joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c1c90
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1031a32a
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0
mov eax, dword fs:[0x2c]
mov edx, dword [0x104c14e0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x106119f8]
cmp eax, dword [edx + 4]
jg 0x100c1d1b
mov eax, dword [0x10611720]
add eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x106119f8
call fcn.102bba07
add esp, 4
cmp dword [0x106119f8], 0xffffffff
jne 0x100c1cf6
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x2c]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x2c], xmm0
push 0xc
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x30], 1
call fcn.1001a120
mov esi, 0x103f6554
jmp 0x100c1d70
mov al, byte [esi]
lea ecx, [ebp - 0x2c]
xor al, 0xa5
movzx eax, al
push eax
call fcn.1001a280
add esi, 2
cmp esi, 0x103f6568
jne 0x100c1d70
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
cmovae esi, dword [ebp - 0x2c]
test edi, edi
je 0x100c1e37
push edi
push 0
push esi
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
je 0x100c1e37
sub eax, esi
cmp eax, 0xffffffff
je 0x100c1e37
jmp 0x100c1dc2
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
mov edx, 1
lea ecx, [ebp - 0x2c]
cmovae esi, dword [ebp - 0x2c]
add esi, eax
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
sub esi, eax
mov eax, edi
sub eax, esi
cmp eax, edx
cmovb edx, eax
cmp dword [ebp - 0x18], 0x10
cmovae ecx, dword [ebp - 0x2c]
sub edi, edx
add ecx, esi
mov eax, edi
sub eax, esi
inc eax
push eax
lea eax, [ecx + edx]
push eax
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
cmovae esi, dword [ebp - 0x2c]
test edi, edi
je 0x100c1e37
push edi
push 0
push esi
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
je 0x100c1e37
sub eax, esi
cmp eax, 0xffffffff
jne 0x100c1dc2
jmp 0x100c1e37
mov edi, dword [ebp - 0x34]
lea esi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
mov ecx, edi
cmovae esi, dword [ebp - 0x2c]
mov eax, dword [edi]
mov eax, dword [eax + 0x44]
call eax
mov edx, esi
mov ecx, eax
call fcn.100d0060
mov ecx, dword [ebp - 0x18]
mov dword [0x10611720], eax
cmp ecx, 0x10
jb 0x100c1e94
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100c1e88
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100c1e88
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.102bb95a
add esp, 8
jmp 0x100c1e94
push 0x106119f8
call fcn.102bb9b6
add esp, 4
jmp 0x100c1cf6
Function at 0x100c1eb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1031a38a
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0
mov eax, dword fs:[0x2c]
mov edx, dword [0x104c14e0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x106117ec]
cmp eax, dword [edx + 4]
jg 0x100c1f3b
mov eax, dword [0x106116c8]
add eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x106117ec
call fcn.102bba07
add esp, 4
cmp dword [0x106117ec], 0xffffffff
jne 0x100c1f16
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x2c]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x2c], xmm0
push 0x10
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x30], 1
call fcn.1001a120
mov esi, 0x103f5c70
jmp 0x100c1f90
mov al, byte [esi]
lea ecx, [ebp - 0x2c]
xor al, 0xa5
movzx eax, al
push eax
call fcn.1001a280
add esi, 2
cmp esi, 0x103f5c8c
jne 0x100c1f90
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
cmovae esi, dword [ebp - 0x2c]
test edi, edi
je 0x100c2057
push edi
push 0
push esi
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
je 0x100c2057
sub eax, esi
cmp eax, 0xffffffff
je 0x100c2057
jmp 0x100c1fe2
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
mov edx, 1
lea ecx, [ebp - 0x2c]
cmovae esi, dword [ebp - 0x2c]
add esi, eax
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
sub esi, eax
mov eax, edi
sub eax, esi
cmp eax, edx
cmovb edx, eax
cmp dword [ebp - 0x18], 0x10
cmovae ecx, dword [ebp - 0x2c]
sub edi, edx
add ecx, esi
mov eax, edi
sub eax, esi
inc eax
push eax
lea eax, [ecx + edx]
push eax
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
cmovae esi, dword [ebp - 0x2c]
test edi, edi
je 0x100c2057
push edi
push 0
push esi
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
je 0x100c2057
sub eax, esi
cmp eax, 0xffffffff
jne 0x100c1fe2
jmp 0x100c2057
mov edi, dword [ebp - 0x34]
lea esi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
mov ecx, edi
cmovae esi, dword [ebp - 0x2c]
mov eax, dword [edi]
mov eax, dword [eax + 0x44]
call eax
mov edx, esi
mov ecx, eax
call fcn.100d0060
mov ecx, dword [ebp - 0x18]
mov dword [0x106116c8], eax
cmp ecx, 0x10
jb 0x100c20b4
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100c20a8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100c20a8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.102bb95a
add esp, 8
jmp 0x100c20b4
push 0x106117ec
call fcn.102bb9b6
add esp, 4
jmp 0x100c1f16
Function at 0x100c20d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1031a3ea
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0
mov eax, dword fs:[0x2c]
mov edx, dword [0x104c14e0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x10611a78]
cmp eax, dword [edx + 4]
jg 0x100c215b
mov eax, dword [0x10611904]
add eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x10611a78
call fcn.102bba07
add esp, 4
cmp dword [0x10611a78], 0xffffffff
jne 0x100c2136
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x2c]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x2c], xmm0
push 0x13
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x30], 1
call fcn.1001a120
mov esi, 0x103f5fe0
jmp 0x100c21b0
mov al, byte [esi]
lea ecx, [ebp - 0x2c]
xor al, 0xa5
movzx eax, al
push eax
call fcn.1001a280
add esi, 2
cmp esi, 0x103f6002
jne 0x100c21b0
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
cmovae esi, dword [ebp - 0x2c]
test edi, edi
je 0x100c2277
push edi
push 0
push esi
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
je 0x100c2277
sub eax, esi
cmp eax, 0xffffffff
je 0x100c2277
jmp 0x100c2202
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
mov edx, 1
lea ecx, [ebp - 0x2c]
cmovae esi, dword [ebp - 0x2c]
add esi, eax
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
sub esi, eax
mov eax, edi
sub eax, esi
cmp eax, edx
cmovb edx, eax
cmp dword [ebp - 0x18], 0x10
cmovae ecx, dword [ebp - 0x2c]
sub edi, edx
add ecx, esi
mov eax, edi
sub eax, esi
inc eax
push eax
lea eax, [ecx + edx]
push eax
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
cmovae esi, dword [ebp - 0x2c]
test edi, edi
je 0x100c2277
push edi
push 0
push esi
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
je 0x100c2277
sub eax, esi
cmp eax, 0xffffffff
jne 0x100c2202
jmp 0x100c2277
mov edi, dword [ebp - 0x34]
lea esi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
mov ecx, edi
cmovae esi, dword [ebp - 0x2c]
mov eax, dword [edi]
mov eax, dword [eax + 0x44]
call eax
mov edx, esi
mov ecx, eax
call fcn.100d0060
mov ecx, dword [ebp - 0x18]
mov dword [0x10611904], eax
cmp ecx, 0x10
jb 0x100c22d4
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100c22c8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100c22c8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.102bb95a
add esp, 8
jmp 0x100c22d4
push 0x10611a78
call fcn.102bb9b6
add esp, 4
jmp 0x100c2136
Function at 0x100c22f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1031a44a
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x28
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0
mov eax, dword fs:[0x2c]
mov edx, dword [0x104c14e0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x1061185c]
cmp eax, dword [edx + 4]
jg 0x100c237b
mov eax, dword [0x10611844]
add eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0x1061185c
call fcn.102bba07
add esp, 4
cmp dword [0x1061185c], 0xffffffff
jne 0x100c2356
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x2c]
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x2c], xmm0
push 0x14
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
mov dword [ebp - 0x30], 1
call fcn.1001a120
mov esi, 0x103f5cc4
jmp 0x100c23d0
mov al, byte [esi]
lea ecx, [ebp - 0x2c]
xor al, 0xa5
movzx eax, al
push eax
call fcn.1001a280
add esi, 2
cmp esi, 0x103f5ce8
jne 0x100c23d0
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
cmovae esi, dword [ebp - 0x2c]
test edi, edi
je 0x100c2497
push edi
push 0
push esi
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
je 0x100c2497
sub eax, esi
cmp eax, 0xffffffff
je 0x100c2497
jmp 0x100c2422
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
mov edx, 1
lea ecx, [ebp - 0x2c]
cmovae esi, dword [ebp - 0x2c]
add esi, eax
cmp dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
sub esi, eax
mov eax, edi
sub eax, esi
cmp eax, edx
cmovb edx, eax
cmp dword [ebp - 0x18], 0x10
cmovae ecx, dword [ebp - 0x2c]
sub edi, edx
add ecx, esi
mov eax, edi
sub eax, esi
inc eax
push eax
lea eax, [ecx + edx]
push eax
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
cmovae esi, dword [ebp - 0x2c]
test edi, edi
je 0x100c2497
push edi
push 0
push esi
call sub.VCRUNTIME140.dll_memchr
add esp, 0xc
test eax, eax
je 0x100c2497
sub eax, esi
cmp eax, 0xffffffff
jne 0x100c2422
jmp 0x100c2497
mov edi, dword [ebp - 0x34]
lea esi, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0x10
mov ecx, edi
cmovae esi, dword [ebp - 0x2c]
mov eax, dword [edi]
mov eax, dword [eax + 0x44]
call eax
mov edx, esi
mov ecx, eax
call fcn.100d0060
mov ecx, dword [ebp - 0x18]
mov dword [0x10611844], eax
cmp ecx, 0x10
jb 0x100c24f4
mov edx, dword [ebp - 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100c24e8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100c24e8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.102bb95a
add esp, 8
jmp 0x100c24f4
push 0x1061185c
call fcn.102bb9b6
add esp, 4
jmp 0x100c2356
Function at 0x100c2510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1031a4a1
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x44], ebx
mov eax, dword fs:[0x2c]
mov edx, dword [0x104c14e0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x10611724]
cmp eax, dword [edx + 4]
jg 0x100c2580
mov eax, dword [0x10611a00]
mov eax, dword [eax + ebx]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
ret
push 0x10611724
call fcn.102bba07
add esp, 4
cmp dword [0x10611724], 0xffffffff
jne 0x100c255c
mov dword [ebp - 4], 0
cmp byte [0x104ac400], 0
jne 0x100c260a
mov byte [0x104ac400], 1
xor esi, esi
jmp 0x100c25b1
xor edx, edx
mov ebx, esi
xor edx, dword [0x104ac414]
xor ebx, dword [0x104ac410]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104ac401]
xor cl, bl
mov byte [esi + 0x104ac401], cl
inc esi
cmp esi, 0xc
jb 0x100c25b1
jmp 0x100c260a
push ecx
push 0x104ac40c
push 0x104ac401
lea ecx, [ebp - 0x40]
call fcn.1001a620
mov byte [ebp - 4], 1
lea edi, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae edi, dword [ebp - 0x40]
cmp byte [0x104aab40], 0
jne 0x100c2699
mov byte [0x104aab40], 1
xor esi, esi
jmp 0x100c2640
xor edx, edx
mov ebx, esi
xor edx, dword [0x104aab54]
xor ebx, dword [0x104aab50]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104aab41]
xor cl, bl
mov byte [esi + 0x104aab41], cl
inc esi
cmp esi, 0xb
jb 0x100c2640
jmp 0x100c2699
push ecx
push 0x104aab4b
push 0x104aab41
lea ecx, [ebp - 0x28]
call fcn.1001a620
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push 0
cmovae eax, dword [ebp - 0x28]
push edi
push eax
call fcn.10171b70
lea ecx, [ebp - 0x28]
mov dword [0x10611a00], eax
call fcn.10019dd0
lea ecx, [ebp - 0x40]
call fcn.10019dd0
push 0x10611724
call fcn.102bb9b6
mov eax, dword [0x10611a00]
add esp, 4
mov ecx, dword [ebp - 0x44]
mov eax, dword [eax + ecx]
jmp 0x100c2564
Function at 0x100c2700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1031a4f1
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x44], ebx
mov eax, dword fs:[0x2c]
mov edx, dword [0x104c14e0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x10611948]
cmp eax, dword [edx + 4]
jg 0x100c276f
mov eax, dword [0x10611900]
add eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
ret
push 0x10611948
call fcn.102bba07
add esp, 4
cmp dword [0x10611948], 0xffffffff
jne 0x100c274c
mov dword [ebp - 4], 0
cmp byte [0x104a9670], 0
jne 0x100c27f9
mov byte [0x104a9670], 1
xor esi, esi
jmp 0x100c27a0
xor edx, edx
mov ebx, esi
xor edx, dword [0x104a968c]
xor ebx, dword [0x104a9688]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104a9671]
xor cl, bl
mov byte [esi + 0x104a9671], cl
inc esi
cmp esi, 0x11
jb 0x100c27a0
jmp 0x100c27f9
push ecx
push 0x104a9681
push 0x104a9671
lea ecx, [ebp - 0x40]
call fcn.1001a620
mov byte [ebp - 4], 1
lea edi, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae edi, dword [ebp - 0x40]
cmp byte [0x104abd50], 0
jne 0x100c2889
mov byte [0x104abd50], 1
xor esi, esi
jmp 0x100c2830
xor edx, edx
mov ebx, esi
xor edx, dword [0x104abd64]
xor ebx, dword [0x104abd60]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104abd51]
xor cl, bl
mov byte [esi + 0x104abd51], cl
inc esi
cmp esi, 0xb
jb 0x100c2830
jmp 0x100c2889
push ecx
push 0x104abd5b
push 0x104abd51
lea ecx, [ebp - 0x28]
call fcn.1001a620
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push 0
cmovae eax, dword [ebp - 0x28]
push edi
push eax
call fcn.10171b70
lea ecx, [ebp - 0x28]
mov dword [0x10611900], eax
call fcn.10019dd0
lea ecx, [ebp - 0x40]
call fcn.10019dd0
push 0x10611948
call fcn.102bb9b6
mov eax, dword [0x10611900]
add esp, 4
add eax, dword [ebp - 0x44]
jmp 0x100c2753
Function at 0x100c28f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1031a541
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x44], ebx
mov eax, dword fs:[0x2c]
mov edx, dword [0x104c14e0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x106116e8]
cmp eax, dword [edx + 4]
jg 0x100c295f
mov eax, dword [0x10611864]
add eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
ret
push 0x106116e8
call fcn.102bba07
add esp, 4
cmp dword [0x106116e8], 0xffffffff
jne 0x100c293c
mov dword [ebp - 4], 0
cmp byte [0x104aae10], 0
jne 0x100c29e9
mov byte [0x104aae10], 1
xor esi, esi
jmp 0x100c2990
xor edx, edx
mov ebx, esi
xor edx, dword [0x104aae24]
xor ebx, dword [0x104aae20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104aae11]
xor cl, bl
mov byte [esi + 0x104aae11], cl
inc esi
cmp esi, 0xd
jb 0x100c2990
jmp 0x100c29e9
push ecx
push 0x104aae1d
push 0x104aae11
lea ecx, [ebp - 0x40]
call fcn.1001a620
mov byte [ebp - 4], 1
lea edi, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae edi, dword [ebp - 0x40]
cmp byte [0x104ab350], 0
jne 0x100c2a79
mov byte [0x104ab350], 1
xor esi, esi
jmp 0x100c2a20
xor edx, edx
mov ebx, esi
xor edx, dword [0x104ab364]
xor ebx, dword [0x104ab360]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104ab351]
xor cl, bl
mov byte [esi + 0x104ab351], cl
inc esi
cmp esi, 0xb
jb 0x100c2a20
jmp 0x100c2a79
push ecx
push 0x104ab35b
push 0x104ab351
lea ecx, [ebp - 0x28]
call fcn.1001a620
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push 0
cmovae eax, dword [ebp - 0x28]
push edi
push eax
call fcn.10171b70
lea ecx, [ebp - 0x28]
mov dword [0x10611864], eax
call fcn.10019dd0
lea ecx, [ebp - 0x40]
call fcn.10019dd0
push 0x106116e8
call fcn.102bb9b6
mov eax, dword [0x10611864]
add esp, 4
add eax, dword [ebp - 0x44]
jmp 0x100c2943
Function at 0x100c2ae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1031a591
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x44], ebx
mov eax, dword fs:[0x2c]
mov edx, dword [0x104c14e0]
mov edx, dword [eax + edx*4]
mov eax, dword [0x106119cc]
cmp eax, dword [edx + 4]
jg 0x100c2b4f
mov eax, dword [0x106118f8]
add eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
ret
push 0x106119cc
call fcn.102bba07
add esp, 4
cmp dword [0x106119cc], 0xffffffff
jne 0x100c2b2c
mov dword [ebp - 4], 0
cmp byte [0x104a9e20], 0
jne 0x100c2bd9
mov byte [0x104a9e20], 1
xor esi, esi
jmp 0x100c2b80
xor edx, edx
mov ebx, esi
xor edx, dword [0x104a9e34]
xor ebx, dword [0x104a9e30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104a9e21]
xor cl, bl
mov byte [esi + 0x104a9e21], cl
inc esi
cmp esi, 0xd
jb 0x100c2b80
jmp 0x100c2bd9
push ecx
push 0x104a9e2d
push 0x104a9e21
lea ecx, [ebp - 0x40]
call fcn.1001a620
mov byte [ebp - 4], 1
lea edi, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae edi, dword [ebp - 0x40]
cmp byte [0x104aa970], 0
jne 0x100c2c69
mov byte [0x104aa970], 1
xor esi, esi
jmp 0x100c2c10
xor edx, edx
mov ebx, esi
xor edx, dword [0x104aa984]
xor ebx, dword [0x104aa980]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, byte [esi + 0x104aa971]
xor cl, bl
mov byte [esi + 0x104aa971], cl
inc esi
cmp esi, 0xb
jb 0x100c2c10
jmp 0x100c2c69
push ecx
push 0x104aa97b
push 0x104aa971
lea ecx, [ebp - 0x28]
call fcn.1001a620
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push 0
cmovae eax, dword [ebp - 0x28]
push edi
push eax
call fcn.10171b70
lea ecx, [ebp - 0x28]
mov dword [0x106118f8], eax
call fcn.10019dd0
lea ecx, [ebp - 0x40]
call fcn.10019dd0
push 0x106119cc
call fcn.102bb9b6
mov eax, dword [0x106118f8]
add esp, 4
add eax, dword [ebp - 0x44]
jmp 0x100c2b33