joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1053620
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f386c], 1
jne 0x10536f8
or dword [0x10f386c], 1
mov dword [0x10f1e90], 0xa6a2b681
mov dword [0x10f1e94], 0xf3a7a0b6
mov dword [0x10f1e98], 0xf3bfa1a6
mov dword [0x10f1e9c], 0xb7b6a0a6
mov dword [0x10f1ea0], 0xb7f3b2f3
mov dword [0x10f1ea4], 0xb6b5b5ba
mov dword [0x10f1ea8], 0xa7bdb6a1
mov dword [0x10f1eac], 0xa1bca3f3
mov dword [0x10f1eb0], 0xbba7f3a7
mov dword [0x10f1eb4], 0xa7f3bdb2
mov dword [0x10f1eb8], 0xb0f3b6bb
mov dword [0x10f1ebc], 0xb6bdbdbc
mov dword [0x10f1ec0], 0xbcbaa7b0
mov dword [0x10f1ec4], 0xb2a4f3bd
mov dword [0x10f1ec8], 0xbdbaf3a0
mov dword [0x10f1ecc], 0xb2baa7ba
mov dword [0x10f1ed0], 0xb6a9babf
mov dword [0x10f1ed4], 0xbaa4f3b7
mov word [0x10f1ed8], 0xbba7
mov byte [0x10f1eda], 0xd3
xor eax, eax
mov cl, byte [eax + 0x10f1e90]
xor cl, 0xd3
mov byte [eax + 0x10f2148], cl
inc eax
cmp eax, 0x4b
jb 0x10536fa
mov eax, 0x10f2148
ret

Function at 0x1053715
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3868], 1
jne 0x105376b
or dword [0x10f3868], 1
mov dword [0x10f1edc], 0x9bbdba84
mov dword [0x10f1ee0], 0x9ca3a7a7
mov dword [0x10f1ee4], 0x81bdb6a3
mov dword [0x10f1ee8], 0xb6a6a2b6
mov dword [0x10f1eec], 0xfafba7a0
mov dword [0x10f1ef0], 0xbab2b5f3
mov dword [0x10f1ef4], 0xd3b7b6bf
xor eax, eax
mov cl, byte [eax + 0x10f1edc]
xor cl, 0xd3
mov byte [eax + 0x10f2194], cl
inc eax
cmp eax, 0x1c
jb 0x105376d
mov eax, 0x10f2194
ret

Function at 0x1053788
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3864], 1
jne 0x1053857
or dword [0x10f3864], 1
mov dword [0x10f1ef8], 0x9bbdba84
mov dword [0x10f1efc], 0x80a3a7a7
mov dword [0x10f1f00], 0xa39ca7b6
mov dword [0x10f1f04], 0xbdbcbaa7
mov dword [0x10f1f08], 0x9d9a84fb
mov dword [0x10f1f0c], 0x8387879b
mov dword [0x10f1f10], 0x87839c8c
mov dword [0x10f1f14], 0x8c9d9c9a
mov dword [0x10f1f18], 0x86909680
mov dword [0x10f1f1c], 0x8a879a81
mov dword [0x10f1f20], 0x929f958c
mov dword [0x10f1f24], 0xf3fa8094
mov dword [0x10f1f28], 0xa1f3bdbc
mov dword [0x10f1f2c], 0xb6a6a2b6
mov dword [0x10f1f30], 0xbbf3a7a0
mov dword [0x10f1f34], 0xbfb7bdb2
mov dword [0x10f1f38], 0xb2b5f3b6
mov dword [0x10f1f3c], 0xb7b6bfba
mov byte [0x10f1f40], 0xd3
xor eax, eax
mov cl, byte [eax + 0x10f1ef8]
xor cl, 0xd3
mov byte [eax + 0x10f21b0], cl
inc eax
cmp eax, 0x49
jb 0x1053859
mov eax, 0x10f21b0
ret
Function at 0x1053874
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3860], 1
jne 0x1053942
or dword [0x10f3860], 1
mov dword [0x10f1f48], 0x9bbdba84
mov dword [0x10f1f4c], 0x80a3a7a7
mov dword [0x10f1f50], 0xa39ca7b6
mov dword [0x10f1f54], 0xbdbcbaa7
mov dword [0x10f1f58], 0x9d9a84fb
mov dword [0x10f1f5c], 0x8387879b
mov dword [0x10f1f60], 0x87839c8c
mov dword [0x10f1f64], 0x8c9d9c9a
mov dword [0x10f1f68], 0x979d9680
mov dword [0x10f1f6c], 0x9e9a878c
mov dword [0x10f1f70], 0x87869c96
mov dword [0x10f1f74], 0xbdbcf3fa
mov dword [0x10f1f78], 0xa2b6a1f3
mov dword [0x10f1f7c], 0xa7a0b6a6
mov dword [0x10f1f80], 0xbdb2bbf3
mov dword [0x10f1f84], 0xf3b6bfb7
mov dword [0x10f1f88], 0xbfbab2b5
mov word [0x10f1f8c], 0xb7b6
mov byte [0x10f1f8e], 0xd3
xor eax, eax
mov cl, byte [eax + 0x10f1f48]
xor cl, 0xd3
mov byte [eax + 0x10f2200], cl
inc eax
cmp eax, 0x47
jb 0x1053944
mov eax, 0x10f2200
ret

Function at 0x105395f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f385c], 1
jne 0x10539c8
or dword [0x10f385c], 1
mov dword [0x10f1f90], 0x9bbdba84
mov dword [0x10f1f94], 0x92a3a7a7
mov dword [0x10f1f98], 0xb681b7b7
mov dword [0x10f1f9c], 0xa0b6a6a2
mov dword [0x10f1fa0], 0xb2b69ba7
mov dword [0x10f1fa4], 0xa0a1b6b7
mov dword [0x10f1fa8], 0xb5f3fafb
mov dword [0x10f1fac], 0xb6bfbab2
mov word [0x10f1fb0], 0xd3b7
xor eax, eax
mov cl, byte [eax + 0x10f1f90]
xor cl, 0xd3
mov byte [eax + 0x10f2248], cl
inc eax
cmp eax, 0x22
jb 0x10539ca
mov eax, 0x10f2248
ret

Function at 0x10539e5
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3858], 1
jne 0x1053a38
or dword [0x10f3858], 1
mov dword [0x10f1fb4], 0xa3a7a79b
mov dword [0x10f1fb8], 0xb7bdb680
mov dword [0x10f1fbc], 0xa6a2b681
mov dword [0x10f1fc0], 0xfba7a0b6
mov dword [0x10f1fc4], 0xb2b5f3fa
mov dword [0x10f1fc8], 0xb7b6bfba
mov byte [0x10f1fcc], 0xd3
xor eax, eax
mov cl, byte [eax + 0x10f1fb4]
xor cl, 0xd3
mov byte [eax + 0x10f226c], cl
inc eax
cmp eax, 0x19
jb 0x1053a3a
mov eax, 0x10f226c
ret

Function at 0x1053a55
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3854], 1
jne 0x1053aa7
or dword [0x10f3854], 1
mov dword [0x10f1fd0], 0xa3a7a79b
mov dword [0x10f1fd4], 0xa1b6a682
mov dword [0x10f1fd8], 0xb5bd9aaa
mov dword [0x10f1fdc], 0xf3fafbbc
mov dword [0x10f1fe0], 0xbfbab2b5
mov word [0x10f1fe4], 0xb7b6
mov byte [0x10f1fe6], 0xd3
xor eax, eax
mov cl, byte [eax + 0x10f1fd0]
xor cl, 0xd3
mov byte [eax + 0x10f2288], cl
inc eax
cmp eax, 0x17
jb 0x1053aa9
mov eax, 0x10f2288
ret
Function at 0x1054287
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f384c], 1
jne 0x10542f7
or dword [0x10f384c], 1
mov dword [0x10f1fec], 0x9bbdba84
mov dword [0x10f1ff0], 0x82a3a7a7
mov dword [0x10f1ff4], 0xaaa1b6a6
mov dword [0x10f1ff8], 0xb2a7b297
mov dword [0x10f1ffc], 0xbab2a592
mov dword [0x10f2000], 0xbfb1b2bf
mov dword [0x10f2004], 0xf3fafbb6
mov dword [0x10f2008], 0xbfbab2b5
mov word [0x10f200c], 0xb7b6
mov byte [0x10f200e], 0xd3
xor eax, eax
mov cl, byte [eax + 0x10f1fec]
xor cl, 0xd3
mov byte [eax + 0x10f22a4], cl
inc eax
cmp eax, 0x23
jb 0x10542f9
mov eax, 0x10f22a4
ret

