joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401270
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404a6f
mov eax, dword fs:[0]
push eax
mov eax, 0x13b8
call fcn.004049f0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x13c0], esi
mov dword [ebp - 0x13b8], esi
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov dword [ebp - 0x13c4], esi
mov dword [ebp - 0x13bc], 0
push 0x40
movups xmmword [ebp - 0x2c], xmm0
call fcn.00403983
movups xmm0, xmmword [str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov ecx, eax
mov dword [ebp - 0x1c], 0x3e
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x18], 0x3f
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x405240]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x405250]
movups xmmword [ecx + 0x20], xmm0
movq xmm0, qword [0x405260]
movq qword [ecx + 0x30], xmm0
mov eax, dword [0x405268]
mov dword [ecx + 0x38], eax
mov ax, word [0x40526c]
mov word [ecx + 0x3c], ax
mov byte [ecx + 0x3e], 0
push 0
mov dword [ebp - 4], 1
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov edx, eax
mov dword [ebp - 0x30], 0xffffffff
add esp, 8
mov dword [ebp - 0x13b0], edx
mov ecx, 1
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [ebp + ecx*4 - 0x13b0], edx
inc ecx
cmp ecx, 0x270
jb 0x401350
xorps xmm0, xmm0
mov dword [ebp - 0x13b4], 0x270
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 0x13bc], 1
mov edi, 0xa
nop dword [eax]
lea ecx, [ebp - 0x13b4]
call fcn.00402d40
mov ecx, 0x3e
mul ecx
cmp eax, ecx
jae 0x4013e8
cmp eax, 4
jae 0x4013e8
mov esi, ecx
nop dword [eax]
lea ecx, [ebp - 0x13b4]
call fcn.00402d40
mul esi
cmp eax, 4
jb 0x4013d0
mov esi, dword [ebp - 0x13c0]
mov ecx, dword [ebp - 0x2c]
lea eax, [edx - 0x80000000]
mov edx, dword [esi + 0x14]
xor eax, 0x80000000
mov al, byte [eax + ecx]
mov ecx, dword [esi + 0x10]
mov byte [ebp - 0x14], al
cmp ecx, edx
jae 0x401422
lea eax, [ecx + 1]
mov dword [esi + 0x10], eax
mov eax, esi
cmp edx, 0xf
jbe 0x401415
mov eax, dword [esi]
add eax, ecx
mov cl, byte [ebp - 0x14]
mov byte [eax + 1], 0
mov byte [eax], cl
jmp 0x40143a
push dword [ebp - 0x14]
mov byte [ebp - 0x13b8], 0
push dword [ebp - 0x13b8]
push ecx
mov ecx, esi
call fcn.004024a0
sub edi, 1
jne 0x4013b0
push 0x40
push dword [ebp - 0x2c]
call fcn.004039b3
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403975
mov esp, ebp
pop ebp
ret
Function at 0x401510
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x13b4
call fcn.004049f0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x13b0], eax
push ebx
push esi
push edi
push 0
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
add esp, 4
mov dword [esp + 0x13b4], 0xffffffff
mov dword [esp + 0x34], eax
mov edx, 1
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [esp + edx*4 + 0x34], eax
inc edx
cmp edx, 0x270
jb 0x401550
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], 0x270
call fcn.00402d40
mov esi, 0xfa1
mul esi
cmp eax, esi
jae 0x4015a2
cmp eax, 0x71f
jae 0x4015a2
nop
lea ecx, [esp + 0x30]
call fcn.00402d40
mul esi
cmp eax, 0x71f
jb 0x401590
lea eax, [edx - 0x7ffffc18]
xor eax, 0x80000000
lea ecx, [esp + 0x10]
cdq
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
call fcn.00401170
mov ebx, dword [esp + 0x10]
mov edi, ebx
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], esi
test ecx, ecx
jl 0x401630
mov eax, dword [esp + 0x24]
jg 0x4015e7
test eax, eax
je 0x401630
push 0
push 0xf4240
push ecx
push eax
call fcn.004049b0
mov ebx, eax
or ecx, 0xffffffff
sub ecx, ebx
mov esi, edx
mov edx, dword [esp + 0x10]
mov eax, 0x7fffffff
sbb eax, esi
cmp edx, eax
jg 0x401619
jl 0x401613
cmp edi, ecx
jae 0x401619
add ebx, edi
adc esi, edx
jmp 0x401621
or ebx, 0xffffffff
mov esi, 0x7fffffff
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], ebx
nop dword [eax]
lea ecx, [esp + 0x28]
call fcn.00401170
mov ecx, dword [esp + 0x2c]
cmp ecx, esi
jg 0x4016b6
mov eax, dword [esp + 0x28]
jl 0x40164b
cmp eax, ebx
jae 0x4016b6
mov edi, ebx
sub edi, eax
mov eax, esi
sbb eax, ecx
mov dword [esp + 0x10], eax
cmp eax, 0x4e94
jl 0x401674
jg 0x401668
cmp edi, 0x914f0000
jb 0x401674
push 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x401630
push 0
push 0xf4240
push eax
push edi
call fcn.00404820
push 0
push 0xf4240
mov ebx, edx
mov esi, eax
push ebx
push esi
call fcn.004049b0
cmp edx, dword [esp + 0x10]
jg 0x4016a3
jl 0x4016a0
cmp eax, edi
jae 0x4016a3
add esi, 1
push esi
call sub.KERNEL32.dll_Sleep
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
jmp 0x401630
mov ecx, dword [esp + 0x13bc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00403975
mov esp, ebp
pop ebp
ret
Function at 0x4016d0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
push 0
mov dword [esp + 0xc], esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x40171f
push 0x402040
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov edx, 0x40528c
call fcn.00401e20
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
jmp 0x40178f
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x401789
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x401789
push eax
lea ecx, [esp + 0x14]
call fcn.00401b70
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
xorps xmm0, xmm0
mov eax, esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [esp + 0x10]
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
movq xmm0, qword [esp + 0x20]
movq qword [esi + 0x10], xmm0
pop edi
pop esi
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00403975
mov esp, ebp
pop ebp
ret
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0x4052a0
mov ecx, esi
call fcn.00401b70
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.00403975
mov esp, ebp
pop ebp
ret
Function at 0x402d40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x402d9d
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x402d60
mov eax, dword [esi]
jmp 0x402e7b
cmp eax, 0x4e0
jb 0x402e7b
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x402db6
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x402e01
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x404216
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x404255
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x404255
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x404255
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x404255
cmp dword [ecx + 0x74], 0xe
jbe 0x404255
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10001b29
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x100c8360]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x134], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [ebp - 0x138], edi
mov dword [ebp - 0x140], eax
call fcn.10001de0
mov ebx, dword [0x100c97a0]
pop ecx
mov ecx, eax
mov eax, ebx
imul eax, ebx
mov dword [ebp - 0x130], ecx
and eax, 0x8000000f
jns 0x10001b80
dec eax
or eax, 0xfffffff0
inc eax
xor esi, esi
cmp eax, 0xe
jne 0x10001be8
mov eax, esi
mov dword [ebp - 0x12c], eax
lea edi, [ebp - 0x124]
mov ecx, esi
mov eax, ebx
inc ecx
cdq
idiv ecx
mov dword [ebp - 0x144], esi
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x148], edx
lea ecx, [esi + 1]
mov esi, ecx
cmp esi, 2
jl 0x10001baf
mov ecx, dword [ebp - 0x13c]
add edi, 2
push 0
pop esi
cmp ecx, 0xc
jl 0x10001b97
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp eax, 0xc
jl 0x10001b95
mov edi, dword [ebp - 0x138]
mov ecx, dword [ebp - 0x130]
mov eax, dword [ebp + 8]
test eax, eax
je 0x10001cdf
mov ebx, dword [ebp - 0x134]
test ebx, ebx
je 0x10001cdf
cmp ecx, dword [ebp + 0x14]
ja 0x10001cdf
mov edx, esi
test edi, edi
je 0x10001cab
cmp edx, edi
jae 0x10001c1f
movzx ecx, byte [edx + eax]
inc edx
jmp 0x10001c21
mov ecx, esi
cmp edx, edi
jae 0x10001c38
movzx edi, byte [edx + eax]
mov dword [ebp - 0x12c], edi
mov edi, dword [ebp - 0x138]
inc edx
jmp 0x10001c3e
mov dword [ebp - 0x12c], esi
cmp edx, edi
jae 0x10001c49
movzx eax, byte [edx + eax]
inc edx
jmp 0x10001c4b
mov eax, esi
shl ecx, 8
add ecx, dword [ebp - 0x12c]
shl ecx, 8
add ecx, eax
mov eax, ecx
shr eax, 0x12
and eax, 0x3f
mov al, byte [eax + 0x100c30b8]
mov byte [ebx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
add ebx, 4
mov al, byte [eax + 0x100c30b8]
mov byte [ebx - 3], al
mov eax, ecx
shr eax, 6
and eax, 0x3f
and ecx, 0x3f
mov al, byte [eax + 0x100c30b8]
mov byte [ebx - 2], al
mov cl, byte [ecx + 0x100c30b8]
mov eax, dword [ebp + 8]
mov byte [ebx - 1], cl
cmp edx, edi
jb 0x10001c18
mov ebx, dword [ebp - 0x134]
xor edx, edx
push 3
pop ecx
mov eax, edi
div ecx
lea ecx, [edx*4 + 0x100900ac]
mov edx, dword [ebp - 0x130]
cmp dword [ecx], esi
jle 0x10001cd3
lea eax, [edx - 1]
add eax, ebx
mov byte [eax], 0x3d
inc esi
dec eax
cmp esi, dword [ecx]
jl 0x10001cca
mov eax, dword [ebp - 0x140]
mov dword [eax], edx
mov al, 1
jmp 0x10001ce1
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007048b
leave
ret
Function at 0x100042f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c8360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x100c97a0]
mov eax, esi
imul eax, esi
push edi
push 0x15
cdq
pop ecx
idiv ecx
xor ebx, ebx
cmp edx, 0xb
jne 0x1000434b
mov ecx, ebx
mov edi, 0x8c
jmp 0x10004339
mov eax, esi
or eax, 0xffffffc3
add esi, eax
mov eax, esi
imul eax, esi
inc ecx
cmp ecx, eax
jg 0x10004343
mov eax, esi
cdq
idiv edi
cmp edx, 0x21
jne 0x10004328
mov esi, ecx
mov dword [0x100c97a0], esi
call fcn.1001871e
test al, al
jne 0x10004389
mov eax, esi
mov edi, 0xc5
cdq
mov dword [ebp - 0x14], edi
idiv edi
mov ecx, ebx
add edi, 0xfffffff0
jmp 0x1000437f
mov eax, esi
or eax, 0xffffffc3
add esi, eax
mov eax, esi
imul eax, esi
inc ecx
cmp ecx, eax
jg 0x10004383
mov eax, esi
cdq
idiv dword [ebp - 0x14]
cmp edx, edi
jne 0x10004368
mov dword [0x100c97a0], ecx
cmp byte [0x100c9ffc], bl
jne 0x100043bf
mov dword [ebp - 0x10], 0xb0a1c2a
mov dword [ebp - 0xc], 0x1e0c0113
mov byte [ebp - 8], bl
mov al, byte [ebx + 0x100c3198]
xor al, byte [ebp + ebx - 0x10]
inc ebx
mov byte [ebx + 0x100c339b], al
cmp ebx, 8
jl 0x100043a2
mov byte [0x100c9ffc], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0x100c339c
pop ebx
call fcn.1007048b
leave
ret

Function at 0x100043d3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c8360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c9ff7], 0
jne 0x1000444a
mov ecx, dword [0x100c97a0]
mov eax, ecx
imul eax, ecx
imul eax, ecx
push ebx
push 0x15
cdq
pop ecx
idiv ecx
xor ebx, ebx
mov dword [ebp - 0x14], 0x3003183f
mov dword [ebp - 0x10], 0x291b1b04
mov dword [ebp - 0xc], 0x21f0201
mov word [ebp - 8], 0x504e
mov byte [ebp - 6], bl
cmp edx, 0xc
jne 0x1000442c
dec dword [0x100c9a8c]
mov al, byte [ebx + 0x100c3198]
xor al, byte [ebp + ebx - 0x14]
inc ebx
mov byte [ebx + 0x100c3363], al
cmp ebx, 0xe
jl 0x1000442c
mov byte [0x100c9ff7], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100c3364
call fcn.1007048b
leave
ret

Function at 0x1000445b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x100c8360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x100c97a0]
push 0xf
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
pop ecx
idiv ecx
xor ebx, ebx
cmp edx, 0xe
jne 0x100044af
mov ecx, ebx
mov eax, dword [ebp + ecx*4 - 0x20c]
imul eax, eax, 0x99
add esi, eax
inc ecx
cmp ecx, 0x1f8
jb 0x10004491
mov dword [0x100c97a0], esi
cmp byte [0x100ca016], bl
jne 0x10004507
call fcn.10003fbe
mov ecx, dword [0x100c9b18]
mov edx, 0x29d0c075
test al, al
cmove ecx, edx
mov dword [0x100c9b18], ecx
mov dword [ebp - 0x14], 0x3003183f
mov dword [ebp - 0x10], 0x291b1b04
mov dword [ebp - 0xc], 0x21f0201
mov byte [ebp - 8], bl
mov al, byte [ebx + 0x100c3198]
xor al, byte [ebp + ebx - 0x14]
inc ebx
mov byte [ebx + 0x100c34f3], al
cmp ebx, 0xc
jl 0x100044ea
mov byte [0x100ca016], 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 0x100c34f4
pop ebx
call fcn.1007048b
leave
ret
Function at 0x1000451a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c8360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100ca046], 0
jne 0x1000457b
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], 0x17160538
mov dword [ebp - 0x10], 0x14233713
mov dword [ebp - 0xc], 0x2100a16
mov byte [ebp - 8], bl
call fcn.100042d6
test al, al
jne 0x1000455d
inc dword [0x100c9a2c]
mov al, byte [ebx + 0x100c3198]
xor al, byte [ebp + ebx - 0x14]
inc ebx
mov byte [ebx + 0x100c377b], al
cmp ebx, 0xc
jl 0x1000455d
mov byte [0x100ca046], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100c377c
call fcn.1007048b
leave
ret

Function at 0x1000458c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c8360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100ca050], 0
jne 0x10004617
push esi
mov esi, dword [0x100c97a0]
push edi
lea edi, [esi + 1]
mov eax, edi
imul eax, esi
push 0x18
cdq
pop ecx
idiv ecx
xor ecx, ecx
cmp edx, 9
jne 0x100045e3
sub esi, ecx
je 0x100045d9
dec esi
je 0x100045d1
mov dword [0x100c97a0], edi
jmp 0x100045e3
mov dword [0x100c97a0], ecx
jmp 0x100045e3
mov dword [0x100c97a0], 2
pop edi
mov dword [ebp - 0x10], 0x17160538
mov dword [ebp - 0xc], 0x1f162413
mov dword [ebp - 8], 0xd
pop esi
mov al, byte [ecx + 0x100c3198]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100c380b], al
cmp ecx, 0xb
jl 0x100045fa
mov byte [0x100ca050], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100c380c
call fcn.1007048b
leave
ret

Function at 0x10004628
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c8360]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.100041eb
test al, al
jne 0x1000466b
mov eax, dword [0x100c97a0]
push 0x64
cdq
pop ecx
idiv ecx
xor ecx, ecx
push 4
lea eax, [edx + 0x7b]
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1006f447
push eax
call fcn.10070c4d
pop ecx
pop ecx
cmp byte [0x100ca005], 0
jne 0x100046a4
xor ecx, ecx
mov dword [ebp - 0x10], 0x13031e38
mov dword [ebp - 0xc], 0xe06380a
mov byte [ebp - 8], cl
mov al, byte [ecx + 0x100c3198]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100c341b], al
cmp ecx, 8
jl 0x10004687
mov byte [0x100ca005], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100c341c
call fcn.1007048b
leave
ret

Function at 0x100046b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c8360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c9fdc], 0
jne 0x10004704
xor ecx, ecx
mov dword [ebp - 0x10], 0x15081938
mov dword [ebp - 0xc], 0x41d112d
mov word [ebp - 8], 0x1007
mov byte [ebp - 6], cl
mov al, byte [ecx + 0x100c3198]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100c31fb], al
cmp ecx, 0xa
jl 0x100046e7
mov byte [0x100c9fdc], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100c31fc
call fcn.1007048b
leave
ret
Function at 0x10004715
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100c8360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x100c97a0]
mov eax, esi
imul eax, esi
imul eax, esi
push 0x12
cdq
pop ecx
idiv ecx
xor ebx, ebx
cmp edx, 2
jne 0x100047a5
mov eax, esi
cdq
push edi
sub eax, edx
mov edi, eax
push 0x63
mov dword [ebp - 0x14], 0x63
mov ecx, ebx
sar edi, 1
pop eax
test edi, edi
jle 0x1000479f
mov eax, esi
cdq
and edx, 3
add edx, eax
sar edx, 2
mov dword [ebp - 0x20], edx
mov esi, ebx
mov eax, edi
mov dword [ebp - 0x18], edi
test edx, edx
jle 0x1000478e
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x14]
mov eax, esi
add edx, eax
dec eax
dec dword [ebp - 0x1c]
jne 0x1000477d
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x20]
add esi, ecx
dec eax
mov dword [ebp - 0x18], eax
jne 0x10004771
mov esi, dword [0x100c97a0]
mov eax, dword [ebp - 0x14]
inc ecx
cmp ecx, eax
jl 0x10004758
pop edi
cmp byte [0x100ca045], bl
jne 0x100047e0
call fcn.100040f6
mov dword [ebp - 0x10], 0x5091838
mov dword [ebp - 0xc], 0x1e1c0931
mov byte [ebp - 8], bl
mov al, byte [ebx + 0x100c3198]
xor al, byte [ebp + ebx - 0x10]
inc ebx
mov byte [ebx + 0x100c376f], al
cmp ebx, 8
jl 0x100047c3
mov byte [0x100ca045], 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 0x100c3770
pop ebx
call fcn.1007048b
leave
ret
Function at 0x100047f3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x974
mov eax, dword [0x100c8360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x100c97a0]
mov eax, ebx
imul eax, ebx
imul eax, ebx
push esi
cdq
push 7
pop ecx
idiv ecx
xor eax, eax
inc eax
cmp edx, 4
jne 0x1000482f
test ebx, ebx
cmove ebx, eax
mov dword [0x100c97a0], ebx
call fcn.1001871e
xor esi, esi
test al, al
jne 0x100048c4
mov eax, esi
mov dword [ebp - 0x96c], eax
lea ecx, [ebp - 0x968]
push edi
mov edx, esi
mov dword [ebp - 0x974], edx
mov dword [ebp - 0x970], ecx
lea ecx, [eax + 1]
lea edi, [edx + 1]
mov eax, ebx
cdq
idiv ecx
mov eax, ebx
mov ecx, ebx
sub ecx, dword [ebp - 0x96c]
mov esi, edx
cdq
imul esi, ecx
idiv edi
add esi, eax
sub esi, dword [ebp - 0x974]
push esi
push 0x100900a8
call fcn.10070c67
mov eax, dword [ebp - 0x96c]
mov ebx, dword [0x100c97a0]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x970]
mov edx, edi
add ecx, 4
mov dword [ebp - 0x974], edi
mov dword [ebp - 0x970], ecx
cmp edx, 0x17
jl 0x1000485b
inc eax
xor esi, esi
mov dword [ebp - 0x96c], eax
cmp eax, 0x1a
jl 0x1000484d
pop edi
cmp byte [0x100ca058], 0
jne 0x10004962
call fcn.1000e5ac
push 3
pop ecx
test al, al
jne 0x1000492a
jmp 0x10004926
mov eax, ebx
and eax, 0x80000001
jns 0x100048ed
dec eax
or eax, 0xfffffffe
inc eax
jne 0x100048fa
mov eax, ebx
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
jmp 0x10004901
lea ebx, [ebx*2 + 1]
mov eax, ebx
cdq
idiv ecx
mov dword [0x100c97a0], ebx
sub edx, esi
je 0x10004919
dec edx
dec edx
je 0x1000491c
dec edx
je 0x1000491d
jmp 0x10004926
add ebx, 2
inc ebx
add ebx, 2
mov dword [0x100c97a0], ebx
test ebx, ebx
jne 0x100048df
xor ebx, ebx
mov dword [ebp - 0x10], 0x15081938
mov word [ebp - 0xc], 0x420
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], cl
mov byte [ebp - 8], cl
mov byte [ebp - 7], bl
mov al, byte [ebx + 0x100c3198]
xor al, byte [ebp + ebx - 0x10]
inc ebx
mov byte [ebx + 0x100c3873], al
cmp ebx, 9
jl 0x10004945
mov byte [0x100ca058], 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 0x100c3874
pop ebx
call fcn.1007048b
leave
ret
Function at 0x10004975
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa12c
call fcn.10070d20
mov eax, dword [0x100c8360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.100041eb
test al, al
jne 0x10004a08
xor eax, eax
push 0x9d86
push eax
mov word [ebp - 0xa118], ax
lea eax, [ebp - 0xa116]
push eax
call fcn.10070e80
add esp, 0xc
xor edi, edi
xor esi, esi
mov ebx, 0x8e
xor edx, edx
test edi, edi
je 0x100049e9
test edx, edx
je 0x100049e9
lea eax, [esi + edx]
lea ecx, [esi + edx]
mov ax, word [ebp + eax*2 - 0xa234]
inc ax
add ax, word [ebp + ecx*2 - 0xa11a]
mov word [ebp + ecx*2 - 0xa118], ax
inc edx
cmp edx, ebx
jl 0x100049c1
add esi, ebx
inc edi
cmp esi, 0x4ec4
jl 0x100049bf
movsx ebx, word [ebp - 0x392]
mov dword [0x100c97a0], ebx
jmp 0x10004a0e
mov ebx, dword [0x100c97a0]
cmp byte [0x100ca05d], 0
jne 0x10004abc
mov dword [ebp - 0x10], 0x5091838
mov dword [ebp - 0xc], 0x1e0c1a2d
mov byte [ebp - 8], 0
xor ecx, ecx
mov al, byte [ecx + 0x100c3198]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100c38b3], al
cmp ecx, 8
jl 0x10004a2f
lea ecx, [ebx + 1]
lea eax, [ebx + 2]
imul eax, ecx
imul eax, ebx
push 0xb
cdq
pop ecx
idiv ecx
mov byte [0x100ca05d], 1
cmp edx, 4
jne 0x10004abc
xor eax, eax
mov dword [ebp - 0xa120], eax
lea esi, [ebp - 0x390]
xor edi, edi
and dword [ebp - 0xa12c], 0
mov eax, ebx
inc edi
cdq
idiv edi
mov dword [ebp - 0xa128], edi
mov edi, dword [ebp - 0xa12c]
mov dword [ebp - 0xa124], edx
lea ecx, [edi + 1]
mov edi, ecx
cmp edi, 8
jl 0x10004a92
mov edi, dword [ebp - 0xa128]
add esi, 8
cmp edi, 0xe
jl 0x10004a73
mov eax, dword [ebp - 0xa120]
inc eax
mov dword [ebp - 0xa120], eax
cmp eax, 8
jl 0x10004a71
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0x100c38b4
pop ebx
call fcn.1007048b
leave
ret