joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004456
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x7478
call fcn.1006e430
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x100c47a0]
push edi
lea eax, [esi + 1]
imul eax, esi
push 3
cdq
pop ecx
idiv ecx
xor ebx, ebx
cmp edx, 1
jne 0x100044f1
xor eax, eax
push 0x6cc6
mov word [ebp - 0x6cd8], ax
lea eax, [ebp - 0x6cd6]
push ebx
push eax
call fcn.1006de50
add esp, 0xc
mov edi, ebx
mov esi, ebx
mov edx, ebx
test edi, edi
je 0x100044d5
test edx, edx
je 0x100044d5
lea eax, [esi + edx]
lea ecx, [esi + edx]
mov ax, word [ebp + eax*2 - 0x6dc4]
inc ax
add ax, word [ebp + ecx*2 - 0x6cda]
mov word [ebp + ecx*2 - 0x6cd8], ax
inc edx
cmp edx, 0x76
jl 0x100044ad
add esi, 0x76
inc edi
cmp esi, 0x3664
jl 0x100044ab
movsx esi, word [ebp - 0x12]
mov dword [0x100c47a0], esi
cmp byte [0x100c4e38], bl
jne 0x100045a4
mov dword [ebp - 0x10], 0x1040f38
mov dword [ebp - 0xc], 0x201182d
mov word [ebp - 8], 0xa
mov ecx, ebx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be873], al
cmp ecx, 9
jl 0x10004513
mov eax, esi
imul eax, esi
imul eax, esi
push 0x15
cdq
pop ecx
idiv ecx
cmp edx, 2
jne 0x1000459d
mov esi, ebx
mov edi, 0xf4
call fcn.1006daf8
movd xmm0, eax
cvtdq2pd xmm0, xmm0
inc esi
movsd qword [ebp + esi*8 - 0x7480], xmm0
cmp esi, edi
jb 0x10004543
mov ecx, 0xf3
mov eax, ecx
cmp ebx, ecx
jge 0x10004598
movsd xmm0, qword [ebp + eax*8 - 0x7478]
movsd xmm1, qword [ebp + eax*8 - 0x7480]
comisd xmm0, xmm1
jbe 0x10004593
movsd qword [ebp + eax*8 - 0x7478], xmm1
movsd qword [ebp + eax*8 - 0x7480], xmm0
dec eax
cmp eax, ebx
jg 0x10004569
inc ebx
cmp ebx, edi
jl 0x10004563
mov byte [0x100c4e38], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 0x100be874
pop ebx
call fcn.1006d48b
leave
ret

Function at 0x100045b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10003ebe
test al, al
jne 0x100045fe
mov eax, dword [0x100c47a0]
push 0x64
cdq
pop ecx
idiv ecx
xor ecx, ecx
push 4
lea eax, [edx + 0x2f4]
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1006c443
push eax
call fcn.1006dc4d
pop ecx
pop ecx
cmp byte [0x100c4e3d], 0
jne 0x10004637
xor ecx, ecx
mov dword [ebp - 0x10], 0x11050e38
mov dword [ebp - 0xc], 0x1f0d0620
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be8b3], al
cmp ecx, 8
jl 0x1000461a
mov byte [0x100c4e3d], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be8b4
call fcn.1006d48b
leave
ret
Function at 0x10004648
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e10], 0
jne 0x10004697
xor ecx, ecx
mov dword [ebp - 0x10], 0x80f1624
mov dword [ebp - 0xc], 0x51c0d20
mov word [ebp - 8], 0x1a0e
mov byte [ebp - 6], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be643], al
cmp ecx, 0xa
jl 0x1000467a
mov byte [0x100c4e10], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be644
call fcn.1006d48b
leave
ret

Function at 0x100046a8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e42], 0
jne 0x100046f7
xor ecx, ecx
mov dword [ebp - 0x10], 0xa050928
mov dword [ebp - 0xc], 0x51c0d20
mov word [ebp - 8], 0x1a0e
mov byte [ebp - 6], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be8e3], al
cmp ecx, 0xa
jl 0x100046da
mov byte [0x100c4e42], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be8e4
call fcn.1006d48b
leave
ret

