joyce8/EMBER2024-capa huggingface dataset:
Function at 0x108f5f6
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x638
mov eax, dword [0x13912f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x638], eax
lea eax, [ebp - 0x62c]
push eax
push 0x104
push esi
call fcn.0103f37c
mov edi, eax
test edi, edi
jl 0x108f7f5
push esi
mov ebx, 0x105
push ebx
lea eax, [ebp - 0x41c]
push eax
call fcn.0104574b
mov edi, eax
test edi, edi
jl 0x108f7f5
lea eax, [ebp - 0x62c]
push eax
push 1
push dword [ebp - 0x62c]
call fcn.0108dfd4
mov edi, eax
test edi, edi
jl 0x108f7f5
mov eax, dword [ebp - 0x62c]
lea eax, [ebp + eax*2 - 0x41c]
cmp word [eax], 0x5c
jne 0x108f689
xor ecx, ecx
mov word [eax], cx
and dword [ebp - 0x630], 0
xor eax, eax
cmp word [ebp - 0x41c], 0x5c
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x62c], eax
jne 0x108f6bb
lea eax, [ebp - 0x41a]
mov dword [ebp - 0x62c], eax
push 0x5c
push dword [ebp - 0x62c]
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
pop ecx
pop ecx
mov dword [ebp - 0x634], esi
lea eax, [ebp - 0x628]
test esi, esi
jne 0x108f700
push dword [ebp - 0x62c]
push ebx
push eax
call fcn.0104574b
mov edi, eax
test edi, edi
jl 0x108f7f5
mov dword [ebp - 0x630], 1
jmp 0x108f73c
sub esi, dword [ebp - 0x62c]
sar esi, 1
push esi
push dword [ebp - 0x62c]
push ebx
push eax
call fcn.0108e2fe
mov edi, eax
test edi, edi
jl 0x108f7f5
mov eax, dword [ebp - 0x62c]
cmp dword [ebp - 0x634], eax
jb 0x108f7dc
xor eax, eax
mov word [ebp + esi*2 - 0x628], ax
lea eax, [ebp - 0x628]
push eax
push ebx
lea eax, [ebp - 0x210]
push eax
call fcn.0108e34a
mov edi, eax
test edi, edi
jl 0x108f7f5
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea eax, [ebp - 0x210]
push eax
call esi
cmp eax, 0xffffffff
je 0x108f772
test al, 0x10
jne 0x108f7a2
mov eax, dword [ebp - 0x630]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x638]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x108f7e3
lea eax, [ebp - 0x210]
push eax
call esi
cmp eax, 0xffffffff
je 0x108f7e3
mov eax, dword [ebp - 0x634]
test eax, eax
je 0x108f7cd
add eax, 2
push 0x1002bbc
mov dword [ebp - 0x62c], eax
push ebx
lea eax, [ebp - 0x210]
push eax
call fcn.0108e34a
mov edi, eax
test edi, edi
jl 0x108f7f5
cmp dword [ebp - 0x630], 0
je 0x108f6bb
jmp 0x108f7f1
mov edi, 0x80070216
jmp 0x108f7f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
mov edi, eax
test edi, edi
jge 0x108f81a
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x108f81a
test byte [eax + 0x3c], 2
je 0x108f81a
push edi
push 0x1006358
push 0x1c
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0103e3fb
leave
ret 8
Function at 0x108ffbe
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
or dword [ebp - 4], 0xffffffff
push ebx
xor ebx, ebx
push edi
cmp dword [ebp + 8], ebx
jne 0x108ffd8
mov ebx, 0x80070057
jmp 0x109004c
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 4]
call fcn.0108dd07
cmp dword [ebp - 4], 0xffffffff
jne 0x1090012
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
mov ebx, eax
jmp 0x1090048
push dword [ebp - 4]
call fcn.0108dcb6
mov edi, dword [ebp + 0xc]
movzx eax, al
push 0
neg eax
lea ecx, [ebp + 8]
push ecx
sbb eax, eax
push edi
push dword [ebp + 0x10]
not eax
and eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1090002
cmp dword [ebp + 8], edi
je 0x1090071
mov ebx, 0x8000ffff
test ebx, ebx
jge 0x1090071
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x1090071
test byte [eax + 0x3c], 2
je 0x1090071
push ebx
push 0x1006358
push 0x33
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 4]
call fcn.0108dce8
pop edi
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x1090614
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
or dword [ebp - 4], 0xffffffff
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x44]
lea ecx, [ebp - 8]
push ecx
push eax
call fcn.0108f5b1
mov ebx, eax
test ebx, ebx
jl 0x10906b5
cmp dword [ebp - 8], 0
je 0x10906b1
mov esi, dword [esi + 0x44]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 4]
call fcn.0108dd07
cmp dword [ebp - 4], 0xffffffff
jne 0x1090678
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
mov ebx, eax
jmp 0x10906b1
push dword [ebp - 4]
call fcn.0108dcb6
movzx eax, al
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 4]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1090668
cmp dword [ebp - 0xc], 0
jl 0x10906b1
jg 0x10906ac
cmp dword [ebp - 0x10], 0x200000
jbe 0x10906b1
mov ebx, 0x8007000d
test ebx, ebx
jge 0x10906da
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x10906da
test byte [eax + 0x3c], 2
je 0x10906da
push ebx
push 0x10060f0
push 0x1c
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 4]
call fcn.0108dce8
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x10917ab
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
or dword [ebp - 8], 0xffffffff
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], ebx
jne 0x10917d3
mov dword [ebp - 4], 0x80070057
jmp 0x10918ab
cmp dword [ebp + 0xc], ebx
je 0x10917c7
cmp dword [ebp + 0x10], ebx
je 0x10917c7
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 8]
call fcn.0108dd07
cmp dword [ebp - 8], 0xffffffff
jne 0x1091819
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
mov dword [ebp - 4], eax
jmp 0x10918a6
push dword [ebp - 8]
call fcn.0108dcb6
mov byte [ebp + 0xb], al
cmp al, bl
je 0x109182c
xor eax, eax
jmp 0x109182f
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x1091805
cmp dword [ebp - 0x10], ebx
jne 0x10917c7
push esi
call fcn.0103e460
lea ecx, [ebp - 0xc]
mov edi, eax
call fcn.0108f529
cmp edi, ebx
jne 0x1091866
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], 0x8007000e
jmp 0x10918ab
mov dword [ebp - 0xc], edi
cmp byte [ebp + 0xb], bl
je 0x1091872
xor eax, eax
jmp 0x1091875
mov eax, dword [ebp - 8]
push ebx
lea ecx, [ebp - 0x14]
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1091805
cmp dword [ebp - 0x14], esi
je 0x1091899
mov dword [ebp - 4], 0x8000ffff
jmp 0x10918ab
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], ebx
mov dword [eax], edi
cmp dword [ebp - 4], ebx
jge 0x10918d2
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x10918d2
test byte [eax + 0x3c], 2
je 0x10918d2
push dword [ebp - 4]
push 0x1006358
push 0x32
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 0xc]
call fcn.0108f529
lea ecx, [ebp - 8]
call fcn.0108dce8
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1092554
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 8], 0x80000001
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
jne 0x1092575
mov dword [ebp - 0xc], esi
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01091091
mov edi, eax
cmp edi, esi
jl 0x10925b9
mov eax, dword [ebp - 4]
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 8], esi
push dword [ebp + 0x14]
push 3
push esi
push dword [ebp + 0x10]
mov dword [ebp + 8], esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call fcn.0103ecb3
mov edi, dword [ebp + 8]
cmp edi, esi
jge 0x10925de
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x10925de
test byte [eax + 0x3c], 2
je 0x10925de
push edi
push 0x1006398
push 0x24
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 8]
call fcn.0104596a
lea ecx, [ebp - 0xc]
call fcn.0103f528
lea ecx, [ebp - 4]
call fcn.0103f528
mov eax, edi
pop edi
pop esi
leave
ret 0x14

Function at 0x10928a5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push 1
xor edi, edi
push edi
push 0x1006950
push 0x80000002
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1092901
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push 0x1006938
push eax
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1092901
cmp dword [ebp - 0xc], 4
jne 0x1092901
cmp dword [ebp - 0x10], edi
je 0x1092901
inc edi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
mov dword [eax], edi
call fcn.0103f528
xor eax, eax
pop edi
leave
ret 4

Function at 0x1092915
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push edi
mov edi, dword [ebp + 8]
and dword [edi], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x10069e0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1092978
mov eax, dword [ebp - 4]
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x10069b4
push eax
mov dword [ebp + 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1092978
cmp dword [ebp - 8], 1
sete al
mov dword [edi], eax
lea ecx, [ebp - 4]
call fcn.0103f528
xor eax, eax
pop edi
leave
ret 4
Function at 0x1092987
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push edi
mov edi, dword [ebp + 8]
and dword [edi], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x10069e0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10929ea
mov eax, dword [ebp - 4]
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x10069fc
push eax
mov dword [ebp + 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10929ea
cmp dword [ebp - 8], 1
sete al
mov dword [edi], eax
lea ecx, [ebp - 4]
call fcn.0103f528
xor eax, eax
pop edi
leave
ret 4
Function at 0x1094bc2
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 8], 0x80000001
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
jne 0x1094be3
mov dword [ebp - 0xc], esi
lea eax, [ebp - 4]
push eax
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.010403ad
mov edi, eax
cmp edi, esi
jl 0x1094c28
mov eax, dword [ebp - 4]
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0x18]
lea ecx, [ebp + 0x14]
push ecx
push 4
push esi
push dword [ebp + 0x10]
mov dword [ebp - 8], esi
push eax
mov dword [ebp + 8], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call fcn.0103ecb3
mov edi, dword [ebp + 8]
cmp edi, esi
jge 0x1094c4d
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x1094c4d
test byte [eax + 0x3c], 2
je 0x1094c4d
push edi
push 0x1006398
push 0x24
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 8]
call fcn.0104596a
lea ecx, [ebp - 0xc]
call fcn.0103f528
lea ecx, [ebp - 4]
call fcn.0103f528
mov eax, edi
pop edi
pop esi
leave
ret 0x14
Function at 0x10b44b1
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 0x24], 0
push esi
mov esi, dword [ebp + 8]
push edi
push 8
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
xor edi, edi
test esi, esi
jne 0x10b4504
mov edi, 0x80070057
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x10b44fc
test byte [eax + 0x3c], 2
je 0x10b44fc
push edi
push 0x1007b00
push 0xa
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
mov eax, edi
pop edi
pop esi
leave
ret 4
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x24]
test eax, eax
je 0x10b4530
cmp eax, 6
je 0x10b452b
cmp eax, 9
je 0x10b4527
mov edi, 0x80004005
jmp 0x10b44d7
push 2
jmp 0x10b452d
push 3
pop eax
jmp 0x10b4533
xor eax, eax
inc eax
mov dword [esi], eax
jmp 0x10b44fc

Function at 0x10b4994
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x13912f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 0x10
pop ecx
mov esi, 0x1007c90
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
movsw word es:[edi], word [esi]
test eax, eax
jne 0x10b49c8
mov ebx, 0x80070057
jmp 0x10b49f8
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x10b49e6
cmp dword [ebp + 8], eax
jae 0x10b4a1d
mov ebx, 0x8007007a
jmp 0x10b49f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0103e996
mov ebx, eax
test ebx, ebx
jge 0x10b4a1d
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x10b4a1d
test byte [eax + 0x3c], 2
je 0x10b4a1d
push ebx
push 0x1007b00
push 0xb
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0103e3fb
leave
ret 8
Function at 0x10b97af
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x13912f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x18]
mov eax, dword [ebx + 0xc]
push esi
mov esi, dword [ebx + 8]
push edi
xor edi, edi
cmp esi, 7
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
jge 0x10b9d5e
cmp dword [ebx + 0x10], 7
jnp 0x10b980e
pop es
jge 0x10b9d5e
call fcn.0103bc4e
je 0x10b9849
loopne 0x10b97fc
in eax, dx
add dword [eax], eax
sal byte [eax + 0x3d], 0x36
loopne 0x10b9831
adc byte [eax], bl
sar byte [ebx], 1
iretd
add al, dl
call fcn.0103c38b
hlt
inc ebp
call 0x811298a6
jmp 0x10b9d6a
mov dword [ebp - 0x18], 0x80070057
cmp dword [ebp - 0x18], edi
jge 0x10b9da6
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x10b9da6
test byte [eax + 0x3c], 2
je 0x10b9da6
call fcn.0110c578
xor al, 0xbe
add byte ss:[ecx], dl
add byte [eax], al
add byte [eax], bh
mov esi, 0x94525036
or dword [eax - 1], edx
jne 0x10b9d7c
push 0x1007b40
push 0x14
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 0x1c]
call fcn.01045c00
lea ecx, [ebp - 0x20]
call fcn.01045b47
lea ecx, [ebp - 0x24]
call fcn.0104669e
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
pop edi
xor ecx, ebp
pop esi
call fcn.0103e3fb
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0x14
Function at 0x10c0493
Capabilities:
Encode data using xor

Disassembly:
pop esi
pop ebx
leave
ret 0xc
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
push ebx
push esi
jne 0x10c06d3
call fcn.012e6715
test al, 0xba
rcr byte ss:[esi], 0
mov al, byte [0x9009b627]
movsb byte es:[edi], byte [esi]
mov edx, 0x86e87036
mov bh, 0xf7
dec eax
sbb dword [esi], esi
sal byte [ebp - 0x3bc00000], 1
sbb dword [esi], esi
loopne 0x10c048d
xchg edx, eax
sub ah, byte [eax]
call fcn.01298d5a
fcom dword [0x264036]
add byte [eax + 0x703615d4], dl
bound edi, qword [edx + ebp + 0x6223e850]
and al, byte [eax]
test byte [ecx + 0x35], bh
inc eax
pop ss
add byte [eax], al
push eax
adc al, 0x62
xor eax, eax
cmp byte [ecx + 0x35], 0x90
call fcn.0103bc4e
and al, 0x76
xor eax, 0x3650
and byte [eax], 0x76
xor eax, 0x33778e40
add al, ch
stosd dword es:[edi], eax
mov edx, 0x6594fff7
xor eax, 0x1fbf0
add byte [eax - 0x1fcfca9b], bl
xor al, 0xe0
mov esi, 0x80070057
call fcn.010906e8
pop ds
mov al, 0x10
loopne 0x10c051f
invalid
push esp
and al, 0x54
and byte ss:[ecx], 0
add al, dl
call fcn.01347b48
int3
call fcn.0103bc4e
clc
invalid

Function at 0x10c0874
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0
push esi
jne 0x10c08b9
call fcn.012e6715
div byte fs:[0x1be0]
ror byte [ecx + 0x3b], 0x2c
nop
pushal
div byte [0xbcd9e820]
add al, 0
xor al, 0x65
xor eax, 0x610
mov al, byte [0x50356538]
arpl word [esp + esi + 0x40], ax
mov esi, 0x80070057
jmp 0x10c0a78
call fcn.010906e8
mov ecx, 0x30900433
sbb dword [ecx], edi
push eax
sub al, 0x19
cmp dword [eax], edx
fadd dword [eax]
add al, dl
call fcn.010906e8
xor bl, cl
or eax, eax
je 0x10c0891
and byte ss:[eax - 0x48], dh
xor ch, dh
add dword [eax], eax
pushal
call fcn.010906e8
cmpsb byte [esi], byte es:[edi]
stc
adc dword [eax + 0x364098], esi
xchg esp, eax
inc eax
ror ah, 1
add al, al
call fcn.01347b48
wait
imul ebp, dword [eax + eax*4 + 0x600001fe], 0x40360ddc
loopne 0x10c0918
mov al, 0xe8
dec eax
test byte [0x35e66800], bl
loopne 0x10c08a6
add byte [eax], al
shl byte [esi + 0x35], 0x90
add al, al
out 0x35, al
nop
test al, 0xd
sub eax, 0xba64e830
idiv edi
inc esp
jge 0x10c095f
push eax
add al, byte [eax]
add byte [eax + 0x40332fac], ah
inc eax
jge 0x10c096b
mov al, byte [0xa9ec0d8b]
cmp byte [ecx], al
mov esi, dword [0x138a9e8]
add ecx, 4
call fcn.01062a5b
mov ecx, dword [esi]
lea edx, [ebp - 4]
push edx
push 0x1003084
push 0x1005818
push eax
push esi
call dword [ecx + 0x14]
call fcn.010906e8
cmpsd dword [esi], dword es:[edi]
lahf
or eax, eax
push esp
mov ebp, 0xbd50d036
push ecx
adc al, 0xe8
cmp ebp, 0xfffffffc
jmp dword [edi + 0x54c0099f]
rcl byte ss:[eax - 0x43]
xor byte ss:[edi], dl
add byte [eax], al
jo 0x10c095e
invalid
call fcn.0103bc4e
mov eax, 0x5a5036e0
add dword [eax], eax
adc byte [eax - 0x3be45fca], dh
add al, 0xf0
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x10c0af1
call fcn.012e6715
invalid
call fcn.01298d5a
insb byte es:[edi], dx
invalid
Function at 0x10c2a8a
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
cmp dword [ebp + 8], esi
jne 0x10c2ab6
mov dword [ebp + 8], 0x80070057
jmp 0x10c300f
call fcn.0103bfc7
shr ah, 1
xor eax, 0x2120
rcl ah, 0xec
xor eax, 0x2cadb4c0
cmp byte [ecx], 0x75
or al, 0x74
fidivr dword [ecx]
jne 0x10c2ae3
je 0x10c2aaa
cmp dword [ebp + 0x14], esi
je 0x10c2aaa
cmp dword [ebp + 0x18], esi
je 0x10c2aaa
call fcn.0103c773
loopne 0x10c2ae6
jmp eax
add al, ah
mov eax, 0x5803598
mov esi, 0x98bc0030
xor eax, 0x9155e880
xchg ecx, eax
idiv edi
pop eax
xchg esi, eax
xor eax, 0x21d0
pushal
push esp
xchg esi, eax
xor eax, 0x30e159c0
adc byte [ebp - 0xaf07bb], cl
jne 0x10c2b18
call fcn.0104bb5f
cmp eax, esi
mov dword [ebp + 8], eax
jl 0x10c300f
inc ebp
or byte [edi], cl
mov edi, gs
add al, 0
add byte [ecx + 0x138aa00], ah
mov eax, dword [0x138aa00]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push 0x10083ac
push dword [ebp - 8]
push 1
push eax
call dword [ecx + 0x34]
call fcn.0103bc4e
je 0x10c2af6
xor eax, 0x1bc0
add byte [eax - 0x4a], dh
xor eax, 0x2f8d9eb0
and byte [ebx], bh
invalid
call fcn.01298d5a
shr byte [eax + 0x36], 1
xor ch, ah
add byte [eax], al
inc eax
int3

Function at 0x10cdd39
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x13912f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x14]
push eax
push edi
push esi
push ecx
call fcn.010ef883
pop ebp
add byte [eax], al
loopne 0x10cddd0
lcall 0xf6e2, 0x55e84004
dec eax
int3
xor eax, 0x31d45040
invalid

Function at 0x10d4169
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push esi
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x10d42dc
call fcn.0110c578
cwde
retf 0x35
cmp dword [ebp + 0x10], 0
je 0x10d4185
call fcn.0103bfc7
aam 0x7b
inc eax
mov eax, dword [0xd8800001]
jnp 0x10d432c
rol byte [edx + ecx], 1
xadd al, ch
mov eax, dword [eax + 0x79a8fff6]
xor eax, 0x2300
push eax
scasd eax, dword es:[edi]
popal
xor edx, eax
movsb byte es:[edi], byte [esi]
jns 0x10d4344
mov al, byte [0x1304358b]
add byte [ecx], al
push edi
push 0x1009e44
call esi
call fcn.01102ea6
cwde
pushfd
and byte ss:[eax], dl
add byte [eax], cl
pop ds
add byte [eax], al
inc eax
pushfd
pushfd
inc eax
call fcn.01298d5a
clc
jp 0x10d4370
add byte [ebp], dl
add al, dh
hlt
invalid
add eax, dword [eax]
add byte [eax + 0x70368db4], dh
call fcn.01347b48
pop eax
invalid
Function at 0x10d8a47
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x50
push esi
push edi
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
call fcn.0108fc5e
mov dword [ebp - 0x20], eax
lea eax, [ebp - 8]
push eax
push dword [ebx + 0xc]
call fcn.0104bb5f
call fcn.01298d5a
test al, 0xa2
add byte ss:[edi], dl
add byte [eax], al
xor byte [edx + 0x5271d036], ah
or edx, eax
call fcn.0103bfc7
add al, 0x88
sar byte ss:[edi + 1], 1
add byte [eax], ah
or byte [eax + 0x14b98036], cl
push cs
invalid