joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10074d30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b9d2b
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x101cc284]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
push 1
push 0x8c
call dword [sym.imp.PhotoBase.dll_void____cdecl_BasePrivate::New_unsigned_int__bool_]
mov edi, eax
add esp, 8
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x10074ef2
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov byte [ebp - 4], 1
lea ebx, [edi + 0x18]
fld1
fstp dword [edi + 0xc]
mov dword [edi], 0x10002618
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [ebp - 0x20], ebx
call dword [sym.imp.PhotoBase.dll_public:_static_class_ATL::CAtlStringMgr____stdcall_Base::String::GetBaseStringManager_void_]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x10074dcf
push 0x80004005
call dword [sym.imp.PhotoBase.dll_void___stdcall_ATL::BaseAtlThrow_long_int_]
mov eax, dword [eax]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x101d13b0]
mov ecx, dword [ebp - 0x14]
call esi
add eax, 0x10
mov dword [ebx], eax
mov eax, 0x10015fbc
mov byte [ebp - 4], 2
mov ecx, ebx
test eax, 0xffff0000
jne 0x10074e03
movzx eax, ax
push eax
call fcn.10042350
jmp 0x10074e0f
push 0x11
push 0x10015fbc
call fcn.100426c0
mov byte [edi + 0x1c], 1
mov dword [edi + 0x20], 0
mov byte [edi + 0x24], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov ebx, dword [ebp - 0x18]
mov dword [edi + 0x74], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 4], 3
mov dword [edi + 0x34], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x80], 0x10001584
mov dword [edi + 0x84], 0
mov dword [edi], 0x10002518
mov dword [edi + 0x80], 0x10002514
mov dword [edi + 0x88], 0
jmp 0x10074ef4
xor edi, edi
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x10074f0f
mov eax, dword [edi]
push edi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x101d13b0]
call esi
mov dword [ebx], edi
test edi, edi
je 0x10074f35
mov eax, dword [edi]
push edi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x101d13b0]
call esi
mov eax, dword [edi]
push edi
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x101d13b0]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101b6170
mov esp, ebp
pop ebp
ret
Function at 0x100a5b20
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ba403
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101cc284]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0xc]
mov dword [esi], 0x10002b90
mov dword [ecx], 0
mov byte [ebp - 4], 1
mov dword [esi + 4], 1
call fcn.100b05f0
fld dword [0x10039e8c]
mov eax, esi
fst dword [esi + 0x10]
fstp dword [esi + 0x14]
fld dword [0x100397ec]
fst dword [esi + 0x18]
fstp dword [esi + 0x1c]
mov dword [esi + 0x20], 0
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], 0x10001584
mov dword [esi + 0x2c], 0
mov dword [esi], 0x10002bdc
mov dword [esi + 0x28], 0x10002bd8
mov dword [esi + 0x30], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100b0c70
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101ba403
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101cc284]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0xc]
mov dword [esi], 0x100037a8
mov dword [ecx], 0
mov byte [ebp - 4], 1
mov dword [esi + 4], 1
call fcn.1003fb50
fld1
mov eax, esi
mov byte [esi + 0x40], 1
fst dword [esi + 0x2c]
fst dword [esi + 0x28]
fldz
fst dword [esi + 0x14]
fst dword [esi + 0x10]
fst dword [esi + 0x1c]
fst dword [esi + 0x18]
fst dword [esi + 0x24]
fstp dword [esi + 0x20]
fst dword [esi + 0x34]
fst dword [esi + 0x30]
fst dword [esi + 0x3c]
fstp dword [esi + 0x38]
mov dword [esi + 0x44], 0x10001584
mov dword [esi + 0x48], 0
mov dword [esi], 0x100037f4
mov dword [esi + 0x44], 0x100037f0
mov dword [esi + 0x4c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100e8870
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101bcc38
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x101cc284]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [ebp + 8], 0
je 0x100e89ac
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
