joyce8/EMBER2024-capa huggingface dataset:
Function at 0x132f610
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x132f632
xor eax, eax
jmp 0x132f620
lea edx, [eax + esi]
lea ecx, [eax - 0x21]
inc eax
xor byte [edx], cl
cmp eax, 4
jb 0x132f620
mov byte [esi + 5], 0
mov eax, esi
pop esi
ret

Function at 0x132f640
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x132f662
xor eax, eax
jmp 0x132f650
lea edx, [eax + esi]
lea ecx, [eax - 0x21]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x132f650
mov byte [esi + 8], 0
mov eax, esi
pop esi
ret

Function at 0x132f670
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 3], 0
je 0x132f692
xor eax, eax
jmp 0x132f680
lea edx, [eax + esi]
lea ecx, [eax - 0x21]
inc eax
xor byte [edx], cl
cmp eax, 2
jb 0x132f680
mov byte [esi + 3], 0
mov eax, esi
pop esi
ret

Function at 0x132f6b0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xdb4156
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 1
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0xf
mov byte [esi], al
mov dword [ebp - 0x14], 1
xor ecx, ecx
mov dword [ebp - 0x10], 0x10082ad
lea eax, [ecx - 0x21]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0x132f708
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
jb 0x132f725
mov eax, dword [ebp + 8]
push edi
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.01409580
mov edi, eax
add esp, 8
test edi, edi
je 0x132f79f
push ebx
push 2
push 0
push edi
call fcn.0140d356
push edi
call fcn.0140910b
push 0
push 0
push edi
mov ebx, eax
call fcn.0140d356
mov ecx, dword [esi + 0x10]
add esp, 0x1c
cmp ebx, ecx
ja 0x132f773
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x132f76a
mov eax, dword [esi]
mov dword [esi + 0x10], ebx
mov byte [eax + ebx], 0
jmp 0x132f781
mov eax, ebx
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.01391180
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x132f78b
mov eax, dword [esi]
push edi
push ebx
push 1
push eax
call fcn.01411e00
push edi
call fcn.0140ce08
add esp, 0x14
pop ebx
mov ecx, dword [ebp + 0x1c]
pop edi
cmp ecx, 0x10
jb 0x132f7d0
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x132f7c6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x132f7e1
push ecx
push edx
call fcn.01403731
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.014089d0
int3
Function at 0x132f7f0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xdb41a5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x18], ebx
push edi
mov dword [ebp - 0x14], 0
push 0x24
mov dword [ebp - 4], 1
call fcn.014034b0
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 2
lea esi, [edi + 0xc]
xor eax, eax
mov dword [edi + 4], 1
mov dword [edi + 8], 1
mov ecx, esi
mov dword [edi], 0xdd2420
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push eax
mov dword [esi + 0xc], eax
push 0xdd02e8
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
call fcn.013282e0
mov byte [ebp - 4], 1
mov dword [ebx + 4], 0
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov dword [ebp - 0x14], 3
xor ecx, ecx
mov dword [ebp - 0x10], 0x10082ad
jmp 0x132f890
lea eax, [ecx - 0x21]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0x132f890
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
jb 0x132f8ad
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.01409580
mov esi, eax
add esp, 8
test esi, esi
je 0x132f924
push 2
push 0
push esi
call fcn.0140d356
push esi
call fcn.0140910b
push 0
push 0
push esi
mov edi, eax
call fcn.0140d356
mov ecx, dword [ebx]
add esp, 0x1c
mov edx, dword [ecx + 0x10]
lea eax, [ecx + 0x10]
cmp edi, edx
ja 0x132f8fb
cmp dword [ecx + 0x14], 0x10
jb 0x132f8f3
mov ecx, dword [ecx]
mov dword [eax], edi
mov byte [ecx + edi], 0
jmp 0x132f907
mov eax, edi
push 0
sub eax, edx
push eax
call fcn.01391180
mov eax, dword [ebx]
cmp dword [eax + 0x14], 0x10
jb 0x132f911
mov eax, dword [eax]
push esi
push edi
push 1
