joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10980d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [esp + 0x14]
movzx eax, byte [esp + 0x20]
movzx ecx, byte [esp + 0x1c]
mov dword [esi], 0
mov dword [esi + 4], 0
mov byte [esi + 8], cl
mov byte [esi + 9], al
movzx edx, byte [ebx]
test dl, dl
je 0x109814a
lea ecx, [ebx + 1]
xor eax, eax
jmp 0x1098119
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x109814c
movzx edi, dl
mov ebp, edi
and ebp, 0xfffffff0
cmp ebp, 0xe0
je 0x1098110
test dl, dl
jns 0x1098110
mov edx, edi
and edx, 0xffffffe0
cmp edx, 0xc0
je 0x1098110
and edi, 0xfffffff8
cmp edi, 0xf0
jne 0x1098111
add eax, 2
jmp 0x1098111
xor eax, eax
mov edi, dword [esp + 0x18]
mov ecx, eax
and ecx, 1
xor eax, 1
lea ebp, [eax + ecx*2]
test ebp, ebp
jns 0x1098166
mov eax, 0xffffffff
jmp 0x109816d
lea eax, [ebp*2]
push eax
call fcn.01088730
add esp, 4
mov dword [esi], eax
push 0
push ebx
push ebp
push eax
call fcn.0108b060
add esp, 0x10
movzx edx, byte [edi]
test dl, dl
je 0x10981e6
lea ecx, [edi + 1]
xor eax, eax
jmp 0x10981a9
inc eax
movzx edx, byte [ecx]
inc ecx
test dl, dl
je 0x10981da
movzx ebx, dl
mov ebp, ebx
and ebp, 0xfffffff0
cmp ebp, 0xe0
je 0x10981a0
test dl, dl
jns 0x10981a0
mov edx, ebx
and edx, 0xffffffe0
cmp edx, 0xc0
je 0x10981a0
and ebx, 0xfffffff8
cmp ebx, 0xf0
jne 0x10981a1
add eax, 2
jmp 0x10981a1
mov ebx, eax
inc ebx
jns 0x10981f2
mov eax, 0xffffffff
jmp 0x10981f9
mov eax, 2
mov ebx, 1
jmp 0x10981f9
lea eax, [eax*2 + 2]
push eax
call fcn.01088730
add esp, 4
mov dword [esi + 4], eax
push 0
push edi
push ebx
push eax
call fcn.0108b060
add esp, 0x10
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 0x10

Function at 0x10983a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + eax], 0
lea eax, [eax + 2]
jne 0x10983c0
lea ecx, [eax + ebp]
add ecx, 0xfffffffe
add eax, ebp
mov edx, 1
sub edx, eax
and edx, ebp
mov ebx, ebp
not ebx
and ebx, ecx
sub ebx, edx
mov esi, dword [esi + 4]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax], 0
lea eax, [eax + 2]
jne 0x10983f0
sar ebx, 1
lea ecx, [esi + eax]
add ecx, 0xfffffffe
add eax, esi
mov edx, 1
sub edx, eax
and edx, esi
mov eax, esi
not eax
and eax, ecx
sub eax, edx
sar eax, 1
add eax, ebx
add eax, 2
test eax, eax
jns 0x1098427
mov eax, 0xffffffff
jmp 0x1098429
add eax, eax
push eax
call fcn.01088730
add esp, 4
mov edi, eax
movzx ecx, word [esi]
test cx, cx
je 0x1098461
add esi, 2
mov eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [esi]
add esi, 2
test cx, cx
jne 0x1098450
mov word [eax], 0x5c
add eax, 2
movzx ecx, word [ebp]
test cx, cx
je 0x1098491
lea edx, [ebp + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x1098480
mov word [eax], 0
lea eax, [esp + 4]
push 0x60
push 3
push 0x120089
push eax
push edi
call fcn.010c05a0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x10c64e4]
Function at 0x109c700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x109c80e
mov ebp, dword [esp + 0x14]
xor esi, esi
mov edi, 2
jmp 0x109c736
mov esi, ebp
lea eax, [edi + 4]
add edi, 2
cmp edi, ecx
mov edi, eax
mov ebp, dword [esp + 0x14]
jae 0x109c810
movzx eax, byte [ebp + edi - 2]
push eax
call fcn.0109ec60
add esp, 4
mov bh, al
movzx eax, byte [ebp + edi - 1]
push eax
call fcn.0109ec60
add esp, 4
mov bl, al
movzx eax, al
mov ecx, eax
not ecx
or ecx, 0x30
add eax, ecx
inc eax
movzx ecx, bh
shr eax, 4
lea eax, [eax + ecx*4]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov byte [edx + esi], al
mov eax, esi
and eax, 1
xor esi, 1
mov edx, ebp
lea ebp, [esi + eax*2]
cmp edi, ecx
jae 0x109c720
movzx eax, byte [edx + edi]
push eax
call fcn.0109ec60
add esp, 4
cmp al, 0x40
jne 0x109c7b0
mov esi, ebp
mov ecx, dword [esp + 0x18]
jmp 0x109c722
shl bl, 4
mov ecx, eax
shr cl, 2
and cl, 0xf
or cl, bl
lea esi, [ebp + 1]
mov edx, dword [esp + 0x1c]
mov byte [edx + ebp], cl
lea ecx, [edi + 1]
mov edx, dword [esp + 0x18]
cmp ecx, edx
jae 0x109c807
mov ebx, eax
mov eax, dword [esp + 0x14]
movzx eax, byte [eax + edi + 1]
push eax
call fcn.0109ec60
mov ecx, dword [esp + 0x1c]
add esp, 4
cmp al, 0x40
je 0x109c722
shl bl, 6
add al, bl
mov edx, dword [esp + 0x1c]
mov byte [edx + ebp + 1], al
add ebp, 2
jmp 0x109c720
mov ecx, edx
jmp 0x109c722
xor esi, esi
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x109cc90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x190
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [esp + 8], 0xd964db35
mov dword [esp + 0xc], 0xdd6fdf6d
mov dword [esp + 0x10], 0xd1d2d36e
mov byte [esp + 0x14], 0
mov eax, 0x2f
mov ecx, 0xd0
nop
nop
nop
nop
mov esi, ecx
and esi, 0x99
mov edx, eax
and edx, 0x26
or edx, esi
xor dl, byte [esp + eax - 0x27]
xor dl, 0x99
add dl, 0x15
mov byte [esp + eax - 0x27], dl
inc eax
dec ecx
cmp eax, 0x3c
jne 0x109ccd0
mov dword [esp + 0x2c], 0xd76ac960
mov dword [esp + 0x30], 0xd362d568
mov dword [esp + 0x34], 0xdf2dd116
mov dword [esp + 0x38], 0xdb6edd2f
mov dword [esp + 0x3c], 0xa709d96b
mov dword [esp + 0x40], 0xa316a505
mov dword [esp + 0x44], 0xaf1da108
mov dword [esp + 0x48], 0xab16ad13
mov dword [esp + 0x4c], 0xb7b6a96e
xor eax, eax
nop
nop
mov ecx, eax
add cl, 0x2e
xor cl, byte [esp + eax + 0x2c]
add cl, 0x1a
mov byte [esp + eax + 0x2c], cl
inc eax
cmp eax, 0x24
jne 0x109cd40
movzx ecx, word [esp + 0x2c]
lea eax, [esp + 0x14c]
test cx, cx
je 0x109cd81
lea edx, [esp + 0x2e]
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x109cd70
mov word [eax], 0
movzx ecx, word [edi]
test cx, cx
je 0x109cdb1
lea edx, [edi + 2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x109cda0
mov word [eax], 0
movzx ecx, word [esp + 8]
test cx, cx
je 0x109cde1
lea edx, [esp + 0xa]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [eax], cx
add eax, 2
movzx ecx, word [edx]
add edx, 2
test cx, cx
jne 0x109cdd0
mov word [eax], 0
mov edi, dword [ebx]
mov dword [esp + 0x2c], 0x353838e6
mov byte [esp + 0x30], 0x90
mov dword [esp + 0x31], 0
mov dword [esp + 0x34], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, eax
add cl, 0xa5
xor cl, byte [esp + eax + 0x2c]
add cl, 0xc7
mov byte [esp + eax + 0x2c], cl
inc eax
cmp eax, 0xc
jne 0x109ce10
movzx eax, byte [esp + 0x2c]
test al, al
je 0x109ce4b
lea ecx, [esp + 0x2d]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov byte [edi], al
inc edi
movzx eax, byte [ecx]
inc ecx
test al, al
jne 0x109ce40
mov byte [edi], 0
lea eax, [esp + 0x13c]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x14c]
push eax
push ecx
push edx
call fcn.0108b780
add esp, 0xc
movzx eax, al
mov eax, dword [eax*4 + 0x10c6ca4]
mov ecx, 0x190d85d3
xor ecx, dword [0x10c6cac]
add eax, ecx
inc eax
jmp eax
Function at 0x10a0900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [ebp + 0xc]
push eax
sub esp, 0x10
mov dword [ebp - 0x1c], esp
push eax
mov dword [ebp - 0x18], esp
mov esi, 0xfffffffe
nop
nop
nop
nop
cmp word [edi + esi + 2], 0
lea esi, [esi + 2]
jne 0x10a0920
sar esi, 1
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push esi
push edi
push 0
call dword [0x10ccdc0]
mov dword [ebp - 0x14], 0xdf1e197f
mov ecx, 0x60983a
nop
nop
nop
nop
nop
movzx edx, byte [ebp + ecx - 0x60984e]
xor edx, ecx
mov ebx, edx
not ebx
add edx, 0xdd
and ebx, 1
or edx, 1
add edx, ebx
mov byte [ebp + ecx - 0x60984e], dl
inc ecx
cmp ecx, 0x60983e
jne 0x10a0950
xor ecx, ecx
cmp eax, dword [ebp - 0x14]
setne cl
xor ebx, ebx
jmp dword [ecx*4 + 0x10c6f4c]
Function at 0x10a74b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
movzx edi, word [esi]
test di, di
je 0x10a7608
mov edx, dword [esp + 0x18]
dec edx
je 0x10a7608
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, di
lea edi, [esi + 2]
cmp bx, 0x7f
ja 0x10a7500
lea ebp, [eax + 1]
mov byte [eax], bl
jmp 0x10a75b0
cmp ebx, 0x7ff
ja 0x10a7530
cmp edx, 2
jb 0x10a7530
mov ecx, ebx
shr ecx, 6
add cl, 0xc0
mov byte [eax], cl
mov ecx, ebx
not ecx
or ecx, 0x3f
add ecx, ebx
add cl, 0x81
lea ebp, [eax + 2]
mov byte [eax + 1], cl
jmp 0x10a75b0
mov ecx, ebx
and ecx, 0xfc00
cmp ecx, 0xd800
jne 0x10a75ca
cmp edx, 4
jb 0x10a75ca
movzx edi, word [esi + 2]
add esi, 4
shl ebx, 0xa
lea ecx, [ebx + edi]
add ecx, 0xfca02400
mov ebx, ecx
shr ebx, 0x12
mov ebp, ecx
shr ebp, 0x11
and ebp, 0xe0
xor ebx, 0xf0
add ebx, ebp
mov byte [eax], bl
mov ebx, ecx
shr ebx, 0xc
and bl, 0x3f
or bl, 0x80
mov byte [eax + 1], bl
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 2], cl
mov ebx, 0x3f
sub ebx, edi
not ebx
or ebx, edi
and bl, 0x3f
or bl, 0x80
lea ebp, [eax + 4]
mov byte [eax + 3], bl
mov edi, esi
nop
nop
nop
add edx, eax
sub edx, ebp
mov esi, edi
mov eax, ebp
movzx edi, word [esi]
test di, di
je 0x10a7608
test edx, edx
jne 0x10a74e0
jmp 0x10a7608
movzx ecx, cx
cmp ecx, 0xdc00
jne 0x10a75d9
mov esi, edi
jmp 0x10a75b8
cmp edx, 3
jb 0x10a7604
mov ecx, ebx
shr ecx, 0xc
or cl, 0xe0
mov byte [eax], cl
mov ecx, ebx
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [eax + 1], cl
and bl, 0x3f
or bl, 0x80
lea ebp, [eax + 3]
mov byte [eax + 2], bl
jmp 0x10a75b0
mov ebp, eax
jmp 0x10a75b0
mov byte [eax], 0
mov ecx, eax
not ecx
mov edx, eax
mov eax, dword [esp + 0x14]
and ecx, eax
not eax
and eax, edx
sub eax, ecx
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10b1670
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x2c0
mov dword [esp + 0x2a4], 0x10c8a0c
mov dword [esp + 0x54], 0
lea eax, [esp + 0x54]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x10c35d8
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], 0x10c35e8
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
call eax
sub esp, 0x14
not eax
shr eax, 0x1f
mov dword [esp + 0x2a0], eax
mov eax, dword [esp + 0x2a4]
mov ecx, dword [esp + 0x2a0]
mov eax, dword [eax + ecx*4]
mov ecx, dword [0x10c8a14]
xor ecx, 0x6c1f398d
lea eax, [eax + ecx + 1]
mov dword [esp + 0x29c], 0x10c80d0
mov ecx, dword [0x10c8a18]
mov dword [esp + 0x148], ecx
mov dword [esp + 0x298], 0x10c8a20
mov dword [esp + 0x290], 0x10c8a2c
mov dword [esp + 0x288], 0x10c8a38
mov dword [esp + 0x280], 0x10c8a44
mov dword [esp + 0x278], 0x10c80d0
mov ecx, dword [0x10c8a50]
mov dword [esp + 0x158], ecx
mov dword [esp + 0x274], 0x10c8a58
mov dword [esp + 0x26c], 0x10c8a64
mov dword [esp + 0x264], 0x10c8a70
mov dword [esp + 0x25c], 0x10c80d0
mov ecx, dword [0x10c8a7c]
mov dword [esp + 0x160], ecx
mov dword [esp + 0x258], 0x10c8a84
mov dword [esp + 0x250], 0x10c80d0
mov ecx, dword [0x10c8a90]
mov dword [esp + 0x194], ecx
mov dword [esp + 0x24c], 0x10c8a98
mov dword [esp + 0x244], 0x10c8aa4
mov dword [esp + 0x23c], 0x10c80d0
mov ecx, dword [0x10c8ab0]
mov dword [esp + 0x190], ecx
mov dword [esp + 0x238], 0x10c8ab8
mov dword [esp + 0x230], 0x10c8ac4
mov dword [esp + 0x228], 0x10c8ad0
mov dword [esp + 0x220], 0x10c8adc
mov dword [esp + 0x218], 0x10c8ae8
mov dword [esp + 0x210], 0x10c8af4
mov dword [esp + 0x208], 0x10c80d0
mov ecx, dword [0x10c8b00]
mov dword [esp + 0x188], ecx
mov dword [esp + 0x204], 0x10c8b08
mov dword [esp + 0x1fc], 0x10c80d0
mov ecx, dword [0x10c8b14]
mov dword [esp + 0x184], ecx
mov dword [esp + 0x1f8], 0x10c8b1c
mov dword [esp + 0x1f0], 0x10c80d0
mov ecx, dword [0x10c8b28]
mov dword [esp + 0x180], ecx
mov dword [esp + 0x1ec], 0x10c80d0
mov ecx, dword [0x10c8b30]
mov dword [esp + 0x17c], ecx
mov dword [esp + 0x1e8], 0x10c80d0
mov ecx, dword [0x10c8b38]
mov dword [esp + 0x178], ecx
mov dword [esp + 0x1e4], 0x10c8b40
mov dword [esp + 0x1dc], 0x10c80d0
mov edi, dword [0x10c8b4c]
mov dword [esp + 0x1d8], 0x10c80d0
mov ecx, dword [0x10c8b54]
mov dword [esp + 0x198], ecx
mov dword [esp + 0x1d4], 0x10c80d0
mov esi, dword [0x10c8b5c]
mov dword [esp + 0x1d0], 0x10c8b64
mov dword [esp + 0x1c8], 0x10c8b70
mov dword [esp + 0x1c0], 0x10c80d0
mov ecx, dword [0x10c8b7c]
mov dword [esp + 0x1bc], 0x10c80d0
mov edx, dword [0x10c8b84]
mov dword [esp + 0x14c], edx
mov dword [esp + 0x1b8], 0x10c80d0
mov edx, dword [0x10c8b8c]
mov dword [esp + 0x15c], edx
mov dword [esp + 0x1b4], 0x10c80d0
mov edx, dword [0x10c8b94]
mov dword [esp + 0x174], edx
mov dword [esp + 0x1b0], 0x10c80d0
mov edx, dword [0x10c8b9c]
mov dword [esp + 0x170], edx
mov dword [esp + 0x1ac], 0x10c80d0
mov edx, dword [0x10c8ba4]
mov dword [esp + 0x16c], edx
mov dword [esp + 0x1a8], 0x10c80d0
xor ebx, ebx
mov edx, dword [0x10c8bac]
jmp eax
Function at 0x10b3340
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
call fcn.01098390
sub esp, 0x14
mov edi, esp
push eax
mov esi, esp
xor eax, eax
sub esp, 4
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
jmp 0x10b336a
cmp eax, 0
setne al
jmp 0x10b3372
xor ebx, ebx
test al, 1
jne 0x10b337d
jmp 0x10b34e5
xor eax, eax
sub esp, 8
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 4
mov dword [esp], 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x10b33b9
jmp 0x10b34dd
mov dword [ebp - 0x18], esi
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
sub esp, 4
mov dword [esp], esi
call fcn.010ae9d0
add esp, 4
cmp eax, 0
setne cl
xor ebx, ebx
test cl, 1
jne 0x10b33ed
jmp 0x10b34ce
xor ecx, ecx
mov dword [ebp - 0x1c], eax
sub ecx, eax
add ecx, 0xffffffff
xor ebx, ebx
sub ebx, ecx
sub esp, 4
mov dword [esp], ebx
call fcn.01088730
sub esp, 8
mov dword [ebp - 0x14], eax
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
call fcn.010a74b0
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov byte [ebp - 0x10], al
mov byte [edi], 0xc9
mov byte [edi + 1], 0xa3
mov byte [edi + 2], 0xa5
mov byte [edi + 3], 0x61
mov byte [edi + 4], 0x52
mov byte [edi + 5], 0x62
mov byte [edi + 6], 0x51
mov byte [edi + 7], 0x67
mov byte [edi + 8], 0x50
mov byte [edi + 9], 0x19
mov byte [edi + 0xa], 0x62
mov byte [edi + 0xb], 0x61
mov byte [edi + 0xc], 0x6c
mov byte [edi + 0xd], 0xfb
mov eax, 0xe
mov byte [edi + eax], 0
add eax, 1
cmp eax, 0x11
jne 0x10b3463
xor eax, eax
mov ecx, dword [ebp + 8]
mov esi, dword [ebp - 0x14]
cmp eax, 0x11
jae 0x10b34a1
movzx edx, byte [edi + eax]
mov ebx, eax
add ebx, 0x861724fd
xor ebx, edx
mov edx, ebx
shl edx, 1
and edx, 2
xor ebx, 1
add ebx, 0xe
add ebx, edx
mov byte [edi + eax], bl
add eax, 1
jmp 0x10b3477
sub esp, 0xc
mov dword [esp], edi
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
call fcn.01089530
mov bl, al
and bl, 1
jmp 0x10b34be
sub esp, 4
mov dword [esp], esi
call fcn.01088740
add esp, 4
jmp 0x10b34ce
sub esp, 4
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x10b34e5
and bl, 1
movzx eax, bl
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10b9300
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
lea eax, [esp + 0x18]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x48]
call fcn.010c05a0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x10c9330]

Function at 0x10b9580
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.010c0c90
add esp, 0x14
test eax, eax
js 0x10b96c6
lea ebx, [esp + 0xc]
lea eax, [esp + 0x10]
push ebx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.010c1070
add esp, 0x24
xor edi, edi
mov esi, 0
test eax, eax
js 0x10b961a
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x10b95e8
mov eax, 0xffffffff
jmp 0x10b95ef
lea eax, [eax*2 + 2]
push eax
call fcn.01088730
add esp, 4
mov esi, eax
push ebx
push eax
push 0
push ebp
push dword [esp + 0x10]
call fcn.010c1670
add esp, 0x14
test eax, eax
jns 0x10b961a
push esi
call fcn.01088740
add esp, 4
xor esi, esi
mov eax, dword [esp]
mov dword [esp + 4], 0x686b6a65
mov byte [esp + 8], 0
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + edi + 4]
mov ebx, 0xe8
sub ebx, edi
lea ecx, [edi + 0x17]
xor ecx, ebx
and ecx, edx
xor ecx, ebx
mov dl, 0x8c
sub dl, cl
mov byte [esp + edi + 4], dl
mov ecx, edi
and ecx, 5
or edi, 0x6c18095
add edi, ecx
