joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001212d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10012150
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x10012150
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x1001215a
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x1001219c
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x100121fe
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x100121f9
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100121e4
test dl, dl
je 0x100121e0
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100121e4
add ecx, 2
add eax, 2
test dl, dl
jne 0x100121c4
xor eax, eax
jmp 0x100121e9
sbb eax, eax
or eax, 1
test eax, eax
je 0x1001220a
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x100121b1
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x1001229c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x100122bf
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x100122bf
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x100122c9
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x1001230b
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x1001236d
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x10012368
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10012353
test dl, dl
je 0x1001234f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10012353
add ecx, 2
add eax, 2
test dl, dl
jne 0x10012333
xor eax, eax
jmp 0x10012358
sbb eax, eax
or eax, 1
test eax, eax
je 0x10012379
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x10012320
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x10012406
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10012429
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x10012429
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x10012433
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x10012475
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x100124d7
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x100124d2
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100124bd
test dl, dl
je 0x100124b9
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100124bd
add ecx, 2
add eax, 2
test dl, dl
jne 0x1001249d
xor eax, eax
jmp 0x100124c2
sbb eax, eax
or eax, 1
test eax, eax
je 0x100124e3
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x1001248a
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x1001257c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x1001259f
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x1001259f
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x100125a9
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x100125eb
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x1001264d
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x10012648
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10012633
test dl, dl
je 0x1001262f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10012633
add ecx, 2
add eax, 2
test dl, dl
jne 0x10012613
xor eax, eax
jmp 0x10012638
sbb eax, eax
or eax, 1
test eax, eax
je 0x10012659
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x10012600
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x100126ed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10012710
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x10012710
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x1001271a
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x1001275c
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x100127be
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x100127b9
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100127a4
test dl, dl
je 0x100127a0
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100127a4
add ecx, 2
add eax, 2
test dl, dl
jne 0x10012784
xor eax, eax
jmp 0x100127a9
sbb eax, eax
or eax, 1
test eax, eax
je 0x100127ca
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x10012771
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x1001285c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x1001287f
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x1001287f
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x10012889
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x100128cb
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x1001292d
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x10012928
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10012913
test dl, dl
je 0x1001290f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10012913
add ecx, 2
add eax, 2
test dl, dl
jne 0x100128f3
xor eax, eax
jmp 0x10012918
sbb eax, eax
or eax, 1
test eax, eax
je 0x10012939
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x100128e0
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
Function at 0x100129cb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
sub esp, 0xc
push ebp
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x100129ee
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x100129ee
mov eax, dword [edi + 0x3c]
cmp dword [eax + edi + 0x7c], 0
jne 0x100129f8
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + edi + 0x78]
add eax, edi
push ebx
mov ecx, dword [eax + 0x20]
mov edx, dword [eax + 0x24]
mov ebx, dword [eax + 0x14]
add ecx, edi
mov dword [esp + 0x20], ecx
push esi
mov esi, dword [eax + 0x1c]
mov ecx, ebp
sub ecx, dword [eax + 0x10]
add esi, edi
add edx, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp ecx, ebx
ja 0x10012a3a
mov eax, dword [esi + ecx*4]
pop esi
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8
mov eax, dword [eax + 0x18]
xor esi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x10012a9c
mov ecx, ebx
lea ebx, [ebx]
movzx ebx, word [edx + esi*2]
cmp ebx, ecx
ja 0x10012a97
mov eax, dword [esp + 0x24]
mov ecx, ebp
mov eax, dword [eax + esi*4]
add eax, edi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10012a82
test dl, dl
je 0x10012a7e
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10012a82
add ecx, 2
add eax, 2
test dl, dl
jne 0x10012a62
xor eax, eax
jmp 0x10012a87
sbb eax, eax
or eax, 1
test eax, eax
je 0x10012aa8
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
inc esi
cmp esi, eax
jb 0x10012a4f
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0xc
ret 8
mov eax, dword [esp + 0x18]
pop esi
mov eax, dword [eax + ebx*4]
pop ebx
add eax, edi
pop edi
pop ebp
add esp, 0xc
ret 8

Function at 0x10017c32
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x10017c55
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10017d2d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x10017d50
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10017f09
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [esi + 4]
bswap eax
bswap edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], esp
mov esp, dword [ebp + 0xc]
mov edi, dword [ebp - 4]
xor eax, dword [ecx + edi*4]
mov edi, eax
mov esi, eax
shr edi, 0x18
shr esi, 0x10
and esi, 0xff
mov ebx, dword [esp + edi*4]
add ebx, dword [esp + esi*4 + 0x400]
movzx edi, ah
movzx esi, al
xor ebx, dword [esp + edi*4 + 0x800]
add ebx, dword [esp + esi*4 + 0xc00]
xor ebx, edx
inc dword [ebp - 4]
mov edx, eax
cmp dword [ebp - 4], 0x10
mov eax, ebx
jne 0x10017f2c
mov esp, dword [ebp - 8]
xchg edx, eax
xor edx, dword [ecx + 0x40]
xor eax, dword [ecx + 0x44]
mov esi, dword [ebp + 8]
bswap eax
bswap edx
mov dword [esi], eax
mov dword [esi + 4], edx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1001ed30
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x1003aa8c]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x1001ed43
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x1001ed84
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x1003ab34]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x1001edb6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x1001edba
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x1001edab
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x1001edd8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x1001eddc
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x1001edcd
xor ecx, ecx
mov eax, 0x1003aa9c
xor ebx, ebx
mov bl, byte [ecx + 0x1003ab44]
cmp byte [esp + ebx + 0x14], 0
je 0x1001ee07
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x1003ab5c]
cmp byte [esp + ebx + 0x14], 0
je 0x1001ee1e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x1001edee
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x1001ed77
lea edx, [esp + 0x84]
push edx
call fcn.1001ee60
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x10068660
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1011dfcd
adc eax, 0x6d66ac86
aam 0x97
sar bh, 7
sbb ecx, dword [edx - 0x10]
pop ecx
mov bl, 0x89
mov ebx, 0x940e0eab
iretd
mov word [ebp + edx*8 - 0x15082b6f], gs
movsd dword es:[edi], dword [esi]
add edx, dword [ebx - 0x45]
push edx
push ebx
sub al, 0xc5
movsb byte es:[edi], byte [esi]
je 0x1011df35
imul edx, dword [eax + 0x43], 0xeb7a94be
cwde
inc edx
into
invalid
add dword [ebp - 0x3ca05251], esp
pop eax
ror byte [bx + di], 1
mov ecx, 0x71ee0733
lodsb al, byte [esi]
neg dl
push esi
xor eax, dword [ebp - 0x73f8c665]
add al, 0xc1
and dword [eax], esp
jle 0x1011df93
xor dword [ecx - 0x47], esi
pop eax
aam 0xae
invalid
push 0x87bb52d0
call fcn.101f37d7
aaa
jnp 0x1011df67
mov dword [0xd03d1ae3], eax
mov dword [0x5ba7221b], eax
mov dword [0xb5abd5e], eax
pop ebp
scasd eax, dword es:[edi]
lcall 0x6e9f, 0x60a3da77
inc ebp
mov dword [0xedc181e8], eax
pop esp
mov ebx, 0xa364e882
jbe 0x1011df93
mov ebp, 0x72dda33c
fnstcw word [ebp + 0x504d445c]
jae 0x1011e069
std
pushal
cmpsb byte [esi], byte es:[edi]
fistp dword [esp + ecx*4 - 0x59]
lds edx, [eax + 0x2c]
inc edx
sub esp, dword [ebx + 0x5c0b1b99]
push 0xffffffffffffff8f
adc byte [edi + 0x5c9957ce], ch
fidiv dword [ebp - 0x57d65cdf]
and byte [ecx + 0x60d86b5c], dh
pop esp
stc
stosb byte es:[edi], al
invalid
lahf
push edi
int3
and al, 0xe5
nop
jp 0x1011e09b
enter 0xffffffffffff8f5c, 0xffffffffffffffdd
dec ecx
mov dword [0x9bedaa71], eax
mov dword [0xeb1fdbae], eax
mov byte [0x80c0fbf6], al
pop esp
std
in al, 9
pop esp
test al, 0x3f
xor eax, 0xfc955c9f
and eax, 0xf74aa319
int3
ja 0x1011e04e
int1
mov byte [0x5c66c41b], al
jnp 0x1011e119
push ebx
pushfd
pop esp
test byte [ecx + 0x57], cl
mov al, 0x5c
test eax, 0x81a33da2
das
adc byte [ebp + 0xa], 0x69
cmpsb byte [esi], byte es:[edi]
dec esp
jmp 0xe728702a
or dword [edx - 0x102e5c10], ebx
std
js 0x1011e0a7
pop ecx
push ds
pop ebp
fidiv dword [ebp - 0x73]
mov dword [0x259cc0e5], eax
mov dword [0x5c39323b], eax
sub byte [0xd5cf31d], 0x79
invalid
pushfd
pop ecx
mov esp, 0x4c36a3df
push edi
mov dword [0xb6317c97], eax
pop esp
das
mov byte [edx], 0xa3
add esp, edx
sar byte [esi + 0x50965f5c], 1
jp 0x1011e0d9
xchg esp, eax
aad 0x57
lahf
mov dword [0xda6ddaad], eax
mov byte [0x260412f5], al
pop esp
dec eax
and eax, esi
rcr dword [ebx + ecx*4 - 0x32], cl
xchg ebx, eax
push ebp
mov dword [0xaf1397f4], eax
pop esp
js 0x1011e121
sub dword [eax - 0x5d], 0x168bc82d
mov dword [0x4a7d7d88], eax
pop esp
push esi
retf 0x5c5d
Function at 0x1006b850
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1032fd0f
mov ecx, dword [edi + esi*8 + 4]
cmp edi, ebp
clc
cmp ch, 0x82
xor ecx, 0x359260a3
clc
cmp esp, 0x216f0e27
sub eax, ecx
cmc
mov cl, dl
clc
cmc
ror eax, cl
mov ecx, dword [edi + esi*8]
test esp, 0x2cf6648e
xor ecx, 0x37c871d4
xor eax, edx
clc
cmp eax, ebp
sub edx, ecx
xchg cl, cl
mov cl, al
stc
ror edx, cl
cmc
xor edx, eax
sub esi, 1
jne 0x1020804b
mov ecx, dword [edi + 4]
inc esi
test esi, 0x498b57c1
xor ecx, 0x359260a3
not esi
sub eax, ecx
adc si, sp
btr esi, 6
or si, 0x6ea0
mov dword [ebx + 4], eax
bt si, dx
mov eax, dword [edi]
xor eax, 0x37c871d4
sar esi, 0xa6
xchg si, si
sub edx, eax
mov dword [ebx], edx
pop esi
ret
mov eax, dword [ecx + 4]
xchg dh, dh
movzx dx, dh
mov edx, dword [ecx]
push esi
cmovo si, bx
mov esi, 0xf
jmp 0x1020804b

Function at 0x1006d0e0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x1006d1ec
test eax, eax
je 0x1006d1ec
push esi
push edi
mov ecx, 0x10
mov esi, 0x10088018
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x1006d1d3
lea edi, [eax + 4]
jmp 0x1006d137
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x1006d14c
mov dword [ebp - 4], 2
jmp 0x1006d16d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x1006d163
mov dword [ebp - 4], 1
jmp 0x1006d16d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x1006d1e3
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x1006d1a6
mov byte [ecx], 0x3d
jmp 0x1006d1b2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x1006d1bd
mov byte [ecx], 0x3d
jmp 0x1006d1c3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x1006d134
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x102e1a8d
Capabilities:
Encode data using xor

Disassembly:
push 0x36545031
call fcn.103637a7
jp 0x102e1ab5
add bh, byte [ebx]
or eax, 0xa4f65883
inc edx
pop eax
sbb eax, 0xc1c1829b
push ds
jnp 0x102e1b0c
shr dword [eax - 0x12], cl
and al, 0xbc
inc ebp
ljmp 0x577
mov ch, 0x77
add eax, 0xd905b4bb
in eax, dx
cmp bh, ah
invalid
push es
wait
and eax, 0xba6618a9
inc edi
mov eax, 0xdc59d4c
invalid

Function at 0x1036f54c
Capabilities:
Encrypt data using speck

Disassembly:
pop ds
popal
mov dword [0x8e8de6a6], eax
pop esi
push eax
lea ecx, [ecx + 0x1a]
out 3, eax
int 0x1f
iretd
and esp, dword [edi + 0x2e]
bound ebx, qword [esi + 0x63]
pop ebx
loop 0x1036f54b
or eax, 0x8f623fde
inc edi
inc ecx
sub esp, edx
shl dword [esi], 1
mov cl, 0xec
sbb eax, 0xda3bb775
popfd
dec esi
pop gs
loopne 0x1036f48a
das
or byte [esi + 0x525be220], dh
enter 0x6221, 0xffffffffffffffce
pmullw mm4, qword [esi]
aad 0x26
loop 0x1036f4cb
mov bh, 0x62
xor ah, byte [edx + 0x2b]
sal ebp, 0x2b
int1
ret
jmp [eax - 0xe]
push 0xd446d3f2
call fcn.100ddf17
add eax, 0x4588836c
push esi
mov al, byte [0xaaf5888b]
cwde
push 0x2c516577
lcall 0x8899, 0x27cf8388
wait
cmc
mov dl, 0x88
jb 0x1036f4f9
adc al, 0x78
ja 0x1036f51d
push edi
mov esp, 0x728f7765
cmp eax, 0x3492776b
or dword [ebx + 0x77], 9
sub al, 0x9a
mov al, dh
mov bl, cl
dec esi
ja 0x1036f5f7
adc cl, dh
int 0xe
jno 0x1036f601
movsb byte es:[di], byte [si]
arpl si, ax
jg 0x1036f604
pop esi
push ds
pop edi
adc esi, 0xfc98eb81
push ebx
xchg ecx, eax
popal
adc eax, 0x2188c136
sbb dh, byte [edi + esi*2 + 0x22]
sub cl, byte [ebx]
nop
mov byte [eax + 0x7e], al
mov bh, 0x88
invalid
xchg edi, eax
aad 0x81
mov byte [esi + 6], ch
pop edx
jg 0x1036f677
ret 0x7cad
lodsd eax, dword [esi]
jl 0x1036f67b
xchg esi, eax
lahf
leave
dec ebp
ljmp 0x8080
mov byte [edx - 0x773ef74f], bh
sbb cl, byte [ebp + 0x137774aa]
fcmovu st(0), st(7)
pop ecx
lea esi, [ebx + ebp*8 - 1]
inc ebp
les edx, [edi]
inc edx
sbb eax, esi
add dword [ebx + 0x73], ebx
add byte [edx - 0x19], bl
cmc
sbb ebp, 0x8733bed9
aad 0xe5
sal dh, cl
xor eax, dword [edi - 0x92d1a2b]
xchg dword [esi], edi
fidivr dword [esi]
push ebp
push ds
cmp eax, 0xb74ffb3a
int 0x65
push es
int1
xor eax, 0x1db87a34
test al, 0x26
cli
sub byte [ebp + 0x6479ce06], bl
mov al, 0xc1
xlatb
in eax, 0x42
mov dword [ebx], eax
shl byte [ebp + 0x4e], 1
and ebp, eax
cmp al, 0x9a
outsd dx, dword [esi]
pop ecx
xor dword [edx], ebx
jbe 0x1036f657
in al, 0xd3
cmp dword [ebp - 0x25d1c9ed], eax
cld
mov eax, 0xe69a2f29
invalid