joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001236
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor ebx, ebx
mov dword [0x10069218], 0xea60
push esi
mov eax, 0x1f4
mov dword [0x10069214], ebx
push edi
push ebx
mov dword [0x10069210], eax
mov dword [0x1006921c], ebx
mov dword [0x10069220], eax
mov dword [0x10069224], ebx
mov dword [0x10069228], ebx
call dword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov esi, eax
mov dword [0x1006923c], edx
mov eax, 0x55555555
mov dword [0x10069238], esi
xor edi, edi
mov dword [0x1006a5b8], eax
pop ecx
mov dword [0x1006a5bc], eax
inc edi
push 0x5851f42d
mov ecx, edx
xor eax, eax
push 0x4c957f2d
shr ecx, 0x1e
xor eax, edx
xor ecx, esi
push eax
push ecx
call fcn.10037820
mov esi, eax
mov eax, 0x138
add esi, edi
mov dword [edi*8 + 0x10069238], esi
adc edx, ebx
mov dword [edi*8 + 0x1006923c], edx
inc edi
cmp edi, eax
jb 0x10001294
movaps xmm0, xmmword [0x1003de40]
pop edi
pop esi
mov dword [0x10069230], eax
mov eax, 0x10069210
movups xmmword [0x1006a5c0], xmm0
pop ebx
ret 0x10

Function at 0x100012ec
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 6], 0
je 0x1000130a
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x63]
xor byte [ecx], al
inc ebx
cmp ebx, 5
jb 0x100012f7
pop ebx
mov byte [edx + 6], 0
mov eax, edx
ret

Function at 0x1000130d
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 5], 0
je 0x1000132b
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x63]
xor byte [ecx], al
inc ebx
cmp ebx, 4
jb 0x10001318
pop ebx
mov byte [edx + 5], 0
mov eax, edx
ret

Function at 0x1000132e
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 8], 0
je 0x1000134c
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x63]
xor byte [ecx], al
inc ebx
cmp ebx, 7
jb 0x10001339
pop ebx
mov byte [edx + 8], 0
mov eax, edx
ret

Function at 0x1000134f
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xe], 0
je 0x1000136d
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x63]
xor byte [ecx], al
inc ebx
cmp ebx, 0xd
jb 0x1000135a
pop ebx
mov byte [edx + 0xe], 0
mov eax, edx
ret

Function at 0x10001370
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 7], 0
je 0x1000138e
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x63]
xor byte [ecx], al
inc ebx
cmp ebx, 6
jb 0x1000137b
pop ebx
mov byte [edx + 7], 0
mov eax, edx
ret

Function at 0x10001391
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x12], 0
je 0x100013af
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x63]
xor byte [ecx], al
inc ebx
cmp ebx, 0x11
jb 0x1000139c
pop ebx
mov byte [edx + 0x12], 0
mov eax, edx
ret

Function at 0x100013b2
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 9], 0
je 0x100013d0
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x63]
xor byte [ecx], al
inc ebx
cmp ebx, 8
jb 0x100013bd
pop ebx
mov byte [edx + 9], 0
mov eax, edx
ret
Function at 0x100013d3
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0x100013f0
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x63]
xor byte [ecx], al
inc edx
cmp edx, 8
jb 0x100013de
mov byte [esi + 9], 0
pop esi
ret

Function at 0x100013f2
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x12], 0
je 0x1000140f
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x63]
xor byte [ecx], al
inc edx
cmp edx, 0x11
jb 0x100013fd
mov byte [esi + 0x12], 0
pop esi
ret

Function at 0x10001411
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 7], 0
je 0x1000142e
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x63]
xor byte [ecx], al
inc edx
cmp edx, 6
jb 0x1000141c
mov byte [esi + 7], 0
pop esi
ret

Function at 0x10001430
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xe], 0
je 0x1000144d
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x63]
xor byte [ecx], al
inc edx
cmp edx, 0xd
jb 0x1000143b
mov byte [esi + 0xe], 0
pop esi
ret

Function at 0x1000144f
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x1000146c
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x63]
xor byte [ecx], al
inc edx
cmp edx, 7
jb 0x1000145a
mov byte [esi + 8], 0
pop esi
ret

Function at 0x1000146e
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x1000148b
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x63]
xor byte [ecx], al
inc edx
cmp edx, 4
jb 0x10001479
mov byte [esi + 5], 0
pop esi
ret

Function at 0x1000148d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 6], 0
je 0x100014aa
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x63]
xor byte [ecx], al
inc edx
cmp edx, 5
jb 0x10001498
mov byte [esi + 6], 0
pop esi
ret

Function at 0x100014ac
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xc], 0
je 0x100014ca
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x63]
xor byte [ecx], al
inc ebx
cmp ebx, 0xb
jb 0x100014b7
pop ebx
mov byte [edx + 0xc], 0
mov eax, edx
ret

Function at 0x100014cd
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
je 0x100014ea
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x63]
xor byte [ecx], al
inc edx
cmp edx, 0xb
jb 0x100014d8
mov byte [esi + 0xc], 0
pop esi
ret

Function at 0x100014ec
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xd], 0
je 0x1000150a
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x62]
xor byte [ecx], al
inc ebx
cmp ebx, 0xc
jb 0x100014f7
pop ebx
mov byte [edx + 0xd], 0
mov eax, edx
ret

Function at 0x1000150d
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xa], 0
je 0x1000152b
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x62]
xor byte [ecx], al
inc ebx
cmp ebx, 9
jb 0x10001518
pop ebx
mov byte [edx + 0xa], 0
mov eax, edx
ret
Function at 0x1000152e
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x1000154b
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x62]
xor byte [ecx], al
inc edx
cmp edx, 9
jb 0x10001539
mov byte [esi + 0xa], 0
pop esi
ret

Function at 0x1000154d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x1000156a
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x62]
xor byte [ecx], al
inc edx
cmp edx, 0xc
jb 0x10001558
mov byte [esi + 0xd], 0
pop esi
ret

Function at 0x100030d8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x100030e6
pop esi
mov eax, edx
pop ebp
ret 4

Function at 0x100030ff
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
push edi
cmp dword [ecx + 0x14], 0xf
mov edi, dword [ecx + 0x10]
jbe 0x10003112
mov ecx, dword [ecx]
xor esi, esi
mov edx, 0x811c9dc5
test edi, edi
je 0x1000312e
movzx eax, byte [ecx + esi]
xor eax, edx
imul edx, eax, 0x1000193
inc esi
cmp esi, edi
jb 0x1000311d
pop edi
mov eax, edx
pop esi
pop ebp
ret 4

Function at 0x10003389
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
test esi, esi
je 0x100033e2
push edi
mov edi, dword [esi + 0x3c]
lea eax, [ebp - 4]
push eax
push 4
push 0x40
push esi
add edi, esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100033ba
push 0x40
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test edi, edi
je 0x100033e1
lea eax, [ebp - 4]
mov esi, 0xf8
push eax
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100033e1
push esi
push 0
push edi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
pop edi
pop esi
leave
ret
Function at 0x100033e5
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp - 8]
jne 0x1000341f
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10003423
cmp edx, esi
jne 0x10003408
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp - 8]
jne 0x10003443
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10003447
cmp edx, esi
jne 0x1000342c
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp - 8]
jne 0x10003467
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x1000346b
cmp edx, esi
jne 0x10003450
popfd
popal
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100035f5
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x11], 0
je 0x10003613
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x61]
xor byte [ecx], al
inc ebx
cmp ebx, 0x10
jb 0x10003600
pop ebx
mov byte [edx + 0x11], 0
mov eax, edx
ret

Function at 0x10003e84
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x14], 0
je 0x10003ea2
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x61]
xor byte [ecx], al
inc ebx
cmp ebx, 0x13
jb 0x10003e8f
pop ebx
mov byte [edx + 0x14], 0
mov eax, edx
ret

Function at 0x10003ea5
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xb], 0
je 0x10003ec3
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x61]
xor byte [ecx], al
inc ebx
cmp ebx, 0xa
jb 0x10003eb0
pop ebx
mov byte [edx + 0xb], 0
mov eax, edx
ret

Function at 0x10004510
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x10], 0
je 0x1000452e
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x61]
xor byte [ecx], al
inc ebx
cmp ebx, 0xf
jb 0x1000451b
pop ebx
mov byte [edx + 0x10], 0
mov eax, edx
ret

Function at 0x10004531
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0x1e], 0
je 0x1000454f
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x61]
xor byte [ecx], al
inc ebx
cmp ebx, 0x1d
jb 0x1000453c
pop ebx
mov byte [edx + 0x1e], 0
mov eax, edx
ret
Function at 0x10004704
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10041040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1004200f], 0
je 0x100047bd
movaps xmm0, xmmword [0x1003e290]
xor ecx, ecx
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0x10091cb
lea eax, [ecx - 0x61]
xor byte [ebp + ecx - 0x18], al
inc ecx
cmp ecx, 0x12
jb 0x10004735
lea eax, [ebp - 0x18]
mov byte [ebp - 5], 0
push eax
call fcn.100144c1
push ecx
push ecx
mov edx, 0x10069170
mov ecx, str.eReadlis
call fcn.1001ae94
mov edx, 0x10069188
mov ecx, str.karacter
call fcn.1001ae94
mov edx, 0x10069180
mov ecx, str.eOver
call fcn.1001ae94
mov edx, 0x10069174
mov ecx, str.evest
call fcn.1001ae94
mov edx, 0x1006917c
mov ecx, str.eHelmet
call fcn.1001ae94
mov edx, 0x10069184
mov ecx, str.eGoggle
call fcn.1001ae94
mov edx, 0x10069178
mov ecx, str.eBackapcl
call fcn.1001ae94
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10033bdc
leave
ret

Function at 0x1000616a
Capabilities:
Encode data using xor

Disassembly:
mov edx, ecx
cmp byte [edx + 0xf], 0
je 0x10006188
push ebx
xor ebx, ebx
lea ecx, [edx + ebx]
lea eax, [ebx - 0x61]
xor byte [ecx], al
inc ebx
cmp ebx, 0xe
jb 0x10006175
pop ebx
mov byte [edx + 0xf], 0
mov eax, edx
ret

Function at 0x10006190
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x100061c8
mov ecx, dword [ebp + 8]
call fcn.100033e5
mov ecx, dword [ebp + 8]
call fcn.10003389
push 0x64
push 0x232
call dword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
push ecx
push ecx
push ecx
push 0x1000618b
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc eax
pop ebp
ret 0xc

Function at 0x100061cf
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x100061ec
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x61]
xor byte [ecx], al
inc edx
cmp edx, 0xe
jb 0x100061da
mov byte [esi + 0xf], 0
pop esi
ret

Function at 0x10006214
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x10006231
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x61]
xor byte [ecx], al
inc edx
cmp edx, 0x12
jb 0x1000621f
mov byte [esi + 0x13], 0
pop esi
ret

Function at 0x1000625c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1e], 0
je 0x10006279
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x61]
xor byte [ecx], al
inc edx
cmp edx, 0x1d
jb 0x10006267
mov byte [esi + 0x1e], 0
pop esi
ret

Function at 0x1000627b
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x10006298
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x61]
xor byte [ecx], al
inc edx
cmp edx, 0xf
jb 0x10006286
mov byte [esi + 0x10], 0
pop esi
ret