Function at 0x10004708
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.10003ebe
test al, al
jne 0x10004743
mov ecx, dword [0x100c47a0]
xor esi, esi
inc esi
cmp ecx, esi
jle 0x1000473b
mov eax, ecx
cdq
idiv esi
inc esi
add esi, edx
cmp esi, ecx
jl 0x1000472f
mov dword [0x100c47a0], esi
jmp 0x10004749
mov esi, dword [0x100c47a0]
cmp byte [0x100c4df3], 0
jne 0x100047f4
lea ecx, [esi + 2]
lea eax, [esi + 1]
imul eax, ecx
imul eax, esi
push ebx
push 0xe
cdq
pop ecx
idiv ecx
xor ebx, ebx
cmp edx, 0xc
jne 0x100047c1
jmp 0x100047bd
mov ecx, esi
and ecx, 0x80000001
jns 0x10004781
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x1000478e
mov eax, esi
cdq
sub eax, edx
mov esi, eax
sar esi, 1
jmp 0x10004795
lea esi, [esi*2 + 1]
mov eax, esi
push 3
cdq
pop ecx
idiv ecx
mov dword [0x100c47a0], esi
sub edx, ebx
je 0x100047b0
dec edx
dec edx
je 0x100047b3
dec edx
je 0x100047b4
jmp 0x100047bd
add esi, 2
inc esi
add esi, 2
mov dword [0x100c47a0], esi
test esi, esi
jne 0x10004772
mov dword [ebp - 0x10], 0x1519073b
mov dword [ebp - 0xc], 0x9072241
mov dword [ebp - 8], 0x1b0c1a
mov al, byte [ebx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ebx - 0x10]
inc ebx
mov byte [ebx + 0x100be4cf], al
cmp ebx, 0xb
jl 0x100047d6
mov byte [0x100c4df3], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be4d0
pop esi
call fcn.1006d48b
leave
ret
Function at 0x10004806
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e3a], 0
jne 0x1000484f
xor ecx, ecx
mov dword [ebp - 0x10], 0x1519073b
mov dword [ebp - 0xc], 0x1b011c3f
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be88b], al
cmp ecx, 8
jl 0x10004832
mov byte [0x100c4e3a], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be88c
call fcn.1006d48b
leave
ret

Function at 0x10004860
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4ded], 0
jne 0x100048af
xor ecx, ecx
mov dword [ebp - 0x10], 0x1519073b
mov dword [ebp - 0xc], 0xb0a1d3b
mov word [ebp - 8], 0x1d08
mov byte [ebp - 6], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be47f], al
cmp ecx, 0xa
jl 0x10004892
mov byte [0x100c4ded], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be480
call fcn.1006d48b
leave
ret

Function at 0x100048c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e17], 0
jne 0x10004910
xor ecx, ecx
mov dword [ebp - 0x14], 0x1519073b
mov dword [ebp - 0x10], 0xd141d3b
mov dword [ebp - 0xc], 0x52440d1f
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100be6ab], al
cmp ecx, 0xc
jl 0x100048f3
mov byte [0x100c4e17], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be6ac
call fcn.1006d48b
leave
ret

Function at 0x10004921
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10003e54
test al, al
jne 0x10004967
mov eax, dword [0x100c47a0]
push 0x64
cdq
pop ecx
idiv ecx
xor ecx, ecx
push 4
lea eax, [edx + 0x2f4]
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1006c443
push eax
call fcn.1006dc4d
pop ecx
pop ecx
cmp byte [0x100c4e1a], 0
jne 0x100049a7
xor ecx, ecx
mov dword [ebp - 0x14], 0x1519073b
mov dword [ebp - 0x10], 0xd141d3b
mov dword [ebp - 0xc], 0x51440d1f
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100be6d7], al
cmp ecx, 0xc
jl 0x1000498a
mov byte [0x100c4e1a], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be6d8
call fcn.1006d48b
leave
ret
Function at 0x100049b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e19], 0
jne 0x10004a08
xor ecx, ecx
mov dword [ebp - 0x14], 0x1519073b
mov dword [ebp - 0x10], 0xd141d3b
mov dword [ebp - 0xc], 0x50440d1f
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x14]
inc ecx
mov byte [ecx + 0x100be6c7], al
cmp ecx, 0xc
jl 0x100049eb
mov byte [0x100c4e19], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be6c8
call fcn.1006d48b
leave
ret

Function at 0x10004a19
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10003ebe
xor ecx, ecx
test al, al
jne 0x10004ac4
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 0x100], eax
lea esi, [ebp - 0xfc]
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x104], esi
mov esi, dword [0x100c47a0]
lea ebx, [ecx + 1]
lea ecx, [eax + 1]
mov eax, esi
cdq
idiv ecx
mov eax, esi
mov ecx, esi
sub ecx, dword [ebp - 0x100]
mov esi, dword [ebp - 0x104]
mov edi, edx
cdq
imul edi, ecx
idiv ebx
add edi, eax
sub edi, dword [ebp - 0x108]
push edi
push 0x1008ac0c
call fcn.1006dc67
mov eax, dword [ebp - 0x100]
pop ecx
pop ecx
mov ecx, ebx
add esi, 4
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x104], esi
cmp ecx, 0x13
jl 0x10004a58
inc eax
push 0
mov dword [ebp - 0x100], eax
pop ecx
cmp eax, 3
jl 0x10004a4c
pop edi
pop esi
pop ebx
cmp byte [0x100c4de2], 0
jne 0x10004b0f
mov dword [ebp - 0x18], 0x1519073b
mov dword [ebp - 0x14], 0x81c1b1b
mov dword [ebp - 0x10], 0x101a2840
mov dword [ebp - 0xc], 0x71b101b
mov word [ebp - 8], 0x1a08
mov byte [ebp - 6], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x18]
inc ecx
mov byte [ecx + 0x100be3eb], al
cmp ecx, 0x12
jl 0x10004af2
mov byte [0x100c4de2], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be3ec
call fcn.1006d48b
leave
ret
Function at 0x10004b20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e24], 0
jne 0x10004bb2
push esi
mov esi, dword [0x100c47a0]
mov eax, esi
imul eax, esi
imul eax, esi
push 0x13
cdq
pop ecx
idiv ecx
cmp edx, 0xa
jne 0x10004b61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [0x100c47a0], esi
mov dword [ebp - 0x10], 0x1f0b0a3b
mov dword [ebp - 0xc], 0x51c0d20
mov word [ebp - 8], 0x1a0e
mov byte [ebp - 6], 0
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be763], al
cmp ecx, 0xa
jl 0x10004b7b
lea eax, [esi + 1]
imul eax, esi
push 0x14
cdq
pop ecx
idiv ecx
pop esi
cmp edx, 8
jne 0x10004bab
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov byte [0x100c4e24], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be764
call fcn.1006d48b
leave
ret

Function at 0x10004bc3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4de6], 0
jne 0x10004c10
mov dword [ebp - 0x10], 0x1f0b0a3b
mov dword [ebp - 0xc], 0x1e173833
mov dword [ebp - 8], 0x1a0a04
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be427], al
cmp ecx, 0xb
jl 0x10004bf3
mov byte [0x100c4de6], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be428
call fcn.1006d48b
leave
ret

Function at 0x10004c21
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
call fcn.10003e96
xor ebx, ebx
test al, al
jne 0x10004c52
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp byte [0x100c4e13], bl
jne 0x10004cbf
mov dword [ebp - 0x14], 0x2b470339
mov dword [ebp - 0x10], 0xd05060d
mov dword [ebp - 0xc], 0x4e0c050f
mov word [ebp - 8], 0x41
mov al, byte [ebx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ebx - 0x14]
inc ebx
mov byte [ebx + 0x100be66f], al
cmp ebx, 0xd
jl 0x10004c75
mov edx, dword [0x100c47a0]
push 0x16
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
pop ecx
idiv ecx
mov eax, dword [0x100c4a24]
mov ecx, 0xcef95930
mov byte [0x100c4e13], 1
cmp edx, 8
cmove eax, ecx
mov dword [0x100c4a24], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be670
pop ebx
call fcn.1006d48b
leave
ret
Function at 0x10004cd1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e07], 0
jne 0x10004d91
mov dword [ebp - 0x10], 0x1f263c2e
mov dword [ebp - 0xc], 0x1f0d1d1e
mov byte [ebp - 8], 0
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be5cf], al
cmp ecx, 8
jl 0x10004d02
push esi
mov esi, dword [0x100c47a0]
push 0x15
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
pop ecx
idiv ecx
mov byte [0x100c4e07], 1
cmp edx, 1
jne 0x10004d90
mov eax, esi
push ebx
push edi
cdq
sub eax, edx
push 0x5d
mov edi, eax
xor ecx, ecx
pop ebx
sar edi, 1
test edi, edi
jle 0x10004d89
mov eax, esi
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [ebp - 0x18], eax
xor edx, edx
mov esi, edi
mov dword [ebp - 0x14], edi
test eax, eax
jle 0x10004d7b
mov esi, dword [ebp - 0x18]
mov eax, edx
add ebx, eax
dec eax
dec esi
jne 0x10004d6f
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
add edx, ecx
dec esi
mov dword [ebp - 0x14], esi
jne 0x10004d66
mov esi, dword [0x100c47a0]
inc ecx
cmp ecx, ebx
jl 0x10004d4d
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be5d0
call fcn.1006d48b
leave
ret

Function at 0x10004da2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e0f], 0
jne 0x10004def
mov dword [ebp - 0x10], 0x2b350339
mov dword [ebp - 0xc], 0xd05060d
mov dword [ebp - 8], 0xc050f
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be637], al
cmp ecx, 0xb
jl 0x10004dd2
mov byte [0x100c4e0f], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be638
call fcn.1006d48b
leave
ret

Function at 0x10004e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dcb], 0
jne 0x10004e62
push ebx
call fcn.10003ebe
xor ebx, ebx
test al, al
jne 0x10004e30
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov dword [ebp - 0x10], 0xb350339
mov dword [ebp - 0xc], 0x505060d
mov word [ebp - 8], 0x19
mov al, byte [ebx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ebx - 0x10]
inc ebx
mov byte [ebx + 0x100be2bb], al
cmp ebx, 9
jl 0x10004e44
mov byte [0x100c4dcb], 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be2bc
call fcn.1006d48b
leave
ret
Function at 0x10004e73
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e0a], 0
jne 0x10004ec2
xor ecx, ecx
mov dword [ebp - 0x10], 0x31c0738
mov dword [ebp - 0xc], 0x193a0d21
mov word [ebp - 8], 0xc0f
mov byte [ebp - 6], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be5f7], al
cmp ecx, 0xa
jl 0x10004ea5
mov byte [0x100c4e0a], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be5f8
call fcn.1006d48b
leave
ret

Function at 0x10004ed3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x100c47a0]
mov eax, esi
imul eax, esi
and eax, 0x8000000f
jns 0x10004efb
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 2
jne 0x10004f0d
call fcn.1006daf8
mov esi, eax
mov dword [0x100c47a0], esi
call fcn.10003d9b
test al, al
jne 0x10004f31
xor ecx, ecx
inc ecx
cmp esi, ecx
jle 0x10004f29
mov eax, esi
cdq
idiv ecx
inc ecx
add ecx, edx
cmp ecx, esi
jl 0x10004f1d
mov esi, ecx
mov dword [0x100c47a0], esi
mov eax, esi
imul eax, esi
imul eax, esi
and eax, 0x8000000f
jns 0x10004f45
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 2
jne 0x10004f95
movsd xmm3, qword [0x1008ac28]
movd xmm4, esi
xorps xmm2, xmm2
cvtdq2pd xmm4, xmm4
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x10004f7b
subsd xmm2, xmm3
divsd xmm3, qword [0x1008ac40]
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmmword [0x1008ac20]
ja 0x10004f5d
cmp byte [0x100c4dd0], 0
jne 0x10004fef
mov dword [ebp - 0x10], 0x3060338
mov dword [ebp - 0xc], 0x2243000f
xor ecx, ecx
mov dword [ebp - 8], 0x62e40
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be303], al
cmp ecx, 0xb
jl 0x10004fb5
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
push 0xc
cdq
pop ecx
idiv ecx
mov byte [0x100c4dd0], 1
cmp edx, 3
jne 0x10004fef
dec dword [0x100c4984]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be304
pop esi
call fcn.1006d48b
leave
ret
Function at 0x10005001
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4e3c], 0
jne 0x10005072
xor ecx, ecx
mov dword [ebp - 0x10], 0x3060338
mov dword [ebp - 0xc], 0x1827000f
mov byte [ebp - 8], cl
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be8a7], al
cmp ecx, 8
jl 0x1000502d
mov ecx, dword [0x100c47a0]
push 0x12
lea eax, [ecx + 1]
imul eax, ecx
cdq
pop ecx
idiv ecx
cmp edx, 0xa
jne 0x1000506b
push 0x42
push 0x41
push str._d__d_n
call fcn.1006dc67
add esp, 0xc
mov byte [0x100c4e3c], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be8a8
call fcn.1006d48b
leave
ret

Function at 0x10005083
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dd8], 0
jne 0x100050c9
mov dword [ebp - 0xc], 0x14050e38
xor ecx, ecx
mov dword [ebp - 8], 0x51500
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0xc]
inc ecx
mov byte [ecx + 0x100be373], al
cmp ecx, 7
jl 0x100050ac
mov byte [0x100c4dd8], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be374
call fcn.1006d48b
leave
ret

Function at 0x100050da
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dc4], 0
jne 0x10005127
mov dword [ebp - 0x10], 0x13050e38
mov dword [ebp - 0xc], 0x1e173818
mov dword [ebp - 8], 0x1a0a04
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be257], al
cmp ecx, 0xb
jl 0x1000510a
mov byte [0x100c4dc4], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be258
call fcn.1006d48b
leave
ret

Function at 0x10005138
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100c3360]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100c4dc3], 0
jne 0x10005184
mov dword [ebp - 0x10], 0x11050e38
mov dword [ebp - 0xc], 0xf1c3841
mov word [ebp - 8], 0x1e
xor ecx, ecx
mov al, byte [ecx + str.kfjfltnlmiicrcoffndjtsngorrapribqrirnkdkfhrurmlieganlsbcicpbeiornqcibnqrtkqtiikhaekasuciflcjnkfmkftr8]
xor al, byte [ebp + ecx - 0x10]
inc ecx
mov byte [ecx + 0x100be24b], al
cmp ecx, 9
jl 0x10005167
mov byte [0x100c4dc3], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x100be24c
call fcn.1006d48b
leave
ret