joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10111260
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d8b8d
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x1026b040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], edx
mov ebx, ecx
mov dword [ebp - 0x3c], ebx
mov edi, dword [0x1030a44c]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
test edi, edi
jne 0x10111350
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0x18]
mov dword [ebp - 0x30], ebx
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ecx + ebx + 0x78]
add ecx, ebx
mov dword [ebp - 0x38], ecx
cmp ecx, ebx
je 0x1011132a
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x1011132a
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, ebx
sub ecx, 4
dec edx
mov dword [ebp - 0x34], ecx
mov edi, 0xbb9164c9
mov dword [ebp - 0x2c], edx
mov ecx, dword [ecx]
add ecx, ebx
mov bl, byte [ecx]
inc ecx
test bl, bl
je 0x10111320
movsx esi, bl
lea ecx, [ecx + 1]
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
mov bl, byte [ecx - 1]
cmova edx, esi
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x101112f2
mov edx, dword [ebp - 0x2c]
cmp edi, 0xdf5324f1
je 0x1011132e
mov ecx, dword [ebp - 0x34]
mov ebx, dword [eax + 0x18]
test edx, edx
jne 0x101112d8
mov eax, dword [eax]
jmp 0x101112b3
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x3c]
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, esi
add eax, esi
movzx eax, word [eax + edx*2]
mov edi, dword [ecx + eax*4]
add edi, esi
mov dword [0x1030a44c], edi
lea eax, [ebp - 0x28]
mov ecx, 0x102fd068
push eax
call fcn.10032020
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0xf
cmova eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x40]
call edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
mov esi, eax
call fcn.1001d970
test esi, esi
jne 0x1011138f
mov dword [ebx], esi
jmp 0x1011139b
push 0
push dword [ebp - 0x44]
call esi
add esp, 8
mov dword [ebx], eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101c8fef
mov esp, ebp
pop ebp
ret
Function at 0x101127b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d8c83
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1026b040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x20], ecx
mov eax, dword [0x10633ee0]
add eax, 0xfab78433
xor eax, 0xc85d879a
mov eax, dword [eax + 0x14c]
mov dword [ebp - 0x24], eax
mov eax, dword [0x10306540]
test al, 1
jne 0x10112934
or eax, 1
mov dword [0x10306540], eax
mov dword [ebp - 4], 0
mov ebx, dword [0x103030f8]
cmp ebx, dword [0x103030fc]
je 0x10112864
nop dword [eax]
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x10112859
mov esi, dword [eax + 0xc]
mov edi, 0x811c9dc5
xor eax, eax
inc eax
cmp byte [esi + eax], 0
jne 0x10112833
xor edx, edx
test eax, eax
je 0x10112859
movsx ecx, byte [esi + edx]
inc edx
xor ecx, edi
imul edi, ecx, 0x1000193
cmp edx, eax
jb 0x10112840
cmp edi, 0x72e242a1
je 0x10112873
add ebx, 4
cmp ebx, dword [0x103030fc]
jne 0x10112820
mov ecx, dword [ebp - 0x20]
xor eax, eax
mov dword [0x10304c98], eax
jmp 0x10112939
mov eax, dword [ebp - 0x10]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
cmp dword [eax + 4], ebx
jle 0x10112918
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
nop dword [eax]
mov edi, dword [eax]
add edi, ecx
mov ecx, dword [edi + 0x28]
test ecx, ecx
je 0x101128c1
cmp dword [ecx + 4], 0
jle 0x101128c1
push 0
mov edx, 0xa4a37590
call fcn.10115470
add esp, 4
test eax, eax
je 0x101128be
mov ecx, dword [edi + 0x2c]
add ecx, eax
add ebx, ecx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x10]
mov esi, dword [edi]
mov ebx, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [esi + ecx], 0
jne 0x101128d0
xor edx, edx
test ecx, ecx
je 0x101128fc
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, ebx
imul ebx, eax, 0x1000193
cmp edx, ecx
jb 0x101128e0
cmp ebx, 0xa4a37590
je 0x10112924
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc edx
mov ebx, dword [ebp - 0x14]
add ecx, 0x3c
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
cmp edx, dword [eax + 4]
jl 0x10112890
mov ecx, dword [ebp - 0x20]
mov eax, ebx
mov dword [0x10304c98], eax
jmp 0x10112939
mov eax, dword [edi + 0x2c]
add eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
mov dword [0x10304c98], eax
jmp 0x10112939
mov eax, dword [0x10304c98]
mov edx, dword [ebp - 0x24]
test byte [eax + edx], 1
je 0x10112957
inc dword [ecx + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ecx + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10115470
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x10115486
mov esp, ebp
pop ebp
ret
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp dword [eax + 4], ebx
jle 0x10115518
xor ecx, ecx
mov dword [ebp - 0xc], ecx
nop
mov edi, dword [eax]
add edi, ecx
mov ecx, dword [edi + 0x28]
test ecx, ecx
je 0x101154cc
cmp dword [ecx + 4], 0
jle 0x101154cc
push dword [ebp + 8]
call fcn.10115470
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x101154cc
mov eax, dword [edi + 0x2c]
add eax, ecx
add ebx, eax
mov dword [ebp - 4], ebx
mov esi, dword [edi]
mov ebx, 0x811c9dc5
xor eax, eax
inc eax
cmp byte [esi + eax], 0
jne 0x101154d5
xor edx, edx
test eax, eax
je 0x101154f3
movsx ecx, byte [esi + edx]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, eax
jb 0x101154e2
cmp ebx, dword [ebp - 0x14]
je 0x10115521
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
inc eax
mov ebx, dword [ebp - 4]
add ecx, 0x3c
cmp eax, dword [edx + 4]
mov dword [ebp - 8], eax
mov eax, edx
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
jl 0x101154a0
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
test eax, eax
je 0x1011552a
mov dword [eax], edi
mov eax, dword [edi + 0x2c]
add eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10115740
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], ecx
push edi
test esi, esi
je 0x101157d4
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [esi + 4], ecx
jle 0x101157ca
xor eax, eax
mov dword [ebp - 8], eax
mov edi, dword [esi]
mov esi, dword [edi + eax + 4]
add edi, eax
test esi, esi
je 0x101157b7
mov ebx, 0x811c9dc5
xor eax, eax
inc eax
cmp byte [esi + eax], 0
jne 0x10115777
xor edx, edx
test eax, eax
je 0x10115798
movsx ecx, byte [esi + edx]
inc edx
xor ecx, ebx
imul ebx, ecx, 0x1000193
cmp edx, eax
jb 0x10115784
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
cmp ebx, edx
je 0x101157dd
cmp dword [edi], 0xa
jne 0x101157b7
mov ecx, dword [edi + 0x20]
test ecx, ecx
je 0x101157b4
call fcn.10115740
test eax, eax
jne 0x101157d6
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 0xc]
inc ecx
add dword [ebp - 8], 0x3c
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
cmp ecx, dword [esi + 4]
jl 0x10115764
mov esi, dword [esi + 0xc]
mov dword [ebp - 0xc], esi
test esi, esi
jne 0x10115755
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10115c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x102ff5b0], 0
push ebx
push esi
je 0x10115ca4
cmp byte [0x102ff5b1], 0
jne 0x10115ce8
mov byte [0x102ff5b1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102ff69c]
xor ebx, dword [0x102ff698]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102ff5b2], al
inc esi
cmp esi, 0xdf
jb 0x10115c60
jmp 0x10115ce8
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102ff69c]
xor ebx, dword [0x102ff698]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102ff5b2], al
inc esi
cmp esi, 0xdf
jb 0x10115ca6
push ecx
mov ecx, dword [ebp + 8]
push 0x102ff690
push 0x102ff5b2
call fcn.100305a0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10115d10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x102fe198], 0
push ebx
push esi
je 0x10115d81
cmp byte [0x102fe199], 0
jne 0x10115dc2
mov byte [0x102fe199], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102fe1ec]
xor ebx, dword [0x102fe1e8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102fe19a], al
inc esi
cmp esi, 0x49
jb 0x10115d40
jmp 0x10115dc2
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102fe1ec]
xor ebx, dword [0x102fe1e8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102fe19a], al
inc esi
cmp esi, 0x49
jb 0x10115d83
push ecx
mov ecx, dword [ebp + 8]
push 0x102fe1e2
push 0x102fe19a
call fcn.100305a0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10115de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10115e50
cmp byte [esi + 1], 0
jne 0x10115e97
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x4c]
xor ebx, dword [esi + 0x48]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x42
jb 0x10115e10
jmp 0x10115e97
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x4c]
xor ebx, dword [esi + 0x48]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x42
jb 0x10115e56
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x43]
push eax
push edi
call fcn.100305a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10115ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x102fddf8], 0
push ebx
push esi
je 0x10115f31
cmp byte [0x102fddf9], 0
jne 0x10115f72
mov byte [0x102fddf9], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102fde4c]
xor ebx, dword [0x102fde48]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102fddfa], al
inc esi
cmp esi, 0x4e
jb 0x10115ef0
jmp 0x10115f72
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102fde4c]
xor ebx, dword [0x102fde48]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102fddfa], al
inc esi
cmp esi, 0x4e
jb 0x10115f33
push ecx
mov ecx, dword [ebp + 8]
push 0x102fde47
push 0x102fddfa
call fcn.100305a0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10115f90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x102ff148], 0
push ebx
push esi
je 0x10116004
cmp byte [0x102ff149], 0
jne 0x10116048
mov byte [0x102ff149], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102ff1f4]
xor ebx, dword [0x102ff1f0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102ff14a], al
inc esi
cmp esi, 0xa3
jb 0x10115fc0
jmp 0x10116048
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102ff1f4]
xor ebx, dword [0x102ff1f0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102ff14a], al
inc esi
cmp esi, 0xa3
jb 0x10116006
push ecx
mov ecx, dword [ebp + 8]
push 0x102ff1ec
push 0x102ff14a
call fcn.100305a0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10116070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x102fea20], 0
push ebx
push esi
je 0x101160e1
cmp byte [0x102fea21], 0
jne 0x10116122
mov byte [0x102fea21], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102fea6c]
xor ebx, dword [0x102fea68]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + str.:_v_], al
inc esi
cmp esi, 0x46
jb 0x101160a0
jmp 0x10116122
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102fea6c]
xor ebx, dword [0x102fea68]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + str.:_v_], al
inc esi
cmp esi, 0x46
jb 0x101160e3
push ecx
mov ecx, dword [ebp + 8]
push 0x102fea67
push str.:_v_
call fcn.100305a0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10116140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x101161b0
cmp byte [esi + 1], 0
jne 0x101161f7
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x34
jb 0x10116170
jmp 0x101161f7
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x34
jb 0x101161b6
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x35]
push eax
push edi
call fcn.100305a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10116220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10116290
cmp byte [esi + 1], 0
jne 0x101162d7
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x5c]
xor ebx, dword [esi + 0x58]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x52
jb 0x10116250
jmp 0x101162d7
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x5c]
xor ebx, dword [esi + 0x58]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x52
jb 0x10116296
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x53]
push eax
push edi
call fcn.100305a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10116300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x102fd318], 0
push ebx
push esi
je 0x10116374
cmp byte [0x102fd319], 0
jne 0x101163b8
mov byte [0x102fd319], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102fd3dc]
xor ebx, dword [0x102fd3d8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102fd31a], al
inc esi
cmp esi, 0xbe
jb 0x10116330
jmp 0x101163b8
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102fd3dc]
xor ebx, dword [0x102fd3d8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102fd31a], al
inc esi
cmp esi, 0xbe
jb 0x10116376
push ecx
mov ecx, dword [ebp + 8]
push 0x102fd3d7
push 0x102fd31a
call fcn.100305a0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x101163e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10116450
cmp byte [esi + 1], 0
jne 0x10116497
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x4c]
xor ebx, dword [esi + 0x48]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x40
jb 0x10116410
jmp 0x10116497
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x4c]
xor ebx, dword [esi + 0x48]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x40
jb 0x10116456
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x41]
push eax
push edi
call fcn.100305a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x101164c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x102fe410], 0
push ebx
push esi
je 0x10116531
cmp byte [0x102fe411], 0
jne 0x10116572
mov byte [0x102fe411], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102fe494]
xor ebx, dword [0x102fe490]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102fe412], al
inc esi
cmp esi, 0x7d
jb 0x101164f0
jmp 0x10116572
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102fe494]
xor ebx, dword [0x102fe490]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102fe412], al
inc esi
cmp esi, 0x7d
jb 0x10116533
push ecx
mov ecx, dword [ebp + 8]
push 0x102fe48e
push 0x102fe412
call fcn.100305a0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10116590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10116600
cmp byte [esi + 1], 0
jne 0x10116647
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x74]
xor ebx, dword [esi + 0x70]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x6d
jb 0x101165c0
jmp 0x10116647
xor ecx, ecx
mov dword [esp + 0x10], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x74]
xor ebx, dword [esi + 0x70]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x6d
jb 0x10116606
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x6e]
push eax
push edi
call fcn.100305a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4