joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100116a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100af7ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
push esi
mov dword [ebp - 0x10], edi
call dword [sym.imp.mfc140.dll_Ordinal_300]
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x1c]
mov dword [edi + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [edi + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [edi + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x38]
mov dword [edi + 0x34], eax
mov dword [edi + 0x38], ecx
lea ecx, [edi + 0x4c]
mov eax, dword [esi + 0x3c]
mov dword [edi + 0x3c], eax
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
lea eax, [esi + 0x4c]
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.mfc140.dll_Ordinal_300]
mov eax, dword [esi + 0x50]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x50], eax
mov eax, dword [esi + 0x54]
mov dword [edi + 0x54], eax
mov eax, dword [esi + 0x58]
mov dword [edi + 0x58], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10011900
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100af868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebx], vtable.CLoadForcePoint.0
movups xmmword [ebx + 0x18], xmm0
mov dword [ebx + 0x10], vtable.CVector.0
movsd qword [ebx + 0x28], xmm0
movups xmmword [ebx + 0x38], xmm0
mov dword [ebx + 0x30], vtable.CVector.0
movsd qword [ebx + 0x48], xmm0
movups xmmword [ebx + 0x58], xmm0
mov dword [ebx + 0x50], vtable.CVector.0
movsd qword [ebx + 0x68], xmm0
lea ecx, [ebx + 0x70]
call dword [sym.imp.mfc140.dll_Ordinal_316]
lea ecx, [ebx + 0x74]
call dword [sym.imp.mfc140.dll_Ordinal_316]
movsd xmm0, qword [ebp + 8]
lea ecx, [ebx + 0x70]
mov eax, dword [ebp + 0x74]
movsd qword [ebx + 8], xmm0
movups xmm0, xmmword [ebp + 0x18]
mov dword [ebx + 0x7c], eax
lea eax, [ebp + 0x70]
push eax
movups xmmword [ebx + 0x18], xmm0
mov byte [ebp - 4], 9
movsd xmm0, qword [ebp + 0x28]
movsd qword [ebx + 0x28], xmm0
movups xmm0, xmmword [ebp + 0x58]
movups xmmword [ebx + 0x58], xmm0
movsd xmm0, qword [ebp + 0x68]
movsd qword [ebx + 0x68], xmm0
movups xmm0, xmmword [ebp + 0x38]
movups xmmword [ebx + 0x38], xmm0
movsd xmm0, qword [ebp + 0x48]
movsd qword [ebx + 0x48], xmm0
call dword [sym.imp.mfc140.dll_Ordinal_1526]
lea eax, [ebp + 0x78]
push eax
lea ecx, [ebx + 0x74]
call dword [sym.imp.mfc140.dll_Ordinal_1526]
lea ecx, [ebp + 0x70]
mov dword [ebx + 0x78], 1
mov dword [ebp + 0x10], vtable.CVector.0
mov dword [ebp + 0x30], vtable.CVector.0
mov dword [ebp + 0x50], vtable.CVector.0
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp + 0x78]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x74
Function at 0x10011a20
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100af8be
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
mov ebx, ecx
xorps xmm0, xmm0
mov dword [ebp - 0x10], ebx
push esi
push edi
mov dword [ebx], vtable.CLoadForcePoint.0
movups xmmword [ebx + 0x18], xmm0
mov dword [ebx + 0x10], vtable.CVector.0
movsd qword [ebx + 0x28], xmm0
mov dword [ebp - 4], 0
movups xmmword [ebx + 0x38], xmm0
mov dword [ebx + 0x30], vtable.CVector.0
movsd qword [ebx + 0x48], xmm0
movups xmmword [ebx + 0x58], xmm0
mov dword [ebx + 0x50], vtable.CVector.0
movsd qword [ebx + 0x68], xmm0
lea ecx, [ebx + 0x70]
call dword [sym.imp.mfc140.dll_Ordinal_316]
lea ecx, [ebx + 0x74]
call dword [sym.imp.mfc140.dll_Ordinal_316]
xorps xmm0, xmm0
mov dword [ebx + 0x7c], 1
movsd qword [ebx + 8], xmm0
lea ecx, [ebx + 0x70]
movups xmmword [ebx + 0x18], xmm0
push 0x100b4344
movsd qword [ebx + 0x28], xmm0
movups xmmword [ebx + 0x38], xmm0
mov byte [ebp - 4], 4
movsd qword [ebx + 0x48], xmm0
movups xmmword [ebx + 0x58], xmm0
