joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005195
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x349c
call fcn.1006e430
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10003d9b
test al, al
jne 0x100051cd
call fcn.1006daf8
mov ecx, dword [0x100c47a0]
cmp ecx, eax
jne 0x100051d3
dec ecx
mov dword [0x100c47a0], ecx
jmp 0x100051d3
mov ecx, dword [0x100c47a0]
cmp byte [0x100c4dcf], 0
jne 0x10005297
imul ecx, ecx
push ebx
mov eax, ecx
push 0x18
cdq
pop ecx
idiv ecx
xor ebx, ebx
mov dword [ebp - 0x14], 0x11050e38
mov dword [ebp - 0x10], 0x1f0f2441
mov dword [ebp - 0xc], 0x11061e1e
mov word [ebp - 8], 0x16
cmp edx, 0xb
jne 0x10005279
push esi
push edi
xor eax, eax
push 0x3486
mov word [ebp - 0x349c], ax
lea eax, [ebp - 0x349a]
push ebx
push eax
call fcn.1006de50
add esp, 0xc
mov edi, ebx
mov esi, ebx
mov edx, ebx
test edi, edi
je 0x1000525c
test edx, edx
je 0x1000525c
lea eax, [esi + edx]
lea ecx, [esi + edx]
mov ax, word [ebp + eax*2 - 0x3540]
inc ax
add ax, word [ebp + ecx*2 - 0x349e]
mov word [ebp + ecx*2 - 0x349c], ax
inc edx
cmp edx, 0x52
jl 0x10005234
add esi, 0x52
inc edi
cmp esi, 0x1a44
jl 0x10005232
movsx eax, word [ebp - 0x16]
pop edi
mov dword [0x100c47a0], eax
pop esi
mov al, byte [ebx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ebx - 0x14]
inc ebx
mov byte [ebx + 0x100be2f3], al
cmp ebx, 0xd
jl 0x10005279
mov byte [0x100c4dcf], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be2f4
call fcn.1006d48b
leave
ret

Function at 0x100052a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dca], 0
jne 0x100052f1
xor ecx, ecx
mov dword [ebp - 0x10], 0x542e2f3b
mov dword [ebp - 0xc], 0x5d584c5f
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be2af], al
cmp ecx, 8
jl 0x100052d4
mov byte [0x100c4dca], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be2b0
call fcn.1006d48b
leave
ret

Function at 0x10005302
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e33], 0
jne 0x10005351
xor ecx, ecx
mov dword [ebp - 0x10], 0x1f12092d
mov dword [ebp - 0xc], 0x51c0d20
mov word [ebp - 8], 0x1a0e
mov byte [ebp - 6], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be82f], al
cmp ecx, 0xa
jl 0x10005334
mov byte [0x100c4e33], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be830
call fcn.1006d48b
leave
ret
Function at 0x10005362
Capabilities:
Encode data using xor
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e20], 0
jne 0x10005410
push ebx
push esi
mov esi, dword [0x100c47a0]
push 6
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
pop ecx
idiv ecx
xor ebx, ebx
mov dword [ebp - 0x10], 0x542e2f3b
mov dword [ebp - 0xc], 0x5f584c5f
mov byte [ebp - 8], bl
cmp edx, 2
jne 0x100053db
push 0x64
pop ecx
mov eax, esi
cdq
idiv ecx
xor ecx, ecx
push 4
lea eax, [edx + 0x2f4]
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1006c443
push eax
call fcn.1006dc4d
pop ecx
pop ecx
mov ecx, ebx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be72b], al
cmp ecx, 8
jl 0x100053dd
mov byte [0x100c4e20], 1
call fcn.10003d9b
test al, al
jne 0x1000540e
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, str.__.T_LX_
call fcn.1006d48b
leave
ret

Function at 0x10005421
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e02], 0
jne 0x100054a9
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], 0x542e2f3b
mov dword [ebp - 0xc], 0x545a4458
mov byte [ebp - 8], bl
call fcn.10003e96
test al, al
jne 0x10005466
call fcn.1006daf8
mov edx, eax
mov dword [0x100c47a0], edx
jmp 0x1000546c
mov edx, dword [0x100c47a0]
mov ecx, ebx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be593], al
cmp ecx, 8
jl 0x1000546e
lea eax, [edx + 1]
imul eax, edx
push 9
cdq
pop ecx
idiv ecx
mov byte [0x100c4e02], 1
cmp edx, 7
jne 0x100054a8
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, str.__.TXDZT
call fcn.1006d48b
leave
ret

Function at 0x100054ba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10003e54
xor ecx, ecx
test al, al
jne 0x100054fd
push esi
mov esi, dword [0x100c47a0]
mov edx, ecx
mov eax, dword [ebp + edx*4 - 0x40c]
imul eax, eax, 0x4f
add esi, eax
inc edx
cmp edx, 0x3fc
jb 0x100054e1
mov dword [0x100c47a0], esi
pop esi
cmp byte [0x100c4e01], cl
jne 0x10005533
mov dword [ebp - 0x10], 0x542e2f3b
mov dword [ebp - 0xc], 0x555a4458
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be587], al
cmp ecx, 8
jl 0x10005516
mov byte [0x100c4e01], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, str.__.TXDZU
call fcn.1006d48b
leave
ret
Function at 0x10005544
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e29], 0
jne 0x100055ca
xor ecx, ecx
mov dword [ebp - 0x10], 0x542e2f3b
mov dword [ebp - 0xc], 0x5a5f4058
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be7a3], al
cmp ecx, 8
jl 0x10005570
mov ecx, dword [0x100c47a0]
push ebx
lea edx, [ecx + 2]
lea eax, [ecx + 1]
imul edx, eax
imul edx, ecx
xor ebx, ebx
inc ebx
mov byte [0x100c4e29], bl
and edx, reloc.OLEAUT32.dll_VariantInit
jns 0x100055af
dec edx
or edx, 0xfffffff8
inc edx
cmp edx, ebx
jne 0x100055c9
mov ecx, ebx
mov edx, 0xaf
dec edx
lea eax, [ecx + ebx]
lea ebx, [ecx]
mov ecx, eax
jns 0x100055ba
mov dword [0x100c47a0], eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, str.__.TX__Z
call fcn.1006d48b
leave
ret

Function at 0x100055db
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dfa], 0
jne 0x10005624
xor ecx, ecx
mov dword [ebp - 0x10], 0x542e2f3b
mov dword [ebp - 0xc], 0x595e4258
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be52b], al
cmp ecx, 8
jl 0x10005607
mov byte [0x100c4dfa], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, str.__.TXBY
call fcn.1006d48b
leave
ret

Function at 0x10005635
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e1f], 0
jne 0x1000567e
xor ecx, ecx
mov dword [ebp - 0x10], 0x542e2f3b
mov dword [ebp - 0xc], 0x585e4358
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be71f], al
cmp ecx, 8
jl 0x10005661
mov byte [0x100c4e1f], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, str.__.TXCX
call fcn.1006d48b
leave
ret

Function at 0x1000568f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dff], 0
jne 0x100056d8
xor ecx, ecx
mov dword [ebp - 0x10], 0x542e2f3b
mov dword [ebp - 0xc], 0x59584358
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be56f], al
cmp ecx, 8
jl 0x100056bb
mov byte [0x100c4dff], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, str.__.TXCXY
call fcn.1006d48b
leave
ret
Function at 0x100056e9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e0b], 0
jne 0x10005738
xor ecx, ecx
mov dword [ebp - 0x10], 0xd04132d
mov dword [ebp - 0xc], 0x51c0d20
mov word [ebp - 8], 0x1a0e
mov byte [ebp - 6], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be603], al
cmp ecx, 0xa
jl 0x1000571b
mov byte [0x100c4e0b], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be604
call fcn.1006d48b
leave
ret

Function at 0x10005749
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dd3], 0
jne 0x10005799
xor ecx, ecx
mov dword [ebp - 0x14], 0x304032c
mov dword [ebp - 0x10], 0x2d0d1d1e
mov dword [ebp - 0xc], 0xd060d09
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100be32b], al
cmp ecx, 0xc
jl 0x1000577c
mov byte [0x100c4dd3], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be32c
call fcn.1006d48b
leave
ret

Function at 0x100057aa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e39], 0
jne 0x100057f6
mov dword [ebp - 0x10], 0x2a1e032c
mov dword [ebp - 0xc], 0xf070615
mov word [ebp - 8], 0x1e
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be87f], al
cmp ecx, 9
jl 0x100057d9
mov byte [0x100c4e39], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be880
call fcn.1006d48b
leave
ret

Function at 0x10005807
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dc8], 0
jne 0x10005854
mov dword [ebp - 0x10], 0x161a0723
mov dword [ebp - 0xc], 0x1e173815
mov dword [ebp - 8], 0x1a0a04
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be293], al
cmp ecx, 0xb
jl 0x10005837
mov byte [0x100c4dc8], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be294
call fcn.1006d48b
leave
ret
Function at 0x10005865
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e06], 0
jne 0x100058ad
xor ecx, ecx
mov dword [ebp - 0xc], 0x21f0427
mov word [ebp - 8], 0xd08
mov byte [ebp - 6], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0xc]
inc ecx
mov byte [ecx + 0x100be5c7], al
cmp ecx, 6
jl 0x10005890
mov byte [0x100c4e06], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be5c8
call fcn.1006d48b
leave
ret

Function at 0x100058be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d30
call fcn.1006e430
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100c47a0]
imul eax, eax
push ebx
push 0x12
cdq
pop ecx
idiv ecx
xor ebx, ebx
cmp edx, 6
jne 0x10005956
push esi
push edi
xor eax, eax
push 0x2d1e
mov word [ebp - 0x2d30], ax
lea eax, [ebp - 0x2d2e]
push ebx
push eax
call fcn.1006de50
add esp, 0xc
mov edi, ebx
mov esi, ebx
mov edx, ebx
test edi, edi
je 0x10005939
test edx, edx
je 0x10005939
lea eax, [esi + edx]
lea ecx, [esi + edx]
mov ax, word [ebp + eax*2 - 0x2dc8]
inc ax
add ax, word [ebp + ecx*2 - 0x2d32]
mov word [ebp + ecx*2 - 0x2d30], ax
inc edx
cmp edx, 0x4c
jl 0x10005911
add esi, 0x4c
inc edi
cmp esi, 0x1690
jl 0x1000590f
movsx eax, word [ebp - 0x12]
pop edi
mov dword [0x100c47a0], eax
pop esi
cmp byte [0x100c4e0d], bl
jne 0x10005992
mov dword [ebp - 0x10], 0xf181f27
mov dword [ebp - 0xc], 0x70b1134
mov word [ebp - 8], 0x1b08
mov byte [ebp - 6], bl
mov al, byte [ebx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ebx - 0x10]
inc ebx
mov byte [ebx + 0x100be61b], al
cmp ebx, 0xa
jl 0x10005975
mov byte [0x100c4e0d], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be61c
pop ebx
call fcn.1006d48b
leave
ret

Function at 0x100059a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dc2], 0
jne 0x100059f1
mov dword [ebp - 0x10], 0xf181f27
mov dword [ebp - 0xc], 0xd0b270f
mov dword [ebp - 8], 0x10a1f
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be23f], al
cmp ecx, 0xb
jl 0x100059d4
mov byte [0x100c4dc2], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be240
call fcn.1006d48b
leave
ret
Function at 0x10005a02
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4de9], 0
jne 0x10005a75
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], 0x91e132a
mov dword [ebp - 0xc], 0x1e173841
mov dword [ebp - 8], 0x1a0a04
mov ecx, ebx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be44b], al
cmp ecx, 0xb
jl 0x10005a38
call fcn.10003f5d
test al, al
jne 0x10005a6d
push esi
mov esi, dword [0x100c47a0]
push edi
mov edi, esi
inc ebx
dec edi
cmp ebx, 0xff
jb 0x10005a61
pop edi
pop esi
mov byte [0x100c4de9], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be44c
call fcn.1006d48b
leave
ret

Function at 0x10005a86
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x100c47a0]
imul eax, eax
push 0x13
cdq
pop ecx
idiv ecx
cmp edx, 3
jne 0x10005ac4
push esi
xor esi, esi
xor eax, eax
push 2
inc esi
inc eax
pop edx
dec edx
lea ecx, [eax + esi]
lea esi, [eax]
mov eax, ecx
jns 0x10005ab3
mov dword [0x100c47a0], ecx
pop esi
cmp byte [0x100c4dd4], 0
jne 0x10005b00
mov dword [ebp - 0x10], 0xf181f27
mov dword [ebp - 0xc], 0x207270f
mov word [ebp - 8], 0xa
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be33b], al
cmp ecx, 9
jl 0x10005ae3
mov byte [0x100c4dd4], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be33c
call fcn.1006d48b
leave
ret

Function at 0x10005b11
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [0x100c47a0]
push ebx
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
push 0x18
cdq
pop ecx
idiv ecx
xor ebx, ebx
cmp edx, 7
jne 0x10005b77
push esi
push edi
push 0x28
call fcn.1006c443
pop ecx
mov edi, eax
mov esi, ebx
call fcn.1006daf8
add eax, dword [0x100c47a0]
mov dword [edi + esi*4], eax
inc esi
cmp esi, 0xa
jl 0x10005b4f
mov eax, dword [edi + 0x24]
push edi
mov dword [0x100c47a0], eax
call fcn.1006dc4d
pop ecx
push 0x18
pop ecx
pop edi
pop esi
cmp byte [0x100c4e37], bl
jne 0x10005bb5
mov word [ebp - 0x10], 0x1f27
mov byte [ebp - 0xe], cl
mov dword [ebp - 0xd], 0x1a270f0f
mov word [ebp - 9], 0x1f0d
mov byte [ebp - 7], bl
mov al, byte [ebx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ebx - 0x10]
inc ebx
mov byte [ebx + 0x100be867], al
cmp ebx, 9
jl 0x10005b98
mov byte [0x100c4e37], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be868
pop ebx
call fcn.1006d48b
leave
ret
Function at 0x10005bc7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10003e36
test al, al
jne 0x10005bf6
call fcn.1006daf8
mov ecx, dword [0x100c47a0]
cmp ecx, eax
jne 0x10005bf6
dec ecx
mov dword [0x100c47a0], ecx
cmp byte [0x100c4e22], 0
jne 0x10005c35
xor ecx, ecx
mov dword [ebp - 0x10], 0xf181f27
mov dword [ebp - 0xc], 0x2743070f
mov word [ebp - 8], 0xd04
mov byte [ebp - 6], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be747], al
cmp ecx, 0xa
jl 0x10005c18
mov byte [0x100c4e22], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be748
call fcn.1006d48b
leave
ret

Function at 0x10005c46
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e09], 0
jne 0x10005c97
xor ecx, ecx
mov dword [ebp - 0x14], 0xf181f27
mov dword [ebp - 0x10], 0x3a43070f
mov dword [ebp - 0xc], 0x61e0c04
mov word [ebp - 8], cx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100be5e7], al
cmp ecx, 0xd
jl 0x10005c7a
mov byte [0x100c4e09], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be5e8
call fcn.1006d48b
leave
ret

Function at 0x10005ca8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dfd], 0
jne 0x10005cfe
xor ecx, ecx
mov dword [ebp - 0x14], 0xf181f27
mov dword [ebp - 0x10], 0x3a43070f
mov dword [ebp - 0xc], 0xa1e0c04
mov word [ebp - 8], 0x41c
mov byte [ebp - 6], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100be553], al
cmp ecx, 0xe
jl 0x10005ce1
mov byte [0x100c4dfd], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be554
call fcn.1006d48b
leave
ret

Function at 0x10005d0f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dbd], 0
jne 0x10005d5b
mov dword [ebp - 0x10], 0xf181f27
mov dword [ebp - 0xc], 0x1e2f070f
mov word [ebp - 8], 0x19
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be207], al
cmp ecx, 9
jl 0x10005d3e
mov byte [0x100c4dbd], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be208
call fcn.1006d48b
leave
ret
Function at 0x10005d6c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dfe], 0
jne 0x10005db8
mov dword [ebp - 0x10], 0xf181f27
mov dword [ebp - 0xc], 0x32c070f
mov word [ebp - 8], 0x19
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be563], al
cmp ecx, 9
jl 0x10005d9b
mov byte [0x100c4dfe], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be564
call fcn.1006d48b
leave
ret

Function at 0x10005dc9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dcc], 0
jne 0x10005e36
mov eax, dword [0x100c47a0]
imul eax, eax
push ebx
push 0x16
cdq
pop ecx
idiv ecx
xor ebx, ebx
cmp edx, 7
jne 0x10005e03
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov dword [ebp - 0x10], 0xf181f27
mov dword [ebp - 0xc], 0x42d070f
mov dword [ebp - 8], 0x1d1a08
mov al, byte [ebx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ebx - 0x10]
inc ebx
mov byte [ebx + 0x100be2c7], al
cmp ebx, 0xb
jl 0x10005e18
mov byte [0x100c4dcc], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be2c8
call fcn.1006d48b
leave
ret

Function at 0x10005e47
Capabilities:
Encode data using xor
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x100c47a0]
mov eax, esi
imul eax, esi
push 0x14
cdq
pop ecx
idiv ecx
xor ebx, ebx
cmp edx, 0xc
jne 0x10005e82
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov esi, dword [0x100c47a0]
cmp byte [0x100c4e0e], bl
jne 0x10005f08
mov dword [ebp - 0x14], 0xf181f27
mov dword [ebp - 0x10], 0x32d070f
mov dword [ebp - 0xc], 0xa081d03
mov dword [ebp - 8], 0x1d061c
mov cl, byte [ebx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor cl, byte [ebp + ebx - 0x14]
inc ebx
mov byte [ebx + 0x100be627], cl
cmp ebx, 0xf
jl 0x10005ea6
imul esi, esi
mov eax, esi
push 0xb
cdq
pop ecx
idiv ecx
cmp edx, 0xa
jne 0x10005f01
push edi
mov esi, str.S16OMamQG33NJ
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
movsw word es:[edi], word [esi]
call fcn.1006d400
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1006c443
push eax
call fcn.1006dc4d
add esp, 0xc
pop edi
mov byte [0x100c4e0e], 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 0x100be628
pop ebx
call fcn.1006d48b
leave
ret