joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100011ca
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov ecx, dword [0x1004a0d4]
test ecx, ecx
jne 0x10001296
mov esi, dword [0x1004a0c4]
test esi, esi
jne 0x10001206
mov ecx, 0xf8f45725
call fcn.1000171e
mov esi, eax
mov dword [0x1004a0c4], eax
mov dword [esp + 2], 0xf4c3f4e2
mov word [esp + 6], 0xede2
mov byte [esp + 8], 0
mov word [esp], 0xe748
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x81
xor byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x10001223
mov byte [esp + 8], 0
mov ecx, dword [0x1004a0c8]
test ecx, ecx
jne 0x10001251
mov ecx, 0x53b2070f
call fcn.1000171e
mov ecx, eax
mov dword [0x1004a0c8], eax
mov dword [esp + 0xe], 0xeae0eaf1
mov word [esp + 0x12], 0xbab4
mov byte [esp + 0x14], 0
mov word [esp + 0xc], 0xe76b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x81
xor byte [esp + eax + 0xc], dl
inc eax
cmp eax, 8
jne 0x1000126f
lea eax, [esp + 0xc]
mov byte [eax + 8], 0
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a0d4], eax
push ebp
push ebx
push edi
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x100012a6
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x3c]
mov ebx, dword [esp + 0x38]
mov esi, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov ecx, dword [0x1004a0d8]
test ecx, ecx
jne 0x10001399
mov esi, dword [0x1004a0c4]
test esi, esi
jne 0x100012ee
mov ecx, 0xf8f45725
call fcn.1000171e
mov esi, eax
mov dword [0x1004a0c4], eax
mov dword [esp + 0xe], 0xe3f1e5e6
mov dword [esp + 0x12], 0xefe5e1c1
mov word [esp + 0x16], 0xdc
mov word [esp + 0xc], 0xf043
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x81
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xb
jne 0x1000130f
mov byte [esp + 0x17], 0
mov ecx, dword [0x1004a0c8]
test ecx, ecx
jne 0x1000133e
mov ecx, 0x53b2070f
call fcn.1000171e
mov ecx, eax
mov dword [0x1004a0c8], eax
mov dword [esp + 2], 0xeae0eaf1
mov word [esp + 6], 0xbab4
mov byte [esp + 8], 0
mov word [esp], 0xe76b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x81
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x1000135b
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a0d8], eax
mov edx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
push eax
push edi
push ebp
push ebx
push esi
push edx
push dword [esp + 0x44]
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0x1c
Function at 0x100013b0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push esi
sub esp, 0x1c
mov ecx, dword [0x1004a0dc]
test ecx, ecx
jne 0x10001475
mov esi, dword [0x1004a0c4]
test esi, esi
jne 0x100013dd
mov ecx, 0xf8f45725
call fcn.1000171e
mov esi, eax
mov dword [0x1004a0c4], eax
mov dword [esp + 0xe], 0xf5e4c8f7
mov dword [esp + 0x12], 0xf8fbcdf3
mov word [esp + 0x16], 0xfee4
mov byte [esp + 0x18], 0
mov word [esp + 0xc], 0xe747
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x81
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xc
jne 0x10001403
mov byte [esp + 0x18], 0
mov ecx, dword [0x1004a0c8]
test ecx, ecx
jne 0x10001432
mov ecx, 0x53b2070f
call fcn.1000171e
mov ecx, eax
mov dword [0x1004a0c8], eax
mov dword [esp + 2], 0xeae0eaf1
mov word [esp + 6], 0xbab4
mov byte [esp + 8], 0
mov word [esp], 0xe76b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x81
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x1000144f
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a0dc], eax
call ecx
add esp, 0x1c
pop esi
ret

Function at 0x1000147c
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [0x1004a0e0]
test ecx, ecx
jne 0x10001559
mov esi, dword [0x1004a0c4]
test esi, esi
jne 0x100014bc
mov ecx, 0xf8f45725
call fcn.1000171e
mov esi, eax
mov dword [0x1004a0c4], eax
mov dword [esp + 0xe], 0xeaecc2f7
mov dword [esp + 0x12], 0xe3e6d8e2
mov dword [esp + 0x16], 0xfce8f8e5
mov byte [esp + 0x1a], 0
mov word [esp + 0xc], 0xe753
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x81
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xe
jne 0x100014e3
mov byte [esp + 0x1a], 0
mov ecx, dword [0x1004a0c8]
test ecx, ecx
jne 0x10001512
mov ecx, 0x53b2070f
call fcn.1000171e
mov ecx, eax
mov dword [0x1004a0c8], eax
mov dword [esp + 2], 0xeae0eaf1
mov word [esp + 6], 0xbab4
mov byte [esp + 8], 0
mov word [esp], 0xe76b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x81
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x1000152f
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a0e0], eax
mov eax, dword [esp + 0x30]
push edi
push ebp
push ebx
push eax
call ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x1000156a
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
mov ebp, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov ecx, dword [0x1004a0e4]
test ecx, ecx
jne 0x1000163d
mov esi, dword [0x1004a0c4]
test esi, esi
jne 0x100015ae
mov ecx, 0xf8f45725
call fcn.1000171e
mov esi, eax
mov dword [0x1004a0c4], eax
mov dword [esp + 0xe], 0xc0e0f0ea
mov dword [esp + 0x12], 0xece4ee
mov word [esp + 0xc], 0xf057
movsd xmm0, qword [esp + 0xd]
xorps xmm0, xmmword [0x1003f1c0]
movlps qword [esp + 0xd], xmm0
mov ecx, dword [0x1004a0c8]
test ecx, ecx
jne 0x100015f2
mov ecx, 0x53b2070f
call fcn.1000171e
mov ecx, eax
mov dword [0x1004a0c8], eax
mov dword [esp + 2], 0xeae0eaf1
mov word [esp + 6], 0xbab4
mov byte [esp + 8], 0
mov word [esp], 0xe76b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x81
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x1000160f
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a0e4], eax
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
push ebx
push edi
push ebp
push edx
push eax
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret 0x14

Function at 0x1000164e
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x24]
mov ecx, dword [0x1004a0e8]
test ecx, ecx
jne 0x10001713
mov esi, dword [0x1004a0c4]
test esi, esi
jne 0x10001680
mov ecx, 0xf8f45725
call fcn.1000171e
mov esi, eax
mov dword [0x1004a0c4], eax
mov dword [esp + 0xe], 0xcee0f7ec
mov dword [esp + 0x12], 0xe6ede6e6
mov word [esp + 0x16], 0xee
mov word [esp + 0xc], 0xee43
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x81
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xb
jne 0x100016a1
mov byte [esp + 0x17], 0
mov ecx, dword [0x1004a0c8]
test ecx, ecx
jne 0x100016d0
mov ecx, 0x53b2070f
call fcn.1000171e
mov ecx, eax
mov dword [0x1004a0c8], eax
mov dword [esp + 2], 0xeae0eaf1
mov word [esp + 6], 0xbab4
mov byte [esp + 8], 0
mov word [esp], 0xe76b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x81
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x100016ed
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a0e8], eax
push edi
call ecx
add esp, 0x18
pop esi
pop edi
ret 4
Function at 0x1000171e
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0xc], ecx
mov eax, dword [0x1004a0c0]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + 0x14]
add edi, 0x14
mov eax, dword [esi + 0x10]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x100017e0
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x100017e0
cmp word [eax + ecx + 0x14], 0x60
jb 0x100017e0
cmp dword [eax + ecx + 0x74], 0
je 0x100017e0
mov edx, dword [eax + ecx + 0x78]
mov ecx, edx
mov dword [esp], edx
test edx, edx
je 0x100017e0
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x18]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x100017e0
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x20]
add ecx, eax
mov dword [esp + 8], ecx
lea ecx, [eax + 1]
mov dword [esp + 4], ecx
xor ebx, ebx
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + ebx*4]
mov dl, byte [eax + ecx]
test dl, dl
je 0x100017c8
add ecx, dword [esp + 4]
mov ebp, 0x811c9dc5
movsx edx, dl
xor edx, ebp
imul ebp, edx, 0x1000193
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x100017b4
jmp 0x100017cd
mov ebp, 0x811c9dc5
cmp ebp, dword [esp + 0xc]
je 0x100017dc
inc ebx
cmp ebx, dword [esp + 0x10]
jne 0x1000179d
jmp 0x100017e0
test eax, eax
jne 0x100017f4
mov esi, dword [esi]
cmp esi, edi
jne 0x1000173a
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp]
mov ecx, dword [eax + edx + 0x24]
add ecx, eax
mov edx, dword [eax + edx + 0x1c]
add edx, eax
movzx ecx, word [ecx + ebx*2]
add eax, dword [edx + ecx*4]
jmp 0x100017ec

Function at 0x10001902
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x24]
mov ecx, dword [0x1004a0f8]
test ecx, ecx
jne 0x100019c4
mov esi, dword [0x1004a0f0]
test esi, esi
jne 0x10001934
mov ecx, 0xf8f45725
call fcn.10002e5c
mov esi, eax
mov dword [0x1004a0f0], eax
mov dword [esp + 2], 0xdeccfccc
mov word [esp + 6], 0xc9d2
mov byte [esp + 8], 0
mov word [esp], 0xd253
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xb6
xor byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x10001951
mov byte [esp + 8], 0
mov ecx, dword [0x1004a0f4]
test ecx, ecx
jne 0x1000197f
mov ecx, 0x53b2070f
call fcn.10002e5c
mov ecx, eax
mov dword [0x1004a0f4], eax
mov dword [esp + 0xe], 0xd7dfd7ca
mov word [esp + 0x12], 0x8f8f
mov byte [esp + 0x14], 0
mov word [esp + 0xc], 0xd26b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xb6
xor byte [esp + eax + 0xc], dl
inc eax
cmp eax, 8
jne 0x1000199d
lea eax, [esp + 0xc]
mov byte [eax + 8], 0
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a0f8], eax
push edi
call ecx
add esp, 0x18
pop esi
pop edi
ret 4
Function at 0x10001a48
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov ebp, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov ecx, dword [0x1004a0fc]
test ecx, ecx
jne 0x10001b1c
mov esi, dword [0x1004a0f0]
test esi, esi
jne 0x10001a84
mov ecx, 0xf8f45725
call fcn.10002e5c
mov esi, eax
mov dword [0x1004a0f0], eax
mov dword [esp + 0xe], 0xdeced8dd
mov dword [esp + 0x12], 0xdacac8f1
mov word [esp + 0x16], 0x96b8
mov byte [esp + 0x18], 0
mov word [esp + 0xc], 0xc543
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xb6
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xc
jne 0x10001aaa
mov byte [esp + 0x18], 0
mov ecx, dword [0x1004a0f4]
test ecx, ecx
jne 0x10001ad9
mov ecx, 0x53b2070f
call fcn.10002e5c
mov ecx, eax
mov dword [0x1004a0f4], eax
mov dword [esp + 2], 0xd7dfd7ca
mov word [esp + 6], 0x8f8f
mov byte [esp + 8], 0
mov word [esp], 0xd26b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xb6
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10001af6
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a0fc], eax
push ebp
push ebx
push edi
call ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret 0xc

Function at 0x10001b2c
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x24]
mov eax, dword [0x1004a100]
test eax, eax
jne 0x10001bee
mov esi, dword [0x1004a0f0]
test esi, esi
jne 0x10001b5d
mov ecx, 0xf8f45725
call fcn.10002e5c
mov esi, eax
mov dword [0x1004a0f0], eax
mov dword [esp + 0xe], 0xc9eacdd1
mov dword [esp + 0x12], 0xccdbded3
mov word [esp + 0x16], 0xb3
mov word [esp + 0xc], 0xcf45
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xb6
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xb
jne 0x10001b7e
mov byte [esp + 0x17], 0
mov ecx, dword [0x1004a0f4]
test ecx, ecx
jne 0x10001bad
mov ecx, 0x53b2070f
call fcn.10002e5c
mov ecx, eax
mov dword [0x1004a0f4], eax
mov dword [esp + 2], 0xd7dfd7ca
mov word [esp + 6], 0x8f8f
mov byte [esp + 8], 0
mov word [esp], 0xd26b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xb6
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10001bca
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov dword [0x1004a100], eax
push edi
call eax
add esp, 0x18
pop esi
pop edi
ret 4
Function at 0x10001bfa
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov ecx, dword [0x1004a104]
test ecx, ecx
jne 0x10001cb8
mov esi, dword [0x1004a0f0]
test esi, esi
jne 0x10001c36
mov ecx, 0xf8f45725
call fcn.10002e5c
mov esi, eax
mov dword [0x1004a0f0], eax
mov dword [esp + 2], 0xcbd7dad5
mov byte [esp + 6], 0
mov word [esp], 0xd26d
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xb6
xor byte [esp + eax], cl
inc eax
cmp eax, 6
jne 0x10001c4c
mov byte [esp + 6], 0
mov ecx, dword [0x1004a0f4]
test ecx, ecx
jne 0x10001c7a
mov ecx, 0x53b2070f
call fcn.10002e5c
mov ecx, eax
mov dword [0x1004a0f4], eax
mov dword [esp + 0xa], 0xcfc8dace
mov byte [esp + 0xe], 0
mov word [esp + 8], 0xc46d
xor eax, eax
inc eax
mov edx, eax
add dl, 0xb6
xor byte [esp + eax + 8], dl
inc eax
cmp eax, 6
jne 0x10001c91
lea eax, [esp + 8]
mov byte [eax + 6], 0
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a104], eax
push ebp
push ebx
push edi
call ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x10002a6c
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov ecx, dword [0x1004a108]
test ecx, ecx
jne 0x10002b2b
mov esi, dword [0x1004a0f0]
test esi, esi
jne 0x10002aa3
mov ecx, 0xf8f45725
call fcn.10002e5c
mov esi, eax
mov dword [0x1004a0f0], eax
mov word [esp + 0x18], 0x90b0
mov byte [esp + 0x1a], 0
movaps xmm0, xmmword [0x1003f200]
movups xmmword [esp + 8], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xb6
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0x12
jne 0x10002abe
mov byte [esp + 0x1a], 0
mov ecx, dword [0x1004a0f4]
test ecx, ecx
jne 0x10002aed
mov ecx, 0x53b2070f
call fcn.10002e5c
mov ecx, eax
mov dword [0x1004a0f4], eax
mov dword [esp + 2], 0x88d6d5dd
mov word [esp + 6], 0x8e
mov word [esp], 0xdf73
xor eax, eax
inc eax
mov edx, eax
add dl, 0xb6
xor byte [esp + eax], dl
inc eax
cmp eax, 7
jne 0x10002b05
mov eax, esp
mov byte [eax + 7], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a108], eax
push ebx
push edi
call ecx
add esp, 0x1c
pop esi
pop edi
pop ebx
ret 8
Function at 0x10002b38
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push esi
sub esp, 0x1c
mov ecx, dword [0x1004a10c]
test ecx, ecx
jne 0x10002be6
mov esi, dword [0x1004a0f0]
test esi, esi
jne 0x10002b65
mov ecx, 0xf8f45725
call fcn.10002e5c
mov esi, eax
mov dword [0x1004a0f0], eax
movaps xmm0, xmmword [0x1003f210]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xb6
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0xf
jne 0x10002b74
mov byte [esp + 0x1b], 0
mov ecx, dword [0x1004a0f4]
test ecx, ecx
jne 0x10002ba3
mov ecx, 0x53b2070f
call fcn.10002e5c
mov ecx, eax
mov dword [0x1004a0f4], eax
mov dword [esp + 2], 0xd7dfd7ca
mov word [esp + 6], 0x8f8f
mov byte [esp + 8], 0
mov word [esp], 0xd26b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xb6
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10002bc0
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a10c], eax
call ecx
add esp, 0x1c
pop esi
ret

Function at 0x10002bee
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x24]
mov ecx, dword [0x1004a110]
test ecx, ecx
jne 0x10002cb0
mov esi, dword [0x1004a0f0]
test esi, esi
jne 0x10002c20
mov ecx, 0xf8f45725
call fcn.10002e5c
mov esi, eax
mov dword [0x1004a0f0], eax
mov dword [esp + 2], 0xded6cbcc
mov word [esp + 6], 0xead2
mov byte [esp + 8], 0
mov word [esp], 0xc46c
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xb6
xor byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x10002c3d
mov byte [esp + 8], 0
mov ecx, dword [0x1004a0f4]
test ecx, ecx
jne 0x10002c6b
mov ecx, 0x53b2070f
call fcn.10002e5c
mov ecx, eax
mov dword [0x1004a0f4], eax
mov dword [esp + 0xe], 0xd7dfd7ca
mov word [esp + 0x12], 0x8f8f
mov byte [esp + 0x14], 0
mov word [esp + 0xc], 0xd26b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xb6
xor byte [esp + eax + 0xc], dl
inc eax
cmp eax, 8
jne 0x10002c89
lea eax, [esp + 0xc]
mov byte [eax + 8], 0
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a110], eax
push edi
call ecx
add esp, 0x18
pop esi
pop edi
ret 4
Function at 0x10002cbc
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [0x1004a114]
test ecx, ecx
jne 0x10002d7a
