joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10063931
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.100638ad
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10063aa0
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10063aa0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10063a55
jg 0x1006398d
test eax, eax
je 0x10063a4b
push 1
push 0x1000
call fcn.10052622
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100639b0
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10063a42
push 0x8000
push ebx
call fcn.100637de
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100639d9
jg 0x100639d4
cmp ecx, 0x1000
jb 0x100639d9
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10056210
add esp, 0x10
cmp eax, 0xffffffff
je 0x10063a1e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100639d4
jl 0x10063a05
test ecx, ecx
jne 0x100639c6
push dword [ebp - 0xc]
push ebx
call fcn.100637de
push esi
call fcn.1005267f
add esp, 0xc
xor ebx, ebx
jmp 0x10063aae
cmp byte [edi + 0x24], 0
je 0x10063a35
cmp dword [edi + 0x20], 5
jne 0x10063a35
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10063a40
mov ebx, dword [edi + 0x18]
jmp 0x10063a42
xor ebx, ebx
push esi
call fcn.1005267f
pop ecx
jmp 0x10063aae
test ecx, ecx
jg 0x10063a17
jl 0x10063a55
test eax, eax
jae 0x10063a17
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100599a3
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10063a75
cmp byte [edi + 0x1c], 0
je 0x10063a17
jmp 0x10063aa6
push ebx
call fcn.1006080c
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10063a17
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10063aae
cmp byte [edi + 0x1c], 0
je 0x10063aab
mov ebx, dword [edi + 0x18]
jmp 0x10063aae
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100599a3
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100650c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100650ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100650ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10001d3c
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x10001d5a
mov eax, dword [ecx + 0x3c]
cmp eax, 0x400
jg 0x10001d5a
add eax, ecx
cmp dword [eax], 0x4550
je 0x10001d5c
xor eax, eax
ret

Function at 0x1000208f
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov eax, dword fs:[0x30]
cmp byte [eax + 2], 0
je 0x100020ac
push 0
push 0
push 0xe0190404
call fcn.10079dd1
add esp, 0xc
ret

Function at 0x100020fc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x24
mov eax, 0x100efd22
call fcn.100ccaa2
xor ebx, ebx
mov dword [ebp - 4], ebx
push str.ntdll.dll
call fcn.10002336
mov dword [ebp - 0x30], eax
test eax, eax
je 0x100021a2
mov byte [ebp - 0x2c], 0x64
mov byte [ebp - 0x2b], 0x81
mov byte [ebp - 0x2a], 0x5d
mov byte [ebp - 0x29], 0x6f
mov byte [ebp - 0x28], 0x7e
mov byte [ebp - 0x27], 0x53
mov byte [ebp - 0x26], 0x78
mov byte [ebp - 0x25], 0x70
mov byte [ebp - 0x24], 0x79
mov byte [ebp - 0x23], 0x7c
mov byte [ebp - 0x22], 0x77
mov byte [ebp - 0x21], 0x6b
mov byte [ebp - 0x20], 0x7e
mov byte [ebp - 0x1f], 0x73
mov byte [ebp - 0x1e], 0x79
mov byte [ebp - 0x1d], 0x78
mov byte [ebp - 0x1c], 0x5e
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x7c
mov byte [ebp - 0x19], 0x6f
mov byte [ebp - 0x18], 0x6b
mov byte [ebp - 0x17], 0x6e
mov byte [ebp - 0x16], bl
mov al, byte [ebp - 0x2c]
lea ecx, [ebp - 0x2c]
call fcn.10002396
push eax
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100021a2
push ebx
push ebx
push 0x11
push 0xfffffffffffffffe
call eax
or dword [ebp - 4], 0xffffffff
call fcn.100cc9ef
ret
Function at 0x100021ae
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x10110164]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x24], 0x1a
mov byte [ebp - 0x20], 0x59
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], 0x7f
mov byte [ebp - 0x1d], 0x79
mov byte [ebp - 0x1c], 0x71
mov byte [ebp - 0x1b], 0x48
mov byte [ebp - 0x1a], 0x7f
mov byte [ebp - 0x19], 0x77
mov byte [ebp - 0x18], 0x75
mov byte [ebp - 0x17], 0x6e
mov byte [ebp - 0x16], 0x7f
mov byte [ebp - 0x15], 0x5e
mov byte [ebp - 0x14], 0x7f
mov byte [ebp - 0x13], 0x78
mov byte [ebp - 0x12], 0x6f
mov byte [ebp - 0x11], 0x7d
mov byte [ebp - 0x10], 0x7d
mov byte [ebp - 0xf], 0x7f
mov byte [ebp - 0xe], 0x68
mov byte [ebp - 0xd], 0x4a
mov byte [ebp - 0xc], 0x68
mov byte [ebp - 0xb], 0x7f
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 9], 0x7f
mov byte [ebp - 8], 0x74
mov byte [ebp - 7], 0x6e
mov al, byte [ebp - 0x20]
mov byte [ebp - 6], 0
mov dword [ebp - 0x44], 0x1920
mov eax, dword [ebp - 0x44]
xor eax, 0x6b
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
inc eax
xor eax, 0x65
mov word [ebp - 0x3e], ax
mov eax, dword [ebp - 0x44]
add eax, 2
xor eax, 0x72
mov word [ebp - 0x3c], ax
mov eax, dword [ebp - 0x44]
add eax, 3
xor eax, 0x6e
mov word [ebp - 0x3a], ax
mov eax, dword [ebp - 0x44]
add eax, 4
xor eax, 0x65
mov word [ebp - 0x38], ax
mov eax, dword [ebp - 0x44]
add eax, 5
xor eax, 0x6c
mov word [ebp - 0x36], ax
mov eax, dword [ebp - 0x44]
add eax, 6
xor eax, 0x33
mov word [ebp - 0x34], ax
mov eax, dword [ebp - 0x44]
add eax, 7
xor eax, 0x32
mov word [ebp - 0x32], ax
mov eax, dword [ebp - 0x44]
add eax, 8
xor eax, 0x2e
mov word [ebp - 0x30], ax
mov eax, dword [ebp - 0x44]
add eax, 9
xor eax, 0x64
mov word [ebp - 0x2e], ax
mov eax, dword [ebp - 0x44]
add eax, 0xa
xor eax, 0x6c
mov ebx, dword [ebp + 0xc]
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x44]
add eax, 0xb
mov edi, dword [ebp + 8]
xor eax, 0x6c
mov word [ebp - 0x2a], ax
lea ecx, [ebp - 0x24]
xor eax, eax
mov word [ebp - 0x28], ax
mov ax, word [ebp - 0x40]
mov esi, dword [0x101ef2d0]
call fcn.100023ad
push eax
lea ecx, [ebp - 0x44]
call fcn.10002367
push eax
call fcn.10002336
push eax
lea eax, [ebp - 0x48]
push eax
call dword [esi + 0x4d8]
test eax, eax
jne 0x10002320
push 0xe0010010
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10002325
push ebx
push edi
call dword [ebp - 0x48]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100cc9b8
leave
ret 8

Function at 0x10002367
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 0xc
jb 0x10002371
pop edi
xor eax, eax
pop esi
mov word [edx + 0x1c], ax
lea eax, [edx + 4]
pop ebx
ret
Function at 0x100023ad
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 0x1a
pop ebx
lea eax, [edi + 4]
mov dl, byte [eax]
movsx esi, byte [edi]
movsx ecx, dl
xor ecx, esi
mov byte [eax], cl
inc eax
sub ebx, 1
jne 0x100023b8
mov byte [edi + 0x1e], bl
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x100023d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x12
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x100023df
xor eax, eax
mov word [esi + 0x28], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x10002c3d
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 0x19
jb 0x10002c47
pop edi
xor eax, eax
pop esi
mov word [edx + 0x36], ax
lea eax, [edx + 4]
pop ebx
ret

Function at 0x10002c85
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x13
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x10002c90
xor eax, eax
mov word [esi + 0x2a], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x10002cb3
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x1b
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x10002cbe
xor eax, eax
mov word [esi + 0x3a], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret
Function at 0x100039ae
Capabilities:
Read file on windows

Disassembly:
push 4
mov eax, 0x100eff48
call fcn.100cca6b
and dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov edi, dword [ecx]
mov eax, dword [ecx + 0x14]
mov esi, dword [ecx + 0x18]
mov ebx, 0x7123a057
xor eax, ebx
cmp dword [esi], eax
je 0x100039db
mov eax, 0xe023001e
jmp 0x10003a1f
cmp dword [ecx + 4], 0
je 0x10003a09
cmp dword [ecx + 8], 0
je 0x10003a09
cmp dword [ecx + 0x10], 0
je 0x10003a09
push dword [ecx + 0x10]
push dword [ecx + 0xc]
push dword [ecx + 8]
push dword [ecx + 4]
call fcn.100dcf87
add esp, 0x10
mov dword [edi], eax
xor dword [esi], ebx
xor eax, eax
jmp 0x10003a1f
mov eax, 0xe0010002
jmp 0x10003a1f
call fcn.100cc9c9
ret 4

Function at 0x10003ba2
Capabilities:
Write file on windows

Disassembly:
push 4
mov eax, 0x100effcf
call fcn.100cca6b
and dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov edi, dword [ecx]
mov eax, dword [ecx + 0x14]
mov esi, dword [ecx + 0x18]
mov ebx, 0x7123a057
xor eax, ebx
cmp dword [esi], eax
je 0x10003bcf
mov eax, 0xe023001e
jmp 0x10003c13
cmp dword [ecx + 4], 0
je 0x10003bfd
cmp dword [ecx + 8], 0
je 0x10003bfd
cmp dword [ecx + 0x10], 0
je 0x10003bfd
push dword [ecx + 0x10]
push dword [ecx + 0xc]
push dword [ecx + 8]
push dword [ecx + 4]
call fcn.100ddaa6
add esp, 0x10
mov dword [edi], eax
xor dword [esi], ebx
xor eax, eax
jmp 0x10003c13
mov eax, 0xe0010002
jmp 0x10003c13
call fcn.100cc9c9
ret 4

Function at 0x10003d85
Capabilities:
Get disk information

Disassembly:
push 4
mov eax, 0x100f0056
call fcn.100cca6b
and dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov edi, dword [ecx]
mov eax, dword [ecx + 0x24]
mov esi, dword [ecx + 0x28]
mov ebx, 0x7123a057
xor eax, ebx
cmp dword [esi], eax
je 0x10003db2
mov eax, 0xe023001e
jmp 0x10003de7
push dword [ecx + 0x20]
push dword [ecx + 0x1c]
push dword [ecx + 0x18]
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push dword [ecx + 0xc]
push dword [ecx + 8]
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov dword [edi], eax
xor dword [esi], ebx
xor eax, eax
jmp 0x10003de7
call fcn.100cc9c9
ret 4

Function at 0x10003def
Capabilities:
Get disk information

Disassembly:
push 4
mov eax, 0x100f0071
call fcn.100cca6b
and dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov edi, dword [ecx]
mov eax, dword [ecx + 0x24]
mov esi, dword [ecx + 0x28]
mov ebx, 0x7123a057
xor eax, ebx
cmp dword [esi], eax
je 0x10003e1c
mov eax, 0xe023001e
jmp 0x10003e51
push dword [ecx + 0x20]
push dword [ecx + 0x1c]
push dword [ecx + 0x18]
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push dword [ecx + 0xc]
push dword [ecx + 8]
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov dword [edi], eax
xor dword [esi], ebx
xor eax, eax
jmp 0x10003e51
call fcn.100cc9c9
ret 4
Function at 0x10004061
Capabilities:
Read file on windows

Disassembly:
push 4
mov eax, 0x100f00f8
call fcn.100cca6b
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov edi, dword [eax + 0x18]
mov esi, dword [eax + 0x1c]
test ebx, ebx
je 0x100040b3
cmp dword [eax + 4], 0
je 0x100040b3
cmp dword [eax + 8], 0
je 0x100040b3
test esi, esi
je 0x100040b3
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebx], eax
xor edi, 0x7123a057
mov dword [esi], edi
xor eax, eax
jmp 0x100040c9
mov eax, 0xe0010002
jmp 0x100040c9
call fcn.100cc9c9
ret 4

Function at 0x10004476
Capabilities:
Create process on windows

Disassembly:
push 4
mov eax, 0x100f012e
call fcn.100cca6b
and dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov edi, dword [ecx]
mov eax, dword [ecx + 0x1c]
mov esi, dword [ecx + 0x20]
mov ebx, 0x7123a057
xor eax, ebx
cmp dword [esi], eax
je 0x100044a3
mov eax, 0xe023001e
jmp 0x100044d2
push dword [ecx + 0x18]
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push dword [ecx + 0xc]
push dword [ecx + 8]
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [edi], eax
xor dword [esi], ebx
xor eax, eax
jmp 0x100044d2
call fcn.100cc9c9
ret 4

Function at 0x100044da
Capabilities:
Create process on windows

Disassembly:
push 4
mov eax, 0x100f0149
call fcn.100cca6b
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov edx, dword [eax + 4]
mov ecx, dword [eax + 8]
mov esi, dword [eax + 0xc]
mov ebx, 0x7123a057
xor ecx, ebx
cmp dword [esi], ecx
je 0x1000450a
mov eax, 0xe023001e
jmp 0x10004528
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov dword [edi], eax
xor dword [esi], ebx
xor eax, eax
jmp 0x10004528
call fcn.100cc9c9
ret 4

Function at 0x10004530
Capabilities:
Create process on windows

Disassembly:
push 4
mov eax, 0x100f0164
call fcn.100cca6b
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov edi, dword [eax]
mov edx, dword [eax + 4]
mov ecx, dword [eax + 8]
mov esi, dword [eax + 0xc]
mov ebx, 0x7123a057
xor ecx, ebx
cmp dword [esi], ecx
je 0x10004560
mov eax, 0xe023001e
jmp 0x1000457e
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [edi], eax
xor dword [esi], ebx
xor eax, eax
jmp 0x1000457e
call fcn.100cc9c9
ret 4

Function at 0x10004586
Capabilities:
Create process on windows

Disassembly:
push 4
mov eax, 0x100f017f
call fcn.100cca6b
and dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov edi, dword [ecx]
mov eax, dword [ecx + 0x1c]
mov esi, dword [ecx + 0x20]
mov ebx, 0x7123a057
xor eax, ebx
cmp dword [esi], eax
je 0x100045b3
mov eax, 0xe023001e
jmp 0x100045e2
push dword [ecx + 0x18]
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push dword [ecx + 0xc]
push dword [ecx + 8]
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [edi], eax
xor dword [esi], ebx
xor eax, eax
jmp 0x100045e2
call fcn.100cc9c9
ret 4
Function at 0x100049e8
Capabilities:
Write file on windows

Disassembly:
push 4
mov eax, 0x100f028d
call fcn.100cca6b
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov ebx, dword [eax]
mov edi, dword [eax + 0x18]
mov esi, dword [eax + 0x1c]
test ebx, ebx
je 0x10004a3a
cmp dword [eax + 4], 0
je 0x10004a3a
cmp dword [eax + 8], 0
je 0x10004a3a
test esi, esi
je 0x10004a3a
push dword [eax + 0x14]
push dword [eax + 0x10]
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebx], eax
xor edi, 0x7123a057
mov dword [esi], edi
xor eax, eax
jmp 0x10004a50
mov eax, 0xe0010002
jmp 0x10004a50
call fcn.100cc9c9
ret 4
Function at 0x1000b3f4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dl, byte [esi + ebx + 4]
mov eax, dword [esi]
add al, bl
movsx ecx, dl
xor eax, ecx
mov byte [esi + ebx + 4], al
inc ebx
cmp ebx, 8
jb 0x1000b3fb
pop edi
mov byte [esi + 0xc], 0
lea eax, [esi + 4]
pop esi
pop ebx
ret

Function at 0x1000b41d
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dl, byte [esi + ebx + 4]
mov eax, dword [esi]
add al, bl
movsx ecx, dl
xor eax, ecx
mov byte [esi + ebx + 4], al
inc ebx
cmp ebx, 0x10
jb 0x1000b424
pop edi
mov byte [esi + 0x14], 0
lea eax, [esi + 4]
pop esi
pop ebx
ret

Function at 0x1000b446
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dl, byte [esi + ebx + 4]
mov eax, dword [esi]
add al, bl
movsx ecx, dl
xor eax, ecx
mov byte [esi + ebx + 4], al
inc ebx
cmp ebx, 0xf
jb 0x1000b44d
pop edi
mov byte [esi + 0x13], 0
lea eax, [esi + 4]
pop esi
pop ebx
ret

Function at 0x1000b46f
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 0x1e
jb 0x1000b479
pop edi
xor eax, eax
pop esi
mov word [edx + 0x40], ax
lea eax, [edx + 4]
pop ebx
ret

Function at 0x1000b49e
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 0x26
jb 0x1000b4a8
pop edi
xor eax, eax
pop esi
mov word [edx + 0x50], ax
lea eax, [edx + 4]
pop ebx
ret

Function at 0x1000b4cd
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 0x12
jb 0x1000b4d7
pop edi
xor eax, eax
pop esi
mov word [edx + 0x28], ax
lea eax, [edx + 4]
pop ebx
ret

Function at 0x1000b4fc
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 0x2a
jb 0x1000b506
pop edi
xor eax, eax
pop esi
mov word [edx + 0x58], ax
lea eax, [edx + 4]
pop ebx
ret

Function at 0x1000b52b
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 7
jb 0x1000b535
pop edi
xor eax, eax
pop esi
mov word [edx + 0x12], ax
lea eax, [edx + 4]
pop ebx
ret
Function at 0x1000b55a
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 0x1a
jb 0x1000b564
pop edi
xor eax, eax
pop esi
mov word [edx + 0x38], ax
lea eax, [edx + 4]
pop ebx
ret

Function at 0x1000b589
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov edx, ecx
push esi
push edi
xor esi, esi
lea edi, [edx + 4]
mov ax, word [edi]
mov ecx, dword [edx]
add ecx, esi
movzx eax, ax
xor ecx, eax
inc esi
mov word [edi], cx
lea edi, [edi + 2]
cmp esi, 0x20
jb 0x1000b593
pop edi
xor eax, eax
pop esi
mov word [edx + 0x44], ax
lea eax, [edx + 4]
pop ebx
ret

Function at 0x1000b64e
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 0x10
pop ebx
lea eax, [edi + 4]
mov dl, byte [eax]
movsx esi, byte [edi]
movsx ecx, dl
xor ecx, esi
mov byte [eax], cl
inc eax
sub ebx, 1
jne 0x1000b659
mov byte [edi + 0x14], bl
lea eax, [edi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x1000b675
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x22
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1000b680
xor eax, eax
mov word [esi + 0x48], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x1000b6a3
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x1c
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1000b6ae
xor eax, eax
mov word [esi + 0x3c], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x1000b6d1
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x3a
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1000b6dc
xor eax, eax
mov word [esi + 0x78], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x1000b6ff
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x26
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1000b70a
xor eax, eax
mov word [esi + 0x50], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x1000b72d
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x20
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1000b738
xor eax, eax
mov word [esi + 0x44], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret
Function at 0x1000b75b
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x24
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1000b766
xor eax, eax
mov word [esi + 0x4c], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x1000b789
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x1f
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1000b794
xor eax, eax
mov word [esi + 0x42], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x1000b7b7
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x10
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1000b7c2
xor eax, eax
mov word [esi + 0x24], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x1000b7e5
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x1a
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1000b7f0
xor eax, eax
mov word [esi + 0x38], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x1000b813
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0xe
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1000b81e
xor eax, eax
mov word [esi + 0x20], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x1000b841
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x14
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1000b84c
xor eax, eax
mov word [esi + 0x2c], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret

Function at 0x1000b86f
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0x25
pop ebx
lea edi, [esi + 4]
mov ax, word [edi]
movzx ecx, word [esi]
movzx edx, ax
xor edx, ecx
mov word [edi], dx
lea edi, [edi + 2]
sub ebx, 1
jne 0x1000b87a
xor eax, eax
mov word [esi + 0x4e], ax
lea eax, [esi + 4]
pop edi
pop esi
pop ebx
ret