Function at 0x1054314
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3848], 1
jne 0x1054369
or dword [0x10f3848], 1
mov dword [0x10f2010], 0xb6a7bd9a
mov dword [0x10f2014], 0xa7b6bda1
mov dword [0x10f2018], 0xb7b2b681
mov dword [0x10f201c], 0xb6bfba95
mov dword [0x10f2020], 0xb5f3fafb
mov dword [0x10f2024], 0xb6bfbab2
mov word [0x10f2028], 0xd3b7
xor eax, eax
mov cl, byte [eax + 0x10f2010]
xor cl, 0xd3
mov byte [eax + 0x10f22c8], cl
inc eax
cmp eax, 0x1a
jb 0x105436b
mov eax, 0x10f22c8
ret

Function at 0x1055169
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f382c], 1
jne 0x10551f0
or dword [0x10f382c], 1
mov dword [0x10f2300], 0xa1f4ba95
mov dword [0x10f2304], 0xb7b1a6ba
mov dword [0x10f2308], 0xbdbab3bb
mov dword [0x10f230c], 0xf4b0b1ae
mov dword [0x10f2310], 0xb1bfbba0
mov dword [0x10f2314], 0xb5a3f4ba
mov dword [0x10f2318], 0xbbb2f4a7
mov dword [0x10f231c], 0xf4b0baa1
mov dword [0x10f2320], 0xb7f4a0b5
mov dword [0x10f2324], 0xb5a6b5bc
mov dword [0x10f2328], 0xa6b1a0b7
mov word [0x10f232c], 0xd4f4
xor eax, eax
mov cl, byte [eax + 0x10f2300]
xor cl, 0xd4
mov byte [eax + 0x10f2450], cl
inc eax
cmp eax, 0x2e
jb 0x10551f2
mov eax, 0x10f2450
ret
Function at 0x1055636
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3828], 1
jne 0x1055692
or dword [0x10f3828], 1
mov dword [0x10f2330], 0xa7a7bd99
mov dword [0x10f2334], 0xf4b3babd
mov dword [0x10f2338], 0xb1b8f4b5
mov dword [0x10f233c], 0xa4f4a0b2
mov dword [0x10f2340], 0xbab1a6b5
mov dword [0x10f2344], 0xa7b1bca0
mov word [0x10f2348], 0xa7bd
mov byte [0x10f234a], 0xd4
xor eax, eax
mov cl, byte [eax + 0x10f2330]
xor cl, 0xd4
mov byte [eax + 0x10f2480], cl
inc eax
cmp eax, 0x1b
jb 0x1055694
mov eax, 0x10f2480
ret

Function at 0x10556af
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3824], 1
jne 0x1055718
or dword [0x10f3824], 1
mov dword [0x10f234c], 0xf4a0bb9a
mov dword [0x10f2350], 0xa1bbbab1
mov dword [0x10f2354], 0xbbf4bcb3
mov dword [0x10f2358], 0xb5a6b1a4
mov dword [0x10f235c], 0xf4a7b0ba
mov dword [0x10f2360], 0xb1f4babd
mov dword [0x10f2364], 0xb1a6a4ac
mov dword [0x10f2368], 0xbbbda7a7
mov word [0x10f236c], 0xd4ba
xor eax, eax
mov cl, byte [eax + 0x10f234c]
xor cl, 0xd4
mov byte [eax + 0x10f249c], cl
inc eax
cmp eax, 0x22
jb 0x105571a
mov eax, 0x10f249c
ret

Function at 0x1055735
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3820], 1
jne 0x1055795
or dword [0x10f3820], 1
mov dword [0x10f2370], 0xf4bbbb80
mov dword [0x10f2374], 0xadbab5b9
mov dword [0x10f2378], 0xb1a4bbf4
mov dword [0x10f237c], 0xb0bab5a6
mov dword [0x10f2380], 0xbabdf4a7
mov dword [0x10f2384], 0xa4acb1f4
mov dword [0x10f2388], 0xa7a7b1a6
mov dword [0x10f238c], 0xd4babbbd
xor eax, eax
mov cl, byte [eax + 0x10f2370]
xor cl, 0xd4
mov byte [eax + 0x10f24c0], cl
inc eax
cmp eax, 0x20
jb 0x1055797
mov eax, 0x10f24c0
ret

