joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100505e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10050644
cmp byte [esi + 1], 0
jne 0x1005068f
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x19
jb 0x10050606
jmp 0x1005068f
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x19
jb 0x10050650
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x1a]
push eax
push edi
call fcn.1004f130
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100506b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10050714
cmp byte [esi + 1], 0
jne 0x1005075f
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1b
jb 0x100506d6
jmp 0x1005075f
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1b
jb 0x10050720
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x1c]
push eax
push edi
call fcn.1004f130
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10050780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100507e4
cmp byte [esi + 1], 0
jne 0x1005082f
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1c
jb 0x100507a6
jmp 0x1005082f
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1c
jb 0x100507f0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x1d]
push eax
push edi
call fcn.1004f130
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10050850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100508b4
cmp byte [esi + 1], 0
jne 0x100508ff
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1d
jb 0x10050876
jmp 0x100508ff
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1d
jb 0x100508c0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x1e]
push eax
push edi
call fcn.1004f130
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10050920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10050984
cmp byte [esi + 1], 0
jne 0x100509cf
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xb
jb 0x10050946
jmp 0x100509cf
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xb
jb 0x10050990
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0xc]
push eax
push edi
call fcn.1004f130
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100509f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10050a54
cmp byte [esi + 1], 0
jne 0x10050a9f
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xc
jb 0x10050a16
jmp 0x10050a9f
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xc
jb 0x10050a60
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0xd]
push eax
push edi
call fcn.1004f130
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10050ac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10050b24
cmp byte [esi + 1], 0
jne 0x10050b6f
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xd
jb 0x10050ae6
jmp 0x10050b6f
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xd
jb 0x10050b30
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0xe]
push eax
push edi
call fcn.1004f130
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10050b90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10050bf4
cmp byte [esi + 1], 0
jne 0x10050c3f
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xe
jb 0x10050bb6
jmp 0x10050c3f
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xe
jb 0x10050c00
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0xf]
push eax
push edi
call fcn.1004f130
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10050c60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10050cc4
cmp byte [esi + 1], 0
jne 0x10050d0f
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xf
jb 0x10050c86
jmp 0x10050d0f
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xf
jb 0x10050cd0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x10]
push eax
push edi
call fcn.1004f130
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10050d30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1019eaa0], 0
push ebx
push esi
je 0x10050da1
cmp byte [0x1019eaa1], 0
jne 0x10050de2
mov byte [0x1019eaa1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1019eacc]
xor ebx, dword [0x1019eac8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1019eaa2], al
inc esi
cmp esi, 0x20
jb 0x10050d60
jmp 0x10050de2
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1019eacc]
xor ebx, dword [0x1019eac8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1019eaa2], al
inc esi
cmp esi, 0x20
jb 0x10050da3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x1019eac1
push 0x1019eaa2
call fcn.1004f130
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10050e10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1019ec00], 0
push ebx
push esi
je 0x10050e81
cmp byte [0x1019ec01], 0
jne 0x10050ec2
mov byte [0x1019ec01], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1019ec34]
xor ebx, dword [0x1019ec30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1019ec02], al
inc esi
cmp esi, 0x28
jb 0x10050e40
jmp 0x10050ec2
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1019ec34]
xor ebx, dword [0x1019ec30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1019ec02], al
inc esi
cmp esi, 0x28
jb 0x10050e83
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x1019ec29
push 0x1019ec02
call fcn.1004f130
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10050ef0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1019ed98], 0
push ebx
push esi
je 0x10050f61
cmp byte [0x1019ed99], 0
jne 0x10050fa2
mov byte [0x1019ed99], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1019edc4]
xor ebx, dword [0x1019edc0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1019ed9a], al
inc esi
cmp esi, 0x1f
jb 0x10050f20
jmp 0x10050fa2
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1019edc4]
xor ebx, dword [0x1019edc0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1019ed9a], al
inc esi
cmp esi, 0x1f
jb 0x10050f63
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x1019edb8
push 0x1019ed9a
call fcn.1004f130
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10056710
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10056774
cmp byte [esi + 1], 0
jne 0x100567bf
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x12
jb 0x10056736
jmp 0x100567bf
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x12
jb 0x10056780
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x13]
push eax
push edi
call fcn.1004f130
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10060620
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x102cdf00]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x40
lea eax, [ebp - 0x44]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x44]
mov ecx, 0x20
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x4c], ecx
mov eax, 0x3f
shr ecx, 3
add esp, 0xc
and ecx, 0x3f
mov dword [ebp - 0x5c], 0x67452301
add edx, ecx
mov dword [ebp - 0x58], 0xefcdab89
mov dword [ebp - 0x54], 0x98badcfe
sub eax, ecx
mov dword [ebp - 0x50], 0x10325476
mov dword [ebp - 0x48], 0
mov byte [edx], 0x80
inc edx
cmp eax, 8
jae 0x100606b4
push eax
push 0
push edx
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.1005ffa0
push 0x38
lea eax, [ebp - 0x44]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x20
jmp 0x100606c3
add eax, 0xfffffff8
push eax
push 0
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.1005ffa0
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, dword [ebp - 0x56]
xor ecx, ebp
call fcn.1010f802
mov esp, ebp
pop ebp
ret
Function at 0x10060710
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [ebx]
mov edi, dword [ebp + 0x10]
cmp edi, 7
ja case.default.0x10060726
jmp dword [edi*4 + 0x100608bc]
mov ecx, esi
and ecx, 3
sub edi, ecx
sub ecx, 1
je 0x10060769
sub ecx, 1
je 0x10060756
sub ecx, 1
jne 0x1006077c
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017e348]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017e348]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017e348]
inc esi
mov edx, edi
sar edx, 3
test edx, edx
je 0x100607fe
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017e348]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017e348]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017e348]
mov ecx, eax
movzx eax, cl
shr ecx, 8
mov eax, dword [eax*4 + 0x1017e348]
xor eax, dword [esi + 4]
add esi, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017e348]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017e348]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017e348]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017e348]
sub edx, 1
jne 0x10060785
and edi, 7
jmp 0x10060721
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017e348]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017e348]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017e348]
inc esi
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
pop edi
pop esi
xor eax, dword [ecx*4 + 0x1017e348]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017e348]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017e348]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017e348]
mov dword [ebx], eax
pop ebx
pop ebp
ret
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017e348]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017e348]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017e348]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret
Function at 0x10060e50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x200
mov esi, ecx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
push 4
call fcn.1010f4aa
add esp, 0x10
test eax, eax
je 0x10060e78
mov dword [eax], esi
jmp 0x10060e7a
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x10060b60
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 8], eax
test eax, eax
je 0x10060eb6
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x10060ec4
push ecx
push eax
call sub.MSVCP140.dll__Thrd_detach
add esp, 8
test eax, eax
jne 0x10060ec4
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 4], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x10063f20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x102cdf00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102cf864]
test eax, eax
jne 0x10064058
push ebx
push esi
cmp byte [0x102b0d78], al
je 0x10063fa4
cmp byte [0x102b0d79], al
jne 0x10063fe8
mov byte [0x102b0d79], 1
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102b0d8c]
xor ebx, dword [0x102b0d88]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 0x24], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102b0d7a], al
inc esi
cmp esi, 0xc
jb 0x10063f60
jmp 0x10063fe8
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102b0d8c]
xor ebx, dword [0x102b0d88]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 0x24], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102b0d7a], al
inc esi
cmp esi, 0xc
jb 0x10063fa6
lea eax, [ebp - 0x1d]
push eax
push 0x102b0d85
push 0x102b0d7a
lea ecx, [ebp - 0x1c]
call fcn.1004f130
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
cmova eax, dword [ebp - 0x1c]
push eax
push dword [0x102cf8bc]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [0x102cf864], eax
pop esi
pop ebx
cmp ecx, 0xf
jbe 0x10064058
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10064049
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10064049
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1010f4da
mov eax, dword [0x102cf864]
add esp, 8
movss xmm0, dword [ebp + 0xc]
sub esp, 8
mov dword [ebp - 0x24], eax
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp + 8]
movss dword [esp], xmm0
call dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
call fcn.1010f802
mov esp, ebp
pop ebp
ret