joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009540
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
cmp dword [ebp + 0xc], 1
jne 0x1000959b
mov dword [ebp - 4], 0
xor eax, eax
lea ecx, [sym.proxy.dll_DllEntry]
lea eax, [ebp - 4]
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
mov eax, 1
add esp, 0x1c
pop ebp
ret 0xc

Function at 0x10009720
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x18
mov dword [esp + 0x10], eax
mov ecx, dword [0x100212fc]
xor eax, eax
cmp dword [ecx + 0x3aed20bf], 1
mov dword [esp + 0x14], eax
je 0x100097a6
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x18
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0x41
mov dword [esp + 0x14], eax
jne 0x10009755
mov eax, dword [0x100212fc]
mov dword [eax + 0x3aed20bf], 1
add esp, 0x18
pop esi
pop edi
ret

Function at 0x100099e0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x13
mov dword [esp + 0x10], eax
mov ecx, dword [0x10021304]
xor eax, eax
cmp dword [ecx - 0x4e378129], 1
mov dword [esp + 0x14], eax
je 0x10009a66
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x13
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0xb
mov dword [esp + 0x14], eax
jne 0x10009a15
mov eax, dword [0x10021304]
mov dword [eax - 0x4e378129], 1
add esp, 0x18
pop esi
pop edi
ret
Function at 0x10009a70
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x17
mov dword [esp + 0x10], eax
mov ecx, dword [0x10021308]
xor eax, eax
cmp dword [ecx + 0x4b39228b], 1
mov dword [esp + 0x14], eax
je 0x10009b5d
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x17
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0xe
mov dword [esp + 0x14], eax
jne 0x10009aa5
mov eax, dword [0x10022cb0]
mov ecx, dword [0x10022cac]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x10009b18
jmp 0x10009b63
mov eax, dword [0x10021308]
mov dword [eax + 0x4b39228b], 1
mov eax, dword [0x10022cb0]
mov ecx, dword [0x10022cac]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x10009b58
jmp 0x10009b63
jmp 0x10009b5d
add esp, 0x18
pop esi
pop edi
ret
mov eax, dword [0x10021308]
mov dword [eax + 0x4b39228b], 1
jmp 0x10009b18

Function at 0x10009b80
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov eax, dword [0x10022ca8]
mov ecx, dword [0x10022ca4]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x10009bc6
jmp 0x10009c84
mov eax, dword [esp + 0x14]
add eax, 0x19
mov dword [esp + 0xc], eax
mov eax, dword [0x1002130c]
cmp dword [eax + 0x342557fd], 1
sete al
mov byte [esp + 0x13], al
mov eax, dword [0x10022ca8]
mov ecx, dword [0x10022ca4]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x10009c15
jmp 0x10009c84
mov cl, byte [esp + 0x13]
xor eax, eax
test cl, 1
mov dword [esp + 8], eax
jne 0x10009c7e
jmp 0x10009c2d
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x19
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0xb
mov dword [esp + 8], eax
jne 0x10009c2d
mov eax, dword [0x1002130c]
mov dword [eax + 0x342557fd], 1
add esp, 0x1c
pop esi
pop edi
ret
jmp 0x10009bc6
Function at 0x10009c90
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x15
mov dword [esp + 0x10], eax
mov ecx, dword [0x10021310]
xor eax, eax
cmp dword [ecx - 0x359b9ea2], 1
mov dword [esp + 0x14], eax
je 0x10009d7d
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x15
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 5
mov dword [esp + 0x14], eax
jne 0x10009cc5
mov eax, dword [0x10022ca0]
mov ecx, dword [0x10022c9c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x10009d38
jmp 0x10009d83
mov eax, dword [0x10021310]
mov dword [eax - 0x359b9ea2], 1
mov eax, dword [0x10022ca0]
mov ecx, dword [0x10022c9c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x10009d78
jmp 0x10009d83
jmp 0x10009d7d
add esp, 0x18
pop esi
pop edi
ret
mov eax, dword [0x10021310]
mov dword [eax - 0x359b9ea2], 1
jmp 0x10009d38

Function at 0x10009da0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x1b
mov dword [esp + 0x10], eax
mov ecx, dword [0x10021314]
xor eax, eax
cmp dword [ecx - 0x24964680], 1
mov dword [esp + 0x14], eax
je 0x10009e26
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1b
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 5
mov dword [esp + 0x14], eax
jne 0x10009dd5
mov eax, dword [0x10021314]
mov dword [eax - 0x24964680], 1
add esp, 0x18
pop esi
pop edi
ret

Function at 0x10009e30
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x18
mov dword [esp + 0x10], eax
mov ecx, dword [0x10021318]
xor eax, eax
cmp dword [ecx - 0x6ded880], 1
mov dword [esp + 0x14], eax
je 0x10009eb6
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x18
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 7
mov dword [esp + 0x14], eax
jne 0x10009e65
mov eax, dword [0x10021318]
mov dword [eax - 0x6ded880], 1
add esp, 0x18
pop esi
pop edi
ret
Function at 0x1000a010
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov eax, dword [0x10022c90]
mov ecx, dword [0x10022c8c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a056
jmp 0x1000a114
mov eax, dword [esp + 0x14]
add eax, 0x1d
mov dword [esp + 0xc], eax
mov eax, dword [0x10021320]
cmp dword [eax - 0x4476dca1], 1
sete al
mov byte [esp + 0x13], al
mov eax, dword [0x10022c90]
mov ecx, dword [0x10022c8c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a0a5
jmp 0x1000a114
mov cl, byte [esp + 0x13]
xor eax, eax
test cl, 1
mov dword [esp + 8], eax
jne 0x1000a10e
jmp 0x1000a0bd
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1d
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0x16
mov dword [esp + 8], eax
jne 0x1000a0bd
mov eax, dword [0x10021320]
mov dword [eax - 0x4476dca1], 1
add esp, 0x1c
pop esi
pop edi
ret
jmp 0x1000a056

Function at 0x1000a120
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
add eax, 0x10
mov dword [esp + 8], eax
mov ecx, dword [0x10021324]
xor eax, eax
cmp dword [ecx - 0x65559076], 1
mov dword [esp + 0xc], eax
je 0x1000a1f7
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
mov esi, dword [esp]
mov edx, dword [esp + 8]
mov dl, byte [edx + eax]
mov edi, eax
and edi, 0xf
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0xd
mov dword [esp + 0xc], eax
jne 0x1000a154
mov eax, dword [0x10022c88]
mov ecx, dword [0x10022c84]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a1b2
jmp 0x1000a1fd
mov eax, dword [0x10021324]
mov dword [eax - 0x65559076], 1
mov eax, dword [0x10022c88]
mov ecx, dword [0x10022c84]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a1f2
jmp 0x1000a1fd
jmp 0x1000a1f7
add esp, 0x10
pop esi
pop edi
ret
mov eax, dword [0x10021324]
mov dword [eax - 0x65559076], 1
jmp 0x1000a1b2
Function at 0x1000a220
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x1c
mov dword [esp + 0x10], eax
mov ecx, dword [0x10021328]
xor eax, eax
cmp dword [ecx - 0x17d9c2b2], 1
mov dword [esp + 0x14], eax
je 0x1000a2a6
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1c
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0x11
mov dword [esp + 0x14], eax
jne 0x1000a255
mov eax, dword [0x10021328]
mov dword [eax - 0x17d9c2b2], 1
mov eax, dword [0x10022c80]
mov ecx, dword [0x10022c7c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a2d7
jmp 0x1000a30e
mov eax, dword [0x10022c80]
mov ecx, dword [0x10022c7c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a308
jmp 0x1000a30e
add esp, 0x18
pop esi
pop edi
ret
jmp 0x1000a2d7

Function at 0x1000a320
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x13
mov dword [esp + 0x10], eax
mov ecx, dword [0x1002132c]
xor eax, eax
cmp dword [ecx + 0x307d15], 1
mov dword [esp + 0x14], eax
je 0x1000a3a6
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x13
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0xd
mov dword [esp + 0x14], eax
jne 0x1000a355
mov eax, dword [0x1002132c]
mov dword [eax + 0x307d15], 1
add esp, 0x18
pop esi
pop edi
ret
Function at 0x1000a3b0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x15
mov dword [esp + 0x10], eax
mov ecx, dword [0x10021330]
xor eax, eax
cmp dword [ecx + 0x401f4e1e], 1
mov dword [esp + 0x14], eax
je 0x1000a49d
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x15
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0xd
mov dword [esp + 0x14], eax
jne 0x1000a3e5
mov eax, dword [0x10022c78]
mov ecx, dword [0x10022c74]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a458
jmp 0x1000a4a3
mov eax, dword [0x10021330]
mov dword [eax + 0x401f4e1e], 1
mov eax, dword [0x10022c78]
mov ecx, dword [0x10022c74]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a498
jmp 0x1000a4a3
jmp 0x1000a49d
add esp, 0x18
pop esi
pop edi
ret
mov eax, dword [0x10021330]
mov dword [eax + 0x401f4e1e], 1
jmp 0x1000a458

Function at 0x1000a4c0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x1f
mov dword [esp + 0x10], eax
mov ecx, dword [0x10021334]
xor eax, eax
cmp dword [ecx + 0x42c29376], 1
mov dword [esp + 0x14], eax
je 0x1000a546
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1f
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0xb
mov dword [esp + 0x14], eax
jne 0x1000a4f5
mov eax, dword [0x10021334]
mov dword [eax + 0x42c29376], 1
add esp, 0x18
pop esi
pop edi
ret

Function at 0x1000a550
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x1a
mov dword [esp + 0x10], eax
mov ecx, dword [0x10021338]
xor eax, eax
cmp dword [ecx - 0xb8516ca], 1
mov dword [esp + 0x14], eax
je 0x1000a5d6
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1a
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0xb
mov dword [esp + 0x14], eax
jne 0x1000a585
mov eax, dword [0x10021338]
mov dword [eax - 0xb8516ca], 1
add esp, 0x18
pop esi
pop edi
ret
Function at 0x1000a5e0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x1e
mov dword [esp + 0x10], eax
mov ecx, dword [0x1002133c]
xor eax, eax
cmp dword [ecx - 0x54492281], 1
mov dword [esp + 0x14], eax
je 0x1000a6cd
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1e
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 8
mov dword [esp + 0x14], eax
jne 0x1000a615
mov eax, dword [0x10022c70]
mov ecx, dword [0x10022c6c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a688
jmp 0x1000a6d3
mov eax, dword [0x1002133c]
mov dword [eax - 0x54492281], 1
mov eax, dword [0x10022c70]
mov ecx, dword [0x10022c6c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a6c8
jmp 0x1000a6d3
jmp 0x1000a6cd
add esp, 0x18
pop esi
pop edi
ret
mov eax, dword [0x1002133c]
mov dword [eax - 0x54492281], 1
jmp 0x1000a688

Function at 0x1000a840
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov eax, dword [0x10022c60]
mov ecx, dword [0x10022c5c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a886
jmp 0x1000a944
mov eax, dword [esp + 0x14]
add eax, 0x14
mov dword [esp + 0xc], eax
mov eax, dword [0x10021344]
cmp dword [eax + 0x101d411a], 1
sete al
mov byte [esp + 0x13], al
mov eax, dword [0x10022c60]
mov ecx, dword [0x10022c5c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000a8d5
jmp 0x1000a944
mov cl, byte [esp + 0x13]
xor eax, eax
test cl, 1
mov dword [esp + 8], eax
jne 0x1000a93e
jmp 0x1000a8ed
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x14
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 6
mov dword [esp + 8], eax
jne 0x1000a8ed
mov eax, dword [0x10021344]
mov dword [eax + 0x101d411a], 1
add esp, 0x1c
pop esi
pop edi
ret
jmp 0x1000a886
Function at 0x1000aaa0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov eax, dword [0x10022c50]
mov ecx, dword [0x10022c4c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000aae6
jmp 0x1000ac06
mov eax, dword [esp + 0x14]
add eax, 0x16
mov dword [esp + 0xc], eax
mov eax, dword [0x1002134c]
cmp dword [eax + 0x6370369e], 1
sete al
mov byte [esp + 0x13], al
mov eax, dword [0x10022c50]
mov ecx, dword [0x10022c4c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000ab35
jmp 0x1000ac06
mov cl, byte [esp + 0x13]
xor eax, eax
test cl, 1
mov dword [esp + 8], eax
jne 0x1000ab9e
jmp 0x1000ab4d
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x16
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0xc
mov dword [esp + 8], eax
jne 0x1000ab4d
mov eax, dword [0x1002134c]
mov dword [eax + 0x6370369e], 1
mov eax, dword [0x10022c50]
mov ecx, dword [0x10022c4c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000abcf
jmp 0x1000ac0b
mov eax, dword [0x10022c50]
mov ecx, dword [0x10022c4c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000ac00
jmp 0x1000ac0b
add esp, 0x1c
pop esi
pop edi
ret
jmp 0x1000aae6
jmp 0x1000abcf

Function at 0x1000ac10
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x1d
mov dword [esp + 0x10], eax
mov ecx, dword [0x10021350]
xor eax, eax
cmp dword [ecx + 0x46c36e77], 1
mov dword [esp + 0x14], eax
je 0x1000ac96
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1d
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 6
mov dword [esp + 0x14], eax
jne 0x1000ac45
mov eax, dword [0x10021350]
mov dword [eax + 0x46c36e77], 1
mov eax, dword [0x10022c48]
mov ecx, dword [0x10022c44]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000acc7
jmp 0x1000acfe
mov eax, dword [0x10022c48]
mov ecx, dword [0x10022c44]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000acf8
jmp 0x1000acfe
add esp, 0x18
pop esi
pop edi
ret
jmp 0x1000acc7
Function at 0x1000ad10
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x19
mov dword [esp + 0x10], eax
mov ecx, dword [0x10021354]
xor eax, eax
cmp dword [ecx - 0x3e35a171], 1
mov dword [esp + 0x14], eax
je 0x1000ad96
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x19
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0x16
mov dword [esp + 0x14], eax
jne 0x1000ad45
mov eax, dword [0x10021354]
mov dword [eax - 0x3e35a171], 1
mov eax, dword [0x10022c40]
mov ecx, dword [0x10022c3c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000adc7
jmp 0x1000adfe
mov eax, dword [0x10022c40]
mov ecx, dword [0x10022c3c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000adf8
jmp 0x1000adfe
add esp, 0x18
pop esi
pop edi
ret
jmp 0x1000adc7

Function at 0x1000ae10
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x11
mov dword [esp + 0x10], eax
mov ecx, dword [0x10021358]
xor eax, eax
cmp dword [ecx - 0x65cebb65], 1
mov dword [esp + 0x14], eax
je 0x1000ae96
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x11
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0xa
mov dword [esp + 0x14], eax
jne 0x1000ae45
mov eax, dword [0x10021358]
mov dword [eax - 0x65cebb65], 1
mov eax, dword [0x10022c38]
mov ecx, dword [0x10022c34]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000aec7
jmp 0x1000aefe
mov eax, dword [0x10022c38]
mov ecx, dword [0x10022c34]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000aef8
jmp 0x1000aefe
add esp, 0x18
pop esi
pop edi
ret
jmp 0x1000aec7