Function at 0x10557b2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f381c], 1
jne 0x1055808
or dword [0x10f381c], 1
mov dword [0x10f2390], 0xa7a7bd99
mov dword [0x10f2394], 0xf4b3babd
mov dword [0x10f2398], 0xbda6f4b5
mov dword [0x10f239c], 0xf4a0bcb3
mov dword [0x10f23a0], 0xb1a6b5a4
mov dword [0x10f23a4], 0xb1bca0ba
mov dword [0x10f23a8], 0xd4a7bda7
xor eax, eax
mov cl, byte [eax + 0x10f2390]
xor cl, 0xd4
mov byte [eax + 0x10f24e0], cl
inc eax
cmp eax, 0x1c
jb 0x105580a
mov eax, 0x10f24e0
ret

Function at 0x1055825
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3818], 1
jne 0x1055896
or dword [0x10f3818], 1
mov dword [0x10f23ac], 0xa6b5ba81
mov dword [0x10f23b0], 0xa4bbf4ad
mov dword [0x10f23b4], 0xa0b5a6b1
mov dword [0x10f23b8], 0xb9f4a6bb
mov dword [0x10f23bc], 0xf4a0a7a1
mov dword [0x10f23c0], 0xb1a2b5bc
mov dword [0x10f23c4], 0xb1babbf4
mov dword [0x10f23c8], 0xb1a4bbf4
mov dword [0x10f23cc], 0xb0bab5a6
mov byte [0x10f23d0], 0xd4
xor eax, eax
mov cl, byte [eax + 0x10f23ac]
xor cl, 0xd4
mov byte [eax + 0x10f24fc], cl
inc eax
cmp eax, 0x25
jb 0x1055898
mov eax, 0x10f24fc
ret
Function at 0x10558b3
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3814], 1
jne 0x105592d
or dword [0x10f3814], 1
mov dword [0x10f23d4], 0xb5babd96
mov dword [0x10f23d8], 0xbbf4ada6
mov dword [0x10f23dc], 0xb5a6b1a4
mov dword [0x10f23e0], 0xf4a6bba0
mov dword [0x10f23e4], 0xa0a7a1b9
mov dword [0x10f23e8], 0xa2b5bcf4
mov dword [0x10f23ec], 0xa3a0f4b1
mov dword [0x10f23f0], 0xa4bbf4bb
mov dword [0x10f23f4], 0xbab5a6b1
mov word [0x10f23f8], 0xa7b0
mov byte [0x10f23fa], 0xd4
xor eax, eax
mov cl, byte [eax + 0x10f23d4]
xor cl, 0xd4
mov byte [eax + 0x10f2524], cl
inc eax
cmp eax, 0x27
jb 0x105592f
mov eax, 0x10f2524
ret

Function at 0x105594a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3810], 1
jne 0x10559b3
or dword [0x10f3810], 1
mov dword [0x10f23fc], 0xb5babd96
mov dword [0x10f2400], 0xbbf4ada6
mov dword [0x10f2404], 0xb5a6b1a4
mov dword [0x10f2408], 0xf4a6bba0
mov dword [0x10f240c], 0xf4a0bbba
mov dword [0x10f2410], 0xb8a4b9bd
mov dword [0x10f2414], 0xbab1b9b1
mov dword [0x10f2418], 0xeeb0b1a0
mov word [0x10f241c], 0xd4f4
xor eax, eax
mov cl, byte [eax + 0x10f23fc]
xor cl, 0xd4
mov byte [eax + 0x10f254c], cl
inc eax
cmp eax, 0x22
jb 0x10559b5
mov eax, 0x10f254c
ret
Function at 0x1057365
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
or eax, 0xffffffff
cmp dword [ebp + 8], 0
je 0x10573a7
push esi
mov cl, byte [edx]
dec dword [ebp + 8]
movzx ecx, cl
mov esi, ecx
xor esi, eax
and esi, 0xf
shr eax, 4
xor eax, dword [esi*4 + 0x10dce28]
shr ecx, 4
mov esi, eax
and esi, 0xf
xor ecx, esi
shr eax, 4
xor eax, dword [ecx*4 + 0x10dce28]
inc edx
cmp dword [ebp + 8], 0
jne 0x1057372
pop esi
not eax
pop ebp
ret