movsd qword [ebx + 0x68], xmm0
call dword [sym.imp.mfc140.dll_Ordinal_1529]
push 0x100b4344
lea ecx, [ebx + 0x74]
call dword [sym.imp.mfc140.dll_Ordinal_1529]
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
mov dword [ebx + 0x78], 1
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x100133a0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100afd95
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [esi + 8]
push eax
lea ecx, [edi + 8]
mov dword [edi], vtable.CObStyle.0
call dword [sym.imp.mfc140.dll_Ordinal_300]
lea eax, [esi + 0xc]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_300]
lea eax, [esi + 0x10]
mov byte [ebp - 4], 1
push eax
lea ecx, [edi + 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_300]
lea eax, [esi + 0x14]
mov byte [ebp - 4], 2
push eax
lea ecx, [edi + 0x14]
call dword [sym.imp.mfc140.dll_Ordinal_300]
lea eax, [esi + 0x18]
mov byte [ebp - 4], 3
push eax
lea ecx, [edi + 0x18]
call dword [sym.imp.mfc140.dll_Ordinal_300]
movsd xmm0, qword [esi + 0x20]
mov ecx, dword [ebp - 0xc]
movsd qword [edi + 0x20], xmm0
movsd xmm0, qword [esi + 0x28]
movsd qword [edi + 0x28], xmm0
movsd xmm0, qword [esi + 0x30]
movsd qword [edi + 0x30], xmm0
movsd xmm0, qword [esi + 0x38]
movsd qword [edi + 0x38], xmm0
mov eax, dword [esi + 0x40]
mov dword [edi + 0x40], eax
mov eax, dword [esi + 0x44]
mov dword [edi + 0x44], eax
mov eax, dword [esi + 0x48]
mov dword [edi + 0x48], eax
mov eax, dword [esi + 0x4c]
mov dword [edi + 0x4c], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x100139b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100afdcd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.CRetainingUserLoad.0
lea ecx, [edi + 0xc]
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_300]
movsd xmm0, qword [esi + 0x10]
lea eax, [esi + 0x38]
movsd qword [edi + 0x10], xmm0
lea ecx, [edi + 0x38]
movsd xmm0, qword [esi + 0x18]
movsd qword [edi + 0x18], xmm0
movsd xmm0, qword [esi + 0x20]
movsd qword [edi + 0x20], xmm0
movsd xmm0, qword [esi + 0x28]
movsd qword [edi + 0x28], xmm0
movsd xmm0, qword [esi + 0x30]
push eax
mov dword [ebp - 4], 0
movsd qword [edi + 0x30], xmm0
call dword [sym.imp.mfc140.dll_Ordinal_300]
mov eax, dword [esi + 0x3c]
lea ecx, [edi + 0x40]
mov dword [edi + 0x3c], eax
lea eax, [esi + 0x40]
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.mfc140.dll_Ordinal_300]
mov eax, dword [esi + 0x44]
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x44], eax
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x10038d10
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0x104]
push ebx
push esi
push edi
push 0x104
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov edi, dword [ebp + 8]
push edi
call fcn.10035100
add esp, 0x10
mov ebx, eax
test edi, edi
je 0x10038da7
cmp ebx, 4
jb 0x10038da7
lea eax, [ebp - 0x104]
xor esi, esi
sub edi, eax
lea ecx, [ebp - 0x104]
add ecx, esi
mov al, byte [edi + ecx]
mov byte [ecx], al
cmp al, 0x5c
je 0x10038d65
cmp al, 0x2f
jne 0x10038d99
lea eax, [ebp - 0x104]
mov byte [ecx + 1], 0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x10038d99
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x10038d99
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10038da7
inc esi
cmp esi, ebx
jb 0x10038d50
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038db0
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b1b78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
push edi
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_300]
push 0x100bb7a8
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc140.dll_Ordinal_1696]
lea ecx, [ebp - 0x38]
call sub.mfc140.dll_Ordinal_503