mov eax, dword [ecx + 4]
lea ecx, [ebp - 0x18]
push ecx
push 8
push eax
mov esi, dword [eax]
mov esi, dword [esi + 0x1d8]
mov ecx, esi
call dword [0x101d13b0]
call esi
test eax, eax
js 0x100e898e
mov eax, dword [ebp - 0x18]
push 1
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x18]
mov ecx, esi
call dword [0x101d13b0]
call esi
test eax, eax
jns 0x100e88f7
push eax
call dword [sym.imp.PhotoBase.dll_void___stdcall_Base::Throw_long_int_]
lea ecx, [ebp - 0x54]
call fcn.10050d40
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x100e8913
call dword [sym.imp.PhotoBase.dll_void___stdcall_Base::ThrowLastError_void_]
mov eax, dword [ebp - 0x18]
push 1
push 0
push 0
mov esi, dword [eax]
push eax
mov esi, dword [esi + 0x1c]
mov ecx, esi
call dword [0x101d13b0]
call esi
cmp eax, 1
jne 0x100e898e
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x100e890d
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
sbb eax, dword [ebp - 0x48]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
fild qword [ebp - 0x34]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
fild qword [ebp - 0x54]
fstp qword [ebp - 0x24]
fdiv qword [ebp - 0x24]
fcomp qword [0x10039b48]
fnstsw ax
test ah, 0x41
je 0x100e898e
mov eax, dword [ebp - 0x18]
push 1
push 0
push 0
mov esi, dword [eax]
push eax
mov esi, dword [esi + 0x1c]
mov ecx, esi
call dword [0x101d13b0]
call esi
cmp eax, 1
je 0x100e8931
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100e89ac
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x101d13b0]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.101b6170
mov esp, ebp
pop ebp
ret 4
Function at 0x100f7860
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101bdfb1
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x101cc284]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
mov dword [ebx + 4], 0x10003d0c
mov dword [ebx], 0x100062c4
mov dword [ebx + 4], 0x100062c0
mov dword [ebx + 8], 0xffffffff
mov byte [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0x1c], 0
mov dword [ebp - 4], 0
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x24], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
push 0x40
lea esi, [ebx + 0x6c]
mov byte [ebx + 0x5c], 0
push 0
push esi
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x68], 0
call sub.msvcrt.dll_memset
fld1
fst dword [esi + 0x3c]
fst dword [esi + 0x28]
fst dword [esi + 0x14]
fstp dword [esi]
mov word [ebx + 0xb4], 0
mov word [ebx + 0xea], 0
mov byte [ebx + 0xec], 0
mov dword [ebx + 0xf0], 0
mov word [ebx + 0xf4], 0
mov dword [ebx + 0xf8], 0
mov dword [ebx + 0xfc], 0
mov dword [ebx + 0x100], 0
mov dword [ebx + 0x104], 0
mov word [ebx + 0x108], 0
mov dword [ebx + 0x10c], 0
mov dword [ebx + 0x110], 0
mov dword [ebx + 0x114], 0
mov dword [ebx + 0x118], 0
fldz
fst dword [ebx + 0x120]
fst dword [ebx + 0x124]
fst dword [ebx + 0x128]
fst dword [ebx + 0x12c]
fst dword [ebx + 0x130]
fst dword [ebx + 0x134]
fst dword [ebx + 0x138]
fst dword [ebx + 0x13c]
fst dword [ebx + 0x140]
fst dword [ebx + 0x144]
fst dword [ebx + 0x148]
fst dword [ebx + 0x14c]
fst dword [ebx + 0x150]
fst dword [ebx + 0x154]
fst dword [ebx + 0x158]
fstp dword [ebx + 0x15c]
mov dword [ebx + 0x160], 0
mov dword [ebx + 0x164], 0
mov dword [ebx + 0x168], 0
push 1
push 0x24
mov byte [ebp - 4], 7
call dword [sym.imp.PhotoBase.dll_void____cdecl_BasePrivate::New_unsigned_int__bool_]
mov edi, eax
add esp, 0x14
mov dword [ebp - 0x18], edi
test edi, edi
je 0x100f7a93
mov dword [edi + 4], 0
mov dword [edi + 0x18], 0x10001584
mov dword [edi + 0x1c], 0
mov dword [edi], 0x10006360
mov dword [edi + 0x18], 0x1000635c
mov dword [edi + 0x20], 0
mov esi, dword [0x10006364]
mov ecx, esi
push edi
call dword [0x101d13b0]
call esi
jmp 0x100f7a95
xor edi, edi
mov dword [edi + 4], ebx
mov dword [ebx + 0x34], edi
mov eax, dword [edi]
push edi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x101d13b0]
call esi
mov eax, dword [edi]
push edi
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x101d13b0]
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101b6170
mov esp, ebp
pop ebp
ret
Function at 0x10102748
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x101d0084]
push esi
push edi
test eax, eax
jne 0x10102761
call fcn.101027f6
test eax, eax
je 0x101027ad
mov eax, dword [0x101d0084]
cmp eax, 1
jne 0x1010277d
push 0xd
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x101027ad
jmp 0x101027f3
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov ecx, eax
test ecx, ecx
je 0x10102796
xor eax, eax
mov edi, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov eax, ecx
jmp 0x101027f3
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x101027b1
xor eax, eax
jmp 0x101027f3
mov eax, dword [esi]
push dword [0x101d0084]
call dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
mov edi, eax
test edi, edi
je 0x101027d7
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x101027f3
lea edi, [esi + 0xff0]
push esi
push dword [0x101d0084]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x101027dd
mov eax, esi
pop edi
pop esi
ret

Function at 0x10103590
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 4
push eax
push 0x2000000
xor edi, edi
push edi
push 0x10026df4
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x101035fb
push esi
lea eax, [ebp - 8]
push eax
push 0x101cc330
lea eax, [ebp - 0xc]
push eax
push edi
push 0x10026e38
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x101035f7
cmp dword [ebp - 0xc], 4
jne 0x101035f7
inc edi
mov eax, edi
jmp 0x101035fd
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x1010378d
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x101cc284]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
test eax, eax
jne 0x101037ae
mov eax, 0x8876086c
jmp 0x10103823
push edi
xor edi, edi
push edi
push 0x10000000
push 3
push edi
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
mov dword [esi], eax
call dword [sym.imp.PhotoBase.dll_void___cdecl_BasePrivate::Delete_void__]
cmp dword [esi], 0xffffffff
pop ecx
je 0x10103817
push edi
push edi
push edi
push 2
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 4], eax
cmp eax, 0xffffffff
je 0x10103817
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0xc], eax
cmp eax, 0xffffffff
je 0x10103817
test eax, eax
je 0x10103834
push edi
push edi
push edi
push 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 8], eax
cmp eax, edi
jne 0x10103837
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x88760b59
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.101b6170
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 8], edi
xor eax, eax
jmp 0x10103822
Function at 0x10107370
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
sub esp, 0x14
mov ecx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, ecx
mov dword [ebp + 0x14], eax
cmp ecx, eax
jae 0x101074b1
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
lea edx, [ecx + eax*4]
mov eax, dword [ebp + 0x14]
lea esi, [edi + edi]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], ebx
cmp ecx, edx
jae 0x10107497
lea eax, [ecx + 4]
mov dword [ebp - 4], eax
mov eax, edx
sub eax, ecx
mov ecx, dword [ebp - 4]
dec eax
shr eax, 3
inc eax
mov dword [ebp - 0xc], eax
mov esi, dword [ecx + edi]
mov edx, 0xffc03fc0
mov edi, dword [edi + ecx - 4]
mov eax, esi
mov ebx, dword [ecx - 4]
mov ecx, dword [ecx]
shr eax, 2
and eax, edx
shr ecx, 2
and ecx, edx
add ecx, eax
mov eax, edi
shr eax, 2
and eax, edx
add ecx, eax
mov eax, ebx
shr eax, 2
add ecx, 0xff800080
and edx, eax
mov eax, dword [ebp - 4]
add edx, ecx
mov ecx, dword [eax]
mov eax, esi
and eax, 0xff00ff
shr esi, 2
and ecx, 0xff00ff
and esi, 0x3fc03fc0
add ecx, eax
mov eax, edi
and eax, 0xff00ff
shr edi, 2
add ecx, eax
mov eax, ebx
and eax, 0xff00ff
shr ebx, 2
add ecx, 0x20002
add eax, ecx
mov ecx, dword [ebp - 4]
shr eax, 2
xor edx, eax
and edx, 0xff00ff
mov eax, dword [ecx]
add ecx, 8
shr eax, 2
and eax, 0x3fc03fc0
mov dword [ebp - 4], ecx
add eax, esi
mov esi, 0x3fc03fc0
and edi, esi
and ebx, esi
add edi, 0x800080
add eax, edi
mov edi, dword [ebp + 0x18]
add eax, ebx
xor edx, eax
mov eax, dword [ebp - 8]
mov dword [eax], edx
add eax, 4
sub dword [ebp - 0xc], 1