Function at 0x1058ff2
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
xor ebx, ebx
push edi
cmp ecx, ebx
je 0x1059017
cmp dword [ecx + 0x38], ebx
je 0x1059017
cmp eax, dword [ecx + 0x10]
jae 0x1059017
cmp dword [ecx + 0x14], 1
jne 0x1059017
mov edx, dword [ecx + 0x38]
mov edi, dword [edx + 0x10]
mov edi, dword [edi + eax*4]
add edi, dword [edx]
jmp 0x1059019
xor edi, edi
cmp edi, ebx
je 0x10590fc
cmp esi, ebx
je 0x10590fc
mov dword [esi], eax
mov ecx, dword [ecx + 0x38]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ecx + eax*4]
mov dword [esi + 4], eax
mov ax, word [edi + 4]
mov word [esi + 8], ax
mov ax, word [edi + 6]
mov word [esi + 0xa], ax
mov ax, word [edi + 8]
mov word [esi + 0xc], ax
mov ax, word [edi + 0xa]
mov word [esi + 0xe], ax
movzx eax, word [edi + 0xe]
movzx edx, word [edi + 0xc]
call fcn.0105879b
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edi + 0x18]
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov ax, word [edi + 0x24]
mov word [esi + 0x30], ax
mov eax, dword [edi + 0x26]
mov dword [esi + 0x34], eax
mov eax, dword [edi + 0x2a]
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
movzx ebx, word [edi + 0x1c]
mov eax, 0x103
cmp ebx, eax
jb 0x10590a8
mov ebx, eax
push ebx
lea eax, [edi + 0x2e]
push eax
lea eax, [esi + 0x44]
push eax
call fcn.01097a10
mov byte [ebx + esi + 0x44], 0
movzx ebx, word [edi + 0x20]
mov eax, 0xff
add esp, 0xc
cmp ebx, eax
jb 0x10590cd
mov ebx, eax
mov dword [esi + 0x40], ebx
movzx eax, word [edi + 0x1e]
movzx ecx, word [edi + 0x1c]
add eax, edi
lea eax, [ecx + eax + 0x2e]
push ebx
push eax
lea eax, [esi + 0x148]
push eax
call fcn.01097a10
xor eax, eax
add esp, 0xc
mov byte [ebx + esi + 0x148], 0
inc eax
jmp 0x10590fe
xor eax, eax
pop edi
pop ebx
ret
Function at 0x1059dce
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3804], 1
jne 0x1059e53
or dword [0x10f3804], 1
mov dword [0x10f2588], 0xb8bdb592
mov dword [0x10f258c], 0xa0f4b0b1
mov dword [0x10f2590], 0xa6b7f4bb
mov dword [0x10f2594], 0xb1a0b5b1
mov dword [0x10f2598], 0xb5a1b8f4
mov dword [0x10f259c], 0xb5a0a7f4
mov dword [0x10f25a0], 0xfcf4b1a0
mov dword [0x10f25a4], 0xbfa6bba3
mov dword [0x10f25a8], 0xa0f4a6b1
mov dword [0x10f25ac], 0xb5b1a6bc
mov dword [0x10f25b0], 0xf4eefdb0
mov byte [0x10f25b4], 0xd4
xor eax, eax
mov cl, byte [eax + 0x10f2588]
xor cl, 0xd4
mov byte [eax + 0x10f2650], cl
inc eax
cmp eax, 0x2d
jb 0x1059e55
mov eax, 0x10f2650
ret

Function at 0x1059e70
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f37f4], 1
jne 0x1059ed7
or dword [0x10f37f4], 1
mov dword [0x10f25c4], 0xb1f4bb9a
mov dword [0x10f25c8], 0xa6bba6a6
mov dword [0x10f25cc], 0xa7b1b9f4
mov dword [0x10f25d0], 0xb1b3b5a7
mov dword [0x10f25d4], 0xa0b1a6f4
mov dword [0x10f25d8], 0xb1baa6a1
mov dword [0x10f25dc], 0xadb6f4b0
mov dword [0x10f25e0], 0xb6bbbef4
mov byte [0x10f25e4], 0xd4
xor eax, eax
mov cl, byte [eax + 0x10f25c4]
xor cl, 0xd4
mov byte [eax + 0x10f268c], cl
inc eax
cmp eax, 0x21
jb 0x1059ed9
mov eax, 0x10f268c
ret

Function at 0x1059ef4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f37e8], 1
jne 0x1059f5d
or dword [0x10f37e8], 1
mov dword [0x10f2610], 0xf4b5a198
mov dword [0x10f2614], 0xbba6a6b1
mov dword [0x10f2618], 0xa1a6f4a6
mov dword [0x10f261c], 0xbabdbaba
mov dword [0x10f2620], 0xa6b1f4b3
mov dword [0x10f2624], 0xf4a6bba6
mov dword [0x10f2628], 0xb0bab5bc
mov dword [0x10f262c], 0xeea6b1b8
mov word [0x10f2630], 0xd4f4
xor eax, eax
mov cl, byte [eax + 0x10f2610]
xor cl, 0xd4
mov byte [eax + 0x10f26d8], cl
inc eax
cmp eax, 0x22
jb 0x1059f5f
mov eax, 0x10f26d8
ret

Function at 0x1059f7a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f37e4], 1
jne 0x1059fcc
or dword [0x10f37e4], 1
mov dword [0x10f2634], 0x98b5a1b8
mov dword [0x10f2638], 0xb5bbb88b
mov dword [0x10f263c], 0xa6a0a7b0
mov dword [0x10f2640], 0xf4b3babd
mov dword [0x10f2644], 0xb8bdb5b2
mov word [0x10f2648], 0xb0b1
mov byte [0x10f264a], 0xd4
xor eax, eax
mov cl, byte [eax + 0x10f2634]
xor cl, 0xd4
mov byte [eax + 0x10f26fc], cl
inc eax
cmp eax, 0x17
jb 0x1059fce
mov eax, 0x10f26fc
ret
Function at 0x105ad72
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10bb758
call fcn.010ba668
sub esp, 0xb0
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ebx
push ebx
push 0x1300
call dword [0x10c3130]
test eax, eax
jne 0x105adba
call fcn.0105af13
mov ecx, dword [ebp + 8]
push eax
call fcn.01036ac7
mov eax, dword [ebp + 8]
jmp 0x105af04
test byte [0x10f37d8], 1
jne 0x105addb
or dword [0x10f37d8], 1
mov dword [0x10f2738], 0xf5dfd8dc
mov byte [0x10f273c], 0xd5
xor eax, eax
mov cl, byte [eax + 0x10f2738]
xor cl, 0xd5
mov byte [eax + 0x10f2f44], cl
inc eax
cmp eax, 5
jb 0x105addd
push 0xf
mov esi, 0x10f2f44
pop edi
mov eax, esi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x48], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x105ae08
sub eax, ecx
push eax
push esi
lea ecx, [ebp - 0x48]
call fcn.01034c54
mov dword [ebp - 4], ebx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.01034cc9
lea eax, [ebp - 0x2c]
push eax
lea edi, [ebp - 0x48]
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.0106073b
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.01034cea
push ebx
push 1
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.01034cea
push dword [ebp - 0x10]
call dword [0x10c30e0]
push ebx
push dword [ebp + 0xc]
lea esi, [ebp - 0xb8]
call fcn.0105b25e
pop ecx
pop ecx
push eax
mov byte [ebp - 4], 5
call fcn.0105af7c
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.01036b04
add esp, 0xc
push 0x10de294
push eax
lea eax, [ebp - 0x9c]
push eax
mov byte [ebp - 4], 6
call fcn.0103d65f
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 7
call fcn.0103b562
push ebx
push 1
lea ecx, [ebp - 0x9c]
call fcn.01034cea
push ebx
push 1
lea ecx, [ebp - 0x80]
call fcn.01034cea
push ebx
push 1
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 4
call fcn.01034cea
mov edi, dword [ebp + 8]
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
call fcn.01034c0a
push ebx
push 1
mov ecx, esi
call fcn.01034cea
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x105af13
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f37dc], 1
jne 0x105af5f
or dword [0x10f37dc], 1
mov dword [0x10f2720], 0xb0a7bb80
mov dword [0x10f2724], 0xbbb2bab6
mov dword [0x10f2728], 0xb1b0afbc
mov dword [0x10f272c], 0xa7a7b0f5
mov dword [0x10f2730], 0xb6f5a7ba
mov dword [0x10f2734], 0xd5b0b1ba
xor eax, eax
mov cl, byte [eax + 0x10f2720]
xor cl, 0xd5
mov byte [eax + 0x10f2f2c], cl
inc eax
cmp eax, 0x18
jb 0x105af61
mov eax, 0x10f2f2c
ret
Function at 0x105af7c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f37d4], 1
jne 0x105afba
or dword [0x10f37d4], 1
mov dword [0x10f2740], 0xa7b0fdf5
mov dword [0x10f2744], 0xf5a7baa7
mov dword [0x10f2748], 0xb0b1bab6
mov word [0x10f274c], 0xf5ef
mov byte [0x10f274e], 0xd5
xor eax, eax
mov cl, byte [eax + 0x10f2740]
xor cl, 0xd5
mov byte [eax + 0x10f2f4c], cl
inc eax
cmp eax, 0xf
jb 0x105afbc
mov eax, 0x10f2f4c
ret

Function at 0x105b25e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
and dword [ebp - 4], 0
test byte [0x10f37d0], 1
jne 0x105b289
or dword [0x10f37d0], 1
mov dword [0x10f2750], 0xb1b9b9f0
mov byte [0x10f2754], 0xd5
xor eax, eax
mov cl, byte [eax + 0x10f2750]
xor cl, 0xd5
mov byte [eax + 0x10f2f5c], cl
inc eax
cmp eax, 5
jb 0x105b28b
push dword [ebp + 0xc]
lea eax, [ebp - 0x48]
push dword [ebp + 8]
push 0x10f2f5c
push eax
call fcn.01060794
and dword [esi + 0x10], 0
add esp, 0x10
lea eax, [ebp - 0x48]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.01034cc9
mov eax, esi
leave
ret

Function at 0x105b42d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f37cc], 1
jne 0x105b489
or dword [0x10f37cc], 1
mov dword [0x10f2758], 0x98a1b092
mov dword [0x10f275c], 0xb9a0b1ba
mov dword [0x10f2760], 0xb9bc93b0
mov dword [0x10f2764], 0xb8b49bb0
mov dword [0x10f2768], 0xb4b3f5b0
mov dword [0x10f276c], 0xb1b0b9bc
mov word [0x10f2770], 0xf5ef
mov byte [0x10f2772], 0xd5
xor eax, eax
mov cl, byte [eax + 0x10f2758]
xor cl, 0xd5
mov byte [eax + 0x10f2f64], cl
inc eax
cmp eax, 0x1b
jb 0x105b48b
mov eax, 0x10f2f64
ret

Function at 0x105b4a6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f37c8], 1
jne 0x105b503
or dword [0x10f37c8], 1
mov dword [0x10f2774], 0x96a1b086
mov dword [0x10f2778], 0xb0a7a7a0
mov dword [0x10f277c], 0xbc91a1bb
mov dword [0x10f2780], 0xa1b6b0a7
mov dword [0x10f2784], 0xf5aca7ba
mov dword [0x10f2788], 0xb9bcb4b3
mov dword [0x10f278c], 0xf5efb1b0
mov byte [0x10f2790], 0xd5
xor eax, eax
mov cl, byte [eax + 0x10f2774]
xor cl, 0xd5
mov byte [eax + 0x10f2f80], cl
inc eax
cmp eax, 0x1d
jb 0x105b505
mov eax, 0x10f2f80
ret

Function at 0x105b617
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f37c4], 1
jne 0x105b674
or dword [0x10f37c4], 1
mov dword [0x10f2794], 0x96a1b092
mov dword [0x10f2798], 0xb0a7a7a0
mov dword [0x10f279c], 0xbc91a1bb
mov dword [0x10f27a0], 0xa1b6b0a7
mov dword [0x10f27a4], 0xf5aca7ba
mov dword [0x10f27a8], 0xb9bcb4b3
mov dword [0x10f27ac], 0xf5efb1b0
mov byte [0x10f27b0], 0xd5
xor eax, eax
mov cl, byte [eax + 0x10f2794]
xor cl, 0xd5
mov byte [eax + 0x10f2fa0], cl
inc eax
cmp eax, 0x1d
jb 0x105b676
mov eax, 0x10f2fa0
ret
Function at 0x105b82f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f37c0], 1
jne 0x105b99c
or dword [0x10f37c0], 1
mov eax, 0x9189
mov ecx, eax
mov word [0x10f27b8], cx
mov word [0x10f27ba], cx
add ecx, 0xfffffffd
mov word [0x10f27bc], cx
lea ecx, [eax + 0x18]
mov word [0x10f27be], cx
add ecx, 6
lea edx, [eax + 0x33]
mov word [0x10f27c0], cx
push ebx
mov ecx, edx
mov word [0x10f27c2], cx
dec ecx
push esi
mov esi, ecx
lea ecx, [eax + 0x2a]
mov word [0x10f27c4], si
lea esi, [eax + 0x29]
mov word [0x10f27c6], si
mov word [0x10f27d4], cx
add esi, 8
add edx, 0xfffffffd
mov ecx, esi
push edi
lea edi, [eax + 0x27]
mov word [0x10f27d6], cx
mov ecx, eax
mov word [0x10f27cc], dx
mov edx, edi
mov word [0x10f27d8], cx
mov word [0x10f27da], cx
add ecx, 0x5c
mov word [0x10f27ce], dx
mov edx, ecx
mov word [0x10f27dc], dx
lea edx, [eax + 0x58]
mov ebx, edx
mov word [0x10f27de], bx
mov ebx, ecx
mov word [0x10f27e0], bx
lea ebx, [eax + 0x63]
mov word [0x10f27ee], ax
mov word [0x10f27e2], bx
mov ebx, ecx
mov ecx, eax
add eax, 0xfffffffc
mov word [0x10f27f0], ax
lea eax, [ecx + 0x28]
mov word [0x10f27f6], ax
add eax, 0xffffffef
mov word [0x10f27f8], ax
lea eax, [ecx + 0x2d]
mov word [0x10f27fa], ax
add eax, 0xffffffeb
mov word [0x10f27fc], ax
lea eax, [ecx + 0x12]
mov word [0x10f27fe], ax
add eax, 0x19
pop edi
mov word [0x10f2800], ax
lea eax, [ecx + 0x4c]
pop esi
mov word [0x10f27e4], bx
mov dword [0x10f27c8], 0x91bc9193
mov dword [0x10f27d0], 0x91bb919c
mov word [0x10f27e6], dx
mov dword [0x10f27e8], 0x91e59197
mov word [0x10f27ec], cx
mov dword [0x10f27f2], 0x91ba91a7
mov dword [0x10f2802], 0x91b091b8
mov word [0x10f2806], ax
pop ebx
xor eax, eax
mov ecx, 0x91d5
xor cx, word [eax + 0x10f27b8]
add eax, 2
mov word [eax + 0x10f2fbe], cx
cmp eax, 0x50
jb 0x105b99e
mov eax, 0x10f2fc0
ret

Function at 0x105b9bf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f37bc], 1
jne 0x105ba14
or dword [0x10f37bc], 1
mov dword [0x10f2808], 0xa3f5ba9b
mov dword [0x10f280c], 0xbca6a7b0
mov dword [0x10f2810], 0xbcf5bbba
mov dword [0x10f2814], 0xf5bab3bb
mov dword [0x10f2818], 0xbcb4a3b4
mov dword [0x10f281c], 0xb9b7b4b9
mov word [0x10f2820], 0xd5b0
xor eax, eax
mov cl, byte [eax + 0x10f2808]
xor cl, 0xd5
mov byte [eax + 0x10f3010], cl
inc eax
cmp eax, 0x1a
jb 0x105ba16
mov eax, 0x10f3010
ret

Function at 0x105bc03
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f37b8], 1
jne 0x105bc58
or dword [0x10f37b8], 1
mov dword [0x10f2824], 0xa3f5ba9b
mov dword [0x10f2828], 0xbca6a7b0
mov dword [0x10f282c], 0xbcf5bbba
mov dword [0x10f2830], 0xf5bab3bb
mov dword [0x10f2834], 0xbcb4a3b4
mov dword [0x10f2838], 0xb9b7b4b9
mov word [0x10f283c], 0xd5b0
xor eax, eax
mov cl, byte [eax + 0x10f2824]
xor cl, 0xd5
mov byte [eax + 0x10f302c], cl
inc eax
cmp eax, 0x1a
jb 0x105bc5a
mov eax, 0x10f302c
ret