joyce8/EMBER2024-capa huggingface dataset:
Function at 0x12b2bd0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 3], 0
je 0x12b2bf2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 2
jb 0x12b2be0
mov byte [esi + 3], 0
mov eax, esi
pop esi
ret

Function at 0x12b2c00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movaps xmm0, xmmword [0xe357a0]
mov dword [ebp - 0xc], ecx
xor ecx, ecx
movups xmmword [ebp - 0x31], xmm0
mov dword [ebp - 0x21], 0xc7c8d6cc
mov dword [ebp - 0x1d], 0xc4c6c1d3
mov word [ebp - 0x19], 0x100
nop word [eax + eax]
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0x31], al
inc ecx
cmp ecx, 0x18
jb 0x12b2c30
mov byte [ebp - 0x18], 0
xor ecx, ecx
mov dword [ebp - 0x17], 0xfaf1e0fd
mov dword [ebp - 0x13], 0xf6fdb6fb
mov word [ebp - 0xf], 0xf7
mov byte [ebp - 0xd], 1
nop dword [eax + eax]
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 9
jb 0x12b2c60
push ebx
push esi
push edi
lea eax, [ebp - 0x17]
mov byte [ebp - 0xd], 0
push eax
call fcn.014cb65a
ret

Function at 0x12b2d50
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x12b2d72
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 9
jb 0x12b2d60
mov byte [esi + 0xa], 0
mov eax, esi
pop esi
ret

Function at 0x12b2d80
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x19], 0
je 0x12b2da2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x18
jb 0x12b2d90
mov byte [esi + 0x19], 0
mov eax, esi
pop esi
ret

Function at 0x12b2ec0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xe], 0
je 0x12b2ee2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0xd
jb 0x12b2ed0
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret

Function at 0x12b2ef0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x12b2f12
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x15
jb 0x12b2f00
mov byte [esi + 0x16], 0
mov eax, esi
pop esi
ret

Function at 0x12b3320
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x12], 0
je 0x12b3342
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x11
jb 0x12b3330
mov byte [esi + 0x12], 0
mov eax, esi
pop esi
ret

Function at 0x12b4030
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x12b4052
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 4
jb 0x12b4040
mov byte [esi + 5], 0
mov eax, esi
pop esi
ret
Function at 0x12b4060
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x12b4082
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x12b4070
mov byte [esi + 8], 0
mov eax, esi
pop esi
ret

Function at 0x12b4090
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xe134d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 0x18], 1
xor ecx, ecx
mov dword [ebp - 0x10], 0x100f6e1
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0x12b40f4
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x10]
push edi
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.0138b5d0
mov edi, eax
add esp, 8
test edi, edi
je 0x12b418d
push 2
push 0
push edi
call fcn.0138f3a6
push edi
call fcn.0138b15b
push 0
push 0
push edi
mov dword [ebp - 0x14], eax
call fcn.0138f3a6
mov ecx, dword [esi + 0x10]
add esp, 0x1c
mov eax, dword [ebp - 0x14]
cmp eax, ecx
ja 0x12b4161
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x12b4158
mov ecx, dword [esi]
mov dword [esi + 0x10], eax
mov byte [ecx + eax], 0
jmp 0x12b4170
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.01310e10
mov eax, dword [ebp - 0x14]
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x12b417a
mov ecx, dword [esi]
push edi
push eax
push 1
push ecx
call fcn.01393e4f
push edi
call fcn.0138ee58
add esp, 0x14
mov ecx, dword [ebp + 0x1c]
pop edi
cmp ecx, 0x10
jb 0x12b41be
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x12b41b4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x12b41cf
push ecx
push edx
call fcn.01385783
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0138aa20
int3
Function at 0x12b41e0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xe13516
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 1
call fcn.01312530
mov dword [ebp - 0x14], 1
xor ecx, ecx
mov dword [ebp - 0x10], 0x100f6e1
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0x12b4224
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x10]
push ebx
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.0138b5d0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x12b42ba
push edi
push 2
push 0
push ebx
call fcn.0138f3a6
push ebx
call fcn.0138b15b
push 0
push 0
push ebx
mov edi, eax
call fcn.0138f3a6
mov ecx, dword [esi]
add esp, 0x1c
mov edx, dword [ecx + 0x10]
lea eax, [ecx + 0x10]
cmp edi, edx
ja 0x12b4290
cmp dword [ecx + 0x14], 0x10
jb 0x12b4288
mov ecx, dword [ecx]
mov dword [eax], edi
mov byte [ecx + edi], 0
jmp 0x12b429c
mov eax, edi
push 0
sub eax, edx
push eax
call fcn.01310e10
mov eax, dword [esi]
cmp dword [eax + 0x14], 0x10
jb 0x12b42a6
mov eax, dword [eax]
push ebx
push edi
push 1
push eax
call fcn.01393e4f
push ebx
call fcn.0138ee58
add esp, 0x14
pop edi
mov ecx, dword [ebp + 0x1c]
pop ebx
cmp ecx, 0x10
jb 0x12b42eb
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x12b42e1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x12b42fc
push ecx
push edx
call fcn.01385783
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0138aa20
int3
Function at 0x12b4310
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xe13516
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push edi
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 1
call fcn.01312530
mov dword [ebp - 0x14], 1
xor ecx, ecx
mov dword [ebp - 0x10], 0x100f6e1
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0x12b4354
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x10]
push ebx
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.0138b5d0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x12b43f4
push esi
push 2
push 0
push ebx
call fcn.0138f3a6
push ebx
call fcn.0138b15b
push 0
push 0
push ebx
mov esi, eax
call fcn.0138f3a6
mov ecx, dword [edi]
mov eax, 0x1e8481
mov edx, dword [ecx + 0x10]
add esp, 0x1c
cmp esi, eax
cmova esi, eax
lea eax, [ecx + 0x10]
cmp esi, edx
ja 0x12b43ca
cmp dword [ecx + 0x14], 0x10
jb 0x12b43c2
mov ecx, dword [ecx]
mov dword [eax], esi
mov byte [ecx + esi], 0
jmp 0x12b43d6
mov eax, esi
push 0
sub eax, edx
push eax
call fcn.01310e10
mov eax, dword [edi]
cmp dword [eax + 0x14], 0x10
jb 0x12b43e0
mov eax, dword [eax]
push ebx
push esi
push 1
push eax
call fcn.01393e4f
push ebx
call fcn.0138ee58
add esp, 0x14
pop esi
mov ecx, dword [ebp + 0x1c]
pop ebx
cmp ecx, 0x10
jb 0x12b4425
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x12b441b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x12b4436
push ecx
push edx
call fcn.01385783
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.0138aa20
int3

Function at 0x12b4440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
mov dword [ebp - 4], 0x100f6e1
xor ecx, ecx
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 2
jb 0x12b4450
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 4]
push esi
lea eax, [ebp + 8]
mov byte [ebp - 1], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.0138b5d0
mov esi, eax
add esp, 8
test esi, esi
je 0x12b449b
push 2
push 0
push esi
call fcn.0138f3a6
push esi
call fcn.0138b15b
push esi
mov edi, eax
call fcn.0138ee58
add esp, 0x14
mov ecx, dword [ebp + 0x1c]
pop esi
cmp ecx, 0x10
jb 0x12b44cc
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x12b44c2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x12b44d3
push ecx
push edx
call fcn.01385783
add esp, 8
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
call fcn.0138aa20
int3
Function at 0x12b4520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov dword [ebp - 0x1a], 0xd1f9e0c1
xor ecx, ecx
mov dword [ebp - 0x16], 0xffcfecf2
mov dword [ebp - 0x12], 0xf1f4efe9
mov word [ebp - 0xe], 0xf1
mov byte [ebp - 0xc], 1
nop word [eax + eax]
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0x1a], al
inc ecx
cmp ecx, 0xd
jb 0x12b4550
mov byte [ebp - 0xc], 0
xor ecx, ecx
mov dword [ebp - 0xb], 0xfaf1e0dd
mov dword [ebp - 7], 0xf6fdb6fb
mov word [ebp - 3], 0xf7
mov byte [ebp - 1], 1
nop dword [eax + eax]
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0xb], al
inc ecx
cmp ecx, 9
jb 0x12b4580
lea eax, [ebp - 0xb]
mov byte [ebp - 1], 0
push eax
call fcn.0141b4a3

Function at 0x12b46b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0x100f6e1
xor ecx, ecx
nop dword [eax]
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 4], al
inc ecx
cmp ecx, 2
jb 0x12b46c0
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 4]
push ebx
lea eax, [ebp + 8]
mov byte [ebp - 1], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.0138b5d0
add esp, 8
test eax, eax
je 0x12b46fb
push eax
call fcn.0138ee58
add esp, 4
mov bl, 1
jmp 0x12b46fd
xor bl, bl
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0x10
jb 0x12b472d
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x12b4723
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x12b4734
push ecx
push edx
call fcn.01385783
add esp, 8
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0138aa20
int3
Function at 0x12b61b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xc], 0
je 0x12b61d2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0xb
jb 0x12b61c0
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
ret

Function at 0x12b75c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x11], 0
je 0x12b75e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x10
jb 0x12b75d0
mov byte [esi + 0x11], 0
mov eax, esi
pop esi
ret

Function at 0x12b75f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x12b7612
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x12b7600
mov byte [esi + 0x10], 0
mov eax, esi
pop esi
ret

Function at 0x12b7620
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0x12b7642
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 8
jb 0x12b7630
mov byte [esi + 9], 0
mov eax, esi
pop esi
ret

Function at 0x12b7650
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x12b7672
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0xa
jb 0x12b7660
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret

Function at 0x12b7680
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x12b76a2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0xc
jb 0x12b7690
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret

Function at 0x12b76b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x12b76d2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x12
jb 0x12b76c0
mov byte [esi + 0x13], 0
mov eax, esi
pop esi
ret

Function at 0x12b76e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x12b7702
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x13
jb 0x12b76f0
mov byte [esi + 0x14], 0
mov eax, esi
pop esi
ret

Function at 0x12b7710
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 0
je 0x12b7732
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x1b
jb 0x12b7720
mov byte [esi + 0x1c], 0
mov eax, esi
pop esi
ret

Function at 0x12b7740
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x12b7762
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x17
jb 0x12b7750
mov byte [esi + 0x18], 0
mov eax, esi
pop esi
ret
Function at 0x12b7770
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x12b7792
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x14
jb 0x12b7780
mov byte [esi + 0x15], 0
mov eax, esi
pop esi
ret

Function at 0x12b77a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x12b77c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x21
jb 0x12b77b0
mov byte [esi + 0x22], 0
mov eax, esi
pop esi
ret

Function at 0x12b77d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x12b77f2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0x12b77e0
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
ret
Function at 0x12b8d00
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 7], 0
je 0x12b8d22
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 6
jb 0x12b8d10
mov byte [esi + 7], 0
mov eax, esi
pop esi
ret
Function at 0x12bc810
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x12bc832
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x1c
jb 0x12bc820
mov byte [esi + 0x1d], 0
mov eax, esi
pop esi
ret
Function at 0x12bd450
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x30]
push ebx
mov al, byte [eax + 2]
test al, al
setne bl
push edi
call fcn.014f4b5c
test eax, eax
movzx ecx, bl
mov edx, 1
cmovne ecx, edx
pushfd
pop eax
mov dword [ebp - 4], eax
test dword [ebp - 4], 0x100
movzx eax, cl
cmovne eax, edx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x12bd5d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, 1
lea edi, [ebp - 0x10]
xor ecx, ecx
xorps xmm0, xmm0
push ebx
cpuid
mov esi, ebx
movups xmmword [ebp - 0x10], xmm0
pop ebx
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov ebx, dword [ebp - 8]
shr ebx, 0x1f
and bl, 1
mov dword [ebp - 0xe], 0xf8e7f1f8
mov dword [ebp - 0xa], 0xa8aaf4f2
xor eax, eax
mov dword [ebp - 6], 0xf2f1f8b5
mov word [ebp - 2], 0x100
lea ecx, [eax - 0x6d]
xor byte [ebp + eax - 0xe], cl
inc eax
cmp eax, 0xc
jb 0x12bd621
lea eax, [ebp - 0xe]
mov byte [ebp - 1], 0
push eax
push esi
call fcn.0146c1cb
test eax, eax
movzx ecx, bl
mov eax, 1
pop edi
cmove ecx, eax
pop esi
mov al, cl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x12bd890
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x29], 0
je 0x12bd8b2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x28
jb 0x12bd8a0
mov byte [esi + 0x29], 0
mov eax, esi
pop esi
ret

Function at 0x12bd8c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
xor bl, bl
push ebx
call fcn.014bd131
test eax, eax
jne 0x12bd8e2
push 0x15
call fcn.014f77df
ret
mov bl, 1
mov dword [ebp - 5], 0xc9aed0
xor ecx, ecx
mov byte [ebp - 1], 1
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 5], al
inc ecx
cmp ecx, 3
jb 0x12bd8f1
push 0x105
lea eax, [ebp - 0x120]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x105
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 5]
push eax
call fcn.01404b04
ret

Function at 0x12be870
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2b], 0
je 0x12be892
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x2a
jb 0x12be880
mov byte [esi + 0x2b], 0
mov eax, esi
pop esi
ret

Function at 0x12be8a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a], 0
je 0x12be8c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x6d]
inc eax
xor byte [edx], cl
cmp eax, 0x19
jb 0x12be8b0
mov byte [esi + 0x1a], 0
mov eax, esi
pop esi
ret
Function at 0x12becf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
push ebx
push esi
push edi
push 0x200
lea eax, [ebp - 0x230]
push 0
push eax
call fcn.01387760
add esp, 0xc
lea eax, [ebp - 0x230]
push 0x200
push eax
push 0
push ebp
call 0x1494833
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x12bed44
sub ecx, edx
lea eax, [ebp - 0x230]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.012ab030
mov dword [ebp - 0xd], 0xf7f2f1df
xor ecx, ecx
mov dword [ebp - 9], 0xf6fcd0fb
mov dword [ebp - 5], 0xeff9eb
mov byte [ebp - 1], 1
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0xd], al
inc ecx
cmp ecx, 0xb
jb 0x12bed78
lea edx, [ebp - 0xd]
mov byte [ebp - 1], 0
lea ecx, [edx + 1]
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x12bed90
mov ebx, dword [ebp - 0x14]
lea eax, [ebp - 0xd]
mov edi, dword [ebp - 0x28]
sub edx, ecx
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
push edx
cmp ebx, 0x10
mov edx, esi
push eax
cmovae ecx, edi
push 0
call fcn.01313bc0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x12bee8d
mov dword [ebp - 0xe], 0xe4f0e4dc
xor ecx, ecx
mov dword [ebp - 0xa], 0xf4f6dbf6
mov dword [ebp - 6], 0xeafef9f5
mov word [ebp - 2], 0x100
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0xe], al
inc ecx
cmp ecx, 0xc
jb 0x12bede2
lea edx, [ebp - 0xe]
mov byte [ebp - 1], 0
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x12bee00
sub edx, ecx
lea eax, [ebp - 0xe]
push edx
cmp ebx, 0x10
lea ecx, [ebp - 0x28]
push eax
cmovae ecx, edi
mov edx, esi
push 0
call fcn.01313bc0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x12bee8d
mov dword [ebp - 0xb], 0xe6c0d1da
xor ecx, ecx
mov dword [ebp - 7], 0xffedf9f3
mov word [ebp - 3], 0xe9
mov byte [ebp - 1], 1
lea eax, [ecx - 0x6d]
xor byte [ebp + ecx - 0xb], al
inc ecx
cmp ecx, 9
jb 0x12bee42
lea esi, [ebp - 0xb]
mov byte [ebp - 1], 0
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x12bee60
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0xb]
sub esi, ecx
cmp ebx, 0x10
push esi
push eax
lea ecx, [ebp - 0x28]
cmovae ecx, edi
push 0
call fcn.01313bc0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x12bee8d
xor bl, bl
jmp 0x12bee8f
mov bl, 1
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x12beebc
inc ecx
mov eax, edi
cmp ecx, 0x1000
jb 0x12beeb2
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x12beec5
push ecx
push edi
call fcn.01385783
add esp, 8
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.0138aa20
int3
Function at 0x12beed0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xe14183
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x470
mov dword [ebp - 0x20], 0
xor ecx, ecx
push esi
push edi
mov dword [ebp - 0x2d], 0xf7f2f1df
mov dword [ebp - 0x29], 0xf6fcd0fb
mov dword [ebp - 0x25], 0xeff9eb
mov byte [ebp - 0x21], 1
mov al, cl
sub al, 0x6d
xor byte [ebp + ecx - 0x2d], al
inc ecx
cmp ecx, 0xb
jb 0x12bef26
lea ecx, [ebp - 0x2d]
mov byte [ebp - 0x21], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x12bef40
mov esi, 0x7fffffff
sub ecx, edx
mov edx, dword [0xe43b54]
mov eax, esi
sub eax, edx
cmp eax, ecx
jb 0x12c097f
cmp dword [0xe43b58], 0x10
mov eax, 0xe43b44
push edx
cmovae eax, dword [0xe43b44]
push eax
push ecx
lea eax, [ebp - 0x2d]
push eax
push ecx
push dword [ebp - 0x17]
lea ecx, [ebp - 0x1ec]
call fcn.01315f90
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x2e], 0xe4f0e4dc
mov dword [ebp - 0x2a], 0xf4f6dbf6
mov dword [ebp - 0x26], 0xeafef9f5
mov word [ebp - 0x22], 0x100
nop dword [eax]
mov al, cl
sub al, 0x6d
xor byte [ebp + ecx - 0x2e], al
inc ecx
cmp ecx, 0xc
jb 0x12befb0
lea ecx, [ebp - 0x2e]
mov byte [ebp - 0x21], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x12befc8
sub ecx, edx
mov eax, esi
mov edx, dword [0xe43b54]
sub eax, edx
cmp eax, ecx
jb 0x12c0984
cmp dword [0xe43b58], 0x10
mov eax, 0xe43b44
push edx
cmovae eax, dword [0xe43b44]
push eax
push ecx
lea eax, [ebp - 0x2e]
push eax
push ecx
push dword [ebp - 0x17]
lea ecx, [ebp - 0x27c]
call fcn.01315f90
mov byte [ebp - 4], 1
xor ecx, ecx
mov dword [ebp - 0x2b], 0xe6c0d1da
mov dword [ebp - 0x27], 0xffedf9f3
mov word [ebp - 0x23], 0xe9
mov byte [ebp - 0x21], 1
nop word [eax + eax]
mov al, cl
sub al, 0x6d
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 9
jb 0x12bf030
lea ecx, [ebp - 0x2b]
mov byte [ebp - 0x21], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x12bf048
sub ecx, edx
mov eax, esi
mov edx, dword [0xe43b54]
sub eax, edx
cmp eax, ecx
jb 0x12c0989
cmp dword [0xe43b58], 0x10
mov eax, 0xe43b44
push edx
cmovae eax, dword [0xe43b44]
push eax
push ecx
lea eax, [ebp - 0x2b]
push eax
push ecx
push dword [ebp - 0x17]
lea ecx, [ebp - 0x15c]
call fcn.01315f90
push 0x200
lea eax, [ebp - 0x480]
mov byte [ebp - 4], 2
push 0
push eax
call fcn.01387760
add esp, 0xc
lea eax, [ebp - 0x480]
push 0x200
push eax
push 0
call fcn.01555a8d
ret
call fcn.012aa840
call fcn.012aa840
call fcn.012aa840
push eax
call fcn.0138472b
call fcn.012aa840
call fcn.0138aa20
call fcn.0138aa20
call fcn.0138aa20
push eax
call fcn.0138472b
call fcn.0138aa20
call fcn.012aa840
call fcn.0138aa20
call fcn.0138aa20
call fcn.0138aa20
call fcn.0138aa20
call fcn.0138aa20
call fcn.0138aa20
call fcn.0138aa20
int3