mov dword [ebp - 8], eax
jne 0x101073c9
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x10]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp - 0x14]
add ebx, dword [ebp + 0x1c]
add ecx, esi
add edx, esi
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ecx
mov dword [ebp - 0x10], edx
cmp ecx, eax
jb 0x101073a9
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1010785f
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
push ebx
mov dword [ebp - 0x10], ecx
mov ebx, dword [eax + 0x20]
mov eax, dword [edx + 0x6c]
imul eax, dword [edx + 0x60]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ecx
add eax, ecx
mov dword [ebp - 0x24], eax
cmp ecx, eax
jae 0x1010799f
push esi
push edi
mov eax, dword [edx + 0x68]
mov edi, ecx
mov esi, dword [edx + 0x60]
add esi, ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
lea eax, [ecx + eax*2]
mov dword [ebp - 8], esi
mov dword [ebp - 0x20], eax
cmp ecx, eax
jae 0x1010797f
mov eax, dword [ebp - 4]
movzx edx, word [esi + 2]
movzx esi, word [esi]
and edx, 0xf81f
movzx edi, word [edi + 2]
movzx ebx, word [eax]
mov eax, esi
and eax, 0xf81f
mov ecx, ebx
and ecx, 0xf81f
add ecx, eax
mov eax, edi
and eax, 0xf81f
add eax, 0x1002
add ecx, eax
mov eax, esi
add edx, ecx
and eax, 0x7e0
mov ecx, ebx
shr edx, 2
and ecx, 0x7e0
add ecx, eax
mov eax, edi
and eax, 0x7e0
add ecx, eax
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 8]
movzx eax, word [ecx + 2]
mov ecx, dword [ebp - 0x1c]
and eax, 0x7e0
add ecx, 0x40
add eax, ecx
mov ecx, 0xf81f
shr eax, 2
and esi, ecx
xor edx, eax
and ebx, ecx
add ebx, esi
and edi, ecx
mov esi, dword [ebp - 8]
add ebx, edi
mov edi, dword [ebp - 4]
and edx, 0x7e0
add edi, 4
mov dword [ebp - 4], edi
movzx eax, word [esi + 2]
add esi, 4
and eax, ecx
mov dword [ebp - 8], esi
add eax, 0x1002
add eax, ebx
shr eax, 2
xor edx, eax
mov eax, dword [ebp - 0xc]
mov word [eax], dx
add eax, 2
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0x20]
jb 0x101078b3
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov edx, dword [eax]
jmp 0x10107982
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
add ebx, dword [eax + 0x60]
mov eax, dword [edx + 0x60]
mov dword [ebp - 0x14], ebx
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x18], ecx
cmp ecx, dword [ebp - 0x24]
jb 0x10107892
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10107ab7
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
push ebx
mov dword [ebp - 0x10], ecx
mov ebx, dword [eax + 0x20]
mov eax, dword [edx + 0x6c]
imul eax, dword [edx + 0x60]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ecx
add eax, ecx
mov dword [ebp - 0x24], eax
cmp ecx, eax
jae 0x10107bfa
push esi
push edi
mov eax, dword [edx + 0x68]
mov edi, ecx
mov esi, dword [edx + 0x60]
add esi, ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
lea eax, [ecx + eax*2]
mov dword [ebp - 8], esi
mov dword [ebp - 0x20], eax
cmp ecx, eax
jae 0x10107bda
mov eax, dword [ebp - 4]
movzx edx, word [esi + 2]
movzx esi, word [esi]
and edx, 0x7c1f
movzx edi, word [edi + 2]
movzx ebx, word [eax]
mov eax, esi
and eax, 0x7c1f
mov ecx, ebx
and ecx, 0x7c1f
add ecx, eax
mov eax, edi
and eax, 0x7c1f
add eax, 0x802
add ecx, eax
mov eax, esi
add edx, ecx
and eax, 0x83e0
mov ecx, ebx
shr edx, 2
and ecx, 0x83e0
add ecx, eax
mov eax, edi
and eax, 0x83e0
add ecx, eax
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 8]
movzx eax, word [ecx + 2]
mov ecx, dword [ebp - 0x1c]
and eax, 0x83e0
add ecx, 0x10040
add eax, ecx
mov ecx, 0x83e0
shr eax, 2
and esi, ecx
xor edx, eax
and ebx, ecx
add ebx, esi
and edi, ecx
mov esi, dword [ebp - 8]
add ebx, edi
mov edi, dword [ebp - 4]
and edx, 0x7c1f
add edi, 4
mov dword [ebp - 4], edi
movzx eax, word [esi + 2]
add esi, 4
and eax, ecx
mov dword [ebp - 8], esi
add eax, 0x10040
add eax, ebx
shr eax, 2
xor edx, eax
mov eax, dword [ebp - 0xc]
mov word [eax], dx
add eax, 2
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0x20]
jb 0x10107b0b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov edx, dword [eax]
jmp 0x10107bdd
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
