joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100507b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10050814
cmp byte [esi + 1], 0
jne 0x1005085f
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x17
jb 0x100507d6
jmp 0x1005085f
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x17
jb 0x10050820
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x18]
push eax
push edi
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10050880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100508e4
cmp byte [esi + 1], 0
jne 0x1005092f
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x18
jb 0x100508a6
jmp 0x1005092f
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x18
jb 0x100508f0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x19]
push eax
push edi
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10050950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100509b4
cmp byte [esi + 1], 0
jne 0x100509ff
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x19
jb 0x10050976
jmp 0x100509ff
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x19
jb 0x100509c0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x1a]
push eax
push edi
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10050a20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10050a84
cmp byte [esi + 1], 0
jne 0x10050acf
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1b
jb 0x10050a46
jmp 0x10050acf
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1b
jb 0x10050a90
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x1c]
push eax
push edi
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10050af0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10050b54
cmp byte [esi + 1], 0
jne 0x10050b9f
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1c
jb 0x10050b16
jmp 0x10050b9f
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1c
jb 0x10050b60
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x1d]
push eax
push edi
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10050bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10050c24
cmp byte [esi + 1], 0
jne 0x10050c6f
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1d
jb 0x10050be6
jmp 0x10050c6f
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1d
jb 0x10050c30
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x1e]
push eax
push edi
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10050c90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10050cf4
cmp byte [esi + 1], 0
jne 0x10050d3f
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xb
jb 0x10050cb6
jmp 0x10050d3f
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xb
jb 0x10050d00
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0xc]
push eax
push edi
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10050d60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10050dc4
cmp byte [esi + 1], 0
jne 0x10050e0f
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xc
jb 0x10050d86
jmp 0x10050e0f
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xc
jb 0x10050dd0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0xd]
push eax
push edi
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10050e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10050e94
cmp byte [esi + 1], 0
jne 0x10050edf
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xd
jb 0x10050e56
jmp 0x10050edf
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xd
jb 0x10050ea0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0xe]
push eax
push edi
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10050f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10050f64
cmp byte [esi + 1], 0
jne 0x10050faf
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xe
jb 0x10050f26
jmp 0x10050faf
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xe
jb 0x10050f70
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0xf]
push eax
push edi
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10050fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10051034
cmp byte [esi + 1], 0
jne 0x1005107f
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xf
jb 0x10050ff6
jmp 0x1005107f
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0xf
jb 0x10051040
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x10]
push eax
push edi
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100510a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1019faa0], 0
push ebx
push esi
je 0x10051111
cmp byte [0x1019faa1], 0
jne 0x10051152
mov byte [0x1019faa1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1019facc]
xor ebx, dword [0x1019fac8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1019faa2], al
inc esi
cmp esi, 0x20
jb 0x100510d0
jmp 0x10051152
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1019facc]
xor ebx, dword [0x1019fac8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1019faa2], al
inc esi
cmp esi, 0x20
jb 0x10051113
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x1019fac1
push 0x1019faa2
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10051180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1019fc00], 0
push ebx
push esi
je 0x100511f1
cmp byte [0x1019fc01], 0
jne 0x10051232
mov byte [0x1019fc01], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1019fc34]
xor ebx, dword [0x1019fc30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1019fc02], al
inc esi
cmp esi, 0x28
jb 0x100511b0
jmp 0x10051232
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1019fc34]
xor ebx, dword [0x1019fc30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1019fc02], al
inc esi
cmp esi, 0x28
jb 0x100511f3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x1019fc29
push 0x1019fc02
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10051260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1019fd98], 0
push ebx
push esi
je 0x100512d1
cmp byte [0x1019fd99], 0
jne 0x10051312
mov byte [0x1019fd99], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1019fdc4]
xor ebx, dword [0x1019fdc0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1019fd9a], al
inc esi
cmp esi, 0x1f
jb 0x10051290
jmp 0x10051312
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x1019fdc4]
xor ebx, dword [0x1019fdc0]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x1019fd9a], al
inc esi
cmp esi, 0x1f
jb 0x100512d3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x1019fdb8
push 0x1019fd9a
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10056ac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10056b24
cmp byte [esi + 1], 0
jne 0x10056b6f
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x12
jb 0x10056ae6
jmp 0x10056b6f
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x12
jb 0x10056b30
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x13]
push eax
push edi
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10060a60
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x102ce4c0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x40
lea eax, [ebp - 0x44]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x44]
mov ecx, 0x20
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x4c], ecx
mov eax, 0x3f
shr ecx, 3
add esp, 0xc
and ecx, 0x3f
mov dword [ebp - 0x5c], 0x67452301
add edx, ecx
mov dword [ebp - 0x58], 0xefcdab89
mov dword [ebp - 0x54], 0x98badcfe
sub eax, ecx
mov dword [ebp - 0x50], 0x10325476
mov dword [ebp - 0x48], 0
mov byte [edx], 0x80
inc edx
cmp eax, 8
jae 0x10060af4
push eax
push 0
push edx
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.100603e0
push 0x38
lea eax, [ebp - 0x44]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x20
jmp 0x10060b03
add eax, 0xfffffff8
push eax
push 0
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.100603e0
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, dword [ebp - 0x56]
xor ecx, ebp
call fcn.10110662
mov esp, ebp
pop ebp
ret
Function at 0x10060b50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [ebx]
mov edi, dword [ebp + 0x10]
cmp edi, 7
ja case.default.0x10060b66
jmp dword [edi*4 + 0x10060cfc]
mov ecx, esi
and ecx, 3
sub edi, ecx
sub ecx, 1
je 0x10060ba9
sub ecx, 1
je 0x10060b96
sub ecx, 1
jne 0x10060bbc
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017f3a8]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017f3a8]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017f3a8]
inc esi
mov edx, edi
sar edx, 3
test edx, edx
je 0x10060c3e
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017f3a8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017f3a8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017f3a8]
mov ecx, eax
movzx eax, cl
shr ecx, 8
mov eax, dword [eax*4 + 0x1017f3a8]
xor eax, dword [esi + 4]
add esi, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017f3a8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017f3a8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017f3a8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017f3a8]
sub edx, 1
jne 0x10060bc5
and edi, 7
jmp 0x10060b61
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017f3a8]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017f3a8]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017f3a8]
inc esi
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
pop edi
pop esi
xor eax, dword [ecx*4 + 0x1017f3a8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017f3a8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017f3a8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017f3a8]
mov dword [ebx], eax
pop ebx
pop ebp
ret
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017f3a8]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017f3a8]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017f3a8]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret