 0x7b7b1874
mov byte [esp + 6], 0
mov word [esp], 0x3677
xor eax, eax
inc eax
mov edx, eax
add dl, 0x44
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x1001aed1
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10051358], eax
push edi
call ecx
add esp, 0x18
pop esi
pop edi
ret 4
Function at 0x1001af02
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push esi
sub esp, 0x18
mov ecx, dword [0x1005135c]
test ecx, ecx
jne 0x1001afa9
mov esi, dword [0x100512d8]
test esi, esi
jne 0x1001af2f
mov ecx, 0xf8f45725
call fcn.1001bba6
mov esi, eax
mov dword [0x100512d8], eax
movaps xmm0, xmmword [0x1003ffe0]
movups xmmword [esp + 8], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x44
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0xf
jne 0x1001af3e
mov byte [esp + 0x17], 0
mov ecx, dword [0x100512dc]
test ecx, ecx
jne 0x1001af6d
mov ecx, 0x53b2070f
call fcn.1001bba6
mov ecx, eax
mov dword [0x100512dc], eax
mov dword [esp + 2], 0x7b7b1874
mov byte [esp + 6], 0
mov word [esp], 0x3677
xor eax, eax
inc eax
mov edx, eax
add dl, 0x44
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x1001af83
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1005135c], eax
call ecx
add esp, 0x18
pop esi
ret

Function at 0x1001afb0
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x18
lea edi, [esp + 0x24]
mov ecx, dword [0x10051360]
test ecx, ecx
jne 0x1001b062
mov esi, dword [0x100512d8]
test esi, esi
jne 0x1001afe2
mov ecx, 0xf8f45725
call fcn.1001bba6
mov esi, eax
mov dword [0x100512d8], eax
mov dword [esp + 0xa], 0x27173323
mov dword [esp + 0xe], 0x2d243e
mov word [esp + 8], 0x2b69
movsd xmm0, qword [esp + 9]
xorps xmm0, xmmword [0x1003fee0]
movlps qword [esp + 9], xmm0
mov ecx, dword [0x100512dc]
test ecx, ecx
jne 0x1001b026
mov ecx, 0x53b2070f
call fcn.1001bba6
mov ecx, eax
mov dword [0x100512dc], eax
mov dword [esp + 2], 0x7b7b1874
mov byte [esp + 6], 0
mov word [esp], 0x3677
xor eax, eax
inc eax
mov edx, eax
add dl, 0x44
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x1001b03c
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10051360], eax
mov eax, dword [edi]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
push eax
call ecx
add esp, 0x18
pop esi
pop edi
ret 4
Function at 0x1001b1c8
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov ecx, dword [0x10051364]
test ecx, ecx
jne 0x1001b28b
mov esi, dword [0x100512d8]
test esi, esi
jne 0x1001b1ff
mov ecx, 0xf8f45725
call fcn.1001bba6
mov esi, eax
mov dword [0x100512d8], eax
mov dword [esp + 0xa], 0x3a272f32
mov dword [esp + 0xe], 0x202d253e
mov word [esp + 0x12], 0x2b
mov word [esp + 8], 0x2067
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x44
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0xb
jne 0x1001b220
mov byte [esp + 0x13], 0
mov ecx, dword [0x100512dc]
test ecx, ecx
jne 0x1001b24f
mov ecx, 0x53b2070f
call fcn.1001bba6
mov ecx, eax
mov dword [0x100512dc], eax
mov dword [esp + 2], 0x7b7b1874
mov byte [esp + 6], 0
mov word [esp], 0x3677
xor eax, eax
inc eax
mov edx, eax
add dl, 0x44
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x1001b265
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10051364], eax
push ebx
push edi
call ecx
add esp, 0x14
pop esi
pop edi
pop ebx
ret 8

Function at 0x1001b298
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x28]
movzx ebx, word [esp + 0x24]
mov ecx, dword [0x10051368]
test ecx, ecx
jne 0x1001b35a
mov esi, dword [0x100512d8]
test esi, esi
jne 0x1001b2d0
mov ecx, 0xf8f45725
call fcn.1001bba6
mov esi, eax
mov dword [0x100512d8], eax
mov dword [esp + 0xa], 0x283c1407
mov dword [esp + 0xe], 0x3d393f38
mov byte [esp + 0x12], 0
mov word [esp + 8], 0x1657
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x44
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0xa
jne 0x1001b2ef
mov byte [esp + 0x12], 0
mov ecx, dword [0x100512dc]
test ecx, ecx
jne 0x1001b31e
mov ecx, 0x53b2070f
call fcn.1001bba6
mov ecx, eax
mov dword [0x100512dc], eax
