joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10062940
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x101903b8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102706ec]
movss dword [ebp - 0x34], xmm1
movss dword [ebp - 0x20], xmm0
push ebx
push esi
push edi
test eax, eax
jne 0x10062aab
mov esi, dword [0x10271284]
test esi, esi
jne 0x10062a33
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0x18]
mov dword [ebp - 0x30], ebx
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ecx + ebx + 0x78]
add ecx, ebx
mov dword [ebp - 0x2c], ecx
cmp ecx, ebx
je 0x10062a08
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x10062a08
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, ebx
nop dword [eax]
mov esi, dword [ecx - 4]
sub ecx, 4
add esi, ebx
mov dword [ebp - 0x28], ecx
dec edx
mov edi, 0x6e118dfa
mov dword [ebp - 0x24], edx
mov bl, byte [esi]
inc esi
test bl, bl
je 0x10062a01
nop dword [eax + eax]
movsx edx, bl
lea esi, [esi + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [esi - 1]
cmova ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
test bl, bl
jne 0x100629d0
cmp edi, 0x60ba2d32
je 0x10062a0f
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov ebx, dword [eax + 0x18]
test edx, edx
jne 0x100629b0
mov eax, dword [eax]
jmp 0x10062984
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x30]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov esi, dword [eax + edx]
add esi, edx
mov dword [0x10271284], esi
lea eax, [ebp - 0x1c]
mov ecx, 0x10265128
push eax
call fcn.10052900
cmp dword [ebp - 8], 0x10
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
push dword [0x10270720]
call esi
mov edx, dword [ebp - 8]
mov dword [0x102706ec], eax
cmp edx, 0x10
jb 0x10062a8f
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10062a80
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10062adb
push edx
push ecx
call fcn.100c9f47
mov eax, dword [0x102706ec]
add esp, 8
movss xmm1, dword [ebp - 0x34]
movss xmm0, dword [ebp - 0x20]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
sub esp, 8
mov dword [ebp - 0x20], eax
movss dword [esp + 4], xmm1
movss dword [esp], xmm0
call dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
add esp, 8
fstp dword [ebp - 0x20]
movss xmm0, dword [ebp - 0x20]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100c9808
mov esp, ebp
pop ebp
ret
call fcn.101387cc
int3
Function at 0x10062af0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [0x10265e90], 0
push ebx
push esi
je 0x10062b6b
cmp byte [0x10265e91], 0
jne 0x10062bb9
mov byte [0x10265e91], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10265edc]
xor ebx, dword [0x10265ed8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0xc], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10265e92]
xor al, bl
mov byte [esi + 0x10265e92], al
inc esi
cmp esi, 0x40
jb 0x10062b20
jmp 0x10062bb9
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10265edc]
xor ebx, dword [0x10265ed8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0xc], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10265e92]
xor al, bl
mov byte [esi + 0x10265e92], al
inc esi
cmp esi, 0x40
jb 0x10062b70
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x3f
push 0x10265e92
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.1001f000
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10062bf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x10062c50
cmp byte [esi + 1], 0
jne 0x10062c91
mov byte [esi + 1], 1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + edi + 2], al
inc edi
cmp edi, 0x32
jb 0x10062c13
jmp 0x10062c91
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + edi + 2]
xor al, bl
mov byte [esi + edi + 2], al
inc edi
cmp edi, 0x32
jb 0x10062c52
lea ecx, [esi + 0x33]
lea eax, [esi + 2]
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
cmp eax, ecx
je 0x10062cbc
push 0x31
push eax
mov ecx, esi
call fcn.1001f000
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10062cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x10062d30
cmp byte [esi + 1], 0
jne 0x10062d71
mov byte [esi + 1], 1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + edi + 2], al
inc edi
cmp edi, 0x1b
jb 0x10062cf3
jmp 0x10062d71
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + edi + 2]
xor al, bl
mov byte [esi + edi + 2], al
inc edi
cmp edi, 0x1b
jb 0x10062d32
lea ecx, [esi + 0x1c]
lea eax, [esi + 2]
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
cmp eax, ecx
je 0x10062d9c
push 0x1a
push eax
mov ecx, esi
call fcn.1001f000
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10062db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [0x10266048], 0
push ebx
push esi
je 0x10062e2b
cmp byte [0x10266049], 0
jne 0x10062e79
mov byte [0x10266049], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1026608c]
xor ebx, dword [0x10266088]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0xc], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1026604a]
xor al, bl
mov byte [esi + 0x1026604a], al
inc esi
cmp esi, 0x3e
jb 0x10062de0
jmp 0x10062e79
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1026608c]
xor ebx, dword [0x10266088]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0xc], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1026604a]
xor al, bl
mov byte [esi + 0x1026604a], al
inc esi
cmp esi, 0x3e
jb 0x10062e30
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x3d
push 0x1026604a
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.1001f000
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10062eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [0x10265d78], 0
push ebx
push esi
je 0x10062f2b
cmp byte [0x10265d79], 0
jne 0x10062f79
mov byte [0x10265d79], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10265ddc]
xor ebx, dword [0x10265dd8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0xc], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10265d7a]
xor al, bl
mov byte [esi + 0x10265d7a], al
inc esi
cmp esi, 0x5e
jb 0x10062ee0
jmp 0x10062f79
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x10265ddc]
xor ebx, dword [0x10265dd8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0xc], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10265d7a]
xor al, bl
mov byte [esi + 0x10265d7a], al
inc esi
cmp esi, 0x5e
jb 0x10062f30
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x5d
push 0x10265d7a
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.1001f000
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10062fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [0x10265268], 0
push ebx
push esi
je 0x1006302b
cmp byte [0x10265269], 0
jne 0x10063079
mov byte [0x10265269], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1026529c]
xor ebx, dword [0x10265298]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0xc], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1026526a]
xor al, bl
mov byte [esi + 0x1026526a], al
inc esi
cmp esi, 0x2e
jb 0x10062fe0
jmp 0x10063079
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1026529c]
xor ebx, dword [0x10265298]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0xc], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1026526a]
xor al, bl
mov byte [esi + 0x1026526a], al
inc esi
cmp esi, 0x2e
jb 0x10063030
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x2d
push 0x1026526a
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.1001f000
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100630b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x10063110
cmp byte [esi + 1], 0
jne 0x10063151
mov byte [esi + 1], 1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + edi + 2], al
inc edi
cmp edi, 0x24
jb 0x100630d3
jmp 0x10063151
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + edi + 2]
xor al, bl
mov byte [esi + edi + 2], al
inc edi
cmp edi, 0x24
jb 0x10063112
lea ecx, [esi + 0x25]
lea eax, [esi + 2]
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
cmp eax, ecx
je 0x1006317c
push 0x23
push eax
mov ecx, esi
call fcn.1001f000
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10063190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x100631f0
cmp byte [esi + 1], 0
jne 0x10063231
mov byte [esi + 1], 1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + edi + 2], al
inc edi
cmp edi, 0x3a
jb 0x100631b3
jmp 0x10063231
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + edi + 2]
xor al, bl
mov byte [esi + edi + 2], al
inc edi
cmp edi, 0x3a
jb 0x100631f2
lea ecx, [esi + 0x3b]
lea eax, [esi + 2]
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
cmp eax, ecx
je 0x1006325c
push 0x39
push eax
mov ecx, esi
call fcn.1001f000
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10063270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [0x10266220], 0
push ebx
push esi
je 0x100632eb
cmp byte [0x10266221], 0
jne 0x10063339
mov byte [0x10266221], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1026625c]
xor ebx, dword [0x10266258]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0xc], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10266222]
xor al, bl
mov byte [esi + 0x10266222], al
inc esi
cmp esi, 0x31
jb 0x100632a0
jmp 0x10063339
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1026625c]
xor ebx, dword [0x10266258]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0xc], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10266222]
xor al, bl
mov byte [esi + 0x10266222], al
inc esi
cmp esi, 0x31
jb 0x100632f0
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x30
push 0x10266222
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.1001f000
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10063370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x100633d0
cmp byte [esi + 1], 0
jne 0x10063411
mov byte [esi + 1], 1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x4c]
xor ebx, dword [esi + 0x48]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + edi + 2], al
inc edi
cmp edi, 0x45
jb 0x10063393
jmp 0x10063411
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x4c]
xor ebx, dword [esi + 0x48]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + edi + 2]
xor al, bl
mov byte [esi + edi + 2], al
inc edi
cmp edi, 0x45
jb 0x100633d2
lea ecx, [esi + 0x46]
lea eax, [esi + 2]
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
cmp eax, ecx
je 0x1006343c
push 0x44
push eax
mov ecx, esi
call fcn.1001f000
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10063450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [0x10265960], 0
push ebx
push esi
je 0x100634cb
cmp byte [0x10265961], 0
jne 0x10063519
mov byte [0x10265961], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102659a4]
xor ebx, dword [0x102659a0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0xc], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10265962]
xor al, bl
mov byte [esi + 0x10265962], al
inc esi
cmp esi, 0x39
jb 0x10063480
jmp 0x10063519
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102659a4]
xor ebx, dword [0x102659a0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0xc], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x10265962]
xor al, bl
mov byte [esi + 0x10265962], al
inc esi
cmp esi, 0x39
jb 0x100634d0
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x38
push 0x10265962
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.1001f000
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10063550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x100635b0
cmp byte [esi + 1], 0
jne 0x100635f1
mov byte [esi + 1], 1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + edi + 2], al
inc edi
cmp edi, 0x38
jb 0x10063573
jmp 0x100635f1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x44]
xor ebx, dword [esi + 0x40]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + edi + 2]
xor al, bl
mov byte [esi + edi + 2], al
inc edi
cmp edi, 0x38
jb 0x100635b2
lea ecx, [esi + 0x39]
lea eax, [esi + 2]
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
cmp eax, ecx
je 0x1006361c
push 0x37
push eax
mov ecx, esi
call fcn.1001f000
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10063630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [0x10265658], 0
push ebx
push esi
je 0x100636ab
cmp byte [0x10265659], 0
jne 0x100636f9
mov byte [0x10265659], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102656a4]
xor ebx, dword [0x102656a0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0xc], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1026565a]
xor al, bl
mov byte [esi + 0x1026565a], al
inc esi
cmp esi, 0x42
jb 0x10063660
jmp 0x100636f9
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102656a4]
xor ebx, dword [0x102656a0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0xc], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1026565a]
xor al, bl
mov byte [esi + 0x1026565a], al
inc esi
cmp esi, 0x42
jb 0x100636b0
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x41
push 0x1026565a
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.1001f000
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10063730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x10063790
cmp byte [esi + 1], 0
jne 0x100637d1
mov byte [esi + 1], 1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x54]
xor ebx, dword [esi + 0x50]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + edi + 2], al
inc edi
cmp edi, 0x4e
jb 0x10063753
jmp 0x100637d1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x54]
xor ebx, dword [esi + 0x50]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + edi + 2]
xor al, bl
mov byte [esi + edi + 2], al
inc edi
cmp edi, 0x4e
jb 0x10063792
lea ecx, [esi + 0x4f]
lea eax, [esi + 2]
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
cmp eax, ecx
je 0x100637fc
push 0x4d
push eax
mov ecx, esi
call fcn.1001f000
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10063810
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x10063870
cmp byte [esi + 1], 0
jne 0x100638b1
mov byte [esi + 1], 1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + edi + 2], al
inc edi
cmp edi, 0x21
jb 0x10063833
jmp 0x100638b1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + edi + 2]
xor al, bl
mov byte [esi + edi + 2], al
inc edi
cmp edi, 0x21
jb 0x10063872
lea ecx, [esi + 0x22]
lea eax, [esi + 2]
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
cmp eax, ecx
je 0x100638dc
push 0x20
push eax
mov ecx, esi
call fcn.1001f000
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100638f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [0x10266478], 0
push ebx
push esi
je 0x1006396b
cmp byte [0x10266479], 0
jne 0x100639b9
mov byte [0x10266479], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102664b4]
xor ebx, dword [0x102664b0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0xc], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1026647a]
xor al, bl
mov byte [esi + 0x1026647a], al
inc esi
cmp esi, 0x33
jb 0x10063920
jmp 0x100639b9
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102664b4]
xor ebx, dword [0x102664b0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0xc], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1026647a]
xor al, bl
mov byte [esi + 0x1026647a], al
inc esi
cmp esi, 0x33
jb 0x10063970
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x32
push 0x1026647a
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
call fcn.1001f000
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4