joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010d860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1010d8d3
cmp byte [esi + 1], 0
jne 0x1010d91e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x31
jb 0x1010d890
jmp 0x1010d91e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x31
jb 0x1010d8e0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x32]
push eax
push edi
call fcn.10047bb0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x101112d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1022d695
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x102d5080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x43800000
sub esp, 8
mov dword [ebp - 0x14], 0x42000000
push eax
push dword [ebp + 8]
call fcn.10110e00
test al, al
je 0x1011136c
test byte [ebp + 0x10], 1
jne 0x1011136c
push 4
call fcn.101f36d1
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dword [ebp + 0x10], eax
mov dword [eax], ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x101114f0
push 0
push 0
call fcn.101ff589
add esp, 0x18
mov dword [ebp - 0x20], eax
test eax, eax
je 0x10111382
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 1
call fcn.100a5650
cmp dword [ebp - 0x1c], 0
jne 0x1011137d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
call fcn.101f8d85
push 6
mov dword [ebp - 0x1c], 0
call fcn.101f1d57
int3
Function at 0x10133dc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10133e33
cmp byte [esi + 1], 0
jne 0x10133e7e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x1a
jb 0x10133df0
jmp 0x10133e7e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x1a
jb 0x10133e40
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1b]
push eax
push edi
call fcn.10047bb0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10133ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10133f13
cmp byte [esi + 1], 0
jne 0x10133f5e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x1e
jb 0x10133ed0
jmp 0x10133f5e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x1e
jb 0x10133f20
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1f]
push eax
push edi
call fcn.10047bb0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10137980
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1023073d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x102d5080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], edx
mov ebx, ecx
mov dword [ebp - 0x3c], ebx
mov edi, dword [0x103af1c0]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
test edi, edi
jne 0x10137a70
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0x18]
mov dword [ebp - 0x30], ebx
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ecx + ebx + 0x78]
add ecx, ebx
mov dword [ebp - 0x38], ecx
cmp ecx, ebx
je 0x10137a4a
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x10137a4a
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, ebx
sub ecx, 4
dec edx
mov dword [ebp - 0x34], ecx
mov edi, 0xc5880019
mov dword [ebp - 0x2c], edx
mov ecx, dword [ecx]
add ecx, ebx
mov bl, byte [ecx]
inc ecx
test bl, bl
je 0x10137a40
movsx esi, bl
lea ecx, [ecx + 1]
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
mov bl, byte [ecx - 1]
cmova edx, esi
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x10137a12
mov edx, dword [ebp - 0x2c]
cmp edi, 0x47f5d8c1
je 0x10137a4e
mov ecx, dword [ebp - 0x34]
mov ebx, dword [eax + 0x18]
test edx, edx
jne 0x101379f8
mov eax, dword [eax]
jmp 0x101379d3
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, esi
add eax, esi
movzx eax, word [eax + edx*2]
mov edi, dword [ecx + eax*4]
add edi, esi
mov dword [0x103af1c0], edi
lea eax, [ebp - 0x28]
mov ecx, 0x1036aa68
push eax
call fcn.1004a170
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0xf
cmova eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x40]
call edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.1002b0f0
test esi, esi
jne 0x10137aaf
mov dword [ebx], esi
jmp 0x10137abb
push 0
push dword [ebp - 0x44]
call esi
add esp, 8
mov dword [ebx], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101f36c3
mov esp, ebp
pop ebp
ret
Function at 0x10138f10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102229a3
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x102d5080]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [0x10bbf240]
add eax, 0xaff3cc8c
xor eax, 0x3743f7af
mov eax, dword [eax + 0x134]
mov dword [ebp - 0x24], eax
mov eax, dword [0x10375568]
test al, 1
jne 0x10139094
or eax, 1
mov dword [0x10375568], eax
mov dword [ebp - 4], 0
mov ebx, dword [0x10371278]
cmp ebx, dword [0x1037127c]
je 0x10138fc4
nop dword [eax]
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x10138fb9
mov esi, dword [eax + 0xc]
mov edi, 0x811c9dc5
xor eax, eax
