joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b64d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
mov ebp, dword [ecx + 0x108]
push esi
mov eax, dword [ebx]
xor eax, dword [ecx + 0x100]
xor ebp, dword [ebx + 8]
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 0x104]
xor eax, dword [ebx + 4]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0xc]
xor eax, dword [ecx + 0x10c]
cmp byte [esp + 0x38], 0
push edi
jne 0x100b6515
movups xmm0, xmmword [ebx]
movups xmmword [esp + 0x24], xmm0
xor edx, edx
mov ebx, eax
mov dword [esp + 0x10], edx
jmp 0x100b6524
mov edx, dword [esp + 0x10]
mov eax, 0x1f
sub eax, edx
cmp byte [esp + 0x3c], 0
cmove edx, eax
and edx, 3
mov esi, dword [ecx + edx*4 + 0x100]
mov edx, ebx
rol edx, 0xb
add edx, ebp
xor edx, esi
mov eax, edx
shr eax, 0x10
movzx eax, al
movzx edi, byte [eax + ecx]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + ecx]
shl eax, 8
or edi, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl edi, 8
movzx eax, byte [eax + ecx]
or edi, eax
movzx eax, dl
mov edx, ebp
shl edi, 8
rol edx, 0x11
xor edx, ebx
movzx eax, byte [eax + ecx]
add edx, esi
or edi, eax
mov eax, edx
shr eax, 0x10
movzx eax, al
xor edi, dword [esp + 0x18]
movzx esi, byte [eax + ecx]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + ecx]
shl eax, 8
or esi, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + ecx]
or esi, eax
movzx eax, dl
shl esi, 8
mov edx, ebp
mov dword [esp + 0x18], edx
mov ebp, edi
movzx eax, byte [eax + ecx]
or esi, eax
mov eax, dword [esp + 0x10]
xor esi, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], ebx
mov ebx, esi
mov dword [esp + 0x10], eax
cmp eax, 0x20
jb 0x100b6520
mov ebx, dword [esp + 0x38]
mov eax, dword [ecx + 0x100]
xor eax, edi
mov dword [ebx], eax
mov eax, dword [ecx + 0x104]
xor eax, esi
mov dword [ebx + 4], eax
mov eax, dword [ecx + 0x108]
xor eax, edx
lea edx, [esp + 0x24]
mov dword [ebx + 8], eax
mov eax, dword [ecx + 0x10c]
xor eax, dword [esp + 0x14]
cmp byte [esp + 0x3c], 0
mov dword [ebx + 0xc], eax
cmovne edx, dword [esp + 0x38]
mov esi, dword [ecx + 0x100]
add edx, 2
mov edi, dword [ecx + 0x104]
mov ebx, dword [ecx + 0x108]
mov ebp, dword [ecx + 0x10c]
mov dword [esp + 0x3c], 4
nop word [eax + eax]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
xor esi, dword [eax*4 + 0x10119c00]
mov dword [ecx + 0x100], esi
movzx eax, byte [edx - 5]
xor edi, dword [eax*4 + 0x10119c00]
mov dword [ecx + 0x104], edi
movzx eax, byte [edx - 4]
xor ebx, dword [eax*4 + 0x10119c00]
mov dword [ecx + 0x108], ebx
movzx eax, byte [edx - 3]
xor ebp, dword [eax*4 + 0x10119c00]
sub dword [esp + 0x3c], 1
mov dword [ecx + 0x10c], ebp
jne 0x100b6650
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 8
Function at 0x100b7d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0xcc
push esi
movzx eax, dl
mov esi, ecx
push 0x40
push eax
lea eax, [esp + 0x18]
push eax
call fcn.100d9dc0
movups xmm0, xmmword [esi]
add esp, 0xc
mov eax, 0x10
pxor xmm0, xmmword [esp + 0x10]
movaps xmmword [esp + 0x10], xmm0
mov cl, byte [eax + esi]
xor byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x14
jb 0x100b7dc5
lea ecx, [esp + 0x50]
call fcn.100d5410
push 0x40
lea edx, [esp + 0x14]
lea ecx, [esp + 0x54]
call fcn.100d5530
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x50]
call fcn.100d52c0
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100b9490
Capabilities:
Encode data using xor

Disassembly:
movups xmm0, xmmword [0x100f7598]
mov dword [ecx + 0x400], 0
xor edx, edx
movups xmm1, xmmword [0x100f7588]
lea eax, [ecx + 0x24]
nop dword [eax]
movups xmmword [eax - 0x24], xmm1
lea eax, [eax + 0x80]
movups xmmword [eax - 0x94], xmm0
xor dword [eax - 0x9c], edx
inc edx
xor dword [eax - 0xa4], 0x2080020
xor dword [eax - 0x98], 0x20000000
mov dword [eax - 0x84], 0
mov dword [eax - 0x80], 0
mov dword [eax - 0x7c], 0
mov dword [eax - 0x78], 0
mov dword [eax - 0x34], 0
mov dword [eax - 0x30], 0
cmp edx, 8
jb 0x100b94b0
mov dword [ecx + 0x3f4], 0xffffffff
ret

Function at 0x100b9520
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
mov dword [ecx], 0x6a09e667
or eax, 0x2000
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
xor dword [ecx], 0x2080020
xor dword [ecx + 8], edx
shl eax, 0x10
xor dword [ecx + 0xc], eax
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov dword [ecx + 0x2c], 0
mov dword [ecx + 0x70], 0
mov dword [ecx + 0x74], 0
ret 4
Function at 0x100b9940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x18]
mov ebx, ecx
push edi
xor edi, edi
mov dword [esp + 0x10], ebx
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x100b9967
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret 0xc
add dword [esp + 0x18], 5
push ebp
lea ebp, [edx - 4]
add ebp, ebx
lea eax, [edi + ebx]
cmp eax, ebp
jae 0x100b998f
nop dword [eax]
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x100b998f
inc eax
cmp eax, ebp
jb 0x100b9980
mov edx, eax
sub edx, edi
mov edi, eax
sub edx, ebx
sub edi, ebx
cmp eax, ebp
jae 0x100b9a91
cmp edx, 2
jbe 0x100b9a1e
xor esi, esi
movzx edx, byte [eax + 4]
lea ecx, [edx + 1]
test cl, 0xfe
jne 0x100b9a80
movzx ecx, byte [eax + 3]
mov ebx, dword [esp + 0x1c]
shl edx, 8
add ebx, edi
or edx, ecx
movzx ecx, byte [eax + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 1]
shl edx, 8
or edx, ecx
mov ecx, edx
add edx, ebx
sub ecx, ebx
cmp dword [esp + 0x24], 0
cmove edx, ecx
mov dword [esp + 0x10], edx
mov ebx, edx
test esi, esi
je 0x100b9a52
and esi, 6
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x100b9a50
mov ebx, 0x100
shl ebx, cl
mov ecx, dword [esp + 0x1c]
dec ebx
xor ebx, dword [esp + 0x10]
add ecx, edi
cmp dword [esp + 0x24], 0
je 0x100b9a4e
add ebx, ecx
jmp 0x100b9a50
mov ecx, edx
shr esi, cl
test esi, esi
je 0x100b99a8
cmp esi, 4
ja 0x100b9a43
cmp esi, 3
je 0x100b9a43
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x100b99a8
or esi, 8
shr esi, 1
inc edi
jmp 0x100b9972
sub ebx, ecx
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov byte [eax + 4], bl
mov eax, 5
mov ebx, dword [esp + 0x14]
add edi, eax
jmp 0x100b9972
or esi, 8
mov eax, 1
shr esi, 1
add edi, eax
jmp 0x100b9972
mov eax, dword [esp + 0x20]
mov ecx, edx
shr esi, cl
xor ecx, ecx
cmp edx, 2
pop ebp
cmovbe ecx, esi
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 8
ret 0xc
Function at 0x100bb210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x38], edx
mov ebp, ecx
nop dword [eax]
mov edi, dword [ebp + 0x10]
cmp edi, 3
jae 0x100bb234
mov ecx, ebp
call fcn.100bd060
jmp 0x100bb3b3
mov ecx, dword [ebp]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
movzx edx, byte [ecx]
movzx eax, byte [ecx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 1]
xor edx, dword [ebp + eax*4 + 0x60]
mov eax, dword [ebp + 0x24]
movzx ecx, dx
mov ebx, dword [eax + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ebp + 4]
mov dword [ecx], eax
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x28]
mov esi, dword [ebp]
mov dword [esp + 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x10], esi
mov esi, dword [ebp + 4]
mov dword [esp + 0x20], esi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
lea ecx, [ecx + eax*8]
mov eax, esi
mov dword [esp + 0x14], ecx
mov esi, dword [esp + 0x24]
lea edx, [ecx + 4]
sub eax, esi
mov dword [esp + 0x18], edx
cmp esi, dword [esp + 0x20]
sbb esi, esi
and esi, eax
mov dword [esp + 0x34], esi
cmp esi, ebx
mov esi, dword [esp + 0x10]
jae 0x100bb38e
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x40]
sub ecx, ebx
cmp dword [esp + 0x3c], ecx
sbb eax, eax
sub esi, ecx
and eax, dword [esp + 0x24]
sub eax, ecx
mov dword [esp + 0x44], esi
add eax, dword [esp + 0x3c]
lea edx, [edx + eax*8]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x28]
mov eax, edx
cmp dword [esp + 0x2c], edx
mov edx, dword [esp + 0x10]
cmovb eax, dword [esp + 0x2c]
mov cl, byte [eax + esi]
cmp cl, byte [eax + edx]
mov edx, dword [esp + 0x1c]
jne 0x100bb344
inc eax
cmp eax, edi
je 0x100bb329
mov ecx, dword [esp + 0x10]
sub esi, ecx
lea edx, [eax + ecx]
mov cl, byte [esi + edx]
cmp cl, byte [edx]
jne 0x100bb33c
inc eax
inc edx
cmp eax, edi
jne 0x100bb318
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [edx + 4]
mov dword [ecx], eax
jmp 0x100bb39a
mov esi, dword [esp + 0x44]
mov edx, dword [esp + 0x1c]
mov cl, byte [eax + esi]
mov esi, dword [esp + 0x10]
cmp cl, byte [eax + esi]
jae 0x100bb369
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x28], eax
mov dword [ecx], ebx
lea ecx, [edx + 4]
mov ebx, dword [ecx]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x14], ecx
jmp 0x100bb37d
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], edx
mov dword [esp + 0x2c], eax
mov dword [ecx], ebx
mov ebx, dword [edx]
mov ecx, dword [esp + 0x14]
sub dword [esp + 0x30], 1
je 0x100bb38e
cmp dword [esp + 0x34], ebx
jb 0x100bb2c4
mov dword [ecx], 0
mov dword [edx], 0
mov eax, dword [ebp + 4]
inc dword [ebp + 0x14]
inc eax
inc dword [ebp]
mov dword [ebp + 4], eax
cmp eax, dword [ebp + 8]
jne 0x100bb3b3
mov ecx, ebp
call fcn.100bcad0
sub dword [esp + 0x38], 1
jne 0x100bb220
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret
Function at 0x100bc0b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x20
push ebx
mov ebx, ecx
push esi
push edi
mov edi, edx
mov esi, dword [ebx + 0x10]
mov dword [esp + 0x24], esi
cmp esi, 3
jae 0x100bc0d4
call fcn.100bd060
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x20
ret
mov ecx, dword [ebx]
push ebp
movzx edx, byte [ecx]
movzx eax, byte [ecx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 1]
xor edx, dword [ebx + eax*4 + 0x60]
mov eax, dword [ebx + 0x24]
movzx ecx, dx
mov edx, dword [eax + ecx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, 2
mov eax, dword [ebx + 0x30]
mov ebp, dword [ebx]
mov dword [esp + 0x1c], eax
mov eax, dword [ebx + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 4]
mov esi, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
mov dword [esi + eax*4], edx
test edx, edx
je 0x100bc1c7
mov esi, dword [esp + 0x20]
sub esi, edx
mov edx, dword [esp + 0x24]
cmp esi, edx
jae 0x100bc1c7
cmp eax, esi
sbb eax, eax
and eax, edx
mov edx, dword [esp + 0x14]
sub eax, esi
add eax, dword [esp + 0x10]
mov eax, dword [edx + eax*4]
mov edx, ebp
sub edx, esi
mov dword [esp + 0x2c], eax
mov al, byte [ecx + ebp]
cmp al, byte [edx + ecx]
jne 0x100bc1a8
mov cl, byte [ebp]
mov eax, ebp
cmp cl, byte [edx]
jne 0x100bc18d
mov edx, dword [esp + 0x28]
inc eax
lea ecx, [edx + ebp]
cmp eax, ecx
je 0x100bc1bc
mov cl, byte [eax]
mov edx, eax
sub edx, esi
cmp cl, byte [edx]
je 0x100bc177
mov ecx, dword [esp + 0x18]
sub eax, ebp
cmp ecx, eax
jae 0x100bc1a8
mov ecx, eax
mov dword [edi], eax
lea eax, [esi - 1]
mov dword [esp + 0x18], ecx
mov dword [edi + 4], eax
add edi, 8
sub dword [esp + 0x1c], 1
je 0x100bc1c7
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
jmp 0x100bc135
lea eax, [esi - 1]
mov dword [edi], edx
mov dword [edi + 4], eax
add edi, 8
mov ecx, dword [ebx + 4]
inc dword [ebx + 0x14]
inc ecx
inc dword [ebx]
mov dword [ebx + 4], ecx
pop ebp
cmp ecx, dword [ebx + 8]
jne 0x100bc1e0
mov ecx, ebx
call fcn.100bcad0
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x20
ret
Function at 0x100bc1f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
mov ebx, edx
push edi
mov dword [esp + 0x14], esi
nop
cmp dword [esi + 0x10], 3
jae 0x100bc210
mov ecx, esi
call fcn.100bd060
dec ebx
jmp 0x100bc28e
mov ebp, dword [esi + 8]
mov edi, dword [esi + 4]
sub ebp, edi
mov ecx, dword [esi + 0x14]
cmp ebx, ebp
mov eax, dword [esi + 0x28]
cmovbe ebp, ebx
sub ebx, ebp
mov dword [esp + 0x18], ebx
lea ebx, [eax + ecx*4]
lea eax, [ecx + ebp]
mov ecx, dword [esi + 0x24]
mov dword [esi + 0x14], eax
mov eax, dword [esi]
mov dword [esp + 0x10], ecx
nop dword [eax + eax]
movzx ecx, byte [eax + 2]
lea edx, [eax + 1]
movzx eax, byte [eax]
lea ebx, [ebx + 4]
shl eax, 8
or ecx, eax
movzx eax, byte [edx]
xor ecx, dword [esi + eax*4 + 0x60]
mov esi, dword [esp + 0x10]
movzx eax, cx
mov ecx, dword [esp + 0x10]
mov ecx, dword [ecx + eax*4]
mov dword [esi + eax*4], edi
inc edi
mov esi, dword [esp + 0x14]
mov eax, edx
mov dword [ebx - 4], ecx
sub ebp, 1
jne 0x100bc240
mov ebx, dword [esp + 0x18]
mov dword [esi], eax
mov dword [esi + 4], edi
cmp edi, dword [esi + 8]
jne 0x100bc28e
mov ecx, esi
call fcn.100bcad0
test ebx, ebx
jne 0x100bc200
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x100bcb60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov dword [ecx + 0x34], 0
lea esi, [ecx + 0x60]
mov word [ecx + 0x1e], 0
xor edx, edx
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x468], 0xffffffff
mov dword [ecx + 0x46c], 0xffffffff
mov dword [ecx + 0x30], 0x20
mov byte [ecx + 0x1d], 1
mov dword [ecx + 0x48], 4
mov ecx, edx
lea esi, [esi + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [esi - 4], eax
cmp edx, 0x100
jb 0x100bcba0
pop esi
ret
Function at 0x100c5600
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
push ebp
mov ebp, ecx
mov ebx, edx
mov ecx, dword [esp + 0x1c]
push esi
push edi
mov edi, dword [esp + 0x28]
movzx esi, word [ecx]
mov eax, esi
mov dword [esp + 0x14], ebx
xor eax, 0x7f0
shr esi, 4
shr eax, 4
mov dword [esp + 0x10], ebp
mov edx, dword [edi + esi*4]
mov eax, dword [edi + eax*4]
mov dword [esp + 0x28], eax
movzx eax, word [ecx + 0x10]
mov esi, dword [esp + 0x28]
shr eax, 4
mov dword [esp + 0x1c], edx
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [esp + 0x18], eax
test ebx, ebx
je 0x100c5698
lea ebx, [ebp + 4]
mov esi, ecx
mov ebp, dword [esp + 0x14]
nop word [eax + eax]
push edi
push ebx
mov ecx, esi
call fcn.100c75e0
mov edx, dword [esp + 0x18]
lea eax, [ebx + 0x20]
push edi
push eax
lea ecx, [esi + 0x10]
call fcn.100c75e0
mov edx, dword [esp + 0x1c]
