joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004ee10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100e41c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, 0x8f
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x100d1dd8]
xor al, dl
mov byte [ebp + ecx - 0x28], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xb
jb 0x1004ee30
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 0x1d], 0
call esi
test eax, eax
je 0x1004f036
mov edx, 0x8f
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ecx + 0x100d1dd8]
xor al, dl
mov byte [ebp + ecx - 0x28], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xb
jb 0x1004ee70
push edi
lea eax, [ebp - 0x28]
mov byte [ebp - 0x1d], 0
push eax
call esi
mov edi, eax
mov dword [ebp - 0x24], 0x74696e49
mov byte [ebp - 0x20], 0
mov edx, 0x8f
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x100d1dd8]
xor al, dl
mov byte [ebp + ecx - 0x14], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xb
jb 0x1004eeb0
lea eax, [ebp - 0x24]
mov byte [ebp - 9], 0
push eax
lea eax, [ebp - 0x14]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test edi, edi
je 0x1004f035
test eax, eax
je 0x1004f035
cmp eax, edi
je 0x1004f035
push 0xff
push 0xe
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], 0xffffffe8
mov ecx, edi
mov dword [ebp - 0x10], 0x5de58bff
mov dword [ebp - 0xc], 0xffffa1c3
mov word [ebp - 8], 0xffff
call fcn.10086180
add esp, 8
mov dword [0x101ef090], eax
test eax, eax
je 0x1004ef4f
add eax, 9
mov edx, 0x1004ede0
push 5
mov dword [0x101ef090], eax
lea ecx, [eax + 5]
mov dword [0x101ef050], ecx
mov ecx, eax
call fcn.10086030
add esp, 4
push 0xff
push 9
lea edx, [ebp - 0x28]
mov dword [ebp - 0x28], 0x83ec8b55
mov ecx, edi
mov dword [ebp - 0x24], 0xec83f8e4
mov byte [ebp - 0x20], 0x20
call fcn.10086180
add esp, 8
test eax, eax
je 0x1004eff8
push ebx
push 0xff
push 0xf
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], 0xffffffe8
mov ecx, edi
mov dword [ebp - 0x14], 0x4478bff
mov dword [ebp - 0x10], 0xf09f8966
mov word [ebp - 0xc], 0
mov byte [ebp - 0xa], 0
call fcn.10086180
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x1004eff7
mov esi, dword [ebx + 1]
lea ecx, [ebx + 0xc]
add ecx, esi
lea edx, [ebx + 5]
mov dword [0x101ef014], ecx
add edx, esi
push ecx
mov ecx, fcn.1004ed00
add ecx, 0x55
call fcn.10086090
mov ecx, fcn.1004ed70
lea edx, [ebx + 5]
add ecx, 0x55
add edx, esi
call fcn.10086090
push 5
mov edx, 0x100d1de4
mov ecx, ebx
call fcn.10085f50
add esp, 8
pop ebx
push 0xff
push 0x16
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x83ec8b55
mov ecx, edi
mov dword [ebp - 0x18], 0xffa110ec
mov dword [ebp - 0x14], 0x33ffffff
mov dword [ebp - 0x10], 0xffff89ff
mov dword [ebp - 0xc], 0xc110ff8b
mov word [ebp - 8], 0x1fff
call fcn.10086180
add esp, 8
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret
Function at 0x1004f130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b70d8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x100e41c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x10232de5], 0
jne 0x1004f1f1
push 0xff
push 0xf
lea edx, [ebp - 0x20]
mov byte [0x10232de5], 1
mov ecx, 0x400000
mov dword [ebp - 0x20], 0x51ec8b55
mov dword [ebp - 0x1c], 0xffffffa1
mov dword [ebp - 0x18], 0xac888aff
mov word [ebp - 0x14], 0
mov byte [ebp - 0x12], 0
call fcn.10086180
add esp, 8
mov dword [0x101eeff8], eax
test eax, eax
je 0x1004f1bd
mov eax, dword [eax + 0x2c]
mov dword [0x101ef024], eax
add eax, 0xfffffffc
mov dword [0x101ef134], eax
jmp 0x1004f20a
mov edx, 0x12
xor ecx, ecx
mov al, byte [ecx + str.afvJ.ZXCZ_]
xor al, dl
mov byte [ebp + ecx - 0x20], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xe
jb 0x1004f1c4
mov byte [ebp - 0x12], 0
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 0
call fcn.10086360
jmp 0x1004f20a
mov eax, dword [0x101ef024]
push edx
push ecx
mov dword [eax], ecx
mov eax, dword [0x101ef134]
mov dword [eax], edx
call dword [0x101eeff8]
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret
Function at 0x10050ac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x100e41c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, 0x1d
xor eax, eax
push ebx
nop
mov bl, byte [eax + str.PkwN]
xor bl, cl
inc ecx
mov byte [ebp + eax - 0x48], bl
inc eax
movzx ecx, cl
cmp eax, 0xc
jb 0x10050ae0
lea eax, [ebp - 0x48]
mov byte [ebp - 0x3c], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
pop ebx
sete al
test al, al
je 0x10050b40
push dword [0x101ef918]
mov eax, 0x404b90
lea ecx, [ebp - 0x38]
push 0xc1
call eax
push edi
mov edi, 0x4050d0
lea ecx, [ebp - 0x38]
call edi
push esi
lea ecx, [ebp - 0x38]
call edi
push 0
push 0
lea ecx, [ebp - 0x38]
call fcn.10062780
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret
Function at 0x100535e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b7278
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x100e41c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xff
push 0xf
lea edx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x2e68ff6a
mov ecx, 0x400000
mov dword [ebp - 0x1c], 0xe800001a
mov dword [ebp - 0x18], 0xffffffff
mov word [ebp - 0x14], 0xc88b
mov byte [ebp - 0x12], 0xe8
call fcn.10086180
mov esi, eax
add esp, 8
test esi, esi
je 0x1005368a
lea edx, [esi + 7]
mov dword [0x101ef174], edx
mov ecx, dword [edx + 1]
add ecx, 5
add ecx, edx
mov dword [0x101ef174], ecx
lea ecx, [esi + 0xe]
mov dword [0x101ef160], ecx
mov eax, dword [ecx + 1]
add ecx, 5
add eax, ecx
lea ecx, [esi + 0x15]
mov dword [0x101ef160], eax
mov dword [0x101eefcc], ecx
mov eax, dword [ecx + 1]
add eax, 5
add eax, ecx
mov dword [0x101eefcc], eax
jmp 0x100536bc
mov edx, 0xc2
xor eax, eax
mov cl, byte [eax + 0x100d272c]
xor cl, dl
mov byte [ebp + eax - 0x24], cl
inc eax
lea ecx, [edx + 1]
movzx edx, cl
cmp eax, 0x12
jb 0x10053691
mov byte [ebp - 0x12], 0
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.10086360
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret
Function at 0x100621c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b7738
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100e41c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xff
push 0x1a
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0xffffffe8
mov ecx, 0x400000
mov dword [ebp - 0x28], 0xcc483ff
mov dword [ebp - 0x24], 0xc25de58b
mov dword [ebp - 0x20], 0xcccc0008
mov dword [ebp - 0x1c], 0xcccccccc
mov dword [ebp - 0x18], 0xcccccccc
mov word [ebp - 0x14], 0x55cc
call fcn.10086180
add esp, 8
mov dword [0x101eeef4], eax
test eax, eax
je 0x10062247
mov ecx, dword [eax + 1]
add eax, 5
add eax, ecx
mov dword [0x101eeef4], eax
jmp 0x1006227b
mov edx, 0x3c
xor ecx, ecx
nop
mov al, byte [ecx + str.on_b_]
xor al, dl
mov byte [ebp + ecx - 0x24], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0x11
jb 0x10062250
mov byte [ebp - 0x13], 0
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0
call fcn.10086360
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret
Function at 0x10068e50
Capabilities:
Check if file exists
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x100e41c4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x101ef05c], 0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
jne 0x10068f69
mov eax, str.DKMZY
lea ecx, [ebp - 0x34]
sub eax, 0x32634904
push eax
call fcn.1007cd60
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10068ef2
push 0xff
push 0x1d
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], 0x83d0458b
mov ecx, 0x400000
mov dword [ebp - 0x20], 0x458901c0
mov dword [ebp - 0x1c], 0xd07d83d0
mov dword [ebp - 0x18], 0xffffff04
mov dword [ebp - 0x14], 0xc7ffffff
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], 0xff
mov byte [ebp - 8], 0
call fcn.10086180
add esp, 8
mov dword [0x101ef05c], eax
test eax, eax
jne 0x10068ef2
mov ecx, str.SS4_Evil_Image_04_Add
call fcn.10086360
mov edx, 0x5e
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + 0x100d4e1c]
xor al, dl
mov byte [ebp + ecx - 0x34], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xc
jb 0x10068f00
lea eax, [ebp - 0x34]
mov byte [ebp - 0x28], 0
push eax
call esi
test eax, eax
je 0x10068f69
push 0xff
push 0xd
lea edx, [ebp - 0x34]
mov dword [ebp - 0x34], 0xff34ff83
mov ecx, 0x400000
mov dword [ebp - 0x30], 0xffffff89
mov dword [ebp - 0x2c], 0xff83ffff
mov byte [ebp - 0x28], 4
call fcn.10086180
add esp, 8
mov dword [0x101ef05c], eax
test eax, eax
jne 0x10068f69
mov ecx, str.SS4_Evil_Image_04_Add
call fcn.10086360
cmp byte [0x101ef916], 0
jne 0x10069013
mov edx, 0x5e
xor ecx, ecx
nop dword [eax]
mov al, byte [ecx + 0x100d4e1c]
xor al, dl
mov byte [ebp + ecx - 0x34], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xc
jb 0x10068f80
lea eax, [ebp - 0x34]
mov byte [ebp - 0x28], 0
push eax
call esi
test eax, eax
je 0x10069013
mov eax, dword [0x40003c]
mov esi, dword [eax + 0x40001c]
test esi, esi
je 0x1006900c
mov ecx, dword [0x10232058]
mov edx, 0x400003
xor edi, edi
mov al, 1
cmp byte [edx - 3], 0x99
movzx eax, al
cmovne eax, edi
cmp byte [edx - 2], 0xb9
movzx eax, al
cmovne eax, edi
cmp byte [edx - 1], 0xf
movzx eax, al
cmovne eax, edi
cmp byte [edx], 0
movzx eax, al
cmovne eax, edi
cmp byte [edx + 1], 0
jne 0x10069000
test al, al
je 0x10069000
lea eax, [edx - 2]
mov dword [ecx*4 + 0x10232148], eax
inc ecx
inc edx
sub esi, 1
jne 0x10068fc0
mov dword [0x10232058], ecx
mov byte [0x101ef916], 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret
Function at 0x10069350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x100e41c4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x101ef00c]
cmp dword [0x101ed414], esi
je 0x100693db
mov dword [0x101ed414], esi
mov edx, 0x35
xor ecx, ecx
nop
mov al, byte [ecx + 0x100d2540]
xor al, dl
mov byte [ebp + ecx - 0x120], al
inc ecx
lea eax, [edx + 1]
movzx edx, al
cmp ecx, 0xd
jb 0x10069380
lea eax, [esi + 1]
mov byte [ebp - 0x113], 0
push eax
push 0x101e6d7e
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.1003a9e0
push 0x101e6ef4
push 0x101e6ef0
mov edx, 0x101eeeec
lea ecx, [ebp - 0x110]
call fcn.1004cde0
add esp, 0x18
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret
Function at 0x1007b2b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b80e8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100e41c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1007b3de
cmp byte [ebx + 0x3d], 0
je 0x1007b3de
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x1007b309
xor al, al
jmp 0x1007b3e0
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.1007b140
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x1007b36f
sub eax, 1
je 0x1007b373
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x1007b3c6
xor bl, bl
jmp 0x1007b3c8
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x1007b3a8
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.100952dc
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x1007b36b
cmp byte [ebx + 0x3d], 0
je 0x1007b3c6
test esi, esi
jne 0x1007b331
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.1007b1d0
jmp 0x1007b32e
mov bl, 1
cmp ecx, 0x10
jb 0x1007b3da
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.1003b1b0
mov al, bl
jmp 0x1007b3e0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008d9f1
mov esp, ebp
pop ebp
ret
Function at 0x1007be10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b6ff6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x100e41c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1008e273
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.1008ca73
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1007cde0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xe
xor eax, eax
mov dl, byte [edi + eax - 0x431faf98]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xd
jb 0x1007cdf1
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007ce20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x1d
xor eax, eax
mov dl, byte [edi + eax + 0x3d1180]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xc
jb 0x1007ce31
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007ced0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x76
xor eax, eax
mov dl, byte [edi + eax - 0x42d7cba7]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xc
jb 0x1007cee1
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007d010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xd2
xor eax, eax
mov dl, byte [edi + eax + 0x7c238504]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xb
jb 0x1007d021
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007d560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x11
xor eax, eax
mov dl, byte [edi + eax + 0x53588f90]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xc
jb 0x1007d571
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x1007d620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xc4
xor eax, eax
mov dl, byte [edi + eax - 0x1bb2448b]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xd
jb 0x1007d631
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007d660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x60
xor eax, eax
mov dl, byte [edi + eax + 0x3516377a]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xc
jb 0x1007d671
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007d6a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xc2
xor eax, eax
mov dl, byte [edi + eax + 0x140316fd]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xc
jb 0x1007d6b1
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007d6e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x56
xor eax, eax
mov dl, byte [edi + eax - 0x1a7e42f1]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xc
jb 0x1007d6f1
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007d720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xc3
xor eax, eax
mov dl, byte [edi + eax - 0x7c8a2d4d]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xc
jb 0x1007d731
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007d760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x4e
xor eax, eax
mov dl, byte [edi + eax + 0xdbc9971]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xc
jb 0x1007d771
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007d7a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xb1
xor eax, eax
mov dl, byte [edi + eax + 0x4f93f29b]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xd
jb 0x1007d7b1
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007d7e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xdb
xor eax, eax
mov dl, byte [edi + eax + 0x20aecddc]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1c
jb 0x1007d7f1
pop edi
mov byte [esi + 0x1c], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x1007d820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0xe
xor eax, eax
mov dl, byte [edi + eax + 0x7a1cd17d]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x18
jb 0x1007d831
pop edi
mov byte [esi + 0x18], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007d860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x31
xor eax, eax
mov dl, byte [edi + eax + 0x30f27cc4]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x18
jb 0x1007d871
pop edi
mov byte [esi + 0x18], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007d8a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x8a
xor eax, eax
mov dl, byte [edi + eax - 0x3ff012b5]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x16
jb 0x1007d8b1
pop edi
mov byte [esi + 0x16], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007d8e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x7a
xor eax, eax
mov dl, byte [edi + eax + 0x4bc74036]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x12
jb 0x1007d8f1
pop edi
mov byte [esi + 0x12], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007d920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x27
xor eax, eax
mov dl, byte [edi + eax + 0x22dc9cfc]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x1e
jb 0x1007d931
pop edi
mov byte [esi + 0x1e], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007daa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x47
xor eax, eax
mov dl, byte [edi + eax + 0x448e8c0c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x14
jb 0x1007dab1
pop edi
mov byte [esi + 0x14], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007db30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x87
xor eax, eax
mov dl, byte [edi + eax + 0x1de0befe]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0xd
jb 0x1007db41
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
pop ebp
ret 4

Function at 0x1007dbf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, 0x2d
xor eax, eax
mov dl, byte [edi + eax - 0x73caf0e3]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
inc eax
movzx ecx, cl
cmp eax, 0x59
jb 0x1007dc01
pop edi
mov byte [esi + 0x59], 0
mov eax, esi
pop esi
pop ebp
ret 4