joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007b0b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x100c47a0]
mov eax, esi
imul eax, esi
push 0xf
cdq
pop ecx
idiv ecx
xor ebx, ebx
cmp edx, 7
jne 0x10007b86
jmp 0x10007b82
mov ecx, esi
and ecx, 0x80000001
jns 0x10007b46
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x10007b53
mov eax, esi
cdq
sub eax, edx
mov esi, eax
sar esi, 1
jmp 0x10007b5a
lea esi, [esi*2 + 1]
mov eax, esi
push 3
cdq
pop ecx
idiv ecx
mov dword [0x100c47a0], esi
sub edx, ebx
je 0x10007b75
dec edx
dec edx
je 0x10007b78
dec edx
je 0x10007b79
jmp 0x10007b82
add esi, 2
inc esi
add esi, 2
mov dword [0x100c47a0], esi
test esi, esi
jne 0x10007b37
imul esi, esi
mov eax, esi
push 0x16
cdq
pop ecx
idiv ecx
cmp edx, 0x13
jne 0x10007ba6
push 4
call fcn.1006c5c8
pop ecx
mov ecx, dword [0x100c47a0]
mov dword [eax], ecx
cmp byte [0x100c4e2f], bl
jne 0x10007be6
mov dword [ebp - 0x14], 0x2040f0d
mov dword [ebp - 0x10], 0x8431541
mov dword [ebp - 0xc], 0x4e050808
mov word [ebp - 8], 0x41
mov al, byte [ebx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ebx - 0x14]
inc ebx
mov byte [ebx + 0x100be7fb], al
cmp ebx, 0xd
jl 0x10007bc9
mov byte [0x100c4e2f], 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 0x100be7fc
pop ebx
call fcn.1006d48b
leave
ret

Function at 0x10007bf9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e2e], 0
jne 0x10007c4c
mov dword [ebp - 0x14], 0x2040f0d
mov dword [ebp - 0x10], 0x8431541
mov dword [ebp - 0xc], 0x4e050808
mov word [ebp - 8], 0x40
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100be7eb], al
cmp ecx, 0xd
jl 0x10007c2f
mov byte [0x100c4e2e], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be7ec
call fcn.1006d48b
leave
ret

Function at 0x10007c5d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e2d], 0
jne 0x10007ce7
mov dword [ebp - 0x14], 0x2040f0d
mov dword [ebp - 0x10], 0x8431541
mov dword [ebp - 0xc], 0x4e050808
mov word [ebp - 8], 0x43
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100be7db], al
cmp ecx, 0xd
jl 0x10007c93
mov eax, dword [0x100c47a0]
xor edx, edx
lea ecx, [eax + 1]
imul ecx, eax
inc edx
mov byte [0x100c4e2d], dl
and ecx, 0x8000000f
jns 0x10007cca
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp ecx, 5
jne 0x10007ce7
push esi
mov ecx, edx
mov esi, 0xb7
dec esi
lea eax, [ecx + edx]
lea edx, [ecx]
mov ecx, eax
jns 0x10007cd7
mov dword [0x100c47a0], eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be7dc
call fcn.1006d48b
leave
ret
Function at 0x10007cf8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4ddd], 0
jne 0x10007d4b
mov dword [ebp - 0x14], 0x50f0a0e
mov dword [ebp - 0x10], 0x20010618
mov dword [ebp - 0xc], 0x1b14
xor ecx, ecx
mov word [ebp - 8], 1
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100be3a7], al
cmp ecx, 0xd
jl 0x10007d2e
mov byte [0x100c4ddd], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be3a8
call fcn.1006d48b
leave
ret

Function at 0x10007d5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4def], 0
jne 0x10007dc3
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], 0xa0b030f
mov dword [ebp - 0x10], 0x101171f
mov dword [ebp - 0xc], 0x61b081d
mov word [ebp - 8], 0x505f
mov byte [ebp - 6], bl
call fcn.10003ebe
test al, al
jne 0x10007da5
dec dword [0x100c47a0]
mov al, byte [ebx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ebx - 0x14]
inc ebx
mov byte [ebx + 0x100be497], al
cmp ebx, 0xe
jl 0x10007da5
mov byte [0x100c4def], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be498
call fcn.1006d48b
leave
ret

Function at 0x10007dd4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4df0], 0
jne 0x10007e2a
xor ecx, ecx
mov dword [ebp - 0x14], 0xa0b030f
mov dword [ebp - 0x10], 0x101171f
mov dword [ebp - 0xc], 0x61b081d
mov word [ebp - 8], 0x515f
mov byte [ebp - 6], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100be4a7], al
cmp ecx, 0xe
jl 0x10007e0d
mov byte [0x100c4df0], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be4a8
call fcn.1006d48b
leave
ret
Function at 0x10007e3b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10003ebe
mov ecx, dword [0x100c47a0]
test al, al
jne 0x10007ea8
movsd xmm3, qword [0x1008ac28]
movd xmm4, ecx
xorps xmm2, xmm2
cvtdq2pd xmm4, xmm4
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x10007e8e
subsd xmm2, xmm3
divsd xmm3, qword [0x1008ac40]
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmmword [0x1008ac20]
ja 0x10007e70
cmp byte [0x100c4dd1], 0
jne 0x10007f73
mov dword [ebp - 0x14], 0xa0b030f
mov dword [ebp - 0x10], 0x101171f
mov dword [ebp - 0xc], 0x61b081d
mov word [ebp - 8], 0x525f
mov byte [ebp - 6], 0
xor edx, edx
mov al, byte [edx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + edx - 0x14]
inc edx
mov byte [edx + 0x100be30f], al
cmp edx, 0xe
jl 0x10007ed6
imul ecx, ecx
and ecx, 0x8000000f
jns 0x10007efc
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp ecx, 5
jne 0x10007f6c
push esi
push edi
xor eax, eax
push 0x240
push eax
mov word [ebp - 0x258], ax
lea eax, [ebp - 0x256]
push eax
call fcn.1006de50
add esp, 0xc
xor edi, edi
xor esi, esi
xor edx, edx
test edi, edi
je 0x10007f4f
test edx, edx
je 0x10007f4f
lea eax, [esi + edx]
lea ecx, [esi + edx]
mov ax, word [ebp + eax*2 - 0x27a]
inc ax
add ax, word [ebp + ecx*2 - 0x25a]
mov word [ebp + ecx*2 - 0x258], ax
inc edx
cmp edx, 0x11
jl 0x10007f27
add esi, 0x11
inc edi
cmp esi, 0x121
jl 0x10007f25
movsx eax, word [ebp - 0x18]
pop edi
mov dword [0x100c47a0], eax
pop esi
mov byte [0x100c4dd1], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be310
call fcn.1006d48b
leave
ret

Function at 0x10007f84
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e2a], 0
jne 0x10007ff6
xor ecx, ecx
mov dword [ebp - 0x10], 0x1f080929
mov dword [ebp - 0xc], 0x51c0d20
mov word [ebp - 8], 0x1a0e
mov byte [ebp - 6], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be7af], al
cmp ecx, 0xa
jl 0x10007fb6
push ebx
xor ebx, ebx
inc ebx
mov byte [0x100c4e2a], bl
call fcn.10003e36
test al, al
jne 0x10007ff5
mov ecx, ebx
mov edx, 0xcb
dec edx
lea eax, [ecx + ebx]
lea ebx, [ecx]
mov ecx, eax
jns 0x10007fe6
mov dword [0x100c47a0], eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be7b0
call fcn.1006d48b
leave
ret
Function at 0x10008007
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e04], 0
jne 0x10008057
xor ecx, ecx
mov dword [ebp - 0x14], 0xa0b030f
mov dword [ebp - 0x10], 0x101171f
mov dword [ebp - 0xc], 0x61b081d
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100be5a7], al
cmp ecx, 0xc
jl 0x1000803a
mov byte [0x100c4e04], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be5a8
call fcn.1006d48b
leave
ret

Function at 0x10008068
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dc6], 0
jne 0x100080be
xor ecx, ecx
mov dword [ebp - 0x14], 0x5030a08
mov dword [ebp - 0x10], 0x41005907
mov dword [ebp - 0xc], 0x81b0800
mov word [ebp - 8], 0x565f
mov byte [ebp - 6], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100be273], al
cmp ecx, 0xe
jl 0x100080a1
mov byte [0x100c4dc6], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be274
call fcn.1006d48b
leave
ret

Function at 0x100080cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dc9], 0
jne 0x10008125
xor ecx, ecx
mov dword [ebp - 0x14], 0x5030a08
mov dword [ebp - 0x10], 0x41005907
mov dword [ebp - 0xc], 0x81b0800
mov word [ebp - 8], 0x515f
mov byte [ebp - 6], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100be29f], al
cmp ecx, 0xe
jl 0x10008108
mov byte [0x100c4dc9], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be2a0
call fcn.1006d48b
leave
ret

Function at 0x10008136
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e1b], 0
jne 0x10008186
xor ecx, ecx
mov dword [ebp - 0x14], 0x5030a08
mov dword [ebp - 0x10], 0x41005907
mov dword [ebp - 0xc], 0x81b0800
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100be6e7], al
cmp ecx, 0xc
jl 0x10008169
mov byte [0x100c4e1b], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be6e8
call fcn.1006d48b
leave
ret
Function at 0x10008197
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e05], 0
jne 0x100081ea
mov dword [ebp - 0x14], 0x121e0309
mov dword [ebp - 0x10], 0x1310609
mov dword [ebp - 0xc], 0xa021b0c
mov word [ebp - 8], 6
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100be5b7], al
cmp ecx, 0xd
jl 0x100081cd
mov byte [0x100c4e05], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be5b8
call fcn.1006d48b
leave
ret

Function at 0x100081fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dc0], 0
jne 0x10008248
mov dword [ebp - 0x10], 0x12190309
mov dword [ebp - 0xc], 0x1e0f1933
mov dword [ebp - 8], 0x1d0006
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be227], al
cmp ecx, 0xb
jl 0x1000822b
mov byte [0x100c4dc0], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be228
call fcn.1006d48b
leave
ret

Function at 0x10008259
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dbf], 0
jne 0x1000829f
mov dword [ebp - 0xc], 0x14132a09
mov dword [ebp - 8], 0x1d1705
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0xc]
inc ecx
mov byte [ecx + 0x100be21f], al
cmp ecx, 7
jl 0x10008282
mov byte [0x100c4dbf], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be220
call fcn.1006d48b
leave
ret

Function at 0x100082b0
Capabilities:
Encode data using xor
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e12], 0
jne 0x10008314
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], 0xa0e020a
mov dword [ebp - 0xc], 0xf070615
mov word [ebp - 8], 0x1e
mov ecx, ebx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be663], al
cmp ecx, 9
jl 0x100082e2
call fcn.10003ebe
test al, al
jne 0x1000830c
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov byte [0x100c4e12], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be664
call fcn.1006d48b
leave
ret
Function at 0x10008325
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e35], 0
jne 0x1000839a
mov ecx, dword [0x100c47a0]
mov eax, ecx
imul eax, ecx
imul eax, ecx
push ebx
push 0x12
cdq
pop ecx
idiv ecx
xor ebx, ebx
mov dword [ebp - 0x10], 0x4b0e020a
mov dword [ebp - 0xc], 0x51c0d00
mov word [ebp - 8], 0x1a0e
mov byte [ebp - 6], bl
cmp edx, 0xd
jne 0x1000837c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x100c47a0], eax
mov al, byte [ebx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ebx - 0x10]
inc ebx
mov byte [ebx + 0x100be84b], al
cmp ebx, 0xa
jl 0x1000837c
mov byte [0x100c4e35], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be84c
call fcn.1006d48b
leave
ret

Function at 0x100083ab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e15], 0
jne 0x100083f7
mov dword [ebp - 0x10], 0x2a1f0932
mov dword [ebp - 0xc], 0xf070615
mov word [ebp - 8], 0x1e
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be68f], al
cmp ecx, 9
jl 0x100083da
mov byte [0x100c4e15], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be690
call fcn.1006d48b
leave
ret

Function at 0x10008408
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e31], 0
jne 0x10008451
xor ecx, ecx
mov dword [ebp - 0x10], 0x80b0e28
mov dword [ebp - 0xc], 0x2923110b
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be817], al
cmp ecx, 8
jl 0x10008434
mov byte [0x100c4e31], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be818
call fcn.1006d48b
leave
ret

Function at 0x10008462
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e0c], 0
jne 0x100084ae
mov dword [ebp - 0x10], 0x7213232
mov dword [ebp - 0xc], 0x701151e
mov word [ebp - 8], 8
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be60f], al
cmp ecx, 9
jl 0x10008491
mov byte [0x100c4e0c], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, str.22__a
call fcn.1006d48b
leave
ret
Function at 0x100084bf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e23], 0
jne 0x10008574
push ebx
push esi
mov esi, dword [0x100c47a0]
mov eax, esi
imul eax, esi
push 0xc
cdq
pop ecx
idiv ecx
xor ebx, ebx
cmp edx, 7
jne 0x10008511
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov esi, dword [0x100c47a0]
xor eax, eax
inc eax
mov word [ebp - 0x14], 0xf33
mov byte [ebp - 0x12], 4
mov byte [ebp - 0x11], al
mov word [ebp - 0x10], 0x1524
mov byte [ebp - 0xe], al
mov dword [ebp - 0xd], 0x1b1420
mov byte [ebp - 9], bl
mov byte [ebp - 8], al
mov byte [ebp - 7], bl
call fcn.1000d2c2
test al, al
jne 0x10008553
push 1
test esi, esi
pop ecx
cmove esi, ecx
mov dword [0x100c47a0], esi
jmp 0x10008556
xor ecx, ecx
inc ecx
mov al, byte [ebx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ebx - 0x14]
inc ebx
mov byte [ebx + 0x100be753], al
cmp ebx, 0xd
jl 0x10008556
pop esi
mov byte [0x100c4e23], cl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be754
call fcn.1006d48b
leave
ret

Function at 0x10008585
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e36], 0
jne 0x100085d5
xor ecx, ecx
mov dword [ebp - 0x14], 0x110f0f3d
mov dword [ebp - 0x10], 0x1f1d153c
mov dword [ebp - 0xc], 0x71b061a
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100be857], al
cmp ecx, 0xc
jl 0x100085b8
mov byte [0x100c4e36], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be858
call fcn.1006d48b
leave
ret
Function at 0x100085e6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
call fcn.10003db9
xor ebx, ebx
test al, al
jne 0x10008662
mov esi, ebx
call fcn.1006daf8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
inc esi
movsd qword [ebp + esi*8 - 0x18c], xmm0
cmp esi, 0x2e
jb 0x10008608
mov eax, ebx
push 0x2d
pop ecx
cmp eax, ecx
jge 0x1000865c
movsd xmm0, qword [ebp + ecx*8 - 0x184]
movsd xmm1, qword [ebp + ecx*8 - 0x18c]
comisd xmm0, xmm1
jbe 0x10008657
movsd qword [ebp + ecx*8 - 0x184], xmm1
movsd qword [ebp + ecx*8 - 0x18c], xmm0
dec ecx
cmp ecx, eax
jg 0x1000862d
inc eax
cmp eax, 0x2e
jl 0x10008626
mov esi, dword [0x100c47a0]
mov eax, esi
imul eax, esi
push 0x18
cdq
pop ecx
idiv ecx
push 3
pop eax
cmp edx, 2
jne 0x100086d1
test esi, esi
je 0x100086d1
mov ecx, esi
and ecx, 0x80000001
jns 0x1000868e
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x1000869b
mov eax, esi
cdq
sub eax, edx
mov esi, eax
sar esi, 1
jmp 0x100086a2
lea esi, [esi*2 + 1]
mov eax, esi
push 3
cdq
pop ecx
idiv ecx
mov dword [0x100c47a0], esi
sub edx, ebx
je 0x100086bd
dec edx
dec edx
je 0x100086c0
dec edx
je 0x100086c1
jmp 0x100086ca
add esi, 2
inc esi
add esi, 2
mov dword [0x100c47a0], esi
test esi, esi
jne 0x1000867f
push 3
pop eax
cmp byte [0x100c4dcd], bl
jne 0x10008717
mov word [ebp - 0x14], 0xf3d
mov byte [ebp - 0x12], 0xe
mov byte [ebp - 0x11], al
mov byte [ebp - 0x10], al
mov dword [ebp - 0xf], 0x1b0d3d59
mov dword [ebp - 0xb], 0x434e1b0c
mov byte [ebp - 7], bl
mov al, byte [ebx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ebx - 0x14]
inc ebx
mov byte [ebx + 0x100be2d3], al
cmp ebx, 0xd
jl 0x100086fa
mov byte [0x100c4dcd], 1
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 0x100be2d4
pop ebx
call fcn.1006d48b
leave
ret

Function at 0x1000872a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dfb], 0
jne 0x100087a1
call fcn.10003f5d
test al, al
jne 0x1000876d
xor ecx, ecx
push esi
mov esi, dword [0x100c47a0]
inc ecx
cmp esi, ecx
jle 0x10008766
mov eax, esi
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, esi
jl 0x1000875a
mov dword [0x100c47a0], ecx
pop esi
mov dword [ebp - 0x10], 0x30e0f3d
mov dword [ebp - 0xc], 0xd3d5903
mov dword [ebp - 8], 0x1b0c1b
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be537], al
cmp ecx, 0xb
jl 0x10008784
mov byte [0x100c4dfb], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be538
call fcn.1006d48b
leave
ret
Function at 0x100087b2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dd2], 0
jne 0x10008801
xor ecx, ecx
mov dword [ebp - 0x10], 0x1203083e
mov dword [ebp - 0xc], 0x1807033f
mov word [ebp - 8], 0x10e
mov byte [ebp - 6], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be31f], al
cmp ecx, 0xa
jl 0x100087e4
mov byte [0x100c4dd2], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be320
call fcn.1006d48b
leave
ret

Function at 0x10008812
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e00], 0
jne 0x1000885e
mov dword [ebp - 0x10], 0x308133f
mov dword [ebp - 0xc], 0x918153f
mov word [ebp - 8], 0x1f
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be57b], al
cmp ecx, 9
jl 0x10008841
mov byte [0x100c4e00], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be57c
call fcn.1006d48b
leave
ret

Function at 0x1000886f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x39c
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x100c47a0]
mov eax, ebx
imul eax, ebx
imul eax, ebx
push esi
push edi
push 0x13
cdq
pop ecx
idiv ecx
cmp edx, 2
jne 0x100088ac
xor esi, esi
mov edi, ebx
inc esi
dec edi
cmp esi, 0x89
jb 0x100088a2
cmp byte [0x100c4ddb], 0
jne 0x10008959
push 0xe
pop eax
mov word [ebp - 0xc], 0x163f
mov byte [ebp - 0xa], al
mov dword [ebp - 9], 0x1d180d03
mov byte [ebp - 5], 0
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0xc]
inc ecx
mov byte [ecx + 0x100be393], al
cmp ecx, 7
jl 0x100088d2
lea ecx, [ebx + 1]
lea eax, [ebx + 2]
imul eax, ecx
imul eax, ebx
push 0xe
cdq
pop ecx
idiv ecx
mov byte [0x100c4ddb], 1
cmp edx, 0xc
jne 0x10008959
xor eax, eax
mov dword [ebp - 0x394], eax
lea esi, [ebp - 0x38c]
xor edi, edi
and dword [ebp - 0x398], 0
mov eax, ebx
inc edi
cdq
idiv edi
mov dword [ebp - 8], edi
mov edi, dword [ebp - 0x398]
mov dword [ebp - 0x39c], edx
lea ecx, [edi + 1]
mov edi, ecx
cmp edi, 8
jl 0x10008932
mov edi, dword [ebp - 8]
add esi, 8
cmp edi, 0x10
jl 0x10008916
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp eax, 7
jl 0x10008914
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0x100be394
pop ebx
call fcn.1006d48b
leave
ret