add ebx, 0x440
add esi, 0x20
sub ebp, 1
jne 0x100c5660
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x10]
mov ebx, dword [ebp]
cmp ebx, 0x10
jbe 0x100c5772
lea eax, [ebp + 0x44]
add ebx, 0xfffffff1
mov dword [esp + 0x18], eax
movzx eax, word [ecx + 0x10]
xor eax, 0x7f0
shr ebx, 1
shr eax, 4
lea ebp, [ebx + 0x180]
add esi, dword [edi + eax*4]
lea ebp, [ecx + ebp*2]
mov dword [esp + 0x28], esi
nop dword [eax]
dec ebx
lea ebp, [ebp - 2]
mov dword [esp + 0x1c], ebx
lea eax, [ebx + 0x80]
mov ebx, dword [esp + 0x24]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x200]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
add esi, dword [edi + ecx*4]
cmp eax, 2
jae 0x100c56e2
movzx ecx, word [ebp]
mov ebx, dword [esp + 0x1c]
mov eax, ecx
mov edx, dword [esp + 0x18]
xor ecx, 0x7f0
shr eax, 4
shr ecx, 4
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [edx + ebx*8], eax
mov eax, dword [edi + ecx*4]
add eax, esi
mov esi, dword [esp + 0x28]
mov dword [edx + ebx*8 + 4], eax
test ebx, ebx
jne 0x100c56d0
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
lea ebx, [eax*4 - 0x40]
mov eax, dword [esp + 0x14]
cmp eax, 1
jbe 0x100c5772
add esi, 0x484
lea edi, [eax - 1]
push ebx
push edx
push esi
call fcn.100d8b00
mov edx, dword [esp + 0x24]
add esp, 0xc
add esi, 0x440
sub edi, 1
jne 0x100c5758
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8

Function at 0x100c5840
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
xor eax, eax
push esi
push edi
mov edi, ecx
or edx, 0x100
mov esi, edx
shr edx, 1
and esi, 1
neg esi
shr esi, 4
movzx ecx, word [edi + edx*2]
and esi, 0x7f
shr ecx, 4
xor ecx, esi
add eax, dword [ebx + ecx*4]
cmp edx, 2
jae 0x100c5851
pop edi
pop esi
pop ebx
ret 4
Function at 0x100c5880
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, 0x100
xor ebx, ebx
push edi
mov edi, dword [esp + 0x14]
mov ebp, ecx
or edx, esi
add edi, edi
mov ecx, esi
and ecx, edi
mov eax, edx
shr eax, 8
add ecx, esi
add eax, ecx
movzx ecx, word [ebp + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
shr eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [esp + 0x18]
add ebx, dword [eax + ecx*4]
mov ecx, edx
xor ecx, edi
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x100c5893
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 8
Function at 0x100c6990
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x48
mov eax, ecx
mov edx, 0x1cbd0
push ebx
mov eax, dword [eax]
call eax
mov ebx, eax
mov dword [esp + 8], ebx
test ebx, ebx
je 0x100c6b24
push ebp
push esi
lea esi, [ebx + 0x270]
mov dword [ebx + 0x7c], 0
push edi
mov ecx, esi
mov dword [ebx + 0x78], 0
call fcn.100bcb60
lea ecx, [ebx + 0xd8]
mov dword [ebx + 0x26c], esi
call fcn.100bdf50
xorps xmm0, xmm0
mov dword [esp + 0x18], 5
lea edx, [esp + 0x18]
mov dword [esp + 0x3c], 0
mov ecx, ebx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x48], 0xffffffff
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x40], 0
movlpd qword [esp + 0x50], xmm0
call fcn.100c7240
lea ebp, [ebx + 0x2cb0]
mov eax, 2
mov word [ebp], 0x100
add ebp, 2
mov dword [esp + 0x10], eax
nop dword [eax + eax]
mov ecx, eax
mov ebx, 1
shr ecx, 1
dec ecx
shl ebx, cl
test ebx, ebx
je 0x100c6aaf
movzx eax, al
mov ecx, ebx
mov esi, ecx
imul eax, eax, 0x1010101
shr ecx, 2
mov edi, ebp
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
inc eax
add ebp, ebx
mov dword [esp + 0x10], eax
cmp eax, 0x16
jb 0x100c6a80
mov ebp, dword [esp + 0x14]
mov edi, 8
lea ebx, [ebp + 0x760]
nop word [eax + eax]
xor edx, edx
mov eax, edi
lea esi, [edx + 4]
nop word [eax + eax]
imul eax, eax
add edx, edx
cmp eax, 0x10000
jb 0x100c6afa
nop dword [eax]
shr eax, 1
inc edx
cmp eax, 0x10000
jae 0x100c6af0
sub esi, 1
jne 0x100c6ae0
mov eax, 0xa1
add edi, 0x10
sub eax, edx
mov dword [ebx], eax
add ebx, 4
cmp edi, 0x808
jb 0x100c6ad0
pop edi
mov dword [ebp + 0x50], esi
mov eax, ebp
mov dword [ebp + 0x1bcb8], esi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret
Function at 0x100c6ca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movaps xmm0, xmmword [0x100f76a0]
push ebx
push esi
mov esi, ecx
mov ebx, 0x400
push edi
mov edi, 0xc
mov dword [esi + 0x2c], 0
lea edx, [esi + 0x1e68]
mov dword [esi + 0x44], 1
mov dword [esi + 0x40], 1
mov dword [esi + 0x3c], 1
mov dword [esi + 0x38], 1
mov eax, dword [esi + 0x78]
mov dword [esi + 0x70], eax
lea eax, [esi + 0x2030]
mov dword [esi + 0x58], 0xffffffff
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
movups xmmword [esi + 0x1e30], xmm0
movups xmmword [esi + 0x1e40], xmm0
mov ecx, 0x10
nop word [eax + eax]
mov word [eax - 0x180], bx
mov word [eax], bx
add eax, 2
sub ecx, 1
jne 0x100c6d50
mov word [edx - 0x18], bx
mov word [edx], bx
mov word [edx + 0x18], bx
mov word [edx + 0x30], bx
add edx, 2
sub edi, 1
jne 0x100c6d41
mov eax, 0x4000400
lea edi, [esi + 0x21b0]
mov ecx, 0x80
rep stosd dword es:[edi], eax
lea edi, [esi + 0x23b0]
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov ecx, dword [esi + 0x94]
mov eax, 0x300
add ecx, dword [esi + 0x98]
shl eax, cl
test eax, eax
je 0x100c6dc2
mov edi, dword [esi + 0x50]
mov ecx, eax
shr ecx, 1
mov eax, 0x4000400
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, 0x4000400
lea edi, [esi + 0x24b0]
mov ecx, 0x80
rep stosd dword es:[edi], eax
lea edi, [esi + 0x26b0]
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov ecx, 0x80
lea edi, [esi + 0x28b0]
rep stosd dword es:[edi], eax
lea edi, [esi + 0x2ab0]
mov ecx, 0x80
rep stosd dword es:[edi], eax
mov dword [esi + 0x1c], 0
lea eax, [esi + 0xbcb8]
mov dword [esi + 0x18], 0
mov ecx, 0x800
mov dword [eax], 0x40000000
lea eax, [eax + 0x20]
sub ecx, 1
jne 0x100c6e14
mov dword [esi + 0x34], ecx
mov eax, 1
mov ecx, dword [esi + 0x9c]
mov edx, 0x100
shl eax, cl
mov ecx, dword [esi + 0x94]
dec eax
mov dword [esi + 0x4c], eax
mov eax, edx
shr eax, cl
mov ecx, dword [esi + 0x98]
shl edx, cl
sub edx, eax
pop edi
mov dword [esi + 0x48], edx
pop esi
pop ebx
ret

Function at 0x100c75e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
xor ebx, ebx
mov dword [esp + 0xc], edx
mov edx, ecx
push esi
push edi
mov dword [esp + 0x10], edx
mov edi, ebx
mov esi, ebx
shr esi, 2
shr edi, 1
mov eax, edi
and eax, 1
movzx ecx, word [edx + esi*2 + 4]
neg eax
shr eax, 4
neg esi
and eax, 0x7f
shr ecx, 4
xor ecx, eax
and esi, 0x7f0
movzx eax, word [edx + 2]
xor esi, eax
mov eax, dword [esp + 0x10]
shr esi, 4
mov edx, dword [ebp + ecx*4]
movzx ecx, word [eax + edi*2 + 8]
add edx, dword [ebp + esi*4]
mov eax, ecx
add edx, dword [esp + 0x14]
xor ecx, 0x7f0
mov esi, dword [esp + 0x1c]
shr eax, 4
shr ecx, 4
mov eax, dword [ebp + eax*4]
add eax, edx
mov dword [esi + ebx*4], eax
mov eax, dword [ebp + ecx*4]
add eax, edx
mov edx, dword [esp + 0x10]
mov dword [esi + ebx*4 + 4], eax
add ebx, 2
cmp ebx, 8
jb 0x100c75f7
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8