push eax
call fcn.01411e00
push esi
call fcn.0140ce08
add esp, 0x14
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x132f954
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x132f94a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x132f967
push ecx
push edx
call fcn.01403731
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.014089d0
int3
Function at 0x132f970
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xdb41a5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x18], ebx
push edi
mov dword [ebp - 0x14], 0
push 0x24
mov dword [ebp - 4], 1
call fcn.014034b0
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 2
lea esi, [edi + 0xc]
xor eax, eax
mov dword [edi + 4], 1
mov dword [edi + 8], 1
mov ecx, esi
mov dword [edi], 0xdd2420
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push eax
mov dword [esi + 0xc], eax
push 0xdd02e8
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
call fcn.013282e0
mov byte [ebp - 4], 1
mov dword [ebx + 4], 0
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov dword [ebp - 0x14], 3
xor ecx, ecx
mov dword [ebp - 0x10], 0x10082ad
jmp 0x132fa10
lea eax, [ecx - 0x21]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0x132fa10
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
jb 0x132fa2d
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.01409580
mov edi, eax
add esp, 8
test edi, edi
je 0x132fab1
push 2
push 0
push edi
call fcn.0140d356
push edi
call fcn.0140910b
push 0
push 0
push edi
mov esi, eax
call fcn.0140d356
add esp, 0x1c
cmp esi, 0x1e8c53
jbe 0x132fa6c
mov esi, 0x1e8c53
mov ecx, dword [ebx]
mov edx, dword [ecx + 0x10]
lea eax, [ecx + 0x10]
cmp esi, edx
ja 0x132fa88
cmp dword [ecx + 0x14], 0x10
jb 0x132fa80
mov ecx, dword [ecx]
mov dword [eax], esi
mov byte [ecx + esi], 0
jmp 0x132fa94
mov eax, esi
push 0
sub eax, edx
push eax
call fcn.01391180
mov eax, dword [ebx]
cmp dword [eax + 0x14], 0x10
jb 0x132fa9e
mov eax, dword [eax]
push edi
push esi
push 1
push eax
call fcn.01411e00
push edi
call fcn.0140ce08
add esp, 0x14
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x132fae1
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x132fad7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x132faf4
push ecx
push edx
call fcn.01403731
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.014089d0
int3
Function at 0x132fb00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
mov dword [ebp - 4], 0x10082ad
xor ecx, ecx
lea eax, [ecx - 0x21]
xor byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 2
jb 0x132fb10
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
mov byte [ebp - 1], 0
jb 0x132fb2d
mov eax, dword [ebp + 8]
push esi
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.01409580
mov esi, eax
add esp, 8
test esi, esi
je 0x132fb5c
push 2
push 0
push esi
call fcn.0140d356
push esi
call fcn.0140910b
push esi
mov edi, eax
call fcn.0140ce08
add esp, 0x14
mov ecx, dword [ebp + 0x1c]
pop esi
cmp ecx, 0x10
jb 0x132fb8d
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x132fb83
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x132fb94
push ecx
push edx
call fcn.01403731
add esp, 8
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
call fcn.014089d0
int3

Function at 0x132fbe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov dword [ebp - 0x1a], 0xa58d948d
xor ecx, ecx
mov dword [ebp - 0x16], 0x83b39086
mov dword [ebp - 0x12], 0x85809b95
mov word [ebp - 0xe], 0x85
mov byte [ebp - 0xc], 1
lea ebx, [ebx]
lea eax, [ecx - 0x21]
xor byte [ebp + ecx - 0x1a], al
inc ecx
cmp ecx, 0xd
jb 0x132fc10
mov byte [ebp - 0xc], 0
xor ecx, ecx
mov dword [ebp - 0xb], 0x8e859491
mov dword [ebp - 7], 0x8a81ca8f
mov word [ebp - 3], 0x8b
mov byte [ebp - 1], 1
jmp 0x132fc40
lea eax, [ecx - 0x21]
xor byte [ebp + ecx - 0xb], al
inc ecx
cmp ecx, 9
jb 0x132fc40
lea eax, [ebp - 0xb]
mov byte [ebp - 1], 0
push eax
call fcn.01526027

Function at 0x132fd60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x10082ad
xor ecx, ecx
lea ecx, [ecx]
lea eax, [ecx - 0x21]
xor byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 2
jb 0x132fd70
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
mov byte [ebp - 1], 0
jb 0x132fd8d
mov eax, dword [ebp + 8]
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.01409580
add esp, 8
test eax, eax
je 0x132fdac
push eax
call fcn.0140ce08
add esp, 4
mov bl, 1
jmp 0x132fdae
xor bl, bl
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x132fdde
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x132fdd4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x132fde5
push ecx
push edx
call fcn.01403731
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.014089d0
int3
Function at 0x1330f90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xdb438a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x678
push ebx
push esi
push edi
mov dword [ebp - 0xcc], ecx
mov esi, 0x20019
call fcn.0132fba0
test eax, eax
je 0x1330fca
mov esi, 0x20119
mov dword [ebp - 0x15], 0x8c8a8e8a
xor ecx, ecx
mov dword [ebp - 0x11], 0x8b938c
mov byte [ebp - 0xd], 1
mov edi, edi
lea eax, [ecx - 0x21]
xor byte [ebp + ecx - 0x15], al
inc ecx
cmp ecx, 7
jb 0x1330fe0
xor eax, eax
mov byte [ebp - 0xd], 0
lea ecx, [ebp - 0x15]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
lea edx, [ecx + 1]
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1331020
sub ecx, edx
lea eax, [ebp - 0x15]
push ecx
push eax
lea ecx, [ebp - 0xb0]
call fcn.013282e0
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0xb6a7af8c
mov dword [ebp - 0x54], 0xa3b7a5b4
mov dword [ebp - 0x50], 0x8980a5bb
mov dword [ebp - 0x4c], 0x819e8399
mov dword [ebp - 0x48], 0xb1ad8489
mov dword [ebp - 0x44], 0x82858d81
mov dword [ebp - 0x40], 0x9b8b9f98
mov dword [ebp - 0x3c], 0x84948b
mov byte [ebp - 0x38], 1
lea eax, [ecx - 0x21]
xor byte [ebp + ecx - 0x58], al
inc ecx
cmp ecx, 0x1f
jb 0x1331085
lea eax, [ebp - 0x5c]
mov byte [ebp - 0x38], 0
push eax
push esi
push 0
lea eax, [ebp - 0x58]
push eax
push 0x80000002
push eax
call 0x1511d21
test eax, eax
jne 0x1331145
mov dword [ebp - 0x34], 0x20019
xor ecx, ecx
mov dword [ebp - 0x28], 0x400
mov dword [ebp - 0x19], 0x8a828192
mov dword [ebp - 0x15], 0xa1808a8a
mov dword [ebp - 0x11], 0x8d8192
mov byte [ebp - 0xd], 1
lea ecx, [ecx]
lea eax, [ecx - 0x21]
xor byte [ebp + ecx - 0x19], al
inc ecx
cmp ecx, 0xb
jb 0x13310e0
lea eax, [ebp - 0x28]
mov byte [ebp - 0xd], 0
push eax
lea eax, [ebp - 0x680]
push eax
lea eax, [ebp - 0x34]
push eax
push 0
lea eax, [ebp - 0x19]
push eax
push dword [ebp - 0x5c]
call dword [0xdbd01c]
test eax, eax
jne 0x133113c
lea ecx, [ebp - 0x680]
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1331120
sub ecx, edx
lea eax, [ebp - 0x680]
push ecx
push eax
lea ecx, [ebp - 0xb0]
call fcn.0138e570
push dword [ebp - 0x5c]
call dword [section..rdata]
mov dword [ebp - 0x15], 0x8c8a8e8a
xor ecx, ecx
mov dword [ebp - 0x11], 0x8b938c
mov byte [ebp - 0xd], 1
lea esp, [esp]
lea eax, [ecx - 0x21]
xor byte [ebp + ecx - 0x15], al
inc ecx
cmp ecx, 7
jb 0x1331160
xor eax, eax
mov byte [ebp - 0xd], 0
lea ecx, [ebp - 0x15]
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
lea edx, [ecx + 1]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x13311a0
sub ecx, edx
lea eax, [ebp - 0x15]
push ecx
push eax
lea ecx, [ebp - 0x98]
call fcn.013282e0
push 0x7c
lea eax, [ebp - 0x280]
mov byte [ebp - 4], 1
push 0
push eax
call fcn.01405710
add esp, 0xc
lea eax, [ebp - 0x280]
push eax
call 0x153448c
Function at 0x13318c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
je 0x13318e2
xor eax, eax
jmp 0x13318d0
lea edx, [eax + esi]
lea ecx, [eax - 0x21]
inc eax
xor byte [edx], cl
cmp eax, 0xb
jb 0x13318d0
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
ret
Function at 0x1331b60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 7], 0
je 0x1331b82
xor eax, eax
jmp 0x1331b70
lea edx, [eax + esi]
lea ecx, [eax - 0x21]
inc eax
xor byte [edx], cl
cmp eax, 6
jb 0x1331b70
mov byte [esi + 7], 0
mov eax, esi
pop esi
ret

