joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006dce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dce], 0
jne 0x10006e84
push ebx
push esi
mov esi, dword [0x100c47a0]
push 0xf
pop ecx
push 7
pop eax
mov byte [ebp - 0xf], al
lea eax, [esi + 1]
imul eax, esi
cdq
idiv ecx
xor ebx, ebx
mov word [ebp - 0x14], 0x1f27
mov byte [ebp - 0x12], 0x18
mov byte [ebp - 0x11], cl
mov byte [ebp - 0x10], cl
mov dword [ebp - 0xe], 0x8081c3d
mov dword [ebp - 0xa], 0x602
cmp edx, 4
jne 0x10006e47
push 0xc5
push 0xc4
push str._d__d_n
call fcn.1006dc67
mov esi, dword [0x100c47a0]
add esp, 0xc
mov al, byte [ebx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ebx - 0x14]
inc ebx
mov byte [ebx + 0x100be2e3], al
cmp ebx, 0xd
jl 0x10006e47
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
push 7
cdq
pop ecx
idiv ecx
mov byte [0x100c4dce], 1
cmp edx, 2
jne 0x10006e82
dec esi
mov dword [0x100c47a0], esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be2e4
call fcn.1006d48b
leave
ret

Function at 0x10006e95
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4de8], 0
jne 0x10006ee1
mov dword [ebp - 0x10], 0xf181f27
mov dword [ebp - 0xc], 0xd3a070f
mov word [ebp - 8], 0xf
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be43f], al
cmp ecx, 9
jl 0x10006ec4
mov byte [0x100c4de8], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be440
call fcn.1006d48b
leave
ret

Function at 0x10006ef2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e32], 0
jne 0x10006fb1
push ebx
push esi
mov esi, dword [0x100c47a0]
push 0x15
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
pop ecx
idiv ecx
xor ebx, ebx
mov dword [ebp - 0x10], 0xf181f27
mov dword [ebp - 0xc], 0x193a070f
mov word [ebp - 8], 0xc0f
mov byte [ebp - 6], bl
cmp edx, 0xe
jne 0x10006f92
movsd xmm3, qword [0x1008ac28]
movd xmm4, esi
xorps xmm2, xmm2
cvtdq2pd xmm4, xmm4
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x10006f78
subsd xmm2, xmm3
divsd xmm3, qword [0x1008ac40]
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmmword [0x1008ac20]
ja 0x10006f5a
mov al, byte [ebx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ebx - 0x10]
inc ebx
mov byte [ebx + 0x100be823], al
cmp ebx, 0xa
jl 0x10006f92
pop esi
mov byte [0x100c4e32], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be824
call fcn.1006d48b
leave
ret
Function at 0x10006fc2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4de0], 0
jne 0x10007011
xor ecx, ecx
mov dword [ebp - 0x10], 0xf181f27
mov dword [ebp - 0xc], 0x538070f
mov word [ebp - 8], 0x1e08
mov byte [ebp - 6], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be3d3], al
cmp ecx, 0xa
jl 0x10006ff4
mov byte [0x100c4de0], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be3d4
call fcn.1006d48b
leave
ret

Function at 0x10007022
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4df5], 0
jne 0x1000706f
mov dword [ebp - 0x10], 0xf181f27
mov dword [ebp - 0xc], 0xd39070f
mov dword [ebp - 8], 0x10a19
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be4e7], al
cmp ecx, 0xb
jl 0x10007052
mov byte [0x100c4df5], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be4e8
call fcn.1006d48b
leave
ret

Function at 0x10007080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e1d], 0
jne 0x100070f8
xor ecx, ecx
mov dword [ebp - 0x14], 0xf181f27
mov dword [ebp - 0x10], 0x339070f
mov dword [ebp - 0xc], 0x110c0f02
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100be703], al
cmp ecx, 0xc
jl 0x100070b3
push esi
mov esi, dword [0x100c47a0]
push edi
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
push 0xd
pop edi
cdq
idiv edi
pop edi
mov byte [0x100c4e1d], 1
cmp edx, 4
cmove esi, ecx
mov dword [0x100c47a0], esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be704
call fcn.1006d48b
leave
ret

Function at 0x10007109
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4de4], 0
jne 0x10007180
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], 0xf181f27
mov dword [ebp - 0xc], 0x2a31070f
mov word [ebp - 8], 0x70c
mov byte [ebp - 6], bl
call fcn.1000d2c2
test al, al
jne 0x10007162
push esi
push edi
mov edi, dword [0x100c47a0]
mov esi, ebx
mov ebx, edi
inc esi
dec ebx
cmp esi, 0x8e
jb 0x10007154
pop edi
xor ebx, ebx
pop esi
mov al, byte [ebx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ebx - 0x10]
inc ebx
mov byte [ebx + 0x100be40f], al
cmp ebx, 0xa
jl 0x10007162
mov byte [0x100c4de4], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be410
call fcn.1006d48b
leave
ret
Function at 0x10007191
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4de3], 0
jne 0x1000724c
push ebx
mov dword [ebp - 0x14], 0xf181f27
mov dword [ebp - 0x10], 0x2a31070f
mov dword [ebp - 0xc], 0xd0c001f
xor ebx, ebx
mov word [ebp - 8], 0x16
call fcn.10003e36
test al, al
jne 0x1000722e
push esi
mov esi, dword [0x100c47a0]
jmp 0x10007229
mov ecx, esi
and ecx, 0x80000001
jns 0x100071ed
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x100071fa
mov eax, esi
cdq
sub eax, edx
mov esi, eax
sar esi, 1
jmp 0x10007201
lea esi, [esi*2 + 1]
mov eax, esi
push 3
cdq
pop ecx
idiv ecx
mov dword [0x100c47a0], esi
sub edx, ebx
je 0x1000721c
dec edx
dec edx
je 0x1000721f
dec edx
je 0x10007220
jmp 0x10007229
add esi, 2
inc esi
add esi, 2
mov dword [0x100c47a0], esi
test esi, esi
jne 0x100071de
pop esi
mov al, byte [ebx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ebx - 0x14]
inc ebx
mov byte [ebx + 0x100be3ff], al
cmp ebx, 0xd
jl 0x1000722e
mov byte [0x100c4de3], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be400
call fcn.1006d48b
leave
ret

Function at 0x1000725d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4df9], 0
jne 0x100072d0
push ebx
call fcn.10003d9b
xor ebx, ebx
test al, al
jne 0x10007297
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x14], 0xf181f27
mov dword [ebp - 0x10], 0x2131070f
mov dword [ebp - 0xc], 0x6020702
mov word [ebp - 8], 0xb
mov al, byte [ebx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ebx - 0x14]
inc ebx
mov byte [ebx + 0x100be51b], al
cmp ebx, 0xd
jl 0x100072b2
mov byte [0x100c4df9], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be51c
call fcn.1006d48b
leave
ret

Function at 0x100072e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10003e54
xor edx, edx
inc edx
test al, al
jne 0x1000730c
mov eax, dword [0x100c47a0]
test eax, eax
cmove eax, edx
mov dword [0x100c47a0], eax
cmp byte [0x100c4e3f], 0
jne 0x10007341
mov dword [ebp - 0xc], 0xf181f27
mov dword [ebp - 8], 0x191b1b
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0xc]
inc ecx
mov byte [ecx + 0x100be8cb], al
cmp ecx, 7
jl 0x10007325
mov byte [0x100c4e3f], dl
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be8cc
call fcn.1006d48b
leave
ret
Function at 0x10007352
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x100c47a0]
push edi
lea eax, [esi + 1]
imul eax, esi
push 0xb
cdq
pop ecx
idiv ecx
xor ebx, ebx
cmp edx, 4
jne 0x1000739e
mov edi, ebx
test esi, esi
je 0x10007396
mov eax, esi
mov ecx, esi
cdq
sub eax, edx
and ecx, 1
mov esi, eax
add edi, ecx
sar esi, 1
jne 0x10007384
mov esi, edi
mov dword [0x100c47a0], esi
cmp byte [0x100c4e16], bl
jne 0x1000744b
mov eax, esi
imul eax, esi
imul eax, esi
push 0x15
cdq
pop ecx
idiv ecx
cmp edx, 0x12
jne 0x10007413
mov eax, esi
cdq
sub eax, edx
mov edi, eax
mov dword [ebp - 0x18], 0x64
mov eax, dword [ebp - 0x18]
mov ecx, ebx
sar edi, 1
test edi, edi
jle 0x1000740e
mov eax, esi
cdq
and edx, 3
add eax, edx
sar eax, 2
mov edx, ebx
mov dword [ebp - 0x1c], eax
mov ebx, edi
mov dword [ebp - 0x20], edi
test eax, eax
jle 0x10007401
mov ebx, dword [ebp - 0x1c]
mov eax, edx
add dword [ebp - 0x18], eax
dec eax
dec ebx
jne 0x100073f4
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
add edx, ecx
dec ebx
mov dword [ebp - 0x20], ebx
jne 0x100073eb
mov eax, dword [ebp - 0x18]
xor ebx, ebx
inc ecx
cmp ecx, eax
jl 0x100073d2
mov dword [ebp - 0x14], 0x121e0329
mov dword [ebp - 0x10], 0x92a0609
mov dword [ebp - 0xc], 0x4e1a050c
mov word [ebp - 8], 0x40
mov al, byte [ebx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ebx - 0x14]
inc ebx
mov byte [ebx + 0x100be69b], al
cmp ebx, 0xd
jl 0x1000742e
mov byte [0x100c4e16], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0x100be69c
pop ebx
call fcn.1006d48b
leave
ret

Function at 0x1000745f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e03], 0
jne 0x100074a7
xor ecx, ecx
mov dword [ebp - 0xc], 0xb181f27
mov word [ebp - 8], 0xc05
mov byte [ebp - 6], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0xc]
inc ecx
mov byte [ecx + 0x100be59f], al
cmp ecx, 6
jl 0x1000748a
mov byte [0x100c4e03], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be5a0
call fcn.1006d48b
leave
ret
Function at 0x100074b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e27], 0
jne 0x10007537
call fcn.10003db9
test al, al
jne 0x10007507
mov eax, dword [0x100c47a0]
push 0x64
cdq
pop ecx
idiv ecx
xor ecx, ecx
push 4
lea eax, [edx + 0x2f4]
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1006c443
push eax
call fcn.1006dc4d
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 0x10], 0x1f264b26
mov dword [ebp - 0xc], 0x1f0d1d1e
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be78b], al
cmp ecx, 8
jl 0x1000751a
mov byte [0x100c4e27], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be78c
call fcn.1006d48b
leave
ret

Function at 0x10007548
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e40], 0
jne 0x1000758e
mov dword [ebp - 0xc], 0x14132a26
mov dword [ebp - 8], 0x1d1705
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0xc]
inc ecx
mov byte [ecx + 0x100be8d3], al
cmp ecx, 7
jl 0x10007571
mov byte [0x100c4e40], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be8d4
call fcn.1006d48b
leave
ret

Function at 0x1000759f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
call fcn.10003e78
xor ebx, ebx
test al, al
jne 0x100075c7
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
cmp byte [0x100c4df7], bl
jne 0x100075fd
mov dword [ebp - 0x10], 0x1f265424
mov dword [ebp - 0xc], 0x1f0d0605
mov byte [ebp - 8], bl
mov al, byte [ebx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ebx - 0x10]
inc ebx
mov byte [ebx + 0x100be503], al
cmp ebx, 8
jl 0x100075e0
mov byte [0x100c4df7], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be504
pop ebx
call fcn.1006d48b
leave
ret

Function at 0x1000760f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e18], 0
jne 0x1000765e
xor ecx, ecx
mov dword [ebp - 0x10], 0x30e0f1d
mov dword [ebp - 0xc], 0x1a0f0703
mov word [ebp - 8], 0x1b08
mov byte [ebp - 6], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be6bb], al
cmp ecx, 0xa
jl 0x10007641
mov byte [0x100c4e18], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be6bc
call fcn.1006d48b
leave
ret
Function at 0x1000766f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e08], 0
jne 0x100076dc
call fcn.10003e36
test al, al
jne 0x100076ac
push esi
xor esi, esi
xor eax, eax
push 0x47
inc esi
inc eax
pop edx
dec edx
lea ecx, [eax + esi]
lea esi, [eax]
mov eax, ecx
jns 0x1000769b
mov dword [0x100c47a0], ecx
pop esi
xor ecx, ecx
mov dword [ebp - 0x10], 0x14130a18
mov dword [ebp - 0xc], 0x1b011a14
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be5db], al
cmp ecx, 8
jl 0x100076bf
mov byte [0x100c4e08], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be5dc
call fcn.1006d48b
leave
ret

Function at 0x100076ed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e11], 0
jne 0x10007758
mov dword [ebp - 0x18], 0x3060318
mov dword [ebp - 0x14], 0x307000f
mov dword [ebp - 0x10], 0xc1d4403
mov dword [ebp - 0xc], 0xf040f1d
mov word [ebp - 8], 0x12
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x18]
inc ecx
mov byte [ecx + 0x100be64f], al
cmp ecx, 0x11
jl 0x1000772a
mov byte [0x100c4e11], 1
call fcn.10003e36
test al, al
jne 0x10007758
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be650
call fcn.1006d48b
leave
ret

Function at 0x10007769
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e21], 0
jne 0x100077c4
call fcn.10003edc
xor ecx, ecx
mov dword [ebp - 0x14], 0x3060318
mov dword [ebp - 0x10], 0x307000f
mov dword [ebp - 0xc], 0xc1d4403
mov word [ebp - 8], 0xf1d
mov byte [ebp - 6], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100be737], al
cmp ecx, 0xe
jl 0x100077a7
mov byte [0x100c4e21], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be738
call fcn.1006d48b
leave
ret

Function at 0x100077d5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e3b], 0
jne 0x10007828
mov dword [ebp - 0x14], 0x1519071b
mov dword [ebp - 0x10], 0x81c1b1b
mov dword [ebp - 0xc], 0x6001f40
xor ecx, ecx
mov word [ebp - 8], 5
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100be897], al
cmp ecx, 0xd
jl 0x1000780b
mov byte [0x100c4e3b], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be898
call fcn.1006d48b
leave
ret
Function at 0x10007839
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dd5], 0
jne 0x10007882
xor ecx, ecx
mov dword [ebp - 0x10], 0xd180706
mov dword [ebp - 0xc], 0x18071f33
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be347], al
cmp ecx, 8
jl 0x10007865
mov byte [0x100c4dd5], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be348
call fcn.1006d48b
leave
ret

Function at 0x10007893
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10003e96
test al, al
jne 0x100078c2
call fcn.1006daf8
mov ecx, dword [0x100c47a0]
cmp ecx, eax
jne 0x100078c2
dec ecx
mov dword [0x100c47a0], ecx
cmp byte [0x100c4e2c], 0
jne 0x1000790d
mov dword [ebp - 0x18], 0x121e0329
mov dword [ebp - 0x14], 0x2210609
mov dword [ebp - 0x10], 0x6070001
xor ecx, ecx
mov dword [ebp - 0xc], 0xa0e0636
mov dword [ebp - 8], 0x554315
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x18]
inc ecx
mov byte [ecx + 0x100be7c7], al
cmp ecx, 0x13
jl 0x100078f0
mov byte [0x100c4e2c], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be7c8
call fcn.1006d48b
leave
ret

Function at 0x1000791e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dfc], 0
jne 0x100079e8
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], 0xf181f07
mov dword [ebp - 0x10], 0x1070f
mov dword [ebp - 0xc], 0x1b14
mov word [ebp - 8], 1
mov ecx, ebx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100be543], al
cmp ecx, 0xd
jl 0x1000795b
mov ecx, dword [0x100c47a0]
mov eax, ecx
imul eax, ecx
imul eax, ecx
push 9
cdq
pop ecx
idiv ecx
mov byte [0x100c4dfc], 1
cmp edx, 2
jne 0x100079e7
push esi
push edi
xor eax, eax
push 0x46
mov word [ebp - 0x5c], ax
lea eax, [ebp - 0x5a]
push ebx
push eax
call fcn.1006de50
add esp, 0xc
mov edi, ebx
mov esi, ebx
mov edx, ebx
test edi, edi
je 0x100079cd
test edx, edx
je 0x100079cd
lea eax, [esi + edx]
lea ecx, [esi + edx]
mov ax, word [ebp + eax*2 - 0x68]
inc ax
add ax, word [ebp + ecx*2 - 0x5e]
mov word [ebp + ecx*2 - 0x5c], ax
inc edx
cmp edx, 6
jl 0x100079ae
add esi, 6
inc edi
cmp esi, 0x24
jl 0x100079ac
movsx eax, word [ebp - 0x16]
pop edi
mov dword [0x100c47a0], eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be544
call fcn.1006d48b
leave
ret
Function at 0x100079f9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e41], 0
jne 0x10007a77
xor ecx, ecx
mov dword [ebp - 0xc], 0x52181f07
mov word [ebp - 8], 0x1101
mov byte [ebp - 6], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0xc]
inc ecx
mov byte [ecx + 0x100be8db], al
cmp ecx, 6
jl 0x10007a24
call fcn.10003f7f
test al, al
jne 0x10007a70
mov eax, dword [0x100c47a0]
push 0x64
cdq
pop ecx
idiv ecx
xor ecx, ecx
push 4
lea eax, [edx + 0x141]
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1006c443
push eax
call fcn.1006dc4d
pop ecx
pop ecx
mov byte [0x100c4e41], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be8dc
call fcn.1006d48b
leave
ret

Function at 0x10007a88
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e1e], 0
jne 0x10007afa
push esi
xor ecx, ecx
push 0xa
mov dword [ebp - 0x10], 0x2040f0d
mov dword [ebp - 0xc], 0x51c0d00
mov word [ebp - 8], 0x1a0e
mov byte [ebp - 6], cl
pop esi
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be713], al
cmp ecx, esi
jl 0x10007abe
mov ecx, dword [0x100c47a0]
mov byte [0x100c4e1e], 1
lea eax, [ecx + 1]
imul eax, ecx
cdq
idiv esi
pop esi
cmp edx, 3
jne 0x10007afa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100c47a0], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be714
call fcn.1006d48b
leave
ret