add edi, 0xf93e7f6c
cmp edi, 5
jb 0x10b9630
mov ecx, dword [0x10ccdc4]
test ecx, ecx
je 0x10b96aa
mov edx, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x10ccdc8]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x10b9690
inc edi
cmp ecx, edi
jne 0x10b9680
jmp 0x10b96aa
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0x10b96aa
push eax
push 4
push ecx
push dword [0x10ccdcc]
call fcn.010bdb70
add esp, 0x10
test esi, esi
jne 0x10b96c8
lea eax, [esp + 4]
push eax
call fcn.010c0390
add esp, 4
test al, al
je 0x10b96c6
cmp dword [esp + 4], 1
je 0x10b96c8
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10bb2e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x1c]
mov dword [esp], 0x33323100
mov word [esp + 4], 0
mov ecx, 0xc862ab4
mov edx, 0x379d54b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + ecx - 0xc862ab4]
mov edi, edx
xor edi, esi
mov ebx, ecx
xor ebx, esi
add edi, esi
not esi
and esi, ecx
add edi, esi
mov ebp, 0xffffffe
sub ebp, edi
sub ebx, esi
add ebx, ecx
and ebx, ebp
add ebx, 0xc1612a7b
mov esi, ebx
xor esi, 0x34
and ebx, 0x4b
add ebx, ebx
sub ebx, esi
add bl, 0x35
mov byte [esp + ecx - 0xc862ab4], bl
inc ecx
dec edx
cmp ecx, 0xc862aba
jne 0x10bb310
mov ecx, dword [esp]
mov ecx, dword fs:[ecx]
push eax
push 0
push dword [ecx + 0x18]
call dword [0x10d4de8]
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10bb6e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [ecx + 8]
test esi, esi
je 0x10bb7a0
xor eax, eax
cmp dword [ecx], 0
jne 0x10bb7eb
mov edx, dword [esp + 0x38]
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp], 0x686b6a65
mov byte [esp + 4], 0
xor eax, eax
xor esi, esi
nop
nop
nop
nop
nop
mov edi, esi
xor edi, 0xe9
mov ebx, eax
and ebx, 0xc
sub ebx, edi
xor bl, byte [esp + esi]
add bl, 0x8d
mov byte [esp + esi], bl
inc esi
add eax, 2
cmp esi, 5
jne 0x10bb750
mov eax, dword [esp]
mov esi, dword [0x10ccdc4]
test esi, esi
je 0x10bb7eb
xor edi, edi
mov ebx, dword [0x10ccdc8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x10bb7f4
inc edi
cmp esi, edi
jne 0x10bb790
jmp 0x10bb7eb
mov dword [esp + 8], 0x23e2e198
mov byte [esp + 0xc], 0
mov eax, 0x7e1e67d8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x7e1e67d0]
mov edx, ecx
and edx, eax
add dl, dl
sub cl, dl
movzx ecx, cl
add ecx, eax
add cl, 0xc8
mov byte [esp + eax - 0x7e1e67d0], cl
inc eax
cmp eax, 0x7e1e67dd
jne 0x10bb7c0
mov eax, dword [esp + 8]
add esp, 0x28
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x10bb7eb
lea eax, [esp + 0x20]
lea edi, [esp + 8]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x10ccdcc]
call fcn.010bdb70
add esp, 0x1c
jmp 0x10bb7eb

Function at 0x10bb820
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x10bb8ba
push ebx
push edi
push esi
sub esp, 8
mov dword [esp], 0x686b6a65
mov byte [esp + 4], 0
xor edx, edx
xor esi, esi
mov edi, esi
xor edi, 0xe9
mov ebx, edx
and ebx, 0xc
sub ebx, edi
xor bl, byte [esp + esi]
add bl, 0x8d
mov byte [esp + esi], bl
inc esi
add edx, 2
cmp esi, 5
jne 0x10bb840
mov edx, dword [0x10ccdc4]
test edx, edx
je 0x10bb8ae
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x10ccdc8]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x10bb890
inc edi
cmp edx, edi
jne 0x10bb880
jmp 0x10bb8ae
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x10bb8ae
push eax
push 4
push edx
push dword [0x10ccdcc]
mov esi, ecx
call fcn.010bdb70
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x10bdae0
Capabilities:
Encode data using xor

Disassembly:
push ebx
sub esp, 8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
xor edx, edx
test eax, eax
sete dl
jmp dword [edx*4 + 0x10c9a54]

Function at 0x10bfa30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0x131211e0
mov word [esp + 4], 0
mov byte [esp + 6], 0
xor eax, eax
nop
mov esi, eax
and esi, 6
xor esi, 0x1e
mov edx, eax
and edx, 1
sub edx, esi
add dl, 0x1a
xor dl, byte [esp + eax]
add dl, 0x14
mov byte [esp + eax], dl
inc eax
cmp eax, 7
jne case.default.0x10bfa7e
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x10ca534]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x10ca53c]
mov edi, 1
jmp dword [edi*4 + 0x10ca54c]
mov esi, dword [esi]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x10ca53c]
xor ebx, ebx
cmp dword [esi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x10ca544]
mov eax, dword [esi + 0x28]
xor edi, edi
jmp dword [edi*4 + 0x10ca54c]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x10c03f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebp, dword [esp + 0x50]
mov edi, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + eax + 2], 0
lea eax, [eax + 2]
jne 0x10c0410
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x10c042b
mov eax, 0xffffffff
jmp 0x10c042e
add eax, 0xa
push eax
call fcn.01088730
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx ebx, word [edi]
test bx, bx
je 0x10c0471
add edi, 2
nop
nop
nop
mov word [edx], bx
add edx, 2
movzx ebx, word [edi]
add edi, 2
test bx, bx
jne 0x10c0460
mov word [edx], 0
mov edx, 3
sub edx, esi
and edx, 2
mov edi, ecx
and edi, 0xfffd
imul edi, edx
and esi, 2
or ecx, 2
imul ecx, esi
lea edx, [ecx + edi]
mov word [esp + 8], dx
add ecx, edi
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x585b5a45
mov byte [esp + 4], 0
xor ecx, ecx
xor edx, edx
nop
nop
nop
nop
nop
nop
movzx esi, byte [esp + edx]
mov edi, edx
xor edi, 0xe43ac66f
add edi, ecx
xor edi, esi
mov esi, edi
and esi, 1
xor edi, 1
lea ebx, [edi + esi*2]
add bl, 0xd4
mov byte [esp + edx], bl
inc edx
add ecx, 2
cmp edx, 5
jne 0x10c04f0
mov esi, dword [esp]
mov ecx, dword [0x10ccdc4]
test ecx, ecx
je 0x10c0582
xor edx, edx
mov edi, dword [0x10ccdc8]
nop
cmp dword [edi + edx*8], 0xf6e92f34
je 0x10c0540
inc edx
cmp ecx, edx
jne 0x10c0530
jmp 0x10c0582
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x10c0582
mov esi, esp
lea edx, [esp + 0x10]
push 0
push 0
push ebp
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [esp + 0x68]
push 0
push esi
push edx
push dword [esp + 0x68]
push dword [esp + 0x68]
push 0x2c
push ecx
push dword [0x10ccdcc]
mov edi, eax
call fcn.010bdb70
add esp, 0x38
mov esi, eax
mov eax, edi
push eax
call fcn.01088740
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret