joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e82f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100e8363
cmp byte [esi + 1], 0
jne 0x100e83ae
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x31
jb 0x100e8320
jmp 0x100e83ae
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x31
jb 0x100e8370
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x32]
push eax
push edi
call fcn.1002fff0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100eb4f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c6815
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x10203360]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x43800000
sub esp, 8
mov dword [ebp - 0x14], 0x42000000
push eax
push dword [ebp + 8]
call fcn.100eb080
test al, al
je 0x100eb5a2
test byte [ebp + 0x10], 1
jne 0x100eb5a2
push 4
call fcn.101b9671
mov ecx, dword [ebp + 0xc]
add esp, 4
mov dword [ebp + 0x10], eax
mov dword [eax], ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x100eb710
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 0x20], eax
test eax, eax
je 0x100eb593
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 1
call fcn.10082b20
cmp dword [ebp - 0x1c], 0
je 0x100eb5a2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
push 6
mov dword [ebp - 0x1c], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1010caf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1010cb63
cmp byte [esi + 1], 0
jne 0x1010cbae
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x1e
jb 0x1010cb20
jmp 0x1010cbae
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x1e
jb 0x1010cb70
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1f]
push eax
push edi
call fcn.1002fff0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1010cbd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1010cc43
cmp byte [esi + 1], 0
jne 0x1010cc8e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x1a
jb 0x1010cc00
jmp 0x1010cc8e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x1a
jb 0x1010cc50
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1b]
push eax
push edi
call fcn.1002fff0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x101102a0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c971d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x10203360]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], edx
mov ebx, ecx
mov dword [ebp - 0x3c], ebx
mov edi, dword [0x102a231c]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
test edi, edi
jne 0x10110390
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0x18]
mov dword [ebp - 0x30], ebx
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ecx + ebx + 0x78]
add ecx, ebx
mov dword [ebp - 0x38], ecx
cmp ecx, ebx
je 0x1011036a
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x1011036a
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, ebx
sub ecx, 4
dec edx
mov dword [ebp - 0x34], ecx
mov edi, 0xc934385
mov dword [ebp - 0x2c], edx
mov ecx, dword [ecx]
add ecx, ebx
mov bl, byte [ecx]
inc ecx
test bl, bl
je 0x10110360
movsx esi, bl
lea ecx, [ecx + 1]
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
mov bl, byte [ecx - 1]
cmova edx, esi
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x10110332
mov edx, dword [ebp - 0x2c]
cmp edi, 0x4a65bc05
je 0x1011036e
mov ecx, dword [ebp - 0x34]
mov ebx, dword [eax + 0x18]
test edx, edx
jne 0x10110318
mov eax, dword [eax]
jmp 0x101102f3
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, esi
add eax, esi
movzx eax, word [eax + edx*2]
mov edi, dword [ecx + eax*4]
add edi, esi
mov dword [0x102a231c], edi
lea eax, [ebp - 0x28]
mov ecx, 0x102952d0
push eax
call fcn.10031980
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x40]
call edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.1001de40
test esi, esi
jne 0x101103cf
mov dword [ebx], esi
jmp 0x101103db
push 0
push dword [ebp - 0x44]
call esi
add esp, 8
mov dword [ebx], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101b965e
mov esp, ebp
pop ebp
ret
Function at 0x10111b20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c9843
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x10203360]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [0x105cbfb0]
add eax, 0x4fd8cdb0
xor eax, 0x91d5c6d7
mov eax, dword [eax + 0x14c]
mov dword [ebp - 0x24], eax
mov eax, dword [0x1029e410]
test al, 1
jne 0x10111ca4
or eax, 1
mov dword [0x1029e410], eax
mov dword [ebp - 4], 0
mov ebx, dword [0x1029b360]
cmp ebx, dword [0x1029b364]
je 0x10111bd4
nop dword [eax]
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x10111bc9
mov esi, dword [eax + 0xc]
mov edi, 0x811c9dc5
xor eax, eax
inc eax
cmp byte [eax + esi], 0
jne 0x10111ba3
xor edx, edx
test eax, eax
je 0x10111bc9
movsx ecx, byte [edx + esi]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, eax
jb 0x10111bb0
cmp edi, 0x72e242a1
je 0x10111be3
add ebx, 4
cmp ebx, dword [0x1029b364]
jne 0x10111b90
mov ecx, dword [ebp - 0x20]
xor eax, eax
mov dword [0x1029cb68], eax
jmp 0x10111ca9
mov eax, dword [ebp - 0x10]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
cmp dword [eax + 4], ebx
jle 0x10111c88
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
nop dword [eax]
mov edi, dword [eax]
add edi, ecx
mov ecx, dword [edi + 0x28]
test ecx, ecx
je 0x10111c31
cmp dword [ecx + 4], 0
jle 0x10111c31
push 0
mov edx, 0xa4a37590
call fcn.101146e0
add esp, 4
test eax, eax
je 0x10111c2e
mov ecx, dword [edi + 0x2c]
add ecx, eax
add ebx, ecx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x10]
mov esi, dword [edi]
mov ebx, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [ecx + esi], 0
jne 0x10111c40
xor edx, edx
test ecx, ecx
je 0x10111c6c
nop dword [eax]
movsx eax, byte [edx + esi]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x10111c50
cmp ebx, 0xa4a37590
je 0x10111c94
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc edx
mov ebx, dword [ebp - 0x14]
add ecx, 0x3c
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
cmp edx, dword [eax + 4]
jl 0x10111c00
mov ecx, dword [ebp - 0x20]
mov eax, ebx
mov dword [0x1029cb68], eax
jmp 0x10111ca9
mov eax, dword [edi + 0x2c]
add eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
mov dword [0x1029cb68], eax
jmp 0x10111ca9
mov eax, dword [0x1029cb68]
mov edx, dword [ebp - 0x24]
test byte [eax + edx], 1
je 0x10111cc7
inc dword [ecx + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ecx + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101146e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x101146f6
mov esp, ebp
pop ebp
ret
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp dword [eax + 4], ebx
jle 0x10114788
xor ecx, ecx
mov dword [ebp - 0xc], ecx
nop
mov edi, dword [eax]
add edi, ecx
mov ecx, dword [edi + 0x28]
test ecx, ecx
je 0x1011473c
cmp dword [ecx + 4], 0
jle 0x1011473c
push dword [ebp + 8]
call fcn.101146e0
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x1011473c
mov eax, dword [edi + 0x2c]
add eax, ecx
add ebx, eax
mov dword [ebp - 4], ebx
mov esi, dword [edi]
mov ebx, 0x811c9dc5
xor eax, eax
inc eax
cmp byte [eax + esi], 0
jne 0x10114745
xor edx, edx
test eax, eax
je 0x10114763
movsx ecx, byte [edx + esi]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, eax
jb 0x10114752
cmp ebx, dword [ebp - 0x14]
je 0x10114791
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
inc eax
mov ebx, dword [ebp - 4]
add ecx, 0x3c
cmp eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, edx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
jl 0x10114710
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
test eax, eax
je 0x1011479a
mov dword [eax], edi
mov eax, dword [edi + 0x2c]
add eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x101149c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
push edi
test esi, esi
je 0x10114a54
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [esi + 4], ecx
jle 0x10114a4a
xor eax, eax
mov dword [ebp - 8], eax
mov edi, dword [esi]
mov esi, dword [edi + eax + 4]
add edi, eax
test esi, esi
je 0x10114a37
mov ebx, 0x811c9dc5
xor eax, eax
inc eax
cmp byte [eax + esi], 0
jne 0x101149f7
xor edx, edx
test eax, eax
je 0x10114a18
movsx ecx, byte [edx + esi]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, eax
jb 0x10114a04
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp ebx, edx
je 0x10114a5d
cmp dword [edi], 0xa
jne 0x10114a37
mov ecx, dword [edi + 0x20]
test ecx, ecx
je 0x10114a34
call fcn.101149c0
test eax, eax
jne 0x10114a56
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
inc ecx
add dword [ebp - 8], 0x3c
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
cmp ecx, dword [esi + 4]
jl 0x101149e4
mov esi, dword [esi + 0xc]
mov dword [ebp - 0xc], esi
test esi, esi
jne 0x101149d5
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10114eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x10296bd8], 0
push ebx
push esi
je 0x10114f2a
cmp byte [0x10296bd9], 0
jne 0x10114f78
mov byte [0x10296bd9], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10296cc4]
xor ebx, dword [0x10296cc0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10296bda]
xor al, bl
mov byte [esi + 0x10296bda], al
inc esi
cmp esi, 0xdf
jb 0x10114ee0
jmp 0x10114f78
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10296cc4]
xor ebx, dword [0x10296cc0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10296bda]
xor al, bl
mov byte [esi + 0x10296bda], al
inc esi
cmp esi, 0xdf
jb 0x10114f30
push ecx
mov ecx, dword [ebp + 8]
push 0x10296cb8
push 0x10296bda
call fcn.1002fff0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10114fa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x10295770], 0
push ebx
push esi
je 0x10115017
cmp byte [0x10295771], 0
jne 0x10115065
mov byte [0x10295771], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102957c4]
xor ebx, dword [0x102957c0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10295772]
xor al, bl
mov byte [esi + 0x10295772], al
inc esi
cmp esi, 0x49
jb 0x10114fd0
jmp 0x10115065
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102957c4]
xor ebx, dword [0x102957c0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10295772]
xor al, bl
mov byte [esi + 0x10295772], al
inc esi
cmp esi, 0x49
jb 0x10115020
push ecx
mov ecx, dword [ebp + 8]
push 0x102957ba
push 0x10295772
call fcn.1002fff0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10115090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10115103
cmp byte [esi + 1], 0
jne 0x1011514e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x4c]
xor ebx, dword [esi + 0x48]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x42
jb 0x101150c0
jmp 0x1011514e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x4c]
xor ebx, dword [esi + 0x48]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x42
jb 0x10115110
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x43]
push eax
push edi
call fcn.1002fff0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10115170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x10297cb0], 0
push ebx
push esi
je 0x101151e7
cmp byte [0x10297cb1], 0
jne 0x10115235
mov byte [0x10297cb1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10297d04]
xor ebx, dword [0x10297d00]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10297cb2]
xor al, bl
mov byte [esi + 0x10297cb2], al
inc esi
cmp esi, 0x4e
jb 0x101151a0
jmp 0x10115235
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10297d04]
xor ebx, dword [0x10297d00]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10297cb2]
xor al, bl
mov byte [esi + 0x10297cb2], al
inc esi
cmp esi, 0x4e
jb 0x101151f0
push ecx
mov ecx, dword [ebp + 8]
push 0x10297cff
push 0x10297cb2
call fcn.1002fff0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10115260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x102966a0], 0
push ebx
push esi
je 0x101152da
cmp byte [0x102966a1], 0
jne 0x10115328
mov byte [0x102966a1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1029674c]
xor ebx, dword [0x10296748]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102966a2]
xor al, bl
mov byte [esi + 0x102966a2], al
inc esi
cmp esi, 0xa3
jb 0x10115290
jmp 0x10115328
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1029674c]
xor ebx, dword [0x10296748]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x102966a2]
xor al, bl
mov byte [esi + 0x102966a2], al
inc esi
cmp esi, 0xa3
jb 0x101152e0
push ecx
mov ecx, dword [ebp + 8]
push 0x10296744
push 0x102966a2
call fcn.1002fff0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10115350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x10296018], 0
push ebx
push esi
je 0x101153c7
cmp byte [0x10296019], 0
jne 0x10115415
mov byte [0x10296019], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10296064]
xor ebx, dword [0x10296060]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + str.:_v_]
xor al, bl
mov byte [esi + str.:_v_], al
inc esi
cmp esi, 0x46
jb 0x10115380
jmp 0x10115415
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10296064]
xor ebx, dword [0x10296060]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + str.:_v_]
xor al, bl
mov byte [esi + str.:_v_], al
inc esi
cmp esi, 0x46
jb 0x101153d0
push ecx
mov ecx, dword [ebp + 8]
push 0x1029605f
push str.:_v_
call fcn.1002fff0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10115440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x101154b3
cmp byte [esi + 1], 0
jne 0x101154fe
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x34
jb 0x10115470
jmp 0x101154fe
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x34
jb 0x101154c0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x35]
push eax
push edi
call fcn.1002fff0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10115520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10115593
cmp byte [esi + 1], 0
jne 0x101155de
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x5c]
xor ebx, dword [esi + 0x58]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x52
jb 0x10115550
jmp 0x101155de
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x5c]
xor ebx, dword [esi + 0x58]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x52
jb 0x101155a0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x53]
push eax
push edi
call fcn.1002fff0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4