joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000aa90
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
add eax, 0x10
mov dword [esp + 8], eax
mov ecx, dword [0x10021368]
xor eax, eax
cmp dword [ecx - 0x16e37fba], 1
mov dword [esp + 0xc], eax
je 0x1000ab00
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
mov esi, dword [esp]
mov edx, dword [esp + 8]
mov dl, byte [edx + eax]
mov edi, eax
and edi, 0xf
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0x14
mov dword [esp + 0xc], eax
jne 0x1000aac4
mov eax, dword [0x10021368]
mov dword [eax - 0x16e37fba], 1
add esp, 0x10
pop esi
pop edi
ret

Function at 0x1000ab10
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x1b
mov dword [esp + 0x10], eax
mov ecx, dword [0x1002136c]
xor eax, eax
cmp dword [ecx + 0x6876da18], 1
mov dword [esp + 0x14], eax
je 0x1000abfd
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1b
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 2
mov dword [esp + 0x14], eax
jne 0x1000ab45
mov eax, dword [0x10022c50]
mov ecx, dword [0x10022c4c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000abb8
jmp 0x1000ac65
mov eax, dword [0x1002136c]
mov dword [eax + 0x6876da18], 1
mov eax, dword [0x10022c50]
mov ecx, dword [0x10022c4c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000abf8
jmp 0x1000ac65
jmp 0x1000abfd
mov eax, dword [0x10022c50]
mov ecx, dword [0x10022c4c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000ac2e
jmp 0x1000ac79
mov eax, dword [0x10022c50]
mov ecx, dword [0x10022c4c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000ac5f
jmp 0x1000ac79
add esp, 0x18
pop esi
pop edi
ret
mov eax, dword [0x1002136c]
mov dword [eax + 0x6876da18], 1
jmp 0x1000abb8
jmp 0x1000ac2e
Function at 0x1000ac80
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x18
mov dword [esp + 0x10], eax
mov ecx, dword [0x10021370]
xor eax, eax
cmp dword [ecx - 0x43f47eed], 1
mov dword [esp + 0x14], eax
je 0x1000ad06
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x18
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 4
mov dword [esp + 0x14], eax
jne 0x1000acb5
mov eax, dword [0x10021370]
mov dword [eax - 0x43f47eed], 1
mov eax, dword [0x10022c48]
mov ecx, dword [0x10022c44]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000ad37
jmp 0x1000ad6e
mov eax, dword [0x10022c48]
mov ecx, dword [0x10022c44]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000ad68
jmp 0x1000ad6e
add esp, 0x18
pop esi
pop edi
ret
jmp 0x1000ad37

Function at 0x1000ad80
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x13
mov dword [esp + 0x10], eax
mov ecx, dword [0x10021374]
xor eax, eax
cmp dword [ecx + 0x192bab79], 1
mov dword [esp + 0x14], eax
je 0x1000ae06
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x13
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 2
mov dword [esp + 0x14], eax
jne 0x1000adb5
mov eax, dword [0x10021374]
mov dword [eax + 0x192bab79], 1
mov eax, dword [0x10022c40]
mov ecx, dword [0x10022c3c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000ae37
jmp 0x1000ae6e
mov eax, dword [0x10022c40]
mov ecx, dword [0x10022c3c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000ae68
jmp 0x1000ae6e
add esp, 0x18
pop esi
pop edi
ret
jmp 0x1000ae37
Function at 0x1000afd0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x1b
mov dword [esp + 0x10], eax
mov ecx, dword [0x1002137c]
xor eax, eax
cmp dword [ecx - 0x786c923], 1
mov dword [esp + 0x14], eax
je 0x1000b0bd
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1b
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 2
mov dword [esp + 0x14], eax
jne 0x1000b005
mov eax, dword [0x10022c30]
mov ecx, dword [0x10022c2c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000b078
jmp 0x1000b0c3
mov eax, dword [0x1002137c]
mov dword [eax - 0x786c923], 1
mov eax, dword [0x10022c30]
mov ecx, dword [0x10022c2c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000b0b8
jmp 0x1000b0c3
jmp 0x1000b0bd
add esp, 0x18
pop esi
pop edi
ret
mov eax, dword [0x1002137c]
mov dword [eax - 0x786c923], 1
jmp 0x1000b078

Function at 0x1000b0e0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x11
mov dword [esp + 0x10], eax
mov ecx, dword [0x10021380]
xor eax, eax
cmp dword [ecx - 0x735e7279], 1
mov dword [esp + 0x14], eax
je 0x1000b1cd
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x11
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0x40
mov dword [esp + 0x14], eax
jne 0x1000b115
mov eax, dword [0x10022c28]
mov ecx, dword [0x10022c24]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000b188
jmp 0x1000b1d3
mov eax, dword [0x10021380]
mov dword [eax - 0x735e7279], 1
mov eax, dword [0x10022c28]
mov ecx, dword [0x10022c24]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000b1c8
jmp 0x1000b1d3
jmp 0x1000b1cd
add esp, 0x18
pop esi
pop edi
ret
mov eax, dword [0x10021380]
mov dword [eax - 0x735e7279], 1
jmp 0x1000b188
Function at 0x1000b1f0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
add eax, 0x10
mov dword [esp + 8], eax
mov ecx, dword [str._BAj]
xor eax, eax
cmp dword [ecx - 0x5a3f21ad], 1
mov dword [esp + 0xc], eax
je 0x1000b260
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
mov esi, dword [esp]
mov edx, dword [esp + 8]
mov dl, byte [edx + eax]
mov edi, eax
and edi, 0xf
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0x40
mov dword [esp + 0xc], eax
jne 0x1000b224
mov eax, dword [str._BAj]
mov dword [eax - 0x5a3f21ad], 1
add esp, 0x10
pop esi
pop edi
ret

Function at 0x1000b270
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x1c
mov dword [esp + 0x10], eax
mov ecx, dword [0x10021388]
xor eax, eax
cmp dword [ecx + 0x6c8d40e4], 1
mov dword [esp + 0x14], eax
je 0x1000b2f6
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1c
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 6
mov dword [esp + 0x14], eax
jne 0x1000b2a5
mov eax, dword [0x10021388]
mov dword [eax + 0x6c8d40e4], 1
add esp, 0x18
pop esi
pop edi
ret

Function at 0x1000b300
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x1a
mov dword [esp + 0x10], eax
mov ecx, dword [0x1002138c]
xor eax, eax
cmp dword [ecx - 0x6d5f5f71], 1
mov dword [esp + 0x14], eax
je 0x1000b386
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1a
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0x1c
mov dword [esp + 0x14], eax
jne 0x1000b335
mov eax, dword [0x1002138c]
mov dword [eax - 0x6d5f5f71], 1
mov eax, dword [0x10022c20]
mov ecx, dword [0x10022c1c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000b3b7
jmp 0x1000b3ee
mov eax, dword [0x10022c20]
mov ecx, dword [0x10022c1c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000b3e8
jmp 0x1000b3ee
add esp, 0x18
pop esi
pop edi
ret
jmp 0x1000b3b7
Function at 0x1000b400
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x1c
mov dword [esp + 0x10], eax
mov ecx, dword [0x10021390]
xor eax, eax
cmp dword [ecx + 0x5ef5bda4], 1
mov dword [esp + 0x14], eax
je 0x1000b4ed
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1c
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 3
mov dword [esp + 0x14], eax
jne 0x1000b435
mov eax, dword [0x10022c18]
mov ecx, dword [0x10022c14]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000b4a8
jmp 0x1000b4f3
mov eax, dword [0x10021390]
mov dword [eax + 0x5ef5bda4], 1
mov eax, dword [0x10022c18]
mov ecx, dword [0x10022c14]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000b4e8
jmp 0x1000b4f3
jmp 0x1000b4ed
add esp, 0x18
pop esi
pop edi
ret
mov eax, dword [0x10021390]
mov dword [eax + 0x5ef5bda4], 1
jmp 0x1000b4a8

Function at 0x1000b510
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x1f
mov dword [esp + 0x10], eax
mov ecx, dword [0x10021394]
xor eax, eax
cmp dword [ecx - 0x79c669b3], 1
mov dword [esp + 0x14], eax
je 0x1000b596
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1f
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 3
mov dword [esp + 0x14], eax
jne 0x1000b545
mov eax, dword [0x10021394]
mov dword [eax - 0x79c669b3], 1
mov eax, dword [0x10022c10]
mov ecx, dword [0x10022c0c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000b5c7
jmp 0x1000b5fe
mov eax, dword [0x10022c10]
mov ecx, dword [0x10022c0c]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000b5f8
jmp 0x1000b5fe
add esp, 0x18
pop esi
pop edi
ret
jmp 0x1000b5c7
Function at 0x1000b610
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x1b
mov dword [esp + 0x10], eax
mov ecx, dword [0x10021398]
xor eax, eax
cmp dword [ecx + 0x1c9b2d73], 1
mov dword [esp + 0x14], eax
je 0x1000b698
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1b
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0x8d
mov dword [esp + 0x14], eax
jne 0x1000b645
mov eax, dword [0x10021398]
mov dword [eax + 0x1c9b2d73], 1
add esp, 0x18
pop esi
pop edi
ret

Function at 0x1000b6a0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x1f
mov dword [esp + 0x10], eax
mov ecx, dword [0x1002139c]
xor eax, eax
cmp dword [ecx + 0x556b2458], 1
mov dword [esp + 0x14], eax
je 0x1000b78d
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1f
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0x14
mov dword [esp + 0x14], eax
jne 0x1000b6d5
mov eax, dword [0x10022c08]
mov ecx, dword [0x10022c04]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000b748
jmp 0x1000b793
mov eax, dword [0x1002139c]
mov dword [eax + 0x556b2458], 1
mov eax, dword [0x10022c08]
mov ecx, dword [0x10022c04]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000b788
jmp 0x1000b793
jmp 0x1000b78d
add esp, 0x18
pop esi
pop edi
ret
mov eax, dword [0x1002139c]
mov dword [eax + 0x556b2458], 1
jmp 0x1000b748
Function at 0x1000b900
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov eax, dword [0x10022bf8]
mov ecx, dword [0x10022bf4]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000b946
jmp 0x1000ba04
mov eax, dword [esp + 0x14]
add eax, 0x1b
mov dword [esp + 0xc], eax
mov eax, dword [0x100213a4]
cmp dword [eax + 0x4167ec4b], 1
sete al
mov byte [esp + 0x13], al
mov eax, dword [0x10022bf8]
mov ecx, dword [0x10022bf4]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000b995
jmp 0x1000ba04
mov cl, byte [esp + 0x13]
xor eax, eax
test cl, 1
mov dword [esp + 8], eax
jne 0x1000b9fe
jmp 0x1000b9ad
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x1b
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0xb
mov dword [esp + 8], eax
jne 0x1000b9ad
mov eax, dword [0x100213a4]
mov dword [eax + 0x4167ec4b], 1
add esp, 0x1c
pop esi
pop edi
ret
jmp 0x1000b946

Function at 0x1000ba10
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x18
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
add eax, 0x12
mov dword [esp + 0x10], eax
mov ecx, dword [0x100213a8]
xor eax, eax
cmp dword [ecx - 0x337b965a], 1
mov dword [esp + 0x14], eax
je 0x1000ba96
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov dword [esp], eax
mov dl, byte [edx + eax]
mov byte [esp + 7], dl
mov edi, 0x12
xor edx, edx
div edi
mov eax, dword [esp]
mov edi, edx
mov dl, byte [esp + 7]
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0xa
mov dword [esp + 0x14], eax
jne 0x1000ba45
mov eax, dword [0x100213a8]
mov dword [eax - 0x337b965a], 1
mov eax, dword [0x10022bf0]
mov ecx, dword [0x10022bec]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000bac7
jmp 0x1000bafe
mov eax, dword [0x10022bf0]
mov ecx, dword [0x10022bec]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000baf8
jmp 0x1000bafe
add esp, 0x18
pop esi
pop edi
ret
jmp 0x1000bac7
Function at 0x1000bb10
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov ecx, dword [esp + 0x1c]
mov dword [esp + 4], ecx
add eax, 0x10
mov dword [esp + 8], eax
mov ecx, dword [0x100213ac]
xor eax, eax
cmp dword [ecx + 0x7224b6f3], 1
mov dword [esp + 0xc], eax
je 0x1000bbe7
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
mov esi, dword [esp]
mov edx, dword [esp + 8]
mov dl, byte [edx + eax]
mov edi, eax
and edi, 0xf
xor dl, byte [esi + edi]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, 0xd
mov dword [esp + 0xc], eax
jne 0x1000bb44
mov eax, dword [0x10022be8]
mov ecx, dword [0x10022be4]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000bba2
jmp 0x1000bc4f
mov eax, dword [0x100213ac]
mov dword [eax + 0x7224b6f3], 1
mov eax, dword [0x10022be8]
mov ecx, dword [0x10022be4]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000bbe2
jmp 0x1000bc4f
jmp 0x1000bbe7
mov eax, dword [0x10022be8]
mov ecx, dword [0x10022be4]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000bc18
jmp 0x1000bc63
mov eax, dword [0x10022be8]
mov ecx, dword [0x10022be4]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
or al, cl
test al, 1
jne 0x1000bc49
jmp 0x1000bc63
add esp, 0x10
pop esi
pop edi
ret
mov eax, dword [0x100213ac]
mov dword [eax + 0x7224b6f3], 1
jmp 0x1000bba2
jmp 0x1000bc18

Function at 0x1001082d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001086c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001086c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001086c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001086c
cmp dword [ecx + 0x74], 0xe
jbe 0x1001086c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001351d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100135ba
push ebx
push esi
call fcn.100134e6
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001347a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10013567
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100135b9
push edi
push eax
call fcn.100114f7
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10013587
call fcn.100114bd
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100135b8
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001347a
add esp, 0x20
test eax, eax
jne 0x100135a6
push edi
call fcn.100114bd
jmp 0x100135ae
push ebx
call fcn.100114bd
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10013827
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001c0a0
push 0x1001c098
push str.FlsAlloc
push 0x1f
call fcn.10013743
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001385b
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001a148]
call esi
jmp 0x10013861
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100138a5
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001c0b0
push 0x1001c0a8
push str.FlsGetValue
push 0x21
call fcn.10013743
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100138dc
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001a148]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x100138e4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001c0b8
push 0x1001c0b0
push str.FlsSetValue
push 0x22
call fcn.10013743
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001391e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001a148]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10018f50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10018f7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10018f7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x406310
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41710b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4042f4
call fcn.00407031
push 4
mov dword [esp + 0x18], 0
call fcn.004080fd
mov edi, eax
add esp, 4
test edi, edi
je 0x406384
push ebx
call fcn.00406f09
mov dword [edi], eax
call fcn.00406cc8
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00406ff2
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406378
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.0040701a
pop ebx
jmp 0x406386
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x408b71
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41adbc]
jne 0x408b7b
repz ret
jmp fcn.0040fb0c