joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10067320
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10280448], 0
push ebx
push esi
je 0x10067391
cmp byte [0x10280449], 0
jne 0x100673d2
mov byte [0x10280449], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10280494]
xor ebx, dword [0x10280490]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1028044a], al
inc esi
cmp esi, 0x43
jb 0x10067350
jmp 0x100673d2
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10280494]
xor ebx, dword [0x10280490]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1028044a], al
inc esi
cmp esi, 0x43
jb 0x10067393
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x1028048c
push 0x1028044a
call fcn.1004f490
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10067400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10280498], 0
push ebx
push esi
je 0x10067471
cmp byte [0x10280499], 0
jne 0x100674b2
mov byte [0x10280499], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102804dc]
xor ebx, dword [0x102804d8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1028049a], al
inc esi
cmp esi, 0x3b
jb 0x10067430
jmp 0x100674b2
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102804dc]
xor ebx, dword [0x102804d8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1028049a], al
inc esi
cmp esi, 0x3b
jb 0x10067473
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x102804d4
push 0x1028049a
call fcn.1004f490
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100674e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10280560], 0
push ebx
push esi
je 0x10067551
cmp byte [0x10280561], 0
jne 0x10067592
mov byte [0x10280561], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102805b4]
xor ebx, dword [0x102805b0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10280562], al
inc esi
cmp esi, 0x4d
jb 0x10067510
jmp 0x10067592
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102805b4]
xor ebx, dword [0x102805b0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10280562], al
inc esi
cmp esi, 0x4d
jb 0x10067553
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x102805ae
push 0x10280562
call fcn.1004f490
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100675c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x102805e8], 0
push ebx
push esi
je 0x10067631
cmp byte [0x102805e9], 0
jne 0x10067672
mov byte [0x102805e9], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10280604]
xor ebx, dword [0x10280600]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102805ea], al
inc esi
cmp esi, 0xf
jb 0x100675f0
jmp 0x10067672
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10280604]
xor ebx, dword [0x10280600]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102805ea], al
inc esi
cmp esi, 0xf
jb 0x10067633
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x102805f8
push 0x102805ea
call fcn.1004f490
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100676a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10280820], 0
push ebx
push esi
je 0x10067711
cmp byte [0x10280821], 0
jne 0x10067752
mov byte [0x10280821], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1028087c]
xor ebx, dword [0x10280878]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10280822], al
inc esi
cmp esi, 0x50
jb 0x100676d0
jmp 0x10067752
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1028087c]
xor ebx, dword [0x10280878]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10280822], al
inc esi
cmp esi, 0x50
jb 0x10067713
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10280871
push 0x10280822
call fcn.1004f490
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10067780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10280978], 0
push ebx
push esi
je 0x100677f1
cmp byte [0x10280979], 0
jne 0x10067832
mov byte [0x10280979], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102809c4]
xor ebx, dword [0x102809c0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1028097a], al
inc esi
cmp esi, 0x42
jb 0x100677b0
jmp 0x10067832
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102809c4]
xor ebx, dword [0x102809c0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1028097a], al
inc esi
cmp esi, 0x42
jb 0x100677f3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x102809bb
push 0x1028097a
call fcn.1004f490
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10067860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10280a48], 0
push ebx
push esi
je 0x100678d1
cmp byte [0x10280a49], 0
jne 0x10067912
mov byte [0x10280a49], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10280a9c]
xor ebx, dword [0x10280a98]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10280a4a], al
inc esi
cmp esi, 0x49
jb 0x10067890
jmp 0x10067912
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10280a9c]
xor ebx, dword [0x10280a98]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10280a4a], al
inc esi
cmp esi, 0x49
jb 0x100678d3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10280a92
push 0x10280a4a
call fcn.1004f490
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10067940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10280b70], 0
push ebx
push esi
je 0x100679b1
cmp byte [0x10280b71], 0
jne 0x100679f2
mov byte [0x10280b71], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10280bc4]
xor ebx, dword [0x10280bc0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10280b72], al
inc esi
cmp esi, 0x4a
jb 0x10067970
jmp 0x100679f2
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10280bc4]
xor ebx, dword [0x10280bc0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10280b72], al
inc esi
cmp esi, 0x4a
jb 0x100679b3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10280bbb
push 0x10280b72
call fcn.1004f490
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10067a20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10280cb8], 0
push ebx
push esi
je 0x10067a91
cmp byte [0x10280cb9], 0
jne 0x10067ad2
mov byte [0x10280cb9], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10280d04]
xor ebx, dword [0x10280d00]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10280cba], al
inc esi
cmp esi, 0x45
jb 0x10067a50
jmp 0x10067ad2
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10280d04]
xor ebx, dword [0x10280d00]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10280cba], al
inc esi
cmp esi, 0x45
jb 0x10067a93
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10280cfe
push 0x10280cba
call fcn.1004f490
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10067b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1027fbf0], 0
push ebx
push esi
je 0x10067b74
cmp byte [0x1027fbf1], 0
jne 0x10067bb8
mov byte [0x1027fbf1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1027fd34]
xor ebx, dword [0x1027fd30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1027fbf2], al
inc esi
cmp esi, 0x137
jb 0x10067b30
jmp 0x10067bb8
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1027fd34]
xor ebx, dword [0x1027fd30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1027fbf2], al
inc esi
cmp esi, 0x137
jb 0x10067b76
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x1027fd28
push 0x1027fbf2
call fcn.1004f490
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10067be0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10280db8], 0
push ebx
push esi
je 0x10067c51
cmp byte [0x10280db9], 0
jne 0x10067c92
mov byte [0x10280db9], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10280dfc]
xor ebx, dword [0x10280df8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10280dba], al
inc esi
cmp esi, 0x3a
jb 0x10067c10
jmp 0x10067c92
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10280dfc]
xor ebx, dword [0x10280df8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10280dba], al
inc esi
cmp esi, 0x3a
jb 0x10067c53
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10280df3
push 0x10280dba
call fcn.1004f490
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10067cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1027f9d0], 0
push ebx
push esi
je 0x10067d31
cmp byte [0x1027f9d1], 0
jne 0x10067d72
mov byte [0x1027f9d1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1027f9ec]
xor ebx, dword [0x1027f9e8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1027f9d2], al
inc esi
cmp esi, 0x10
jb 0x10067cf0
jmp 0x10067d72
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1027f9ec]
xor ebx, dword [0x1027f9e8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1027f9d2], al
inc esi
cmp esi, 0x10
jb 0x10067d33
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x1027f9e1
push 0x1027f9d2
call fcn.1004f490
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10067da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1027f9f0], 0
push ebx
push esi
je 0x10067e11
cmp byte [0x1027f9f1], 0
jne 0x10067e52
mov byte [0x1027f9f1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1027fa04]
xor ebx, dword [0x1027fa00]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1027f9f2], al
inc esi
cmp esi, 0xc
jb 0x10067dd0
jmp 0x10067e52
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1027fa04]
xor ebx, dword [0x1027fa00]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1027f9f2], al
inc esi
cmp esi, 0xc
jb 0x10067e13
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x1027f9fd
push 0x1027f9f2
call fcn.1004f490
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1006b8c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1029e280]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x102822a0], 0
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ebx
je 0x1006b942
cmp byte [0x102822a1], 0
jne 0x1006b986
mov byte [0x102822a1], 1
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102822bc]
xor ebx, dword [0x102822b8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102822a2], al
inc esi
cmp esi, 0x10
jb 0x1006b901
jmp 0x1006b983
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102822bc]
xor ebx, dword [0x102822b8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102822a2], al
inc esi
cmp esi, 0x10
jb 0x1006b944
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x1d]
push eax
push 0x102822b1
push 0x102822a2
lea ecx, [ebp - 0x1c]
call fcn.1004f490
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
cmova eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov esi, eax
cmp ecx, 0xf
jbe 0x1006b9e9
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1006b9df
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1006b9df
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.101169da
add esp, 8
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
test esi, esi
jne 0x1006ba03
mov dword [edi], esi
jmp 0x1006ba15
cmp dword [ebx + 0x14], 0xf
jbe 0x1006ba0b
mov ebx, dword [ebx]
push 0
push ebx
call esi
add esp, 8
mov dword [edi], eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10116d02
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10072fa0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret 4
Function at 0x10073650
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 8
call fcn.101169aa
add esp, 4
test eax, eax
je 0x10073672
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
jmp 0x10073674
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
push edi
lea edi, [esi + 4]
push edi
push 0
push eax
push 0x10073390
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x1007369c
pop edi
pop esi
pop ebp
ret
push 6
mov dword [edi], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x10077270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10285db0], 0
push ebx
push esi
je 0x100772e1
cmp byte [0x10285db1], 0
jne 0x10077322
mov byte [0x10285db1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10285de4]
xor ebx, dword [0x10285de0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10285db2], al
inc esi
cmp esi, 0x28
jb 0x100772a0
jmp 0x10077322
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10285de4]
xor ebx, dword [0x10285de0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10285db2], al
inc esi
cmp esi, 0x28
jb 0x100772e3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10285dd9
push 0x10285db2
call fcn.1004f490
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10077370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10285e60], 0
push ebx
push esi
je 0x100773e4
cmp byte [0x10285e61], 0
jne 0x10077428
mov byte [0x10285e61], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10285f0c]
xor ebx, dword [0x10285f08]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10285e62], al
inc esi
cmp esi, 0x9f
jb 0x100773a0
jmp 0x10077428
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10285f0c]
xor ebx, dword [0x10285f08]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10285e62], al
inc esi
cmp esi, 0x9f
jb 0x100773e6
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x10285f00
push 0x10285e62
call fcn.1004f490
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1007a770
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
push ebx
push esi
push edi
jne 0x1007a787
mov ecx, dword [0x102a01b0]
call fcn.10113e30
mov ecx, dword [0x102a01b0]
call fcn.10113e70
mov eax, dword [ebp + 8]
push 0x10078b30
push 1
mov dword [0x102a01b4], eax
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
jmp 0x1007a7b0
mov eax, dword [0x1027f7b8]
sub eax, dword [0x1027f7c0]
xor eax, dword [0x1027f7bc]
mov ecx, dword [ebp + 8]
push 0
push 0
push dword [ebp + 0x10]
mov dword [eax + 0x50], ecx
push 0x10078af0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1007a7e6
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x100833c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10083427
cmp byte [esi + 1], 0
jne 0x1008346c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x37
jb 0x100833e6
jmp 0x1008346c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x37
jb 0x10083430
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x38]
push eax
push edi
call fcn.1004f490
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10083660
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1029e280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x1008371c
cmp byte [esi + 0x3d], 0
je 0x1008371c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1008370a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x100836d1
sub eax, 1
je 0x100836d5
sub eax, 2
jne 0x1008370a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10116d02
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100836f3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1008370a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10116d02
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10116d02
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.10116d02
mov esp, ebp
pop ebp
ret
Function at 0x1008c3d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1029e280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push 0x102a32c0
push eax
call fcn.10082980
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
cmova eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, dword [ebp - 8]
add esp, 0x10
cmp ecx, 0xf
jbe 0x1008c43d
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1008c433
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1008c433
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.101169da
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10116d02
mov esp, ebp
pop ebp
ret