joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014132
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x24]
mov ecx, dword [0x1004a578]
test ecx, ecx
jne 0x100141f4
mov esi, dword [0x1004a568]
test esi, esi
jne 0x10014164
mov ecx, 0xf8f45725
call fcn.10014543
mov esi, eax
mov dword [0x1004a568], eax
mov dword [esp + 2], 0x60e1314
mov word [esp + 6], 0x240a
mov byte [esp + 8], 0
mov word [esp], 0x2c6c
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x5e
xor byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x10014181
mov byte [esp + 8], 0
mov ecx, dword [0x1004a56c]
test ecx, ecx
jne 0x100141af
mov ecx, 0x53b2070f
call fcn.10014543
mov ecx, eax
mov dword [0x1004a56c], eax
mov dword [esp + 0xe], 0xf070f12
mov word [esp + 0x12], 0x5757
mov byte [esp + 0x14], 0
mov word [esp + 0xc], 0x3a6b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x5e
xor byte [esp + eax + 0xc], dl
inc eax
cmp eax, 8
jne 0x100141cd
lea eax, [esp + 0xc]
mov byte [eax + 8], 0
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a578], eax
push edi
call ecx
add esp, 0x18
pop esi
pop edi
ret 4

Function at 0x100142ca
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
mov ecx, dword [0x1004a57c]
test ecx, ecx
jne 0x100143b3
mov esi, dword [0x1004a568]
test esi, esi
jne 0x10014312
mov ecx, 0xf8f45725
call fcn.10014543
mov esi, eax
mov dword [0x1004a568], eax
mov dword [esp + 0x1c], 0x151b17
movaps xmm0, xmmword [0x1003fae0]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x5e
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x13
jne 0x10014329
mov byte [esp + 0x1f], 0
mov ecx, dword [0x1004a56c]
test ecx, ecx
jne 0x10014358
mov ecx, 0x53b2070f
call fcn.10014543
mov ecx, eax
mov dword [0x1004a56c], eax
mov dword [esp + 2], 0xf070f12
mov word [esp + 6], 0x5757
mov byte [esp + 8], 0
mov word [esp], 0x3a6b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x5e
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10014375
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a57c], eax
mov esi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov ebx, dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x48]
push eax
push ebx
push edx
push edi
push ebp
push esi
push dword [esp + 0x50]
push dword [esp + 0x50]
call ecx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 0x20
Function at 0x10014454
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov ebp, dword [esp + 0x48]
mov ebx, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
mov esi, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ecx, dword [0x1004a580]
test ecx, ecx
jne 0x10014531
mov esi, dword [0x1004a568]
test esi, esi
jne 0x1001449c
mov ecx, 0xf8f45725
call fcn.10014543
mov esi, eax
mov dword [0x1004a568], eax
mov dword [esp + 0x1c], 0x20e06
movaps xmm0, xmmword [0x1003faf0]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x5e
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x13
jne 0x100144b3
mov byte [esp + 0x1f], 0
mov ecx, dword [0x1004a56c]
test ecx, ecx
jne 0x100144e2
mov ecx, 0x53b2070f
call fcn.10014543
mov ecx, eax
mov dword [0x1004a56c], eax
mov dword [esp + 2], 0xf070f12
mov word [esp + 6], 0x5757
mov byte [esp + 8], 0
mov word [esp], 0x3a6b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x5e
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x100144ff
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a580], eax
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
push ebp
push ebx
push edi
push esi
push edx
push eax
call ecx
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret 0x18

Function at 0x10014543
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0xc], ecx
mov eax, dword [0x1004a564]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + 0x14]
add edi, 0x14
mov eax, dword [esi + 0x10]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x10014605
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x10014605
cmp word [eax + ecx + 0x14], 0x60
jb 0x10014605
cmp dword [eax + ecx + 0x74], 0
je 0x10014605
mov edx, dword [eax + ecx + 0x78]
mov ecx, edx
mov dword [esp], edx
test edx, edx
je 0x10014605
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x18]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x10014605
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x20]
add ecx, eax
mov dword [esp + 8], ecx
lea ecx, [eax + 1]
mov dword [esp + 4], ecx
xor ebx, ebx
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + ebx*4]
mov dl, byte [eax + ecx]
test dl, dl
je 0x100145ed
add ecx, dword [esp + 4]
mov ebp, 0x811c9dc5
movsx edx, dl
xor edx, ebp
imul ebp, edx, 0x1000193
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x100145d9
jmp 0x100145f2
mov ebp, 0x811c9dc5
cmp ebp, dword [esp + 0xc]
je 0x10014601
inc ebx
cmp ebx, dword [esp + 0x10]
jne 0x100145c2
jmp 0x10014605
test eax, eax
jne 0x10014619
mov esi, dword [esi]
cmp esi, edi
jne 0x1001455f
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp]
mov ecx, dword [eax + edx + 0x24]
add ecx, eax
mov edx, dword [eax + edx + 0x1c]
add edx, eax
movzx ecx, word [ecx + ebx*2]
add eax, dword [edx + ecx*4]
jmp 0x10014611
Function at 0x1001464e
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x34]
mov eax, dword [0x1004a590]
test eax, eax
jne 0x10014715
mov esi, dword [0x1004a588]
test esi, esi
jne 0x1001467f
mov ecx, 0xf8f45725
call fcn.100147f2
mov esi, eax
mov dword [0x1004a588], eax
mov dword [esp + 0x1c], 0x755c626c
mov dword [esp + 0x20], 0x7b7a6672
mov word [esp + 0x24], 0x7b
movaps xmm0, xmmword [0x1003fb00]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xfd
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x19
jne 0x100146a5
mov byte [esp + 0x25], 0
mov ecx, dword [0x1004a58c]
test ecx, ecx
jne 0x100146d4
mov ecx, 0x53b2070f
call fcn.100147f2
mov ecx, eax
mov dword [0x1004a58c], eax
mov dword [esp + 2], 0x6e646e8d
mov word [esp + 6], 0x3630
mov byte [esp + 8], 0
mov word [esp], 0x9b6b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xfd
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x100146f1
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov dword [0x1004a590], eax
push edi
call eax
add esp, 0x28
pop esi
pop edi
ret 4

Function at 0x10014728
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x24
mov edi, dword [esp + 0x30]
mov eax, dword [0x1004a594]
test eax, eax
jne 0x100147e7
mov esi, dword [0x1004a588]
test esi, esi
jne 0x10014759
mov ecx, 0xf8f45725
call fcn.100147f2
mov esi, eax
mov dword [0x1004a588], eax
mov dword [esp + 0x1c], 0x7f667a6e
mov word [esp + 0x20], 0x7f
movaps xmm0, xmmword [0x1003fb10]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xfd
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x15
jne 0x10014777
mov byte [esp + 0x21], 0
mov ecx, dword [0x1004a58c]
test ecx, ecx
jne 0x100147a6
mov ecx, 0x53b2070f
call fcn.100147f2
mov ecx, eax
mov dword [0x1004a58c], eax
mov dword [esp + 2], 0x6e646e8d
mov word [esp + 6], 0x3630
mov byte [esp + 8], 0
mov word [esp], 0x9b6b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xfd
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x100147c3
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov dword [0x1004a594], eax
push edi
call eax
add esp, 0x24
pop esi
pop edi
ret 4
Function at 0x100147f2
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0xc], ecx
mov eax, dword [0x1004a584]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + 0x14]
add edi, 0x14
mov eax, dword [esi + 0x10]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x100148b4
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x100148b4
cmp word [eax + ecx + 0x14], 0x60
jb 0x100148b4
cmp dword [eax + ecx + 0x74], 0
je 0x100148b4
mov edx, dword [eax + ecx + 0x78]
mov ecx, edx
mov dword [esp], edx
test edx, edx
je 0x100148b4
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x18]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x100148b4
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x20]
add ecx, eax
mov dword [esp + 8], ecx
lea ecx, [eax + 1]
mov dword [esp + 4], ecx
xor ebx, ebx
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + ebx*4]
mov dl, byte [eax + ecx]
test dl, dl
je 0x1001489c
add ecx, dword [esp + 4]
mov ebp, 0x811c9dc5
movsx edx, dl
xor edx, ebp
imul ebp, edx, 0x1000193
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10014888
jmp 0x100148a1
mov ebp, 0x811c9dc5
cmp ebp, dword [esp + 0xc]
je 0x100148b0
inc ebx
cmp ebx, dword [esp + 0x10]
jne 0x10014871
jmp 0x100148b4
test eax, eax
jne 0x100148c8
mov esi, dword [esi]
cmp esi, edi
jne 0x1001480e
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp]
mov ecx, dword [eax + edx + 0x24]
add ecx, eax
mov edx, dword [eax + edx + 0x1c]
add edx, eax
movzx ecx, word [ecx + ebx*2]
add eax, dword [edx + ecx*4]
jmp 0x100148c0

Function at 0x100148f4
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
push eax
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
sub esp, 0x1c
xor ecx, ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], ecx
movaps xmm0, xmmword [0x1003fb20]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
call fcn.100012a6
cmp eax, 0xffffffff
je 0x1001495c
mov esi, eax
push 0
push eax
call fcn.10014966
cmp eax, 0xffffffff
je 0x10014947
mov ecx, esp
push 0
push ecx
push eax
push edi
push esi
call fcn.10014a3e
xor edi, edi
test eax, eax
jne 0x1001494e
call fcn.100013b0
mov edi, eax
push esi
call fcn.1000164e
mov eax, edi
add esp, 4
pop esi
pop edi
ret
add esp, 4
pop esi
pop edi
jmp fcn.100013b0
Function at 0x10014966
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [0x1004a5a4]
test ecx, ecx
jne 0x10014a30
mov esi, dword [0x1004a59c]
test esi, esi
jne 0x1001499d
mov ecx, 0xf8f45725
call fcn.100153e4
mov esi, eax
mov dword [0x1004a59c], eax
mov dword [esp + 0xe], 0xcdc9d9ea
mov dword [esp + 0x12], 0xdfcdf0c7
mov word [esp + 0x16], 0xc3
mov word [esp + 0xc], 0xf847
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x9c
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xb
jne 0x100149be
mov byte [esp + 0x17], 0
mov ecx, dword [0x1004a5a0]
test ecx, ecx
jne 0x100149ed
mov ecx, 0x53b2070f
call fcn.100153e4
mov ecx, eax
mov dword [0x1004a5a0], eax
mov dword [esp + 2], 0xcdc5f1ec
mov word [esp + 6], 0x9191
mov byte [esp + 8], 0
mov word [esp], 0xf86b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x9c
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10014a0a
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a5a4], eax
push ebx
push edi
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
ret 8

Function at 0x10014a3e
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
mov ebp, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x1004a5a8]
test ecx, ecx
jne 0x10014b1a
mov esi, dword [0x1004a59c]
test esi, esi
jne 0x10014a82
mov ecx, 0xf8f45725
call fcn.100153e4
mov esi, eax
mov dword [0x1004a59c], eax
mov dword [esp + 2], 0xc8e6fbff
mov word [esp + 6], 0xc6ce
mov byte [esp + 8], 0
mov word [esp], 0xf852
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x9c
xor byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x10014a9f
mov byte [esp + 8], 0
mov ecx, dword [0x1004a5a0]
test ecx, ecx
jne 0x10014acd
mov ecx, 0x53b2070f
call fcn.100153e4
mov ecx, eax
mov dword [0x1004a5a0], eax
mov dword [esp + 0xe], 0xcdc5f1ec
mov word [esp + 0x12], 0x9191
mov byte [esp + 0x14], 0
mov word [esp + 0xc], 0xf86b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x9c
xor byte [esp + eax + 0xc], dl
inc eax
cmp eax, 8
jne 0x10014aeb
lea eax, [esp + 0xc]
mov byte [eax + 8], 0
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a5a8], eax
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
push ebx
push edi
push ebp
push edx
push eax
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x10014b2c
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
sub esp, 0x1c
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
movaps xmm0, xmmword [0x1003fb30]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
call fcn.100012a6
cmp eax, 0xffffffff
je 0x10014bb5
push eax
call fcn.1000164e
test ebp, ebp
je 0x10014bc1
sub esp, 0x1c
xor esi, esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], esi
movaps xmm0, xmmword [0x1003fb30]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
call fcn.100012a6
cmp eax, 0xffffffff
je 0x10014bc6
mov edi, eax
mov eax, esp
push 0
push eax
push ebp
push ebx
push edi
call fcn.1000156a
test eax, eax
jne 0x10014bad
call fcn.100013b0
mov esi, eax
push edi
call fcn.1000164e
jmp 0x10014bcd
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.100013b0
xor esi, esi
inc esi
jmp 0x10014bcd
call fcn.100013b0
mov esi, eax
mov eax, esi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10014c7e
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov ebp, dword [esp + 0x40]
mov ebx, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
mov ecx, dword [0x1004a5ac]
test ecx, ecx
jne 0x10014d48
mov esi, dword [0x1004a59c]
test esi, esi
jne 0x10014cba
mov ecx, 0xf8f45725
call fcn.100153e4
mov esi, eax
mov dword [0x1004a59c], eax
mov dword [esp + 0x1c], 0xf8d6e8df
mov byte [esp + 0x20], 0
movaps xmm0, xmmword [0x1003fb50]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x9c
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x14
jne 0x10014cd6
mov byte [esp + 0x20], 0
mov ecx, dword [0x1004a5a0]
test ecx, ecx
jne 0x10014d05
mov ecx, 0x53b2070f
call fcn.100153e4
mov ecx, eax
mov dword [0x1004a5a0], eax
mov dword [esp + 2], 0xcdc5f1ec
mov word [esp + 6], 0x9191
mov byte [esp + 8], 0
mov word [esp], 0xf86b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x9c
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10014d22
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a5ac], eax
push ebp
push ebx
push edi
call ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x10014eaa
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x2c]
mov ecx, dword [0x1004a5b0]
test ecx, ecx
jne 0x10014f69
mov esi, dword [0x1004a59c]
test esi, esi
jne 0x10014edc
mov ecx, 0xf8f45725
call fcn.100153e4
mov esi, eax
mov dword [0x1004a59c], eax
mov word [esp + 0x1c], 0xfadf
mov byte [esp + 0x1e], 0
movaps xmm0, xmmword [0x1003fb50]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x9c
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x12
jne 0x10014ef7
mov byte [esp + 0x1e], 0
mov ecx, dword [0x1004a5a0]
test ecx, ecx
jne 0x10014f26
mov ecx, 0x53b2070f
call fcn.100153e4
mov ecx, eax
mov dword [0x1004a5a0], eax
mov dword [esp + 2], 0xcdc5f1ec
mov word [esp + 6], 0x9191
mov byte [esp + 8], 0
mov word [esp], 0xf86b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x9c
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10014f43
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a5b0], eax
push edi
call ecx
add esp, 0x20
pop esi
pop edi
ret 4

Function at 0x10014f78
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov ecx, dword [0x1004a5b4]
test ecx, ecx
jne 0x10015048
mov esi, dword [0x1004a59c]
test esi, esi
jne 0x10014faf
mov ecx, 0xf8f45725
call fcn.100153e4
mov esi, eax
mov dword [0x1004a59c], eax
mov dword [esp + 0xe], 0xc8e6fbf0
mov dword [esp + 0x12], 0xe3d0d0d0
mov dword [esp + 0x16], 0xfecdcbcf
mov byte [esp + 0x1a], 0
mov word [esp + 0xc], 0xf446
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x9c
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xe
jne 0x10014fd6
mov byte [esp + 0x1a], 0
mov ecx, dword [0x1004a5a0]
test ecx, ecx
jne 0x10015005
mov ecx, 0x53b2070f
call fcn.100153e4
mov ecx, eax
mov dword [0x1004a5a0], eax
mov dword [esp + 2], 0xcdc5f1ec
mov word [esp + 6], 0x9191
mov byte [esp + 8], 0
mov word [esp], 0xf86b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x9c
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10015022
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a5b4], eax
push ebx
push edi
call ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
ret 8
Function at 0x10015056
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov ecx, dword [0x1004a5b8]
test ecx, ecx
jne 0x10015121
mov esi, dword [0x1004a59c]
test esi, esi
jne 0x1001508d
mov ecx, 0xf8f45725
call fcn.100153e4
mov esi, eax
mov dword [0x1004a59c], eax
mov dword [esp + 0xe], 0xc4eefbf0
mov dword [esp + 0x12], 0xcce2d7da
mov dword [esp + 0x16], 0xffc2ca
mov word [esp + 0xc], 0xf446
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x9c
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xd
jne 0x100150af
mov byte [esp + 0x19], 0
mov ecx, dword [0x1004a5a0]
test ecx, ecx
jne 0x100150de
mov ecx, 0x53b2070f
call fcn.100153e4
mov ecx, eax
mov dword [0x1004a5a0], eax
mov dword [esp + 2], 0xcdc5f1ec
mov word [esp + 6], 0x9191
mov byte [esp + 8], 0
mov word [esp], 0xf86b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x9c
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x100150fb
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a5b8], eax
push ebx
push edi
call ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
ret 8

Function at 0x1001512e
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x24]
mov ecx, dword [0x1004a5bc]
test ecx, ecx
jne 0x100151e7
mov esi, dword [0x1004a59c]
test esi, esi
jne 0x10015160
mov ecx, 0xf8f45725
call fcn.100153e4
mov esi, eax
mov dword [0x1004a59c], eax
mov dword [esp + 0xe], 0xcde3fbf0
mov dword [esp + 0x12], 0xc1d0cd
mov word [esp + 0xc], 0xf446
movsd xmm0, qword [esp + 0xd]
xorps xmm0, xmmword [0x1003fb40]
movlps qword [esp + 0xd], xmm0
mov ecx, dword [0x1004a5a0]
test ecx, ecx
jne 0x100151a4
mov ecx, 0x53b2070f
call fcn.100153e4
mov ecx, eax
mov dword [0x1004a5a0], eax
mov dword [esp + 2], 0xcdc5f1ec
mov word [esp + 6], 0x9191
mov byte [esp + 8], 0
mov word [esp], 0xf86b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x9c
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x100151c1
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a5bc], eax
push edi
call ecx
add esp, 0x18
pop esi
pop edi
ret 4
Function at 0x100151f2
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x20]
mov eax, dword [0x1004a5c0]
test eax, eax
jne 0x10015296
mov esi, dword [0x1004a59c]
test esi, esi
jne 0x10015223
mov ecx, 0xf8f45725
call fcn.100153e4
mov esi, eax
mov dword [0x1004a59c], eax
mov dword [esp + 0xe], 0xd0fafb
mov word [esp + 0xc], 0xf153
xor dword [esp + 0xd], 0xa09f9e9d
mov ecx, dword [0x1004a5a0]
test ecx, ecx
jne 0x10015255
mov ecx, 0x53b2070f
call fcn.100153e4
mov ecx, eax
mov dword [0x1004a5a0], eax
mov dword [esp + 2], 0xcdc5f1ec
mov word [esp + 6], 0x9191
mov byte [esp + 8], 0
mov word [esp], 0xf86b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x9c
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10015272
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov dword [0x1004a5c0], eax
push edi
call eax
add esp, 0x14
pop esi
pop edi
ret 4

Function at 0x100152a2
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x2c]
mov ecx, dword [0x1004a5c4]
test ecx, ecx
jne 0x1001535a
mov esi, dword [0x1004a59c]
test esi, esi
jne 0x100152d4
mov ecx, 0xf8f45725
call fcn.100153e4
mov esi, eax
mov dword [0x1004a59c], eax
mov byte [esp + 0x1c], 0
movaps xmm0, xmmword [0x1003fb60]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x9c
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x10
jne 0x100152e8
mov byte [esp + 0x1c], 0
mov ecx, dword [0x1004a5a0]
test ecx, ecx
jne 0x10015317
mov ecx, 0x53b2070f
call fcn.100153e4
mov ecx, eax
mov dword [0x1004a5a0], eax
mov dword [esp + 2], 0xcdc5f1ec
mov word [esp + 6], 0x9191
mov byte [esp + 8], 0
mov word [esp], 0xf86b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x9c
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10015334
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a5c4], eax
push edi
call ecx
add esp, 0x20
pop esi
pop edi
ret 4

Function at 0x10015366
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
sub esp, 0x1c
movaps xmm0, xmmword [0x1003fb70]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
call fcn.100012a6
cmp eax, 0xffffffff
je 0x100153d8
mov esi, eax
xor edi, edi
push 2
push edi
push edi
push eax
call fcn.1000147c
mov eax, esp
push edi
push eax
push ebp
push ebx
push esi
call fcn.1000156a
test eax, eax
jne 0x100153c8
call fcn.100013b0
mov edi, eax
push esi
call fcn.1000164e
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.100013b0