joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a100
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x19
mov dword [esp + 0x10], eax
mov ecx, dword [0x10020368]
xor eax, eax
cmp dword [ecx + 0xd6d491e], 1
mov dword [esp + 0x14], eax
je 0x1000a186
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x19
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0x14
mov dword [esp + 0x14], eax
jne 0x1000a135
mov eax, dword [0x10020368]
mov dword [eax + 0xd6d491e], 1
add esp, 0x18
pop esi
pop edi
ret

Function at 0x1000a190
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov eax, dword [0x10021c38]
mov ecx, dword [0x10021c34]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a1d6
jmp 0x1000a294
mov eax, dword [esp + 0x14]
add eax, 0x14
mov dword [esp + 0xc], eax
mov eax, dword [0x1002036c]
cmp dword [eax - 0x6caefd6d], 1
sete al
mov byte [esp + 0x13], al
mov eax, dword [0x10021c38]
mov ecx, dword [0x10021c34]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a225
jmp 0x1000a294
mov cl, byte [esp + 0x13]
xor eax, eax
test cl, 1
mov dword [esp + 8], eax
jne 0x1000a28e
jmp 0x1000a23d
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x14
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 2
mov dword [esp + 8], eax
jne 0x1000a23d
mov eax, dword [0x1002036c]
mov dword [eax - 0x6caefd6d], 1
add esp, 0x1c
pop esi
pop edi
ret
jmp 0x1000a1d6
Function at 0x1000a2a0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov eax, dword [0x10021c30]
mov ecx, dword [0x10021c2c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a2e6
jmp 0x1000a3a4
mov eax, dword [esp + 0x14]
add eax, 0x1e
mov dword [esp + 0xc], eax
mov eax, dword [0x10020370]
cmp dword [eax - 0x589c0613], 1
sete al
mov byte [esp + 0x13], al
mov eax, dword [0x10021c30]
mov ecx, dword [0x10021c2c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a335
jmp 0x1000a3a4
mov cl, byte [esp + 0x13]
xor eax, eax
test cl, 1
mov dword [esp + 8], eax
jne 0x1000a39e
jmp 0x1000a34d
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1e
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 4
mov dword [esp + 8], eax
jne 0x1000a34d
mov eax, dword [0x10020370]
mov dword [eax - 0x589c0613], 1
add esp, 0x1c
pop esi
pop edi
ret
jmp 0x1000a2e6

Function at 0x1000a3b0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x17
mov dword [esp + 0x10], eax
mov ecx, dword [0x10020374]
xor eax, eax
cmp dword [ecx + 0x397d0457], 1
mov dword [esp + 0x14], eax
je 0x1000a49d
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x17
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 2
mov dword [esp + 0x14], eax
jne 0x1000a3e5
mov eax, dword [0x10021c28]
mov ecx, dword [0x10021c24]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a458
jmp 0x1000a505
mov eax, dword [0x10020374]
mov dword [eax + 0x397d0457], 1
mov eax, dword [0x10021c28]
mov ecx, dword [0x10021c24]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a498
jmp 0x1000a505
jmp 0x1000a49d
mov eax, dword [0x10021c28]
mov ecx, dword [0x10021c24]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a4ce
jmp 0x1000a519
mov eax, dword [0x10021c28]
mov ecx, dword [0x10021c24]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a4ff
jmp 0x1000a519
add esp, 0x18
pop esi
pop edi
ret
mov eax, dword [0x10020374]
mov dword [eax + 0x397d0457], 1
jmp 0x1000a458
jmp 0x1000a4ce
Function at 0x1000a520
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
add eax, 0x10
mov dword [esp + 8], eax
mov ecx, dword [0x10020378]
xor eax, eax
cmp dword [ecx + 0x489335a3], 1
mov dword [esp + 0xc], eax
je 0x1000a590
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
mov esi, dword [esp]
mov edx, dword [esp + 8]
mov dl, byte [edx + eax]
mov edi, eax
and edi, 0xf
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0x13
mov dword [esp + 0xc], eax
jne 0x1000a554
mov eax, dword [0x10020378]
mov dword [eax + 0x489335a3], 1
add esp, 0x10
pop esi
pop edi
ret

Function at 0x1000a5a0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x19
mov dword [esp + 0x10], eax
mov ecx, dword [0x1002037c]
xor eax, eax
cmp dword [ecx + 0x7e390388], 1
mov dword [esp + 0x14], eax
je 0x1000a626
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x19
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 2
mov dword [esp + 0x14], eax
jne 0x1000a5d5
mov eax, dword [0x1002037c]
mov dword [eax + 0x7e390388], 1
add esp, 0x18
pop esi
pop edi
ret

Function at 0x1000a630
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x1d
mov dword [esp + 0x10], eax
mov ecx, dword [0x10020380]
xor eax, eax
cmp dword [ecx - 0x2d0e988], 1
mov dword [esp + 0x14], eax
je 0x1000a6b6
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1d
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0x40
mov dword [esp + 0x14], eax
jne 0x1000a665
mov eax, dword [0x10020380]
mov dword [eax - 0x2d0e988], 1
add esp, 0x18
pop esi
pop edi
ret
Function at 0x1000a6c0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x1f
mov dword [esp + 0x10], eax
mov ecx, dword [0x10020384]
xor eax, eax
cmp dword [ecx - 0x3c32af95], 1
mov dword [esp + 0x14], eax
je 0x1000a7ad
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1f
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0x40
mov dword [esp + 0x14], eax
jne 0x1000a6f5
mov eax, dword [0x10021c20]
mov ecx, dword [0x10021c1c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a768
jmp 0x1000a7b3
mov eax, dword [0x10020384]
mov dword [eax - 0x3c32af95], 1
mov eax, dword [0x10021c20]
mov ecx, dword [0x10021c1c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a7a8
jmp 0x1000a7b3
jmp 0x1000a7ad
add esp, 0x18
pop esi
pop edi
ret
mov eax, dword [0x10020384]
mov dword [eax - 0x3c32af95], 1
jmp 0x1000a768

Function at 0x1000a7d0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov eax, dword [0x10021c18]
mov ecx, dword [0x10021c14]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a816
jmp 0x1000a8d4
mov eax, dword [esp + 0x14]
add eax, 0x15
mov dword [esp + 0xc], eax
mov eax, dword [0x10020388]
cmp dword [eax - 0x4abf7a88], 1
sete al
mov byte [esp + 0x13], al
mov eax, dword [0x10021c18]
mov ecx, dword [0x10021c14]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a865
jmp 0x1000a8d4
mov cl, byte [esp + 0x13]
xor eax, eax
test cl, 1
mov dword [esp + 8], eax
jne 0x1000a8ce
jmp 0x1000a87d
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x15
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 6
mov dword [esp + 8], eax
jne 0x1000a87d
mov eax, dword [0x10020388]
mov dword [eax - 0x4abf7a88], 1
add esp, 0x1c
pop esi
pop edi
ret
jmp 0x1000a816
Function at 0x1000a8e0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x19
mov dword [esp + 0x10], eax
mov ecx, dword [0x1002038c]
xor eax, eax
cmp dword [ecx + 0x44462fc3], 1
mov dword [esp + 0x14], eax
je 0x1000a9cd
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x19
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0x1c
mov dword [esp + 0x14], eax
jne 0x1000a915
mov eax, dword [0x10021c10]
mov ecx, dword [0x10021c0c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a988
jmp 0x1000a9d3
mov eax, dword [0x1002038c]
mov dword [eax + 0x44462fc3], 1
mov eax, dword [0x10021c10]
mov ecx, dword [0x10021c0c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a9c8
jmp 0x1000a9d3
jmp 0x1000a9cd
add esp, 0x18
pop esi
pop edi
ret
mov eax, dword [0x1002038c]
mov dword [eax + 0x44462fc3], 1
jmp 0x1000a988

Function at 0x1000a9f0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov eax, dword [0x10021c08]
mov ecx, dword [0x10021c04]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000aa36
jmp 0x1000aaf4
mov eax, dword [esp + 0x14]
add eax, 0x1a
mov dword [esp + 0xc], eax
mov eax, dword [0x10020390]
cmp dword [eax + 0x151eecb2], 1
sete al
mov byte [esp + 0x13], al
mov eax, dword [0x10021c08]
mov ecx, dword [0x10021c04]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000aa85
jmp 0x1000aaf4
mov cl, byte [esp + 0x13]
xor eax, eax
test cl, 1
mov dword [esp + 8], eax
jne 0x1000aaee
jmp 0x1000aa9d
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1a
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 3
mov dword [esp + 8], eax
jne 0x1000aa9d
mov eax, dword [0x10020390]
mov dword [eax + 0x151eecb2], 1
add esp, 0x1c
pop esi
pop edi
ret
jmp 0x1000aa36
Function at 0x1000ae00
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov eax, dword [0x10021bf0]
mov ecx, dword [0x10021bec]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000ae46
jmp 0x1000af04
mov eax, dword [esp + 0x14]
add eax, 0x14
mov dword [esp + 0xc], eax
mov eax, dword [str._rpj]
cmp dword [eax - 0x5a6e6104], 1
sete al
mov byte [esp + 0x13], al
mov eax, dword [0x10021bf0]
mov ecx, dword [0x10021bec]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000ae95
jmp 0x1000af04
mov cl, byte [esp + 0x13]
xor eax, eax
test cl, 1
mov dword [esp + 8], eax
jne 0x1000aefe
jmp 0x1000aead
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x14
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0x14
mov dword [esp + 8], eax
jne 0x1000aead
mov eax, dword [str._rpj]
mov dword [eax - 0x5a6e6104], 1
add esp, 0x1c
pop esi
pop edi
ret
jmp 0x1000ae46

Function at 0x1000af10
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov eax, dword [0x10021be8]
mov ecx, dword [0x10021be4]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000af56
jmp 0x1000b014
mov eax, dword [esp + 0x14]
add eax, 0x12
mov dword [esp + 0xc], eax
mov eax, dword [0x100203a0]
cmp dword [eax - 0x710caf49], 1
sete al
mov byte [esp + 0x13], al
mov eax, dword [0x10021be8]
mov ecx, dword [0x10021be4]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000afa5
jmp 0x1000b014
mov cl, byte [esp + 0x13]
xor eax, eax
test cl, 1
mov dword [esp + 8], eax
jne 0x1000b00e
jmp 0x1000afbd
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x12
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0x15
mov dword [esp + 8], eax
jne 0x1000afbd
mov eax, dword [0x100203a0]
mov dword [eax - 0x710caf49], 1
add esp, 0x1c
pop esi
pop edi
ret
jmp 0x1000af56
Function at 0x1000b020
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x1a
mov dword [esp + 0x10], eax
mov ecx, dword [0x100203a4]
xor eax, eax
cmp dword [ecx + 0x5d4fcdbf], 1
mov dword [esp + 0x14], eax
je 0x1000b0a6
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1a
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0xb
mov dword [esp + 0x14], eax
jne 0x1000b055
mov eax, dword [0x100203a4]
mov dword [eax + 0x5d4fcdbf], 1
add esp, 0x18
pop esi
pop edi
ret

Function at 0x1000b0b0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x1f
mov dword [esp + 0x10], eax
mov ecx, dword [0x100203a8]
xor eax, eax
cmp dword [ecx + 0x4154e7d5], 1
mov dword [esp + 0x14], eax
je 0x1000b136
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1f
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0xa
mov dword [esp + 0x14], eax
jne 0x1000b0e5
mov eax, dword [0x100203a8]
mov dword [eax + 0x4154e7d5], 1
add esp, 0x18
pop esi
pop edi
ret

Function at 0x1000b140
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x17
mov dword [esp + 0x10], eax
mov ecx, dword [0x100203ac]
xor eax, eax
cmp dword [ecx + 0x2b84d624], 1
mov dword [esp + 0x14], eax
je 0x1000b1c6
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x17
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0xd
mov dword [esp + 0x14], eax
jne 0x1000b175
mov eax, dword [0x100203ac]
mov dword [eax + 0x2b84d624], 1
add esp, 0x18
pop esi
pop edi
ret

Function at 0x1000fdfd
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000fe3c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000fe3c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000fe3c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000fe3c
cmp dword [ecx + 0x74], 0xe
jbe 0x1000fe3c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10012aed
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10012b8a
push ebx
push esi
call fcn.10012ab6
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10012a4a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10012b37
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10012b89
push edi
push eax
call fcn.10010ac7
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10012b57
call fcn.10010a8d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10012b88
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10012a4a
add esp, 0x20
test eax, eax
jne 0x10012b76
push edi
call fcn.10010a8d
jmp 0x10012b7e
push ebx
call fcn.10010a8d
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10012df7
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001b0d8
push 0x1001b0d0
push str.FlsAlloc
push 0x1f
call fcn.10012d13
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10012e2b
push dword [ebp + 8]
mov ecx, esi
call dword [0x10019148]
call esi
jmp 0x10012e31
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10012e75
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001b0e8
push 0x1001b0e0
push str.FlsGetValue
push 0x21
call fcn.10012d13
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10012eac
push dword [ebp + 8]
mov ecx, esi
call dword [0x10019148]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10012eb4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001b0f0
push 0x1001b0e8
push str.FlsSetValue
push 0x22
call fcn.10012d13
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10012eee
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10019148]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10018520
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001854d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001854d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..data
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x19e69ce
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data_1
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x64413df6
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219