add ebx, dword [eax + 0x60]
mov eax, dword [edx + 0x60]
mov dword [ebp - 0x14], ebx
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x18], ecx
cmp ecx, dword [ebp - 0x24]
jb 0x10107aea
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10107c01
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
push ebx
mov dword [ebp - 0x10], ecx
mov ebx, dword [eax + 0x20]
mov eax, dword [edx + 0x6c]
imul eax, dword [edx + 0x60]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ecx
add eax, ecx
mov dword [ebp - 0x24], eax
cmp ecx, eax
jae 0x10107d44
push esi
push edi
mov eax, dword [edx + 0x68]
mov edi, ecx
mov esi, dword [edx + 0x60]
add esi, ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], edi
lea eax, [ecx + eax*2]
mov dword [ebp - 8], esi
mov dword [ebp - 0x20], eax
cmp ecx, eax
jae 0x10107d24
mov eax, dword [ebp - 4]
movzx edx, word [esi + 2]
movzx esi, word [esi]
and edx, 0xf0f
movzx edi, word [edi + 2]
movzx ebx, word [eax]
mov eax, esi
and eax, 0xf0f
mov ecx, ebx
and ecx, 0xf0f
add ecx, eax
mov eax, edi
and eax, 0xf0f
add eax, 0x202
add ecx, eax
mov eax, esi
add edx, ecx
and eax, 0xf0f0
mov ecx, ebx
shr edx, 2
and ecx, 0xf0f0
add ecx, eax
mov eax, edi
and eax, 0xf0f0
add ecx, eax
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 8]
movzx eax, word [ecx + 2]
mov ecx, dword [ebp - 0x1c]
and eax, 0xf0f0
add ecx, 0x2020
add eax, ecx
mov ecx, 0xf0f0
shr eax, 2
and esi, ecx
xor edx, eax
and ebx, ecx
add ebx, esi
and edi, ecx
mov esi, dword [ebp - 8]
add ebx, edi
mov edi, dword [ebp - 4]
and edx, 0xf0f
add edi, 4
mov dword [ebp - 4], edi
movzx eax, word [esi + 2]
add esi, 4
and eax, ecx
mov dword [ebp - 8], esi
add eax, 0x2020
add eax, ebx
shr eax, 2
xor edx, eax
mov eax, dword [ebp - 0xc]
mov word [eax], dx
add eax, 2
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0x20]
jb 0x10107c55
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov edx, dword [eax]
jmp 0x10107d27
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
add ebx, dword [eax + 0x60]
mov eax, dword [edx + 0x60]
mov dword [ebp - 0x14], ebx
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x18], ecx
cmp ecx, dword [ebp - 0x24]
jb 0x10107c34
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10107d4b
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
push ebx
mov dword [ebp - 0x14], ecx
mov ebx, dword [eax + 0x20]
mov eax, dword [edx + 0x6c]
imul eax, dword [edx + 0x60]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ecx
add eax, ecx
mov dword [ebp - 0x24], eax
cmp ecx, eax
jae 0x10107e6f
push esi
push edi
mov eax, dword [edx + 0x68]
mov edi, ecx
mov esi, dword [edx + 0x60]
add eax, ecx
add esi, ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], eax
cmp ecx, eax
jae 0x10107e4f
movzx edx, byte [esi + 1]
mov eax, dword [ebp - 4]
movzx esi, byte [esi]
movzx edi, byte [edi + 1]
mov dword [ebp - 8], edx
and edx, 0xe3
movzx ebx, byte [eax]
mov eax, esi
and eax, 0xe3
mov ecx, ebx
and ecx, 0xe3
add ecx, eax
mov eax, edi
and eax, 0xe3
add eax, 0x42
add ecx, eax
mov eax, esi
and eax, 0x1c
add edx, ecx
mov ecx, ebx
shr edx, 2
and ecx, 0x1c
add ecx, eax
mov eax, edi
and eax, 0x1c
add ecx, eax
mov eax, dword [ebp - 8]
and eax, 0x1c
add eax, 8
add eax, ecx
mov ecx, 0xe3
shr eax, 2
and esi, ecx
xor dl, al
and ebx, ecx
mov eax, dword [ebp - 8]
add ebx, esi
mov esi, dword [ebp - 0x10]
and eax, ecx
and edi, ecx
add eax, 0x42
add ebx, edi
and dl, 0x1c
mov edi, dword [ebp - 4]
add eax, ebx
shr eax, 2
add edi, 2
xor dl, al
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0xc]
add esi, 2
mov dword [ebp - 0x10], esi
mov byte [eax], dl
inc eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0x20]
jb 0x10107d9e
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov edx, dword [eax]
jmp 0x10107e52
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 4]
add ebx, dword [eax + 0x60]
mov eax, dword [edx + 0x60]
mov dword [ebp - 0x18], ebx
lea ecx, [ecx + eax*2]
mov dword [ebp - 0x1c], ecx
cmp ecx, dword [ebp - 0x24]
jb 0x10107d7e
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret