joyce8/EMBER2024-capa huggingface dataset:
Function at 0x105836a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8c34], 1
jne 0x10583b2
or dword [0x10f8c34], 1
mov dword [0x10f3eac], 0x29687c45
mov dword [0x10f3eb0], 0x66646c64
mov dword [0x10f3eb4], 0x6c29707b
mov dword [0x10f3eb8], 0x7b667b7b
mov word [0x10f3ebc], 0x2933
mov byte [0x10f3ebe], 9
xor eax, eax
mov cl, byte [eax + 0x10f3eac]
xor cl, 9
mov byte [eax + 0x10f449c], cl
inc eax
cmp eax, 0x13
jb 0x10583b4
mov eax, 0x10f449c
ret

Function at 0x10583cf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8c30], 1
jne 0x1058436
or dword [0x10f8c30], 1
mov dword [0x10f3ec0], 0x29687c45
mov dword [0x10f3ec4], 0x667b7b6c
mov dword [0x10f3ec8], 0x6760297b
mov dword [0x10f3ecc], 0x6c6d607a
mov dword [0x10f3ed0], 0x7b7b6c29
mov dword [0x10f3ed4], 0x61297b66
mov dword [0x10f3ed8], 0x656d6768
mov dword [0x10f3edc], 0x29337b6c
mov byte [0x10f3ee0], 9
xor eax, eax
mov cl, byte [eax + 0x10f3ec0]
xor cl, 9
mov byte [eax + 0x10f44b0], cl
inc eax
cmp eax, 0x21
jb 0x1058438
mov eax, 0x10f44b0
ret

Function at 0x1058453
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8c2c], 1
jne 0x10584af
or dword [0x10f8c2c], 1
mov dword [0x10f3ee4], 0x6762675c
mov dword [0x10f3ee8], 0x29677e66
mov dword [0x10f3eec], 0x667b7b6c
mov dword [0x10f3ef0], 0x6760297b
mov dword [0x10f3ef4], 0x687c6529
mov dword [0x10f3ef8], 0x686a7956
mov word [0x10f3efc], 0x6565
mov byte [0x10f3efe], 9
xor eax, eax
mov cl, byte [eax + 0x10f3ee4]
xor cl, 9
mov byte [eax + 0x10f44d4], cl
inc eax
cmp eax, 0x1b
jb 0x10584b1
mov eax, 0x10f44d4
ret

Function at 0x10586ed
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8c28], 1
jne 0x1058736
or dword [0x10f8c28], 1
mov dword [0x10f3f00], 0x6c7a684b
mov dword [0x10f3f04], 0x6d293d3f
mov dword [0x10f3f08], 0x6d666a6c
mov dword [0x10f3f0c], 0x686f296c
mov dword [0x10f3f10], 0x6d6c6560
mov byte [0x10f3f14], 9
xor eax, eax
mov cl, byte [eax + 0x10f3f00]
xor cl, 9
mov byte [eax + 0x10f44f0], cl
inc eax
cmp eax, 0x15
jb 0x1058738
mov eax, 0x10f44f0
ret
Function at 0x1058753
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10c4a1e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [esp + 0x24]
xor ebx, ebx
push eax
mov dword [esp + 0x18], ebx
call fcn.0107c73c
lea ecx, [esp + 0x44]
push ecx
mov ecx, eax
mov dword [esp + 0x70], ebx
call fcn.0107ab2c
add esp, 0xc
push 1
xor edi, edi
lea esi, [esp + 0x24]
call fcn.01054e3d
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x64], 3
mov esi, dword [esp + 0x4c]
lea eax, [esp + 0x20]
call fcn.0105acc6
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
cmp dword [esp + 0x50], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
jae 0x10587e0
lea eax, [esp + 0x3c]
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0x24]
push esi
push eax
call fcn.0107f744
add esp, 0x10
test al, al
jne 0x1058825
call fcn.0105889c
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
call fcn.0109ba25
push 0x10e44a8
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.std::runtime_error.0
call fcn.010a5926
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x20]
call fcn.0105acc6
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
xor esi, esi
sub ecx, eax
mov dword [esp + 0xc], ecx
je 0x1058865
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov edi, dword [eax + 4]
sub edi, ecx
xor edx, edx
mov eax, esi
div edi
mov eax, dword [esp + 0x20]
mov cl, byte [edx + ecx]
xor byte [eax + esi], cl
inc esi
cmp esi, dword [esp + 0xc]
jb 0x1058844
push dword [esp + 0xc]
mov esi, dword [ebp + 8]
push eax
call fcn.0105a131
lea esi, [esp + 0x20]
call fcn.01054bf7
push ebx
push 1
lea ecx, [esp + 0x44]
call fcn.01054cff
mov ecx, dword [esp + 0x5c]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x105889c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8c24], 1
jne 0x10588e5
or dword [0x10f8c24], 1
mov dword [0x10f3f18], 0x6c7a684b
mov dword [0x10f3f1c], 0x6d293d3f
mov dword [0x10f3f20], 0x6d666a6c
mov dword [0x10f3f24], 0x686f296c
mov dword [0x10f3f28], 0x6d6c6560
mov byte [0x10f3f2c], 9
xor eax, eax
mov cl, byte [eax + 0x10f3f18]
xor cl, 9
mov byte [eax + 0x10f4508], cl
inc eax
cmp eax, 0x15
jb 0x10588e7
mov eax, 0x10f4508
ret

Function at 0x1058fda
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8c20], 1
jne 0x105902f
or dword [0x10f8c20], 1
mov dword [0x10f3f30], 0x657c664a
mov dword [0x10f3f34], 0x6667296d
mov dword [0x10f3f38], 0x7966297d
mov dword [0x10f3f3c], 0x6a29676c
mov dword [0x10f3f40], 0x617a687b
mov dword [0x10f3f44], 0x647c6d29
mov word [0x10f3f48], 0x979
xor eax, eax
mov cl, byte [eax + 0x10f3f30]
xor cl, 9
mov byte [eax + 0x10f4520], cl
inc eax
cmp eax, 0x1a
jb 0x1059031
mov eax, 0x10f4520
ret
Function at 0x105904c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8c18], 1
jne 0x105906f
or dword [0x10f8c18], 1
mov dword [0x10f3f50], 0x6e666526
mov word [0x10f3f54], 0x926
xor eax, eax
mov cl, byte [eax + 0x10f3f50]
xor cl, 9
mov byte [eax + 0x10f4540], cl
inc eax
cmp eax, 6
jb 0x1059071
mov eax, 0x10f4540
ret

Function at 0x105908c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8c14], 1
jne 0x1059107
or dword [0x10f8c14], 1
mov dword [0x10f3f58], 0x797d7d61
mov dword [0x10f3f5c], 0x68262633
mov dword [0x10f3f60], 0x70656867
mov dword [0x10f3f64], 0x7a6a607d
mov dword [0x10f3f68], 0x7d6c6e27
mov dword [0x10f3f6c], 0x677e666d
mov dword [0x10f3f70], 0x7d7a6c7d
mov dword [0x10f3f74], 0x64666a27
mov dword [0x10f3f78], 0x263b7f26
mov dword [0x10f3f7c], 0x266e6665
mov byte [0x10f3f80], 9
xor eax, eax
mov cl, byte [eax + 0x10f3f58]
xor cl, 9
mov byte [eax + 0x10f4548], cl
inc eax
cmp eax, 0x29
jb 0x1059109
mov eax, 0x10f4548
ret

Function at 0x1059124
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8c10], 1
jne 0x105914f
or dword [0x10f8c10], 1
mov dword [0x10f3f84], 0x7a2f346a
mov dword [0x10f3f88], 0x347d2f34
mov byte [0x10f3f8c], 9
xor eax, eax
mov cl, byte [eax + 0x10f3f84]
xor cl, 9
mov byte [eax + 0x10f4574], cl
inc eax
cmp eax, 9
jb 0x1059151
mov eax, 0x10f4574
ret

Function at 0x105916c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8c00], 1
jne 0x10591f4
or dword [0x10f8c00], 1
mov dword [0x10f3fa0], 0x7d67664a
mov dword [0x10f3fa4], 0x247d676c
mov dword [0x10f3fa8], 0x6c79705d
mov dword [0x10f3fac], 0x79682933
mov dword [0x10f3fb0], 0x6a606579
mov dword [0x10f3fb4], 0x66607d68
mov dword [0x10f3fb8], 0x24712667
mov dword [0x10f3fbc], 0x247e7e7e
mov dword [0x10f3fc0], 0x647b666f
mov dword [0x10f3fc4], 0x657b7c24
mov dword [0x10f3fc8], 0x666a676c
mov dword [0x10f3fcc], 0x96d6c6d
xor eax, eax
mov cl, byte [eax + 0x10f3fa0]
xor cl, 9
mov byte [eax + 0x10f4590], cl
inc eax
cmp eax, 0x30
jb 0x10591f6
mov eax, 0x10f4590
ret

Function at 0x1059211
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8bfc], 1
jne 0x105923c
or dword [0x10f8bfc], 1
mov dword [0x10f3fd0], 0x5d5a4659
mov dword [0x10f3fd4], 0x29667d29
mov byte [0x10f3fd8], 9
xor eax, eax
mov cl, byte [eax + 0x10f3fd0]
xor cl, 9
mov byte [eax + 0x10f45c0], cl
inc eax
cmp eax, 9
jb 0x105923e
mov eax, 0x10f45c0
ret

Function at 0x1059259
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8bf8], 1
jne 0x10592a2
or dword [0x10f8bf8], 1
mov dword [0x10f3fdc], 0x60686f29
mov dword [0x10f3fe0], 0x296d6c65
mov dword [0x10f3fe4], 0x617d607e
mov dword [0x10f3fe8], 0x687d7a29
mov dword [0x10f3fec], 0x297a7c7d
mov byte [0x10f3ff0], 9
xor eax, eax
mov cl, byte [eax + 0x10f3fdc]
xor cl, 9
mov byte [eax + 0x10f45cc], cl
inc eax
cmp eax, 0x15
jb 0x10592a4
mov eax, 0x10f45cc
ret
Function at 0x10592d9
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10c329a
call fcn.010c1cf8
sub esp, 0xa8
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x10], ebx
push edi
cmp dword [ebp + 0xc], ebx
je 0x105948a
cmp dword [ebp + 0x10], ebx
je 0x105948a
push dword [ebp + 0x14]
lea esi, [ebp - 0x7c]
call fcn.0105a627
push eax
push 0x10e2c70
lea eax, [ebp - 0x98]
mov dword [ebp - 4], ebx
call fcn.01055493
push 0x10e2c6c
push eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.010554c9
add esp, 0x10
push 1
xor edi, edi
lea esi, [ebp - 0x98]
call fcn.01054e3d
push 1
lea esi, [ebp - 0x7c]
mov byte [ebp - 4], 4
call fcn.01054e3d
mov dword [ebp - 0x10], ebx
cmp dword [ebp + 0x10], ebx
jle 0x10593e5
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push dword [eax + ecx*4]
lea esi, [ebp - 0x60]
call fcn.0105a627
mov byte [ebp - 4], 5
push dword [ebp - 0x1c]
mov eax, esi
push ebx
push eax
lea esi, [ebp - 0xb4]
call fcn.0105a649
mov ecx, eax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x1059399
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
push eax
mov eax, dword [ecx + 0x10]
call fcn.0105e0c4
mov ebx, eax
neg ebx
sbb bl, bl
push 1
xor edi, edi
lea esi, [ebp - 0xb4]
mov byte [ebp - 4], 5
call fcn.01054e3d
inc bl
jne 0x1059451
push 1
lea esi, [ebp - 0x60]
mov byte [ebp - 4], 4
call fcn.01054e3d
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ebx, ebx
cmp eax, dword [ebp + 0x10]
jl 0x1059360
test byte [0x10f8bf0], 1
jne 0x1059412
or dword [0x10f8bf0], 1
mov dword [0x10f4000], 0x297d6647
mov dword [0x10f4004], 0x677c666f
mov word [0x10f4008], 0x96d
xor eax, eax
mov cl, byte [eax + 0x10f4000]
xor cl, 9
mov byte [eax + 0x10f45f0], cl
inc eax
cmp eax, 0xa
jb 0x1059414
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp + 0xc], 0x10f45f0
call fcn.0109ba25
mov dword [ebp - 0x44], vtable.std::runtime_error.0
push 0x10e44a8
lea eax, [ebp - 0x44]
push eax
call fcn.010a5926
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x1c]
lea eax, [ebp - 0x60]
push eax
call fcn.0105a649
push 1
xor edi, edi
lea esi, [ebp - 0x60]
call fcn.01054e3d
push 1
lea esi, [ebp - 0x2c]
call fcn.01054e3d
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
call fcn.010594af
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x38]
call fcn.0109ba25
mov dword [ebp - 0x38], vtable.std::runtime_error.0
push 0x10e44a8
lea eax, [ebp - 0x38]
jmp 0x105944b

Function at 0x10594af
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8bf4], 1
jne 0x10594dc
or dword [0x10f8bf4], 1
mov dword [0x10f3ff4], 0x297d6647
mov dword [0x10f3ff8], 0x677c666f
mov word [0x10f3ffc], 0x96d
xor eax, eax
mov cl, byte [eax + 0x10f3ff4]
xor cl, 9
mov byte [eax + 0x10f45e4], cl
inc eax
cmp eax, 0xa
jb 0x10594de
mov eax, 0x10f45e4
ret
Function at 0x1059c93
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8bec], 1
mov ecx, 0x8709
jne 0x1059d1d
or dword [0x10f8bec], 1
lea eax, [ecx + 0x61]
mov word [0x10f400c], ax
add eax, 0x11
mov edx, eax
mov word [0x10f400e], dx
lea edx, [ecx + 0x5f]
mov word [0x10f4010], dx
add edx, 0x12
mov word [0x10f4012], dx
lea edx, [ecx + 0x58]
mov word [0x10f4014], dx
add edx, 0xfffffff5
mov word [0x10f4016], dx
mov edx, eax
mov word [0x10f4018], dx
lea edx, [ecx + 0x63]
lea eax, [ecx + 0x74]
mov word [0x10f401a], dx
mov word [0x10f4022], ax
add edx, 0xd
mov eax, ecx
mov word [0x10f401c], dx
mov dword [0x10f401e], 0x877b8766
mov word [0x10f4024], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x10f400c]
add eax, 2
mov word [eax + 0x10f45fa], dx
cmp eax, 0x1a
jb 0x1059d1f
mov eax, 0x10f45fc
ret

Function at 0x1059d3d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8be8], 1
jne 0x1059d68
or dword [0x10f8be8], 1
mov dword [0x10f4028], 0x677b6c62
mov dword [0x10f402c], 0x3b3a656c
mov byte [0x10f4030], 9
xor eax, eax
mov cl, byte [eax + 0x10f4028]
xor cl, 9
mov byte [eax + 0x10f4618], cl
inc eax
cmp eax, 9
jb 0x1059d6a
mov eax, 0x10f4618
ret

Function at 0x1059d85
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8be4], 1
jne 0x1059dee
or dword [0x10f8be4], 1
mov dword [0x10f4034], 0x597d6c5a
mov dword [0x10f4038], 0x6c6a667b
mov dword [0x10f403c], 0x7a5c7a7a
mov dword [0x10f4040], 0x66447b6c
mov dword [0x10f4044], 0x714c6c6d
mov dword [0x10f4048], 0x7d796c6a
mov dword [0x10f404c], 0x59676660
mov dword [0x10f4050], 0x6a606566
mov word [0x10f4054], 0x970
xor eax, eax
mov cl, byte [eax + 0x10f4034]
xor cl, 9
mov byte [eax + 0x10f4624], cl
inc eax
cmp eax, 0x22
jb 0x1059df0
mov eax, 0x10f4624
ret

Function at 0x1059e0b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8be0], 1
jne 0x1059e74
or dword [0x10f8be0], 1
mov dword [0x10f4058], 0x597d6c4e
mov dword [0x10f405c], 0x6c6a667b
mov dword [0x10f4060], 0x7a5c7a7a
mov dword [0x10f4064], 0x66447b6c
mov dword [0x10f4068], 0x714c6c6d
mov dword [0x10f406c], 0x7d796c6a
mov dword [0x10f4070], 0x59676660
mov dword [0x10f4074], 0x6a606566
mov word [0x10f4078], 0x970
xor eax, eax
mov cl, byte [eax + 0x10f4058]
xor cl, 9
mov byte [eax + 0x10f4648], cl
inc eax
cmp eax, 0x22
jb 0x1059e76
mov eax, 0x10f4648
ret

Function at 0x1059e91
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8bdc], 1
jne 0x1059ee7
or dword [0x10f8bdc], 1
mov dword [0x10f407c], 0x296c6546
mov dword [0x10f4080], 0x7d606760
mov dword [0x10f4084], 0x60656860
mov dword [0x10f4088], 0x607d6873
mov dword [0x10f408c], 0x6f296766
mov dword [0x10f4090], 0x6c656068
mov dword [0x10f4094], 0x929336d
xor eax, eax
mov cl, byte [eax + 0x10f407c]
xor cl, 9
mov byte [eax + 0x10f466c], cl
inc eax
cmp eax, 0x1c
jb 0x1059ee9
mov eax, 0x10f466c
ret
Function at 0x1059f04
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8bd8], 1
mov ecx, 0x8709
jne 0x1059f33
or dword [0x10f8bd8], 1
lea eax, [ecx + 0x5f]
mov word [0x10f4098], ax
add eax, 0xffffffd3
mov word [0x10f409a], ax
mov eax, ecx
mov word [0x10f409c], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x10f4098]
add eax, 2
mov word [eax + 0x10f4686], dx
cmp eax, 6
jb 0x1059f35
mov eax, 0x10f4688
ret

Function at 0x1059f53
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8bd0], 1
jne 0x1059fc3
or dword [0x10f8bd0], 1
mov dword [0x10f40a8], 0x6560684f
mov dword [0x10f40ac], 0x7d296d6c
mov dword [0x10f40b0], 0x67602966
mov dword [0x10f40b4], 0x68607d60
mov dword [0x10f40b8], 0x6c736065
mov dword [0x10f40bc], 0x7f676c29
mov dword [0x10f40c0], 0x67667b60
mov dword [0x10f40c4], 0x7d676c64
mov word [0x10f40c8], 0x2933
mov byte [0x10f40ca], 9
xor eax, eax
mov cl, byte [eax + 0x10f40a8]
xor cl, 9
mov byte [eax + 0x10f4698], cl
inc eax
cmp eax, 0x23
jb 0x1059fc5
mov eax, 0x10f4698
ret

Function at 0x1059fe0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8bc8], 1
jne 0x105a02b
or dword [0x10f8bc8], 1
mov dword [0x10f40d4], 0x6861675c
mov dword [0x10f40d8], 0x6c656d67
mov dword [0x10f40dc], 0x716c296d
mov dword [0x10f40e0], 0x7d796c6a
mov dword [0x10f40e4], 0x33676660
mov word [0x10f40e8], 0x929
xor eax, eax
mov cl, byte [eax + 0x10f40d4]
xor cl, 9
mov byte [eax + 0x10f46c4], cl
inc eax
cmp eax, 0x16
jb 0x105a02d
mov eax, 0x10f46c4
ret

Function at 0x105a048
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8bc4], 1
jne 0x105a09b
or dword [0x10f8bc4], 1
mov dword [0x10f40ec], 0x6861675c
mov dword [0x10f40f0], 0x6c656d67
mov dword [0x10f40f4], 0x716c296d
mov dword [0x10f40f8], 0x7d796c6a
mov dword [0x10f40fc], 0x33676660
mov dword [0x10f4100], 0x37a2c29
mov byte [0x10f4104], 9
xor eax, eax
mov cl, byte [eax + 0x10f40ec]
xor cl, 9
mov byte [eax + 0x10f46dc], cl
inc eax
cmp eax, 0x19
jb 0x105a09d
mov eax, 0x10f46dc
ret

Function at 0x105a0b8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8bc0], 1
jne 0x105a0f0
or dword [0x10f8bc0], 1
mov dword [0x10f4108], 0x6b7c7d5a
mov dword [0x10f410c], 0x60716c29
mov dword [0x10f4110], 0x2c21297d
mov dword [0x10f4114], 0x903206d
xor eax, eax
mov cl, byte [eax + 0x10f4108]
xor cl, 9
mov byte [eax + 0x10f46f8], cl
inc eax
cmp eax, 0x10
jb 0x105a0f2
mov eax, 0x10f46f8
ret
Function at 0x105bae8
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x10c2a99
call fcn.010c1cf8
sub esp, 0x20
push ebx
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x105bbcc
cmp byte [edi + 0x49], bl
je 0x105bbcc
mov eax, dword [edi]
push 0xffffffffffffffff
mov ecx, edi
call dword [eax + 0xc]
cmp eax, 0xffffffff
jne 0x105bb1f
xor al, al
jmp 0x105bbce
push esi
lea esi, [ebp - 0x2c]
call fcn.0105b5e1
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x105bb6f
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [edi + 0x44]
mov esi, dword [ecx]
lea ebx, [ebp - 0x10]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [edi + 0x4c]
push eax
call dword [esi + 0x18]
sub eax, 0
je 0x105bb74
dec eax
je 0x105bb78
dec eax
dec eax
je 0x105bbc8
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.01054cff
mov al, bl
pop esi
jmp 0x105bbce
mov edx, dword [ebp - 0x2c]
jmp 0x105bb39
mov byte [edi + 0x49], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x105bb84
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x10]
sub esi, eax
je 0x105bbaa
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x105bb97
lea eax, [ebp - 0x2c]
push dword [edi + 0x54]
push esi
push 1
push eax
call fcn.0109d7fe
add esp, 0x10
cmp esi, eax
jne 0x105bb5c
cmp byte [edi + 0x49], 0
je 0x105bbc8
test esi, esi
jne 0x105bb2b
push esi
push 8
lea esi, [ebp - 0x2c]
call fcn.0105b6ba
jmp 0x105bb2b
mov bl, 1
jmp 0x105bb5e
mov al, 1
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x10603d2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8bbc], 1
jne 0x1060446
or dword [0x10f8bbc], 1
mov dword [0x10f4718], 0x667f6549
mov dword [0x10f471c], 0x65642a6e
mov dword [0x10f4720], 0x6f6d2a7e
mov dword [0x10f4724], 0x636e2a7e
mov dword [0x10f4728], 0x6e637a79
mov dword [0x10f472c], 0x2a6c652a
mov dword [0x10f4730], 0x627e6f67
mov dword [0x10f4734], 0x2d2a6e65
mov dword [0x10f4738], 0x66666b69
mov dword [0x10f473c], 0xa2a302d
xor eax, eax
mov cl, byte [eax + 0x10f4718]
xor cl, 0xa
mov byte [eax + 0x10f485c], cl
inc eax
cmp eax, 0x28
jb 0x1060448
mov eax, 0x10f485c
ret

Function at 0x1060463
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8bb8], 1
jne 0x10604ca
or dword [0x10f8bb8], 1
mov dword [0x10f4740], 0x66636b4c
mov dword [0x10f4744], 0x7e2a6e6f
mov dword [0x10f4748], 0x64632a65
mov dword [0x10f474c], 0x6f61657c
mov dword [0x10f4750], 0x7e6f672a
mov dword [0x10f4754], 0x2a6e6562
mov dword [0x10f4758], 0x666b692d
mov dword [0x10f475c], 0x2a302d66
mov byte [0x10f4760], 0xa
xor eax, eax
mov cl, byte [eax + 0x10f4740]
xor cl, 0xa
mov byte [eax + 0x10f4884], cl
inc eax
cmp eax, 0x21
jb 0x10604cc
mov eax, 0x10f4884
ret
Function at 0x10604e7
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x10f8bb4], 1
jne 0x1060549
or dword [0x10f8bb4], 1
mov dword [0x10f4764], 0x65785a00
mov dword [0x10f4768], 0x66686b68
mov dword [0x10f476c], 0x7f6e2a73
mov dword [0x10f4770], 0x657e2a6f
mov dword [0x10f4774], 0x7869792a
mov dword [0x10f4778], 0x2a7e7a63
mov dword [0x10f477c], 0x6578786f
mov dword [0x10f4780], 0xa2a3078
mov cl, byte [eax + 0x10f4764]
xor cl, 0xa
mov byte [eax + 0x10f48a8], cl
inc eax
cmp eax, 0x20
jb 0x1060549
mov eax, 0x10f48a8
ret

Function at 0x1060b24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, eax
jbe 0x1060c69
mov ebx, dword [ebp + 8]
push 4
sub ebx, edi
pop esi
test byte [0x10f8bb0], 1
jne 0x1060b86
or dword [0x10f8bb0], 1
mov eax, 0x8779
mov word [0x10f4784], ax
add eax, 0xfffffff6
mov word [0x10f4786], ax
mov eax, 0x8764
mov word [0x10f4788], ax
add eax, 0xa
mov word [0x10f478a], ax
mov eax, 0x870a
mov word [0x10f478c], ax
xor eax, eax
mov ecx, 0x870a
xor cx, word [eax + 0x10f4784]
add eax, 2
mov word [eax + 0x10f48c6], cx
cmp eax, 0xa
jb 0x1060b88
mov eax, dword [ebx + edi]
mov ecx, 0x10f48c8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1060bcf
test dx, dx
je 0x1060bcb
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1060bcf
add eax, esi
add ecx, esi
test dx, dx
jne 0x1060bab
xor eax, eax
jmp 0x1060bd4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1060be0
mov dword [edi], 0x385
jmp 0x1060c58
call fcn.01060c79
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x1060c0c
test dx, dx
je 0x1060c08
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x1060c0c
add ecx, esi
add eax, esi
test dx, dx
jne 0x1060be8
xor eax, eax
jmp 0x1060c11
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1060c1d
mov dword [edi], 0x386
jmp 0x1060c58
call fcn.01060d4c
mov ecx, dword [ebx + edi]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x1060c49
test dx, dx
je 0x1060c45
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x1060c49
add ecx, esi
add eax, esi
test dx, dx
jne 0x1060c25
xor eax, eax
jmp 0x1060c4e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1060c72
mov dword [edi], 0x387
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add edi, esi
cmp eax, dword [ebp + 0xc]
jb 0x1060b43
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, 0x80020006
jmp 0x1060c6b
Function at 0x1060c79
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8bac], 1
jne 0x1060d29
or dword [0x10f8bac], 1
mov eax, 0x876b
mov word [0x10f4790], ax
add eax, 3
mov ecx, eax
mov word [0x10f4794], ax
mov eax, 0x874f
mov word [0x10f4796], ax
add eax, 0x2d
mov word [0x10f4798], ax
mov eax, 0x876f
mov word [0x10f4792], cx
mov ecx, eax
lea edx, [eax - 0xb]
mov word [0x10f479a], cx
mov ecx, edx
push edi
mov word [0x10f479c], cx
add ecx, 0x1a
mov edi, ecx
mov word [0x10f479e], di
lea edi, [eax - 0x29]
mov word [0x10f47a0], di
add edi, 0x1d
mov ecx, eax
add eax, 9
mov word [0x10f47ae], ax
lea eax, [ecx - 0x65]
mov word [0x10f47a2], di
mov dword [0x10f47a4], 0x877e8779
mov word [0x10f47a8], cx
mov dword [0x10f47aa], 0x876f8764
mov word [0x10f47b0], ax
pop edi
xor eax, eax
mov ecx, 0x870a
xor cx, word [eax + 0x10f4790]
add eax, 2
mov word [eax + 0x10f48d2], cx
cmp eax, 0x22
jb 0x1060d2b
mov eax, 0x10f48d4
ret

Function at 0x1060d4c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8ba8], 1
mov ecx, 0x870a
jne 0x1060da6
or dword [0x10f8ba8], 1
lea eax, [ecx + 0x72]
mov word [0x10f47b4], ax
add eax, 0xfffffff3
mov word [0x10f47b6], ax
lea eax, [ecx + 0x6e]
mov word [0x10f47b8], ax
inc eax
mov word [0x10f47ba], ax
lea eax, [ecx + 0x59]
mov word [0x10f47bc], ax
add eax, 2
mov word [0x10f47be], ax
lea eax, [ecx + 0x5a]
mov word [0x10f47c0], ax
mov eax, ecx
mov word [0x10f47c2], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x10f47b4]
add eax, 2
mov word [eax + 0x10f48f6], dx
cmp eax, 0x10
jb 0x1060da8
mov eax, 0x10f48f8
ret

Function at 0x1061765
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8ba4], 1
mov edx, 0x870a
jne 0x10617c8
or dword [0x10f8ba4], 1
lea ecx, [edx + 0x65]
mov eax, ecx
mov word [0x10f47c4], ax
add eax, 9
push esi
mov esi, eax
lea eax, [edx + 0x3c]
mov word [0x10f47ce], ax
add eax, 0x1d
mov word [0x10f47d0], ax
mov eax, edx
mov word [0x10f47c6], si
mov word [0x10f47c8], si
mov dword [0x10f47ca], 0x87788765
mov dword [0x10f47d2], 0x876f8764
mov word [0x10f47d6], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x10f47c4]
add eax, 2
mov word [eax + 0x10f4906], cx
cmp eax, 0x14
jb 0x10617ca
mov eax, 0x10f4908
ret

Function at 0x10617e8
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8ba0], 1
jne 0x1061884
or dword [0x10f8ba0], 1
mov edx, 0x876f
mov eax, edx
mov word [0x10f47d8], ax
add eax, 9
mov ecx, eax
mov word [0x10f47da], cx
mov word [0x10f47dc], cx
lea ecx, [edx - 0xa]
mov word [0x10f47de], cx
mov ecx, eax
mov word [0x10f47e0], cx
lea ecx, [edx - 0x26]
mov word [0x10f47e2], cx
add ecx, 0x19
mov word [0x10f47e4], cx
lea ecx, [edx - 4]
push edi
mov edi, ecx
mov word [0x10f47e6], di
mov edi, eax
mov word [0x10f47ea], cx
mov word [0x10f47f2], ax
add ecx, 0xfffffffe
lea eax, [edx - 0x65]
mov word [0x10f47e8], di
mov word [0x10f47ec], cx
mov dword [0x10f47ee], 0x876f877e
mov word [0x10f47f4], ax
pop edi
xor eax, eax
mov ecx, 0x870a
xor cx, word [eax + 0x10f47d8]
add eax, 2
mov word [eax + 0x10f491a], cx
cmp eax, 0x1e
jb 0x1061886
mov eax, 0x10f491c
ret