joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103116f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [ebp - 8]
mov dword [ebp - 4], edi
push ecx
push 4
push dword [ebp + 0x10]
add eax, edi
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, edi
mov dword [ebp + 0xc], esi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x103121c
push ebx
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, dword [esi + 0x10]
mov edx, eax
mov eax, dword [esi]
add ebx, edi
mov dword [ebp - 0xc], edx
mov edi, ebx
test eax, eax
je 0x10311c3
mov edi, dword [ebp - 4]
add edi, eax
mov ecx, dword [edi]
test ecx, ecx
je 0x103120b
mov esi, dword [ebp - 4]
jns 0x10311ea
mov eax, dword [edx + 0x3c]
movzx ecx, cx
mov eax, dword [eax + edx + 0x78]
sub ecx, dword [eax + edx + 0x10]
mov eax, dword [eax + edx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
jmp 0x10311fa
lea eax, [esi + 2]
add eax, ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 0xc]
add edi, 4
mov dword [ebx], eax
add ebx, 4
mov ecx, dword [edi]
test ecx, ecx
jne 0x10311cc
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x20]
add esi, 0x14
mov edi, dword [ebp - 4]
mov dword [ebp + 0xc], esi
test eax, eax
jne 0x10311a3
pop ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1031235
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov ebx, dword [eax + 0xc]
mov edi, dword [eax + 8]
add ebx, ecx
add ebx, dword [ebp + 8]
cmp dword [eax + 0x10], edi
cmovb edi, dword [eax + 0x10]
sub edi, dword [ebp + 8]
cmp edi, 1
jbe 0x1031284
lea eax, [ebp + 8]
push eax
push 0x40
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [0x1031024]
mov edx, edi
mov ecx, ebx
call fcn.01031048
pop ecx
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop ebx
pop ebp
ret
Function at 0x1031288
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
xor edx, edx
mov ecx, edi
mov ebx, dword [edi + 0x3c]
add ebx, edi
mov dword [ebp - 4], ebx
movzx esi, word [ebx + 0x14]
add esi, 0x18
add esi, ebx
sub eax, dword [0x103101c]
mov dword [ebp - 0x10], eax
sbb edx, edx
mov dword [ebp - 0x14], esi
neg eax
mov dword [ebp - 0xc], edx
adc edx, 0
neg edx
push edx
mov edx, dword [ebx + 0xa0]
push eax
mov eax, dword [esi + 0xc]
add eax, dword [0x1031028]
push eax
push dword [ebx + 0xa4]
call fcn.010310ab
push esi
push dword [0x1031028]
mov ecx, edi
call fcn.01031235
mov eax, dword [0x1031020]
add esp, 0x18
add esi, 0x28
cmp eax, 1
jbe 0x103131b
push esi
push dword [0x103102c]
mov ecx, edi
call fcn.01031235
mov eax, dword [0x1031020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 2
jbe 0x1031338
push esi
push dword [0x1031030]
mov ecx, edi
call fcn.01031235
mov eax, dword [0x1031020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 3
jbe 0x1031355
push esi
push dword [0x1031034]
mov ecx, edi
call fcn.01031235
mov eax, dword [0x1031020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 4
jbe 0x1031372
push esi
push dword [0x1031038]
mov ecx, edi
call fcn.01031235
mov eax, dword [0x1031020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 5
jbe 0x103138f
push esi
push dword [0x103103c]
mov ecx, edi
call fcn.01031235
mov eax, dword [0x1031020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 6
jbe 0x10313ac
push esi
push dword [0x1031040]
mov ecx, edi
call fcn.01031235
mov eax, dword [0x1031020]
add esi, 0x28
pop ecx
pop ecx
cmp eax, 7
jbe 0x10313c1
push esi
push dword [0x1031044]
mov ecx, edi
call fcn.01031235
pop ecx
pop ecx
cmp dword [0x1031014], 0
je 0x103140a
add ebx, 0x88
cmp dword [ebx], 0
je 0x1031407
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 8]
push eax
push 4
push 8
push ebx
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [0x1031014]
mov dword [ebx], eax
mov eax, dword [0x1031018]
mov dword [ecx + 0x8c], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 8
push ebx
call esi
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
mov ecx, edi
push dword [ebp - 0xc]
mov edx, dword [ebx + 0xa0]
push dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [0x1031028]
push eax
push dword [ebx + 0xa4]
call fcn.010310ab
mov edx, dword [0x1031004]
add esp, 0x10
push dword [0x1031010]
push dword [0x103100c]
push ecx
mov ecx, edi
call fcn.0103116f
mov eax, dword [section..text]
add esp, 0xc
add eax, edi
call eax
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1032577
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3f10], 1
mov ecx, 0x91c4
jne 0x10325fe
or dword [0x10f3f10], 1
lea eax, [ecx + 0x1d]
mov edx, eax
add eax, 0xffffffb7
mov word [0x10eda14], ax
mov word [0x10eda08], dx
add edx, 0xffffffaf
lea eax, [ecx - 0x24]
mov word [0x10eda16], ax
add eax, 0x11
mov word [0x10eda18], ax
mov word [0x10eda0a], dx
lea edx, [ecx - 0x43]
lea eax, [ecx - 0x1b]
mov word [0x10eda1a], ax
mov word [0x10eda0c], dx
add edx, 8
add eax, 0xb
mov word [0x10eda1c], ax
lea eax, [ecx - 0x29]
mov word [0x10eda1e], ax
mov eax, ecx
mov word [0x10eda0e], dx
mov dword [0x10eda10], 0x91e19194
mov word [0x10eda20], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x10eda08]
add eax, 2
mov word [eax + 0x10ee0b2], dx
cmp eax, 0x1a
jb 0x1032600
mov eax, 0x10ee0b4
ret

Function at 0x103261e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3f08], 1
jne 0x103264c
or dword [0x10f3f08], 1
mov dword [0x10eda30], 0xa0aba9f8
mov dword [0x10eda34], 0xfba1a8b1
mov dword [0x10eda38], 0xc4fafbfb
xor eax, eax
mov cl, byte [eax + 0x10eda30]
xor cl, 0xc4
mov byte [eax + 0x10ee0dc], cl
inc eax
cmp eax, 0xc
jb 0x103264e
mov eax, 0x10ee0dc
ret

Function at 0x1032669
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3f04], 1
mov edx, 0x91c4
jne 0x1032729
push esi
lea ecx, [edx + 0x22]
mov eax, ecx
mov word [0x10eda3c], ax
add eax, 0xfffffffe
or dword [0x10f3f04], 1
mov word [0x10eda3e], ax
lea eax, [edx + 0x25]
mov esi, eax
mov word [0x10eda40], si
mov word [0x10eda42], ax
add eax, 0xffffffbe
mov word [0x10eda44], ax
lea eax, [edx - 0xe]
mov esi, eax
mov word [0x10eda46], si
add esi, 0xffffffef
mov word [0x10eda48], si
lea esi, [edx - 0xd]
mov word [0x10eda4a], si
add esi, 0xfffffff5
mov word [0x10eda4c], si
lea esi, [edx - 0x29]
mov word [0x10eda4e], si
mov esi, eax
mov word [0x10eda50], si
add esi, 0xffffffeb
add eax, 0xfffffffa
mov word [0x10eda52], si
lea esi, [edx - 0x10]
mov word [0x10eda5a], ax
mov eax, edx
mov word [0x10eda54], si
mov dword [0x10eda56], 0x91b691ab
mov dword [0x10eda5c], 0x91e691f9
mov word [0x10eda60], ax
pop esi
xor eax, eax
mov ecx, edx
xor cx, word [eax + 0x10eda3c]
add eax, 2
mov word [eax + 0x10ee0e6], cx
cmp eax, 0x26
jb 0x103272b
mov eax, 0x10ee0e8
ret
Function at 0x103280c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
test byte [0x10f3f00], 1
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov ecx, 0x91c4
jne 0x103284a
or dword [0x10f3f00], 1
lea eax, [ecx - 0x11]
mov word [0x10eda64], ax
add eax, 0xfffffff3
mov word [0x10eda66], ax
mov eax, ecx
mov word [0x10eda68], ax
xor esi, esi
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x10eda64]
add eax, 2
mov word [eax + 0x10ee10e], dx
cmp eax, 6
jb 0x103284e
lea eax, [ebx + 0xc]
cmp dword [eax + 0x14], 8
jb 0x1032871
mov eax, dword [eax]
push 0x10ee110
push eax
lea eax, [esp + 0x18]
push eax
call fcn.01094297
add esp, 0xc
test eax, eax
jne 0x103293c
push dword [esp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.010335a1
push dword [esp + 0x10]
call fcn.01032945
push eax
call fcn.010947f1
push dword [esp + 0x18]
call fcn.01094d7c
add esp, 0xc
push 0x44
pop edi
push edi
lea eax, [esp + 0x44]
push esi
push eax
call fcn.01097950
add esp, 0xc
mov dword [esp + 0x40], edi
xor eax, eax
lea ecx, [esp + 0x14]
push ecx
lea edi, [esp + 0x18]
stosd dword es:[edi], eax
lea ecx, [esp + 0x44]
push ecx
push esi
push esi
stosd dword es:[edi], eax
push esi
push esi
stosd dword es:[edi], eax
push esi
stosd dword es:[edi], eax
mov eax, dword [ebx + 0x28]
push esi
push eax
push esi
call dword [0x10c308c]
test eax, eax
jne 0x103292a
call dword [0x10c30a8]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0105ad72
cmp dword [eax + 0x14], 0x10
pop ecx
pop ecx
jb 0x103290e
mov eax, dword [eax]
push eax
call fcn.01032985
push eax
call fcn.01094ac0
pop ecx
pop ecx
push esi
push 1
lea ecx, [esp + 0x2c]
call fcn.01034cea
jmp 0x103293c
push dword [esp + 0x18]
mov esi, dword [0x10c30bc]
call esi
push dword [esp + 0x14]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1032945
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3efc], 1
jne 0x1032968
or dword [0x10f3efc], 1
mov dword [0x10eda6c], 0x8a81cec9
mov word [0x10eda70], 0xc480
xor eax, eax
mov cl, byte [eax + 0x10eda6c]
xor cl, 0xc4
mov byte [eax + 0x10ee118], cl
inc eax
cmp eax, 6
jb 0x103296a
mov eax, 0x10ee118
ret

Function at 0x1032985
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3ef8], 1
jne 0x1032a0a
or dword [0x10f3ef8], 1
mov dword [0x10eda74], 0xa8ada582
mov dword [0x10eda78], 0xb0e4a0a1
mov dword [0x10eda7c], 0xb6a7e4ab
mov dword [0x10eda80], 0xa1b0a5a1
mov dword [0x10eda84], 0xa5b6a7e4
mov dword [0x10eda88], 0xb6e4acb7
mov dword [0x10eda8c], 0xb6abb4a1
mov dword [0x10eda90], 0xe4b6a1b0
mov dword [0x10eda94], 0xa7abb6b4
mov dword [0x10eda98], 0xfeb7b7a1
mov dword [0x10eda9c], 0xceb7e1e4
mov byte [0x10edaa0], 0xc4
xor eax, eax
mov cl, byte [eax + 0x10eda74]
xor cl, 0xc4
mov byte [eax + 0x10ee120], cl
inc eax
cmp eax, 0x2d
jb 0x1032a0c
mov eax, 0x10ee120
ret
Function at 0x1033ad6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e98], 1
jne 0x1033b0b
or dword [0x10f3e98], 1
mov dword [0x10edd20], 0xb1a0ab89
mov dword [0x10edd24], 0xe4fea1a8
mov dword [0x10edd28], 0xcec9b7e1
mov byte [0x10edd2c], 0xc4
xor eax, eax
mov cl, byte [eax + 0x10edd20]
xor cl, 0xc4
mov byte [eax + 0x10ee3cc], cl
inc eax
cmp eax, 0xd
jb 0x1033b0d
mov eax, 0x10ee3cc
ret

Function at 0x1033b28
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e94], 1
jne 0x1033b67
or dword [0x10f3e94], 1
mov dword [0x10edd30], 0xa1b6ac90
mov dword [0x10edd34], 0xe4fea0a5
mov dword [0x10edd38], 0xbce1bcf4
mov dword [0x10edd3c], 0xcec9cec9
mov byte [0x10edd40], 0xc4
xor eax, eax
mov cl, byte [eax + 0x10edd30]
xor cl, 0xc4
mov byte [eax + 0x10ee3dc], cl
inc eax
cmp eax, 0x11
jb 0x1033b69
mov eax, 0x10ee3dc
ret

Function at 0x1033b84
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e90], 1
jne 0x1033bc2
or dword [0x10f3e90], 1
mov dword [0x10edd44], 0xa1a7bc81
mov dword [0x10edd48], 0xabadb0b4
mov dword [0x10edd4c], 0xa0e1e4aa
mov word [0x10edd50], 0xcec9
mov byte [0x10edd52], 0xc4
xor eax, eax
mov cl, byte [eax + 0x10edd44]
xor cl, 0xc4
mov byte [eax + 0x10ee3f0], cl
inc eax
cmp eax, 0xf
jb 0x1033bc4
mov eax, 0x10ee3f0
ret

Function at 0x1033bdf
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e8c], 1
jne 0x1033c1d
or dword [0x10f3e8c], 1
mov dword [0x10edd54], 0xa5a7ab88
mov dword [0x10edd58], 0xaaabadb0
mov dword [0x10edd5c], 0xb4e1e4fe
mov word [0x10edd60], 0xcec9
mov byte [0x10edd62], 0xc4
xor eax, eax
mov cl, byte [eax + 0x10edd54]
xor cl, 0xc4
mov byte [eax + 0x10ee400], cl
inc eax
cmp eax, 0xf
jb 0x1033c1f
mov eax, 0x10ee400
ret

Function at 0x1033c3a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e88], 1
jne 0x1033c7b
or dword [0x10f3e88], 1
mov dword [0x10edd64], 0xa1b4bd90
mov dword [0x10edd68], 0xb7e1e4fe
mov dword [0x10edd6c], 0xbcf4ece4
mov dword [0x10edd70], 0xc9edbce1
mov word [0x10edd74], 0xc4ce
xor eax, eax
mov cl, byte [eax + 0x10edd64]
xor cl, 0xc4
mov byte [eax + 0x10ee410], cl
inc eax
cmp eax, 0x12
jb 0x1033c7d
mov eax, 0x10ee410
ret

Function at 0x1033c98
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e84], 1
jne 0x1033d20
or dword [0x10f3e84], 1
mov dword [0x10edd78], 0xa5b0a180
mov dword [0x10edd7c], 0xfeb7a8ad
mov dword [0x10edd80], 0xadb690e4
mov dword [0x10edd84], 0xb0e4a0a1
mov dword [0x10edd88], 0xa1b6e4ab
mov dword [0x10edd8c], 0xa2e4a0a5
mov dword [0x10edd90], 0xe4a9abb6
mov dword [0x10edd94], 0xaba9a1a9
mov dword [0x10edd98], 0xa5e4bdb6
mov dword [0x10edd9c], 0xa1b6a0a0
mov dword [0x10edda0], 0xe1e4b7b7
mov dword [0x10edda4], 0xc4cec9b4
xor eax, eax
mov cl, byte [eax + 0x10edd78]
xor cl, 0xc4
mov byte [eax + 0x10ee424], cl
inc eax
cmp eax, 0x30
jb 0x1033d22
mov eax, 0x10ee424
ret
Function at 0x1033d3d
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e80], 1
jne 0x1033dcf
or dword [0x10f3e80], 1
mov dword [0x10edda8], 0xa5b0a180
mov dword [0x10eddac], 0xfeb7a8ad
mov dword [0x10eddb0], 0xadb690e4
mov dword [0x10eddb4], 0xb0e4a0a1
mov dword [0x10eddb8], 0xb6b3e4ab
mov dword [0x10eddbc], 0xe4a1b0ad
mov dword [0x10eddc0], 0xa9e4abb0
mov dword [0x10eddc4], 0xb6aba9a1
mov dword [0x10eddc8], 0xa0a5e4bd
mov dword [0x10eddcc], 0xb7a1b6a0
mov dword [0x10eddd0], 0xb4e1e4b7
mov word [0x10eddd4], 0xcec9
mov byte [0x10eddd6], 0xc4
xor eax, eax
mov cl, byte [eax + 0x10edda8]
xor cl, 0xc4
mov byte [eax + 0x10ee454], cl
inc eax
cmp eax, 0x2f
jb 0x1033dd1
mov eax, 0x10ee454
ret

Function at 0x1033dec
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e7c], 1
jne 0x1033e7f
or dword [0x10f3e7c], 1
mov dword [0x10eddd8], 0xa5b0a180
mov dword [0x10edddc], 0xfeb7a8ad
mov dword [0x10edde0], 0xadb690e4
mov dword [0x10edde4], 0xb0e4a0a1
mov dword [0x10edde8], 0xbca1e4ab
mov dword [0x10eddec], 0xb0b1a7a1
mov dword [0x10eddf0], 0xa1a9e4a1
mov dword [0x10eddf4], 0xbdb6aba9
mov dword [0x10eddf8], 0xe4b0a5e4
mov dword [0x10eddfc], 0xb6a0a0a5
mov dword [0x10ede00], 0xe4b7b7a1
mov dword [0x10ede04], 0xcec9b4e1
mov byte [0x10ede08], 0xc4
xor eax, eax
mov cl, byte [eax + 0x10eddd8]
xor cl, 0xc4
mov byte [eax + 0x10ee484], cl
inc eax
cmp eax, 0x31
jb 0x1033e81
mov eax, 0x10ee484
ret

Function at 0x1033e9c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e78], 1
jne 0x1033ed3
or dword [0x10f3e78], 1
mov dword [0x10ede0c], 0xa3a5a882
mov dword [0x10ede10], 0xf4e4feb7
mov dword [0x10ede14], 0xc9bce1bc
mov word [0x10ede18], 0xc4ce
xor eax, eax
mov cl, byte [eax + 0x10ede0c]
xor cl, 0xc4
mov byte [eax + 0x10ee4b8], cl
inc eax
cmp eax, 0xe
jb 0x1033ed5
mov eax, 0x10ee4b8
ret

Function at 0x1033ef0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e74], 1
jne 0x1033f27
or dword [0x10f3e74], 1
mov dword [0x10ede1c], 0xa5b6a594
mov dword [0x10ede20], 0xa1b0a1a9
mov dword [0x10ede24], 0xc9feb7b6
mov word [0x10ede28], 0xc4ce
xor eax, eax
mov cl, byte [eax + 0x10ede1c]
xor cl, 0xc4
mov byte [eax + 0x10ee4c8], cl
inc eax
cmp eax, 0xe
jb 0x1033f29
mov eax, 0x10ee4c8
ret

Function at 0x1033f44
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e70], 1
jne 0x1033f8d
or dword [0x10f3e70], 1
mov dword [0x10ede2c], 0xb6a594cd
mov dword [0x10ede30], 0xb0a1a9a5
mov dword [0x10ede34], 0xe19fb6a1
mov dword [0x10ede38], 0xe4fe99a0
mov dword [0x10ede3c], 0xcec9b4e1
mov byte [0x10ede40], 0xc4
xor eax, eax
mov cl, byte [eax + 0x10ede2c]
xor cl, 0xc4
mov byte [eax + 0x10ee4d8], cl
inc eax
cmp eax, 0x15
jb 0x1033f8f
mov eax, 0x10ee4d8
ret

Function at 0x1033faa
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e6c], 1
jne 0x1033fe2
or dword [0x10f3e6c], 1
mov dword [0x10ede44], 0xe48c8197
mov dword [0x10ede48], 0xa8a5aa85
mov dword [0x10ede4c], 0xb7adb7bd
mov dword [0x10ede50], 0xc4cec9fe
xor eax, eax
mov cl, byte [eax + 0x10ede44]
xor cl, 0xc4
mov byte [eax + 0x10ee4f0], cl
inc eax
cmp eax, 0x10
jb 0x1033fe4
mov eax, 0x10ee4f0
ret
Function at 0x1033fff
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e68], 1
jne 0x1034047
or dword [0x10f3e68], 1
mov dword [0x10ede54], 0xaea68bcd
mov dword [0x10ede58], 0xe4b0a7a1
mov dword [0x10ede5c], 0xa1b4bdb0
mov dword [0x10ede60], 0xb7e1e4fe
mov word [0x10ede64], 0xcec9
mov byte [0x10ede66], 0xc4
xor eax, eax
mov cl, byte [eax + 0x10ede54]
xor cl, 0xc4
mov byte [eax + 0x10ee500], cl
inc eax
cmp eax, 0x13
jb 0x1034049
mov eax, 0x10ee500
ret

Function at 0x1034064
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e64], 1
jne 0x10340cd
or dword [0x10f3e64], 1
mov dword [0x10ede68], 0xada582cd
mov dword [0x10ede6c], 0xe4a0a1a8
mov dword [0x10ede70], 0xa2e4abb0
mov dword [0x10ede74], 0xaba8a8ab
mov dword [0x10ede78], 0xabb4e4b3
mov dword [0x10ede7c], 0xa1b0aaad
mov dword [0x10ede80], 0xaca7e4b6
mov dword [0x10ede84], 0xc9aaada5
mov word [0x10ede88], 0xc4ce
xor eax, eax
mov cl, byte [eax + 0x10ede68]
xor cl, 0xc4
mov byte [eax + 0x10ee514], cl
inc eax
cmp eax, 0x22
jb 0x10340cf
mov eax, 0x10ee514
ret

Function at 0x10340ea
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e60], 1
jne 0x103410d
or dword [0x10f3e60], 1
mov dword [0x10ede8c], 0xa0b0b784
mov word [0x10ede90], 0xc484
xor eax, eax
mov cl, byte [eax + 0x10ede8c]
xor cl, 0xc4
mov byte [eax + 0x10ee538], cl
inc eax
cmp eax, 6
jb 0x103410f
mov eax, 0x10ee538
ret

Function at 0x103412a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e5c], 1
jne 0x1034161
or dword [0x10f3e5c], 1
mov dword [0x10ede94], 0xb0aab1b6
mov dword [0x10ede98], 0x9ba1a9ad
mov dword [0x10ede9c], 0xabb6b6a1
mov word [0x10edea0], 0xc4b6
xor eax, eax
mov cl, byte [eax + 0x10ede94]
xor cl, 0xc4
mov byte [eax + 0x10ee540], cl
inc eax
cmp eax, 0xe
jb 0x1034163
mov eax, 0x10ee540
ret

Function at 0x103417e
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e58], 1
jne 0x10341ac
or dword [0x10f3e58], 1
mov dword [0x10edea4], 0xa3aaa5b6
mov dword [0x10edea8], 0xb6a19ba1
mov dword [0x10edeac], 0xc4b6abb6
xor eax, eax
mov cl, byte [eax + 0x10edea4]
xor cl, 0xc4
mov byte [eax + 0x10ee550], cl
inc eax
cmp eax, 0xc
jb 0x10341ae
mov eax, 0x10ee550
ret

Function at 0x10341c9
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e54], 1
jne 0x1034207
or dword [0x10f3e54], 1
mov dword [0x10edeb0], 0xb6a1b2ab
mov dword [0x10edeb4], 0xb3aba8a2
mov dword [0x10edeb8], 0xb6b6a19b
mov word [0x10edebc], 0xb6ab
mov byte [0x10edebe], 0xc4
xor eax, eax
mov cl, byte [eax + 0x10edeb0]
xor cl, 0xc4
mov byte [eax + 0x10ee55c], cl
inc eax
cmp eax, 0xf
jb 0x1034209
mov eax, 0x10ee55c
ret

Function at 0x1034224
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e50], 1
jne 0x103425c
or dword [0x10f3e50], 1
mov dword [0x10edec0], 0xa1a0aab1
mov dword [0x10edec4], 0xaba8a2b6
mov dword [0x10edec8], 0xb6a19bb3
mov dword [0x10edecc], 0xc4b6abb6
xor eax, eax
mov cl, byte [eax + 0x10edec0]
xor cl, 0xc4
mov byte [eax + 0x10ee56c], cl
inc eax
cmp eax, 0x10
jb 0x103425e
mov eax, 0x10ee56c
ret
Function at 0x1034279
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e4c], 1
jne 0x10342a7
or dword [0x10f3e4c], 1
mov dword [0x10eded0], 0xada3aba8
mov dword [0x10eded4], 0xb6a19ba7
mov dword [0x10eded8], 0xc4b6abb6
xor eax, eax
mov cl, byte [eax + 0x10eded0]
xor cl, 0xc4
mov byte [eax + 0x10ee57c], cl
inc eax
cmp eax, 0xc
jb 0x10342a9
mov eax, 0x10ee57c
ret

Function at 0x10342c4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e48], 1
jne 0x10342f9
or dword [0x10f3e48], 1
mov dword [0x10ededc], 0xa5a9aba0
mov dword [0x10edee0], 0xa19baaad
mov dword [0x10edee4], 0xb6abb6b6
mov byte [0x10edee8], 0xc4
xor eax, eax
mov cl, byte [eax + 0x10ededc]
xor cl, 0xc4
mov byte [eax + 0x10ee588], cl
inc eax
cmp eax, 0xd
jb 0x10342fb
mov eax, 0x10ee588
ret

Function at 0x1034316
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e44], 1
jne 0x1034355
or dword [0x10f3e44], 1
mov dword [0x10edeec], 0xa5b2aaad
mov dword [0x10edef0], 0x9ba0ada8
mov dword [0x10edef4], 0xb1a3b6a5
mov dword [0x10edef8], 0xb0aaa1a9
mov byte [0x10edefc], 0xc4
xor eax, eax
mov cl, byte [eax + 0x10edeec]
xor cl, 0xc4
mov byte [eax + 0x10ee598], cl
inc eax
cmp eax, 0x11
jb 0x1034357
mov eax, 0x10ee598
ret

Function at 0x1034372
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e40], 1
jne 0x10343a7
or dword [0x10f3e40], 1
mov dword [0x10edf00], 0xa3aaa1a8
mov dword [0x10edf04], 0xa19bacb0
mov dword [0x10edf08], 0xb6abb6b6
mov byte [0x10edf0c], 0xc4
xor eax, eax
mov cl, byte [eax + 0x10edf00]
xor cl, 0xc4
mov byte [eax + 0x10ee5ac], cl
inc eax
cmp eax, 0xd
jb 0x10343a9
mov eax, 0x10ee5ac
ret

Function at 0x10343c4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e3c], 1
jne 0x10343f9
or dword [0x10f3e3c], 1
mov dword [0x10edf10], 0x9bb0b1ab
mov dword [0x10edf14], 0xb69ba2ab
mov dword [0x10edf18], 0xa1a3aaa5
mov byte [0x10edf1c], 0xc4
xor eax, eax
mov cl, byte [eax + 0x10edf10]
xor cl, 0xc4
mov byte [eax + 0x10ee5bc], cl
inc eax
cmp eax, 0xd
jb 0x10343fb
mov eax, 0x10ee5bc
ret

Function at 0x1034416
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e38], 1
jne 0x1034443
or dword [0x10f3e38], 1
mov dword [0x10edf20], 0xa1a7bca1
mov dword [0x10edf24], 0xabadb0b4
mov word [0x10edf28], 0xc4aa
xor eax, eax
mov cl, byte [eax + 0x10edf20]
xor cl, 0xc4
mov byte [eax + 0x10ee5cc], cl
inc eax
cmp eax, 0xa
jb 0x1034445
mov eax, 0x10ee5cc
ret

Function at 0x1034460
Capabilities:
Encode data using xor

Disassembly:
test byte [0x10f3e34], 1
jne 0x10344bf
or dword [0x10f3e34], 1
mov dword [0x10edf2c], 0xa0b0b7cd
mov dword [0x10edf30], 0xbca1fefe
mov dword [0x10edf34], 0xb0b4a1a7
mov dword [0x10edf38], 0xfeaaabad
mov dword [0x10edf3c], 0xa5acb3fe
mov dword [0x10edf40], 0xfeedecb0
mov dword [0x10edf44], 0xc9b7e1e4
mov word [0x10edf48], 0xc4ce
xor eax, eax
mov cl, byte [eax + 0x10edf2c]
xor cl, 0xc4
mov byte [eax + 0x10ee5d8], cl
inc eax
cmp eax, 0x1e
jb 0x10344c1
mov eax, 0x10ee5d8
ret