joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100665f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x1023fb58], 0
push ebx
push esi
je 0x10066664
cmp byte [0x1023fb59], 0
jne 0x100666a8
mov byte [0x1023fb59], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1023fb74]
xor ebx, dword [0x1023fb70]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1023fb5a], al
inc esi
cmp esi, 0x15
jb 0x10066620
jmp 0x100666a8
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1023fb74]
xor ebx, dword [0x1023fb70]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1023fb5a], al
inc esi
cmp esi, 0x15
jb 0x10066666
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x14
push 0x1023fb5a
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10045f20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100666e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x1023fd80], 0
push ebx
push esi
je 0x10066754
cmp byte [0x1023fd81], 0
jne 0x10066798
mov byte [0x1023fd81], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1023fdd4]
xor ebx, dword [0x1023fdd0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1023fd82], al
inc esi
cmp esi, 0x48
jb 0x10066710
jmp 0x10066798
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1023fdd4]
xor ebx, dword [0x1023fdd0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1023fd82], al
inc esi
cmp esi, 0x48
jb 0x10066756
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x47
push 0x1023fd82
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10045f20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100667d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x1023fe08], 0
push ebx
push esi
je 0x10066844
cmp byte [0x1023fe09], 0
jne 0x10066888
mov byte [0x1023fe09], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1023fe54]
xor ebx, dword [0x1023fe50]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1023fe0a], al
inc esi
cmp esi, 0x43
jb 0x10066800
jmp 0x10066888
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1023fe54]
xor ebx, dword [0x1023fe50]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1023fe0a], al
inc esi
cmp esi, 0x43
jb 0x10066846
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x42
push 0x1023fe0a
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10045f20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100668c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x1023fe58], 0
push ebx
push esi
je 0x10066934
cmp byte [0x1023fe59], 0
jne 0x10066978
mov byte [0x1023fe59], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1023fe9c]
xor ebx, dword [0x1023fe98]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1023fe5a], al
inc esi
cmp esi, 0x3b
jb 0x100668f0
jmp 0x10066978
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1023fe9c]
xor ebx, dword [0x1023fe98]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1023fe5a], al
inc esi
cmp esi, 0x3b
jb 0x10066936
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x3a
push 0x1023fe5a
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10045f20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100669b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x1023ff20], 0
push ebx
push esi
je 0x10066a24
cmp byte [0x1023ff21], 0
jne 0x10066a68
mov byte [0x1023ff21], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1023ff74]
xor ebx, dword [0x1023ff70]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1023ff22], al
inc esi
cmp esi, 0x4d
jb 0x100669e0
jmp 0x10066a68
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1023ff74]
xor ebx, dword [0x1023ff70]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1023ff22], al
inc esi
cmp esi, 0x4d
jb 0x10066a26
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x4c
push 0x1023ff22
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10045f20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10066aa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x1023ffa8], 0
push ebx
push esi
je 0x10066b14
cmp byte [0x1023ffa9], 0
jne 0x10066b58
mov byte [0x1023ffa9], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1023ffc4]
xor ebx, dword [0x1023ffc0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1023ffaa], al
inc esi
cmp esi, 0xf
jb 0x10066ad0
jmp 0x10066b58
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1023ffc4]
xor ebx, dword [0x1023ffc0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1023ffaa], al
inc esi
cmp esi, 0xf
jb 0x10066b16
mov esi, dword [ebp + 8]
mov ecx, esi
push 0xe
push 0x1023ffaa
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10045f20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10066b90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x102401e0], 0
push ebx
push esi
je 0x10066c04
cmp byte [0x102401e1], 0
jne 0x10066c48
mov byte [0x102401e1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1024023c]
xor ebx, dword [0x10240238]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102401e2], al
inc esi
cmp esi, 0x50
jb 0x10066bc0
jmp 0x10066c48
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1024023c]
xor ebx, dword [0x10240238]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102401e2], al
inc esi
cmp esi, 0x50
jb 0x10066c06
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x4f
push 0x102401e2
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10045f20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10066c80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10240338], 0
push ebx
push esi
je 0x10066cf4
cmp byte [0x10240339], 0
jne 0x10066d38
mov byte [0x10240339], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10240384]
xor ebx, dword [0x10240380]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1024033a], al
inc esi
cmp esi, 0x42
jb 0x10066cb0
jmp 0x10066d38
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10240384]
xor ebx, dword [0x10240380]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1024033a], al
inc esi
cmp esi, 0x42
jb 0x10066cf6
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x41
push 0x1024033a
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10045f20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10066d70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10240408], 0
push ebx
push esi
je 0x10066de4
cmp byte [0x10240409], 0
jne 0x10066e28
mov byte [0x10240409], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1024045c]
xor ebx, dword [0x10240458]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1024040a], al
inc esi
cmp esi, 0x49
jb 0x10066da0
jmp 0x10066e28
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1024045c]
xor ebx, dword [0x10240458]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1024040a], al
inc esi
cmp esi, 0x49
jb 0x10066de6
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x48
push 0x1024040a
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10045f20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10066e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10240530], 0
push ebx
push esi
je 0x10066ed4
cmp byte [0x10240531], 0
jne 0x10066f18
mov byte [0x10240531], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10240584]
xor ebx, dword [0x10240580]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10240532], al
inc esi
cmp esi, 0x4a
jb 0x10066e90
jmp 0x10066f18
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10240584]
xor ebx, dword [0x10240580]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10240532], al
inc esi
cmp esi, 0x4a
jb 0x10066ed6
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x49
push 0x10240532
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10045f20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10066f60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10240678], 0
push ebx
push esi
je 0x10066fd4
cmp byte [0x10240679], 0
jne 0x10067018
mov byte [0x10240679], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102406c4]
xor ebx, dword [0x102406c0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1024067a], al
inc esi
cmp esi, 0x45
jb 0x10066f90
jmp 0x10067018
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102406c4]
xor ebx, dword [0x102406c0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1024067a], al
inc esi
cmp esi, 0x45
jb 0x10066fd6
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x44
push 0x1024067a
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10045f20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10067050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x1023f5b0], 0
push ebx
push esi
je 0x100670c7
cmp byte [0x1023f5b1], 0
jne 0x10067115
mov byte [0x1023f5b1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1023f6f4]
xor ebx, dword [0x1023f6f0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1023f5b2], al
inc esi
cmp esi, 0x137
jb 0x10067080
jmp 0x10067115
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1023f6f4]
xor ebx, dword [0x1023f6f0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1023f5b2], al
inc esi
cmp esi, 0x137
jb 0x100670d0
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x136
push 0x1023f5b2
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10045f20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10067150
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10240778], 0
push ebx
push esi
je 0x100671c4
cmp byte [0x10240779], 0
jne 0x10067208
mov byte [0x10240779], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102407bc]
xor ebx, dword [0x102407b8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1024077a], al
inc esi
cmp esi, 0x3a
jb 0x10067180
jmp 0x10067208
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102407bc]
xor ebx, dword [0x102407b8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1024077a], al
inc esi
cmp esi, 0x3a
jb 0x100671c6
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x39
push 0x1024077a
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10045f20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10067240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x1023f390], 0
push ebx
push esi
je 0x100672b4
cmp byte [0x1023f391], 0
jne 0x100672f8
mov byte [0x1023f391], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1023f3ac]
xor ebx, dword [0x1023f3a8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1023f392], al
inc esi
cmp esi, 0x10
jb 0x10067270
jmp 0x100672f8
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1023f3ac]
xor ebx, dword [0x1023f3a8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1023f392], al
inc esi
cmp esi, 0x10
jb 0x100672b6
mov esi, dword [ebp + 8]
mov ecx, esi
push 0xf
push 0x1023f392
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10045f20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10067330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x1023f3b0], 0
push ebx
push esi
je 0x100673a4
cmp byte [0x1023f3b1], 0
jne 0x100673e8
mov byte [0x1023f3b1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1023f3c4]
xor ebx, dword [0x1023f3c0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1023f3b2], al
inc esi
cmp esi, 0xc
jb 0x10067360
jmp 0x100673e8
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1023f3c4]
xor ebx, dword [0x1023f3c0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1023f3b2], al
inc esi
cmp esi, 0xc
jb 0x100673a6
mov esi, dword [ebp + 8]
mov ecx, esi
push 0xb
push 0x1023f3b2
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10045f20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1006b300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1025ab04]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x10241c60], 0
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ebx
je 0x1006b385
cmp byte [0x10241c61], 0
jne 0x1006b3d5
mov byte [0x10241c61], 1
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10241c7c]
xor ebx, dword [0x10241c78]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 0x28], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10241c62], al
inc esi
cmp esi, 0x10
jb 0x1006b341
jmp 0x1006b3d2
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10241c7c]
xor ebx, dword [0x10241c78]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 0x28], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10241c62], al
inc esi
cmp esi, 0x10
jb 0x1006b390
mov ebx, dword [ebp - 0x20]
push 0xf
push 0x10241c62
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
call fcn.10045f20
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [ebp - 8]
mov esi, eax
cmp edx, 0x10
jb 0x1006b446
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1006b43c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x1006b43c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.101041fa
add esp, 8
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
test esi, esi
jne 0x1006b460
mov dword [edi], esi
jmp 0x1006b472
cmp dword [ebx + 0x14], 0x10
jb 0x1006b468
mov ebx, dword [ebx]
push 0
push ebx
call esi
add esp, 8
mov dword [edi], eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10104522
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10071ee0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 8
mov esi, ecx
call fcn.101041ca
add esp, 4
test eax, eax
je 0x10071f06
mov edx, dword [ebp + 0xc]
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
mov dword [eax + 4], ecx
jmp 0x10071f08
xor eax, eax
lea edi, [esi + 4]
push edi
push 0
push eax
push 0x10072290
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
je 0x10071f2f
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
push 6
mov dword [edi], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x10071f40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edx + 1]
xor ecx, eax
movzx eax, byte [edx + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 4]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 5]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 6]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edx + 7]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
pop ebp
ret 4
Function at 0x10075c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x102456a0], 0
push ebx
push esi
je 0x10075c84
cmp byte [0x102456a1], 0
jne 0x10075cc8
mov byte [0x102456a1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102456d4]
xor ebx, dword [0x102456d0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102456a2], al
inc esi
cmp esi, 0x28
jb 0x10075c40
jmp 0x10075cc8
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102456d4]
xor ebx, dword [0x102456d0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102456a2], al
inc esi
cmp esi, 0x28
jb 0x10075c86
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x27
push 0x102456a2
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10045f20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10075d20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10245750], 0
push ebx
push esi
je 0x10075d97
cmp byte [0x10245751], 0
jne 0x10075de5
mov byte [0x10245751], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102457fc]
xor ebx, dword [0x102457f8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10245752], al
inc esi
cmp esi, 0x9f
jb 0x10075d50
jmp 0x10075de5
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102457fc]
xor ebx, dword [0x102457f8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 4], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10245752], al
inc esi
cmp esi, 0x9f
jb 0x10075da0
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x9e
push 0x10245752
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.10045f20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10079170
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
push ebx
push esi
push edi
jne 0x100791dc
mov eax, dword [ebp + 8]
push 0x10077710
push 1
mov dword [0x1025e560], eax
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
jmp 0x1007919a
mov eax, dword [0x1023f178]
sub eax, dword [0x1023f180]
xor eax, dword [0x1023f17c]
mov ecx, dword [ebp + 8]
push 0
push 0
push dword [ebp + 0x10]
mov dword [eax + 0x50], ecx
push 0x100776d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x100791d0
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc