joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1015ec70
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], edx
push edi
push 0
push 4
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x1015ed6a
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1015ed63
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x20], 0x10
jb 0x1015ed49
call ebx
cmp dword [ebp - 0x14], eax
jne 0x1015ed49
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x1015ed49
mov edx, dword [esi]
test edx, edx
jne 0x1015ed12
push 0x200
push edx
push dword [0x1060b318]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x1015ed63
jmp 0x1015ed3d
mov eax, dword [esi + 4]
cmp dword [esi + 8], eax
jb 0x1015ed3d
shl eax, 3
push eax
push edx
push 0
push dword [0x1060b318]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x1015ed63
mov eax, dword [esi + 4]
add eax, eax
mov dword [esi], edx
mov dword [esi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [esi + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1015ecd1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esi], 0
je 0x1015edaf
xor edi, edi
cmp dword [esi + 8], edi
jbe 0x1015edaf
mov eax, dword [esi]
push dword [eax + edi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x1015eda9
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.1015eb00
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [esi + 8]
jb 0x1015ed76
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102bb91c
mov esp, ebp
pop ebp
ret

Function at 0x1015edc0
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx], 0
je 0x1015ee0c
push esi
xor esi, esi
cmp dword [ebx + 8], esi
jbe 0x1015edfb
push edi
mov eax, dword [ebx]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x1015edf4
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebx + 8]
jb 0x1015edd1
pop edi
push dword [ebx]
push 0
push dword [0x1060b318]
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
ret
Function at 0x1015ee10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
imul esi, ecx, 0x2c
push edi
add esi, dword [0x10614380]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ebx, [eax*2 + 5]
lea eax, [ebp - 4]
push eax
push 0x40
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1015ee56
pop edi
pop esi
mov eax, 0xa
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x1015ee71
mov eax, dword [esi]
mov word [eax], 0xf9eb
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [esi + 0x14], 6
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10163eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b13e0], 0
push esi
jne 0x10163f10
mov byte [0x104b13e0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b13f4]
xor ebx, dword [0x104b13f0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b13e1], cl
inc eax
cmp eax, 0xd
jb 0x10163ed0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b13ed
push 0x104b13e1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10163f30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b1180], 0
push esi
jne 0x10163f90
mov byte [0x104b1180], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b1194]
xor ebx, dword [0x104b1190]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b1181], cl
inc eax
cmp eax, 0xd
jb 0x10163f50
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b118d
push 0x104b1181
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10163fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b1420], 0
push esi
jne 0x10164010
mov byte [0x104b1420], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b143c]
xor ebx, dword [0x104b1438]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b1421], cl
inc eax
cmp eax, 0x11
jb 0x10163fd0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b1431
push 0x104b1421
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10176570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10321fcd
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movaps xmm0, xmm1
movss dword [ebp - 0x44], xmm0
mov eax, dword [0x1060b334]
test eax, eax
jne 0x101766fa
cmp byte [0x104b1a50], al
jne 0x10176618
mov byte [0x104b1a50], 1
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x104b1a64]
xor ebx, dword [0x104b1a60]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104b1a51]
xor cl, bl
mov byte [esi + 0x104b1a51], cl
inc esi
cmp esi, 0xc
jb 0x101765c1
push ecx
push 0x104b1a5c
push 0x104b1a51
lea ecx, [ebp - 0x40]
call fcn.1001a620
mov dword [ebp - 4], 0
lea edi, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae edi, dword [ebp - 0x40]
cmp byte [0x104b1990], 0
jne 0x101766a7
mov byte [0x104b1990], 1
xor esi, esi
nop
xor edx, edx
mov ebx, esi
xor edx, dword [0x104b19a4]
xor ebx, dword [0x104b19a0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104b1991]
xor cl, bl
mov byte [esi + 0x104b1991], cl
inc esi
cmp esi, 0xc
jb 0x10176650
push ecx
push 0x104b199c
push 0x104b1991
lea ecx, [ebp - 0x28]
call fcn.1001a620
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x28]
mov dword [0x1060b334], eax
call fcn.10019dd0
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0xffffffff
call fcn.10019dd0
mov eax, dword [0x1060b334]
movss xmm0, dword [ebp - 0x44]
sub esp, 8
mov dword [ebp - 0x44], eax
movss dword [esp + 4], xmm0
mov dword [esp], 0
call dword [ebp - 0x44]
fstp dword [ebp - 0x44]
movss xmm0, dword [ebp - 0x44]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
ret
Function at 0x10192800
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
movss xmm1, dword [eax]
ucomiss xmm1, xmm0
lahf
test ah, 0x44
jp 0x1019281f
mov dword [ebp + 8], 0
jmp 0x10192824
movss dword [ebp + 8], xmm1
mov edx, dword [ebp + 8]
movzx eax, dl
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
shr edx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, edx
imul eax, eax, 0x1000193
pop ebp
ret 4
Function at 0x1019d5d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b2f00], 0
push esi
jne 0x1019d630
mov byte [0x104b2f00], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b2f14]
xor ebx, dword [0x104b2f10]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b2f01], cl
inc eax
cmp eax, 0xf
jb 0x1019d5f0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b2f0f
push 0x104b2f01
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1019e040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b2ba0], 0
push esi
jne 0x1019e0a0
mov byte [0x104b2ba0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b2bb4]
xor ebx, dword [0x104b2bb0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b2ba1], cl
inc eax
cmp eax, 0xd
jb 0x1019e060
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b2bad
push 0x104b2ba1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1019e0c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b35c0], 0
push esi
jne 0x1019e120
mov byte [0x104b35c0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b35d4]
xor ebx, dword [0x104b35d0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + str.__bM], cl
inc eax
cmp eax, 0xd
jb 0x1019e0e0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b35cd
push str.__bM
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1019e140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b46a0], 0
push esi
jne 0x1019e1a0
mov byte [0x104b46a0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b46b4]
xor ebx, dword [0x104b46b0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b46a1], cl
inc eax
cmp eax, 0xf
jb 0x1019e160
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b46af
push 0x104b46a1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1019e4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b4710], 0
push esi
jne 0x1019e520
mov byte [0x104b4710], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b472c]
xor ebx, dword [0x104b4728]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + str.Z_f_], cl
inc eax
cmp eax, 0x12
jb 0x1019e4e0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b4722
push str.Z_f_
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1019e540
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b3200], 0
push esi
jne 0x1019e5a0
mov byte [0x104b3200], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b3214]
xor ebx, dword [0x104b3210]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b3201], cl
inc eax
cmp eax, 0xd
jb 0x1019e560
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b320d
push 0x104b3201
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1019e5c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b46f0], 0
push esi
jne 0x1019e620
mov byte [0x104b46f0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b4704]
xor ebx, dword [0x104b4700]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + str.6M], cl
inc eax
cmp eax, 0xf
jb 0x1019e5e0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b46ff
push str.6M
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1019e640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b3390], 0
push esi
jne 0x1019e6a0
mov byte [0x104b3390], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b33a4]
xor ebx, dword [0x104b33a0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b3391], cl
inc eax
cmp eax, 0xc
jb 0x1019e660
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b339c
push 0x104b3391
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1019e6c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b2790], 0
push esi
jne 0x1019e720
mov byte [0x104b2790], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b27a4]
xor ebx, dword [0x104b27a0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b2791], cl
inc eax
cmp eax, 0xe
jb 0x1019e6e0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b279e
push 0x104b2791
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1019e740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b2710], 0
push esi
jne 0x1019e7a0
mov byte [0x104b2710], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b2724]
xor ebx, dword [0x104b2720]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b2711], cl
inc eax
cmp eax, 0xe
jb 0x1019e760
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b271e
push 0x104b2711
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1019e7c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b3d50], 0
push esi
jne 0x1019e820
mov byte [0x104b3d50], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b3d6c]
xor ebx, dword [0x104b3d68]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + str.BP:T], cl
inc eax
cmp eax, 0x16
jb 0x1019e7e0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b3d66
push str.BP:T
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1019e840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b36e0], 0
push esi
jne 0x1019e8a0
mov byte [0x104b36e0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b36f4]
xor ebx, dword [0x104b36f0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b36e1], cl
inc eax
cmp eax, 0xc
jb 0x1019e860
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b36ec
push 0x104b36e1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1019e8c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b3cd0], 0
push esi
jne 0x1019e920
mov byte [0x104b3cd0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b3cec]
xor ebx, dword [0x104b3ce8]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b3cd1], cl
inc eax
cmp eax, 0x11
jb 0x1019e8e0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b3ce1
push 0x104b3cd1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1019e940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b32b0], 0
push esi
jne 0x1019e9a0
mov byte [0x104b32b0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b32cc]
xor ebx, dword [0x104b32c8]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b32b1], cl
inc eax
cmp eax, 0x11
jb 0x1019e960
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b32c1
push 0x104b32b1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1019e9c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b2aa0], 0
push esi
jne 0x1019ea20
mov byte [0x104b2aa0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b2abc]
xor ebx, dword [0x104b2ab8]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + str.T3A_ag_a], cl
inc eax
cmp eax, 0x10
jb 0x1019e9e0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b2ab0
push str.T3A_ag_a
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1019ea40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b3e60], 0
push esi
jne 0x1019eaa0
mov byte [0x104b3e60], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b3e7c]
xor ebx, dword [0x104b3e78]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b3e61], cl
inc eax
cmp eax, 0x10
jb 0x1019ea60
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b3e70
push 0x104b3e61
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1019eac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b3790], 0
push esi
jne 0x1019eb20
mov byte [0x104b3790], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b37ac]
xor ebx, dword [0x104b37a8]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b3791], cl
inc eax
cmp eax, 0x11
jb 0x1019eae0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b37a1
push 0x104b3791
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1019eb40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b3010], 0
push esi
jne 0x1019eba0
mov byte [0x104b3010], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b302c]
xor ebx, dword [0x104b3028]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b3011], cl
inc eax
cmp eax, 0x11
jb 0x1019eb60
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b3021
push 0x104b3011
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1019ebc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b2e40], 0
push esi
jne 0x1019ec20
mov byte [0x104b2e40], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b2e54]
xor ebx, dword [0x104b2e50]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + str.H__er], cl
inc eax
cmp eax, 0xe
jb 0x1019ebe0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b2e4e
push str.H__er
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x1019ec40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104b2b80], 0
push esi
jne 0x1019eca0
mov byte [0x104b2b80], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104b2b94]
xor ebx, dword [0x104b2b90]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104b2b81], cl
inc eax
cmp eax, 0xe
jb 0x1019ec60
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104b2b8e
push 0x104b2b81
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4