inc eax
cmp byte [eax + esi], 0
jne 0x10138f93
xor edx, edx
test eax, eax
je 0x10138fb9
movsx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, eax
jb 0x10138fa0
cmp edi, 0x72e242a1
je 0x10138fd3
add ebx, 4
cmp ebx, dword [0x1037127c]
jne 0x10138f80
mov ecx, dword [ebp - 0x20]
xor eax, eax
mov dword [0x10373c68], eax
jmp 0x10139099
mov eax, dword [ebp - 0x10]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
cmp dword [eax + 4], ebx
jle 0x10139078
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
nop dword [eax]
mov edi, dword [eax]
add edi, ecx
mov ecx, dword [edi + 0x28]
test ecx, ecx
je 0x10139021
cmp dword [ecx + 4], 0
jle 0x10139021
push 0
mov edx, 0xa4a37590
call fcn.1013bb80
add esp, 4
test eax, eax
je 0x1013901e
mov ecx, dword [edi + 0x2c]
add ecx, eax
add ebx, ecx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x10]
mov esi, dword [edi]
mov ebx, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [ecx + esi], 0
jne 0x10139030
xor edx, edx
test ecx, ecx
je 0x1013905c
nop dword [eax]
movsx eax, byte [edx + esi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x10139040
cmp ebx, 0xa4a37590
je 0x10139084
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc edx
mov ebx, dword [ebp - 0x14]
add ecx, 0x3c
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
cmp edx, dword [eax + 4]
jl 0x10138ff0
mov ecx, dword [ebp - 0x20]
mov eax, ebx
mov dword [0x10373c68], eax
jmp 0x10139099
mov eax, dword [edi + 0x2c]
add eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
mov dword [0x10373c68], eax
jmp 0x10139099
mov eax, dword [0x10373c68]
mov edx, dword [ebp - 0x24]
test byte [eax + edx], 1
je 0x101390b7
inc dword [ecx + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ecx + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1013bb80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x1013bb96
mov esp, ebp
pop ebp
ret
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp dword [eax + 4], ebx
jle 0x1013bc28
xor ecx, ecx
mov dword [ebp - 0xc], ecx
nop
mov edi, dword [eax]
add edi, ecx
mov ecx, dword [edi + 0x28]
test ecx, ecx
je 0x1013bbdc
cmp dword [ecx + 4], 0
jle 0x1013bbdc
push dword [ebp + 8]
call fcn.1013bb80
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x1013bbdc
mov eax, dword [edi + 0x2c]
add eax, ecx
add ebx, eax
mov dword [ebp - 4], ebx
mov esi, dword [edi]
mov ebx, 0x811c9dc5
xor eax, eax
inc eax
cmp byte [eax + esi], 0
jne 0x1013bbe5
xor edx, edx
test eax, eax
je 0x1013bc03
movsx ecx, byte [edx + esi]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, eax
jb 0x1013bbf2
cmp ebx, dword [ebp - 0x14]
je 0x1013bc31
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
inc eax
mov ebx, dword [ebp - 4]
add ecx, 0x3c
cmp eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, edx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
jl 0x1013bbb0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
test eax, eax
je 0x1013bc3a
mov dword [eax], edi
mov eax, dword [edi + 0x2c]
add eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1013be50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
push edi
test esi, esi
je 0x1013bee4
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [esi + 4], ecx
jle 0x1013beda
xor eax, eax
mov dword [ebp - 8], eax
mov edi, dword [esi]
mov esi, dword [edi + eax + 4]
add edi, eax
test esi, esi
je 0x1013bec7
mov ebx, 0x811c9dc5
xor eax, eax
inc eax
cmp byte [eax + esi], 0
jne 0x1013be87
xor edx, edx
test eax, eax
je 0x1013bea8
movsx ecx, byte [edx + esi]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, eax
jb 0x1013be94
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp ebx, edx
je 0x1013beed
cmp dword [edi], 0xa
jne 0x1013bec7
mov ecx, dword [edi + 0x20]
test ecx, ecx
je 0x1013bec4
call fcn.1013be50
test eax, eax
jne 0x1013bee6
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
inc ecx
add dword [ebp - 8], 0x3c
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
cmp ecx, dword [esi + 4]
jl 0x1013be74
mov esi, dword [esi + 0xc]
mov dword [ebp - 0xc], esi
test esi, esi
jne 0x1013be65
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1013c500
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x1036bd10], 0
push ebx
push esi
je 0x1013c57a
cmp byte [0x1036bd11], 0
jne 0x1013c5c8
mov byte [0x1036bd11], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1036bde4]
xor ebx, dword [0x1036bde0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1036bd12]
xor al, bl
mov byte [esi + 0x1036bd12], al
inc esi
cmp esi, 0xcc
jb 0x1013c530
jmp 0x1013c5c8
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1036bde4]
xor ebx, dword [0x1036bde0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1036bd12]
xor al, bl
mov byte [esi + 0x1036bd12], al
inc esi
cmp esi, 0xcc
jb 0x1013c580
push ecx
mov ecx, dword [ebp + 8]
push 0x1036bddd
push 0x1036bd12
call fcn.10047bb0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1013c5f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x1036b7a8], 0
push ebx
push esi
je 0x1013c66a
cmp byte [0x1036b7a9], 0
jne 0x1013c6b8
mov byte [0x1036b7a9], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1036b894]
xor ebx, dword [0x1036b890]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1036b7aa]
xor al, bl
mov byte [esi + 0x1036b7aa], al
inc esi
cmp esi, 0xdf
jb 0x1013c620
jmp 0x1013c6b8
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1036b894]
xor ebx, dword [0x1036b890]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1036b7aa]
xor al, bl
mov byte [esi + 0x1036b7aa], al
inc esi
cmp esi, 0xdf
jb 0x1013c670
push ecx
mov ecx, dword [ebp + 8]
push 0x1036b888
push 0x1036b7aa
call fcn.10047bb0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1013c6e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1013c753
cmp byte [esi + 1], 0
jne 0x1013c79e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x3d
jb 0x1013c710
jmp 0x1013c79e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x3d
jb 0x1013c760
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x3e]
push eax
push edi
call fcn.10047bb0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1013c7c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1013c833
cmp byte [esi + 1], 0
jne 0x1013c87e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x4c]
xor ebx, dword [esi + 0x48]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x42
jb 0x1013c7f0
jmp 0x1013c87e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x4c]
xor ebx, dword [esi + 0x48]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x42
jb 0x1013c840
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x43]
push eax
push edi
call fcn.10047bb0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1013c8a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x1036cd88], 0
push ebx
push esi
je 0x1013c917
cmp byte [0x1036cd89], 0
jne 0x1013c965
mov byte [0x1036cd89], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1036cddc]
xor ebx, dword [0x1036cdd8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1036cd8a]
xor al, bl
mov byte [esi + 0x1036cd8a], al
inc esi
cmp esi, 0x4e
jb 0x1013c8d0
jmp 0x1013c965
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1036cddc]
xor ebx, dword [0x1036cdd8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1036cd8a]
xor al, bl
mov byte [esi + 0x1036cd8a], al
inc esi
cmp esi, 0x4e
jb 0x1013c920
push ecx
mov ecx, dword [ebp + 8]
push 0x1036cdd7
push 0x1036cd8a
call fcn.10047bb0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1013c990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x1036b968], 0
push ebx
push esi
je 0x1013ca07
cmp byte [0x1036b969], 0
jne 0x1013ca55
mov byte [0x1036b969], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1036b9c4]
xor ebx, dword [0x1036b9c0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1036b96a]
xor al, bl
mov byte [esi + 0x1036b96a], al
inc esi
cmp esi, 0x50
jb 0x1013c9c0
jmp 0x1013ca55
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1036b9c4]
xor ebx, dword [0x1036b9c0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1036b96a]
xor al, bl
mov byte [esi + 0x1036b96a], al
inc esi
cmp esi, 0x50
jb 0x1013ca10
push ecx
mov ecx, dword [ebp + 8]
push 0x1036b9b9
push 0x1036b96a
call fcn.10047bb0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1013ca80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x1036bc60], 0
push ebx
push esi
je 0x1013cafa
cmp byte [0x1036bc61], 0
jne 0x1013cb48
mov byte [0x1036bc61], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1036bd0c]
xor ebx, dword [0x1036bd08]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1036bc62]
xor al, bl
mov byte [esi + 0x1036bc62], al
inc esi
cmp esi, 0xa3
jb 0x1013cab0
jmp 0x1013cb48
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1036bd0c]
xor ebx, dword [0x1036bd08]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1036bc62]
xor al, bl
mov byte [esi + 0x1036bc62], al
inc esi
cmp esi, 0xa3
jb 0x1013cb00
push ecx
mov ecx, dword [ebp + 8]
push 0x1036bd04
push 0x1036bc62
call fcn.10047bb0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1013cb70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1013cbe3
cmp byte [esi + 1], 0
jne 0x1013cc2e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x34
jb 0x1013cba0
jmp 0x1013cc2e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x34
jb 0x1013cbf0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x35]
push eax
push edi
call fcn.10047bb0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4