joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100572c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10451f40], 0
push esi
jne 0x10057320
mov byte [0x10451f40], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x10451f6c]
xor ebx, dword [0x10451f68]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x10451f41], cl
inc eax
cmp eax, 0x21
jb 0x100572e0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x10451f61
push 0x10451f41
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10057340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104a1890], 0
push esi
jne 0x100573a0
mov byte [0x104a1890], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104a18d4]
xor ebx, dword [0x104a18d0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104a1891], cl
inc eax
cmp eax, 0x3c
jb 0x10057360
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104a18cc
push 0x104a1891
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100573c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10452020], 0
push esi
jne 0x10057420
mov byte [0x10452020], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x10452054]
xor ebx, dword [0x10452050]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x10452021], cl
inc eax
cmp eax, 0x2a
jb 0x100573e0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x1045204a
push 0x10452021
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10064710
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104a9440], 0
push esi
jne 0x10064770
mov byte [0x104a9440], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104a9454]
xor ebx, dword [0x104a9450]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104a9441], cl
inc eax
cmp eax, 0xd
jb 0x10064730
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104a944d
push 0x104a9441
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10064790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104a6c60], 0
push esi
jne 0x100647f0
mov byte [0x104a6c60], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104a6c74]
xor ebx, dword [0x104a6c70]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104a6c61], cl
inc eax
cmp eax, 0xd
jb 0x100647b0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104a6c6d
push 0x104a6c61
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10064810
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1049b070], 0
push esi
jne 0x10064870
mov byte [0x1049b070], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x1049b08c]
xor ebx, dword [0x1049b088]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x1049b071], cl
inc eax
cmp eax, 0x10
jb 0x10064830
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x1049b080
push 0x1049b071
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10064890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10493550], 0
push esi
jne 0x100648f0
mov byte [0x10493550], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x10493574]
xor ebx, dword [0x10493570]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x10493551], cl
inc eax
cmp eax, 0x1d
jb 0x100648b0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x1049356d
push 0x10493551
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10064910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x10493390], 0
push esi
jne 0x10064970
mov byte [0x10493390], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104933ac]
xor ebx, dword [0x104933a8]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x10493391], cl
inc eax
cmp eax, 0x12
jb 0x10064930
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104933a2
push 0x10493391
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10064990
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104a9320], 0
push esi
jne 0x100649f0
mov byte [0x104a9320], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104a9344]
xor ebx, dword [0x104a9340]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104a9321], cl
inc eax
cmp eax, 0x1c
jb 0x100649b0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104a933c
push 0x104a9321
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10064a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1049afd0], 0
push esi
jne 0x10064a70
mov byte [0x1049afd0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x1049b00c]
xor ebx, dword [0x1049b008]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x1049afd1], cl
inc eax
cmp eax, 0x32
jb 0x10064a30
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x1049b002
push 0x1049afd1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10067d70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10318a15
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1043900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x104a7030], 0
jne 0x10067e07
mov byte [0x104a7030], 1
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x104a704c]
xor ebx, dword [0x104a7048]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, bl
xor cl, byte [esi + 0x104a7031]
mov byte [esi + 0x104a7031], cl
inc esi
cmp esi, 0x14
jb 0x10067db0
push ecx
push 0x104a7044
push 0x104a7031
lea ecx, [ebp - 0x40]
call fcn.1001a620
mov dword [ebp - 4], 0
lea edi, [ebp - 0x40]
cmp dword [ebp - 0x2c], 0x10
cmovae edi, dword [ebp - 0x40]
cmp byte [0x1043a180], 0
jne 0x10067e97
mov byte [0x1043a180], 1
xor esi, esi
nop
xor edx, edx
mov ebx, esi
xor edx, dword [0x1043a194]
xor ebx, dword [0x1043a190]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
xor edx, ecx
shl eax, 0xd
xor ebx, eax
mov ecx, edx
mov eax, ebx
shrd eax, ecx, 7
shr ecx, 7
xor ebx, eax
xor edx, ecx
mov ecx, ebx
shld edx, ecx, 0x11
shl ecx, 0x11
xor cl, bl
xor cl, byte [esi + 0x1043a181]
mov byte [esi + 0x1043a181], cl
inc esi
cmp esi, 0xe
jb 0x10067e40
push ecx
push 0x1043a18e
push 0x1043a181
lea ecx, [ebp - 0x28]
call fcn.1001a620
mov byte [ebp - 4], 1
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
push 0
cmovae eax, dword [ebp - 0x28]
push edi
push eax
call fcn.10171b70
mov ecx, dword [0x1060b504]
mov byte [ebp - 4], 0
mov dword [ecx + 0x120], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x10067f02
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10067ef8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10067f41
push ecx
push edx
call fcn.102bb95a
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
cmp ecx, 0x10
jb 0x10067f51
mov edx, dword [ebp - 0x40]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10067f47
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10067f47
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.102bb95a
add esp, 8
mov ecx, dword [0x1060b504]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.10036db0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.102bb91c
mov esp, ebp
pop ebp
ret
Function at 0x10068170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1043d500], 0
push esi
jne 0x100681d0
mov byte [0x1043d500], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x1043d51c]
xor ebx, dword [0x1043d518]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x1043d501], cl
inc eax
cmp eax, 0x15
jb 0x10068190
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x1043d515
push 0x1043d501
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100681f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1049afa0], 0
push esi
jne 0x10068250
mov byte [0x1049afa0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x1049afcc]
xor ebx, dword [0x1049afc8]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x1049afa1], cl
inc eax
cmp eax, 0x23
jb 0x10068210
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x1049afc3
push 0x1049afa1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10068270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104a6af0], 0
push esi
jne 0x100682d0
mov byte [0x104a6af0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104a6b1c]
xor ebx, dword [0x104a6b18]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104a6af1], cl
inc eax
cmp eax, 0x21
jb 0x10068290
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104a6b11
push 0x104a6af1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100682f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104a93f0], 0
push esi
jne 0x10068350
mov byte [0x104a93f0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104a9414]
xor ebx, dword [0x104a9410]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104a93f1], cl
inc eax
cmp eax, 0x1b
jb 0x10068310
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104a940b
push 0x104a93f1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10068370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104a1840], 0
push esi
jne 0x100683d0
mov byte [0x104a1840], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104a185c]
xor ebx, dword [0x104a1858]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104a1841], cl
inc eax
cmp eax, 0x15
jb 0x10068390
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104a1855
push 0x104a1841
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100683f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1049b250], 0
push esi
jne 0x10068450
mov byte [0x1049b250], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x1049b274]
xor ebx, dword [0x1049b270]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x1049b251], cl
inc eax
cmp eax, 0x18
jb 0x10068410
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x1049b268
push 0x1049b251
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10068470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104a6cb0], 0
push esi
jne 0x100684d0
mov byte [0x104a6cb0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104a6cdc]
xor ebx, dword [0x104a6cd8]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104a6cb1], cl
inc eax
cmp eax, 0x23
jb 0x10068490
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104a6cd3
push 0x104a6cb1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100684f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1043a0a0], 0
push esi
jne 0x10068550
mov byte [0x1043a0a0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x1043a0b4]
xor ebx, dword [0x1043a0b0]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x1043a0a1], cl
inc eax
cmp eax, 0xd
jb 0x10068510
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x1043a0ad
push 0x1043a0a1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10068570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1049b030], 0
push esi
jne 0x100685d0
mov byte [0x1049b030], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x1049b044]
xor ebx, dword [0x1049b040]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x1049b031], cl
inc eax
cmp eax, 0xb
jb 0x10068590
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x1049b03b
push 0x1049b031
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10068600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104a1940], 0
push esi
jne 0x10068660
mov byte [0x104a1940], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104a1994]
xor ebx, dword [0x104a1990]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104a1941], cl
inc eax
cmp eax, 0x49
jb 0x10068620
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104a1989
push 0x104a1941
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10068680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1049b0c0], 0
push esi
jne 0x100686e0
mov byte [0x1049b0c0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x1049b0fc]
xor ebx, dword [0x1049b0f8]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x1049b0c1], cl
inc eax
cmp eax, 0x32
jb 0x100686a0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x1049b0f2
push 0x1049b0c1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10068700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1043a0f0], 0
push esi
jne 0x10068760
mov byte [0x1043a0f0], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x1043a15c]
xor ebx, dword [0x1043a158]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x1043a0f1], cl
inc eax
cmp eax, 0x61
jb 0x10068720
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x1043a151
push 0x1043a0f1
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10068780
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1043a420], 0
push esi
jne 0x100687e0
mov byte [0x1043a420], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x1043a43c]
xor ebx, dword [0x1043a438]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x1043a421], cl
inc eax
cmp eax, 0x11
jb 0x100687a0
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x1043a431
push 0x1043a421
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10068800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x104a1e00], 0
push esi
jne 0x10068860
mov byte [0x104a1e00], 1
xor eax, eax
push ebx
nop word [eax + eax]
xor esi, esi
mov ebx, eax
xor esi, dword [0x104a1e14]
xor ebx, dword [0x104a1e10]
xor esi, 0xd28f2c5
xor ebx, 0x1de26cd5
mov edx, esi
mov ecx, ebx
shld edx, ecx, 0xd
shl ecx, 0xd
xor esi, edx
xor ebx, ecx
mov ecx, ebx
shrd ecx, esi, 7
xor cl, bl
xor byte [eax + 0x104a1e01], cl
inc eax
cmp eax, 0xc
jb 0x10068820
pop ebx
push ecx
mov ecx, dword [ebp + 8]
push 0x104a1e0c
push 0x104a1e01
call fcn.1001a620
mov eax, dword [ebp + 8]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10068e90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x10068ebc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10068ee4
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x10068eea
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x10068f52
jg 0x10068f01
test esi, esi
je 0x10068f52
test ecx, ecx
jl 0x10068f4d
jg 0x10068f0b
test eax, eax
je 0x10068f4d
cmp edi, ecx
jg 0x10068f1f
jl 0x10068f15
cmp esi, eax
jae 0x10068f1f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x10068f55
mov ecx, dword [ebp + 8]
jmp 0x10068f5f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x10068f79
jg 0x10068f5f
test esi, esi
je 0x10068f79
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x10068f79
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10068f90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
sub esp, 0xc
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
test eax, eax
jg 0x10068fbb
jl 0x10068fae
test ecx, ecx
jne 0x10068fbb
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10068fd7
push eax
push ecx
push dword [ebp + 8]
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov eax, dword [eax]
mov dword [esp + 0x14], eax
test eax, eax
je 0x10069029
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [esp + 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10069030
mov edi, dword [ebp + 8]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [esp + 0x18]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x20], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [esp + 0x14]
jmp 0x10069033
lea eax, [ebx + 0x2c]
mov dword [esp + 0x10], eax
mov esi, dword [ebp + 8]
cmp dword [ebx + 0x4c], 0
je 0x100690a6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1006905d
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x10069094
nop word [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x100690a6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x10069070
test edi, edi
je 0x100690a6
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc