joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e0570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104abf00], 0
push esi
jne 0x100e05d0
mov byte [0x104abf00], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104abf1c]
xor ebx, dword [0x104abf18]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + str.c6T_nI], cl
inc eax
cmp eax, 0x10
jb 0x100e0590
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104abf10
push str.c6T_nI
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100e05f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104abc30], 0
push esi
jne 0x100e0650
mov byte [0x104abc30], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104abc44]
xor ebx, dword [0x104abc40]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104abc31], cl
inc eax
cmp eax, 0xe
jb 0x100e0610
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104abc3e
push 0x104abc31
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100e0670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104ac3e0], 0
push esi
jne 0x100e06d0
mov byte [0x104ac3e0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104ac3f4]
xor ebx, dword [0x104ac3f0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104ac3e1], cl
inc eax
cmp eax, 0xd
jb 0x100e0690
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104ac3ed
push 0x104ac3e1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100e06f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104ab200], 0
push esi
jne 0x100e0750
mov byte [0x104ab200], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104ab214]
xor ebx, dword [0x104ab210]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104ab201], cl
inc eax
cmp eax, 0xd
jb 0x100e0710
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104ab20d
push 0x104ab201
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100e0770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104ab590], 0
push esi
jne 0x100e07d0
mov byte [0x104ab590], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104ab5a4]
xor ebx, dword [0x104ab5a0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104ab591], cl
inc eax
cmp eax, 0xd
jb 0x100e0790
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104ab59d
push 0x104ab591
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100e07f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104a9c50], 0
push esi
jne 0x100e0850
mov byte [0x104a9c50], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104a9c64]
xor ebx, dword [0x104a9c60]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104a9c51], cl
inc eax
cmp eax, 0xd
jb 0x100e0810
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104a9c5d
push 0x104a9c51
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100e0870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104a9500], 0
push esi
jne 0x100e08d0
mov byte [0x104a9500], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104a9514]
xor ebx, dword [0x104a9510]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104a9501], cl
inc eax
cmp eax, 0xd
jb 0x100e0890
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104a950d
push 0x104a9501
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100e08f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104a9d80], 0
push esi
jne 0x100e0950
mov byte [0x104a9d80], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104a9d94]
xor ebx, dword [0x104a9d90]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104a9d81], cl
inc eax
cmp eax, 0xd
jb 0x100e0910
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104a9d8d
push 0x104a9d81
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100e0970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104a9a90], 0
push esi
jne 0x100e09d0
mov byte [0x104a9a90], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104a9aa4]
xor ebx, dword [0x104a9aa0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + str..L], cl
inc eax
cmp eax, 0xc
jb 0x100e0990
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104a9a9c
push str..L
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100e09f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104aad40], 0
push esi
jne 0x100e0a50
mov byte [0x104aad40], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104aad54]
xor ebx, dword [0x104aad50]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104aad41], cl
inc eax
cmp eax, 0xb
jb 0x100e0a10
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104aad4b
push 0x104aad41
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100e0a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104aa350], 0
push esi
jne 0x100e0ad0
mov byte [0x104aa350], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104aa364]
xor ebx, dword [0x104aa360]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104aa351], cl
inc eax
cmp eax, 0xd
jb 0x100e0a90
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104aa35d
push 0x104aa351
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100e0af0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104aa370], 0
push esi
jne 0x100e0b50
mov byte [0x104aa370], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104aa384]
xor ebx, dword [0x104aa380]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104aa371], cl
inc eax
cmp eax, 0xb
jb 0x100e0b10
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104aa37b
push 0x104aa371
