joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10344dc
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e30], 1
jne 0x1034550
or dword [0x10f3e30], 1
mov dword [0x10edf4c], 0xada582cd
mov dword [0x10edf50], 0xe4a0a1a8
mov dword [0x10edf54], 0xa3e4abb0
mov dword [0x10edf58], 0xb7e4b0a1
mov dword [0x10edf5c], 0xfefea0b0
mov dword [0x10edf60], 0xa1a7bca1
mov dword [0x10edf64], 0xabadb0b4
mov dword [0x10edf68], 0xb3fefeaa
mov dword [0x10edf6c], 0xecb0a5ac
mov dword [0x10edf70], 0xc4cec9ed
xor eax, eax
mov cl, byte [eax + 0x10edf4c]
xor cl, 0xc4
mov byte [eax + 0x10ee5f8], cl
inc eax
cmp eax, 0x28
jb 0x1034552
mov eax, 0x10ee5f8
ret

Function at 0x103456d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e2c], 1
jne 0x10345a1
or dword [0x10f3e2c], 1
mov dword [0x10edf74], 0xa9aba79b
mov dword [0x10edf78], 0xb6b6a19b
mov word [0x10edf7c], 0xb6ab
mov byte [0x10edf7e], 0xc4
xor eax, eax
mov cl, byte [eax + 0x10edf74]
xor cl, 0xc4
mov byte [eax + 0x10ee620], cl
inc eax
cmp eax, 0xb
jb 0x10345a3
mov eax, 0x10ee620
ret

Function at 0x10345be
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e28], 1
jne 0x1034627
or dword [0x10f3e28], 1
mov dword [0x10edf80], 0xaba79bcd
mov dword [0x10edf84], 0xb6a19ba9
mov dword [0x10edf88], 0xfeb6abb6
mov dword [0x10edf8c], 0xb6b681fe
mov dword [0x10edf90], 0xa189b6ab
mov dword [0x10edf94], 0xa3a5b7b7
mov dword [0x10edf98], 0xfeedeca1
mov dword [0x10edf9c], 0xc9b7e1e4
mov word [0x10edfa0], 0xc4ce
xor eax, eax
mov cl, byte [eax + 0x10edf80]
xor cl, 0xc4
mov byte [eax + 0x10ee62c], cl
inc eax
cmp eax, 0x22
jb 0x1034629
mov eax, 0x10ee62c
ret

Function at 0x1034644
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e24], 1
jne 0x10346c2
or dword [0x10f3e24], 1
mov dword [0x10edfa4], 0xada582cd
mov dword [0x10edfa8], 0xe4a0a1a8
mov dword [0x10edfac], 0xa3e4abb0
mov dword [0x10edfb0], 0x9be4b0a1
mov dword [0x10edfb4], 0x9ba9aba7
mov dword [0x10edfb8], 0xabb6b6a1
mov dword [0x10edfbc], 0x81fefeb6
mov dword [0x10edfc0], 0xb6abb6b6
mov dword [0x10edfc4], 0xb7b7a189
mov dword [0x10edfc8], 0xeca1a3a5
mov dword [0x10edfcc], 0xc4cec9ed
xor eax, eax
mov cl, byte [eax + 0x10edfa4]
xor cl, 0xc4
mov byte [eax + 0x10ee650], cl
inc eax
cmp eax, 0x2c
jb 0x10346c4
mov eax, 0x10ee650
ret

Function at 0x10346df
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e20], 1
jne 0x103475a
or dword [0x10f3e20], 1
mov dword [0x10edfd0], 0xa7a5b097
mov dword [0x10edfd4], 0xb1a0e4af
mov dword [0x10edfd8], 0xa1e4b4a9
mov dword [0x10edfdc], 0xb6abb6b6
mov dword [0x10edfe0], 0xab87e4fe
mov dword [0x10edfe4], 0xbca1b0aa
mov dword [0x10edfe8], 0xa7a196b0
mov dword [0x10edfec], 0xe4a0b6ab
mov dword [0x10edff0], 0xe4b7a5b3
mov dword [0x10edff4], 0xa8a8b1aa
mov byte [0x10edff8], 0xc4
xor eax, eax
mov cl, byte [eax + 0x10edfd0]
xor cl, 0xc4
mov byte [eax + 0x10ee67c], cl
inc eax
cmp eax, 0x29
jb 0x103475c
mov eax, 0x10ee67c
ret
Function at 0x1034777
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e1c], 1
jne 0x10347f1
or dword [0x10f3e1c], 1
mov dword [0x10edffc], 0xa7a5b097
mov dword [0x10ee000], 0xb1a0e4af
mov dword [0x10ee004], 0xa1e4b4a9
mov dword [0x10ee008], 0xb6abb6b6
mov dword [0x10ee00c], 0xbd97e4fe
mov dword [0x10ee010], 0xadaa8da9
mov dword [0x10ee014], 0xa8a5adb0
mov dword [0x10ee018], 0xe4a1bead
mov dword [0x10ee01c], 0xa8ada5a2
mov word [0x10ee020], 0xa0a1
mov byte [0x10ee022], 0xc4
xor eax, eax
mov cl, byte [eax + 0x10edffc]
xor cl, 0xc4
mov byte [eax + 0x10ee6a8], cl
inc eax
cmp eax, 0x27
jb 0x10347f3
mov eax, 0x10ee6a8
ret

Function at 0x103480e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e18], 1
jne 0x1034874
or dword [0x10f3e18], 1
mov dword [0x10ee024], 0xadafb7f8
mov dword [0x10ee028], 0xa0a1b4b4
mov dword [0x10ee02c], 0xa5b6a2e4
mov dword [0x10ee030], 0xe4e8a1a9
mov dword [0x10ee034], 0xb3e48794
mov dword [0x10ee038], 0xaae4b7a5
mov dword [0x10ee03c], 0xfaa8a8b1
mov word [0x10ee040], 0xcec9
mov byte [0x10ee042], 0xc4
xor eax, eax
mov cl, byte [eax + 0x10ee024]
xor cl, 0xc4
mov byte [eax + 0x10ee6d0], cl
inc eax
cmp eax, 0x1f
jb 0x1034876
mov eax, 0x10ee6d0
ret

Function at 0x1034891
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e14], 1
jne 0x1034924
or dword [0x10f3e14], 1
mov dword [0x10ee044], 0xadafb7f8
mov dword [0x10ee048], 0xa0a1b4b4
mov dword [0x10ee04c], 0xa5b6a2e4
mov dword [0x10ee050], 0xe4e8a1a9
mov dword [0x10ee054], 0xb3e48794
mov dword [0x10ee058], 0xb7e4b7a5
mov dword [0x10ee05c], 0xe4a1a9a5
mov dword [0x10ee060], 0xb6e4b7a5
mov dword [0x10ee064], 0xb6b1b0a1
mov dword [0x10ee068], 0xa0a5e4aa
mov dword [0x10ee06c], 0xb7a1b6a0
mov dword [0x10ee070], 0xcec9fab7
mov byte [0x10ee074], 0xc4
xor eax, eax
mov cl, byte [eax + 0x10ee044]
xor cl, 0xc4
mov byte [eax + 0x10ee6f0], cl
inc eax
cmp eax, 0x31
jb 0x1034926
mov eax, 0x10ee6f0
ret
Function at 0x1034941
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16c4
call fcn.010a7490
push ebx
push esi
push edi
call dword [0x10c3094]
test byte [0x10f3e10], 1
mov dword [ebp - 4], eax
jne 0x1034988
or dword [0x10f3e10], 1
mov dword [0x10ee078], 0xa0aba9f8
mov dword [0x10ee07c], 0xfba1a8b1
mov dword [0x10ee080], 0xc4fafbfb
xor edi, edi
xor eax, eax
mov cl, byte [eax + 0x10ee078]
xor cl, 0xc4
mov byte [eax + 0x10ee724], cl
inc eax
cmp eax, 0xc
jb 0x103498c
test byte [0x10f3e0c], 1
mov dword [ebp - 8], 0x10ee724
jne 0x10349d6
or dword [0x10f3e0c], 1
mov dword [0x10ee084], 0xa9bdb7f8
mov dword [0x10ee088], 0xfba8aba6
mov dword [0x10ee08c], 0xc4fafbfb
xor eax, eax
mov cl, byte [eax + 0x10ee084]
xor cl, 0xc4
mov byte [eax + 0x10ee730], cl
inc eax
cmp eax, 0xc
jb 0x10349d8
mov esi, 0x688
push esi
lea eax, [ebp - 0x6c0]
push edi
push eax
mov dword [ebp - 0x1c], 0x10ee730
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.01097950
mov eax, dword [ebp + 8]
cdq
add esp, 0xc
mov dword [ebp - 0x6c0], esi
mov esi, eax
lea eax, [ebp - 0x6c0]
push eax
mov ebx, edx
push ebx
push esi
push dword [ebp - 4]
call dword [0x10c33b8]
test eax, eax
je 0x1034a3d
lea eax, [ebp - 0x69c]
mov dword [ebp - 8], eax
push 0xffa
lea eax, [ebp - 0x16c0]
push edi
push eax
call fcn.01097950
add esp, 0xc
lea eax, [ebp - 0x16c0]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x16c0], 0x58
mov dword [ebp - 0x1670], 0x7d0
call dword [0x10c33c4]
lea ecx, [ebp - 0x166c]
test eax, eax
jne 0x1034a89
mov ecx, dword [ebp - 0x1c]
test byte [0x10f3e08], 1
jne 0x1034ac0
or dword [0x10f3e08], 1
mov dword [0x10ee090], 0xe1e4b4e1
mov dword [0x10ee094], 0xb7e1e5b7
mov dword [0x10ee098], 0xe1bcf4ef
mov word [0x10ee09c], 0xc4bc
xor eax, eax
mov dl, byte [eax + 0x10ee090]
xor dl, 0xc4
mov byte [eax + 0x10ee73c], dl
inc eax
cmp eax, 0xe
jb 0x1034ac2
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push dword [ebp - 8]
push dword [ebp + 8]
push 0x10ee73c
push dword [ebp + 0xc]
call fcn.01094b7d
add esp, 0x1c
push 6
pop ecx
mov dword [ebp - 0xc], edi
xor eax, eax
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [ebp - 4]
mov dword [ebp - 0x38], 0x18
call dword [0x10c33ac]
test eax, eax
je 0x1034b39
push dword [ebp - 0xc]
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call fcn.01034b86
push eax
push dword [ebp + 0xc]
call fcn.01094b7d
add esp, 0x14
test byte [0x10f3e00], 1
jne 0x1034b59
or dword [0x10f3e00], 1
mov word [0x10ee0b0], 0xcec9
mov byte [0x10ee0b2], 0xc4
xor eax, eax
mov cl, byte [eax + 0x10ee0b0]
xor cl, 0xc4
mov byte [eax + 0x10ee75c], cl
inc eax
cmp eax, 3
jb 0x1034b5b
push dword [ebp + 0xc]
push 0x10ee75c
call fcn.010947f1
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x1034b86
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e04], 1
jne 0x1034bbe
or dword [0x10f3e04], 1
mov dword [0x10ee0a0], 0xb7e1ece4
mov dword [0x10ee0a4], 0xe4a0e1fe
mov dword [0x10ee0a8], 0xbcf4e4ef
mov dword [0x10ee0ac], 0xc4edbce1
xor eax, eax
mov cl, byte [eax + 0x10ee0a0]
xor cl, 0xc4
mov byte [eax + 0x10ee74c], cl
inc eax
cmp eax, 0x10
jb 0x1034bc0
mov eax, 0x10ee74c
ret

Function at 0x1035e1c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3df4], 1
jne 0x1035e71
or dword [0x10f3df4], 1
mov dword [0x10ee780], 0x8197848d
mov dword [0x10ee784], 0x80978492
mov dword [0x10ee788], 0x95868499
mov dword [0x10ee78c], 0x9681998c
mov dword [0x10ee790], 0x93999181
mov dword [0x10ee794], 0x9a9d8a87
mov word [0x10ee798], 0xc59a
xor eax, eax
mov cl, byte [eax + 0x10ee780]
xor cl, 0xc5
mov byte [eax + 0x10ee980], cl
inc eax
cmp eax, 0x1a
jb 0x1035e73
mov eax, 0x10ee980
ret

Function at 0x1035f82
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3df0], 1
jne 0x1035fac
or dword [0x10f3df0], 1
mov dword [0x10ee79c], 0xa4928893
mov word [0x10ee7a0], 0xa0b7
mov byte [0x10ee7a2], 0xc5
xor eax, eax
mov cl, byte [eax + 0x10ee79c]
xor cl, 0xc5
mov byte [eax + 0x10ee99c], cl
inc eax
cmp eax, 7
jb 0x1035fae
mov eax, 0x10ee99c
ret

Function at 0x1035fc9
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3dec], 1
jne 0x1035ff6
or dword [0x10f3dec], 1
mov dword [0x10ee7a4], 0xb1b7ac93
mov dword [0x10ee7a8], 0x95a9a4b0
mov word [0x10ee7ac], 0xc586
xor eax, eax
mov cl, byte [eax + 0x10ee7a4]
xor cl, 0xc5
mov byte [eax + 0x10ee9a4], cl
inc eax
cmp eax, 0xa
jb 0x1035ff8
mov eax, 0x10ee9a4
ret

Function at 0x1036013
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3de8], 1
jne 0x1036047
or dword [0x10f3de8], 1
mov dword [0x10ee7b0], 0xb1b7ac93
mov dword [0x10ee7b4], 0x87a9a4b0
mov word [0x10ee7b8], 0xbdaa
mov byte [0x10ee7ba], 0xc5
xor eax, eax
mov cl, byte [eax + 0x10ee7b0]
xor cl, 0xc5
mov byte [eax + 0x10ee9b0], cl
inc eax
cmp eax, 0xb
jb 0x1036049
mov eax, 0x10ee9b0
ret

Function at 0x1036064
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3de4], 1
jne 0x1036088
or dword [0x10f3de4], 1
mov dword [0x10ee7bc], 0xa0aba082
mov dword [0x10ee7c0], 0xc5a6acb7
xor eax, eax
mov cl, byte [eax + 0x10ee7bc]
xor cl, 0xc5
mov byte [eax + 0x10ee9bc], cl
inc eax
cmp eax, 8
jb 0x103608a
mov eax, 0x10ee9bc
ret
Function at 0x10360a5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10bbc9d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
and dword [esp], 0
test byte [0x10f3de0], 1
push esi
jne 0x10360f8
or dword [0x10f3de0], 1
mov dword [0x10ee7c4], 0xa9a1b1ab
mov dword [0x10ee7c8], 0xa9a1eba9
mov word [0x10ee7cc], 0xc5a9
xor eax, eax
mov cl, byte [eax + 0x10ee7c4]
xor cl, 0xc5
mov byte [eax + 0x10ee9c4], cl
inc eax
cmp eax, 0xa
jb 0x10360fa
push 0x10ee9c4
call dword [0x10c30cc]
mov esi, eax
test esi, esi
jne 0x103616c
call dword [0x10c30a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0105ad72
pop ecx
pop ecx
and dword [esp + 0xb4], esi
push eax
call fcn.010362b3
push eax
lea eax, [esp + 0x28]
push eax
call fcn.01036b04
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 1
call fcn.01035bce
push 0x10dfd00
mov eax, esi
push eax
call fcn.0109e2a5
call fcn.01036319
push eax
push esi
call dword [0x10c30c8]
test eax, eax
jne 0x10361c9
call dword [0x10c30a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0105ad72
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 2
call fcn.0103638b
push eax
lea eax, [esp + 0x44]
push eax
call fcn.01036b04
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 3
call fcn.01035bce
push 0x10dfd00
mov eax, esi
jmp 0x1036166
lea ecx, [esp + 4]
push ecx
push 0x18
lea ecx, [esp + 0x60]
push ecx
push 0
push dword [ebp + 8]
call eax
test eax, eax
jne 0x1036251
cmp dword [esp + 4], 0x18
jne 0x1036251
push dword [esp + 0x6c]
push eax
push 0x410
call dword [0x10c30c4]
test eax, eax
jne 0x10362a0
call dword [0x10c30a8]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.0105ad72
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 6
call fcn.010364cb
push eax
lea eax, [esp + 0x94]
push eax
call fcn.01036b04
add esp, 0xc
lea esi, [esp + 0x14]
mov byte [esp + 0xb4], 7
call fcn.01035bce
push 0x10dfd00
mov eax, esi
jmp 0x1036166
call dword [0x10c30a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0105ad72
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 4
call fcn.0103643e
push eax
lea eax, [esp + 0x44]
push eax
call fcn.01036b04
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 5
call fcn.01035bce
push 0x10dfd00
mov eax, esi
jmp 0x1036166
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10362b3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3ddc], 1
jne 0x10362fc
or dword [0x10f3ddc], 1
mov dword [0x10ee7d0], 0xa1a4aa89
mov dword [0x10ee7d4], 0xb7a7ac89
mov dword [0x10ee7d8], 0xe5bcb7a4
mov dword [0x10ee7dc], 0xa9aca4a3
mov dword [0x10ee7e0], 0xe5ffa1a0
mov byte [0x10ee7e4], 0xc5
xor eax, eax
mov cl, byte [eax + 0x10ee7d0]
xor cl, 0xc5
mov byte [eax + 0x10ee9d0], cl
inc eax
cmp eax, 0x15
jb 0x10362fe
mov eax, 0x10ee9d0
ret
Function at 0x1036319
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3dd8], 1
jne 0x103636e
or dword [0x10f3dd8], 1
mov dword [0x10ee7e8], 0xb094b18b
mov dword [0x10ee7ec], 0x8cbcb7a0
mov dword [0x10ee7f0], 0xb7aaa3ab
mov dword [0x10ee7f4], 0xacb1a4a8
mov dword [0x10ee7f8], 0xb795abaa
mov dword [0x10ee7fc], 0xb6a0a6aa
mov word [0x10ee800], 0xc5b6
xor eax, eax
mov cl, byte [eax + 0x10ee7e8]
xor cl, 0xc5
mov byte [eax + 0x10ee9e8], cl
inc eax
cmp eax, 0x1a
jb 0x1036370
mov eax, 0x10ee9e8
ret

Function at 0x103638b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3dd4], 1
jne 0x1036421
or dword [0x10f3dd4], 1
mov dword [0x10ee804], 0x95b1a082
mov dword [0x10ee808], 0x84a6aab7
mov dword [0x10ee80c], 0xa0b7a1a1
mov dword [0x10ee810], 0xa3e5b6b6
mov dword [0x10ee814], 0xa0a9aca4
mov dword [0x10ee818], 0x8bede5a1
mov dword [0x10ee81c], 0xa0b094b1
mov dword [0x10ee820], 0xab8cbcb7
mov dword [0x10ee824], 0xa8b7aaa3
mov dword [0x10ee828], 0xaaacb1a4
mov dword [0x10ee82c], 0xaab795ab
mov dword [0x10ee830], 0xb6b6a0a6
mov dword [0x10ee834], 0xc5e5ffec
xor eax, eax
mov cl, byte [eax + 0x10ee804]
xor cl, 0xc5
mov byte [eax + 0x10eea04], cl
inc eax
cmp eax, 0x34
jb 0x1036423
mov eax, 0x10eea04
ret

Function at 0x103643e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3dd0], 1
jne 0x10364ae
or dword [0x10f3dd0], 1
mov dword [0x10ee838], 0xb094b18b
mov dword [0x10ee83c], 0x8cbcb7a0
mov dword [0x10ee840], 0xb7aaa3ab
mov dword [0x10ee844], 0xacb1a4a8
mov dword [0x10ee848], 0xb795abaa
mov dword [0x10ee84c], 0xb6a0a6aa
mov dword [0x10ee850], 0xa4a3e5b6
mov dword [0x10ee854], 0xa1a0a9ac
mov word [0x10ee858], 0xe5ff
mov byte [0x10ee85a], 0xc5
xor eax, eax
mov cl, byte [eax + 0x10ee838]
xor cl, 0xc5
mov byte [eax + 0x10eea38], cl
inc eax
cmp eax, 0x23
jb 0x10364b0
mov eax, 0x10eea38
ret

Function at 0x10364cb
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3dcc], 1
jne 0x1036514
or dword [0x10f3dcc], 1
mov dword [0x10ee85c], 0xaba0b58a
mov dword [0x10ee860], 0xa6aab795
mov dword [0x10ee864], 0xe5b6b6a0
mov dword [0x10ee868], 0xa9aca4a3
mov dword [0x10ee86c], 0xe5ffa1a0
mov byte [0x10ee870], 0xc5
xor eax, eax
mov cl, byte [eax + 0x10ee85c]
xor cl, 0xc5
mov byte [eax + 0x10eea5c], cl
inc eax
cmp eax, 0x15
jb 0x1036516
mov eax, 0x10eea5c
ret
Function at 0x1036531
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10bbc4a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
and dword [esp + 0xc], 0
test byte [0x10f3dc8], 1
push esi
push edi
jne 0x103658e
or dword [0x10f3dc8], 1
mov dword [0x10ee874], 0xabb7a0ae
mov dword [0x10ee878], 0xf7f6a9a0
mov dword [0x10ee87c], 0xa9a9a1eb
mov byte [0x10ee880], 0xc5
xor eax, eax
mov cl, byte [eax + 0x10ee874]
xor cl, 0xc5
mov byte [eax + 0x10eea74], cl
inc eax
cmp eax, 0xd
jb 0x1036590
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0x10eea74
call edi
mov esi, eax
test esi, esi
jne 0x1036604
call dword [0x10c30a8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0105ad72
pop ecx
pop ecx
and dword [esp + 0x264], esi
push eax
call fcn.01036766
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.01036b04
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 1
call fcn.01035bce
push 0x10dfd00
mov eax, esi
push eax
call fcn.0109e2a5
call fcn.010367e3
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
jne 0x10366d1
call fcn.01036856
push eax
call edi
mov edi, eax
test edi, edi
jne 0x1036675
call dword [0x10c30a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0105ad72
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 2
call fcn.010368a0
push eax
lea eax, [esp + 0x20]
push eax
call fcn.01036b04
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 3
call fcn.01035bce
push 0x10dfd00
mov eax, esi
jmp 0x10365fe
call fcn.0103691a
push eax
push edi
call esi
test eax, eax
jne 0x10366d1
call dword [0x10c30a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0105ad72
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 4
call fcn.0103698a
push eax
lea eax, [esp + 0x20]
push eax
call fcn.01036b04
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 5
call fcn.01035bce
push 0x10dfd00
mov eax, esi
jmp 0x10365fe
push 0x208
lea ecx, [esp + 0x54]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0x1036733
call dword [0x10c30a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0105ad72
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 6
call fcn.01036a43
push eax
lea eax, [esp + 0x20]
push eax
call fcn.01036b04
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 7
call fcn.01035bce
push 0x10dfd00
mov eax, esi
jmp 0x10365fe
mov esi, dword [ebp + 8]
and dword [esi + 0x10], 0
lea eax, [esp + 0x50]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.01034cc9
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1036766
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3dc4], 1
jne 0x10367c6
or dword [0x10f3dc4], 1
mov dword [0x10ee884], 0xa1a4aa89
mov dword [0x10ee888], 0xb7a7ac89
mov dword [0x10ee88c], 0xe5bcb7a4
mov dword [0x10ee890], 0xa9aca4a3
mov dword [0x10ee894], 0xede5a1a0
mov dword [0x10ee898], 0xabb7a0ae
mov dword [0x10ee89c], 0xf7f6a9a0
mov dword [0x10ee8a0], 0xc5e5ffec
xor eax, eax
mov cl, byte [eax + 0x10ee884]
xor cl, 0xc5
mov byte [eax + 0x10eea84], cl
inc eax
cmp eax, 0x20
jb 0x10367c8
mov eax, 0x10eea84
ret

Function at 0x10367e3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3dc0], 1
jne 0x1036839
or dword [0x10f3dc0], 1
mov dword [0x10ee8a4], 0x82f7f68e
mov dword [0x10ee8a8], 0xb795b1a0
mov dword [0x10ee8ac], 0xb6a0a6aa
mov dword [0x10ee8b0], 0xa4a88cb6
mov dword [0x10ee8b4], 0xac83a0a2
mov dword [0x10ee8b8], 0xa48ba0a9
mov dword [0x10ee8bc], 0xc584a0a8
xor eax, eax
mov cl, byte [eax + 0x10ee8a4]
xor cl, 0xc5
mov byte [eax + 0x10eeaa4], cl
inc eax
cmp eax, 0x1c
jb 0x103683b
mov eax, 0x10eeaa4
ret

Function at 0x1036856
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3dbc], 1
jne 0x1036883
or dword [0x10f3dbc], 1
mov dword [0x10ee8c0], 0xb5a4b6b5
mov dword [0x10ee8c4], 0xa9a1ebac
mov word [0x10ee8c8], 0xc5a9
xor eax, eax
mov cl, byte [eax + 0x10ee8c0]
xor cl, 0xc5
mov byte [eax + 0x10eeac0], cl
inc eax
cmp eax, 0xa
jb 0x1036885
mov eax, 0x10eeac0
ret

Function at 0x10368a0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3db8], 1
jne 0x10368fd
or dword [0x10f3db8], 1
mov dword [0x10ee8cc], 0xa1a4aa89
mov dword [0x10ee8d0], 0xb7a7ac89
mov dword [0x10ee8d4], 0xe5bcb7a4
mov dword [0x10ee8d8], 0xa9aca4a3
mov dword [0x10ee8dc], 0xede5a1a0
mov dword [0x10ee8e0], 0xb5a4b6b5
mov dword [0x10ee8e4], 0xe5ffecac
mov byte [0x10ee8e8], 0xc5
xor eax, eax
mov cl, byte [eax + 0x10ee8cc]
xor cl, 0xc5
mov byte [eax + 0x10eeacc], cl
inc eax
cmp eax, 0x1d
jb 0x10368ff
mov eax, 0x10eeacc
ret

Function at 0x103691a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3db4], 1
jne 0x103696d
or dword [0x10f3db4], 1
mov dword [0x10ee8ec], 0x95b1a082
mov dword [0x10ee8f0], 0xa0a6aab7
mov dword [0x10ee8f4], 0xa88cb6b6
mov dword [0x10ee8f8], 0x83a0a2a4
mov dword [0x10ee8fc], 0x8ba0a9ac
mov dword [0x10ee900], 0x84a0a8a4
mov byte [0x10ee904], 0xc5
xor eax, eax
mov cl, byte [eax + 0x10ee8ec]
xor cl, 0xc5
mov byte [eax + 0x10eeaec], cl
inc eax
cmp eax, 0x19
jb 0x103696f
mov eax, 0x10eeaec
ret
Function at 0x103698a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3db0], 1
jne 0x1036a26
or dword [0x10f3db0], 1
mov dword [0x10ee908], 0x95b1a082
mov dword [0x10ee90c], 0x84a6aab7
mov dword [0x10ee910], 0xa0b7a1a1
mov dword [0x10ee914], 0xa3e5b6b6
mov dword [0x10ee918], 0xa0a9aca4
mov dword [0x10ee91c], 0x82ede5a1
mov dword [0x10ee920], 0xb795b1a0
mov dword [0x10ee924], 0xb6a0a6aa
mov dword [0x10ee928], 0xa4a88cb6
mov dword [0x10ee92c], 0xac83a0a2
mov dword [0x10ee930], 0xa48ba0a9
mov dword [0x10ee934], 0xec84a0a8
mov word [0x10ee938], 0xe5ff
mov byte [0x10ee93a], 0xc5
xor eax, eax
mov cl, byte [eax + 0x10ee908]
xor cl, 0xc5
mov byte [eax + 0x10eeb08], cl
inc eax
cmp eax, 0x33
jb 0x1036a28
mov eax, 0x10eeb08
ret

Function at 0x1036a43
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3dac], 1
jne 0x1036aaa
or dword [0x10f3dac], 1
mov dword [0x10ee93c], 0x95b1a082
mov dword [0x10ee940], 0xa0a6aab7
mov dword [0x10ee944], 0xa88cb6b6
mov dword [0x10ee948], 0x83a0a2a4
mov dword [0x10ee94c], 0xaba0a9ac
mov dword [0x10ee950], 0xe5a0a8a4
mov dword [0x10ee954], 0xa9aca4a3
mov dword [0x10ee958], 0xe5ffa1a0
mov byte [0x10ee95c], 0xc5
xor eax, eax
mov cl, byte [eax + 0x10ee93c]
xor cl, 0xc5
mov byte [eax + 0x10eeb3c], cl
inc eax
cmp eax, 0x21
jb 0x1036aac
mov eax, 0x10eeb3c
ret

Function at 0x1037623
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3da8], 1
jne 0x1037809
or dword [0x10f3da8], 1
mov dword [0x10eeb68], 0xb5e8a9af
mov dword [0x10eeb6c], 0xb3a9a2b2
mov dword [0x10eeb70], 0xa3b5fcb2
mov dword [0x10eeb74], 0xb3a4b0b2
mov dword [0x10eeb78], 0xa8e1eea0
mov dword [0x10eeb7c], 0xccefe1a9
mov dword [0x10eeb80], 0xada5a7b6
mov dword [0x10eeb84], 0xe8a3a1a7
mov dword [0x10eeb88], 0xaeb2a7b6
mov dword [0x10eeb8c], 0xe1e6fbe6
mov dword [0x10eeb90], 0xa3b4cce1
mov dword [0x10eeb94], 0xb4afb3b7
mov dword [0x10eeb98], 0xb5e1eea3
mov dword [0x10eeb9c], 0xa5afb4b2
mov dword [0x10eeba0], 0xccefe1b2
mov dword [0x10eeba4], 0xa7a5a9aa
mov dword [0x10eeba8], 0xeab5e6aa
mov dword [0x10eebac], 0xfbe6b4e6
mov dword [0x10eebb0], 0xa5b6bee6
mov dword [0x10eebb4], 0xeeaaaaa7
mov dword [0x10eebb8], 0xa5a8b3a0
mov dword [0x10eebbc], 0xa8a9afb2
mov dword [0x10eebc0], 0xb4e6efee
mov dword [0x10eebc4], 0xb4b3b2a3
mov dword [0x10eebc8], 0xa3b4e6a8
mov dword [0x10eebcc], 0xb4afb3b7
mov dword [0x10eebd0], 0xe3e1eea3
mov dword [0x10eebd4], 0xe8efe18b
mov dword [0x10eebd8], 0xa8afa7ab
mov dword [0x10eebdc], 0xa79999ee
mov dword [0x10eebe0], 0xefb5a1b4
mov dword [0x10eebe4], 0xa2a8a3e6
mov dword [0x10eebe8], 0xa3a2e6ea
mov dword [0x10eebec], 0xe8a1b3a4
mov dword [0x10eebf0], 0xa5a7b4b2
mov dword [0x10eebf4], 0xa5a7a4a3
mov dword [0x10eebf8], 0xafccefad
mov dword [0x10eebfc], 0xa9a8e6a0
mov dword [0x10eec00], 0xe6b5e6b2
mov dword [0x10eec04], 0xa8a3aeb2
mov dword [0x10eec08], 0xb4b4a3e6
mov dword [0x10eec0c], 0xb4eeb4a9
mov dword [0x10eec10], 0xa8a3e6ef
mov dword [0x10eec14], 0xa3b4cca2
mov dword [0x10eec18], 0xa8b4b3b2
mov word [0x10eec1c], 0xb4e6
mov byte [0x10eec1e], 0xc6
xor eax, eax
mov cl, byte [eax + 0x10eeb68]
xor cl, 0xc6
mov byte [eax + 0x10ef160], cl
inc eax
cmp eax, 0xb7
jb 0x103780b
mov eax, 0x10ef160
ret