joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe4157a
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7c84], 1
jne 0xe415d6
or dword [0xed7c84], 1
mov dword [0xed723c], 0xb78183b4
mov dword [0xed7240], 0x9f948393
mov dword [0xed7244], 0x938a87b0
mov dword [0xed7248], 0xce9ea383
mov dword [0xed724c], 0x8780c6cf
mov dword [0xed7250], 0x82838a8f
mov word [0xed7254], 0xc6dc
mov byte [0xed7256], 0xe6
xor eax, eax
mov cl, byte [eax + 0xed723c]
xor cl, 0xe6
mov byte [eax + 0xed7920], cl
inc eax
cmp eax, 0x1b
jb 0xe415d8
mov eax, 0xed7920
ret

Function at 0xe41658
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7c80], 1
jne 0xe416a3
or dword [0xed7c80], 1
mov dword [0xed7258], 0x83969fb2
mov dword [0xed725c], 0x958791c6
mov dword [0xed7260], 0x928988c6
mov dword [0xed7264], 0x95c687c6
mov dword [0xed7268], 0x888f9492
mov word [0xed726c], 0xe681
xor eax, eax
mov cl, byte [eax + 0xed7258]
xor cl, 0xe6
mov byte [eax + 0xed793c], cl
inc eax
cmp eax, 0x16
jb 0xe416a5
mov eax, 0xed793c
ret

Function at 0xe416c0
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7c7c], 1
jne 0xe41729
or dword [0xed7c7c], 1
mov dword [0xed7270], 0x879088af
mov dword [0xed7274], 0xc6828f8a
mov dword [0xed7278], 0x87928782
mov dword [0xed727c], 0x9c8f95c6
mov dword [0xed7280], 0x8980c683
mov dword [0xed7284], 0x8f91c694
mov dword [0xed7288], 0xb4c68382
mov dword [0xed728c], 0xb5b9a1a3
mov word [0xed7290], 0xe6bc
xor eax, eax
mov cl, byte [eax + 0xed7270]
xor cl, 0xe6
mov byte [eax + 0xed7954], cl
inc eax
cmp eax, 0x22
jb 0xe4172b
mov eax, 0xed7954
ret

Function at 0xe418a5
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7c78], 1
jne 0xe418f1
or dword [0xed7c78], 1
mov dword [0xed7294], 0xa98183b4
mov dword [0xed7298], 0xad888396
mov dword [0xed729c], 0x9ea39f83
mov dword [0xed72a0], 0x80c6cfce
mov dword [0xed72a4], 0x838a8f87
mov dword [0xed72a8], 0xe6c6dc82
xor eax, eax
mov cl, byte [eax + 0xed7294]
xor cl, 0xe6
mov byte [eax + 0xed7978], cl
inc eax
cmp eax, 0x18
jb 0xe418f3
mov eax, 0xed7978
ret

Function at 0xe4190e
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7c74], 1
jne 0xe41974
or dword [0xed7c74], 1
mov dword [0xed72ac], 0xb58183b4
mov dword [0xed72b0], 0x87b09283
mov dword [0xed72b4], 0xa383938a
mov dword [0xed72b8], 0x9295ce9e
mov dword [0xed72bc], 0x81888f94
mov dword [0xed72c0], 0x8780c6cf
mov dword [0xed72c4], 0x82838a8f
mov word [0xed72c8], 0xc6dc
mov byte [0xed72ca], 0xe6
xor eax, eax
mov cl, byte [eax + 0xed72ac]
xor cl, 0xe6
mov byte [eax + 0xed7990], cl
inc eax
cmp eax, 0x1f
jb 0xe41976
mov eax, 0xed7990
ret

Function at 0xe41ae0
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7c70], 1
jne 0xe41b2c
or dword [0xed7c70], 1
mov dword [0xed72cc], 0xa98183b4
mov dword [0xed72d0], 0xad888396
mov dword [0xed72d4], 0x9ea39f83
mov dword [0xed72d8], 0x80c6cfce
mov dword [0xed72dc], 0x838a8f87
mov dword [0xed72e0], 0xe6c6dc82
xor eax, eax
mov cl, byte [eax + 0xed72cc]
xor cl, 0xe6
mov byte [eax + 0xed79b0], cl
inc eax
cmp eax, 0x18
jb 0xe41b2e
mov eax, 0xed79b0
ret
Function at 0xe41b49
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7c6c], 1
jne 0xe41ba8
or dword [0xed7c6c], 1
mov dword [0xed72e4], 0xb58183b4
mov dword [0xed72e8], 0x87b09283
mov dword [0xed72ec], 0xa383938a
mov dword [0xed72f0], 0x9182ce9e
mov dword [0xed72f4], 0xcf829489
mov dword [0xed72f8], 0x8f8780c6
mov dword [0xed72fc], 0xdc82838a
mov word [0xed7300], 0xe6c6
xor eax, eax
mov cl, byte [eax + 0xed72e4]
xor cl, 0xe6
mov byte [eax + 0xed79c8], cl
inc eax
cmp eax, 0x1e
jb 0xe41baa
mov eax, 0xed79c8
ret

Function at 0xe41d15
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7c68], 1
jne 0xe41d8f
or dword [0xed7c68], 1
mov dword [0xed7304], 0x929593ab
mov dword [0xed7308], 0x839695c6
mov dword [0xed730c], 0x9f808f85
mov dword [0xed7310], 0x88c687c6
mov dword [0xed7314], 0x83cb8889
mov dword [0xed7318], 0x9f92968b
mov dword [0xed731c], 0x849395c6
mov dword [0xed7320], 0xc69f838d
mov dword [0xed7324], 0x8f949295
mov word [0xed7328], 0x8188
mov byte [0xed732a], 0xe6
xor eax, eax
mov cl, byte [eax + 0xed7304]
xor cl, 0xe6
mov byte [eax + 0xed79e8], cl
inc eax
cmp eax, 0x27
jb 0xe41d91
mov eax, 0xed79e8
ret

Function at 0xe41dac
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7c64], 1
jne 0xe41df8
or dword [0xed7c64], 1
mov dword [0xed732c], 0xa98183b4
mov dword [0xed7330], 0xad888396
mov dword [0xed7334], 0x9ea39f83
mov dword [0xed7338], 0x80c6cfce
mov dword [0xed733c], 0x838a8f87
mov dword [0xed7340], 0xe6c6dc82
xor eax, eax
mov cl, byte [eax + 0xed732c]
xor cl, 0xe6
mov byte [eax + 0xed7a10], cl
inc eax
cmp eax, 0x18
jb 0xe41dfa
mov eax, 0xed7a10
ret

Function at 0xe41e15
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7c60], 1
jne 0xe41e67
or dword [0xed7c60], 1
mov dword [0xed7344], 0x83a2aeb5
mov dword [0xed7348], 0x8392838a
mov dword [0xed734c], 0xce9f83ad
mov dword [0xed7350], 0x8780c6cf
mov dword [0xed7354], 0x82838a8f
mov word [0xed7358], 0xc6dc
mov byte [0xed735a], 0xe6
xor eax, eax
mov cl, byte [eax + 0xed7344]
xor cl, 0xe6
mov byte [eax + 0xed7a28], cl
inc eax
cmp eax, 0x17
jb 0xe41e69
mov eax, 0xed7a28
ret

Function at 0xe41fb6
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7c5c], 1
jne 0xe42002
or dword [0xed7c5c], 1
mov dword [0xed735c], 0xa98183b4
mov dword [0xed7360], 0xad888396
mov dword [0xed7364], 0x9ea39f83
mov dword [0xed7368], 0x80c6cfce
mov dword [0xed736c], 0x838a8f87
mov dword [0xed7370], 0xe6c6dc82
xor eax, eax
mov cl, byte [eax + 0xed735c]
xor cl, 0xe6
mov byte [eax + 0xed7a40], cl
inc eax
cmp eax, 0x18
jb 0xe42004
mov eax, 0xed7a40
ret

Function at 0xe4201f
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7c58], 1
jne 0xe42072
or dword [0xed7c58], 1
mov dword [0xed7374], 0x83a2aeb5
mov dword [0xed7378], 0x8392838a
mov dword [0xed737c], 0x938a87b0
mov dword [0xed7380], 0xc6cfce83
mov dword [0xed7384], 0x8a8f8780
mov dword [0xed7388], 0xc6dc8283
mov byte [0xed738c], 0xe6
xor eax, eax
mov cl, byte [eax + 0xed7374]
xor cl, 0xe6
mov byte [eax + 0xed7a58], cl
inc eax
cmp eax, 0x19
jb 0xe42074
mov eax, 0xed7a58
ret
Function at 0xe4208f
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7c54], 1
jne 0xe4214a
or dword [0xed7c54], 1
mov dword [0xed7390], 0xa2a5a4a7
mov dword [0xed7394], 0xaea1a0a3
mov dword [0xed7398], 0xaaadacaf
mov dword [0xed739c], 0xb6a9a8ab
mov dword [0xed73a0], 0xb2b5b4b7
mov dword [0xed73a4], 0xbeb1b0b3
mov dword [0xed73a8], 0x8487bcbf
mov dword [0xed73ac], 0x80838285
mov dword [0xed73b0], 0x8c8f8e81
mov dword [0xed73b4], 0x888b8a8d
mov dword [0xed73b8], 0x94979689
mov dword [0xed73bc], 0x90939295
mov dword [0xed73c0], 0x9c9f9e91
mov dword [0xed73c4], 0xd5d4d7d6
mov dword [0xed73c8], 0xd1d0d3d2
mov dword [0xed73cc], 0xc9cddfde
mov byte [0xed73d0], 0xe6
xor eax, eax
mov cl, byte [eax + 0xed7390]
xor cl, 0xe6
mov byte [eax + 0xed7a78], cl
inc eax
cmp eax, 0x41
jb 0xe4214c
mov eax, 0xed7a78
ret

Function at 0xe421f7
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, eax
xor edx, edx
push 3
lea eax, [ecx + 2]
pop ebx
div ebx
mov esi, dword [ebp + 0x10]
shl eax, 2
inc eax
cmp dword [esi], eax
jae 0xe42221
mov dword [esi], eax
xor al, al
jmp 0xe422f9
mov eax, ecx
xor edx, edx
push 3
pop ecx
div ecx
mov esi, dword [ebp + 0xc]
mov ecx, dword [0xed1a7c]
xor edx, edx
imul eax, eax, 3
test eax, eax
je 0xe4229d
dec eax
push 3
pop ebx
div ebx
inc eax
mov edx, eax
mov dword [ebp - 4], eax
imul edx, edx, 3
movzx eax, byte [edi]
shr eax, 2
mov al, byte [eax + ecx]
mov byte [esi], al
movzx eax, byte [edi + 1]
movzx ebx, byte [edi]
shr eax, 4
shl ebx, 4
add eax, ebx
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 1], al
movzx eax, byte [edi + 2]
movzx ebx, byte [edi + 1]
shr eax, 6
lea eax, [eax + ebx*4]
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 2], al
movzx eax, byte [edi + 2]
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 3], al
add esi, 4
add edi, 3
dec dword [ebp - 4]
jne 0xe4224b
cmp edx, dword [ebp + 8]
jae 0xe422ec
movzx eax, byte [edi]
inc edx
cmp edx, dword [ebp + 8]
jae 0xe422b1
movzx edi, byte [edi + 1]
jmp 0xe422b3
xor edi, edi
mov ebx, eax
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + ecx]
mov byte [esi], bl
mov ebx, edi
shr ebx, 4
shl eax, 4
add ebx, eax
and ebx, 0x3f
mov al, byte [ebx + ecx]
mov byte [esi + 1], al
cmp edx, dword [ebp + 8]
jae 0xe422e0
and edi, 0xf
mov cl, byte [ecx + edi*4]
jmp 0xe422e2
mov cl, 0x3d
mov byte [esi + 2], cl
mov byte [esi + 3], 0x3d
add esi, 4
mov eax, dword [ebp + 0x10]
mov byte [esi], 0
sub esi, dword [ebp + 0xc]
mov dword [eax], esi
mov al, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0xe42f55
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7c50], 1
jne 0xe42fbc
or dword [0xed7c50], 1
mov dword [0xed7abc], 0x93b69384
mov dword [0xed7ac0], 0x9bb69980
mov dword [0xed7ac4], 0x8c8d888c
mov dword [0xed7ac8], 0x8780b69b
mov dword [0xed7acc], 0x8fb69d80
mov dword [0xed7ad0], 0xc18c8580
mov dword [0xed7ad4], 0x888fc9c0
mov dword [0xed7ad8], 0x8d8c8580
mov byte [0xed7adc], 0xe9
xor eax, eax
mov cl, byte [eax + 0xed7abc]
xor cl, 0xe9
mov byte [eax + 0xed7b7c], cl
inc eax
cmp eax, 0x21
jb 0xe42fbe
mov eax, 0xed7b7c
ret
Function at 0xe42fda
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7c4c], 1
jne 0xe43041
or dword [0xed7c4c], 1
mov dword [0xed7ae0], 0x93b69384
mov dword [0xed7ae4], 0x9bb69980
mov dword [0xed7ae8], 0x8c8d888c
mov dword [0xed7aec], 0x808fb69b
mov dword [0xed7af0], 0x9ab68c85
mov dword [0xed7af4], 0xc19d889d
mov dword [0xed7af8], 0x888fc9c0
mov dword [0xed7afc], 0x8d8c8580
mov byte [0xed7b00], 0xe9
xor eax, eax
mov cl, byte [eax + 0xed7ae0]
xor cl, 0xe9
mov byte [eax + 0xed7ba0], cl
inc eax
cmp eax, 0x21
jb 0xe43043
mov eax, 0xed7ba0
ret

Function at 0xe4305e
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7c48], 1
jne 0xe430dc
or dword [0xed7c48], 1
mov dword [0xed7b04], 0x93b69384
mov dword [0xed7b08], 0x9bb69980
mov dword [0xed7b0c], 0x8c8d888c
mov dword [0xed7b10], 0x918cb69b
mov dword [0xed7b14], 0x8a889b9d
mov dword [0xed7b18], 0x808fb69d
mov dword [0xed7b1c], 0x9db68c85
mov dword [0xed7b20], 0x8c81b686
mov dword [0xed7b24], 0xc0c19988
mov dword [0xed7b28], 0x80888fc9
mov dword [0xed7b2c], 0xe98d8c85
xor eax, eax
mov cl, byte [eax + 0xed7b04]
xor cl, 0xe9
mov byte [eax + 0xed7bc4], cl
inc eax
cmp eax, 0x2c
jb 0xe430de
mov eax, 0xed7bc4
ret

Function at 0xe430f9
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7c44], 1
jne 0xe43163
or dword [0xed7c44], 1
mov dword [0xed7b30], 0x858088af
mov dword [0xed7b34], 0x9dc98d8c
mov dword [0xed7b38], 0x9b8ac986
mov dword [0xed7b3c], 0x8c9d888c
mov dword [0xed7b40], 0x9a8c8dc9
mov dword [0xed7b44], 0x8887809d
mov dword [0xed7b48], 0x8786809d
mov dword [0xed7b4c], 0x9d8899c9
mov dword [0xed7b50], 0xe9c9d381
xor eax, eax
mov cl, byte [eax + 0xed7b30]
xor cl, 0xe9
mov byte [eax + 0xed7bf0], cl
inc eax
cmp eax, 0x24
jb 0xe43165
mov eax, 0xed7bf0
ret

Function at 0xe43180
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7c40], 1
jne 0xe431a4
or dword [0xed7c40], 1
mov dword [0xed7b54], 0x9d8899c9
mov dword [0xed7b58], 0xe9c9d381
xor eax, eax
mov cl, byte [eax + 0xed7b54]
xor cl, 0xe9
mov byte [eax + 0xed7c14], cl
inc eax
cmp eax, 8
jb 0xe431a6
mov eax, 0xed7c14
ret

Function at 0xe431c1
Capabilities:
Encode data using xor

Disassembly:
test byte [0xed7c3c], 1
jne 0xe43227
or dword [0xed7c3c], 1
mov dword [0xed7b5c], 0x858088af
mov dword [0xed7b60], 0x9dc98d8c
mov dword [0xed7b64], 0x9b8ac986
mov dword [0xed7b68], 0x8c9d888c
mov dword [0xed7b6c], 0x9d9c86c9
mov dword [0xed7b70], 0xc99d9c99
mov dword [0xed7b74], 0x8c85808f
mov word [0xed7b78], 0xc9d3
mov byte [0xed7b7a], 0xe9
xor eax, eax
mov cl, byte [eax + 0xed7b5c]
xor cl, 0xe9
mov byte [eax + 0xed7c1c], cl
inc eax
cmp eax, 0x1f
jb 0xe43229
mov eax, 0xed7c1c
ret
Function at 0xe4bcd0
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edx]
mov eax, dword [eax + 0x1f0]
test cl, cl
je 0xe4bcf2
lea esp, [esp]
imul eax, eax, 0xf4243
movzx ecx, cl
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0xe4bce0
ret
Function at 0xe5b910
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
xor eax, eax
pop ebp
ret

Function at 0xe5ba00
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x1c]
mov edx, 0x40
cmp eax, edx
jb 0xe5ba19
lea eax, [edx - 0x30]
pop esi
pop ebp
ret
lea ecx, [eax*8]
add dword [esi], ecx
push ebx
mov ebx, 0
adc dword [esi + 4], ebx
push edi
mov byte [eax + esi + 0x20], 0x80
mov edi, 1
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
mov ecx, 0x38
cmp eax, ecx
jbe 0xe5ba72
cmp eax, edx
jae 0xe5ba5e
lea esp, [esp]
mov byte [eax + esi + 0x20], bl
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
cmp eax, edx
jb 0xe5ba50
lea edx, [esi + 0x20]
push esi
call fcn.00e5b410
add esp, 4
mov dword [esi + 0x1c], ebx
mov ecx, 0x38
cmp dword [esi + 0x1c], ecx
jae 0xe5ba8f
jmp 0xe5ba80
mov edx, dword [esi + 0x1c]
mov byte [esi + edx + 0x20], bl
add dword [esi + 0x1c], edi
cmp dword [esi + 0x1c], ecx
jb 0xe5ba80
movzx eax, byte [esi + 7]
movzx ecx, byte [esi + 6]
movzx edx, byte [esi + 5]
mov byte [esi + 0x58], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x59], cl
movzx ecx, byte [esi + 3]
mov byte [esi + 0x5a], dl
movzx edx, byte [esi + 2]
mov byte [esi + 0x5b], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x5c], cl
movzx ecx, byte [esi]
mov byte [esi + 0x5d], dl
lea edx, [esi + 0x20]
push esi
mov byte [esi + 0x5e], al
mov byte [esi + 0x5f], cl
call fcn.00e5b410
movzx edx, byte [esi + 0xb]
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
movzx ecx, byte [esi + 0xa]
mov byte [eax + 1], cl
movzx edx, byte [esi + 9]
mov byte [eax + 2], dl
movzx ecx, byte [esi + 8]
mov byte [eax + 3], cl
movzx edx, byte [esi + 0xf]
mov byte [eax + 4], dl
movzx ecx, byte [esi + 0xe]
mov byte [eax + 5], cl
movzx edx, byte [esi + 0xd]
mov byte [eax + 6], dl
movzx ecx, byte [esi + 0xc]
mov byte [eax + 7], cl
movzx edx, byte [esi + 0x13]
mov byte [eax + 8], dl
movzx ecx, byte [esi + 0x12]
mov byte [eax + 9], cl
movzx edx, byte [esi + 0x11]
mov byte [eax + 0xa], dl
movzx ecx, byte [esi + 0x10]
mov byte [eax + 0xb], cl
movzx edx, byte [esi + 0x17]
mov byte [eax + 0xc], dl
movzx ecx, byte [esi + 0x16]
mov byte [eax + 0xd], cl
movzx edx, byte [esi + 0x15]
mov byte [eax + 0xe], dl
movzx ecx, byte [esi + 0x14]
mov byte [eax + 0xf], cl
movzx edx, byte [esi + 0x1b]
mov byte [eax + 0x10], dl
movzx ecx, byte [esi + 0x1a]
mov byte [eax + 0x11], cl
movzx edx, byte [esi + 0x19]
add esp, 4
mov byte [eax + 0x12], dl
movzx ecx, byte [esi + 0x18]
pop edi
pop ebx
mov byte [eax + 0x13], cl
xor eax, eax
pop esi
pop ebp
ret
Function at 0xe5d6a0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret
Function at 0xe5d7a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x28]
mov edx, 0x40
cmp eax, edx
jb 0xe5d7b9
lea eax, [edx - 0x30]
pop esi
pop ebp
ret
lea ecx, [eax*8]
add dword [esi], ecx
push ebx
mov ebx, 0
adc dword [esi + 4], ebx
push edi
mov byte [eax + esi + 0x2c], 0x80
mov edi, 1
add dword [esi + 0x28], edi
mov eax, dword [esi + 0x28]
mov ecx, 0x38
cmp eax, ecx
jbe 0xe5d812
cmp eax, edx
jae 0xe5d7fe
lea esp, [esp]
mov byte [eax + esi + 0x2c], bl
add dword [esi + 0x28], edi
mov eax, dword [esi + 0x28]
cmp eax, edx
jb 0xe5d7f0
lea eax, [esi + 0x2c]
push esi
call fcn.00e5bbf0
add esp, 4
mov dword [esi + 0x28], ebx
mov ecx, 0x38
cmp dword [esi + 0x28], ecx
jae 0xe5d82f
jmp 0xe5d820
mov edx, dword [esi + 0x28]
mov byte [esi + edx + 0x2c], bl
add dword [esi + 0x28], edi
cmp dword [esi + 0x28], ecx
jb 0xe5d820
movzx eax, byte [esi + 7]
movzx ecx, byte [esi + 6]
movzx edx, byte [esi + 5]
mov byte [esi + 0x64], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x65], cl
movzx ecx, byte [esi + 3]
mov byte [esi + 0x67], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x66], dl
movzx edx, byte [esi + 2]
mov byte [esi + 0x68], cl
movzx ecx, byte [esi]
mov byte [esi + 0x6a], al
lea eax, [esi + 0x2c]
push esi
mov byte [esi + 0x69], dl
mov byte [esi + 0x6b], cl
call fcn.00e5bbf0
movzx edx, byte [esi + 0xb]
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
movzx ecx, byte [esi + 0xa]
mov byte [eax + 1], cl
movzx edx, byte [esi + 9]
mov byte [eax + 2], dl
movzx ecx, byte [esi + 8]
mov byte [eax + 3], cl
movzx edx, byte [esi + 0xf]
mov byte [eax + 4], dl
movzx ecx, byte [esi + 0xe]
mov byte [eax + 5], cl
movzx edx, byte [esi + 0xd]
mov byte [eax + 6], dl
movzx ecx, byte [esi + 0xc]
mov byte [eax + 7], cl
movzx edx, byte [esi + 0x13]
mov byte [eax + 8], dl
movzx ecx, byte [esi + 0x12]
mov byte [eax + 9], cl
movzx edx, byte [esi + 0x11]
mov byte [eax + 0xa], dl
movzx ecx, byte [esi + 0x10]
mov byte [eax + 0xb], cl
movzx edx, byte [esi + 0x17]
mov byte [eax + 0xc], dl
movzx ecx, byte [esi + 0x16]
mov byte [eax + 0xd], cl
movzx edx, byte [esi + 0x15]
mov byte [eax + 0xe], dl
movzx ecx, byte [esi + 0x14]
mov byte [eax + 0xf], cl
movzx edx, byte [esi + 0x1b]
mov byte [eax + 0x10], dl
movzx ecx, byte [esi + 0x1a]
mov byte [eax + 0x11], cl
movzx edx, byte [esi + 0x19]
mov byte [eax + 0x12], dl
movzx ecx, byte [esi + 0x18]
mov byte [eax + 0x13], cl
movzx edx, byte [esi + 0x1f]
mov byte [eax + 0x14], dl
movzx ecx, byte [esi + 0x1e]
mov byte [eax + 0x15], cl
movzx edx, byte [esi + 0x1d]
mov byte [eax + 0x16], dl
movzx ecx, byte [esi + 0x1c]
mov byte [eax + 0x17], cl
movzx edx, byte [esi + 0x23]
mov byte [eax + 0x18], dl
movzx ecx, byte [esi + 0x22]
mov byte [eax + 0x19], cl
movzx edx, byte [esi + 0x21]
mov byte [eax + 0x1a], dl
movzx ecx, byte [esi + 0x20]
mov byte [eax + 0x1b], cl
movzx edx, byte [esi + 0x27]
mov byte [eax + 0x1c], dl
movzx ecx, byte [esi + 0x26]
add esp, 4
mov byte [eax + 0x1d], cl
movzx edx, byte [esi + 0x25]
mov byte [eax + 0x1e], dl
movzx ecx, byte [esi + 0x24]
pop edi
pop ebx
mov byte [eax + 0x1f], cl
xor eax, eax
pop esi
pop ebp
ret
Function at 0xe5ece0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x23c], 0
jne 0xe5ee34
mov eax, dword [esi + 0x240]
cmp eax, 0x10
jge 0xe5ee34
test eax, eax
js 0xe5ee34
mov eax, dword [esi + 0x234]
push eax
call fcn.00e60ef0
add esp, 4
test eax, eax
jne 0xe5ee39
mov ecx, dword [esi + 0x240]
mov eax, dword [ebp + 0x10]
lea edx, [ecx + eax]
cmp edx, 0xc
jbe 0xe5ed3a
or dword [esi + 0x238], 1
push ebx
push edi
xor edi, edi
test ecx, ecx
jne 0xe5ed95
mov ecx, eax
and ecx, 0xfffffff0
mov dword [ebp + 8], ecx
jbe 0xe5ed8e
lea ebx, [esi + 0x1f4]
xor eax, eax
mov edx, dword [ebp + 0xc]
lea ecx, [eax + edi]
mov ecx, dword [ecx + edx]
xor dword [ebx + eax], ecx
add eax, 4
cmp eax, 0x10
jb 0xe5ed54
push ebx
push esi
call fcn.00e60e60
add esp, 8
add dword [esi + 0x248], 0x80
adc dword [esi + 0x24c], 0
add edi, 0x10
cmp edi, dword [ebp + 8]
jb 0xe5ed52
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
add ebx, edi
jmp 0xe5ed98
mov ebx, dword [ebp + 0xc]
cmp edi, eax
jae 0xe5ee2d
sub eax, edi
mov dword [ebp + 8], eax
mov ecx, 1
lea ebx, [ebx]
mov al, byte [ebx]
mov edx, dword [esi + 0x240]
mov byte [esi + edx + 0x224], al
add dword [esi + 0x240], ecx
add ebx, ecx
cmp dword [esi + 0x240], 0x10
jne 0xe5ee23
lea edi, [esi + 0x1f4]
mov eax, edi
mov ecx, 4
lea ecx, [ecx]
movzx edx, byte [eax + 0x30]
xor byte [eax], dl
movzx edx, byte [eax + 0x31]
xor byte [eax + 1], dl
movzx edx, byte [eax + 0x32]
xor byte [eax + 2], dl
movzx edx, byte [eax + 0x33]
xor byte [eax + 3], dl
add eax, 4
dec ecx
jne 0xe5ede0
push edi
push esi
call fcn.00e60e60
xor eax, eax
add esp, 8
add dword [esi + 0x248], 0x80
mov dword [esi + 0x240], eax
adc dword [esi + 0x24c], eax
mov ecx, 1
sub dword [ebp + 8], ecx
jne 0xe5edb0
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret
mov eax, 0x10
pop esi
pop ebp
ret
Function at 0xe60cb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push edi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], edi
cmp eax, edi
je 0xe60d54
push esi
mov eax, dword [ebp + 0x10]
dec dword [ebp + 0xc]
test eax, eax
je 0xe60ce1
call eax
dec dword [ebp - 8]
call fcn.00e7bae8
mov esi, eax
call fcn.00e7bae8
cmp esi, eax
jne 0xe60d00
xor edi, 1
call fcn.00e7bae8
cmp esi, eax
je 0xe60cf4
call fcn.00e7bae8
mov esi, eax
call fcn.00e7bae8
cmp esi, eax
jne 0xe60d1c
xor ebx, 1
call fcn.00e7bae8
cmp esi, eax
je 0xe60d10
cmp edi, ebx
je 0xe60ce4
mov eax, dword [ebp - 4]
lea ecx, [eax + eax]
or ecx, edi
cmp dword [ebp - 8], 0
mov dword [ebp - 4], ecx
jne 0xe60ce1
mov eax, dword [ebp + 8]
mov dl, cl
mov byte [eax], dl
inc eax
cmp dword [ebp + 0xc], 0
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 8
jne 0xe60cd5
mov eax, dword [ebp - 0xc]
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0xe60e60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
add eax, eax
lea edx, [ecx + eax*8 + 0x258]
push 0x10
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.00e7a030
add esp, 0xc
mov esi, 1
mov edx, 0x100
movzx ecx, byte [esi + edi]
mov ebx, dword [ebp + 8]
add ecx, edx
xor eax, eax
add ecx, ecx
lea ecx, [ebx + ecx*8 + 0x258]
jmp 0xe60eb0
mov ebx, dword [ecx]
xor dword [ebp + eax - 0x10], ebx
add eax, 4
add ecx, 4
cmp eax, 0x10
jl 0xe60eb0
add edx, 0x100
inc esi
cmp edx, 0x1000
jl 0xe60e94
push 0x10
lea edx, [ebp - 0x10]
push edx
push edi
call fcn.00e7a030
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret