joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009c6f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x103357d4]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10337d18]
cmp eax, dword [ecx + 4]
jle 0x1009c787
push 0x10337d18
call fcn.1014bbcf
add esp, 4
cmp dword [0x10337d18], 0xffffffff
jne 0x1009c787
mov eax, dword [0x10335870]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x1009c772
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009c738
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x1009c76b
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x1009c750
cmp ecx, 0xbaadee37
je 0x1009c774
mov esi, dword [esi + 4]
test esi, esi
jne 0x1009c730
xor esi, esi
push 0x10337d18
mov dword [0x10337d34], esi
call fcn.1014bb7e
add esp, 4
mov eax, dword [0x10337d34]
pop edi
pop esi
ret

Function at 0x1009c790
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x103357d4]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10337d38]
cmp eax, dword [ecx + 4]
jle 0x1009c827
push 0x10337d38
call fcn.1014bbcf
add esp, 4
cmp dword [0x10337d38], 0xffffffff
jne 0x1009c827
mov eax, dword [0x10335870]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x1009c812
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009c7d8
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x1009c80b
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x1009c7f0
cmp ecx, 0xad013136
je 0x1009c814
mov esi, dword [esi + 4]
test esi, esi
jne 0x1009c7d0
xor esi, esi
push 0x10337d38
mov dword [0x10337d30], esi
call fcn.1014bb7e
add esp, 4
mov eax, dword [0x10337d30]
pop edi
pop esi
ret

Function at 0x1009c830
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x103357d4]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10337d20]
cmp eax, dword [ecx + 4]
jle 0x1009c8c7
push 0x10337d20
call fcn.1014bbcf
add esp, 4
cmp dword [0x10337d20], 0xffffffff
jne 0x1009c8c7
mov eax, dword [0x10335870]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x1009c8b2
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009c878
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x1009c8ab
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x1009c890
cmp ecx, 0x84616929
je 0x1009c8b4
mov esi, dword [esi + 4]
test esi, esi
jne 0x1009c870
xor esi, esi
push 0x10337d20
mov dword [0x10337d3c], esi
call fcn.1014bb7e
add esp, 4
mov eax, dword [0x10337d3c]
pop edi
pop esi
ret
Function at 0x1009c8d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x103357d4]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10337d28]
cmp eax, dword [ecx + 4]
jle 0x1009c967
push 0x10337d28
call fcn.1014bbcf
add esp, 4
cmp dword [0x10337d28], 0xffffffff
jne 0x1009c967
mov eax, dword [0x10335870]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x1009c952
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1009c918
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x1009c94b
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x1009c930
cmp ecx, 0xb5599648
je 0x1009c954
mov esi, dword [esi + 4]
test esi, esi
jne 0x1009c910
xor esi, esi
push 0x10337d28
mov dword [0x10337d24], esi
call fcn.1014bb7e
add esp, 4
mov eax, dword [0x10337d24]
pop edi
pop esi
ret
Function at 0x100ab6c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x100ab70f
lea edx, [esi + 8]
mov edi, eax
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x100ab6d2
mov eax, dword [esi]
jmp 0x100ab7f8
cmp eax, 0x4e0
jb 0x100ab7f8
push ebx
mov ebx, dword [esi + 0x9c4]
lea edi, [esi + 0x9c4]
push ebp
mov ebp, 0xe3
nop dword [eax]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub ebp, 1
jne 0x100ab730
mov ebx, dword [esi + 0xd50]
lea edi, [esi + 0xd50]
mov ebp, 0x18c
nop dword [eax]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub ebp, 1
jne 0x100ab780
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop ebp
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
pop ebx
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
ret
Function at 0x100b6840
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x103357d4]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10339208]
cmp eax, dword [ecx + 4]
jle 0x100b68d7
push 0x10339208
call fcn.1014bbcf
add esp, 4
cmp dword [0x10339208], 0xffffffff
jne 0x100b68d7
mov eax, dword [0x10335870]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x100b68c2
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100b6888
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x100b68bb
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x100b68a0
cmp ecx, 0xbbefcb72
je 0x100b68c4
mov esi, dword [esi + 4]
test esi, esi
jne 0x100b6880
xor esi, esi
push 0x10339208
mov dword [0x103391dc], esi
call fcn.1014bb7e
add esp, 4
mov eax, dword [0x103391dc]
pop edi
pop esi
ret
Function at 0x100b9170
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x103357d4]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x103392a8]
cmp eax, dword [ecx + 4]
jle 0x100b9207
push 0x103392a8
call fcn.1014bbcf
add esp, 4
cmp dword [0x103392a8], 0xffffffff
jne 0x100b9207
mov eax, dword [0x10335870]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x100b91f2
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100b91b8
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x100b91eb
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x100b91d0
cmp ecx, 0x77798729
je 0x100b91f4
mov esi, dword [esi + 4]
test esi, esi
jne 0x100b91b0
xor esi, esi
push 0x103392a8
mov dword [0x103392b0], esi
call fcn.1014bb7e
add esp, 4
mov ecx, dword [0x103392b0]
mov eax, dword [ecx + 0x1c]
mov eax, dword [eax + 0x30]
xor eax, ecx
jne 0x100b9253
mov eax, dword [0x10335fb8]
cmp byte [eax + 0x17fe], 0
je 0x100b9253
mov eax, dword [0x10336270]
mov ecx, dword [eax + 8]
mov eax, dword [ecx + 0x25c]
sub eax, 8
je 0x100b9253
sub eax, 1
je 0x100b9253
sub eax, 1
je 0x100b9253
test byte [ecx + 0x104], 1
jne 0x100b9253
mov eax, dword [esp + 0xc]
and dword [eax + 0x30], 0xfffffffd
pop edi
pop esi
ret 4

Function at 0x100bb110
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov edx, ecx
mov dword [esp + 4], edx
push ebx
push ebp
push esi
push edi
test eax, eax
jne 0x100bb12f
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
xor esi, esi
xor ebx, ebx
mov dword [esp + 0x10], esi
cmp dword [eax + 4], ebx
jle 0x100bb1c5
mov ecx, dword [esp + 0x20]
xor ebp, ebp
mov edi, dword [eax]
mov eax, dword [edi + ebp + 0x28]
add edi, ebp
test eax, eax
je 0x100bb174
cmp dword [eax + 4], 0
jle 0x100bb174
push 0
push ecx
push eax
mov ecx, edx
call fcn.100bb110
mov ecx, eax
test ecx, ecx
je 0x100bb174
mov eax, dword [edi + 0x2c]
add eax, ecx
add esi, eax
mov dword [esp + 0x10], esi
mov edx, dword [edi]
mov eax, edx
lea esi, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100bb180
sub eax, esi
mov esi, 0x4fa38bcd
lea ecx, [eax + 1]
test ecx, ecx
je 0x100bb1a8
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, esi
imul esi, eax, 0xf1546419
sub ecx, 1
jne 0x100bb195
mov ecx, dword [esp + 0x20]
cmp esi, ecx
je 0x100bb1d1
mov eax, dword [esp + 0x1c]
inc ebx
mov esi, dword [esp + 0x10]
add ebp, 0x3c
mov edx, dword [esp + 0x14]
cmp ebx, dword [eax + 4]
jl 0x100bb146
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov eax, dword [edi + 0x2c]
add eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x100bb1f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [ecx + 4]
push esi
push edi
mov edi, dword [ecx]
cmp edi, ebp
je 0x100bb245
nop dword [eax]
mov ebx, dword [edi]
test ebx, ebx
je 0x100bb23e
mov edx, dword [ebx + 0xc]
mov eax, edx
lea esi, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100bb210
sub eax, esi
mov ecx, 0x4fa38bcd
lea esi, [eax + 1]
test esi, esi
je 0x100bb238
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub esi, 1
jne 0x100bb225
cmp ecx, dword [esp + 0x14]
je 0x100bb24e
add edi, 4
cmp edi, ebp
jne 0x100bb200
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 4
Function at 0x100c9330
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x103357d4]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x103392e8]
cmp eax, dword [ecx + 4]
jle 0x100c93c7
push 0x103392e8
call fcn.1014bbcf
add esp, 4
cmp dword [0x103392e8], 0xffffffff
jne 0x100c93c7
mov eax, dword [0x10335870]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x100c93b2
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100c9378
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x100c93ab
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x100c9390
cmp ecx, 0x8ff61511
je 0x100c93b4
mov esi, dword [esi + 4]
test esi, esi
jne 0x100c9370
xor esi, esi
push 0x103392e8
mov dword [0x103392f0], esi
call fcn.1014bb7e
add esp, 4
mov eax, dword [0x103392f0]
pop edi
pop esi
ret

Function at 0x100c95a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ab47d
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10242040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
call fcn.10018230
push dword [ebp + 0xc]
lea ecx, [esi + 0x18]
mov dword [ebp - 4], 0
call fcn.10018230
mov ecx, dword [ebp + 0x10]
movss xmm0, dword [ebp + 0x18]
movzx eax, byte [ecx]
mov byte [esi + 0x30], al
mov eax, dword [ecx + 4]
mov dword [esi + 0x34], eax
mov eax, dword [ecx + 8]
mov dword [esi + 0x38], eax
mov eax, dword [ecx + 0xc]
mov dword [esi + 0x3c], eax
mov eax, dword [ecx + 0x10]
mov dword [esi + 0x40], eax
movzx eax, byte [ecx + 0x14]
mov byte [esi + 0x44], al
movzx eax, byte [ecx + 0x15]
mov byte [esi + 0x45], al
mov eax, dword [ecx + 0x18]
mov dword [esi + 0x48], eax
movzx eax, byte [ecx + 0x1c]
mov byte [esi + 0x4c], al
mov eax, dword [ecx + 0x20]
mov dword [esi + 0x50], eax
movzx eax, byte [ecx + 0x24]
mov byte [esi + 0x54], al
mov eax, dword [ecx + 0x28]
mov dword [esi + 0x58], eax
mov eax, dword [ecx + 0x2c]
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x5c], eax
mov eax, dword [ecx]
mov dword [esi + 0x60], eax
mov eax, dword [ecx + 4]
mov dword [esi + 0x64], eax
mov eax, dword [ecx + 8]
mov dword [esi + 0x68], eax
mov eax, esi
movss dword [esi + 0x6c], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x100d41a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x103357d4]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10339314]
cmp eax, dword [ecx + 4]
jle 0x100d4237
push 0x10339314
call fcn.1014bbcf
add esp, 4
cmp dword [0x10339314], 0xffffffff
jne 0x100d4237
mov eax, dword [0x10335870]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x100d4222
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100d41e8
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x100d421b
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x100d4200
cmp ecx, 0xb5599648
je 0x100d4224
mov esi, dword [esi + 4]
test esi, esi
jne 0x100d41e0
xor esi, esi
push 0x10339314
mov dword [0x10339300], esi
call fcn.1014bb7e
add esp, 4
mov eax, dword [0x10339300]
pop edi
pop esi
ret

Function at 0x100d4240
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x103357d4]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1033931c]
cmp eax, dword [ecx + 4]
jle 0x100d42d7
push 0x1033931c
call fcn.1014bbcf
add esp, 4
cmp dword [0x1033931c], 0xffffffff
jne 0x100d42d7
mov eax, dword [0x10335870]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x100d42c2
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100d4288
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x100d42bb
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x100d42a0
cmp ecx, 0xb5599648
je 0x100d42c4
mov esi, dword [esi + 4]
test esi, esi
jne 0x100d4280
xor esi, esi
push 0x1033931c
mov dword [0x10339318], esi
call fcn.1014bb7e
add esp, 4
mov eax, dword [0x10339318]
pop edi
pop esi
ret
Function at 0x100d42e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x10336270]
push ebx
push esi
push edi
mov ecx, dword [eax + 0x14]
test ecx, ecx
je 0x100d43cc
mov eax, dword [ecx]
mov eax, dword [eax + 0x734]
call eax
mov ebx, eax
test ebx, ebx
je 0x100d43cc
mov ecx, dword fs:[0x2c]
mov edx, dword [0x103357d4]
mov edx, dword [ecx + edx*4]
mov ecx, dword [0x103392fc]
cmp ecx, dword [edx + 4]
jle 0x100d439c
push 0x103392fc
call fcn.1014bbcf
add esp, 4
cmp dword [0x103392fc], 0xffffffff
jne 0x100d439c
mov eax, dword [0x10335870]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x100d4387
mov edx, dword [esi + 0xc]
mov ecx, edx
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100d4350
sub ecx, edi
lea edi, [ecx + 1]
mov ecx, 0x4fa38bcd
test edi, edi
je 0x100d4380
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x100d4365
cmp ecx, 0xb5599648
je 0x100d4389
mov esi, dword [esi + 4]
test esi, esi
jne 0x100d4347
xor esi, esi
push 0x103392fc
mov dword [0x10339310], esi
call fcn.1014bb7e
add esp, 4
mov ecx, dword [0x10339310]
mov eax, dword [ecx + 0x1c]
mov eax, dword [eax + 0x30]
xor eax, ecx
movd xmm0, eax
mov eax, dword [0x1033582c]
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [eax + 0x20]
divss xmm0, dword [ebx + 0xdc]
cvttss2si eax, xmm0
inc eax
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
mov eax, 1
pop ebx
ret

Function at 0x100d4690
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x2c]
mov ecx, dword [0x103357d4]
push esi
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10339308]
cmp eax, dword [ecx + 4]
jle 0x100d4727
push 0x10339308
call fcn.1014bbcf
add esp, 4
cmp dword [0x10339308], 0xffffffff
jne 0x100d4727
mov eax, dword [0x10335870]
mov esi, dword [eax + 0x30]
test esi, esi
je 0x100d4712
mov edx, dword [esi + 0xc]
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100d46d8
sub eax, edi
mov ecx, 0x4fa38bcd
lea edi, [eax + 1]
test edi, edi
je 0x100d470b
nop dword [eax]
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub edi, 1
jne 0x100d46f0
cmp ecx, 0xb5599648
je 0x100d4714
mov esi, dword [esi + 4]
test esi, esi
jne 0x100d46d0
xor esi, esi
push 0x10339308
mov dword [0x1033930c], esi
call fcn.1014bb7e
add esp, 4
mov eax, dword [0x1033930c]
pop edi
pop esi
ret
Function at 0x100dbbf0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
mov dword [esp + 4], ecx
mov ecx, dword [0x103358dc]
push ebx
push ebp
push esi
mov eax, dword [ecx]
push edi
mov eax, dword [eax + 0x20]
call eax
mov ebx, eax
mov dword [esp + 0x10], eax
test ebx, ebx
je 0x100dbcd6
mov edx, dword [ebx + 8]
mov ecx, edx
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100dbc20
sub ecx, esi
lea esi, [ecx + 1]
mov ecx, 0x4fa38bcd
test esi, esi
je 0x100dbc48
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
imul ecx, eax, 0xf1546419
sub esi, 1
jne 0x100dbc35
cmp ecx, dword [esp + 0x1c]
jne 0x100dbcaa
mov edi, dword [ebx + 0xc]
xor ebx, ebx
mov ebp, dword [edi + 4]
test ebp, ebp
jle 0x100dbca6
mov edi, dword [edi]
nop dword [eax]
test edi, edi
je 0x100dbc9e
mov edx, dword [edi]
mov eax, edx
lea esi, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100dbc70
sub eax, esi
mov esi, 0x4fa38bcd
lea ecx, [eax + 1]
test ecx, ecx
je 0x100dbc98
movsx eax, byte [edx]
lea edx, [edx + 1]
xor eax, esi
imul esi, eax, 0xf1546419
sub ecx, 1
jne 0x100dbc85
cmp esi, dword [esp + 0x20]
je 0x100dbcc3
inc ebx
add edi, 0x3c
cmp ebx, ebp
jl 0x100dbc60
mov ebx, dword [esp + 0x10]
mov ebx, dword [ebx + 0x10]
mov dword [esp + 0x10], ebx
test ebx, ebx
jne 0x100dbc16
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov ecx, dword [esp + 0x14]
mov dword [ecx], edi
mov eax, dword [edi + 0x20]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x24]
mov dword [edi + 0x20], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x100e15d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ac7c9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x10242040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x10335fb8]
cmp dword [eax + 0x482a], 0
je 0x100e17d3
mov eax, dword fs:[0x2c]
mov ecx, dword [0x103357d4]
mov edi, dword [eax + ecx*4]
mov eax, dword [0x10335dc4]
cmp eax, dword [edi + 4]
jle 0x100e1670
push 0x10335dc4
call fcn.1014bbcf
add esp, 4
cmp dword [0x10335dc4], 0xffffffff
jne 0x100e1670
push ecx
push 0x2c0ffa6
mov dword [ebp - 4], 0
mov ecx, dword [0x10336104]
push 0xbbcce2b5
call fcn.100bb0f0
push 0x10335dc4
mov dword [0x10335dc0], eax
mov dword [ebp - 4], 0xffffffff
call fcn.1014bb7e
add esp, 4
mov ecx, dword [0x10335890]
mov eax, dword [0x10335dc0]
mov esi, dword [ebp + 0xc]
mov edx, dword [ecx]
push dword [eax + esi]
call dword [edx + 0x10]
mov ecx, dword [0x10336270]
mov esi, dword [ecx + 8]
test esi, esi
je 0x100e17d3
test eax, eax
je 0x100e17d3
cmp eax, esi
jne 0x100e17d3
mov eax, dword [0x10335858]
cmp eax, dword [edi + 4]
jle 0x100e1700
push 0x10335858
call fcn.1014bbcf
add esp, 4
cmp dword [0x10335858], 0xffffffff
jne 0x100e1700
push ecx
push 0xc4cbab11
mov dword [ebp - 4], 1
mov ecx, dword [0x10336104]
push 0x3a46cc70
call fcn.100bb0f0
push 0x10335858
mov dword [0x10335850], eax
mov dword [ebp - 4], 0xffffffff
call fcn.1014bb7e
add esp, 4
mov ecx, dword [0x10335890]
mov eax, dword [0x10335850]
mov edx, dword [ecx]
push dword [eax + esi]
call dword [edx + 0x10]
mov esi, eax
test esi, esi
je 0x100e17d3
mov ecx, dword [0x10335848]
cmp ecx, dword [edi + 4]
jle 0x100e1777
push 0x10335848
call fcn.1014bbcf
add esp, 4
cmp dword [0x10335848], 0xffffffff
jne 0x100e1777
push ecx
push 0x8d29f550
mov dword [ebp - 4], 2
mov ecx, dword [0x10336104]
push 0x19c23329
call fcn.100bb0f0
push 0x10335848
mov dword [0x1033584c], eax
mov dword [ebp - 4], 0xffffffff
call fcn.1014bb7e
add esp, 4
mov eax, dword [0x1033584c]
movsx ecx, word [eax + esi]
call fcn.100dec30
mov esi, eax
test esi, esi
je 0x100e17d3
cmp dword [esi + 0x14], 0xf
mov ebx, dword [ebp + 8]
jbe 0x100e1796
mov esi, dword [esi]
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100e17a0
sub ecx, edx
mov edi, 0x4fa38bcd
add ecx, 1
je 0x100e17c6
movsx eax, byte [esi]
lea esi, [esi + 1]
xor eax, edi
imul edi, eax, 0xf1546419
sub ecx, 1
jne 0x100e17b3
mov edx, dword [ebx + 8]
mov ecx, edi
call fcn.100e13e0
mov dword [ebx + 8], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8