mov dword [esp + 2], 0x7b7b1874
mov byte [esp + 6], 0
mov word [esp], 0x3677
xor eax, eax
inc eax
mov edx, eax
add dl, 0x44
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x1001b334
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10051368], eax
movzx eax, bx
push edi
push eax
call ecx
add esp, 0x14
pop esi
pop edi
pop ebx
ret 8
Function at 0x1001b36a
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push esi
sub esp, 0x14
mov ecx, dword [0x1005136c]
test ecx, ecx
jne 0x1001b421
mov esi, dword [0x100512d8]
test esi, esi
jne 0x1001b397
mov ecx, 0xf8f45725
call fcn.1001bba6
mov esi, eax
mov dword [0x100512d8], eax
mov dword [esp + 0xa], 0x2c240407
mov dword [esp + 0xe], 0x3d39252b
mov byte [esp + 0x12], 0
mov word [esp + 8], 0x1657
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x44
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0xa
jne 0x1001b3b6
mov byte [esp + 0x12], 0
mov ecx, dword [0x100512dc]
test ecx, ecx
jne 0x1001b3e5
mov ecx, 0x53b2070f
call fcn.1001bba6
mov ecx, eax
mov dword [0x100512dc], eax
mov dword [esp + 2], 0x7b7b1874
mov byte [esp + 6], 0
mov word [esp], 0x3677
xor eax, eax
inc eax
mov edx, eax
add dl, 0x44
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x1001b3fb
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1005136c], eax
call ecx
add esp, 0x14
pop esi
ret
Function at 0x1001ba98
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x4c]
mov ebx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x3c]
mov esi, dword [esp + 0x38]
mov ecx, dword [0x10051370]
test ecx, ecx
jne 0x1001bb8c
mov esi, dword [0x100512d8]
test esi, esi
jne 0x1001bae0
mov ecx, 0xf8f45725
call fcn.1001bba6
mov esi, eax
mov dword [0x100512d8], eax
mov dword [esp + 0xe], 0x3c260221
mov dword [esp + 0x12], 0x34290027
mov dword [esp + 0x16], 0x7370b
mov word [esp + 0xc], 0x2052
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x44
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xd
jne 0x1001bb02
mov byte [esp + 0x19], 0
mov ecx, dword [0x100512dc]
test ecx, ecx
jne 0x1001bb31
mov ecx, 0x53b2070f
call fcn.1001bba6
mov ecx, eax
mov dword [0x100512dc], eax
mov dword [esp + 2], 0x20382630
mov word [esp + 6], 0x7979
mov byte [esp + 8], 0
mov word [esp], 0x2161
xor eax, eax
inc eax
mov edx, eax
add dl, 0x44
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x1001bb4e
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10051370], eax
mov esi, dword [esp + 0x38]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
mov edx, dword [esp + 0x44]
push eax
push ebx
push edx
push edi
push ebp
push esi
push dword [esp + 0x4c]
push dword [esp + 0x4c]
call ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0x20
Function at 0x1001bba6
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0xc], ecx
mov eax, dword [0x1004aa44]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + 0x14]
add edi, 0x14
mov eax, dword [esi + 0x10]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x1001bc68
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x1001bc68
cmp word [eax + ecx + 0x14], 0x60
jb 0x1001bc68
cmp dword [eax + ecx + 0x74], 0
je 0x1001bc68
mov edx, dword [eax + ecx + 0x78]
mov ecx, edx
mov dword [esp], edx
test edx, edx
je 0x1001bc68
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x18]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x1001bc68
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x20]
add ecx, eax
mov dword [esp + 8], ecx
lea ecx, [eax + 1]
mov dword [esp + 4], ecx
xor ebx, ebx
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + ebx*4]
mov dl, byte [eax + ecx]
test dl, dl
je 0x1001bc50
add ecx, dword [esp + 4]
mov ebp, 0x811c9dc5
movsx edx, dl
xor edx, ebp
imul ebp, edx, 0x1000193
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x1001bc3c
jmp 0x1001bc55
mov ebp, 0x811c9dc5
cmp ebp, dword [esp + 0xc]
je 0x1001bc64
inc ebx
cmp ebx, dword [esp + 0x10]
jne 0x1001bc25
jmp 0x1001bc68
test eax, eax
jne 0x1001bc7c
mov esi, dword [esi]
cmp esi, edi
jne 0x1001bbc2
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp]
mov ecx, dword [eax + edx + 0x24]
add ecx, eax
mov edx, dword [eax + edx + 0x1c]
add edx, eax
movzx ecx, word [ecx + ebx*2]
add eax, dword [edx + ecx*4]
jmp 0x1001bc74
Function at 0x1001c796
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov ecx, dword [0x10051380]
test ecx, ecx
jne 0x1001c859
mov esi, dword [0x10051378]
test esi, esi
jne 0x1001c7d2
mov ecx, 0xf8f45725
call fcn.1001e859
mov esi, eax
mov dword [0x10051378], eax
mov dword [esp + 0xe], 0x81a19f95
mov dword [esp + 0x12], 0xbc8f85
mov word [esp + 0xc], 0x8b43
movsd xmm0, qword [esp + 0xd]
xorps xmm0, xmmword [0x100405d0]
movlps qword [esp + 0xd], xmm0
mov ecx, dword [0x1005137c]
test ecx, ecx
jne 0x1001c816
mov ecx, 0x53b2070f
call fcn.1001e859
mov ecx, eax
mov dword [0x1005137c], eax
mov dword [esp + 2], 0x84828897
mov word [esp + 6], 0xd8da
mov byte [esp + 8], 0
mov word [esp], 0x816b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xe3
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x1001c833
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10051380], eax
push ebp
push ebx
push edi
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x1001c868
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x10]
push edi
call fcn.10014bd8
add esp, 4
mov ebx, eax
push eax
push 0x40
call fcn.1001c9a4
mov esi, eax
push ebx
push 0
push eax
call fcn.10013ed4
add esp, 0xc
push esi
push edi
call fcn.100148f4
add esp, 8
test eax, eax
jne 0x1001c8bd
test ebx, ebx
jle 0x1001c8b4
mov eax, ebx
shr eax, 1
add eax, ebx
xor ecx, ecx
xor byte [esi + ecx], al
inc ecx
add al, bl
cmp ebx, ecx
jne 0x1001c8aa
push esi
call fcn.1001ca7a
add esp, 4
test esi, esi
je 0x1001c8c7
push esi
call fcn.1001cc84
xor eax, eax
pop esi
pop edi
pop ebx
ret

Function at 0x1001c8ce
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x28]
mov ecx, dword [0x10051384]
test ecx, ecx
jne 0x1001c998
mov esi, dword [0x10051378]
test esi, esi
jne 0x1001c900
mov ecx, 0xf8f45725
call fcn.1001e859
mov esi, eax
mov dword [0x10051378], eax
mov dword [esp + 0xe], 0x8d8a9396
mov dword [esp + 0x12], 0x899982bd
mov word [esp + 0x16], 0x8a8c
mov byte [esp + 0x18], 0
mov word [esp + 0xc], 0x8152
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xe3
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xc
jne 0x1001c926
mov byte [esp + 0x18], 0
mov ecx, dword [0x1005137c]
test ecx, ecx
jne 0x1001c955
mov ecx, 0x53b2070f
call fcn.1001e859
mov ecx, eax
mov dword [0x1005137c], eax
mov dword [esp + 2], 0x84828897
mov word [esp + 6], 0xd8da
mov byte [esp + 8], 0
mov word [esp], 0x816b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xe3
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x1001c972
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10051384], eax
push edi
call ecx
add esp, 0x1c
pop esi
pop edi
ret 4
Function at 0x1001c9a4
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [0x10051388]
test ecx, ecx
jne 0x1001ca6c
mov esi, dword [0x10051378]
test esi, esi
jne 0x1001c9db
mov ecx, 0xf8f45725
call fcn.1001e859
mov esi, eax
mov dword [0x10051378], eax
mov dword [esp + 0xe], 0xa98b8786
mov dword [esp + 0x12], 0x8f848685
mov byte [esp + 0x16], 0
mov word [esp + 0xc], 0x8b4c
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xe3
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xa
jne 0x1001c9fa
mov byte [esp + 0x16], 0
mov ecx, dword [0x1005137c]
test ecx, ecx
jne 0x1001ca29
mov ecx, 0x53b2070f
call fcn.1001e859
mov ecx, eax
mov dword [0x1005137c], eax
mov dword [esp + 2], 0x84828897
mov word [esp + 6], 0xd8da
mov byte [esp + 8], 0
mov word [esp], 0x816b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xe3
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x1001ca46
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10051388], eax
push ebx
push edi
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
ret 8