joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100b5180
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push eax
push ecx
push esi
call fcn.100b4ca0
lea edi, [eax*4]
add esp, 0xc
xor ebx, ebx
mov dword [esp + 0xc], eax
test edi, edi
jle 0x100b51f5
lea edx, [esi + edi*4 + 8]
lea ecx, [esi + 8]
push ebp
mov eax, dword [edx - 8]
mov ebp, dword [ecx - 8]
mov dword [ecx - 8], eax
mov dword [edx - 8], ebp
mov ebp, dword [edx - 4]
mov eax, dword [ecx - 4]
mov dword [ecx - 4], ebp
mov ebp, dword [edx]
mov dword [edx - 4], eax
mov eax, dword [ecx]
mov dword [ecx], ebp
mov ebp, dword [edx + 4]
mov dword [edx], eax
mov eax, dword [ecx + 4]
mov dword [ecx + 4], ebp
mov dword [edx + 4], eax
add ebx, 4
sub edi, 4
add ecx, 0x10
sub edx, 0x10
cmp ebx, edi
jl 0x100b51b4
mov eax, dword [esp + 0x10]
pop ebp
cmp eax, 1
jle 0x100b53b0
lea edx, [eax - 1]
mov ecx, dword [esi + 0x10]
movzx ebx, byte [esi + 0x11]
mov ebx, dword [ebx*4 + str.ccccwwww]
add esi, 0x10
mov edi, ecx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x10182f10]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x10183710]
movzx ebx, byte [esi + 2]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x10183310]
movzx ebx, byte [esi + 5]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff
xor edi, dword [ecx*4 + 0x10183b10]
mov ecx, dword [esi + 4]
mov dword [esi], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, ecx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x10182f10]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x10183710]
movzx ebx, byte [esi + 6]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x10183310]
movzx ebx, byte [esi + 9]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff
xor edi, dword [ecx*4 + 0x10183b10]
mov ecx, dword [esi + 8]
mov dword [esi + 4], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, ecx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x10182f10]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x10183710]
movzx ebx, byte [esi + 0xa]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x10183310]
movzx ebx, byte [esi + 0xd]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ecx, 0xff
xor edi, dword [ecx*4 + 0x10183b10]
mov ecx, dword [esi + 0xc]
mov dword [esi + 8], edi
mov ebx, dword [ebx*4 + str.ccccwwww]
mov edi, ecx
shr edi, 0x18
mov edi, dword [edi*4 + str.ccccwwww]
and edi, 0xff
mov edi, dword [edi*4 + 0x10182f10]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x10183710]
movzx ebx, byte [esi + 0xe]
mov ebx, dword [ebx*4 + str.ccccwwww]
and ecx, 0xff
mov ecx, dword [ecx*4 + str.ccccwwww]
and ebx, 0xff
xor edi, dword [ebx*4 + 0x10183310]
and ecx, 0xff
xor edi, dword [ecx*4 + 0x10183b10]
sub edx, 1
mov dword [esi + 0xc], edi
jne 0x100b5201
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x100ba5f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x100ba71d
mov eax, dword [esi + 4]
test eax, eax
je 0x100ba71d
cmp dword [eax], 0
je 0x100ba71d
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x100ba71d
mov ecx, dword [eax]
cmp dword [ecx + 0x20], 0x10
push edi
jne 0x100ba67a
xor eax, eax
lea esp, [esp]
mov edx, dword [esi + 4]
mov edx, dword [edx]
lea edi, [edx + eax + 0x10]
movzx edx, byte [ecx + eax + 0x24]
xor byte [edi], dl
mov edx, dword [esi + 4]
mov edx, dword [edx]
lea edi, [edx + eax + 0x11]
movzx edx, byte [ecx + eax + 0x25]
xor byte [edi], dl
mov edx, dword [esi + 4]
mov edx, dword [edx]
lea edi, [edx + eax + 0x12]
movzx edx, byte [ecx + eax + 0x26]
xor byte [edi], dl
mov edx, dword [esi + 4]
mov edx, dword [edx]
lea edi, [edx + eax + 0x13]
movzx edx, byte [ecx + eax + 0x27]
xor byte [edi], dl
add eax, 4
cmp eax, 0x10
jl 0x100ba630
jmp 0x100ba6ed
mov eax, dword [eax]
mov edx, dword [eax + 0x20]
xor byte [eax + edx], 0x80
add eax, edx
xor eax, eax
mov edx, dword [esi + 4]
mov edx, dword [edx]
lea edi, [edx + eax]
movzx edx, byte [ecx + eax + 0x34]
xor byte [edi], dl
mov edx, dword [esi + 4]
mov edx, dword [edx]
lea edi, [edx + eax + 1]
movzx edx, byte [ecx + eax + 0x35]
xor byte [edi], dl
mov edx, dword [esi + 4]
mov edx, dword [edx]
lea edi, [edx + eax + 2]
movzx edx, byte [ecx + eax + 0x36]
xor byte [edi], dl
mov edx, dword [esi + 4]
mov edx, dword [edx]
lea edi, [edx + eax + 3]
movzx edx, byte [ecx + eax + 0x37]
xor byte [edi], dl
add eax, 4
cmp eax, 0x10
jl 0x100ba687
mov eax, dword [esi + 4]
mov eax, dword [eax]
mov ecx, dword [eax + 0x20]
mov edx, 0x10
sub edx, ecx
push edx
lea eax, [ecx + eax + 0x10]
push 0
push eax
call fcn.1013f910
add esp, 0xc
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
push eax
lea edx, [eax + 0x44]
push edx
add eax, 0x10
push eax
push ebp
push 0x411
call fcn.100c4ca0
mov eax, dword [esp + 0x2c]
add esp, 0x14
pop edi
test eax, eax
je 0x100ba718
mov dword [eax], 0x10
pop esi
xor eax, eax
pop ebp
ret
pop esi
mov eax, 0xfffff446
pop ebp
ret
Function at 0x100bd690
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push ebx
push eax
push ecx
call fcn.100bd160
add esp, 0xc
test eax, eax
jl 0x100bd8d8
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x100bd70d
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea ebx, [ebx]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x100bd6d0
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x100bd8d4
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x10186050]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x10186050]
and esi, 0xff
mov esi, dword [esi*4 + 0x10186c50]
and edi, 0xff
xor esi, dword [edi*4 + 0x10187450]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x10186050]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x10187850]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x10186050]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x10187050]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x10186050]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x10186050]
and esi, 0xff
mov esi, dword [esi*4 + 0x10186c50]
and edi, 0xff
xor esi, dword [edi*4 + 0x10187450]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x10186050]
and edi, 0xff
xor esi, dword [edi*4 + 0x10187050]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x10186050]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x10187850]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x10186050]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x10186050]
and esi, 0xff
mov esi, dword [esi*4 + 0x10186c50]
and edi, 0xff
xor esi, dword [edi*4 + 0x10187450]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x10186050]
and edi, 0xff
xor esi, dword [edi*4 + 0x10187050]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x10186050]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x10187850]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x10186050]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x10186050]
and esi, 0xff
mov esi, dword [esi*4 + 0x10186c50]
and edi, 0xff
xor esi, dword [edi*4 + 0x10187450]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x10186050]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x10186050]
and edi, 0xff
xor esi, dword [edi*4 + 0x10187050]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x10187850]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x100bd721
pop edi
xor eax, eax
pop esi
pop ebx
ret
Function at 0x100be480
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
mov eax, dword [0x101c3584]
xor eax, esp
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ebp
mov ebp, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x10], edi
test cl, 7
jne 0x100be56f
cmp ecx, 8
jb 0x100be56f
push ebx
push ecx
lea eax, [edi + 8]
push edx
push eax
mov ebx, 1
call fcn.10118460
add esp, 0xc
test esi, esi
jne 0x100be4d8
mov esi, 0x10187d78
push 8
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.10118460
add esp, 0xc
mov dword [esp + 0x10], 6
mov eax, dword [esp + 0x40]
lea esi, [edi + 8]
test eax, eax
jbe 0x100be53e
lea edi, [eax - 1]
shr edi, 3
inc edi
push 8
lea ecx, [esp + 0x24]
push esi
push ecx
call fcn.10118460
lea edx, [esp + 0x24]
push ebp
push edx
mov eax, edx
push eax
call fcn.100bd900
xor byte [esp + 0x37], bl
push 8
lea ecx, [esp + 0x3c]
push ecx
push esi
call fcn.10118460
add esp, 0x24
inc ebx
add esi, 8
sub edi, 1
jne 0x100be502
mov edi, dword [esp + 0x14]
sub dword [esp + 0x10], 1
jne 0x100be4f0
push 8
lea edx, [esp + 0x1c]
push edx
push edi
call fcn.10118460
mov eax, dword [esp + 0x4c]
add esp, 0xc
pop ebx
pop edi
pop esi
add eax, 8
pop ebp
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1013d581
add esp, 0x1c
ret
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
xor ecx, esp
or eax, 0xffffffff
call fcn.1013d581
add esp, 0x1c
ret
Function at 0x100be590
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
mov eax, dword [0x101c3584]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
push ebx
mov ebx, dword [esp + 0x40]
push ebp
mov ebp, dword [esp + 0x34]
push esi
mov esi, dword [esp + 0x44]
sub ebx, 8
push edi
mov edi, dword [esp + 0x44]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], ebx
test bl, 7
jne 0x100be6c9
cmp ebx, 8
jb 0x100be6c9
push 8
shr ebx, 3
lea ecx, [esp + 0x28]
push esi
lea ebx, [ebx + ebx*2]
push ecx
add ebx, ebx
call fcn.10118460
mov edx, dword [esp + 0x1c]
push edx
add esi, 8
push esi
push edi
call fcn.10118460
mov eax, dword [esp + 0x28]
lea ecx, [eax + edi - 8]
add esp, 0x18
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], 6
mov esi, dword [esp + 0x20]
test eax, eax
jbe 0x100be661
lea edi, [eax - 1]
shr edi, 3
inc edi
xor byte [esp + 0x2b], bl
push 8
lea edx, [esp + 0x30]
push esi
push edx
call fcn.10118460
lea eax, [esp + 0x30]
push ebp
push eax
mov ecx, eax
push ecx
call fcn.100bdec0
push 8
lea edx, [esp + 0x48]
push edx
push esi
call fcn.10118460
add esp, 0x24
dec ebx
sub esi, 8
sub edi, 1
jne 0x100be621
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x1c]
sub dword [esp + 0x18], 1
jne 0x100be612
cmp dword [esp + 0x14], 0
jne 0x100be677
mov dword [esp + 0x14], 0x10187d78
mov eax, dword [esp + 0x14]
push 8
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.100bc950
add esp, 0xc
test eax, eax
je 0x100be6b2
mov edx, dword [esp + 0x10]
push edx
push edi
call fcn.100bc9d0
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1013d581
add esp, 0x28
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1013d581
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
or eax, 0xffffffff
call fcn.1013d581
add esp, 0x28
ret

Function at 0x100bf7d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, eax
push edi
dec esi
mov eax, dword [ebp + esi*4]
mov edi, 0x20
sub edi, ebx
lea edx, [ebp + esi*4]
mov ecx, edi
shr eax, cl
mov dword [esp + 0x10], eax
test esi, esi
je 0x100bf829
mov eax, dword [esp + 0x18]
sub eax, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx - 4]
mov ebp, dword [edx]
mov ecx, edi
shr eax, cl
mov ecx, ebx
shl ebp, cl
mov ecx, dword [esp + 0xc]
dec esi
sub edx, 4
xor eax, ebp
mov dword [ecx + edx + 4], eax
test esi, esi
jne 0x100bf802
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x1c]
mov edx, dword [ebp + esi*4]
mov ecx, ebx
shl edx, cl
mov ecx, dword [esp + 0x18]
pop edi
mov dword [ecx + esi*4], edx
pop esi
pop ebp
add esp, 8
ret
Function at 0x100bf840
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push esi
mov esi, 0x20
sub esi, ebx
mov ecx, esi
shl eax, cl
mov ecx, dword [esp + 0x18]
push edi
xor edi, edi
add ecx, 0xffffffff
mov dword [esp + 8], eax
je 0x100bf89e
mov edi, dword [esp + 0x14]
sub edi, edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], ecx
push ebp
mov eax, dword [edx + 4]
mov ebp, dword [edx]
mov ecx, esi
shl eax, cl
mov ecx, ebx
shr ebp, cl
add edx, 4
xor eax, ebp
sub dword [esp + 0x20], 1
mov dword [edi + edx - 4], eax
jne 0x100bf874
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
pop ebp
mov edx, dword [edx + edi*4]
mov ecx, ebx
shr edx, cl
mov ecx, dword [esp + 0x14]
mov dword [ecx + edi*4], edx
pop edi
pop esi
add esp, 8
ret

Function at 0x100c0370
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
push edi
add eax, eax
add eax, eax
xor edi, edi
push eax
push edi
push ecx
mov dword [esi], edi
mov dword [esi + 4], edi
call fcn.1013f910
mov ebx, dword [esp + 0x24]
shr ebx, 5
add esp, 0xc
cmp ebx, edi
jbe 0x100c03bc
nop
call fcn.10142907
mov ebp, eax
shl ebp, 0xb
call fcn.10142907
mov edx, dword [esi + 0xc]
xor eax, ebp
mov dword [edx + edi*4], eax
inc edi
cmp edi, ebx
jb 0x100c03a0
mov ebp, dword [esp + 0x18]
and ebp, 0x1f
je 0x100c03ee
call fcn.10142907
mov ebx, eax
shl ebx, 0xb
call fcn.10142907
mov ecx, dword [esi + 0xc]
xor eax, ebx
mov dword [ecx + edi*4], eax
mov edx, dword [esi + 0xc]
mov eax, 1
mov ecx, ebp
shl eax, cl
lea edi, [edx + edi*4]
dec eax
and dword [edi], eax
mov ecx, dword [esp + 0x18]
dec ecx
shr ecx, 5
pop edi
inc ecx
mov dword [esi + 4], ecx
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x100c26b0
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [0x101bca40]
mov eax, dword [esp + 4]
and ecx, 0xff00
xor edx, edx
cmp ecx, 0x2300
sete dl
xor ecx, ecx
mov dword [eax + 0x98], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], ecx
mov dword [eax + 0x50], ecx
ret

Function at 0x100c3970
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 4], 1
je 0x100c39a8
shr edx, 2
test edx, edx
je 0x100c39a8
push esi
push edi
mov eax, dword [ecx]
mov esi, eax
shr esi, 8
mov edi, eax
shl edi, 8
xor esi, edi
and esi, 0xff00ff
shl eax, 8
xor esi, eax
dec edx
rol esi, 0x10
mov dword [ecx], esi
add ecx, 4
test edx, edx
jne 0x100c3980
pop edi
pop esi
ret

Function at 0x100c39b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx + 0x50]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
lea ecx, [eax + edi*8]
mov dword [ebx + 0x50], ecx
cmp ecx, eax
jae 0x100c39cc
inc dword [ebx + 0x54]
mov ecx, edi
sar ecx, 0x1d
add dword [ebx + 0x54], ecx
shr eax, 3
and eax, 0x3f
je 0x100c3a31
mov esi, 0x40
sub esi, eax
cmp edi, esi
lea ecx, [eax + ebx + 0x58]
jge 0x100c39ff
mov edx, dword [esp + 0x18]
push edi
push edx
push ecx
call fcn.1013fc90
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x18]
push esi
push eax
push ecx
call fcn.1013fc90
mov ecx, dword [ebx + 0x98]
lea ebp, [ebx + 0x58]
push ecx
mov edx, 0x40
mov ecx, ebp
call fcn.100c3970
push ebp
push ebx
call fcn.100c2700
add dword [esp + 0x30], esi
add esp, 0x18
sub edi, esi
cmp edi, 0x40
jl 0x100c3ab0
mov eax, edi
shr eax, 6
mov dword [esp + 0x14], eax
neg eax
shl eax, 6
add edi, eax
lea ebp, [ebx + 0x58]
mov dword [esp + 0x1c], edi
lea ecx, [ecx]
cmp dword [ebx + 0x98], 1
mov esi, dword [esp + 0x18]
mov ecx, 0x10
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
je 0x100c3a96
mov edx, 0x10
lea ecx, [ecx]
mov eax, dword [ecx]
mov esi, eax
shr esi, 8
mov edi, eax
shl edi, 8
xor esi, edi
and esi, 0xff00ff
shl eax, 8
xor esi, eax
dec edx
rol esi, 0x10
mov dword [ecx], esi
add ecx, 4
test edx, edx
jne 0x100c3a70
push ebp
push ebx
call fcn.100c2700
add dword [esp + 0x20], 0x40
add esp, 8
sub dword [esp + 0x14], 1
jne 0x100c3a50
mov edi, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push edi
push edx
add ebx, 0x58
push ebx
call fcn.1013fc90
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100c4f00
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
add eax, 0xfffffbef
push esi
push edi
cmp eax, 7
ja case.0x100c4f14.1044
jmp dword [eax*4 + 0x100c507c]
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov esi, dword [esp + 0x10]
mov dword [0x101f4c04], ecx
mov edx, dword [eax + 4]
mov dword [0x101f4c08], edx
mov ecx, dword [eax + 8]
push esi
push eax
mov dword [0x101f4c0c], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x20]
push 0xa
push eax
mov edi, 0x10
mov dword [0x101f4c10], edx
call fcn.100b64b0
add esp, 0x10
jmp 0x100c5043
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov esi, dword [esp + 0x10]
mov dword [0x101f4c04], ecx
mov edx, dword [eax + 4]
mov dword [0x101f4c08], edx
mov ecx, dword [eax + 8]
push esi
push eax
mov dword [0x101f4c0c], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x20]
push 0xc
push eax
mov edi, 0x10
mov dword [0x101f4c10], edx
call fcn.100b64b0
add esp, 0x10
jmp 0x100c5043
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov esi, dword [esp + 0x10]
mov dword [0x101f4c04], ecx
mov edx, dword [eax + 4]
mov dword [0x101f4c08], edx
mov ecx, dword [eax + 8]
push esi
push eax
mov dword [0x101f4c0c], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x20]
push 0xe
push eax
mov edi, 0x10
mov dword [0x101f4c10], edx
call fcn.100b64b0
add esp, 0x10
jmp 0x100c5043
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov esi, dword [esp + 0x10]
push esi
mov dword [0x101f4c04], ecx
mov edx, dword [eax + 4]
push eax
mov eax, dword [esp + 0x20]
push eax
mov edi, 8
mov dword [0x101f4c08], edx
call fcn.100b4a10
jmp 0x100c5040
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov esi, dword [esp + 0x10]
push esi
mov dword [0x101f4c04], ecx
mov edx, dword [eax + 4]
push eax
mov eax, dword [esp + 0x20]
push eax
mov edi, 8
mov dword [0x101f4c08], edx
call fcn.100b4250
add esp, 0xc
push ebp
mov ebp, dword [esp + 0x20]
test edi, edi
jle 0x100c505f
mov ecx, ebp
mov eax, esi
sub ecx, esi
mov esi, edi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub esi, 1
jne 0x100c5054
push edi
push 0x101f4c04
push ebp
call fcn.1013fc90
add esp, 0xc
pop ebp
pop edi
xor eax, eax
pop esi
ret
pop edi
mov eax, 0xfffff445
pop esi
ret
Function at 0x100c50a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebp
add eax, 0xfffffbef
push esi
push edi
cmp eax, 7
ja case.0x100c50b5.1044
jmp dword [eax*4 + 0x100c5230]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
mov dword [0x101f4c04], ecx
mov edx, dword [eax + 4]
mov dword [0x101f4c08], edx
mov ecx, dword [eax + 8]
push esi
mov dword [0x101f4c0c], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x20]
push ebp
push 0xa
push eax
mov edi, 0x10
mov dword [0x101f4c10], edx
call fcn.100b53c0
add esp, 0x10
jmp 0x100c51f8
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
mov dword [0x101f4c04], ecx
mov edx, dword [eax + 4]
mov dword [0x101f4c08], edx
mov ecx, dword [eax + 8]
push esi
mov dword [0x101f4c0c], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x20]
push ebp
push 0xc
push eax
mov edi, 0x10
mov dword [0x101f4c10], edx
call fcn.100b53c0
add esp, 0x10
jmp 0x100c51f8
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
mov dword [0x101f4c04], ecx
mov edx, dword [eax + 4]
mov dword [0x101f4c08], edx
mov ecx, dword [eax + 8]
push esi
mov dword [0x101f4c0c], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x20]
push ebp
push 0xe
push eax
mov edi, 0x10
mov dword [0x101f4c10], edx
call fcn.100b53c0
add esp, 0x10
jmp 0x100c51f8
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
mov dword [0x101f4c04], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x1c]
push esi
push ebp
push eax
mov edi, 8
mov dword [0x101f4c08], edx
call fcn.100b4a10
jmp 0x100c51f5
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
mov dword [0x101f4c04], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x1c]
push esi
push ebp
push eax
mov edi, 8
mov dword [0x101f4c08], edx
call fcn.100b4250
add esp, 0xc
test edi, edi
jle 0x100c5214
mov ecx, 0x101f4c04
mov eax, esi
sub ecx, esi
mov edx, edi
push ebx
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
sub edx, 1
jne 0x100c5208
pop ebx
push edi
push esi
push ebp
call fcn.1013fc90
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebp
ret
pop edi
pop esi
mov eax, 0xfffff445
pop ebp
ret
Function at 0x100c5250
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebp
add eax, 0xfffffbef
push esi
push edi
cmp eax, 7
ja case.0x100c5265.1044
jmp dword [eax*4 + 0x100c53e0]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
mov dword [0x101f4c04], ecx
mov edx, dword [eax + 4]
mov dword [0x101f4c08], edx
mov ecx, dword [eax + 8]
push esi
mov dword [0x101f4c0c], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x20]
push ebp
push 0xa
push eax
mov edi, 0x10
mov dword [0x101f4c10], edx
call fcn.100b53c0
add esp, 0x10
jmp 0x100c53a8
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
mov dword [0x101f4c04], ecx
mov edx, dword [eax + 4]
mov dword [0x101f4c08], edx
mov ecx, dword [eax + 8]
push esi
mov dword [0x101f4c0c], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x20]
push ebp
push 0xc
push eax
mov edi, 0x10
mov dword [0x101f4c10], edx
call fcn.100b53c0
add esp, 0x10
jmp 0x100c53a8
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
mov dword [0x101f4c04], ecx
mov edx, dword [eax + 4]
mov dword [0x101f4c08], edx
mov ecx, dword [eax + 8]
push esi
mov dword [0x101f4c0c], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x20]
push ebp
push 0xe
push eax
mov edi, 0x10
mov dword [0x101f4c10], edx
call fcn.100b53c0
add esp, 0x10
jmp 0x100c53a8
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
mov dword [0x101f4c04], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x1c]
push esi
push ebp
push eax
mov edi, 8
mov dword [0x101f4c08], edx
call fcn.100b4a10
jmp 0x100c53a5
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x20]
mov dword [0x101f4c04], ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x1c]
push esi
push ebp
push eax
mov edi, 8
mov dword [0x101f4c08], edx
call fcn.100b4250
add esp, 0xc
test edi, edi
jle 0x100c53c2
mov ecx, 0x101f4c04
mov eax, esi
sub ecx, esi
mov esi, edi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub esi, 1
jne 0x100c53b7
push edi
push 0x101f4c04
push ebp
call fcn.1013fc90
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebp
ret
pop edi
pop esi
mov eax, 0xfffff445
pop ebp
ret