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100e0b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104ac370], 0
push esi
jne 0x100e0bd0
mov byte [0x104ac370], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104ac384]
xor ebx, dword [0x104ac380]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + str.w__], cl
inc eax
cmp eax, 0xe
jb 0x100e0b90
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104ac37e
push str.w__
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100e0da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104abcd0], 0
push esi
jne 0x100e0e00
mov byte [0x104abcd0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104abce4]
xor ebx, dword [0x104abce0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104abcd1], cl
inc eax
cmp eax, 0xf
jb 0x100e0dc0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104abcdf
push 0x104abcd1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100e1060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104aa660], 0
push esi
jne 0x100e10c0
mov byte [0x104aa660], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104aa674]
xor ebx, dword [0x104aa670]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104aa661], cl
inc eax
cmp eax, 0xf
jb 0x100e1080
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104aa66f
push 0x104aa661
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100e10e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104abb40], 0
push esi
jne 0x100e1140
mov byte [0x104abb40], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104abb5c]
xor ebx, dword [0x104abb58]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104abb41], cl
inc eax
cmp eax, 0x15
jb 0x100e1100
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104abb55
push 0x104abb41
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100e1160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104abae0], 0
push esi
jne 0x100e11c0
mov byte [0x104abae0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104abaf4]
xor ebx, dword [0x104abaf0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104abae1], cl
inc eax
cmp eax, 0xc
jb 0x100e1180
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104abaec
push 0x104abae1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100e11e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104ac140], 0
push esi
jne 0x100e1240
mov byte [0x104ac140], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104ac154]
xor ebx, dword [0x104ac150]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104ac141], cl
inc eax
cmp eax, 0xb
jb 0x100e1200
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104ac14b
push 0x104ac141
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100e1260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104a9b30], 0
push esi
jne 0x100e12c0
mov byte [0x104a9b30], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104a9b44]
xor ebx, dword [0x104a9b40]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104a9b31], cl
inc eax
cmp eax, 0xf
jb 0x100e1280
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104a9b3f
push 0x104a9b31
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100e12e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104aa030], 0
push esi
jne 0x100e1340
mov byte [0x104aa030], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104aa044]
xor ebx, dword [0x104aa040]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104aa031], cl
inc eax
cmp eax, 0xb
jb 0x100e1300
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104aa03b
push 0x104aa031
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100e1360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1031c8c1
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x44], ebx
mov eax, dword fs:[0x2c]
mov edx, dword [0x104c14e0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x106118f4]
cmp eax, dword [edx + 4]
jg 0x100e13cf
mov eax, dword [0x10611984]
add eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
ret
push 0x106118f4
call fcn.102bba07
add esp, 4
cmp dword [0x106118f4], 0xffffffff
jne 0x100e13ac
mov dword [ebp - 4], 0
cmp byte [0x104abf40], 0
jne 0x100e1459
mov byte [0x104abf40], 1
xor esi, esi
jmp 0x100e1400
xor edx, edx
mov ebx, esi
xor edx, dword [0x104abf54]
xor ebx, dword [0x104abf50]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104abf41]
xor cl, bl
mov byte [esi + 0x104abf41], cl
inc esi
cmp esi, 0xd
jb 0x100e1400
jmp 0x100e1459
push ecx
push 0x104abf4d
push 0x104abf41
lea ecx, [ebp - 0x40]
call fcn.1001a620
mov byte [ebp - 4], 1
lea edi, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae edi, dword [ebp - 0x40]
cmp byte [0x104ab9e0], 0
jne 0x100e14e9
mov byte [0x104ab9e0], 1
xor esi, esi
jmp 0x100e1490
xor edx, edx
mov ebx, esi
xor edx, dword [0x104ab9fc]
xor ebx, dword [0x104ab9f8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104ab9e1]
xor cl, bl
mov byte [esi + 0x104ab9e1], cl
inc esi
cmp esi, 0x11
jb 0x100e1490
jmp 0x100e14e9
push ecx
push 0x104ab9f1
push 0x104ab9e1
lea ecx, [ebp - 0x28]
call fcn.1001a620
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push 0
cmovae eax, dword [ebp - 0x28]
push edi
push eax
call fcn.10171b70
lea ecx, [ebp - 0x28]
mov dword [0x10611984], eax
call fcn.10019dd0
lea ecx, [ebp - 0x40]
call fcn.10019dd0
push 0x106118f4
call fcn.102bb9b6
mov eax, dword [0x10611984]
add esp, 4
add eax, dword [ebp - 0x44]
jmp 0x100e13b3
Function at 0x100e1550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1031c911
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x44], ebx
mov eax, dword fs:[0x2c]
mov edx, dword [0x104c14e0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x1061196c]
cmp eax, dword [edx + 4]
jg 0x100e15bf
mov eax, dword [0x106119e0]
add eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
ret
push 0x1061196c
call fcn.102bba07
add esp, 4
cmp dword [0x1061196c], 0xffffffff
jne 0x100e159c
mov dword [ebp - 4], 0
cmp byte [0x104aafe0], 0
jne 0x100e1649
mov byte [0x104aafe0], 1
xor esi, esi
jmp 0x100e15f0
xor edx, edx
mov ebx, esi
xor edx, dword [0x104aaff4]
xor ebx, dword [0x104aaff0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104aafe1]
xor cl, bl
mov byte [esi + 0x104aafe1], cl
inc esi
cmp esi, 0xc
jb 0x100e15f0
jmp 0x100e1649
push ecx
push 0x104aafec
push 0x104aafe1
lea ecx, [ebp - 0x40]
call fcn.1001a620
mov byte [ebp - 4], 1
lea edi, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae edi, dword [ebp - 0x40]
cmp byte [0x104ab760], 0
jne 0x100e16d9
mov byte [0x104ab760], 1
xor esi, esi
jmp 0x100e1680
xor edx, edx
mov ebx, esi
xor edx, dword [0x104ab77c]
xor ebx, dword [0x104ab778]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104ab761]
xor cl, bl
mov byte [esi + 0x104ab761], cl
inc esi
cmp esi, 0x11
jb 0x100e1680
jmp 0x100e16d9
push ecx
push 0x104ab771
push 0x104ab761
lea ecx, [ebp - 0x28]
call fcn.1001a620
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push 0
cmovae eax, dword [ebp - 0x28]
push edi
push eax
call fcn.10171b70
lea ecx, [ebp - 0x28]
mov dword [0x106119e0], eax
call fcn.10019dd0
lea ecx, [ebp - 0x40]
call fcn.10019dd0
push 0x1061196c
call fcn.102bb9b6
mov eax, dword [0x106119e0]
add esp, 4
add eax, dword [ebp - 0x44]
jmp 0x100e15a3
Function at 0x100e1b80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1031c9b1
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x44], ebx
mov eax, dword fs:[0x2c]
mov edx, dword [0x104c14e0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x10611820]
cmp eax, dword [edx + 4]
jg 0x100e1bef
mov eax, dword [0x106117b4]
add eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
ret
push 0x10611820
call fcn.102bba07
add esp, 4
cmp dword [0x10611820], 0xffffffff
jne 0x100e1bcc
mov dword [ebp - 4], 0
cmp byte [0x104ab3a0], 0
jne 0x100e1c79
mov byte [0x104ab3a0], 1
xor esi, esi
jmp 0x100e1c20
xor edx, edx
mov ebx, esi
xor edx, dword [0x104ab3bc]
xor ebx, dword [0x104ab3b8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104ab3a1]
xor cl, bl
mov byte [esi + 0x104ab3a1], cl
inc esi
cmp esi, 0x11
jb 0x100e1c20
jmp 0x100e1c79
push ecx
push 0x104ab3b1
push 0x104ab3a1
lea ecx, [ebp - 0x40]
call fcn.1001a620
mov byte [ebp - 4], 1
lea edi, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae edi, dword [ebp - 0x40]
cmp byte [0x104aaef0], 0
jne 0x100e1d09
mov byte [0x104aaef0], 1
xor esi, esi
jmp 0x100e1cb0
xor edx, edx
mov ebx, esi
xor edx, dword [0x104aaf0c]
xor ebx, dword [0x104aaf08]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104aaef1]
xor cl, bl
mov byte [esi + 0x104aaef1], cl
inc esi
cmp esi, 0x11
jb 0x100e1cb0
jmp 0x100e1d09
push ecx
push 0x104aaf01
push 0x104aaef1
lea ecx, [ebp - 0x28]
call fcn.1001a620
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push 0
cmovae eax, dword [ebp - 0x28]
push edi
push eax
call fcn.10171b70
lea ecx, [ebp - 0x28]
mov dword [0x106117b4], eax
call fcn.10019dd0
lea ecx, [ebp - 0x40]
call fcn.10019dd0
push 0x10611820
call fcn.102bb9b6
mov eax, dword [0x106117b4]
add esp, 4
add eax, dword [ebp - 0x44]
jmp 0x100e1bd3
Function at 0x100e1d70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1031ca01
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x44], ebx
mov eax, dword fs:[0x2c]
mov edx, dword [0x104c14e0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x10611788]
cmp eax, dword [edx + 4]
jg 0x100e1ddf
mov eax, dword [0x10611a84]
add eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
ret
push 0x10611788
call fcn.102bba07
add esp, 4
cmp dword [0x10611788], 0xffffffff
jne 0x100e1dbc
mov dword [ebp - 4], 0
cmp byte [0x104a9c90], 0
jne 0x100e1e69
mov byte [0x104a9c90], 1
xor esi, esi
jmp 0x100e1e10
xor edx, edx
mov ebx, esi
xor edx, dword [0x104a9cac]
xor ebx, dword [0x104a9ca8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104a9c91]
xor cl, bl
mov byte [esi + 0x104a9c91], cl
inc esi
cmp esi, 0x13
jb 0x100e1e10
jmp 0x100e1e69
push ecx
push 0x104a9ca3
push 0x104a9c91
lea ecx, [ebp - 0x40]
call fcn.1001a620
mov byte [ebp - 4], 1
lea edi, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae edi, dword [ebp - 0x40]
cmp byte [0x104aa760], 0
jne 0x100e1ef9
mov byte [0x104aa760], 1
xor esi, esi
jmp 0x100e1ea0
xor edx, edx
mov ebx, esi
xor edx, dword [0x104aa77c]
xor ebx, dword [0x104aa778]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104aa761]
xor cl, bl
mov byte [esi + 0x104aa761], cl
inc esi
cmp esi, 0x11
jb 0x100e1ea0
jmp 0x100e1ef9
push ecx
push 0x104aa771
push 0x104aa761
lea ecx, [ebp - 0x28]
call fcn.1001a620
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push 0
cmovae eax, dword [ebp - 0x28]
push edi
push eax
call fcn.10171b70
lea ecx, [ebp - 0x28]
mov dword [0x10611a84], eax
call fcn.10019dd0
lea ecx, [ebp - 0x40]
call fcn.10019dd0
push 0x10611788
call fcn.102bb9b6
mov eax, dword [0x10611a84]
add esp, 4
add eax, dword [ebp - 0x44]
jmp 0x100e1dc3