joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10046010
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10266c30
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x103230ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
mov dword [ebp - 0x10], edx
cmp dword [ebp + 0xc], 1
lea ebx, [edx + 4]
mov dword [edx + 0xc], ebx
lea esi, [edx + 8]
sete al
mov dword [edx + 0x10], esi
mov byte [edx + 0x48], al
lea edi, [edx + 0x14]
mov eax, dword [ebp - 0x10]
lea ecx, [edx + 0x18]
mov byte [edx + 0x3d], 0
mov dword [edx + 0x1c], edi
mov dword [edx + 0x20], ecx
add edx, 0x24
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp + 0xc]
mov dword [esi], 0
mov esi, dword [ebp + 8]
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
test esi, esi
je 0x100460f0
lea eax, [ebp - 0x14]
mov dword [ebp + 0xc], 0
push eax
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], 0
push eax
push esi
call fcn.102400f2
mov edx, dword [ebp - 0x10]
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [edx + 0x1c], eax
mov dword [edx + 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x2c], eax
mov dword [edx + 0x30], eax
jmp 0x100460f3
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x4c], esi
mov eax, dword [0x103c6ca8]
mov ecx, dword [0x103c6cac]
mov dword [edx + 0x40], eax
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10047090
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10266da0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x103230ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push 8
mov dword [ebx], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1023506d
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.10233dfb
add esp, 8
mov dword [esi + 4], eax
mov ecx, ebx
mov dword [ebx + 0x34], esi
call fcn.10047320
mov eax, ebx
mov dword [eax], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea ebx, [eax + 4]
mov byte [eax + 0x48], 0
mov dword [eax + 0xc], ebx
lea ecx, [eax + 0x18]
mov byte [eax + 0x3d], 0
lea edx, [eax + 0x24]
mov dword [eax + 0x2c], edx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
lea edi, [eax + 0x14]
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x4c], 0
mov eax, dword [0x103c6ca8]
mov ecx, dword [0x103c6cac]
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10048090
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10266f85
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x103230ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
movzx eax, byte [edi]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
lea eax, [ebp - 0x14]
imul ebx, ecx, 0x1000193
push ebx
push edi
push eax
call fcn.100496b0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x1004811c
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [0x103f8aac], 0x9249249
je 0x10048284
mov dword [ebp - 0x1c], 0x103f8aa8
mov dword [ebp - 4], 0
push 0x1c
mov dword [ebp - 0x18], 0
call fcn.1023506d
mov ecx, dword [edi]
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [ebp - 4], 1
mov ecx, dword [0x103f8aac]
mov edi, dword [0x103f8ac0]
lea eax, [ecx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1030c010]
mov eax, edi
shr eax, 0x1f
cvtpd2ps xmm2, xmm0
movd xmm0, edi
cvtdq2pd xmm0, xmm0
movaps xmm1, xmm2
addsd xmm0, qword [eax*8 + 0x1030c010]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
movss xmm0, dword [0x103f8aa4]
comiss xmm1, xmm0
seta al
test al, al
je 0x10048220
divss xmm2, xmm0
movaps xmm0, xmm2
call fcn.1000e000
call fcn.10235ce0
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
cmp edi, ecx
jae 0x10048202
cmp edi, 0x200
jae 0x10048200
shl edi, 3
cmp edi, ecx
jae 0x10048202
mov edi, ecx
push edi
call fcn.100492a0
push ebx
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100496b0
mov ecx, dword [0x103f8aac]
mov edx, dword [eax]
jmp 0x10048223
mov edx, dword [ebp - 0x14]
mov edi, dword [edx + 4]
inc ecx
mov dword [0x103f8aac], ecx
mov dword [esi], edx
mov dword [esi + 4], edi
mov dword [edi], esi
mov dword [edx + 4], esi
mov eax, dword [0x103f8abc]
mov ecx, dword [0x103f8ab0]
and eax, ebx
mov ebx, dword [ecx + eax*8]
cmp ebx, dword [0x103f8aa8]
jne 0x10048254
mov dword [ecx + eax*8], esi
jmp 0x10048263
cmp ebx, edx
jne 0x1004825d
mov dword [ecx + eax*8], esi
jmp 0x10048267
cmp dword [ecx + eax*8 + 4], edi
jne 0x10048267
mov dword [ecx + eax*8 + 4], esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.unordered_map_set_too_long
call fcn.10233791
int3
Function at 0x100492a0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x102670c0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x103230ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, 0x1fffffff
mov edi, 1
bsr ecx, eax
mov eax, edi
shl eax, cl
mov ecx, dword [ebp + 8]
cmp ecx, eax
ja 0x10049438
lea eax, [ecx - 1]
mov esi, dword [0x103f8aa8]
or eax, edi
mov dword [ebp + 8], esi
bsr ecx, eax
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, 0x103f8ab0
lea eax, [edi + edi]
push eax
call fcn.1002ac40
mov eax, dword [0x103f8aa8]
lea ebx, [edi - 1]
mov dword [0x103f8abc], ebx
mov dword [0x103f8ac0], edi
mov eax, dword [eax]
mov ecx, eax
cmp eax, esi
je 0x10049424
nop dword [eax]
movzx edx, byte [eax + 8]
xor edx, 0x811c9dc5
mov ecx, dword [ecx]
imul edi, edx, 0x1000193
movzx edx, byte [eax + 9]
xor edi, edx
movzx edx, byte [eax + 0xa]
imul edi, edi, 0x1000193
xor edi, edx
movzx edx, byte [eax + 0xb]
imul edi, edi, 0x1000193
xor edi, edx
mov edx, dword [0x103f8ab0]
imul edi, edi, 0x1000193
and edi, ebx
lea edx, [edx + edi*8]
mov edi, dword [edx]
mov dword [ebp - 0x10], edx
cmp edi, esi
jne 0x10049381
mov dword [edx], eax
mov dword [edx + 4], eax
jmp 0x100493ef
mov edx, dword [edx + 4]
mov ebx, dword [eax + 8]
cmp ebx, dword [edx + 8]
jne 0x100493bb
mov edx, dword [edx]
mov dword [ebp - 0x14], edx
cmp edx, eax
je 0x100493b3
mov ebx, dword [eax + 4]
mov esi, dword [ebp - 0x14]
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
jmp 0x100493ef
cmp edi, edx
je 0x100493cc
nop
mov edx, dword [edx + 4]
cmp ebx, dword [edx + 8]
je 0x10049400
cmp edi, edx
jne 0x100493c0
mov ebx, dword [eax + 4]
mov dword [ebp - 0x14], ebx
mov dword [ebx], ecx
mov ebx, dword [ecx + 4]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov dword [edx + 4], ebx
mov edx, dword [ebp - 0x14]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edi
mov dword [edx], eax
mov eax, ecx
cmp ecx, esi
je 0x10049424
mov ebx, dword [0x103f8abc]
jmp 0x10049330
mov ebx, dword [eax + 4]
mov edx, dword [edx]
mov dword [ebp - 0x14], edx
mov esi, edx
mov dword [ebx], ecx
mov edi, dword [ecx + 4]
mov dword [edi], edx
mov edx, dword [edx + 4]
mov dword [edx], eax
mov dword [esi + 4], edi
mov esi, dword [ebp + 8]
mov dword [ecx + 4], ebx
mov dword [eax + 4], edx
jmp 0x100493ef
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.invalid_hash_bucket_count
call fcn.10233791
int3
Function at 0x1004a450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004a4c3
cmp byte [esi + 1], 0
jne 0x1004a50e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x13
jb 0x1004a480
jmp 0x1004a50e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x13
jb 0x1004a4d0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x14]
push eax
push edi
call fcn.10047f80
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004a530
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004a5a3
cmp byte [esi + 1], 0
jne 0x1004a5ee
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x10
jb 0x1004a560
jmp 0x1004a5ee
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x10
jb 0x1004a5b0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x11]
push eax
push edi
call fcn.10047f80
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004a610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004a683
cmp byte [esi + 1], 0
jne 0x1004a6ce
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0xf
jb 0x1004a640
jmp 0x1004a6ce
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0xf
jb 0x1004a690
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x10]
push eax
push edi
call fcn.10047f80
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004a6f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004a763
cmp byte [esi + 1], 0
jne 0x1004a7ae
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x14
jb 0x1004a720
jmp 0x1004a7ae
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x14
jb 0x1004a770
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x15]
push eax
push edi
call fcn.10047f80
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004a7d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004a843
cmp byte [esi + 1], 0
jne 0x1004a88e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x11
jb 0x1004a800
jmp 0x1004a88e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x11
jb 0x1004a850
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x12]
push eax
push edi
call fcn.10047f80
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004a8b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004a923
cmp byte [esi + 1], 0
jne 0x1004a96e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0xd
jb 0x1004a8e0
jmp 0x1004a96e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0xd
jb 0x1004a930
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xe]
push eax
push edi
call fcn.10047f80
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004f5d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004f643
cmp byte [esi + 1], 0
jne 0x1004f68e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x15
jb 0x1004f600
jmp 0x1004f68e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x15
jb 0x1004f650
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x16]
push eax
push edi
call fcn.10047f80
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004f6b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x103ad1e0], 0
push ebx
push esi
je 0x1004f72a
cmp byte [0x103ad1e1], 0
jne 0x1004f778
mov byte [0x103ad1e1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x103ad29c]
xor ebx, dword [0x103ad298]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x103ad1e2]
xor al, bl
mov byte [esi + 0x103ad1e2], al
inc esi
cmp esi, 0xb0
jb 0x1004f6e0
jmp 0x1004f778
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x103ad29c]
xor ebx, dword [0x103ad298]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x103ad1e2]
xor al, bl
mov byte [esi + 0x103ad1e2], al
inc esi
cmp esi, 0xb0
jb 0x1004f730
push ecx
mov ecx, dword [ebp + 8]
push 0x103ad291
push 0x103ad1e2
call fcn.10047f80
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004f7a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004f813
cmp byte [esi + 1], 0
jne 0x1004f85e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x33
jb 0x1004f7d0
jmp 0x1004f85e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x33
jb 0x1004f820
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x34]
push eax
push edi
call fcn.10047f80
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004f880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004f8f3
cmp byte [esi + 1], 0
jne 0x1004f93e
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0x10], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x18
jb 0x1004f8b0
jmp 0x1004f93e
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0x10]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x18
jb 0x1004f900
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x19]
push eax
push edi
call fcn.10047f80
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004f960
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x103ad310], 0
push ebx
push esi
je 0x1004f9da
cmp byte [0x103ad311], 0
jne 0x1004fa28
mov byte [0x103ad311], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x103ad474]
xor ebx, dword [0x103ad470]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x103ad312]
xor al, bl
mov byte [esi + 0x103ad312], al
inc esi
cmp esi, 0x157
jb 0x1004f990
jmp 0x1004fa28
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x103ad474]
xor ebx, dword [0x103ad470]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x103ad312]
xor al, bl
mov byte [esi + 0x103ad312], al
inc esi
cmp esi, 0x157
jb 0x1004f9e0
push ecx
mov ecx, dword [ebp + 8]
push 0x103ad468
push 0x103ad312
call fcn.10047f80
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004fa50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [0x103acd88], 0
push ebx
push esi
je 0x1004faca
cmp byte [0x103acd89], 0
jne 0x1004fb18
mov byte [0x103acd89], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x103ace6c]
xor ebx, dword [0x103ace68]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x103acd8a]
xor al, bl
mov byte [esi + 0x103acd8a], al
inc esi
cmp esi, 0xd7
jb 0x1004fa80
jmp 0x1004fb18
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x103ace6c]
xor ebx, dword [0x103ace68]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x103acd8a]
xor al, bl
mov byte [esi + 0x103acd8a], al
inc esi
cmp esi, 0xd7
jb 0x1004fad0
push ecx
mov ecx, dword [ebp + 8]
push 0x103ace60
push 0x103acd8a
call fcn.10047f80
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4