mov esi, dword [0x1004a0f0]
test esi, esi
jne 0x10002cf3
mov ecx, 0xf8f45725
call fcn.10002e5c
mov esi, eax
mov dword [0x1004a0f0], eax
mov dword [esp + 0xe], 0xd6d9cbcc
mov dword [esp + 0x12], 0xe9d4cc
mov word [esp + 0xc], 0xc46c
movsd xmm0, qword [esp + 0xd]
xorps xmm0, xmmword [0x1003f220]
movlps qword [esp + 0xd], xmm0
mov ecx, dword [0x1004a0f4]
test ecx, ecx
jne 0x10002d37
mov ecx, 0x53b2070f
call fcn.10002e5c
mov ecx, eax
mov dword [0x1004a0f4], eax
mov dword [esp + 2], 0xd7dfd7ca
mov word [esp + 6], 0x8f8f
mov byte [esp + 8], 0
mov word [esp], 0xd26b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xb6
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10002d54
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a114], eax
push ebx
push edi
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
ret 8

Function at 0x10002d88
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [0x1004a118]
test ecx, ecx
jne 0x10002e4f
mov esi, dword [0x1004a0f0]
test esi, esi
jne 0x10002dbf
mov ecx, 0xf8f45725
call fcn.10002e5c
mov esi, eax
mov dword [0x1004a0f0], eax
mov dword [esp + 2], 0xd6d9cbcc
mov word [esp + 6], 0xeacc
mov byte [esp + 8], 0
mov word [esp], 0xc46c
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xb6
xor byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x10002ddc
mov byte [esp + 8], 0
mov ecx, dword [0x1004a0f4]
test ecx, ecx
jne 0x10002e0a
mov ecx, 0x53b2070f
call fcn.10002e5c
mov ecx, eax
mov dword [0x1004a0f4], eax
mov dword [esp + 0xe], 0xd7dfd7ca
mov word [esp + 0x12], 0x8f8f
mov byte [esp + 0x14], 0
mov word [esp + 0xc], 0xd26b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xb6
xor byte [esp + eax + 0xc], dl
inc eax
cmp eax, 8
jne 0x10002e28
lea eax, [esp + 0xc]
mov byte [eax + 8], 0
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1004a118], eax
push ebx
push edi
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
ret 8
Function at 0x10002e5c
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0xc], ecx
mov eax, dword [0x1004a0ec]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + 0x14]
add edi, 0x14
mov eax, dword [esi + 0x10]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x10002f1e
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x10002f1e
cmp word [eax + ecx + 0x14], 0x60
jb 0x10002f1e
cmp dword [eax + ecx + 0x74], 0
je 0x10002f1e
mov edx, dword [eax + ecx + 0x78]
mov ecx, edx
mov dword [esp], edx
test edx, edx
je 0x10002f1e
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x18]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x10002f1e
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x20]
add ecx, eax
mov dword [esp + 8], ecx
lea ecx, [eax + 1]
mov dword [esp + 4], ecx
xor ebx, ebx
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + ebx*4]
mov dl, byte [eax + ecx]
test dl, dl
je 0x10002f06
add ecx, dword [esp + 4]
mov ebp, 0x811c9dc5
movsx edx, dl
xor edx, ebp
imul ebp, edx, 0x1000193
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10002ef2
jmp 0x10002f0b
mov ebp, 0x811c9dc5
cmp ebp, dword [esp + 0xc]
je 0x10002f1a
inc ebx
cmp ebx, dword [esp + 0x10]
jne 0x10002edb
jmp 0x10002f1e
test eax, eax
jne 0x10002f32
mov esi, dword [esi]
cmp esi, edi
jne 0x10002e78
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp]
mov ecx, dword [eax + edx + 0x24]
add ecx, eax
mov edx, dword [eax + edx + 0x1c]
add edx, eax
movzx ecx, word [ecx + ebx*2]
add eax, dword [edx + ecx*4]
jmp 0x10002f2a

Function at 0x10002f58
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
call fcn.10023c20
push eax
push 0x1004a328
call fcn.10002fb0
mov dword [esp + 0x10], 0xd329d34d
mov word [esp + 0x26], 0
movaps xmm0, xmmword [0x1003fa10]
movups xmmword [esp], xmm0
xor eax, eax
inc eax
lea ecx, [eax - 0x2ce0]
xor word [esp + eax*2], cx
inc eax
cmp eax, 0x13
jne 0x10002f88
mov eax, esp
mov word [eax + 0x26], 0
push eax
push 0x1004a328
call fcn.10003084
add esp, 0x28
ret