joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1056111
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10c334f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
and dword [esp], 0
test byte [0x10f8cdc], 1
push esi
jne 0x1056164
or dword [0x10f8cdc], 1
mov dword [0x10f3784], 0x646c7c66
mov dword [0x10f3788], 0x646c2664
mov word [0x10f378c], 0x864
xor eax, eax
mov cl, byte [eax + 0x10f3784]
xor cl, 8
mov byte [eax + 0x10f3984], cl
inc eax
cmp eax, 0xa
jb 0x1056166
push 0x10f3984
call dword [0x10ca0cc]
mov esi, eax
test esi, esi
jne 0x10561d8
call dword [0x10ca0a8]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.0107a8c7
pop ecx
pop ecx
and dword [esp + 0xb4], esi
push eax
call fcn.0105631f
push eax
lea eax, [esp + 0x28]
push eax
call fcn.01056b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 1
call fcn.01055c58
push 0x10e44a8
mov eax, esi
push eax
call fcn.010a5926
call fcn.01056385
push eax
push esi
call dword [0x10ca0c8]
test eax, eax
jne 0x1056235
call dword [0x10ca0a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0107a8c7
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 2
call fcn.010563f7
push eax
lea eax, [esp + 0x44]
push eax
call fcn.01056b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 3
call fcn.01055c58
push 0x10e44a8
mov eax, esi
jmp 0x10561d2
lea ecx, [esp + 4]
push ecx
push 0x18
lea ecx, [esp + 0x60]
push ecx
push 0
push dword [ebp + 8]
call eax
test eax, eax
jne 0x10562bd
cmp dword [esp + 4], 0x18
jne 0x10562bd
push dword [esp + 0x6c]
push eax
push 0x410
call dword [0x10ca0c4]
test eax, eax
jne 0x105630c
call dword [0x10ca0a8]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.0107a8c7
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 6
call fcn.01056537
push eax
lea eax, [esp + 0x94]
push eax
call fcn.01056b70
add esp, 0xc
lea esi, [esp + 0x14]
mov byte [esp + 0xb4], 7
call fcn.01055c58
push 0x10e44a8
mov eax, esi
jmp 0x10561d2
call dword [0x10ca0a8]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0107a8c7
pop ecx
pop ecx
push eax
mov dword [esp + 0xb8], 4
call fcn.010564aa
push eax
lea eax, [esp + 0x44]
push eax
call fcn.01056b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0xb4], 5
call fcn.01055c58
push 0x10e44a8
mov eax, esi
jmp 0x10561d2
mov ecx, dword [esp + 0xac]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x105631f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8cd8], 1
jne 0x1056368
or dword [0x10f8cd8], 1
mov dword [0x10f3790], 0x6c696744
mov dword [0x10f3794], 0x7a6a6144
mov dword [0x10f3798], 0x28717a69
mov dword [0x10f379c], 0x6461696e
mov dword [0x10f37a0], 0x28326c6d
mov byte [0x10f37a4], 8
xor eax, eax
mov cl, byte [eax + 0x10f3790]
xor cl, 8
mov byte [eax + 0x10f3990], cl
inc eax
cmp eax, 0x15
jb 0x105636a
mov eax, 0x10f3990
ret
Function at 0x1056385
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8cd4], 1
jne 0x10563da
or dword [0x10f8cd4], 1
mov dword [0x10f37a8], 0x7d597c46
mov dword [0x10f37ac], 0x41717a6d
mov dword [0x10f37b0], 0x7a676e66
mov dword [0x10f37b4], 0x617c6965
mov dword [0x10f37b8], 0x7a586667
mov dword [0x10f37bc], 0x7b6d6b67
mov word [0x10f37c0], 0x87b
xor eax, eax
mov cl, byte [eax + 0x10f37a8]
xor cl, 8
mov byte [eax + 0x10f39a8], cl
inc eax
cmp eax, 0x1a
jb 0x10563dc
mov eax, 0x10f39a8
ret

Function at 0x10563f7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8cd0], 1
jne 0x105648d
or dword [0x10f8cd0], 1
mov dword [0x10f37c4], 0x587c6d4f
mov dword [0x10f37c8], 0x496b677a
mov dword [0x10f37cc], 0x6d7a6c6c
mov dword [0x10f37d0], 0x6e287b7b
mov dword [0x10f37d4], 0x6d646169
mov dword [0x10f37d8], 0x4620286c
mov dword [0x10f37dc], 0x6d7d597c
mov dword [0x10f37e0], 0x6641717a
mov dword [0x10f37e4], 0x657a676e
mov dword [0x10f37e8], 0x67617c69
mov dword [0x10f37ec], 0x677a5866
mov dword [0x10f37f0], 0x7b7b6d6b
mov dword [0x10f37f4], 0x8283221
xor eax, eax
mov cl, byte [eax + 0x10f37c4]
xor cl, 8
mov byte [eax + 0x10f39c4], cl
inc eax
cmp eax, 0x34
jb 0x105648f
mov eax, 0x10f39c4
ret

Function at 0x10564aa
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8ccc], 1
jne 0x105651a
or dword [0x10f8ccc], 1
mov dword [0x10f37f8], 0x7d597c46
mov dword [0x10f37fc], 0x41717a6d
mov dword [0x10f3800], 0x7a676e66
mov dword [0x10f3804], 0x617c6965
mov dword [0x10f3808], 0x7a586667
mov dword [0x10f380c], 0x7b6d6b67
mov dword [0x10f3810], 0x696e287b
mov dword [0x10f3814], 0x6c6d6461
mov word [0x10f3818], 0x2832
mov byte [0x10f381a], 8
xor eax, eax
mov cl, byte [eax + 0x10f37f8]
xor cl, 8
mov byte [eax + 0x10f39f8], cl
inc eax
cmp eax, 0x23
jb 0x105651c
mov eax, 0x10f39f8
ret

Function at 0x1056537
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8cc8], 1
jne 0x1056580
or dword [0x10f8cc8], 1
mov dword [0x10f381c], 0x666d7847
mov dword [0x10f3820], 0x6b677a58
mov dword [0x10f3824], 0x287b7b6d
mov dword [0x10f3828], 0x6461696e
mov dword [0x10f382c], 0x28326c6d
mov byte [0x10f3830], 8
xor eax, eax
mov cl, byte [eax + 0x10f381c]
xor cl, 8
mov byte [eax + 0x10f3a1c], cl
inc eax
cmp eax, 0x15
jb 0x1056582
mov eax, 0x10f3a1c
ret
Function at 0x105659d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10c32fc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x254
and dword [esp + 0xc], 0
test byte [0x10f8cc4], 1
push esi
push edi
jne 0x10565fa
or dword [0x10f8cc4], 1
mov dword [0x10f3834], 0x667a6d63
mov dword [0x10f3838], 0x3a3b646d
mov dword [0x10f383c], 0x64646c26
mov byte [0x10f3840], 8
xor eax, eax
mov cl, byte [eax + 0x10f3834]
xor cl, 8
mov byte [eax + 0x10f3a34], cl
inc eax
cmp eax, 0xd
jb 0x10565fc
mov edi, dword [reloc.KERNEL32.dll_LoadLibraryA]
push 0x10f3a34
call edi
mov esi, eax
test esi, esi
jne 0x1056670
call dword [0x10ca0a8]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0107a8c7
pop ecx
pop ecx
and dword [esp + 0x264], esi
push eax
call fcn.010567d2
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.01056b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 1
call fcn.01055c58
push 0x10e44a8
mov eax, esi
push eax
call fcn.010a5926
call fcn.0105684f
push eax
push esi
mov esi, dword [reloc.KERNEL32.dll_GetProcAddress]
call esi
test eax, eax
jne 0x105673d
call fcn.010568c2
push eax
call edi
mov edi, eax
test edi, edi
jne 0x10566e1
call dword [0x10ca0a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0107a8c7
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 2
call fcn.0105690c
push eax
lea eax, [esp + 0x20]
push eax
call fcn.01056b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 3
call fcn.01055c58
push 0x10e44a8
mov eax, esi
jmp 0x105666a
call fcn.01056986
push eax
push edi
call esi
test eax, eax
jne 0x105673d
call dword [0x10ca0a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0107a8c7
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 4
call fcn.010569f6
push eax
lea eax, [esp + 0x20]
push eax
call fcn.01056b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 5
call fcn.01055c58
push 0x10e44a8
mov eax, esi
jmp 0x105666a
push 0x208
lea ecx, [esp + 0x54]
push ecx
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0x105679f
call dword [0x10ca0a8]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0107a8c7
pop ecx
pop ecx
push eax
mov dword [esp + 0x268], 6
call fcn.01056aaf
push eax
lea eax, [esp + 0x20]
push eax
call fcn.01056b70
add esp, 0xc
lea esi, [esp + 8]
mov byte [esp + 0x264], 7
call fcn.01055c58
push 0x10e44a8
mov eax, esi
jmp 0x105666a
mov esi, dword [ebp + 8]
and dword [esi + 0x10], 0
lea eax, [esp + 0x50]
mov dword [esi + 0x14], 0xf
push eax
mov ecx, esi
mov byte [esi], 0
call fcn.01054cde
mov ecx, dword [esp + 0x25c]
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10567d2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8cc0], 1
jne 0x1056832
or dword [0x10f8cc0], 1
mov dword [0x10f3844], 0x6c696744
mov dword [0x10f3848], 0x7a6a6144
mov dword [0x10f384c], 0x28717a69
mov dword [0x10f3850], 0x6461696e
mov dword [0x10f3854], 0x20286c6d
mov dword [0x10f3858], 0x667a6d63
mov dword [0x10f385c], 0x3a3b646d
mov dword [0x10f3860], 0x8283221
xor eax, eax
mov cl, byte [eax + 0x10f3844]
xor cl, 8
mov byte [eax + 0x10f3a44], cl
inc eax
cmp eax, 0x20
jb 0x1056834
mov eax, 0x10f3a44
ret
Function at 0x105684f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8cbc], 1
jne 0x10568a5
or dword [0x10f8cbc], 1
mov dword [0x10f3864], 0x4f3a3b43
mov dword [0x10f3868], 0x7a587c6d
mov dword [0x10f386c], 0x7b6d6b67
mov dword [0x10f3870], 0x6965417b
mov dword [0x10f3874], 0x614e6d6f
mov dword [0x10f3878], 0x69466d64
mov dword [0x10f387c], 0x8496d65
xor eax, eax
mov cl, byte [eax + 0x10f3864]
xor cl, 8
mov byte [eax + 0x10f3a64], cl
inc eax
cmp eax, 0x1c
jb 0x10568a7
mov eax, 0x10f3a64
ret

Function at 0x10568c2
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8cb8], 1
jne 0x10568ef
or dword [0x10f8cb8], 1
mov dword [0x10f3880], 0x78697b78
mov dword [0x10f3884], 0x646c2661
mov word [0x10f3888], 0x864
xor eax, eax
mov cl, byte [eax + 0x10f3880]
xor cl, 8
mov byte [eax + 0x10f3a80], cl
inc eax
cmp eax, 0xa
jb 0x10568f1
mov eax, 0x10f3a80
ret

Function at 0x105690c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8cb4], 1
jne 0x1056969
or dword [0x10f8cb4], 1
mov dword [0x10f388c], 0x6c696744
mov dword [0x10f3890], 0x7a6a6144
mov dword [0x10f3894], 0x28717a69
mov dword [0x10f3898], 0x6461696e
mov dword [0x10f389c], 0x20286c6d
mov dword [0x10f38a0], 0x78697b78
mov dword [0x10f38a4], 0x28322161
mov byte [0x10f38a8], 8
xor eax, eax
mov cl, byte [eax + 0x10f388c]
xor cl, 8
mov byte [eax + 0x10f3a8c], cl
inc eax
cmp eax, 0x1d
jb 0x105696b
mov eax, 0x10f3a8c
ret

Function at 0x1056986
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8cb0], 1
jne 0x10569d9
or dword [0x10f8cb0], 1
mov dword [0x10f38ac], 0x587c6d4f
mov dword [0x10f38b0], 0x6d6b677a
mov dword [0x10f38b4], 0x65417b7b
mov dword [0x10f38b8], 0x4e6d6f69
mov dword [0x10f38bc], 0x466d6461
mov dword [0x10f38c0], 0x496d6569
mov byte [0x10f38c4], 8
xor eax, eax
mov cl, byte [eax + 0x10f38ac]
xor cl, 8
mov byte [eax + 0x10f3aac], cl
inc eax
cmp eax, 0x19
jb 0x10569db
mov eax, 0x10f3aac
ret

Function at 0x10569f6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8cac], 1
jne 0x1056a92
or dword [0x10f8cac], 1
mov dword [0x10f38c8], 0x587c6d4f
mov dword [0x10f38cc], 0x496b677a
mov dword [0x10f38d0], 0x6d7a6c6c
mov dword [0x10f38d4], 0x6e287b7b
mov dword [0x10f38d8], 0x6d646169
mov dword [0x10f38dc], 0x4f20286c
mov dword [0x10f38e0], 0x7a587c6d
mov dword [0x10f38e4], 0x7b6d6b67
mov dword [0x10f38e8], 0x6965417b
mov dword [0x10f38ec], 0x614e6d6f
mov dword [0x10f38f0], 0x69466d64
mov dword [0x10f38f4], 0x21496d65
mov word [0x10f38f8], 0x2832
mov byte [0x10f38fa], 8
xor eax, eax
mov cl, byte [eax + 0x10f38c8]
xor cl, 8
mov byte [eax + 0x10f3ac8], cl
inc eax
cmp eax, 0x33
jb 0x1056a94
mov eax, 0x10f3ac8
ret
Function at 0x1056aaf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8ca8], 1
jne 0x1056b16
or dword [0x10f8ca8], 1
mov dword [0x10f38fc], 0x587c6d4f
mov dword [0x10f3900], 0x6d6b677a
mov dword [0x10f3904], 0x65417b7b
mov dword [0x10f3908], 0x4e6d6f69
mov dword [0x10f390c], 0x666d6461
mov dword [0x10f3910], 0x286d6569
mov dword [0x10f3914], 0x6461696e
mov dword [0x10f3918], 0x28326c6d
mov byte [0x10f391c], 8
xor eax, eax
mov cl, byte [eax + 0x10f38fc]
xor cl, 8
mov byte [eax + 0x10f3afc], cl
inc eax
cmp eax, 0x21
jb 0x1056b18
mov eax, 0x10f3afc
ret

Function at 0x10576e4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8ca4], 1
jne 0x10578ca
or dword [0x10f8ca4], 1
mov dword [0x10f3b28], 0x7a276660
mov dword [0x10f3b2c], 0x7c666d7d
mov dword [0x10f3b30], 0x6c7a337d
mov dword [0x10f3b34], 0x7c6b7f7d
mov dword [0x10f3b38], 0x672e216f
mov dword [0x10f3b3c], 0x3202e66
mov dword [0x10f3b40], 0x626a6879
mov dword [0x10f3b44], 0x276c6e68
mov dword [0x10f3b48], 0x617d6879
mov dword [0x10f3b4c], 0x2e293429
mov dword [0x10f3b50], 0x6c7b032e
mov dword [0x10f3b54], 0x7b607c78
mov dword [0x10f3b58], 0x7a2e216c
mov dword [0x10f3b5c], 0x6a607b7d
mov dword [0x10f3b60], 0x3202e7d
mov dword [0x10f3b64], 0x686a6665
mov dword [0x10f3b68], 0x257a2965
mov dword [0x10f3b6c], 0x34297b29
mov dword [0x10f3b70], 0x6a797129
mov dword [0x10f3b74], 0x21656568
mov dword [0x10f3b78], 0x6a677c6f
mov dword [0x10f3b7c], 0x6766607d
mov dword [0x10f3b80], 0x7b292021
mov dword [0x10f3b84], 0x7b7c7d6c
mov dword [0x10f3b88], 0x6c7b2967
mov dword [0x10f3b8c], 0x7b607c78
mov dword [0x10f3b90], 0x2c2e216c
mov dword [0x10f3b94], 0x27202e44
mov dword [0x10f3b98], 0x67606864
mov dword [0x10f3b9c], 0x68565621
mov dword [0x10f3ba0], 0x207a6e7b
mov dword [0x10f3ba4], 0x6d676c29
mov dword [0x10f3ba8], 0x6c6d2925
mov dword [0x10f3bac], 0x276e7c6b
mov dword [0x10f3bb0], 0x6a687b7d
mov dword [0x10f3bb4], 0x6a686b6c
mov dword [0x10f3bb8], 0x60032062
mov dword [0x10f3bbc], 0x6667296f
mov dword [0x10f3bc0], 0x297a297d
mov dword [0x10f3bc4], 0x676c617d
mov dword [0x10f3bc8], 0x7b7b6c29
mov dword [0x10f3bcc], 0x7b217b66
mov dword [0x10f3bd0], 0x676c2920
mov dword [0x10f3bd4], 0x6c7b036d
mov dword [0x10f3bd8], 0x677b7c7d
mov word [0x10f3bdc], 0x7b29
mov byte [0x10f3bde], 9
xor eax, eax
mov cl, byte [eax + 0x10f3b28]
xor cl, 9
mov byte [eax + 0x10f4118], cl
inc eax
cmp eax, 0xb7
jb 0x10578cc
mov eax, 0x10f4118
ret
Function at 0x10578e9
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8ca0], 1
jne 0x1057b6f
or dword [0x10f8ca0], 1
mov dword [0x10f3be0], 0x7a276660
mov dword [0x10f3be4], 0x7c666d7d
mov dword [0x10f3be8], 0x6c7a337d
mov dword [0x10f3bec], 0x7c6b7f7d
mov dword [0x10f3bf0], 0x672e216f
mov dword [0x10f3bf4], 0x3202e66
mov dword [0x10f3bf8], 0x626a6879
mov dword [0x10f3bfc], 0x276c6e68
mov dword [0x10f3c00], 0x617d6879
mov dword [0x10f3c04], 0x32e2e34
mov dword [0x10f3c08], 0x7c786c7b
mov dword [0x10f3c0c], 0x216c7b60
mov dword [0x10f3c10], 0x7b7d7a2e
mov dword [0x10f3c14], 0x2e7d6a60
mov dword [0x10f3c18], 0x66650320
mov dword [0x10f3c1c], 0x2965686a
mov dword [0x10f3c20], 0x34296564
mov dword [0x10f3c24], 0x786c7b29
mov dword [0x10f3c28], 0x6c7b607c
mov dword [0x10f3c2c], 0x65642e21
mov dword [0x10f3c30], 0x6503202e
mov dword [0x10f3c34], 0x65686a66
mov dword [0x10f3c38], 0x7b257a29
mov dword [0x10f3c3c], 0x34296c25
mov dword [0x10f3c40], 0x6a797129
mov dword [0x10f3c44], 0x21656568
mov dword [0x10f3c48], 0x6a677c6f
mov dword [0x10f3c4c], 0x6766607d
mov dword [0x10f3c50], 0x7b292021
mov dword [0x10f3c54], 0x7b7c7d6c
mov dword [0x10f3c58], 0x6c7b2967
mov dword [0x10f3c5c], 0x7b607c78
mov dword [0x10f3c60], 0x2c2e216c
mov dword [0x10f3c64], 0x27202e44
mov dword [0x10f3c68], 0x2c214f2c
mov dword [0x10f3c6c], 0x6c292048
mov dword [0x10f3c70], 0x29256d67
mov dword [0x10f3c74], 0x7c6b6c6d
mov dword [0x10f3c78], 0x7b7d276e
mov dword [0x10f3c7c], 0x6b6c6a68
mov dword [0x10f3c80], 0x20626a68
mov dword [0x10f3c84], 0x296f6003
mov dword [0x10f3c88], 0x297d6667
mov dword [0x10f3c8c], 0x617d297a
mov dword [0x10f3c90], 0x7b29676c
mov dword [0x10f3c94], 0x7b7c7d6c
mov dword [0x10f3c98], 0x60672967
mov dword [0x10f3c9c], 0x7b292565
mov dword [0x10f3ca0], 0x6d676c29
mov dword [0x10f3ca4], 0x296f6003
mov dword [0x10f3ca8], 0x3477297b
mov dword [0x10f3cac], 0x65606729
mov dword [0x10f3cb0], 0x6c617d29
mov dword [0x10f3cb4], 0x297b2967
mov dword [0x10f3cb8], 0x65642934
mov dword [0x10f3cbc], 0x7d7a7d27
mov dword [0x10f3cc0], 0x6e67607b
mov dword [0x10f3cc4], 0x29207b21
mov dword [0x10f3cc8], 0x36d676c
mov dword [0x10f3ccc], 0x7c7d6c7b
mov dword [0x10f3cd0], 0x7b29677b
mov word [0x10f3cd4], 0x6c25
mov byte [0x10f3cd6], 9
xor eax, eax
mov cl, byte [eax + 0x10f3be0]
xor cl, 9
mov byte [eax + 0x10f41d0], cl
inc eax
cmp eax, 0xf7
jb 0x1057b71
mov eax, 0x10f41d0
ret
Function at 0x1057b8e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
test byte [0x10f8c64], 1
jne 0x1057bb5
or dword [0x10f8c64], 1
mov dword [0x10f3dc8], 0x626a6879
mov dword [0x10f3dcc], 0x96c6e68
xor eax, eax
mov cl, byte [eax + 0x10f3dc8]
xor cl, 9
mov byte [eax + 0x10f43b8], cl
inc eax
cmp eax, 8
jb 0x1057bb7
push 0x10f43b8
push dword [ebp + 8]
call fcn.01088c75
test byte [0x10f8c60], 1
pop ecx
pop ecx
jne 0x1057bff
or dword [0x10f8c60], 1
mov dword [0x10f3dd0], 0x656c7b79
mov dword [0x10f3dd4], 0x96d6866
xor eax, eax
mov cl, byte [eax + 0x10f3dd0]
xor cl, 9
mov byte [eax + 0x10f43c0], cl
inc eax
cmp eax, 8
jb 0x1057c01
push esi
push 0x10f43c0
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.01088ce9
add esp, 0xc
cmp dword [0x10eebe0], 0
mov esi, 0x10eebe0
je 0x1057c61
push edi
mov edi, esi
push 0
push dword [esi + 4]
push dword [ebp + 8]
call fcn.01088b95
push dword [esi]
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.01088f16
add edi, 8
add esp, 0x18
cmp dword [edi], 0
mov esi, edi
jne 0x1057c3a
pop edi
push 0xfffffffffffffffd
push dword [ebp + 8]
call fcn.010883ea
pop ecx
pop ecx
pop esi
pop ebp
ret
Function at 0x1057edb
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10c2d38
call fcn.010c1cf8
sub esp, 0x64
test byte [0x10f8c4c], 1
jne 0x1057f08
or dword [0x10f8c4c], 1
mov word [0x10f3e00], 0x442c
mov byte [0x10f3e02], 9
push ebx
push esi
xor ebx, ebx
push edi
xor eax, eax
mov cl, byte [eax + 0x10f3e00]
xor cl, 9
mov byte [eax + 0x10f43f0], cl
inc eax
cmp eax, 3
jb 0x1057f0f
mov esi, 0x10f43f0
mov eax, esi
mov dword [ebp - 0x40], 0xf
mov dword [ebp - 0x44], ebx
mov byte [ebp - 0x54], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1057f3b
sub eax, edi
push eax
push esi
lea ecx, [ebp - 0x54]
call fcn.01054c69
push dword [ebp + 0x10]
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 4], ebx
call fcn.0105d0cc
add esp, 0x10
push ebx
push 1
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.01054cff
cmp dword [ebp - 0x5c], 0x10
mov eax, dword [ebp - 0x70]
jae 0x1057f82
lea eax, [ebp - 0x70]
mov esi, dword [ebp + 8]
push eax
push esi
call fcn.010877e8
pop ecx
pop ecx
cmp eax, ebx
je 0x1057fd3
cmp eax, 3
jne 0x1057fc0
call fcn.010580da
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0109ba25
mov dword [ebp - 0x1c], vtable.std::runtime_error.0
push 0x10e44a8
lea eax, [ebp - 0x1c]
push eax
call fcn.010a5926
cmp eax, 4
jne 0x1057fcc
call fcn.0105818d
jmp 0x1057f9c
call fcn.01058240
jmp 0x1057f9c
push ebx
push ebx
push ebx
push 1
push ebx
push esi
call fcn.0108921e
mov edi, eax
add esp, 0x18
cmp edi, ebx
je 0x105808a
push ebx
call fcn.010582c4
push eax
push 0xffffffffffffffff
push esi
call fcn.01087f7f
add esp, 0x10
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x24], 0xf
mov dword [ebp - 0x28], ebx
mov byte [ebp - 0x38], bl
call fcn.01054cde
mov byte [ebp - 4], 3
cmp edi, 2
jne 0x1058042
call fcn.0105830b
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0105d13d
pop ecx
pop ecx
mov byte [ebp - 4], 4
lea esi, [ebp - 0x1c]
call fcn.01055c58
jmp 0x1057fb2
cmp edi, 4
jne 0x1058061
call fcn.0105836a
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0105d13d
pop ecx
pop ecx
mov byte [ebp - 4], 5
jmp 0x1058035
cmp edi, 6
jne 0x1058080
call fcn.010583cf
push eax
lea eax, [ebp - 0x54]
push eax
lea edi, [ebp - 0x38]
call fcn.0105d13d
pop ecx
pop ecx
mov byte [ebp - 4], 6
jmp 0x1058035
call fcn.01058453
jmp 0x1057f9c
or edi, 0xffffffff
push edi
push esi
mov dword [ebp - 0x10], edi
call fcn.010885da
pop ecx
pop ecx
test eax, eax
je 0x10580ab
push ebx
push edi
push esi
call fcn.0108879e
add esp, 0xc
mov dword [ebp - 0x10], eax
push esi
call fcn.010883d4
sub edi, eax
push edi
push esi
call fcn.010883ea
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x70]
call fcn.01054cff
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10580da
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8c48], 1
jne 0x1058170
or dword [0x10f8c48], 1
mov dword [0x10f3e04], 0x6560684f
mov dword [0x10f3e08], 0x7d296d6c
mov dword [0x10f3e0c], 0x7f6c2966
mov dword [0x10f3e10], 0x687c6568
mov dword [0x10f3e14], 0x6b296c7d
mov dword [0x10f3e18], 0x7a7d6666
mov dword [0x10f3e1c], 0x79687b7d
mov dword [0x10f3e20], 0x687b6f29
mov dword [0x10f3e24], 0x676c646e
mov dword [0x10f3e28], 0x7a29257d
mov dword [0x10f3e2c], 0x687d6770
mov dword [0x10f3e30], 0x7b6c2971
mov dword [0x10f3e34], 0x97b667b
xor eax, eax
mov cl, byte [eax + 0x10f3e04]
xor cl, 9
mov byte [eax + 0x10f43f4], cl
inc eax
cmp eax, 0x34
jb 0x1058172
mov eax, 0x10f43f4
ret

Function at 0x105818d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8c44], 1
jne 0x1058223
or dword [0x10f8c44], 1
mov dword [0x10f3e38], 0x6560684f
mov dword [0x10f3e3c], 0x7d296d6c
mov dword [0x10f3e40], 0x7f6c2966
mov dword [0x10f3e44], 0x687c6568
mov dword [0x10f3e48], 0x6b296c7d
mov dword [0x10f3e4c], 0x7a7d6666
mov dword [0x10f3e50], 0x79687b7d
mov dword [0x10f3e54], 0x687b6f29
mov dword [0x10f3e58], 0x676c646e
mov dword [0x10f3e5c], 0x6429257d
mov dword [0x10f3e60], 0x7b66646c
mov dword [0x10f3e64], 0x7b6c2970
mov dword [0x10f3e68], 0x97b667b
xor eax, eax
mov cl, byte [eax + 0x10f3e38]
xor cl, 9
mov byte [eax + 0x10f4428], cl
inc eax
cmp eax, 0x34
jb 0x1058225
mov eax, 0x10f4428
ret

Function at 0x1058240
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8c40], 1
jne 0x10582a7
or dword [0x10f8c40], 1
mov dword [0x10f3e6c], 0x6762675c
mov dword [0x10f3e70], 0x29677e66
mov dword [0x10f3e74], 0x667b7b6c
mov dword [0x10f3e78], 0x6760297b
mov dword [0x10f3e7c], 0x687c6529
mov dword [0x10f3e80], 0x66655645
mov dword [0x10f3e84], 0x7d7a6d68
mov dword [0x10f3e88], 0x6e67607b
mov byte [0x10f3e8c], 9
xor eax, eax
mov cl, byte [eax + 0x10f3e6c]
xor cl, 9
mov byte [eax + 0x10f445c], cl
inc eax
cmp eax, 0x21
jb 0x10582a9
mov eax, 0x10f445c
ret

Function at 0x10582c4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8c3c], 1
jne 0x10582ee
or dword [0x10f8c3c], 1
mov dword [0x10f3e90], 0x67666735
mov word [0x10f3e94], 0x376c
mov byte [0x10f3e96], 9
xor eax, eax
mov cl, byte [eax + 0x10f3e90]
xor cl, 9
mov byte [eax + 0x10f4480], cl
inc eax
cmp eax, 7
jb 0x10582f0
mov eax, 0x10f4480
ret

Function at 0x105830b
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f8c38], 1
jne 0x105834d
or dword [0x10f8c38], 1
mov dword [0x10f3e98], 0x29687c45
mov dword [0x10f3e9c], 0x7d677c7b
mov dword [0x10f3ea0], 0x296c6460
mov dword [0x10f3ea4], 0x667b7b6c
mov dword [0x10f3ea8], 0x929337b
xor eax, eax
mov cl, byte [eax + 0x10f3e98]
xor cl, 9
mov byte [eax + 0x10f4488], cl
inc eax
cmp eax, 0x14
jb 0x105834f
mov eax, 0x10f4488
ret