joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004f6d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x1035ae20], 0
push ebx
push esi
je 0x1004f74a
cmp byte [0x1035ae21], 0
jne 0x1004f798
mov byte [0x1035ae21], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1035af24]
xor ebx, dword [0x1035af20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1035ae22]
xor al, bl
mov byte [esi + 0x1035ae22], al
inc esi
cmp esi, 0xfd
jb 0x1004f700
jmp 0x1004f798
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1035af24]
xor ebx, dword [0x1035af20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1035ae22]
xor al, bl
mov byte [esi + 0x1035ae22], al
inc esi
cmp esi, 0xfd
jb 0x1004f750
push ecx
mov ecx, dword [ebp + 8]
push 0x1035af1e
push 0x1035ae22
call fcn.10047b20
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004f7c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x1035afa8], 0
push ebx
push esi
je 0x1004f83a
cmp byte [0x1035afa9], 0
jne 0x1004f888
mov byte [0x1035afa9], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1035b08c]
xor ebx, dword [0x1035b088]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1035afaa]
xor al, bl
mov byte [esi + 0x1035afaa], al
inc esi
cmp esi, 0xda
jb 0x1004f7f0
jmp 0x1004f888
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1035b08c]
xor ebx, dword [0x1035b088]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1035afaa]
xor al, bl
mov byte [esi + 0x1035afaa], al
inc esi
cmp esi, 0xda
jb 0x1004f840
push ecx
mov ecx, dword [ebp + 8]
push 0x1035b083
push 0x1035afaa
call fcn.10047b20
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004f8b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x1035aa10], 0
push ebx
push esi
je 0x1004f92a
cmp byte [0x1035aa11], 0
jne 0x1004f978
mov byte [0x1035aa11], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1035aaf4]
xor ebx, dword [0x1035aaf0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1035aa12]
xor al, bl
mov byte [esi + 0x1035aa12], al
inc esi
cmp esi, 0xdb
jb 0x1004f8e0
jmp 0x1004f978
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1035aaf4]
xor ebx, dword [0x1035aaf0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1035aa12]
xor al, bl
mov byte [esi + 0x1035aa12], al
inc esi
cmp esi, 0xdb
jb 0x1004f930
push ecx
mov ecx, dword [ebp + 8]
push 0x1035aaec
push 0x1035aa12
call fcn.10047b20
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004f9a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x1035a760], 0
push ebx
push esi
je 0x1004fa1a
cmp byte [0x1035a761], 0
jne 0x1004fa68
mov byte [0x1035a761], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1035a90c]
xor ebx, dword [0x1035a908]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1035a762]
xor al, bl
mov byte [esi + 0x1035a762], al
inc esi
cmp esi, 0x1a6
jb 0x1004f9d0
jmp 0x1004fa68
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1035a90c]
xor ebx, dword [0x1035a908]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1035a762]
xor al, bl
mov byte [esi + 0x1035a762], al
inc esi
cmp esi, 0x1a6
jb 0x1004fa20
push ecx
mov ecx, dword [ebp + 8]
push 0x1035a907
push 0x1035a762
call fcn.10047b20
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004fa90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x1035b3a0], 0
push ebx
push esi
je 0x1004fb0a
cmp byte [0x1035b3a1], 0
jne 0x1004fb58
mov byte [0x1035b3a1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1035b474]
xor ebx, dword [0x1035b470]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1035b3a2]
xor al, bl
mov byte [esi + 0x1035b3a2], al
inc esi
cmp esi, 0xca
jb 0x1004fac0
jmp 0x1004fb58
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1035b474]
xor ebx, dword [0x1035b470]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1035b3a2]
xor al, bl
mov byte [esi + 0x1035b3a2], al
inc esi
cmp esi, 0xca
jb 0x1004fb10
push ecx
mov ecx, dword [ebp + 8]
push 0x1035b46b
push 0x1035b3a2
call fcn.10047b20
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004fb80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x1035ab10], 0
push ebx
push esi
je 0x1004fbfa
cmp byte [0x1035ab11], 0
jne 0x1004fc48
mov byte [0x1035ab11], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1035ac44]
xor ebx, dword [0x1035ac40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1035ab12]
xor al, bl
mov byte [esi + 0x1035ab12], al
inc esi
cmp esi, 0x129
jb 0x1004fbb0
jmp 0x1004fc48
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1035ac44]
xor ebx, dword [0x1035ac40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1035ab12]
xor al, bl
mov byte [esi + 0x1035ab12], al
inc esi
cmp esi, 0x129
jb 0x1004fc00
push ecx
mov ecx, dword [ebp + 8]
push 0x1035ac3a
push 0x1035ab12
call fcn.10047b20
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004fc70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x1035b5e8], 0
push ebx
push esi
je 0x1004fcea
cmp byte [0x1035b5e9], 0
jne 0x1004fd38
mov byte [0x1035b5e9], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1035b6b4]
xor ebx, dword [0x1035b6b0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1035b5ea]
xor al, bl
mov byte [esi + 0x1035b5ea], al
inc esi
cmp esi, 0xbf
jb 0x1004fca0
jmp 0x1004fd38
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1035b6b4]
xor ebx, dword [0x1035b6b0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1035b5ea]
xor al, bl
mov byte [esi + 0x1035b5ea], al
inc esi
cmp esi, 0xbf
jb 0x1004fcf0
push ecx
mov ecx, dword [ebp + 8]
push 0x1035b6a8
push 0x1035b5ea
call fcn.10047b20
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100521b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10052223
cmp byte [esi + 1], 0
jne 0x1005226e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x16
jb 0x100521e0
jmp 0x1005226e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x16
jb 0x10052230
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x17]
push eax
push edi
call fcn.10047b20
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10052290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10052303
cmp byte [esi + 1], 0
jne 0x1005234e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x12
jb 0x100522c0
jmp 0x1005234e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x12
jb 0x10052310
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x13]
push eax
push edi
call fcn.10047b20
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10052370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100523e3
cmp byte [esi + 1], 0
jne 0x1005242e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x1f
jb 0x100523a0
jmp 0x1005242e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x1f
jb 0x100523f0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x20]
push eax
push edi
call fcn.10047b20
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10052450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100524c3
cmp byte [esi + 1], 0
jne 0x1005250e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x26
jb 0x10052480
jmp 0x1005250e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x26
jb 0x100524d0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x27]
push eax
push edi
call fcn.10047b20
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10052530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100525a3
cmp byte [esi + 1], 0
jne 0x100525ee
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x1b
jb 0x10052560
jmp 0x100525ee
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x1b
jb 0x100525b0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1c]
push eax
push edi
call fcn.10047b20
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10052610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10052683
cmp byte [esi + 1], 0
jne 0x100526ce
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x28
jb 0x10052640
jmp 0x100526ce
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x28
jb 0x10052690
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x29]
push eax
push edi
call fcn.10047b20
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100526f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10052763
cmp byte [esi + 1], 0
jne 0x100527ae
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x1c
jb 0x10052720
jmp 0x100527ae
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x1c
jb 0x10052770
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1d]
push eax
push edi
call fcn.10047b20
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100527d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10052843
cmp byte [esi + 1], 0
jne 0x1005288e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x20
jb 0x10052800
jmp 0x1005288e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x20
jb 0x10052850
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x21]
push eax
push edi
call fcn.10047b20
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100528b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10052923
cmp byte [esi + 1], 0
jne 0x1005296e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x17
jb 0x100528e0
jmp 0x1005296e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x17
jb 0x10052930
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x18]
push eax
push edi
call fcn.10047b20
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10052990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10052a03
cmp byte [esi + 1], 0
jne 0x10052a4e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x1d
jb 0x100529c0
jmp 0x10052a4e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x1d
jb 0x10052a10
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1e]
push eax
push edi
call fcn.10047b20
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10061e00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [0x103a5e34]
push esi
push dword [ebp + 8]
mov dword [edi + 0x154], 1
lea eax, [edi + 0x15c]
lea ebx, [edi + 0x154]
push eax
call fcn.101f27e0
add esp, 0xc
mov dword [edi + 0x158], esi
add esi, 8
je 0x10061eb7
mov eax, dword [edi]
test eax, eax
je 0x10061e70
mov eax, dword [eax + 4]
cmp eax, 0xffffffff
je 0x10061e70
test ebx, ebx
je 0x10061e70
push 0
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push ecx
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x10061e70
cmp dword [ebp + 0xc], esi
je 0x10061eb7
mov ecx, dword [edi + 0xc]
test ecx, ecx
je 0x10061e90
mov eax, dword [edi + 4]
cmp eax, 3
je 0x10061e84
cmp eax, 1
jne 0x10061e90
lea eax, [edi + 0x54]
push eax
push dword [edi + 0x50]
call ecx
add esp, 8
mov esi, dword [edi]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0xffffffff
xor al, al
mov byte [esi], 0
mov dword [edi + 4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8