joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10060710
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [ebx]
mov edi, dword [ebp + 0x10]
cmp edi, 7
ja case.default.0x10060726
jmp dword [edi*4 + 0x100608bc]
mov ecx, esi
and ecx, 3
sub edi, ecx
sub ecx, 1
je 0x10060769
sub ecx, 1
je 0x10060756
sub ecx, 1
jne 0x1006077c
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1016c9d0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1016c9d0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1016c9d0]
inc esi
mov edx, edi
sar edx, 3
test edx, edx
je 0x100607fe
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1016c9d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1016c9d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1016c9d0]
mov ecx, eax
movzx eax, cl
shr ecx, 8
mov eax, dword [eax*4 + 0x1016c9d0]
xor eax, dword [esi + 4]
add esi, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1016c9d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1016c9d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1016c9d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1016c9d0]
sub edx, 1
jne 0x10060785
and edi, 7
jmp 0x10060721
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1016c9d0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1016c9d0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1016c9d0]
inc esi
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
pop edi
pop esi
xor eax, dword [ecx*4 + 0x1016c9d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1016c9d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1016c9d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1016c9d0]
mov dword [ebx], eax
pop ebx
pop ebp
ret
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1016c9d0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1016c9d0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1016c9d0]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret
Function at 0x1006083f
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [ebx]
mov edi, dword [ebp + 0x10]
cmp edi, 7
ja case.default.0x10060726
jmp dword [edi*4 + 0x100608bc]
mov ecx, esi
and ecx, 3
sub edi, ecx
sub ecx, 1
je 0x10060769
sub ecx, 1
je 0x10060756
sub ecx, 1
jne 0x1006077c
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1016c9d0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1016c9d0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1016c9d0]
inc esi
mov edx, edi
sar edx, 3
test edx, edx
je 0x100607fe
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1016c9d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1016c9d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1016c9d0]
mov ecx, eax
movzx eax, cl
shr ecx, 8
mov eax, dword [eax*4 + 0x1016c9d0]
xor eax, dword [esi + 4]
add esi, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1016c9d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1016c9d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1016c9d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1016c9d0]
sub edx, 1
jne 0x10060785
and edi, 7
jmp 0x10060721
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1016c9d0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1016c9d0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1016c9d0]
inc esi
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
pop edi
pop esi
xor eax, dword [ecx*4 + 0x1016c9d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1016c9d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1016c9d0]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1016c9d0]
mov dword [ebx], eax
pop ebx
pop ebp
ret
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1016c9d0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1016c9d0]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1016c9d0]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret

Function at 0x10060bb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
jmp fcn.10060eb0
Function at 0x10060e30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x200
mov esi, ecx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
push 4
call fcn.10102cea
add esp, 0x10
test eax, eax
je 0x10060e58
mov dword [eax], esi
jmp 0x10060e5a
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x10060b70
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 8], eax
test eax, eax
je 0x10060e96
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x10060ea4
push ecx
push eax
call sub.MSVCP140.dll__Thrd_detach
add esp, 8
test eax, eax
jne 0x10060ea4
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 4], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x10064380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1024b8c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1024d074]
test eax, eax
jne 0x100644b8
push ebx
push esi
cmp byte [0x10238698], al
je 0x10064404
cmp byte [0x10238699], al
jne 0x10064448
mov byte [0x10238699], 1
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102386ac]
xor ebx, dword [0x102386a8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 0x24], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1023869a], al
inc esi
cmp esi, 0xc
jb 0x100643c0
jmp 0x10064448
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102386ac]
xor ebx, dword [0x102386a8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 0x24], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1023869a], al
inc esi
cmp esi, 0xc
jb 0x10064406
lea eax, [ebp - 0x1d]
push eax
push 0x102386a5
push 0x1023869a
lea ecx, [ebp - 0x1c]
call fcn.1004f960
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
cmova eax, dword [ebp - 0x1c]
push eax
push dword [0x1024d0cc]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [0x1024d074], eax
pop esi
pop ebx
cmp ecx, 0xf
jbe 0x100644b8
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100644a9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100644a9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10102d1a
mov eax, dword [0x1024d074]
add esp, 8
movss xmm0, dword [ebp + 0xc]
sub esp, 8
mov dword [ebp - 0x24], eax
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp + 8]
movss dword [esp], xmm0
call dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
call fcn.10103042
mov esp, ebp
pop ebp
ret
Function at 0x10064ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10064f07
cmp byte [esi + 1], 0
jne 0x10064f4c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1a
jb 0x10064ec6
jmp 0x10064f4c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1a
jb 0x10064f10
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x1b]
push eax
push edi
call fcn.1004f960
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10064f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10064fd7
cmp byte [esi + 1], 0
jne 0x1006501c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1e
jb 0x10064f96
jmp 0x1006501c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1e
jb 0x10064fe0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x1f]
push eax
push edi
call fcn.1004f960
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10065040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100650a7
cmp byte [esi + 1], 0
jne 0x100650ec
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1f
jb 0x10065066
jmp 0x100650ec
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1f
jb 0x100650b0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x20]
push eax
push edi
call fcn.1004f960
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10065110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10065177
cmp byte [esi + 1], 0
jne 0x100651bc
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x20
jb 0x10065136
jmp 0x100651bc
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x20
jb 0x10065180
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x21]
push eax
push edi
call fcn.1004f960
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100651e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10065247
cmp byte [esi + 1], 0
jne 0x1006528c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x21
jb 0x10065206
jmp 0x1006528c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x21
jb 0x10065250
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x22]
push eax
push edi
call fcn.1004f960
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100652b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10065317
cmp byte [esi + 1], 0
jne 0x1006535c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x22
jb 0x100652d6
jmp 0x1006535c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x22
jb 0x10065320
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x23]
push eax
push edi
call fcn.1004f960
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10065380
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100653e7
cmp byte [esi + 1], 0
jne 0x1006542c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x23
jb 0x100653a6
jmp 0x1006542c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x23
jb 0x100653f0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x24]
push eax
push edi
call fcn.1004f960
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10065450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100654b7
cmp byte [esi + 1], 0
jne 0x100654fc
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x25
jb 0x10065476
jmp 0x100654fc
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x25
jb 0x100654c0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x26]
push eax
push edi
call fcn.1004f960
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10065520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10065587
cmp byte [esi + 1], 0
jne 0x100655cc
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x26
jb 0x10065546
jmp 0x100655cc
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x26
jb 0x10065590
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x27]
push eax
push edi
call fcn.1004f960
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100655f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10065657
cmp byte [esi + 1], 0
jne 0x1006569c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x27
jb 0x10065616
jmp 0x1006569c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x27
jb 0x10065660
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x28]
push eax
push edi
call fcn.1004f960
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100656c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10065727
cmp byte [esi + 1], 0
jne 0x1006576c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x28
jb 0x100656e6
jmp 0x1006576c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x28
jb 0x10065730
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x29]
push eax
push edi
call fcn.1004f960
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10065790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100657f7
cmp byte [esi + 1], 0
jne 0x1006583c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x29
jb 0x100657b6
jmp 0x1006583c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x29
jb 0x10065800
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x2a]
push eax
push edi
call fcn.1004f960
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4