joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001ca7a
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x844
mov ebp, dword [esp + 0x858]
mov edi, 0x208
xor esi, esi
lea eax, [esp + 0x434]
push edi
push esi
push eax
call fcn.10031f20
add esp, 0xc
lea eax, [esp + 0x22c]
push edi
push esi
push eax
call fcn.10031f20
add esp, 0xc
lea eax, [esp + 0x63c]
push edi
push esi
push eax
call fcn.10031f20
add esp, 0xc
mov ebp, dword [ebp]
lea eax, [esp + 0x24]
push edi
push esi
push eax
call fcn.10031f20
add esp, 0xc
mov word [esp + 0x22], 0
movaps xmm0, xmmword [0x100405e0]
movups xmmword [esp + 4], xmm0
xor eax, eax
inc eax
lea ecx, [eax + 0x32e3]
xor word [esp + eax*2 + 4], cx
inc eax
cmp eax, 0xf
jne 0x1001caf0
lea eax, [esp + 4]
mov word [eax + 0x1e], 0
push 0x208
lea ebx, [esp + 0x28]
push ebx
push eax
call fcn.100033c4
push ebp
push 0x40
call fcn.1001c9a4
mov esi, eax
push ebp
push 0
push eax
call fcn.10013ed4
add esp, 0xc
mov edi, dword [esp + 0x858]
lea eax, [edi + 0x84]
push ebp
push eax
push esi
call fcn.10013fc8
add esp, 0xc
push ebx
lea ebx, [esp + 0x438]
push ebx
call fcn.10002fb0
lea eax, [edi + 4]
push eax
push ebx
call fcn.10003084
push ebp
push esi
push ebx
call fcn.10014b2c
add esp, 0xc
test esi, esi
je 0x1001cb76
push esi
call fcn.1001cc84
mov edi, dword [esp + 0x858]
lea eax, [edi + ebp]
add eax, 0x88
mov dword [esp], eax
mov ebx, dword [eax - 4]
push ebx
push 0x40
call fcn.1001c9a4
mov esi, eax
push ebx
push 0
push eax
call fcn.10013ed4
add esp, 0xc
lea eax, [edi + ebp]
add eax, 0x108
add ebp, 0x108
push ebx
push eax
push esi
call fcn.10013fc8
add esp, 0xc
lea eax, [esp + 0x24]
push eax
lea edi, [esp + 0x230]
push edi
call fcn.10002fb0
push dword [esp]
push edi
call fcn.10003084
push ebx
push esi
push edi
call fcn.10014b2c
add esp, 0xc
test esi, esi
je 0x1001cbea
push esi
call fcn.1001cc84
add ebx, ebp
mov eax, dword [esp + 0x858]
lea edi, [eax + ebx]
add edi, 0x84
mov ebp, dword [edi - 0x84]
push ebp
push 0x40
call fcn.1001c9a4
mov esi, eax
push ebp
push 0
push eax
call fcn.10013ed4
add esp, 0xc
push ebp
push edi
push esi
call fcn.10013fc8
add esp, 0xc
lea eax, [esp + 0x24]
push eax
lea edi, [esp + 0x640]
push edi
call fcn.10002fb0
mov eax, dword [esp + 0x858]
add eax, ebx
add eax, 4
push eax
push edi
call fcn.10003084
push ebp
push esi
push edi
call fcn.10014b2c
add esp, 0xc
test esi, esi
je 0x1001cc5d
push esi
call fcn.1001cc84
push edi
lea eax, [esp + 0x230]
push eax
lea eax, [esp + 0x43c]
push eax
call fcn.1001cd48
add esp, 0xc
xor eax, eax
add esp, 0x844
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1001cc84
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x18
mov edi, dword [esp + 0x24]
mov ecx, dword [0x1005138c]
test ecx, ecx
jne 0x1001cd3d
mov esi, dword [0x10051378]
test esi, esi
jne 0x1001ccb6
mov ecx, 0xf8f45725
call fcn.1001e859
mov esi, eax
mov dword [0x10051378], eax
mov dword [esp + 0xe], 0xae8b8786
mov dword [esp + 0x12], 0x8e8f9b
mov word [esp + 0xc], 0x8b4c
movsd xmm0, qword [esp + 0xd]
xorps xmm0, xmmword [0x100405d0]
movlps qword [esp + 0xd], xmm0
mov ecx, dword [0x1005137c]
test ecx, ecx
jne 0x1001ccfa
mov ecx, 0x53b2070f
call fcn.1001e859
mov ecx, eax
mov dword [0x1005137c], eax
mov dword [esp + 2], 0x84828897
mov word [esp + 6], 0xd8da
mov byte [esp + 8], 0
mov word [esp], 0x816b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xe3
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x1001cd17
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1005138c], eax
push edi
call ecx
add esp, 0x18
pop esi
pop edi
ret 4

Function at 0x1001e859
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0xc], ecx
mov eax, dword [0x10051374]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + 0x14]
add edi, 0x14
mov eax, dword [esi + 0x10]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x1001e91b
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x1001e91b
cmp word [eax + ecx + 0x14], 0x60
jb 0x1001e91b
cmp dword [eax + ecx + 0x74], 0
je 0x1001e91b
mov edx, dword [eax + ecx + 0x78]
mov ecx, edx
mov dword [esp], edx
test edx, edx
je 0x1001e91b
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x18]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x1001e91b
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x20]
add ecx, eax
mov dword [esp + 8], ecx
lea ecx, [eax + 1]
mov dword [esp + 4], ecx
xor ebx, ebx
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + ebx*4]
mov dl, byte [eax + ecx]
test dl, dl
je 0x1001e903
add ecx, dword [esp + 4]
mov ebp, 0x811c9dc5
movsx edx, dl
xor edx, ebp
imul ebp, edx, 0x1000193
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x1001e8ef
jmp 0x1001e908
mov ebp, 0x811c9dc5
cmp ebp, dword [esp + 0xc]
je 0x1001e917
inc ebx
cmp ebx, dword [esp + 0x10]
jne 0x1001e8d8
jmp 0x1001e91b
test eax, eax
jne 0x1001e92f
mov esi, dword [esi]
cmp esi, edi
jne 0x1001e875
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp]
mov ecx, dword [eax + edx + 0x24]
add ecx, eax
mov edx, dword [eax + edx + 0x1c]
add edx, eax
movzx ecx, word [ecx + ebx*2]
add eax, dword [edx + ecx*4]
jmp 0x1001e927
Function at 0x1001f596
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c4
lea eax, [esp + 4]
mov dword [eax], 0
push eax
call fcn.1001a348
add esp, 4
test eax, eax
je 0x1001f5c1
mov dword [esp + 4], 0
jmp 0x1001f5d2
cmp dword [esp + 4], 0
je 0x1001f5d2
lea eax, [esp + 8]
push eax
call fcn.1001fa88
movzx eax, word [0x1004165e]
lea ebx, [esp + 0xbc]
mov word [ebx + 0x30], ax
movups xmm0, xmmword [0x1004164e]
movups xmmword [ebx + 0x20], xmm0
movups xmm0, xmmword [0x1004163e]
movups xmmword [ebx + 0x10], xmm0
movups xmm0, xmmword [str.SoftwareClassesmscfile]
movups xmmword [ebx], xmm0
mov esi, 0x80000001
push ebx
push esi
call fcn.1001f9b0
lea edi, [esp + 0x64]
push 0x58
push str.SoftwareClassesmscfile_shellopencommand
push edi
call fcn.100318d0
sub esp, 0x18
xor ebp, ebp
mov dword [esp + 0x20], ebp
lea eax, [esp + 0x24]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebp
movaps xmm0, xmmword [0x1003fec0]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.10019956
mov esi, eax
test eax, eax
jne 0x1001f754
mov esi, dword [esp + 0x2d8]
push esi
call fcn.10002bee
add eax, eax
push eax
push esi
push 1
push ebp
push ebp
push dword [esp + 0x14]
call fcn.10019a56
mov esi, eax
push dword [esp]
call fcn.10019b56
test esi, esi
jne 0x1001f754
movzx eax, word [0x100416d8]
mov word [esp + 0x2c], ax
movups xmm0, xmmword [0x100416c8]
movups xmmword [esp + 0x1c], xmm0
movups xmm0, xmmword [str.__c_eventvwr.exe]
movups xmmword [esp + 0xc], xmm0
push 0x208
push 0
push ebx
call fcn.10031f20
add esp, 0xc
mov dword [esp + 0x40], 0x4a8b4aaf
mov word [esp + 0x56], 0
movaps xmm0, xmmword [0x10040dd0]
movups xmmword [esp + 0x30], xmm0
xor eax, eax
inc eax
lea ecx, [eax + 0x4a82]
xor word [esp + eax*2 + 0x30], cx
inc eax
cmp eax, 0x13
jne 0x1001f6da
lea esi, [esp + 0x30]
mov word [esi + 0x26], 0
push 0x208
push ebx
push esi
call fcn.100033c4
lea eax, [esp + 0xc]
push eax
push ebx
call fcn.10003084
push 0x2710
push 0
push ebx
call fcn.1001aa44
add esp, 0xc
movzx eax, word [0x1004165e]
mov word [esi + 0x30], ax
movups xmm0, xmmword [0x1004164e]
movups xmmword [esi + 0x20], xmm0
movups xmm0, xmmword [0x1004163e]
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [str.SoftwareClassesmscfile]
movups xmmword [esi], xmm0
push esi
push 0x80000001
call fcn.1001f9b0
xor esi, esi
mov eax, esi
add esp, 0x2c4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1001f762
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x518
lea eax, [esp + 4]
mov dword [eax], 0
push eax
call fcn.1001a348
add esp, 4
test eax, eax
je 0x1001f78d
mov dword [esp + 4], 0
jmp 0x1001f79e
cmp dword [esp + 4], 0
je 0x1001f79e
lea eax, [esp + 0x18]
push eax
call fcn.1001fa88
mov esi, 0x56
mov ebx, str.SoftwareClassesFolder_shellopencommand
lea edi, [esp + 0x108]
push esi
push ebx
push edi
call fcn.100318d0
add esp, 0xc
mov ebp, 0x80000001
push edi
push ebp
call fcn.1001f9b0
lea edi, [esp + 0xb2]
push esi
push ebx
push edi
call fcn.100318d0
sub esp, 0x18
xor ebx, ebx
mov dword [esp + 0x20], ebx
lea eax, [esp + 0x24]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
movaps xmm0, xmmword [0x1003fec0]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edi
mov dword [esp], ebp
call fcn.10019956
mov esi, eax
test eax, eax
jne 0x1001f9a3
lea ecx, [esp + 0x10]
call fcn.10013ddc
push 0x208
push ebx
lea ebp, [esp + 0x110]
push ebp
call fcn.10031f20
add esp, 0xc
push 0x1004a328
push ebp
call fcn.10002fb0
lea esi, [esp + 8]
mov ecx, esi
call fcn.10013ddc
mov edi, 0x1003f9ea
mov ecx, esi
push edi
call fcn.10013e6e
mov ecx, esi
push ebp
call fcn.10014114
mov ecx, esi
push edi
call fcn.10014114
mov ecx, esi
push str._1_0_1
call fcn.10014114
push dword [esi + 4]
push dword [esi]
push 1
push ebx
push ebx
push dword [esp + 0x14]
call fcn.10019a56
test eax, eax
je 0x1001f88f
mov esi, eax
push dword [esp]
call fcn.10019b56
jmp 0x1001f991
movups xmm0, xmmword [0x100417f6]
lea eax, [esp + 0x90]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [str.DelegateExecute]
movups xmmword [eax], xmm0
mov ecx, dword [esp]
sub esp, 0x18
movaps xmm0, xmmword [0x1003fd90]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.10019a56
mov esi, eax
push dword [esp]
call fcn.10019b56
test esi, esi
jne 0x1001f991
movups xmm0, xmmword [0x10041720]
movups xmmword [esp + 0x28], xmm0
movups xmm0, xmmword [str.__c_sdclt.exe]
movups xmmword [esp + 0x1c], xmm0
lea esi, [esp + 0x310]
push 0x208
push 0
push esi
call fcn.10031f20
add esp, 0xc
mov dword [esp + 0x48], 0x4a8b4aaf
mov word [esp + 0x5e], 0
movaps xmm0, xmmword [0x10040dd0]
movups xmmword [esp + 0x38], xmm0
xor eax, eax
inc eax
lea ecx, [eax + 0x4a82]
xor word [esp + eax*2 + 0x38], cx
inc eax
cmp eax, 0x13
jne 0x1001f928
lea edi, [esp + 0x38]
mov word [edi + 0x26], 0
push 0x208
push esi
push edi
call fcn.100033c4
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.10003084
push 0x2710
push 0
push esi
call fcn.1001aa44
add esp, 0xc
push 0xbb8
call fcn.100151f2
push 0x56
push str.SoftwareClassesFolder_shellopencommand
push edi
call fcn.100318d0
add esp, 0xc
push edi
push 0x80000001
call fcn.1001f9b0
xor esi, esi
lea ecx, [esp + 8]
call fcn.10013eba
lea ecx, [esp + 0x10]
call fcn.10013eba
mov eax, esi
add esp, 0x518
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1001f9b0
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [0x1005139c]
test ecx, ecx
jne 0x1001fa7a
mov esi, dword [0x10051394]
test esi, esi
jne 0x1001f9e7
mov ecx, 0xf8f45725
call fcn.1001fb6a
mov esi, eax
mov dword [0x10051394], eax
mov dword [esp + 0xa], 0xe2eae0c0
mov dword [esp + 0xe], 0xeec1ecfc
mov word [esp + 0x12], 0xdaf5
mov byte [esp + 0x14], 0
mov word [esp + 8], 0xcb53
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x82
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0xc
jne 0x1001fa0d
mov byte [esp + 0x14], 0
mov ecx, dword [0x10051398]
test ecx, ecx
jne 0x1001fa3c
mov ecx, 0x53b2070f
call fcn.1001fb6a
mov ecx, eax
mov dword [0x10051398], eax
mov dword [esp + 2], 0xf7e7f2e8
mov word [esp + 6], 0xe1
mov word [esp], 0xeb73
xor eax, eax
inc eax
mov edx, eax
add dl, 0x82
xor byte [esp + eax], dl
inc eax
cmp eax, 7
jne 0x1001fa54
mov eax, esp
mov byte [eax + 7], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x1005139c], eax
push ebx
push edi
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
ret 8

Function at 0x1001fa88
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x2c
mov edi, dword [esp + 0x38]
mov ecx, dword [0x100513a0]
test ecx, ecx
jne 0x1001fb5f
mov esi, dword [0x10051394]
test esi, esi
jne 0x1001faba
mov ecx, 0xf8f45725
call fcn.1001fb6a
mov esi, eax
mov dword [0x10051394], eax
mov dword [esp + 0x1c], 0xc7e7d5a6
mov dword [esp + 0x20], 0xebf1f3f3
mov dword [esp + 0x24], 0xf4e8f8ff
mov word [esp + 0x28], 0xf1f1
mov byte [esp + 0x2a], 0
movaps xmm0, xmmword [0x10040de0]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0x82
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x1e
jne 0x1001faed
mov byte [esp + 0x2a], 0
mov ecx, dword [0x10051398]
test ecx, ecx
jne 0x1001fb1c
mov ecx, 0x53b2070f
call fcn.1001fb6a
mov ecx, eax
mov dword [0x10051398], eax
mov dword [esp + 2], 0xebe3ebf6
mov word [esp + 6], 0xbbbb
mov byte [esp + 8], 0
mov word [esp], 0xe66b
xor eax, eax
inc eax
mov edx, eax
add dl, 0x82
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x1001fb39
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100513a0], eax
push edi
call ecx
add esp, 0x2c
pop esi
pop edi
ret 4
Function at 0x1001fb6a
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0xc], ecx
mov eax, dword [0x10051390]
mov eax, dword [eax + 0x30]
mov edi, dword [eax + 0xc]
mov esi, dword [edi + 0x14]
add edi, 0x14
mov eax, dword [esi + 0x10]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x1001fc2c
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x1001fc2c
cmp word [eax + ecx + 0x14], 0x60
jb 0x1001fc2c
cmp dword [eax + ecx + 0x74], 0
je 0x1001fc2c
mov edx, dword [eax + ecx + 0x78]
mov ecx, edx
mov dword [esp], edx
test edx, edx
je 0x1001fc2c
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x18]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x1001fc2c
mov ecx, dword [esp]
mov ecx, dword [eax + ecx + 0x20]
add ecx, eax
mov dword [esp + 8], ecx
lea ecx, [eax + 1]
mov dword [esp + 4], ecx
xor ebx, ebx
mov ecx, dword [esp + 8]
mov ecx, dword [ecx + ebx*4]
mov dl, byte [eax + ecx]
test dl, dl
je 0x1001fc14
add ecx, dword [esp + 4]
mov ebp, 0x811c9dc5
movsx edx, dl
xor edx, ebp
imul ebp, edx, 0x1000193
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x1001fc00
jmp 0x1001fc19
mov ebp, 0x811c9dc5
cmp ebp, dword [esp + 0xc]
je 0x1001fc28
inc ebx
cmp ebx, dword [esp + 0x10]
jne 0x1001fbe9
jmp 0x1001fc2c
test eax, eax
jne 0x1001fc40
mov esi, dword [esi]
cmp esi, edi
jne 0x1001fb86
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp]
mov ecx, dword [eax + edx + 0x24]
add ecx, eax
mov edx, dword [eax + edx + 0x1c]
add edx, eax
movzx ecx, word [ecx + ebx*2]
add eax, dword [edx + ecx*4]
jmp 0x1001fc38
Function at 0x1002001a
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov edi, dword [esp + 0x5c]
mov esi, dword [esp + 0x58]
push 1
call fcn.1001568c
movaps xmm0, xmmword [0x1003fba0]
movups xmmword [esp + 0x10], xmm0
mov word [esp + 0x20], 0xec16
mov word [esp + 0x42], 0
movaps xmm0, xmmword [0x1003fbb0]
movups xmmword [esp], xmm0
movdqa xmm0, xmmword [0x1003fbc0]
xor eax, eax
movdqa xmm1, xmmword [0x1003fbd0]
movdqa xmm2, xmmword [str._b_b_b_b_b_b_b_bS]
movdqu xmm3, xmmword [esp + eax*2 + 2]
movdqa xmm4, xmm0
paddw xmm4, xmm1
pxor xmm4, xmm3
movdqu xmmword [esp + eax*2 + 2], xmm4
add eax, 8
paddw xmm0, xmm2
cmp eax, 0x20
jne 0x10015535
xor ebp, ebp
mov ebx, esp
mov word [ebx + 0x42], bp
push 1
push ebx
call fcn.10019580
add esp, 8
mov dword [ebx + 0x10], 0xec66ec78
mov dword [ebx + 0x14], 0xec74ec7c
mov dword [ebx + 0x18], 0xec76ec75
mov word [ebx + 0x1c], 0xec14
mov word [ebx + 0x3a], bp
movaps xmm0, xmmword [0x1003fbf0]
movups xmmword [ebx], xmm0
xor eax, eax
inc eax
lea ecx, [eax - 0x13fa]
xor word [esp + eax*2], cx
inc eax
cmp eax, 0x1d
jne 0x10015598
mov word [esp + 0x3a], 0
push 1
push ebx
call fcn.10019580
add esp, 8
mov ecx, esi
push 0xffffffffffffffff
push edi
call fcn.10024150
test eax, eax
jne 0x10015684
mov eax, dword [edi + 4]
lea ecx, [eax - 0x3000]
cmp ecx, 0xf
ja case.default.0x100155da
jmp dword [ecx*4 + 0x1003fc00]
push edi
push esi
call fcn.1001585c
jmp 0x10015679
cmp eax, 0x3102
je 0x10015672
cmp eax, 0x7002
jne case.0x100155da.12290
push edi
push esi
call fcn.10017278
jmp 0x10015679
mov dword [edi + 0xc], 0x32
mov dword [edi + 8], 0
mov ecx, esi
push 0x7530
push edi
call fcn.100241f0
jmp 0x1001567c
push edi
push esi
call fcn.10015dae
jmp 0x10015679
push edi
push esi
call fcn.100168b0
jmp 0x10015679
push edi
push esi
call fcn.10016332
jmp 0x10015679
push edi
push esi
call fcn.10016a9e
jmp 0x10015679
push edi
push esi
call fcn.10016bb2
jmp 0x10015679
push edi
push esi
call fcn.10016d62
jmp 0x10015679
push edi
push esi
call fcn.10016c32
jmp 0x10015679
push edi
push esi
call fcn.10017088
jmp 0x10015679
push edi
push esi
call fcn.1001710c
jmp 0x10015679
push edi
push esi
call fcn.100162ac
add esp, 8
test eax, eax
je 0x100155ba
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
movaps xmm0, xmmword [0x10041870]
movups xmmword [eax], xmm0
push 0x7530
push eax
call fcn.100241f0
test eax, eax
je 0x100154e0
ret
Function at 0x10020e16
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x2c]
mov eax, dword [0x100519b8]
test eax, eax
jne 0x10020ed2
mov esi, dword [0x100519b0]
test esi, esi
jne 0x10020e47
mov ecx, 0xf8f45725
call fcn.10021c70
mov esi, eax
mov dword [0x100519b0], eax
mov word [esp + 0x1c], 0x8e89
mov byte [esp + 0x1e], 0
movaps xmm0, xmmword [0x10041890]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xec
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x12
jne 0x10020e62
mov byte [esp + 0x1e], 0
mov ecx, dword [0x100519b4]
test ecx, ecx
jne 0x10020e91
mov ecx, 0x53b2070f
call fcn.10021c70
mov ecx, eax
mov dword [0x100519b4], eax
mov dword [esp + 2], 0x9d95819c
mov word [esp + 6], 0xc1c1
mov byte [esp + 8], 0
mov word [esp], 0x886b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xec
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10020eae
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov dword [0x100519b8], eax
push edi
call eax
add esp, 0x20
pop esi
pop edi
ret 4

Function at 0x10020ede
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push edi
push esi
sub esp, 0x1c
mov edi, dword [esp + 0x28]
mov ecx, dword [0x100519bc]
test ecx, ecx
jne 0x10020f8f
mov esi, dword [0x100519b0]
test esi, esi
jne 0x10020f10
mov ecx, 0xf8f45725
call fcn.10021c70
mov esi, eax
mov dword [0x100519b0], eax
mov byte [esp + 0x18], 0
movaps xmm0, xmmword [0x100418a0]
movups xmmword [esp + 8], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xec
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 0x10
jne 0x10020f24
mov byte [esp + 0x18], 0
mov ecx, dword [0x100519b4]
test ecx, ecx
jne 0x10020f53
mov ecx, 0x53b2070f
call fcn.10021c70
mov ecx, eax
mov dword [0x100519b4], eax
mov dword [esp + 2], 0xc3c39d8b
mov byte [esp + 6], 0
mov word [esp], 0x9e75
xor eax, eax
inc eax
mov edx, eax
add dl, 0xec
xor byte [esp + eax], dl
inc eax
cmp eax, 6
jne 0x10020f69
mov eax, esp
mov byte [eax + 6], 0
push eax
call ecx
lea ecx, [esp + 8]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100519bc], eax
push edi
call ecx
add esp, 0x1c
pop esi
pop edi
ret 4
Function at 0x10020f9a
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push esi
sub esp, 0x24
mov ecx, dword [0x100519c0]
test ecx, ecx
jne 0x10021055
mov esi, dword [0x100519b0]
test esi, esi
jne 0x10020fc7
mov ecx, 0xf8f45725
call fcn.10021c70
mov esi, eax
mov dword [0x100519b0], eax
mov dword [esp + 0x1c], 0xbbb7beb0
mov byte [esp + 0x20], 0
movaps xmm0, xmmword [0x100418b0]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xec
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x14
jne 0x10020fe3
mov byte [esp + 0x20], 0
mov ecx, dword [0x100519b4]
test ecx, ecx
jne 0x10021012
mov ecx, 0x53b2070f
call fcn.10021c70
mov ecx, eax
mov dword [0x100519b4], eax
mov dword [esp + 2], 0x9d95819c
mov word [esp + 6], 0xc1c1
mov byte [esp + 8], 0
mov word [esp], 0x886b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xec
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x1002102f
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100519c0], eax
call ecx
add esp, 0x24
pop esi
ret
Function at 0x10021948
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [0x100519c4]
test ecx, ecx
jne 0x10021a0f
mov esi, dword [0x100519b0]
test esi, esi
jne 0x1002197f
mov ecx, 0xf8f45725
call fcn.10021c70
mov esi, eax
mov dword [0x100519b0], eax
mov dword [esp + 2], 0x81939d9a
mov word [esp + 6], 0xb28b
mov byte [esp + 8], 0
mov word [esp], 0x9e6c
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xec
xor byte [esp + eax], cl
inc eax
cmp eax, 8
jne 0x1002199c
mov byte [esp + 8], 0
mov ecx, dword [0x100519b4]
test ecx, ecx
jne 0x100219ca
mov ecx, 0x53b2070f
call fcn.10021c70
mov ecx, eax
mov dword [0x100519b4], eax
mov dword [esp + 0xe], 0x9d95819c
mov word [esp + 0x12], 0xc1c1
mov byte [esp + 0x14], 0
mov word [esp + 0xc], 0x886b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xec
xor byte [esp + eax + 0xc], dl
inc eax
cmp eax, 8
jne 0x100219e8
lea eax, [esp + 0xc]
mov byte [eax + 8], 0
push eax
call ecx
mov ecx, esp
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100519c4], eax
push ebx
push edi
call ecx
add esp, 0x18
pop esi
pop edi
pop ebx
ret 8

Function at 0x10021a1c
Capabilities:
Encode data using xor
Resolve function by fnv-1a hash

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov ecx, dword [0x100519c8]
test ecx, ecx
jne 0x10021ad9
mov esi, dword [0x100519b0]
test esi, esi
jne 0x10021a53
mov ecx, 0xf8f45725
call fcn.10021c70
mov esi, eax
mov dword [0x100519b0], eax
mov byte [esp + 0x1c], 0
movaps xmm0, xmmword [0x100418e0]
movups xmmword [esp + 0xc], xmm0
xor eax, eax
inc eax
mov ecx, eax
add cl, 0xec
xor byte [esp + eax + 0xc], cl
inc eax
cmp eax, 0x10
jne 0x10021a67
mov byte [esp + 0x1c], 0
mov ecx, dword [0x100519b4]
test ecx, ecx
jne 0x10021a96
mov ecx, 0x53b2070f
call fcn.10021c70
mov ecx, eax
mov dword [0x100519b4], eax
mov dword [esp + 2], 0x9d95819c
mov word [esp + 6], 0xc1c1
mov byte [esp + 8], 0
mov word [esp], 0x886b
xor eax, eax
inc eax
mov edx, eax
add dl, 0xec
xor byte [esp + eax], dl
inc eax
cmp eax, 8
jne 0x10021ab3
mov eax, esp
mov byte [eax + 8], 0
push eax
call ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call esi
mov ecx, eax
mov dword [0x100519c8], eax
push ebx
push edi
call ecx
add esp, 0x20
pop esi
pop edi
pop ebx
ret 8