Function at 0x100062bb
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x100062d8
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x61]
xor byte [ecx], al
inc edx
cmp edx, 0xa
jb 0x100062c6
mov byte [esi + 0xb], 0
pop esi
ret
Function at 0x100062fb
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x10006318
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x61]
xor byte [ecx], al
inc edx
cmp edx, 0x10
jb 0x10006306
mov byte [esi + 0x11], 0
pop esi
ret
Function at 0x10006fb8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10041040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x100691d8]
lea eax, [ebp - 0x14]
push esi
push edi
push eax
push dword [0x1009fadc]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
movd xmm1, eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x20]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x20]
mov ecx, edi
sub ecx, dword [0x1009fae0]
mov esi, dword [ebp - 0x1c]
mov edx, esi
sbb edx, dword [0x1009fae4]
call fcn.10037a70
mov edx, dword [0x1009faec]
mov ecx, dword [0x1009fae8]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x18], xmm0
call fcn.10037a70
movss xmm1, dword [ebp - 0x18]
cvtsd2ss xmm0, xmm0
push 0x11
divss xmm1, xmm0
movss dword [ebx + 0x18], xmm1
mov dword [0x1009fae4], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x1009fae0], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xf1], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xf2], al
call esi
shr eax, 0xf
and al, 1
mov byte [ebx + 0xf4], 0
mov byte [ebx + 0xf3], al
call fcn.10006f11
cmp byte [ebx + 0xf0], 0
pop edi
pop esi
pop ebx
je 0x100070b2
or eax, 0xffffffff
jmp 0x100070bd
mov eax, dword [0x100691d8]
mov eax, dword [eax + 0x1cfc]
cmp dword [0x10041988], eax
je 0x100070cf
mov dword [0x10041988], eax
call fcn.10006e75
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10033bdc
leave
ret

Function at 0x100085de
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x1009fb34], 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
jne 0x1000861d
xor esi, esi
push 8
mov ecx, esi
pop edx
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
sub edx, 1
jne 0x100085f8
mov dword [esi*4 + 0x1009fb30], ecx
inc esi
cmp esi, 0x100
jb 0x100085f3
mov esi, dword [ebp + 8]
not esi
mov edx, esi
test ebx, ebx
jle 0x10008662
movzx eax, byte [edi]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1009fb30]
inc edi
sub ebx, 1
jne 0x10008628
jmp 0x10008669
cmp al, 0x23
jne 0x10008650
cmp byte [edi], al
jne 0x10008650
cmp byte [edi + 1], al
cmove edx, esi
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1009fb30]
mov al, byte [edi]
inc edi
test al, al
jne 0x10008642
pop edi
not edx
pop esi
mov eax, edx
pop ebx
pop ebp
ret
Function at 0x10008e63
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10008e72
and dword [edi], 0
mov edx, 0x1003d300
call fcn.10008dd1
mov esi, eax
test esi, esi
je 0x10008f10
push ebx
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10008f05
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebx, eax
pop ecx
cmp ebx, 0xffffffff
je 0x10008f05
push 0
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10008f05
mov ecx, ebx
call fcn.1000a58f
mov dword [ebp + 8], eax
test eax, eax
je 0x10008f05
push esi
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, ebx
je 0x10008ef3
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
push dword [ebp + 8]
dec dword [0x1009faf0]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x10008f0c
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
test edi, edi
je 0x10008f00
mov dword [edi], ebx
mov eax, dword [ebp + 8]
jmp 0x10008f0f
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
pop ecx
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x1000d603
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100691d8]
push esi
mov esi, ecx
and dword [eax + 0x2c8c], 0
test esi, esi
je 0x1000d653
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push edi
call fcn.1000d656
mov edx, 0x1003d304
mov ecx, esi
mov edi, eax
call fcn.10008dd1
mov esi, eax
test esi, esi
je 0x1000d652
push esi
push dword [ebp - 4]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
leave
ret
Function at 0x10014478
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
mov edi, dword [0x100691d8]
mov eax, dword [edi + 0x1a20]
mov byte [eax + 0x78], 1
mov eax, dword [edi + 0x1a20]
cmp byte [eax + 0x7b], 0
jne 0x100144be
push edx
lea esi, [edi + 0x2ec4]
mov edx, 0xc01
push ecx
mov ecx, esi
call fcn.100085b0
pop ecx
pop ecx
lea edx, [edi + 0x2ec4]
mov ecx, esi
lea edx, [edx + eax]
pop edi
pop esi
jmp fcn.100144fe
pop edi
pop esi
ret
Function at 0x100253c6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
mov eax, dword [0x10041040]
xor eax, esp
mov dword [esp + 0x2c], eax
movaps xmm0, xmmword [0x1003e340]
xor edx, edx
movups xmmword [esp], xmm0
mov dword [esp + 0x20], 0xa1afb2b3
movaps xmm0, xmmword [0x1003e190]
movups xmmword [esp + 0x10], xmm0
mov dword [esp + 0x24], 0xbaa682e5
mov dword [esp + 0x28], 0x100caa2
mov al, dl
sub al, 0x5f
xor byte [esp + edx], al
inc edx
cmp edx, 0x2a
jb 0x1002540b
push ecx
lea eax, [esp + 4]
mov byte [esp + 0x2f], 0
push eax
mov edx, 0x1009ff3c
call fcn.1001b53d
pop ecx
pop ecx
test al, al
je 0x10025478
mov eax, dword [0x1009ff3c]
sub eax, 0
je 0x1002546d
sub eax, 1
je 0x10025466
sub eax, 1
je 0x1002545f
sub eax, 1
je 0x10025458
sub eax, 1
jne 0x10025474
call fcn.1002e44f
jmp 0x10025474
call fcn.1002eab9
jmp 0x10025474
call fcn.1002d8c7
jmp 0x10025474
call fcn.1002df43
jmp 0x10025474
xor ecx, ecx
call fcn.1002cf51
mov al, 1
jmp 0x1002547a
xor al, al
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10033bdc
mov esp, ebp
pop ebp
ret
Function at 0x10027e37
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x34], 0
je 0x10027e54
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x33
jb 0x10027e42
mov byte [esi + 0x34], 0
pop esi
ret

Function at 0x10027e56
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x24], 0
je 0x10027e73
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x23
jb 0x10027e61
mov byte [esi + 0x24], 0
pop esi
ret

Function at 0x10027e75
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a5], 0
je 0x10027e9b
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x1a4
jb 0x10027e83
mov byte [esi + 0x1a5], 0
pop esi
ret

Function at 0x10027e9d
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2c], 0
je 0x10027eba
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x2b
jb 0x10027ea8
mov byte [esi + 0x2c], 0
pop esi
ret

Function at 0x10027ebc
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x10027ed9
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x21
jb 0x10027ec7
mov byte [esi + 0x22], 0
pop esi
ret

Function at 0x10027edb
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x10027ef8
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x1c
jb 0x10027ee6
mov byte [esi + 0x1d], 0
pop esi
ret

Function at 0x10027efa
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x5f], 0
je 0x10027f17
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x5e
jb 0x10027f05
mov byte [esi + 0x5f], 0
pop esi
ret

Function at 0x10027f19
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x3c], 0
je 0x10027f36
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x3b
jb 0x10027f24
mov byte [esi + 0x3c], 0
pop esi
ret

Function at 0x10027f38
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x68], 0
je 0x10027f55
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x67
jb 0x10027f43
mov byte [esi + 0x68], 0
pop esi
ret

Function at 0x10027f57
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x41], 0
je 0x10027f74
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x40
jb 0x10027f62
mov byte [esi + 0x41], 0
pop esi
ret

Function at 0x10027f76
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x8b], 0
je 0x10027f9c
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x8a
jb 0x10027f84
mov byte [esi + 0x8b], 0
pop esi
ret
Function at 0x10027f9e
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2b], 0
je 0x10027fbb
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x2a
jb 0x10027fa9
mov byte [esi + 0x2b], 0
pop esi
ret

Function at 0x10027fbd
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x10027fda
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x14
jb 0x10027fc8
mov byte [esi + 0x15], 0
pop esi
ret

Function at 0x10027fdc
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x10027ff9
xor edx, edx
lea ecx, [esi + edx]
lea eax, [edx - 0x5f]
xor byte [ecx], al
inc edx
cmp edx, 0x16
jb 0x10027fe7
mov byte [esi + 0x17], 0
pop esi
ret