joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005cf80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019d47f
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1005cff4
cmp byte [esi + 1], 0
jne 0x1005d041
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x2d
jb 0x1005cfb4
jmp 0x1005d041
xor ecx, ecx
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x2d
jb 0x1005d000
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x2e]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1005d060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019d47f
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1005d0ce
cmp byte [esi + 1], 0
jne 0x1005d112
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x36
jb 0x1005d090
jmp 0x1005d112
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x36
jb 0x1005d0d3
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x37]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1005d130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, 0x1019d47f
push ebx
push esi
call fcn.10137ff6
cmp byte [0x10183c98], 0
je 0x1005d1a2
cmp byte [0x10183c99], 0
jne 0x1005d1e3
mov byte [0x10183c99], 1
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10183ce4]
xor ebx, dword [0x10183ce0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10183c9a], al
inc esi
cmp esi, 0x46
jb 0x1005d161
jmp 0x1005d1e3
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x10183ce4]
xor ebx, dword [0x10183ce0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x10183c9a], al
inc esi
cmp esi, 0x46
jb 0x1005d1a4
push ecx
mov ecx, dword [ebp + 8]
push 0x10183cdf
push 0x10183c9a
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1005d210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019d47f
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1005d27e
cmp byte [esi + 1], 0
jne 0x1005d2c2
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x26
jb 0x1005d240
jmp 0x1005d2c2
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x26
jb 0x1005d283
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x27]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1005d2e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019d47f
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1005d34e
cmp byte [esi + 1], 0
jne 0x1005d392
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x2b
jb 0x1005d310
jmp 0x1005d392
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x2b
jb 0x1005d353
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x2c]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1005d3b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019d47f
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1005d424
cmp byte [esi + 1], 0
jne 0x1005d471
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x34
jb 0x1005d3e4
jmp 0x1005d471
xor ecx, ecx
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x34
jb 0x1005d430
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x35]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1005d490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019d47f
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1005d4fe
cmp byte [esi + 1], 0
jne 0x1005d542
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x2c
jb 0x1005d4c0
jmp 0x1005d542
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x2c
jb 0x1005d503
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x2d]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1005d560
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019d47f
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1005d5ce
cmp byte [esi + 1], 0
jne 0x1005d612
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x1a
jb 0x1005d590
jmp 0x1005d612
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x1a
jb 0x1005d5d3
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1b]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1005d630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019d47f
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1005d6a4
cmp byte [esi + 1], 0
jne 0x1005d6f1
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x1f
jb 0x1005d664
jmp 0x1005d6f1
xor ecx, ecx
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x1f
jb 0x1005d6b0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x20]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1005d710
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019d47f
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1005d77e
cmp byte [esi + 1], 0
jne 0x1005d7c2
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x29
jb 0x1005d740
jmp 0x1005d7c2
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x29
jb 0x1005d783
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x2a]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1005d7e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019d47f
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1005d84e
cmp byte [esi + 1], 0
jne 0x1005d892
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x6c]
xor ebx, dword [esi + 0x68]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x66
jb 0x1005d810
jmp 0x1005d892
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x6c]
xor ebx, dword [esi + 0x68]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x66
jb 0x1005d853
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x67]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1005d8b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019d47f
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1005d91e
cmp byte [esi + 1], 0
jne 0x1005d962
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x1e
jb 0x1005d8e0
jmp 0x1005d962
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x1e
jb 0x1005d923
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1f]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1005d980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019d47f
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1005d9f4
cmp byte [esi + 1], 0
jne 0x1005da41
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x2a
jb 0x1005d9b4
jmp 0x1005da41
xor ecx, ecx
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x2a
jb 0x1005da00
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x2b]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1005da60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019d47f
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1005dace
cmp byte [esi + 1], 0
jne 0x1005db12
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x54]
xor ebx, dword [esi + 0x50]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x47
jb 0x1005da90
jmp 0x1005db12
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x54]
xor ebx, dword [esi + 0x50]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x47
jb 0x1005dad3
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x48]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1005db30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019d47f
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1005dba4
cmp byte [esi + 1], 0
jne 0x1005dbf1
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x23
jb 0x1005db64
jmp 0x1005dbf1
xor ecx, ecx
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x23
jb 0x1005dbb0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x24]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100697d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x101a157a
call fcn.10137ff6
cmp dword [ebp + 0xc], 1
jne 0x10069802
push 0
push 0
push dword [ebp + 0x10]
push 0x100696f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
xor eax, eax
pop ebp
ret 0xc

Function at 0x1006a9b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x10160380]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov ecx, 0x1019db39
call fcn.10137ff6
cmp dword [esi + 0x38], 0
je 0x1006aa78
cmp byte [esi + 0x3d], 0
je 0x1006aa78
mov eax, dword [esi]
mov ecx, esi
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x1006aa66
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x1006aa2d
sub eax, 1
je 0x1006aa31
sub eax, 2
jne 0x1006aa66
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100dfbc8
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1006aa4f
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1006aa66
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100dfbc8
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100dfbc8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100dfbc8
mov esp, ebp
pop ebp
ret
Function at 0x1006c680
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ecx, 0x101a157f
call fcn.10137ff6
add edi, 0x60
mov dword [ebp - 4], 0x41
nop dword [eax]
mov byte [edi - 0x60], 0
lea eax, [edi + 0x90]
mov dword [edi - 0x5c], 0
mov dword [edi - 0x58], 0
mov dword [edi - 0x54], 0
mov dword [edi - 0x50], 0
mov dword [edi - 0x4c], 0
mov word [edi - 0x48], 0
mov byte [edi - 0x46], 0
mov dword [edi - 0x44], 0
mov dword [edi - 0x40], 0
mov dword [edi - 0x3c], 0
mov dword [edi - 0x38], 0
mov dword [edi - 0x34], 0
mov dword [edi - 0x30], 0
mov dword [edi - 0x2c], 0
mov dword [edi - 0x28], 0
mov dword [edi - 0x24], 0
mov dword [edi - 0x20], 0
mov dword [edi - 0x1c], 0
mov dword [edi - 0x18], 0
mov dword [edi - 0x14], 0
mov dword [edi - 0x10], 0
mov dword [edi - 0xc], 0
mov dword [edi - 8], 0
mov dword [edi - 4], 0
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x74], 0
push 0x60
mov dword [edi + 0x78], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x80], 0
push 0
push eax
mov dword [edi + 0x84], 0
mov dword [edi + 0x88], 0
mov dword [edi + 0x8c], 0
call sub.VCRUNTIME140.dll_memset
push 0x60
lea eax, [edi + 0xf0]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x1800
lea esi, [edi + 0x150]
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0x24
mov ebx, 0x80
nop word [eax + eax]
push 0x30
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
add esi, 0x30
sub ebx, 1
jne 0x1006c890
push 0x2d8
lea esi, [edi + 0x1950]
push ebx
push esi
call sub.VCRUNTIME140.dll_memset
mov ecx, esi
call fcn.1006c5f0
push 0x1800
lea esi, [edi + 0x1c28]
push ebx
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
mov ebx, 0x80
push 0x30
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
add esi, 0x30
sub ebx, 1
jne 0x1006c8d8
push 0x60
lea eax, [edi + 0x3428]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
mov dword [edi + 0x3488], ebx
lea esi, [edi + 0x3490]
mov dword [edi + 0x348c], ebx
push 8
mov dword [esi], ebx
mov dword [edi + 0x3494], ebx
mov dword [edi + 0x3498], ebx
mov dword [edi + 0x349c], ebx
mov dword [edi + 0x34a0], ebx
call fcn.100dfc8b
add esp, 0x10
add edi, 0x3504
sub dword [ebp - 4], 1
mov dword [eax + 4], ebx
mov dword [esi], eax
mov dword [eax], esi
jne 0x1006c6a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret