joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10045c40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10220b20
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x102d2084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
cmp dword [ebp + 0xc], 1
lea ebx, [edx + 4]
mov dword [edx + 0xc], ebx
lea esi, [edx + 8]
sete al
mov dword [edx + 0x10], esi
mov byte [edx + 0x48], al
lea edi, [edx + 0x14]
mov eax, dword [ebp - 0x10]
lea ecx, [edx + 0x18]
mov byte [edx + 0x3d], 0
mov dword [edx + 0x1c], edi
mov dword [edx + 0x20], ecx
add edx, 0x24
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp + 0xc]
mov dword [esi], 0
mov esi, dword [ebp + 8]
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
test esi, esi
je 0x10045d20
lea eax, [ebp - 0x14]
mov dword [ebp + 0xc], 0
push eax
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], 0
push eax
push esi
call fcn.101fb597
mov edx, dword [ebp - 0x10]
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [edx + 0x1c], eax
mov dword [edx + 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
jmp 0x10045d23
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x4c], esi
mov eax, dword [0x10374038]
mov ecx, dword [0x1037403c]
mov dword [edx + 0x40], eax
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10046c30
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10220c90
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x102d2084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push 8
mov dword [ebx], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.101f066d
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.101ef405
add esp, 8
mov dword [esi + 4], eax
mov ecx, ebx
mov dword [ebx + 0x34], esi
call fcn.10046ec0
mov eax, ebx
mov dword [eax], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea ebx, [eax + 4]
mov byte [eax + 0x48], 0
mov dword [eax + 0xc], ebx
lea ecx, [eax + 0x18]
mov byte [eax + 0x3d], 0
lea edx, [eax + 0x24]
mov dword [eax + 0x2c], edx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
lea edi, [eax + 0x14]
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x4c], 0
mov eax, dword [0x10374038]
mov ecx, dword [0x1037403c]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10047c30
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10220e75
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x102d2084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.10049250
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10047cbc
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x103a5e1c], 0x9249249
je 0x10047e24
mov dword [ebp - 0x1c], 0x103a5e18
mov dword [ebp - 4], 0
push 0x1c
mov dword [ebp - 0x18], 0
call fcn.101f066d
mov ecx, dword [edi]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x103a5e1c]
mov edi, dword [0x103a5e30]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x102baf40]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x102baf40]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x103a5e14]
comiss xmm1, xmm0
seta al
test al, al
je 0x10047dc0
divss xmm2, xmm0
movaps xmm0, xmm2
call fcn.1000da10
call fcn.101f1400
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x10047da2
cmp edi, 0x200
jae 0x10047da0
shl edi, 3
cmp edi, ecx
jae 0x10047da2
mov edi, ecx
push edi
call fcn.10048e40
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10049250
mov ecx, dword [0x103a5e1c]
mov edx, dword [eax]
jmp 0x10047dc3
mov edx, dword [ebp - 0x14]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x103a5e1c], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x103a5e2c]
mov ecx, dword [0x103a5e20]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x103a5e18]
jne 0x10047df4
mov dword [ecx + eax*8], esi
jmp 0x10047e03
cmp ebx, edx
jne 0x10047dfd
mov dword [ecx + eax*8], esi
jmp 0x10047e07
cmp dword [ecx + eax*8 + 4], edi
jne 0x10047e07
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.101eed9b
int3
Function at 0x10048e40
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10220fb0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x102d2084]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, 0x1fffffff
mov edi, 1
bsr ecx, eax
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x10048fd8
lea eax, [ecx - 1]
mov esi, dword [0x103a5e18]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x103a5e20
lea eax, [edi + edi]
push eax
call fcn.1002ba40
mov eax, dword [0x103a5e18]
lea ebx, [edi - 1]
mov dword [0x103a5e2c], ebx
mov dword [0x103a5e30], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10048fc4
nop dword [eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x103a5e20]
imul edi, edi, 0x1000193
and edi, ebx
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0x10], edx
cmp edi, esi
jne 0x10048f21
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x10048f8f
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x10048f5b
mov edx, dword [edx]
mov dword [ebp - 0x14], edx
cmp edx, eax
je 0x10048f53
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0x14]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
jmp 0x10048f8f
cmp edi, edx
je 0x10048f6c
nop
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x10048fa0
cmp edi, edx
jne 0x10048f60
mov ebx, dword [eax + 4]
mov dword [ebp - 0x14], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0x14]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x10048fc4
mov ebx, dword [0x103a5e2c]
jmp 0x10048ed0
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0x14], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x10048f8f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_hash_bucket_count
call fcn.101eed9b
int3
Function at 0x10049ff0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004a063
cmp byte [esi + 1], 0
jne 0x1004a0ae
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x13
jb 0x1004a020
jmp 0x1004a0ae
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x13
jb 0x1004a070
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x14]
push eax
push edi
call fcn.10047b20
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004a0d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004a143
cmp byte [esi + 1], 0
jne 0x1004a18e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x10
jb 0x1004a100
jmp 0x1004a18e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x10
jb 0x1004a150
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x11]
push eax
push edi
call fcn.10047b20
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004a1b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004a223
cmp byte [esi + 1], 0
jne 0x1004a26e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0xf
jb 0x1004a1e0
jmp 0x1004a26e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0xf
jb 0x1004a230
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x10]
push eax
push edi
call fcn.10047b20
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004a290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004a303
cmp byte [esi + 1], 0
jne 0x1004a34e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x14
jb 0x1004a2c0
jmp 0x1004a34e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x14
jb 0x1004a310
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x15]
push eax
push edi
call fcn.10047b20
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004a370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004a3e3
cmp byte [esi + 1], 0
jne 0x1004a42e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x11
jb 0x1004a3a0
jmp 0x1004a42e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x11
jb 0x1004a3f0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x12]
push eax
push edi
call fcn.10047b20
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004a450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004a4c3
cmp byte [esi + 1], 0
jne 0x1004a50e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0xd
jb 0x1004a480
jmp 0x1004a50e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0xd
jb 0x1004a4d0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xe]
push eax
push edi
call fcn.10047b20
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004f160
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004f1d3
cmp byte [esi + 1], 0
jne 0x1004f21e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x15
jb 0x1004f190
jmp 0x1004f21e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x15
jb 0x1004f1e0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x16]
push eax
push edi
call fcn.10047b20
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004f240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x1035b0b0], 0
push ebx
push esi
je 0x1004f2ba
cmp byte [0x1035b0b1], 0
jne 0x1004f308
mov byte [0x1035b0b1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1035b16c]
xor ebx, dword [0x1035b168]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1035b0b2]
xor al, bl
mov byte [esi + 0x1035b0b2], al
inc esi
cmp esi, 0xb0
jb 0x1004f270
jmp 0x1004f308
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1035b16c]
xor ebx, dword [0x1035b168]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1035b0b2]
xor al, bl
mov byte [esi + 0x1035b0b2], al
inc esi
cmp esi, 0xb0
jb 0x1004f2c0
push ecx
mov ecx, dword [ebp + 8]
push 0x1035b161
push 0x1035b0b2
call fcn.10047b20
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004f330
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004f3a3
cmp byte [esi + 1], 0
jne 0x1004f3ee
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x33
jb 0x1004f360
jmp 0x1004f3ee
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x33
jb 0x1004f3b0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x34]
push eax
push edi
call fcn.10047b20
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004f410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004f483
cmp byte [esi + 1], 0
jne 0x1004f4ce
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x18
jb 0x1004f440
jmp 0x1004f4ce
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x18
jb 0x1004f490
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x19]
push eax
push edi
call fcn.10047b20
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004f4f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x1035b1e0], 0
push ebx
push esi
je 0x1004f56a
cmp byte [0x1035b1e1], 0
jne 0x1004f5b8
mov byte [0x1035b1e1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1035b344]
xor ebx, dword [0x1035b340]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1035b1e2]
xor al, bl
mov byte [esi + 0x1035b1e2], al
inc esi
cmp esi, 0x157
jb 0x1004f520
jmp 0x1004f5b8
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1035b344]
xor ebx, dword [0x1035b340]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1035b1e2]
xor al, bl
mov byte [esi + 0x1035b1e2], al
inc esi
cmp esi, 0x157
jb 0x1004f570
push ecx
mov ecx, dword [ebp + 8]
push 0x1035b338
push 0x1035b1e2
call fcn.10047b20
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004f5e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x1035ac80], 0
push ebx
push esi
je 0x1004f65a
cmp byte [0x1035ac81], 0
jne 0x1004f6a8
mov byte [0x1035ac81], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1035ad64]
xor ebx, dword [0x1035ad60]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1035ac82]
xor al, bl
mov byte [esi + 0x1035ac82], al
inc esi
cmp esi, 0xd7
jb 0x1004f610
jmp 0x1004f6a8
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1035ad64]
xor ebx, dword [0x1035ad60]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1035ac82]
xor al, bl
mov byte [esi + 0x1035ac82], al
inc esi
cmp esi, 0xd7
jb 0x1004f660
push ecx
mov ecx, dword [ebp + 8]
push 0x1035ad58
push 0x1035ac82
call fcn.10047b20
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4