joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422678
Capabilities:
Hash data using murmur3

Disassembly:
add dword [0x4ba940], edx
dec ecx
or dword [0x4ba92b], ecx
mov dword [0x4ba8a7], edx
not esi
xor dword [0x4baaf3], 0xefc834db
and dword [0x4ba811], 0x3a524e3d
or edx, dword [0x4badf1]
rol ecx, 0x14
call fcn.0046e560
ror eax, 0xc
inc edi
call fcn.004308dd
neg esi
call fcn.00451f28
call fcn.0046c791
call fcn.0043a840
neg esi
call fcn.00452fbc
dec edi
rol eax, 0xc
call fcn.00405db5
ror ecx, 0x14
xor dword [0x4babb2], 0x802d5957
dec ebx
add byte [edi + 0x59], dl
sub eax, 0x5258180
test al, 0x4b
add bl, dh
pop eax
xchg sp, ax
not esi
sub dword [0x4ba964], esi
or dword [0x4ba849], ebx
inc ecx
call fcn.00403a3a
ror edx, 0x14
push ecx
ror edx, 0x14
mov dword [0x4babc4], edx
call fcn.00408203
xor ecx, esi
neg esi
ror edx, 9
dec edi
not edx
sub edx, dword [0x4badf3]
call fcn.004307bf
not edx
inc edi
rol edx, 9
neg esi
xor ecx, esi
and dword [0x4ba934], esi
rol edx, 0x14
mov eax, 0xa8c06ffd
sub edx, ebx
add esi, edx
xor eax, ebp
add edx, dword [0x4bae68]
sub ebx, 0x7d2600a2
and dword [0x4baa4c], ecx
xor eax, 0x7336cdcb
inc ecx
add edx, dword [0x4bae3c]
add ebx, 0xd5fd3e2e
call fcn.0044c310
call fcn.004491b1
sub ebx, 0xd5fd3e2e
dec ecx
xor eax, 0x7336cdcb
sub dword [0x4babdc], eax
add ebx, 0x7d2600a2
xor eax, ebp
sub esi, edx
add edx, ebx
xor eax, 0x798a290c
sub dword [0x4ba84b], edx
rol edi, 0x16
add dword [0x4ba8b4], ebx
xchg ebx, esi
or edx, dword [0x4badc8]
sub ebx, 0x950e19f0
add edx, esi
call fcn.0040376f
sub ebx, dword [0x4bad3d]
rol esi, 0xb
xchg edi, eax
mov dword [0x4ba96d], edi
xchg edx, eax
or edx, dword [0x4baea0]
neg ecx
inc edx
xchg ecx, esi
xchg ecx, esi
dec edx
neg ecx
xchg edx, eax
add dword [0x4ba89e], ecx
xchg edi, eax
ror esi, 0xb
sub edx, esi
add ebx, 0x950e19f0
xchg ebx, esi
ror edi, 0x16
mov dword [0x4ba8be], ebx
add eax, 0x2f21b974
not esi
dec ebx
xor ebx, 0xa9797029
xchg eax, edx
xor ebx, esi
add dword [0x4bab75], 0xa7f4b8f8
sub edx, esi
dec ecx
neg eax
call fcn.0043ba2f
xor esi, dword [0x4baf30]
xor dword [0x4ba952], ecx
not ecx
call fcn.0048c6e7
not ecx
mov dword [0x4bab72], 0x17d2454a
not ecx
call fcn.00490d64
not ecx
call fcn.00463c4c
neg eax
inc ecx
add edx, esi
xor dword [0x4ba813], 0xad025ffa
xor ebx, esi
xchg eax, edx
xor ebx, 0xa9797029
inc ebx
not esi
push eax
xor ecx, dword [0x4baecb]
xor edi, 0xc186238f
dec esi
add ebx, 0x5fdb90c1
sub dword [0x4ba82b], 0xa790103a
dec edx
xor edi, dword [0x4baca9]
sub ecx, dword [0x4baebd]
dec eax
and dword [0x4ba94a], ebx
dec edx
xor edi, dword [0x4bad19]
call 0x42401e
inc esi
xchg esi, edx
call fcn.00451ad7
add dword [0x4ba804], 0x13e550d9
add al, 0xa8
dec ebx
add cl, bl
push eax
in eax, 0x13
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x424019
mov eax, dword [ebx]
call fcn.00423df4
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4228bc
Capabilities:
Hash data using murmur3

Disassembly:
add al, 0xa8
dec ebx
add cl, bl
push eax
in eax, 0x13
mov dword [0x4ba84a], 0xd99905a2
call fcn.004146d0
xchg esi, edx
dec esi
inc edx
add dword [0x4baa7e], ebx
inc eax
inc edx
add dword [0x4baa1e], 0xd3fa9026
sub ebx, 0x5fdb90c1
inc esi
xor edi, 0xc186238f
mov ecx, 0xfbc87ce2
inc ecx
or ecx, dword [0x4bac78]
sub ebx, ecx
ror ebx, 0x10
neg eax
ror esi, 0x1a
dec esi
xor eax, dword [0x4bad2f]
dec ecx
xchg esi, eax
sub dword [0x4baa5b], ecx
call fcn.004598ee
call fcn.0046d036
mov dword [0x4baa8f], ebx
xchg esi, eax
inc ecx
inc esi
rol esi, 0x1a
neg eax
rol ebx, 0x10
add ebx, ecx
dec ecx
or ecx, 0x81060b47
dec edx
neg eax
xor esi, ebp
ror edi, 0x19
or esi, dword [0x4baef8]
add ecx, dword [0x4baca3]
sub eax, ecx
call fcn.004063de
rol ecx, 8
xor edx, ebx
neg ecx
inc ecx
call fcn.004195b2
call fcn.0045adee
add eax, dword [eax]
dec ecx
neg ecx
xor edx, ebx
ror ecx, 8
call fcn.00443a42
add eax, ecx
rol edi, 0x19
xor esi, ebp
neg eax
inc edx
add ecx, 0x49f808b
dec edx
xor edx, dword [0x4bae12]
not ecx
rol ecx, 0x12
add dword [0x4ba834], 0x146dd5f2
sub ecx, ebp
sub edi, dword [0x4bae78]
call fcn.004085d8
add ecx, edx
inc edi
xor edx, ecx
add dword [0x4ba8e5], ebx
add byte [ecx - 0x4b493910], al
add esi, dword [ecx]
sbb eax, 0x4baa85
sub esi, edx
call fcn.00432a97
neg ebx
sub edx, 0xf2bd0d50
ror edx, 0x12
invalid

Function at 0x4229b8
Capabilities:
Hash data using murmur3

Disassembly:
add al, 0xa8
dec ebx
add cl, bl
push eax
in eax, 0x13
mov dword [0x4ba84a], 0xd99905a2
call fcn.004146d0
xchg esi, edx
dec esi
inc edx
add dword [0x4baa7e], ebx
inc eax
inc edx
add dword [0x4baa1e], 0xd3fa9026
sub ebx, 0x5fdb90c1
inc esi
xor edi, 0xc186238f
mov ecx, 0xfbc87ce2
inc ecx
or ecx, dword [0x4bac78]
sub ebx, ecx
ror ebx, 0x10
neg eax
ror esi, 0x1a
dec esi
xor eax, dword [0x4bad2f]
dec ecx
xchg esi, eax
sub dword [0x4baa5b], ecx
call fcn.004598ee
call fcn.0046d036
mov dword [0x4baa8f], ebx
xchg esi, eax
inc ecx
inc esi
rol esi, 0x1a
neg eax
rol ebx, 0x10
add ebx, ecx
dec ecx
or ecx, 0x81060b47
dec edx
neg eax
xor esi, ebp
ror edi, 0x19
or esi, dword [0x4baef8]
add ecx, dword [0x4baca3]
sub eax, ecx
call fcn.004063de
rol ecx, 8
xor edx, ebx
neg ecx
inc ecx
call fcn.004195b2
call fcn.0045adee
add eax, dword [eax]
dec ecx
neg ecx
xor edx, ebx
ror ecx, 8
call fcn.00443a42
add eax, ecx
rol edi, 0x19
xor esi, ebp
neg eax
inc edx
add ecx, 0x49f808b
dec edx
xor edx, dword [0x4bae12]
not ecx
rol ecx, 0x12
add dword [0x4ba834], 0x146dd5f2
sub ecx, ebp
sub edi, dword [0x4bae78]
call fcn.004085d8
add ecx, edx
inc edi
xor edx, ecx
add dword [0x4ba8e5], ebx
add byte [ecx - 0x4b493910], al
add esi, dword [ecx]
sbb eax, 0x4baa85
sub esi, edx
call fcn.00432a97
neg ebx
sub edx, 0xf2bd0d50
ror edx, 0x12
invalid

Function at 0x4229d8
Capabilities:
Hash data using murmur3

Disassembly:
sbb dword [bp + di], eax
add al, ch
push 0xe800030d
jno 0x422a43
pop es
add cl, al
ret 0x8112
sal dword [ebx], cl
or eax, 0x4bafb2
Function at 0x422c40
Capabilities:
Hash data using murmur3

Disassembly:
xor esi, dword [0x4bac57]
dec esi
or edx, dword [0x4bac67]
xor ecx, dword [0x4bac21]
add ecx, 0x7fa03ab
sub ecx, 0xb1a58d73
xor esi, edi
or dword [0x4ba82d], ebx
call fcn.0048ea9f
call fcn.00425b3e
mov dword [0x4baa1a], edx
xor esi, edi
add ecx, 0xb1a58d73
sub ecx, 0x7fa03ab
inc esi
rol edi, 0xb
xor ecx, esi
ror edx, 0x1f
dec esi
inc ebx
add eax, 0x2b7323ea
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
neg esi
invalid
invalid

Function at 0x422da4
Capabilities:
Hash data using murmur3

Disassembly:
dec ebx
sub edx, ecx
mov dword [0x4bab5d], edi
sub ecx, 0x8c3cd106
not esi
sub ebx, 0x8fcce1ea
xor edx, ebx
call fcn.004a17ae
xchg esi, eax
and dword [0x4ba8d9], edx
mov edi, 0xdf9cb815
sub ecx, esi
into
Function at 0x422dd0
Capabilities:
Hash data using murmur3

Disassembly:
into
not edi
xor dword [0x4baa30], eax
inc ecx
call fcn.00435ad3
mov dword [0x4ba9cf], ebx
xor ecx, dword [0x4bac00]
dec ebx
add ebx, ebp
not esi
call fcn.004195b2
not esi
sub ebx, ebp
inc ebx
xor dword [0x4ba90d], ebx
dec ecx
sub dword [0x4ba916], edx
not edi
add ecx, esi
xor edi, 0xf28bcd6a
sub edx, 0x6bee26a5
or dword [0x4ba868], edi
xor ecx, dword [0x4baf1f]
dec eax
and dword [0x4ba899], 0x6c983ec5
rol ebx, 2
add eax, dword [0x4baf4a]
inc ecx
neg ebx
call fcn.00426f81
sub eax, ebx
neg esi
xor ebx, 0x3347512c
neg edx
call fcn.004848aa
call fcn.0048de79
neg edx
xor ebx, 0x3347512c
neg esi
add eax, ebx
neg ebx
dec ecx
ror ebx, 2
mov dword [0x4bab7c], 0xace4c25e
inc eax
add dword [0x4ba8ee], eax
add edx, 0x6bee26a5
sub edi, 0x2d17757f
xor edi, eax
call fcn.00456575
sub esi, ecx
xor esi, edx
add edx, dword [0x4badb3]
xor eax, 0x748f7d04
or esi, dword [0x4bae95]
inc edx
add dword [0x4ba802], edx
mov dword [0x4baa19], eax
inc edi
xor eax, ebx
add ecx, edx
xor eax, dword [0x4bad54]
or eax, dword [0x4bad2e]
dec esi
call fcn.00463c4c
dec ecx
neg esi
add eax, 0x50c8e9b7
call fcn.0047b843
sub eax, 0x50c8e9b7
neg esi
inc ecx
call fcn.00425a6e
inc esi
sub ecx, edx
xor eax, ebx
dec edi
dec edx
xor eax, 0x748f7d04
xor esi, edx
add esi, ecx
xor edi, eax
push edi
xchg edx, eax
call fcn.0048d4d5
neg edi
add edi, dword [0x4bad2a]
ror ebx, 0x13
or ebx, dword [0x4bad79]
call fcn.0044e7d0
ror eax, 0x13
sub edx, dword [0x4bacb1]
inc edi
call fcn.00463c4c
xor esi, edi
xor ecx, 0x8322e9e7
or edi, dword [0x4baec5]
add ecx, dword [0x4baca2]
xor ecx, 0x8322e9e7
xor esi, edi
dec edi
rol eax, 0x13
rol ebx, 0x13
neg edi
call fcn.0041d4b1
xchg edx, eax
mov edx, 0xcf64fdd9
not edx
xor ecx, eax
not esi
or ebx, dword [0x4bacf9]
call fcn.0042d2c8
xor ebx, dword [0x4baebd]
xor edi, edx
call fcn.0045675a
neg esi
dec ebx
sub edx, dword [0x4bacb3]
and dword [0x4ba8d3], edx
xor dword [0x4ba96e], edi
inc ebx
neg esi
xor edi, edx
not esi
xor ecx, eax
not edx
and edx, 0x1580d732
xor ebx, dword [0x4baeb2]
add dword [0x4ba9f1], ebx
dec eax
ror esi, 1
sub ecx, 0x16ca9c65
xor edi, dword [0x4baca0]
rol edi, 0x1a
add dword [0x4ba941], edi
xor edi, dword [0x4bae70]
and dword [0x4bab91], edx
neg ecx
add esi, dword [0x4baee2]
or edx, dword [0x4bad77]
or dword [0x4ba9cf], edx
not edx
dec eax
xchg ecx, eax
ror esi, 0x17
call fcn.0048db59
sub edx, 0xc827c9e6
call fcn.00463c4c
call fcn.0048cbbf
add edx, 0xc827c9e6
call fcn.00451ad7
rol esi, 0x17
xchg ecx, eax
inc eax
not edx
neg ecx
add dword [0x4baa4a], esi
mov dword [0x4ba9ac], esi
ror edi, 0x1a
add ecx, 0x16ca9c65
rol esi, 1
inc eax
xor edx, 0x666fb97c
dec ebx
xor esi, ebx
or dword [0x4baa97], edx
dec ecx
sub edi, dword [0x4badfe]
add edi, dword [0x4baded]
sub esi, 0xf0958355
add edx, dword [0x4baedc]
rol ebx, 1
xor edx, ecx
call fcn.0049e055
inc ebx
add esi, 0xb7bc1643
call fcn.00463c4c
xor ebx, dword [0x4baeb2]
add ecx, esi
xor ecx, 0xf85b466c
call fcn.00451d04
xor ecx, 0xd1638cf9
ror dword [ecx + 0x4ba86015], 1
add byte [ecx], ch
adc eax, 0x4baa9d

Function at 0x423164
Capabilities:
Hash data using murmur3

Disassembly:
xchg byte [0x81dbf700], al
ret 0xea82
Function at 0x423434
Capabilities:
Hash data using murmur3

Disassembly:
shr al, 1
inc edx
je 0x42343f
add byte [ebx], dh
enter 0x4857, 0xffffffffffffff81
imul byte [ebp + 0x7f]
fisubr dword [ebx + 0x3108c2c1]
xor eax, 0x4baaed

Function at 0x4246e4
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x4c090c
mov eax, esi
mov edx, 8
test al, 1
je 0x424700
shr eax, 1
xor eax, 0xedb88320
jmp 0x424702
shr eax, 1
dec edx
jne 0x4246f3
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4246ec
pop esi
ret

Function at 0x424718
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x4c0908], 0
jne 0x424742
call fcn.004246e4
mov dword [esp], 0x4c0908
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x42476c
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x4c090c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x424748
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x42729c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00427250
test al, al
jne 0x4272bd
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x427309
xor eax, eax
push ebp
push 0x4272f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004084ec
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427300
lea eax, [ebp - 0xc]
call fcn.0042728c
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x467584
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x46758c
mov eax, edx
pop esi
pop ebx
ret

Function at 0x497a9c
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x497aea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.00497560
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x497b03
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4af4d8
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
call fcn.0041ff44
cmp eax, 2
jne 0x4af540
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x4af4fb
xor eax, eax
jmp 0x4af54f
lea eax, [esp + 8]
push eax
push 0x4af554
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x4af540
xor eax, eax
jmp 0x4af54f
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret

Function at 0x4af57c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4af5d6
inc esi
xor edi, edi
cmp edi, 1
jne 0x4af5a2
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4af5b0
cmp edi, 1
jle 0x4af5b0
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0042729c
test eax, eax
jne 0x4af5d6
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x4af5d6
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x4af5d6
inc edi
dec esi
jne 0x4af592
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4af5e0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW
test eax, eax
jle 0x4af604
mov eax, dword [ebp - 4]
jmp 0x4af607
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret
Function at 0x1000a47f
Capabilities:
Encode data using xor

Disassembly:
push esi
push 6
mov esi, ecx
call fcn.1000c515
mov dword [esi], eax
pop ecx
xor eax, eax
mov ecx, dword [esp + 8]
mov cx, word [eax + ecx]
xor cx, word [esp + 0xc]
mov edx, dword [esi]
mov word [eax + edx], cx
inc eax
inc eax
cmp eax, 4
jb 0x1000a48e
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 4], cx
mov eax, esi
pop esi
ret 8

Function at 0x1000a4e0
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0xa
mov esi, ecx
call fcn.1000c515
mov dword [esi], eax
pop ecx
xor eax, eax
mov ecx, dword [esp + 8]
mov cx, word [eax + ecx]
xor cx, word [esp + 0xc]
mov edx, dword [esi]
mov word [eax + edx], cx
inc eax
inc eax
cmp eax, 8
jb 0x1000a4ef
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 8], cx
mov eax, esi
pop esi
ret 8

Function at 0x1000a517
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0xe
mov esi, ecx
call fcn.1000c515
mov dword [esi], eax
pop ecx
xor eax, eax
mov ecx, dword [esp + 8]
mov cx, word [eax + ecx]
xor cx, word [esp + 0xc]
mov edx, dword [esi]
mov word [eax + edx], cx
inc eax
inc eax
cmp eax, 0xc
jb 0x1000a526
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0xc], cx
mov eax, esi
pop esi
ret 8

Function at 0x1000a54e
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x28
mov esi, ecx
call fcn.1000c515
mov dword [esi], eax
pop ecx
xor eax, eax
mov ecx, dword [esp + 8]
mov cl, byte [eax + ecx]
xor cl, byte [esp + 0xc]
mov edx, dword [esi]
mov byte [eax + edx], cl
inc eax
cmp eax, 0x27
jb 0x1000a55d
mov eax, dword [esi]
mov byte [eax + 0x27], 0
mov eax, esi
pop esi
ret 8

Function at 0x1000a5b6
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x10
mov esi, ecx
call fcn.1000c515
mov dword [esi], eax
pop ecx
xor eax, eax
mov ecx, dword [esp + 8]
mov cx, word [eax + ecx]
xor cx, word [esp + 0xc]
mov edx, dword [esi]
mov word [eax + edx], cx
inc eax
inc eax
cmp eax, 0xe
jb 0x1000a5c5
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0xe], cx
mov eax, esi
pop esi
ret 8

Function at 0x1000a5ed
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x1e
mov esi, ecx
call fcn.1000c515
mov dword [esi], eax
pop ecx
xor eax, eax
mov ecx, dword [esp + 8]
mov cx, word [eax + ecx]
xor cx, word [esp + 0xc]
mov edx, dword [esi]
mov word [eax + edx], cx
inc eax
inc eax
cmp eax, 0x1c
jb 0x1000a5fc
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x1c], cx
mov eax, esi
pop esi
ret 8

Function at 0x1000a6fd
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x20
mov esi, ecx
call fcn.1000c515
mov dword [esi], eax
pop ecx
xor eax, eax
mov ecx, dword [esp + 8]
mov cx, word [eax + ecx]
xor cx, word [esp + 0xc]
mov edx, dword [esi]
mov word [eax + edx], cx
inc eax
inc eax
cmp eax, 0x1e
jb 0x1000a70c
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x1e], cx
mov eax, esi
pop esi
ret 8
Function at 0x1000a912
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x20
mov esi, ecx
call fcn.1000c515
mov dword [esi], eax
pop ecx
xor eax, eax
mov ecx, dword [esp + 8]
mov cl, byte [eax + ecx]
xor cl, byte [esp + 0xc]
mov edx, dword [esi]
mov byte [eax + edx], cl
inc eax
cmp eax, 0x1f
jb 0x1000a921
mov eax, dword [esi]
mov byte [eax + 0x1f], 0
mov eax, esi
pop esi
ret 8

Function at 0x1000a943
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x15
mov esi, ecx
call fcn.1000c515
mov dword [esi], eax
pop ecx
xor eax, eax
mov ecx, dword [esp + 8]
mov cl, byte [eax + ecx]
xor cl, byte [esp + 0xc]
mov edx, dword [esi]
mov byte [eax + edx], cl
inc eax
cmp eax, 0x14
jb 0x1000a952
mov eax, dword [esi]
mov byte [eax + 0x14], 0
mov eax, esi
pop esi
ret 8

Function at 0x1000a9da
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push 0xd
mov esi, ecx
call fcn.1000c515
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
pop ecx
xor ecx, ecx
mov dword [esi], eax
sub edi, edx
lea eax, [ecx + edx]
mov bl, byte [edi + eax]
xor bl, byte [eax]
mov eax, dword [esi]
mov byte [ecx + eax], bl
inc ecx
cmp ecx, 0xc
jb 0x1000a9f5
mov eax, dword [esi]
pop edi
mov byte [eax + 0xc], 0
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x1000aa16
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push 0x14
mov esi, ecx
call fcn.1000c515
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
pop ecx
xor ecx, ecx
mov dword [esi], eax
sub edi, edx
lea eax, [ecx + edx]
mov bl, byte [edi + eax]
xor bl, byte [eax]
mov eax, dword [esi]
mov byte [ecx + eax], bl
inc ecx
cmp ecx, 0x13
jb 0x1000aa31
mov eax, dword [esi]
pop edi
mov byte [eax + 0x13], 0
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x1000aab3
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x18
mov esi, ecx
call fcn.1000c515
mov dword [esi], eax
pop ecx
xor eax, eax
mov ecx, dword [esp + 8]
mov cx, word [eax + ecx]
xor cx, word [esp + 0xc]
mov edx, dword [esi]
mov word [eax + edx], cx
inc eax
inc eax
cmp eax, 0x16
jb 0x1000aac2
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x16], cx
mov eax, esi
pop esi
ret 8

Function at 0x1000aaea
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push 0xc
mov esi, ecx
call fcn.1000c515
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
pop ecx
xor ecx, ecx
mov dword [esi], eax
sub edi, edx
lea eax, [ecx + edx]
mov bl, byte [edi + eax]
xor bl, byte [eax]
mov eax, dword [esi]
mov byte [ecx + eax], bl
inc ecx
cmp ecx, 0xb
jb 0x1000ab05
mov eax, dword [esi]
pop edi
mov byte [eax + 0xb], 0
mov eax, esi
pop esi
pop ebx
ret 8

Function at 0x1000ab26
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push 8
mov esi, ecx
call fcn.1000c515
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
pop ecx
xor ecx, ecx
mov dword [esi], eax
sub edi, edx
lea eax, [ecx + edx]
mov bl, byte [edi + eax]
xor bl, byte [eax]
mov eax, dword [esi]
mov byte [ecx + eax], bl
inc ecx
cmp ecx, 7
jb 0x1000ab41
mov eax, dword [esi]
pop edi
mov byte [eax + 7], 0
mov eax, esi
pop esi
pop ebx
ret 8
Function at 0x1000ae8e
Capabilities:
Encode data using xor

Disassembly:
push esi
push 8
mov esi, ecx
call fcn.1000c515
mov dword [esi], eax
pop ecx
xor eax, eax
mov ecx, dword [esp + 8]
mov cx, word [eax + ecx]
xor cx, word [esp + 0xc]
mov edx, dword [esi]
mov word [eax + edx], cx
inc eax
inc eax
cmp eax, 6
jb 0x1000ae9d
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 6], cx
mov eax, esi
pop esi
ret 8

Function at 0x1000afa1
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0xc
mov esi, ecx
call fcn.1000c515
mov dword [esi], eax
pop ecx
xor eax, eax
mov ecx, dword [esp + 8]
mov cx, word [eax + ecx]
xor cx, word [esp + 0xc]
mov edx, dword [esi]
mov word [eax + edx], cx
inc eax
inc eax
cmp eax, 0xa
jb 0x1000afb0
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0xa], cx
mov eax, esi
pop esi
ret 8

Function at 0x1000afd8
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x62
mov esi, ecx
call fcn.1000c515
mov dword [esi], eax
pop ecx
xor eax, eax
mov ecx, dword [esp + 8]
mov cx, word [eax + ecx]
xor cx, word [esp + 0xc]
mov edx, dword [esi]
mov word [eax + edx], cx
inc eax
inc eax
cmp eax, 0x60
jb 0x1000afe7
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x60], cx
mov eax, esi
pop esi
ret 8

Function at 0x1000b180
Capabilities:
Encode data using xor

Disassembly:
push esi
push 0x26
mov esi, ecx
call fcn.1000c515
mov dword [esi], eax
pop ecx
xor eax, eax
mov ecx, dword [esp + 8]
mov cx, word [eax + ecx]
xor cx, word [esp + 0xc]
mov edx, dword [esi]
mov word [eax + edx], cx
inc eax
inc eax
cmp eax, 0x24
jb 0x1000b18f
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x24], cx
mov eax, esi
pop esi
ret 8

Function at 0x10016eaf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10058e78]
jne 0x10016eb9
repz ret
jmp fcn.1001bd0c