joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100698c0
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1015c587
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0x38], ebx
call fcn.10067c00
mov al, byte [esp + 0x4c]
push 0x101913e8
mov byte [esp + 0x2c], al
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call fcn.1013c2c2
add esp, 4
lea ecx, [esp + 0x28]
push eax
push 0x101913e8
call fcn.1000bf40
mov al, byte [0x1019800c]
mov dword [esp + 0x44], 1
test al, 1
mov word [esp + 8], bx
mov word [esp + 0xa], 6
mov word [esp + 0xc], 0x10
mov word [esp + 0xe], 7
mov word [esp + 0x10], 0x2a
mov word [esp + 0x12], 0x1c
mov word [esp + 0x14], 0x11
jne 0x100699b6
push edi
or al, 1
push 0x10
mov byte [0x1019800c], al
call fcn.1013c2df
add esp, 4
mov dword [0x10198010], eax
xor esi, esi
mov di, word [esp + esi + 0xc]
push 0x75
mov ecx, edi
and ecx, 0xffff
push ecx
mov ecx, 0x10198010
call fcn.100a8ee0
mov edx, dword [0x10198010]
add eax, 0x75
xor eax, edi
mov word [esi + edx], ax
add esi, 2
cmp esi, 0xe
jb 0x1006996e
mov eax, dword [0x10198010]
push 0x10043b90
mov word [eax + 0xe], bx
call fcn.1013c36b
add esp, 4
pop edi
mov esi, dword [0x10198010]
mov cl, byte [esp + 0x4c]
push esi
mov byte [esp + 0x1c], cl
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call fcn.1013c2c2
add esp, 4
lea ecx, [esp + 0x18]
push eax
push esi
call fcn.1000bf40
mov esi, dword [esp + 0x4c]
mov ecx, dword [0x10191a54]
lea edx, [esp + 0x28]
lea eax, [esp + 0x18]
push edx
push eax
push esi
mov byte [esp + 0x50], 2
call fcn.10058e60
mov ecx, eax
call fcn.10067fe0
mov dword [esp + 0x38], 1
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x44], 1
cmp ecx, ebx
je 0x10069a3d
mov al, byte [ecx - 1]
cmp al, bl
je 0x10069a31
cmp al, 0xff
je 0x10069a31
dec al
mov byte [ecx - 1], al
jmp 0x10069a3d
lea eax, [ecx - 2]
push eax
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
cmp ecx, ebx
mov byte [esp + 0x44], bl
je 0x10069a84
mov al, byte [ecx - 1]
cmp al, bl
je 0x10069a78
cmp al, 0xff
je 0x10069a78
dec al
mov byte [ecx - 1], al
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x10069aa0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1015c5bf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov al, byte [0x10198004]
push ebx
push ebp
xor ebx, ebx
push esi
push edi
test al, 1
mov dword [esp + 0x34], ebx
mov word [esp + 0x20], 0x54
mov word [esp + 0x22], 6
mov word [esp + 0x24], 0x3d
mov word [esp + 0x26], 0x31
mov word [esp + 0x28], 0x1b
mov word [esp + 0x2a], 0x18
mov word [esp + 0x2c], 0xf
mov word [esp + 0x2e], 7
mov word [esp + 0x30], 0x17
jne 0x10069b71
or al, 1
push 0x14
mov byte [0x10198004], al
call fcn.1013c2df
add esp, 4
mov dword [0x10198008], eax
mov edi, 0x30
xor esi, esi
mov bp, word [esp + esi + 0x20]
push edi
mov eax, ebp
mov ecx, 0x10198008
and eax, 0xffff
push eax
call fcn.1004a650
mov ecx, dword [0x10198008]
xor eax, ebp
xor eax, edi
xor edi, edi
mov word [esi + ecx], ax
mov eax, dword [0x10198008]
mov di, word [esi + eax]
add esi, 2
cmp esi, 0x12
jb 0x10069b27
push 0x10043ba0
mov word [eax + 0x12], bx
call fcn.1013c36b
add esp, 4
mov edi, dword [0x10198008]
mov dl, byte [esp + 0x48]
push edi
mov byte [esp + 0x14], dl
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.1013c2c2
add esp, 4
mov ebp, 1
mov esi, eax
lea ecx, [esp + 0x10]
push ebp
push esi
call fcn.1000c010
test al, al
je 0x10069bc3
mov eax, dword [esp + 0x14]
push esi
push edi
push eax
call fcn.100017d0
add esp, 0xc
lea ecx, [esp + 0x10]
push esi
call fcn.1000bff0
lea ecx, [esp + 0x10]
push ebx
push ecx
mov ecx, dword [0x10191a54]
mov dword [esp + 0x48], ebp
call fcn.10058e60
mov ecx, eax
call fcn.10067e70
mov ecx, dword [esp + 0x14]
mov esi, eax
cmp ecx, ebx
mov byte [esp + 0x40], bl
je 0x10069c0b
mov al, byte [ecx - 1]
cmp al, bl
je 0x10069bff
cmp al, 0xff
je 0x10069bff
dec al
mov byte [ecx - 1], al
jmp 0x10069c0b
lea eax, [ecx - 2]
push eax
call fcn.101307a0
add esp, 4
call fcn.10067c00
cmp esi, ebx
jne 0x10069c78
mov esi, dword [esp + 0x48]
mov dl, byte [esp + 0x48]
push 0x101913e8
mov byte [esi], dl
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.1013c2c2
add esp, 4
mov edi, eax
mov ecx, esi
push ebp
push edi
call fcn.1000c010
test al, al
je 0x10069c72
mov ecx, dword [esi + 4]
cmp edi, ebx
mov eax, 0x101913e8
jbe 0x10069c65
sub ecx, eax
mov edx, edi
mov bp, word [eax]
mov word [ecx + eax], bp
add eax, 2
dec edx
jne 0x10069c53
mov ebp, 1
mov eax, dword [esi + 4]
mov dword [esi + 8], edi
mov word [eax + edi*2], bx
lea eax, [eax + edi*2]
mov dword [esp + 0x34], ebp
jmp 0x10069c8c
push 0xa
push esi
mov esi, dword [esp + 0x50]
push esi
call fcn.10021a90
add esp, 0xc
mov dword [esp + 0x34], ebp
mov ecx, dword [esp + 0x38]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x10069f20
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1015c620
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov al, byte [esp + 0x38]
push ebx
mov bl, byte [0x1018c7f0]
push ebp
dec bl
push esi
mov byte [0x1018c7f0], bl
push edi
xor ebx, ebx
push 0x101913e8
mov byte [esp + 0x1c], al
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call fcn.1013c2c2
add esp, 4
lea ecx, [esp + 0x18]
push eax
push 0x101913e8
call fcn.1000bf40
mov edx, dword [esp + 0x48]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [0x10191a54]
lea eax, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x4c], ebx
call fcn.10058e60
mov ecx, eax
call fcn.10067fe0
mov ebp, eax
mov cl, byte [0x10197e8c]
mov al, 1
test al, cl
mov byte [esp + 0x40], al
mov word [esp + 0x10], 0x98
mov word [esp + 0x12], 0x9e
mov word [esp + 0x14], 0x99
mov word [esp + 0x16], 0x89
jne 0x1006a034
or cl, al
push 0xa
mov byte [0x10197e8c], cl
call fcn.1013c2df
add esp, 4
mov dword [0x10197e90], eax
xor esi, esi
mov di, word [esp + esi + 0x10]
push 0xec
mov ecx, edi
and ecx, 0xffff
push ecx
mov ecx, 0x10197e90
call fcn.100a8ee0
mov edx, dword [0x10197e90]
add eax, 0xec
xor eax, edi
mov word [esi + edx], ax
add esi, 2
cmp esi, 8
jb 0x10069fe8
mov eax, dword [0x10197e90]
push 0x10043a50
mov word [eax + 8], bx
call fcn.1013c36b
add esp, 4
mov edi, dword [0x10197e90]
push edi
call fcn.1013c2c2
mov ebx, dword [ebp + 8]
add esp, 4
cmp ebx, eax
mov esi, ebx
jb 0x1006a04e
mov esi, eax
mov ecx, dword [ebp + 4]
mov edx, edi
test esi, esi
jbe 0x1006a07a
mov di, word [ecx]
cmp di, word [edx]
jne 0x1006a06a
add ecx, 2
add edx, 2
dec esi
jne 0x1006a057
jmp 0x1006a07a
mov cx, word [ecx]
cmp cx, word [edx]
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
test ecx, ecx
jne 0x1006a08c
cmp ebx, eax
jae 0x1006a083
or ecx, 0xffffffff
jmp 0x1006a08a
xor ecx, ecx
cmp ebx, eax
setne cl
test ecx, ecx
mov ecx, dword [esp + 0x2c]
mov byte [esp + 0x40], 0
sete bl
xor esi, esi
cmp ecx, esi
je 0x1006a0bc
mov al, byte [ecx - 1]
test al, al
je 0x1006a0b0
cmp al, 0xff
je 0x1006a0b0
dec al
mov byte [ecx - 1], al
jmp 0x1006a0bc
lea eax, [ecx - 2]
push eax
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
cmp ecx, esi
mov dword [esp + 0x40], 0xffffffff
je 0x1006a0f6
mov al, byte [ecx - 1]
test al, al
je 0x1006a0ea
cmp al, 0xff
je 0x1006a0ea
dec al
mov byte [ecx - 1], al
jmp 0x1006a0f6
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x38]
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x1006a110
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1015c638
push eax
mov al, byte [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
xor ebx, ebx
push esi
cmp al, bl
push edi
je 0x1006a1cd
mov al, byte [0x10197e8c]
mov word [esp + 0xc], 0x98
test al, 1
mov word [esp + 0xe], 0x9e
mov word [esp + 0x10], 0x99
mov word [esp + 0x12], 0x89
jne 0x1006a1c2
or al, 1
push 0xa
mov byte [0x10197e8c], al
call fcn.1013c2df
add esp, 4
mov dword [0x10197e90], eax
xor esi, esi
mov di, word [esp + esi + 0xc]
push 0xec
mov eax, edi
mov ecx, 0x10197e90
and eax, 0xffff
push eax
call fcn.100a8ee0
mov ecx, dword [0x10197e90]
add eax, 0xec
xor eax, edi
mov word [esi + ecx], ax
add esi, 2
cmp esi, 8
jb 0x1006a176
mov edx, dword [0x10197e90]
push 0x10043a50
mov word [edx + 8], bx
call fcn.1013c36b
add esp, 4
mov edi, dword [0x10197e90]
jmp 0x1006a264
mov al, byte [0x1019771c]
mov word [esp + 0xc], 0xffdd
test al, 1
mov word [esp + 0xe], 0xffd8
mov word [esp + 0x10], 0xffe3
mov word [esp + 0x12], 0xffea
mov word [esp + 0x14], 0xffdc
jne 0x1006a25e
or al, 1
push 0xc
mov byte [0x1019771c], al
call fcn.1013c2df
add esp, 4
mov dword [0x10197720], eax
xor edi, edi
mov si, word [esp + edi + 0xc]
push 0x89
mov eax, esi
mov ecx, 0x10197720
and eax, 0xffff
push eax
call fcn.1002ea10
mov ecx, dword [0x10197720]
sub esi, eax
add esi, 0x89
mov word [edi + ecx], si
add edi, 2
cmp edi, 0xa
jb 0x1006a211
mov edx, dword [0x10197720]
push 0x1006b950
mov word [edx + 0xa], bx
call fcn.1013c36b
add esp, 4
mov edi, dword [0x10197720]
mov al, byte [esp + 0x3c]
push edi
mov byte [esp + 0x1c], al
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call fcn.1013c2c2
add esp, 4
mov esi, eax
lea ecx, [esp + 0x18]
push 1
push esi
call fcn.1000c010
test al, al
je 0x1006a2ae
mov ecx, dword [esp + 0x1c]
push esi
push edi
push ecx
call fcn.100017d0
mov edx, dword [esp + 0x28]
mov dword [esp + 0x2c], esi
add esp, 0xc
mov word [edx + esi*2], bx
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x18]
push eax
push ecx
mov ecx, dword [0x10191a54]
mov dword [esp + 0x38], ebx
call fcn.10058e60
mov ecx, eax
call fcn.10068200
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
cmp ecx, ebx
je 0x1006a2fc
mov al, byte [ecx - 1]
cmp al, bl
je 0x1006a2f0
cmp al, 0xff
je 0x1006a2f0
dec al
mov byte [ecx - 1], al
jmp 0x1006a2fc
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov eax, 0x304
mov ecx, dword [0x1018c7c8]
cdq
idiv dword [0x1018c7cc]
mov al, 0xb7
pop edi
pop esi
mov bl, byte [edx + ecx]
mov ecx, dword [esp + 0x20]
sub al, bl
pop ebx
mov byte [0x1018c7f1], al
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x1006ef90
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1015cb28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, 0xce
mov ecx, 0xd9
mov word [esp + 0x12], ax
mov word [esp + 0x1a], ax
mov eax, 0xc6
push ebx
mov word [esp + 0x28], ax
mov word [esp + 0x34], ax
mov al, byte [0x10197644]
mov word [esp + 0x14], cx
mov word [esp + 0x1c], cx
mov ecx, 0xf4
xor ebx, ebx
push esi
test al, 1
push edi
mov word [esp + 0x20], 0xcf
mov word [esp + 0x22], 0xc2
mov word [esp + 0x28], 0xc8
mov word [esp + 0x2a], 0xdf
mov word [esp + 0x2c], 0xd8
mov word [esp + 0x2e], cx
mov word [esp + 0x32], 0xca
mov word [esp + 0x34], 0xd3
mov word [esp + 0x36], cx
mov word [esp + 0x38], 0xc5
mov word [esp + 0x3a], 0xde
jne 0x1006f095
or al, 1
push 0x24
mov byte [0x10197644], al
call fcn.1013c2df
add esp, 4
mov dword [0x10197648], eax
xor esi, esi
mov di, word [esp + esi + 0x1c]
push 0xab
mov eax, edi
mov ecx, 0x10197648
and eax, 0xffff
push eax
call fcn.100a8ee0
mov ecx, dword [0x10197648]
add eax, 0xab
xor eax, edi
mov word [esi + ecx], ax
add esi, 2
cmp esi, 0x22
jb 0x1006f049
mov edx, dword [0x10197648]
push 0x10075120
mov word [edx + 0x22], bx
call fcn.1013c36b
add esp, 4
mov edi, dword [0x10197648]
mov al, byte [esp + 0x50]
push edi
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.1013c2c2
add esp, 4
mov esi, eax
lea ecx, [esp + 0xc]
push 1
push esi
call fcn.1000c010
test al, al
je 0x1006f0e5
mov ecx, dword [esp + 0x10]
push esi
push edi
push ecx
call fcn.100017d0
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x20], esi
add esp, 0xc
mov word [edx + esi*2], bx
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0xc]
push eax
push ecx
mov ecx, dword [0x10191a54]
mov dword [esp + 0x50], ebx
call fcn.10058e60
mov ecx, eax
call fcn.10067f30
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x48], 0xffffffff
cmp ecx, ebx
je 0x1006f145
mov al, byte [ecx - 1]
cmp al, bl
je 0x1006f139
cmp al, 0xff
je 0x1006f139
dec al
pop edi
pop esi
mov byte [ecx - 1], al
pop ebx
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
add esp, 0x40
ret 4
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret 4
Function at 0x10072a10
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push 0x20
call fcn.1013c2df
mov ebp, dword [esp + 0x18]
add esp, 4
mov dword [ebx], eax
xor edi, edi
mov si, word [edi + ebp]
mov ecx, esi
and ecx, 0xffff
sub ecx, 0xcc
cmp ecx, 0xcc
jle 0x10072a5e
lea edx, [ecx - 1]
mov eax, 0xa0a0a0a1
mul edx
shr edx, 7
mov eax, edx
neg eax
shl eax, 4
sub eax, edx
lea eax, [eax + eax*2]
lea ecx, [ecx + eax*4]
test ecx, ecx
je 0x10072a64
xor ecx, ecx
sub esi, ecx
mov ecx, dword [ebx]
add esi, 0xcc
mov word [edi + ecx], si
add edi, 2
cmp edi, 0x1e
jb 0x10072a28
mov edx, dword [ebx]
pop edi
pop esi
mov eax, ebx
pop ebp
mov word [edx + 0x1e], 0
pop ebx
ret 4
Function at 0x10075360
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1015d148
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov eax, 0xcb
push ebx
mov word [esp + 0x1a], ax
mov word [esp + 0x20], ax
mov eax, 0xe6
mov ebx, 1
mov word [esp + 0x26], ax
mov word [esp + 0x30], ax
mov eax, 0xdc
push ebp
mov word [esp + 0x36], ax
mov word [esp + 0x40], ax
mov al, byte [0x101975fc]
mov edx, 0xc9
mov ecx, 0xd8
push esi
test bl, al
push edi
mov word [esp + 0x24], dx
mov word [esp + 0x28], 0xd6
mov word [esp + 0x2a], 0xde
mov word [esp + 0x2e], cx
mov word [esp + 0x30], 0xd4
mov word [esp + 0x34], dx
mov word [esp + 0x36], 0xcc
mov word [esp + 0x38], 0xca
mov word [esp + 0x3a], 0xd1
mov word [esp + 0x40], 0xd7
mov word [esp + 0x42], cx
mov word [esp + 0x44], 0xdb
mov word [esp + 0x46], 0xd5
mov word [esp + 0x4a], 0xdd
jne 0x10075483
or al, bl
push 0x2a
mov byte [0x101975fc], al
call fcn.1013c2df
add esp, 4
xor ebp, ebp
mov dword [0x10197600], eax
xor esi, esi
mov di, word [esp + esi + 0x24]
push 0xb9
mov eax, edi
mov ecx, 0x10197600
and eax, 0xffff
push eax
call fcn.100a8ee0
mov ecx, dword [0x10197600]
add eax, 0xb9
xor eax, edi
mov word [esi + ecx], ax
add esi, 2
cmp esi, 0x28
jb 0x10075435
mov edx, dword [0x10197600]
push 0x10077a30
mov word [edx + 0x28], bp
call fcn.1013c36b
add esp, 4
jmp 0x10075485
xor ebp, ebp
mov edi, dword [0x10197600]
mov al, byte [esp + 0x13]
push edi
mov byte [esp + 0x18], al
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
call fcn.1013c2c2
add esp, 4
mov esi, eax
lea ecx, [esp + 0x14]
push ebx
push esi
call fcn.1000c010
test al, al
je 0x100754d4
mov ecx, dword [esp + 0x18]
push esi
push edi
push ecx
call fcn.100017d0
mov edx, dword [esp + 0x24]
mov dword [esp + 0x28], esi
add esp, 0xc
mov word [edx + esi*2], bp
lea eax, [esp + 0x14]
mov dword [esp + 0x54], ebp
push eax
call fcn.10069f20
mov ecx, dword [esp + 0x1c]
add esp, 4
cmp ecx, ebp
mov bl, al
mov dword [esp + 0x54], 0xffffffff
je 0x10075515
mov al, byte [ecx - 1]
test al, al
je 0x10075509
cmp al, 0xff
je 0x10075509
dec al
mov byte [ecx - 1], al
jmp 0x10075515
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret
Function at 0x10075530
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1015d170
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
mov al, byte [esp + 3]
push ebx
xor ebx, ebx
push esi
push edi
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov eax, 5
mov dword [esp + 0x4c], ebx
mov word [esp + 0x32], ax
mov word [esp + 0x3c], ax
mov al, byte [0x101975f4]
mov byte [0x1018c8bc], 0x98
test al, 1
mov word [esp + 0x30], 0x40
mov word [esp + 0x34], 6
mov word [esp + 0x36], 0x1b
mov word [esp + 0x38], 0x37
mov word [esp + 0x3a], 0x33
mov word [esp + 0x3e], 0x1a
mov word [esp + 0x40], 7
jne 0x1007561f
push ebp
or al, 1
push 0x14
mov byte [0x101975f4], al
call fcn.1013c2df
add esp, 4
mov dword [0x101975f8], eax
mov edi, 0x30
xor esi, esi
mov bp, word [esp + esi + 0x34]
push edi
mov ecx, ebp
and ecx, 0xffff
push ecx
mov ecx, 0x101975f8
call fcn.1004a650
mov edx, dword [0x101975f8]
xor eax, ebp
xor eax, edi
xor edi, edi
mov word [esi + edx], ax
mov eax, dword [0x101975f8]
mov di, word [esi + eax]
add esi, 2
cmp esi, 0x12
jb 0x100755d3
push 0x10077a20
mov word [eax + 0x12], bx
call fcn.1013c36b
add esp, 4
pop ebp
mov esi, dword [0x101975f8]
mov al, byte [esp + 0xf]
push esi
mov byte [esp + 0x24], al
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.1013c2c2
add esp, 4
lea ecx, [esp + 0x20]
push eax
push esi
call fcn.1000bf40
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [0x10191a54]
push edx
mov byte [esp + 0x54], 1
call fcn.10058e60
mov ecx, eax
call fcn.10068300
mov ecx, dword [esp + 0x24]
mov byte [esp + 0x4c], bl
cmp ecx, ebx
je 0x10075698
mov al, byte [ecx - 1]
cmp al, bl
je 0x1007568c
cmp al, 0xff
je 0x1007568c
dec al
mov byte [ecx - 1], al
jmp 0x10075698
lea eax, [ecx - 2]
push eax
call fcn.101307a0
add esp, 4
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
cmp esi, ebx
jne 0x100756a8
xor eax, eax
jmp 0x100756af
mov eax, ecx
sub eax, esi
sar eax, 4
cmp eax, ebx
mov dword [esp + 0x4c], 0xffffffff
sete bl
cmp esi, ecx
mov edi, ecx
je 0x100756d6
push 1
mov ecx, esi
call fcn.1000bc70
add esi, 0x10
cmp esi, edi
jne 0x100756c2
mov esi, dword [esp + 0x14]
push esi
call fcn.101307a0
mov ecx, dword [esp + 0x48]
add esp, 4
mov al, bl
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x44
ret
Function at 0x10079660
Capabilities:
Encode data using xor
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x1015d4b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov ecx, dword [0x1018c8c8]
mov eax, 0x133
cdq
idiv ecx
push ebx
push esi
mov eax, 0xdf
push edi
mov esi, edx
cdq
idiv ecx
mov eax, dword [0x1018c8c4]
mov cl, byte [esi + eax]
add cl, byte [edx + eax]
add cl, 0x64
push ecx
call fcn.10079830
mov dl, 0x54
add esp, 4
imul dl
mov byte [0x1018c8ed], al
mov eax, 5
mov word [esp + 0x1e], ax
mov word [esp + 0x22], ax
mov al, byte [0x101974ec]
xor ebx, ebx
test al, 1
mov word [esp + 0x1c], 0x45
mov word [esp + 0x20], 0x14
mov word [esp + 0x24], 0x15
mov word [esp + 0x26], 0x11
mov word [esp + 0x28], 0x3a
mov word [esp + 0x2a], 0x2a
mov word [esp + 0x2c], 7
mov word [esp + 0x2e], 0x1e
jne 0x1007976e
push ebp
or al, 1
push 0x16
mov byte [0x101974ec], al
call fcn.1013c2df
add esp, 4
mov dword [0x101974f0], eax
mov edi, 0x30
xor esi, esi
mov bp, word [esp + esi + 0x20]
push edi
mov eax, ebp
mov ecx, 0x101974f0
and eax, 0xffff
push eax
call fcn.1004a650
mov ecx, dword [0x101974f0]
xor eax, ebp
xor eax, edi
xor edi, edi
mov word [esi + ecx], ax
mov eax, dword [0x101974f0]
mov di, word [esi + eax]
add esi, 2
cmp esi, 0x14
jb 0x10079723
push 0x1007a3f0
mov word [eax + 0x14], bx
call fcn.1013c36b
add esp, 4
pop ebp
mov edi, dword [0x101974f0]
mov dl, byte [esp + 0x40]
push edi
mov byte [esp + 0x10], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.1013c2c2
add esp, 4
mov esi, eax
lea ecx, [esp + 0xc]
push 1
push esi
call fcn.1000c010
test al, al
je 0x100797be
mov eax, dword [esp + 0x10]
push esi
push edi
push eax
call fcn.100017d0
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], esi
add esp, 0xc
mov word [ecx + esi*2], bx
mov edx, dword [esp + 0x40]
mov ecx, dword [0x10191a54]
lea eax, [esp + 0xc]
push edx
push eax
mov dword [esp + 0x40], ebx
call fcn.10058e60
mov ecx, eax
call fcn.10068200
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
cmp ecx, ebx
je 0x1007980c
mov al, byte [ecx - 1]
cmp al, bl
je 0x10079800
cmp al, 0xff
je 0x10079800
dec al
mov byte [ecx - 1], al
jmp 0x1007980c
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x30]
pop edi
pop esi
mov byte [0x1018c8ef], 0x28
pop ebx
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x1007c6e0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x1015d7d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
mov al, byte [0x1019745c]
push ebx
xor ebx, ebx
push esi
test al, 1
mov dword [esp + 8], ecx
mov word [esp + 0x3c], 0x6f
mov word [esp + 0x3e], 0x3b
mov word [esp + 0x40], 6
mov word [esp + 0x42], 0x3d
mov word [esp + 0x44], 0x32
mov word [esp + 0x46], 0x19
mov word [esp + 0x48], 0x1d
mov word [esp + 0x4a], 4
mov word [esp + 0x4c], 8
mov word [esp + 0x4e], 0x3a
jne 0x1007c7ba
push ebp
push edi
or al, 1
push 0x16
mov byte [0x1019745c], al
call fcn.1013c2df
add esp, 4
mov dword [0x10197460], eax
mov edi, 0x30
xor esi, esi
mov bp, word [esp + esi + 0x44]
push edi
mov eax, ebp
mov ecx, 0x10197460
and eax, 0xffff
push eax
call fcn.1004a650
mov ecx, dword [0x10197460]
xor eax, ebp
xor eax, edi
xor edi, edi
mov word [esi + ecx], ax
mov eax, dword [0x10197460]
mov di, word [esi + eax]
add esi, 2
cmp esi, 0x14
jb 0x1007c76e
push 0x1007ecb0
mov word [eax + 0x14], bx
call fcn.1013c36b
add esp, 4
pop edi
pop ebp
mov esi, dword [0x10197460]
mov dl, byte [esp + 0x60]
push esi
mov byte [esp + 0x10], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.1013c2c2
add esp, 4
lea ecx, [esp + 0xc]
push eax
push esi
call fcn.1000bf40
lea eax, [esp + 0xc]
lea ecx, [esp + 0x2c]
push eax
push ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x60], ebx
call fcn.1007d400
mov edx, dword [esp + 0x60]
mov byte [esp + 0x58], 1
push edx
push eax
lea eax, [esp + 0x24]
push eax
call fcn.1000d050
add esp, 0xc
mov ecx, dword [0x10191a54]
push ebx
push eax
mov byte [esp + 0x60], 2
call fcn.10058e60
mov ecx, eax
call fcn.10067e70
mov esi, eax
mov eax, dword [esp + 0x20]
cmp eax, ebx
mov byte [esp + 0x58], 1
je 0x1007c85e
mov cl, byte [eax - 1]
cmp cl, bl
je 0x1007c852
cmp cl, 0xff
je 0x1007c852
dec cl
mov byte [eax - 1], cl
jmp 0x1007c85e
add eax, 0xfffffffe
push eax
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
cmp ecx, ebx
mov byte [esp + 0x58], bl
je 0x1007c894
mov al, byte [ecx - 1]
cmp al, bl
je 0x1007c888
cmp al, 0xff
je 0x1007c888
dec al
mov byte [ecx - 1], al
jmp 0x1007c894
lea eax, [ecx - 2]
push eax
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
cmp ecx, ebx
mov dword [esp + 0x58], 0xffffffff
je 0x1007c8ce
mov al, byte [ecx - 1]
cmp al, bl
je 0x1007c8c2
cmp al, 0xff
je 0x1007c8c2
dec al
mov byte [ecx - 1], al
jmp 0x1007c8ce
add ecx, 0xfffffffe
push ecx
call fcn.101307a0
add esp, 4
mov ecx, dword [esp + 0x50]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x54
ret 4