joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021ae6
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebp, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov ecx, dword [0x100519cc]
test ecx, ecx
jne 0x10021ba3
mov esi, dword [0x100519b0]
test esi, esi
jne 0x10021b22
mov ecx, 0xf8f45725
call fcn.10021c70
mov esi, eax
mov dword [0x100519b0], eax
movaps xmm0, xmmword [0x100418f0]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xec
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xf
jne 0x10021b31
mov byte [esp + 0x1b], 0
mov ecx, dword [0x100519b4]
test ecx, ecx
jne 0x10021b60
mov ecx, 0x53b2070f
call fcn.10021c70
mov ecx, eax
mov dword [0x100519b4], eax
mov dword [esp + 2], 0x9d95819c
mov word [esp + 6], 0xc1c1
mov byte [esp + 8], 0
mov word [esp], 0x886b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xec
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10021b7d
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100519cc], eax
push ebp
push ebx
push edi
call ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x10021bb2
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x28]
mov ecx, dword [0x100519d0]
test ecx, ecx
jne 0x10021c65
mov esi, dword [0x100519b0]
test esi, esi
jne 0x10021be4
mov ecx, 0xf8f45725
call fcn.10021c70
mov esi, eax
mov dword [0x100519b0], eax
movaps xmm0, xmmword [0x10041900]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xec
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xf
jne 0x10021bf3
mov byte [esp + 0x1b], 0
mov ecx, dword [0x100519b4]
test ecx, ecx
jne 0x10021c22
mov ecx, 0x53b2070f
call fcn.10021c70
mov ecx, eax
mov dword [0x100519b4], eax
mov dword [esp + 2], 0x9d95819c
mov word [esp + 6], 0xc1c1
mov byte [esp + 8], 0
mov word [esp], 0x886b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xec
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10021c3f
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100519d0], eax
push edi
call ecx
add esp, 0x1c
pop esi
pop edi
ret 4
Function at 0x10021c70
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0xc], ecx
mov eax, dword [0x100513a4]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + 0x14]
add edi, 0x14
mov eax, dword [esi + 0x10]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x10021d32
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x10021d32
cmp word [eax + ecx + 0x14], 0x60
jb 0x10021d32
cmp dword [eax + ecx + 0x74], 0
je 0x10021d32
mov edx, dword [eax + ecx + 0x78]
mov ecx, edx
mov dword [esp], edx
test edx, edx
je 0x10021d32
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x18]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x10021d32
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x20]
add ecx, eax
mov dword [esp + 8], ecx
lea ecx, [eax + 1]
mov dword [esp + 4], ecx
xor ebx, ebx
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + ebx*4]
mov dl, byte [eax + ecx]
test dl, dl
je 0x10021d1a
add ecx, dword [esp + 4]
mov ebp, 0x811c9dc5
movsx edx, dl
xor edx, ebp
imul ebp, edx, 0x1000193
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10021d06
jmp 0x10021d1f
mov ebp, 0x811c9dc5
cmp ebp, dword [esp + 0xc]
je 0x10021d2e
inc ebx
cmp ebx, dword [esp + 0x10]
jne 0x10021cef
jmp 0x10021d32
test eax, eax
jne 0x10021d46
mov esi, dword [esi]
cmp esi, edi
jne 0x10021c8c
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp]
mov ecx, dword [eax + edx + 0x24]
add ecx, eax
mov edx, dword [eax + edx + 0x1c]
add edx, eax
movzx ecx, word [ecx + ebx*2]
add eax, dword [edx + ecx*4]
jmp 0x10021d3e

Function at 0x10021dc2
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
mov ecx, dword [0x100519e0]
test ecx, ecx
jne 0x10021e85
mov esi, dword [0x100519d8]
test esi, esi
jne 0x10021dfe
mov ecx, 0xf8f45725
call fcn.10022466
mov esi, eax
mov dword [0x100519d8], eax
mov dword [esp + 0x10], 0xecf2cbf5
mov dword [esp + 0x14], 0xc3d1f3f4
mov dword [esp + 0x18], 0xcff6c1c0
mov word [esp + 0x1c], 0xcddd
mov byte [esp + 0x1e], 0
movaps xmm0, xmmword [0x10041a80]
movups xmmword [esp], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x8b
xor byte [esp + eax], cl
inc eax
cmp eax, 0x1e
jne 0x10021e30
mov byte [esp + 0x1e], 0
mov ecx, dword [0x100519dc]
test ecx, ecx
jne 0x10021e5e
mov ecx, 0x53b2070f
call fcn.10022466
mov ecx, eax
mov dword [0x100519dc], eax
lea eax, [esp + 0x20]
mov dword [eax + 2], 0xe3e2e9
mov word [eax], 0xf86e
xor dword [eax + 1], 0x8f8e8d8c
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100519e0], eax
push ebp
push ebx
push edi
call ecx
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x10021e94
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [0x100519e4]
test ecx, ecx
jne 0x10021f70
mov esi, dword [0x100519d8]
test esi, esi
jne 0x10021ed4
mov ecx, 0xf8f45725
call fcn.10022466
mov esi, eax
mov dword [0x100519d8], eax
mov dword [esp + 0xe], 0xf1fafaff
mov dword [esp + 0x12], 0xf8ffd3fd
mov word [esp + 0x16], 0xf5fa
mov byte [esp + 0x18], 0
mov word [esp + 0xc], 0xe556
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x8b
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xc
jne 0x10021efa
mov byte [esp + 0x18], 0
mov ecx, dword [0x100519dc]
test ecx, ecx
jne 0x10021f29
mov ecx, 0x53b2070f
call fcn.10022466
mov ecx, eax
mov dword [0x100519dc], eax
mov dword [esp + 2], 0xfceae0ff
mov word [esp + 6], 0xa0a2
mov byte [esp + 8], 0
mov word [esp], 0xe96b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x8b
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10021f46
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100519e4], eax
mov eax, dword [esp + 0x30]
push edi
push ebp
push ebx
push eax
call ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x10021fc8
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov ecx, dword [0x100519e8]
test ecx, ecx
jne 0x10022097
mov esi, dword [0x100519d8]
test esi, esi
jne 0x10022004
mov ecx, 0xf8f45725
call fcn.10022466
mov esi, eax
mov dword [0x100519d8], eax
mov dword [esp + 0xe], 0xf1fafaff
mov dword [esp + 0x12], 0xf1e1d4fd
mov word [esp + 0x16], 0xf0
mov word [esp + 0xc], 0xe556
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x8b
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xb
jne 0x10022025
mov byte [esp + 0x17], 0
mov ecx, dword [0x100519dc]
test ecx, ecx
jne 0x10022054
mov ecx, 0x53b2070f
call fcn.10022466
mov ecx, eax
mov dword [0x100519dc], eax
mov dword [esp + 2], 0xfceae0ff
mov word [esp + 6], 0xa0a2
mov byte [esp + 8], 0
mov word [esp], 0xe96b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x8b
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10022071
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100519e8], eax
push ebp
push ebx
push edi
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x100221ca
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x4c]
mov ebx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x3c]
mov esi, dword [esp + 0x38]
mov ecx, dword [0x100519ec]
test ecx, ecx
jne 0x1002228f
mov esi, dword [0x100519d8]
test esi, esi
jne 0x10022212
mov ecx, 0xf8f45725
call fcn.10022466
mov esi, eax
mov dword [0x100519d8], eax
mov word [esp + 0x10], 0xe9
movaps xmm0, xmmword [0x10041a90]
movups xmmword [esp], xmm0
movups xmm0, xmmword [esp + 1]
xorps xmm0, xmmword [0x10041aa0]
movups xmmword [esp + 1], xmm0
mov ecx, dword [0x100519dc]
test ecx, ecx
jne 0x10022250
mov ecx, 0x53b2070f
call fcn.10022466
mov ecx, eax
mov dword [0x100519dc], eax
lea eax, [esp + 0x14]
mov dword [eax + 2], 0xe3e2e9
mov word [eax], 0xf86e
xor dword [eax + 1], 0x8f8e8d8c
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100519ec], eax
mov esi, dword [esp + 0x38]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
mov ebx, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
mov edx, dword [esp + 0x44]
push eax
push ebx
push edx
push edi
push ebp
push esi
push dword [esp + 0x4c]
push dword [esp + 0x4c]
call ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0x20

Function at 0x10022372
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebp, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
mov esi, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [0x100519f0]
test ecx, ecx
jne 0x10022431
mov esi, dword [0x100519d8]
test esi, esi
jne 0x100223ba
mov ecx, 0xf8f45725
call fcn.10022466
mov esi, eax
mov dword [0x100519d8], eax
mov dword [esp + 0x10], 0xeff9fd
movaps xmm0, xmmword [0x10041ab0]
movups xmmword [esp], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x8b
xor byte [esp + eax], cl
inc eax
cmp eax, 0x13
jne 0x100223d0
mov byte [esp + 0x13], 0
mov ecx, dword [0x100519dc]
test ecx, ecx
jne 0x100223fe
mov ecx, 0x53b2070f
call fcn.10022466
mov ecx, eax
mov dword [0x100519dc], eax
lea eax, [esp + 0x14]
mov dword [eax + 2], 0xe3e2e9
mov word [eax], 0xf86e
xor dword [eax + 1], 0x8f8e8d8c
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100519f0], eax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x38]
push ebp
push ebx
push edi
push esi
push edx
push eax
call ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x10022466
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0xc], ecx
mov eax, dword [0x100519d4]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + 0x14]
add edi, 0x14
mov eax, dword [esi + 0x10]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x10022528
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x10022528
cmp word [eax + ecx + 0x14], 0x60
jb 0x10022528
cmp dword [eax + ecx + 0x74], 0
je 0x10022528
mov edx, dword [eax + ecx + 0x78]
mov ecx, edx
mov dword [esp], edx
test edx, edx
je 0x10022528
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x18]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x10022528
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x20]
add ecx, eax
mov dword [esp + 8], ecx
lea ecx, [eax + 1]
mov dword [esp + 4], ecx
xor ebx, ebx
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + ebx*4]
mov dl, byte [eax + ecx]
test dl, dl
je 0x10022510
add ecx, dword [esp + 4]
mov ebp, 0x811c9dc5
movsx edx, dl
xor edx, ebp
imul ebp, edx, 0x1000193
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x100224fc
jmp 0x10022515
mov ebp, 0x811c9dc5
cmp ebp, dword [esp + 0xc]
je 0x10022524
inc ebx
cmp ebx, dword [esp + 0x10]
jne 0x100224e5
jmp 0x10022528
test eax, eax
jne 0x1002253c
mov esi, dword [esi]
cmp esi, edi
jne 0x10022482
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp]
mov ecx, dword [eax + edx + 0x24]
add ecx, eax
mov edx, dword [eax + edx + 0x1c]
add edx, eax
movzx ecx, word [ecx + ebx*2]
add eax, dword [edx + ecx*4]
jmp 0x10022534

Function at 0x10022560
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
mov ecx, dword [0x10051a00]
test ecx, ecx
jne 0x1002262d
mov esi, dword [0x100519f8]
test esi, esi
jne 0x10022597
mov ecx, 0xf8f45725
call fcn.100229e5
mov esi, eax
mov dword [0x100519f8], eax
mov dword [esp + 0x1c], 0x78666856
mov dword [esp + 0x20], 0x7864627a
mov byte [esp + 0x24], 0
movaps xmm0, xmmword [0x10041ac0]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xf5
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x18
jne 0x100225bb
mov byte [esp + 0x24], 0
mov ecx, dword [0x100519fc]
test ecx, ecx
jne 0x100225ea
mov ecx, 0x53b2070f
call fcn.100229e5
mov ecx, eax
mov dword [0x100519fc], eax
mov dword [esp + 2], 0x969c9685
mov word [esp + 6], 0xcec8
mov byte [esp + 8], 0
mov word [esp], 0x936b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xf5
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10022607
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10051a00], eax
push ebx
push edi
call ecx
add esp, 0x28
pop esi
pop edi
pop ebx
ret 8
Function at 0x1002263a
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov ecx, dword [0x10051a04]
test ecx, ecx
jne 0x1002270a
mov esi, dword [0x100519f8]
test esi, esi
jne 0x10022671
mov ecx, 0xf8f45725
call fcn.100229e5
mov esi, eax
mov dword [0x100519f8], eax
mov dword [esp + 0xe], 0x899c9b98
mov dword [esp + 0x12], 0xb8cfcf88
mov dword [esp + 0x16], 0x76727296
mov byte [esp + 0x1a], 0
mov word [esp + 0xc], 0x8450
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xf5
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xe
jne 0x10022698
mov byte [esp + 0x1a], 0
mov ecx, dword [0x100519fc]
test ecx, ecx
jne 0x100226c7
mov ecx, 0x53b2070f
call fcn.100229e5
mov ecx, eax
mov dword [0x100519fc], eax
mov dword [esp + 2], 0x969c9685
mov word [esp + 6], 0xcec8
mov byte [esp + 8], 0
mov word [esp], 0x936b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xf5
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x100226e4
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10051a04], eax
push ebx
push edi
call ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
ret 8

Function at 0x10022718
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov ecx, dword [0x10051a08]
test ecx, ecx
jne 0x100227e3
mov esi, dword [0x100519f8]
test esi, esi
jne 0x1002274f
mov ecx, 0xf8f45725
call fcn.100229e5
mov esi, eax
mov dword [0x100519f8], eax
mov dword [esp + 0xe], 0x899c9b98
mov dword [esp + 0x12], 0xb0cfcf88
mov dword [esp + 0x16], 0x75789a
mov word [esp + 0xc], 0x8450
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xf5
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xd
jne 0x10022771
mov byte [esp + 0x19], 0
mov ecx, dword [0x100519fc]
test ecx, ecx
jne 0x100227a0
mov ecx, 0x53b2070f
call fcn.100229e5
mov ecx, eax
mov dword [0x100519fc], eax
mov dword [esp + 2], 0x969c9685
mov word [esp + 6], 0xcec8
mov byte [esp + 8], 0
mov word [esp], 0x936b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xf5
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x100227bd
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10051a08], eax
push ebx
push edi
call ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
ret 8
Function at 0x100228f0
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x40]
mov ebx, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x10051a0c]
test ecx, ecx
jne 0x100229d3
mov esi, dword [0x100519f8]
test esi, esi
jne 0x10022938
mov ecx, 0xf8f45725
call fcn.100229e5
mov esi, eax
mov dword [0x100519f8], eax
mov dword [esp + 0xa], 0xbf959492
mov dword [esp + 0xe], 0x8b9e9983
mov dword [esp + 0x12], 0x56658b
mov word [esp + 8], 0x9e53
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xf5
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0xd
jne 0x1002295a
mov byte [esp + 0x15], 0
mov ecx, dword [0x100519fc]
test ecx, ecx
jne 0x10022989
mov ecx, 0x53b2070f
call fcn.100229e5
mov ecx, eax
mov dword [0x100519fc], eax
mov dword [esp + 2], 0xc9959492
mov word [esp + 6], 0xc9
mov word [esp], 0x9e73
xor eax, eax
inc eax
mov edx, eax
add dl, 0xf5
xor byte [esp + eax], dl
inc eax
cmp eax, 7
jne 0x100229a1
mov eax, esp
mov byte [eax + 7], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10051a0c], eax
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
push ebp
push ebx
push edi
push esi
push edx
push eax
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0x18

Function at 0x100229e5
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0xc], ecx
mov eax, dword [0x100519f4]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + 0x14]
add edi, 0x14
mov eax, dword [esi + 0x10]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x10022aa7
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x10022aa7
cmp word [eax + ecx + 0x14], 0x60
jb 0x10022aa7
cmp dword [eax + ecx + 0x74], 0
je 0x10022aa7
mov edx, dword [eax + ecx + 0x78]
mov ecx, edx
mov dword [esp], edx
test edx, edx
je 0x10022aa7
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x18]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x10022aa7
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x20]
add ecx, eax
mov dword [esp + 8], ecx
lea ecx, [eax + 1]
mov dword [esp + 4], ecx
xor ebx, ebx
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + ebx*4]
mov dl, byte [eax + ecx]
test dl, dl
je 0x10022a8f
add ecx, dword [esp + 4]
mov ebp, 0x811c9dc5
movsx edx, dl
xor edx, ebp
imul ebp, edx, 0x1000193
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10022a7b
jmp 0x10022a94
mov ebp, 0x811c9dc5
cmp ebp, dword [esp + 0xc]
je 0x10022aa3
inc ebx
cmp ebx, dword [esp + 0x10]
jne 0x10022a64
jmp 0x10022aa7
test eax, eax
jne 0x10022abb
mov esi, dword [esi]
cmp esi, edi
jne 0x10022a01
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp]
mov ecx, dword [eax + edx + 0x24]
add ecx, eax
mov edx, dword [eax + edx + 0x1c]
add edx, eax
movzx ecx, word [ecx + ebx*2]
add eax, dword [edx + ecx*4]
jmp 0x10022ab3
Function at 0x10022bd4
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x24]
test eax, eax
je 0x10022c31
xor ebx, ebx
xor ebp, ebp
lea ecx, [ebx + 1]
mov dword [esp], ecx
mov edx, 0xff
and ecx, edx
mov esi, dword [esp + 0x18]
movzx eax, byte [esi + ecx]
and ebp, edx
add ebp, eax
mov edi, ebp
and edi, edx
mov dl, byte [esi + edi]
mov byte [esi + ecx], dl
mov byte [esi + edi], al
mov cl, byte [esi + ecx]
add cl, al
movzx eax, cl
mov al, byte [esi + eax]
mov ecx, dword [esp + 0x1c]
xor al, byte [ecx + ebx]
mov ecx, dword [esp + 0x20]
mov byte [ecx + ebx], al
mov eax, dword [esp + 0x24]
mov ecx, dword [esp]
mov ebx, ecx
cmp eax, ecx
jne 0x10022be5
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10022c56
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push esi
sub esp, 0x18
mov ecx, dword [0x10053a24]
test ecx, ecx
jne 0x10022d13
mov esi, dword [0x10053a1c]
test esi, esi
jne 0x10022c83
mov ecx, 0xf8f45725
call fcn.1002321e
mov esi, eax
mov dword [0x10053a1c], eax
mov dword [esp + 2], 0xf5f4d6e5
mov word [esp + 6], 0xf8f5
mov byte [esp + 8], 0
mov word [esp], 0xf954
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x94
xor byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x10022ca0
mov byte [esp + 8], 0
mov ecx, dword [0x10053a20]
test ecx, ecx
jne 0x10022cce
mov ecx, 0x53b2070f
call fcn.1002321e
mov ecx, eax
mov dword [0x10053a20], eax
mov dword [esp + 0xe], 0xf5fdf9e4
mov word [esp + 0x12], 0xa9a9
mov byte [esp + 0x14], 0
mov word [esp + 0xc], 0xf06b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x94
xor byte [esp + eax + 0xc], dl
inc eax
cmp eax, 8
jne 0x10022cec
lea eax, [esp + 0xc]
mov byte [eax + 8], 0
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10053a24], eax
call ecx
add esp, 0x18
pop esi
ret

Function at 0x10022d1a
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x34]
mov ecx, dword [0x10053a28]
test ecx, ecx
jne 0x10022de5
mov esi, dword [0x10053a1c]
test esi, esi
jne 0x10022d4c
mov ecx, 0xf8f45725
call fcn.1002321e
mov esi, eax
mov dword [0x10053a1c], eax
mov dword [esp + 0x1c], 0xc8cfd1d4
mov dword [esp + 0x20], 0xc7c3efc6
mov dword [esp + 0x24], 0xdcc8d8
movaps xmm0, xmmword [0x10041b50]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x94
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x1b
jne 0x10022d73
mov byte [esp + 0x27], 0
mov ecx, dword [0x10053a20]
test ecx, ecx
jne 0x10022da2
mov ecx, 0x53b2070f
call fcn.1002321e
mov ecx, eax
mov dword [0x10053a20], eax
mov dword [esp + 2], 0xf5fdf9e4
mov word [esp + 6], 0xa9a9
mov byte [esp + 8], 0
mov word [esp], 0xf06b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x94
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10022dbf
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10053a28], eax
push edi
call ecx
add esp, 0x28
pop esi
pop edi
ret 4
Function at 0x10022f06
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x20]
mov ecx, dword [0x10053a2c]
test ecx, ecx
jne 0x10022fc3
mov esi, dword [0x10053a1c]
test esi, esi
jne 0x10022f38
mov ecx, 0xf8f45725
call fcn.1002321e
mov esi, eax
mov dword [0x10053a1c], eax
mov dword [esp + 2], 0xfcead1e5
mov word [esp + 6], 0xff
mov word [esp], 0xf954
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x94
xor byte [esp + eax], cl
inc eax
cmp eax, 7
jne 0x10022f50
mov byte [esp + 7], 0
mov ecx, dword [0x10053a20]
test ecx, ecx
jne 0x10022f7e
mov ecx, 0x53b2070f
call fcn.1002321e
mov ecx, eax
mov dword [0x10053a20], eax
mov dword [esp + 0xa], 0xf5fdf9e4
mov word [esp + 0xe], 0xa9a9
mov byte [esp + 0x10], 0
mov word [esp + 8], 0xf06b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x94
xor byte [esp + eax + 8], dl
inc eax
cmp eax, 8
jne 0x10022f9c
lea eax, [esp + 8]
mov byte [eax + 8], 0
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10053a2c], eax
push edi
call ecx
add esp, 0x14
pop esi
pop edi
ret 4

Function at 0x10022fce
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x24]
mov ecx, dword [0x10053a30]
test ecx, ecx
jne 0x10023093
mov esi, dword [0x10053a1c]
test esi, esi
jne 0x10023000
mov ecx, 0xf8f45725
call fcn.1002321e
mov esi, eax
mov dword [0x10053a1c], eax
mov dword [esp + 0xe], 0xedfdd0e5
mov dword [esp + 0x12], 0xe8f0facc
mov word [esp + 0x16], 0xfb
mov word [esp + 0xc], 0xf954
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x94
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xb
jne 0x10023021
mov byte [esp + 0x17], 0
mov ecx, dword [0x10053a20]
test ecx, ecx
jne 0x10023050
mov ecx, 0x53b2070f
call fcn.1002321e
mov ecx, eax
mov dword [0x10053a20], eax
mov dword [esp + 2], 0xf5fdf9e4
mov word [esp + 6], 0xa9a9
mov byte [esp + 8], 0
mov word [esp], 0xf06b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x94
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x1002306d
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x10053a30], eax
push edi
call ecx
add esp, 0x18
pop esi
pop edi
ret 4