Function at 0x1333650
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x1333672
xor eax, eax
jmp 0x1333660
lea edx, [eax + esi]
lea ecx, [eax - 0x21]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0x1333660
mov byte [esi + 0x11], 0
mov eax, esi
pop esi
ret

Function at 0x1333680
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x13336a2
xor eax, eax
jmp 0x1333690
lea edx, [eax + esi]
lea ecx, [eax - 0x21]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x1333690
mov byte [esi + 0x10], 0
mov eax, esi
pop esi
ret

Function at 0x13336b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0x13336d2
xor eax, eax
jmp 0x13336c0
lea edx, [eax + esi]
lea ecx, [eax - 0x21]
inc eax
xor byte [edx], cl
cmp eax, 8
jb 0x13336c0
mov byte [esi + 9], 0
mov eax, esi
pop esi
ret

Function at 0x13336e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x1333702
xor eax, eax
jmp 0x13336f0
lea edx, [eax + esi]
lea ecx, [eax - 0x21]
inc eax
xor byte [edx], cl
cmp eax, 0xa
jb 0x13336f0
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret

Function at 0x1333710
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x1333732
xor eax, eax
jmp 0x1333720
lea edx, [eax + esi]
lea ecx, [eax - 0x21]
inc eax
xor byte [edx], cl
cmp eax, 0xc
jb 0x1333720
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret

Function at 0x1333740
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x1333762
xor eax, eax
jmp 0x1333750
lea edx, [eax + esi]
lea ecx, [eax - 0x21]
inc eax
xor byte [edx], cl
cmp eax, 0x12
jb 0x1333750
mov byte [esi + 0x13], 0
mov eax, esi
pop esi
ret

Function at 0x1333770
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 0
je 0x1333792
xor eax, eax
jmp 0x1333780
lea edx, [eax + esi]
lea ecx, [eax - 0x21]
inc eax
xor byte [edx], cl
cmp eax, 0x1b
jb 0x1333780
mov byte [esi + 0x1c], 0
mov eax, esi
pop esi
ret

Function at 0x13337a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x13337c2
xor eax, eax
jmp 0x13337b0
lea edx, [eax + esi]
lea ecx, [eax - 0x21]
inc eax
xor byte [edx], cl
cmp eax, 0x17
jb 0x13337b0
mov byte [esi + 0x18], 0
mov eax, esi
pop esi
ret

Function at 0x13337d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x13337f2
xor eax, eax
jmp 0x13337e0
lea edx, [eax + esi]
lea ecx, [eax - 0x21]
inc eax
xor byte [edx], cl
cmp eax, 0x14
jb 0x13337e0
mov byte [esi + 0x15], 0
mov eax, esi
pop esi
ret
Function at 0x1333800
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x1333822
xor eax, eax
jmp 0x1333810
lea edx, [eax + esi]
lea ecx, [eax - 0x21]
inc eax
xor byte [edx], cl
cmp eax, 0x21
jb 0x1333810
mov byte [esi + 0x22], 0
mov eax, esi
pop esi
ret

Function at 0x1333830
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x1333852
xor eax, eax
jmp 0x1333840
lea edx, [eax + esi]
lea ecx, [eax - 0x21]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0x1333840
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
ret

Function at 0x1333860
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x1333882
xor eax, eax
jmp 0x1333870
lea edx, [eax + esi]
lea ecx, [eax - 0x21]
inc eax
xor byte [edx], cl
cmp eax, 0x13
jb 0x1333870
mov byte [esi + 0x14], 0
mov eax, esi
pop esi
ret
Function at 0x13338b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xdb450b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c8
push ebx
push esi
push edi
mov bh, cl
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x64], 0xf
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x78], al
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], al
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], al
mov byte [ebp - 4], 4
xor bl, bl
mov dword [ebp - 0x14], 0xc8cfca83
xor ecx, ecx
mov word [ebp - 0x10], 0x100
lea esp, [esp]
lea eax, [ecx - 0x21]
xor byte [ebp + ecx - 0x14], al
inc ecx
cmp ecx, 4
jb 0x1333940
lea ecx, [ebp - 0x14]
mov byte [ebp - 0xf], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1333957
sub ecx, edx
mov eax, 0x7fffffff
mov edx, dword [ebp + 0x18]
sub eax, edx
cmp eax, ecx
jb 0x1333eef
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
jb 0x133397e
mov eax, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push edx
push eax
push ecx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x48]
call fcn.01396210
mov ecx, dword [ebp - 0x4c]
cmp ecx, 0x10
jb 0x13339c5
mov edx, dword [ebp - 0x60]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x13339bb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1333efa
push ecx
push edx
call fcn.01403731
add esp, 8
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x60]
mov edx, dword [ebp - 0x48]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x4c], eax
cmp eax, 0x10
jb 0x13339f3
mov ecx, edx
lea eax, [ebp - 0x1d4]
push eax
push ecx
call 0x14f85c4
ret
call fcn.01327a70
push eax
call fcn.014026db
call fcn.014089d0
int3
Function at 0x1338bb0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x1338bd2
xor eax, eax
jmp 0x1338bc0
lea edx, [eax + esi]
lea ecx, [eax - 0x21]
inc eax
xor byte [edx], cl
cmp eax, 0x1c
jb 0x1338bc0
mov byte [esi + 0x1d], 0
mov eax, esi
pop esi
ret
Function at 0x13399e0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
mov al, byte [eax + 2]
test al, al
setne bl
push eax
call 0x15e94d0
test eax, eax
je 0x13399ff
mov bl, 1
pushfd
pop eax
mov dword [ebp - 4], eax
test dword [ebp - 4], 0x100
mov al, 1
jne 0x1339a11
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1339b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor eax, eax
xor ecx, ecx
push esi
push edi
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, 1
push ebx
cpuid
mov esi, ebx
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov ebx, dword [ebp - 8]
shr ebx, 0x1f
and bl, 1
mov dword [ebp - 0xe], 0x8c9385b4
mov dword [ebp - 0xa], 0xd4d68886
xor eax, eax
mov dword [ebp - 6], 0x86858cc9
mov word [ebp - 2], 0x100
lea ecx, [eax - 0x21]
xor byte [ebp + eax - 0xe], cl
inc eax
cmp eax, 0xc
jb 0x1339bb8
lea eax, [ebp - 0xe]
mov byte [ebp - 1], 0
push eax
push edi
call fcn.014c2590
test eax, eax
mov al, 1
je 0x1339bdb
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1339e60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x29], 0
je 0x1339e82
xor eax, eax
jmp 0x1339e70
lea edx, [eax + esi]
lea ecx, [eax - 0x21]
inc eax
xor byte [edx], cl
cmp eax, 0x28
jb 0x1339e70
mov byte [esi + 0x29], 0
mov eax, esi
pop esi
ret

Function at 0x1339e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
xor bl, bl
push esi
call fcn.014660fa
test eax, eax
jne 0x1339eb2
push 0x15
call fcn.015d251d
ret
mov bl, 1
mov dword [ebp - 5], 0xbdda9c
xor ecx, ecx
mov byte [ebp - 1], 1
lea eax, [ecx - 0x21]
xor byte [ebp + ecx - 5], al
inc ecx
cmp ecx, 3
jb 0x1339ec1
push 0x105
lea eax, [ebp - 0x120]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x105
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 5]
push eax
push eax
call fcn.0149b39b
test eax, eax
je 0x133a030
mov dword [ebp - 9], 0x9a8ea289
xor ecx, ecx
mov dword [ebp - 5], 0x9396a7
mov byte [ebp - 1], 1
lea esp, [esp]
lea eax, [ecx - 0x21]
xor byte [ebp + ecx - 9], al
inc ecx
cmp ecx, 7
jb 0x1339f20
mov byte [ebp - 1], 0
lea ecx, [ebp - 9]
lea eax, [ebp - 0x120]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1339f60
test dl, dl
je 0x1339f5c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1339f60
add eax, 2
add ecx, 2
test dl, dl
jne 0x1339f40
xor eax, eax
jmp 0x1339f65
sbb eax, eax
or eax, 1
test eax, eax
je 0x133a029
mov dword [ebp - 8], 0x9a8ea289
xor ecx, ecx
mov dword [ebp - 4], 0x100a2b0
lea ecx, [ecx]
lea eax, [ecx - 0x21]
xor byte [ebp + ecx - 8], al
inc ecx
cmp ecx, 6
jb 0x1339f80
mov byte [ebp - 1], 0
lea ecx, [ebp - 8]
lea eax, [ebp - 0x120]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1339fc0
test dl, dl
je 0x1339fbc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1339fc0
add eax, 2
add ecx, 2
test dl, dl
jne 0x1339fa0
xor eax, eax
jmp 0x1339fc5
sbb eax, eax
or eax, 1
test eax, eax
je 0x133a029
mov dword [ebp - 0xb], 0x9a8ea289
xor ecx, ecx
mov dword [ebp - 7], 0x958091a4
mov word [ebp - 3], 0x93
mov byte [ebp - 1], 1
lea eax, [ecx - 0x21]
xor byte [ebp + ecx - 0xb], al
inc ecx
cmp ecx, 9
jb 0x1339fe3
mov byte [ebp - 1], 0
lea ecx, [ebp - 0xb]
lea eax, [ebp - 0x120]
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x133a020
test dl, dl
je 0x133a01c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x133a020
add eax, 2
add ecx, 2
test dl, dl
jne 0x133a000
xor eax, eax
jmp 0x133a025
sbb eax, eax
or eax, 1
test eax, eax
jne 0x133a030
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x133b0d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2b], 0
je 0x133b0f2
xor eax, eax
jmp 0x133b0e0
lea edx, [eax + esi]
lea ecx, [eax - 0x21]
inc eax
xor byte [edx], cl
cmp eax, 0x2a
jb 0x133b0e0
mov byte [esi + 0x2b], 0
mov eax, esi
pop esi
ret