push 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 2
call sub.mfc140.dll_Ordinal_4705
test eax, eax
je 0x10038ea9
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop word [eax + eax]
lea ecx, [ebp - 0x38]
call sub.mfc140.dll_Ordinal_4725
lea ecx, [ebp - 0x38]
mov esi, eax
call sub.mfc140.dll_Ordinal_8140
test eax, eax
jne 0x10038ea1
mov edx, dword [ebp - 0x38]
lea ecx, [ebp - 0x38]
push 0x10
call dword [edx + 0x40]
lea ecx, [ebp - 0x38]
test eax, eax
je 0x10038e8b
lea eax, [ebp - 0x14]
push eax
call sub.mfc140.dll_Ordinal_5565
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc140.dll_Ordinal_1526]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call dword [sym.imp.mfc140.dll_Ordinal_1044]
push ecx
mov eax, esp
lea ecx, [ebp - 0x10]
push 0x100bb7c4
push ecx
push eax
call fcn.10038be0
add esp, 0xc
call fcn.10038db0
add esp, 4
jmp 0x10038ea1
lea eax, [ebp - 0x18]
push eax
call sub.mfc140.dll_Ordinal_5565
push dword [eax]
call edi
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
test esi, esi
jne 0x10038e20
lea ecx, [ebp - 0x38]
call sub.mfc140.dll_Ordinal_2881
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [ebp - 0x38]
call sub.mfc140.dll_Ordinal_1142
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov ecx, dword [ebp - 0xc]
mov eax, 1
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003a760
Capabilities:
Check if file exists
Check os version
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x100ec084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push esi
push edi
push eax
xor esi, esi
mov dword [ebp - 0x9c], ecx
call fcn.10055220
mov edi, eax
add esp, 4
test edi, edi
jne 0x1003a7a4
pop edi
lea eax, [esi + 7]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10031516
mov esp, ebp
pop ebp
ret
mov eax, dword [0x100efd74]
test eax, eax
jne 0x1003a7d6
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [ebp - 0x88], 2
sete al
inc eax
mov dword [0x100efd74], eax
push ebx
cmp eax, 2
jne 0x1003a816
nop dword [eax]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1003a806
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x9c], eax
cmp eax, 5
jne 0x1003a84c
inc esi
cmp esi, 5
jge 0x1003a84c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1003a7e0
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1003a83c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x9c], eax
cmp eax, 5
jne 0x1003a84c
inc esi
cmp esi, 5
jge 0x1003a84c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1003a816
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
cmp ebx, 0xffffffff
pop ebx
jne 0x1003a877
cmp dword [ebp - 0x9c], 2
jne 0x1003a877
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10031516
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xa0a
pop edi
xor ecx, ebp
pop esi
call fcn.10031516
mov esp, ebp
pop ebp
ret
Function at 0x100672b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edx, dword [esi + 0x3c]
cmp dword [edx], ebx
jne 0x100672ee
mov eax, dword [esi + 0x78]
mov ecx, dword [esi]
or eax, 0x1e
push ebx
and eax, 0x87f3f
push eax
mov eax, dword [ecx + 0x18]
push edx
push ebx
push ecx
call eax
mov ebx, eax
add esp, 0x14
mov dword [ebp - 4], ebx
test ebx, ebx
jne 0x100673cb
mov ecx, dword [esi + 0x18]
cmp ecx, dword [esi + 0x24]
jbe 0x10067327
mov eax, dword [esi + 0x80]
push 0
cdq
push ecx
push edx
push eax
call fcn.100ad910
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x3c]
mov dword [ebp - 8], edx
lea edx, [ebp - 0xc]
push edx
push 5
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [esi + 0x18]
add esp, 0xc
mov dword [esi + 0x24], eax
push edi
mov edi, dword [ebp + 0xc]
nop dword [eax + eax]
test edi, edi
je 0x100673c8
mov ebx, dword [edi + 0xc]
cmp ebx, dword [esi + 0x18]
ja 0x100673ba
test byte [edi + 0x14], 0x20
jne 0x100673ba
mov eax, dword [esi + 0x80]
lea ecx, [ebx - 1]
cdq
push edx
push eax
push 0
push ecx
call fcn.100ad910
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp ebx, 1
jne 0x1006736e
push edi
call fcn.10067230
add esp, 4
push dword [ebp - 4]
mov eax, dword [edi]
push dword [ebp - 8]
mov edx, dword [esi + 0x80]
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x3c]
push edx
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
mov eax, dword [ecx + 0xc]
call eax
add esp, 0x14
mov dword [ebp - 4], eax
cmp ebx, 1
jne 0x100673a4
mov eax, dword [ebp + 8]
movups xmm0, xmmword [eax + 0x18]
movups xmmword [esi + 0x64], xmm0
cmp ebx, dword [esi + 0x20]
jbe 0x100673ac
mov dword [esi + 0x20], ebx
push dword [edi]
push ebx
push dword [esi + 0x58]
call fcn.100701d0
add esp, 0xc
mov ebx, dword [ebp - 4]
mov edi, dword [edi + 8]
test ebx, ebx
je 0x10067330
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007c8a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x10
push ebx
push edi
xor edi, edi
mov ebx, edx
test edx, edx
jne 0x1007c8b8
mov dword [ebp - 4], edi
jmp 0x1007c8d1
cmp byte [edx], 0
je 0x1007c8c6
nop dword [eax]
inc ebx
cmp byte [ebx], 0
jne 0x1007c8c0
sub ebx, edx
and ebx, 0x3fffffff
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, dword [eax + 4]
mov dword [ebp - 0xc], ebx
test ebx, ebx
jle 0x1007c9dd
mov ebx, dword [eax + 8]
mov dword [ebp - 0x10], ebx
push esi
nop
mov eax, ecx
xor eax, 1
cmp ecx, 2
cmovae eax, ecx
mov ecx, dword [ebp + 0x10]
add eax, eax
mov esi, dword [ebx + eax*8 + 0xc]
mov dword [ebp + 8], esi
test ecx, ecx
je 0x1007c95f
mov edx, dword [ebx + eax*8]
mov bl, byte [ecx]
test bl, bl
je 0x1007c944
mov esi, ecx
mov al, bl
sub esi, edx
nop word [eax + eax]
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x100bc608]
cmp al, byte [ecx + 0x100bc608]
jne 0x1007c941
mov al, byte [esi + edx + 1]
inc edx
mov bl, al
test al, al
jne 0x1007c920
mov esi, dword [ebp + 8]
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x100bc608]
movzx eax, bl
movzx eax, byte [eax + 0x100bc608]
sub eax, ecx
jne 0x1007c9c6
mov edx, dword [ebp + 0xc]
cmp dword [esi + 0x24], 0
lea ecx, [esi + 0x18]
mov ebx, dword [ebp - 4]
mov dword [ebp + 8], ecx
je 0x1007c9a0
mov edi, edx
mov esi, ebx
xor edx, edx
test ebx, ebx
je 0x1007c998
movzx eax, byte [edi]
lea edi, [edi + 1]
dec esi
movzx ecx, byte [eax + 0x100bc608]
lea eax, [edx*8]
xor ecx, eax
xor edx, ecx
test esi, esi
jg 0x1007c978
mov ecx, dword [ebp + 8]
mov eax, edx
xor edx, edx
div dword [ecx]
jmp 0x1007c9a2
xor edx, edx
push edx
push ebx
push dword [ebp + 0xc]
push ecx
call fcn.1005ace0
add esp, 0x10
test eax, eax
je 0x1007c9c4
mov edi, dword [eax + 8]
test edi, edi
je 0x1007c9c6
pop esi
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
mov ecx, dword [ebp - 8]
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, dword [ebp - 0xc]
jge 0x1007c9bb
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x10]
jmp 0x1007c8f0
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007c9f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 8], ecx
push ebx
mov ebx, edx
push esi
test edx, edx
jne 0x1007ca0b
mov dword [ebp - 4], ecx
jmp 0x1007ca20
cmp byte [edx], cl
je 0x1007ca15
nop
inc ebx
cmp byte [ebx], cl
jne 0x1007ca10
sub ebx, edx
and ebx, 0x3fffffff
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0xc], eax
mov esi, dword [ebx + 4]
mov dword [ebp - 0x10], esi
test esi, esi
jle 0x1007cb0e
push edi
mov edi, dword [ebp + 0x10]
mov esi, eax
xor esi, 1
cmp eax, 2
cmovae esi, eax
test edi, edi
je 0x1007caa3
mov eax, dword [ebx + 8]
mov ecx, esi
mov bl, byte [edi]
add ecx, ecx
mov edx, dword [eax + ecx*8]
test bl, bl
je 0x1007ca81
mov al, bl
sub edi, edx
nop dword [eax]
movzx ecx, byte [edx]
mov bl, al
movzx eax, al
mov al, byte [eax + 0x100bc608]
cmp al, byte [ecx + 0x100bc608]
jne 0x1007ca81
mov al, byte [edi + edx + 1]
inc edx
mov bl, al
test al, al
jne 0x1007ca60
movzx eax, byte [edx]
movzx ecx, byte [eax + 0x100bc608]
movzx eax, bl
movzx eax, byte [eax + 0x100bc608]
sub eax, ecx
jne 0x1007cb1b
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 8]
add esi, esi
mov ebx, dword [ebp - 4]
mov ecx, dword [eax + esi*8 + 0xc]
add ecx, 8
mov dword [ebp - 8], ecx
cmp dword [ecx + 0xc], 0
je 0x1007caed
mov edi, edx
mov esi, ebx
xor edx, edx
test ebx, ebx
je 0x1007cae5
movzx eax, byte [edi]
lea edi, [edi + 1]
dec esi
movzx ecx, byte [eax + 0x100bc608]
lea eax, [edx*8]
xor ecx, eax
xor edx, ecx
test esi, esi
jg 0x1007cac5
mov ecx, dword [ebp - 8]
mov eax, edx
xor edx, edx
div dword [ecx]
jmp 0x1007caef
xor edx, edx
push edx
push ebx
push dword [ebp + 0xc]
push ecx
call fcn.1005ace0
add esp, 0x10
test eax, eax
je 0x1007cb14
mov ecx, dword [eax + 8]
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x1007cb1e
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov dword [ebp - 8], ecx
jmp 0x1007cb1e
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebp - 0x10]
jge 0x1007cb0b
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
jmp 0x1007ca37
Function at 0x1007e160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x10
mov eax, dword [eax]
push esi
xor esi, esi
test dword [eax + 0xc], 0x4000000
je 0x1007e29d
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov ebx, dword [eax + 0x24]
test ebx, ebx
je 0x1007e1b8
mov edi, dword [ebx + 0x14]
test edi, edi
jle 0x1007e1ae
lea edx, [ebx + 0x24]
mov ecx, dword [edx]
cmp ecx, 0x1f
jle 0x1007e19d
or eax, 0xffffffff
jmp 0x1007e1a4
mov eax, 1
shl eax, cl
or esi, eax
add edx, 8
sub edi, 1
jne 0x1007e191
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x1007e187
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edi, ecx
mov dword [ebp - 0x10], ecx
test ecx, ecx
je 0x1007e1d6
cmp byte [ecx], 0
je 0x1007e1ce
inc edi
cmp byte [edi], 0
jne 0x1007e1c8
sub edi, ecx
and edi, 0x3fffffff
mov eax, dword [eax + 0x44]
xor edx, edx
add eax, 0x38
mov dword [ebp - 4], edi
mov dword [ebp - 8], eax
cmp dword [eax + 0xc], edx
je 0x1007e222
mov dword [ebp - 0xc], ecx
mov ebx, edi
test edi, edi
je 0x1007e217
mov edi, ecx
movzx eax, byte [edi]
lea edi, [edi + 1]
dec ebx
movzx ecx, byte [eax + 0x100bc608]
lea eax, [edx*8]
xor ecx, eax
xor edx, ecx
test ebx, ebx
jg 0x1007e1f4
mov edi, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 8]
mov eax, edx
xor edx, edx
div dword [ebx]
mov eax, ebx
push edx
push edi
push ecx
push eax
call fcn.1005ace0
add esp, 0x10
test eax, eax
je 0x1007e294
mov ebx, dword [eax + 8]
test ebx, ebx
je 0x1007e294
nop dword [eax]
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10061010
mov edx, dword [ebp - 8]
add esp, 0x14
test edx, edx
je 0x1007e28d
mov edi, dword [edx + 4]
test edi, edi
jle 0x1007e28d
mov edx, dword [edx + 8]
nop dword [eax]
mov ecx, dword [edx]
cmp ecx, 0x1f
jle 0x1007e27c
or eax, 0xffffffff
jmp 0x1007e283
mov eax, 1
shl eax, cl
or esi, eax
add edx, 4
sub edi, 1
jne 0x1007e270
mov ebx, dword [ebx + 0xc]
test ebx, ebx
jne 0x1007e240
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100a4ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
jle 0x100a4ef0
push ebx
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx]
lea ecx, [esi*8]
dec edi
lea ebx, [ebx + 1]
movzx edx, byte [eax + 0x100bc608]
xor edx, ecx
xor esi, edx
test edi, edi
jg 0x100a4ed2
pop ebx
pop edi
mov eax, esi
pop esi
pop ebp
ret