joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004d2f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [0x101e42c0], 0
push ebx
push esi
je 0x1004d367
cmp byte [0x101e42c1], 0
jne 0x1004d3b5
mov byte [0x101e42c1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x101e4314]
xor ebx, dword [0x101e4310]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x101e42c2]
xor al, bl
mov byte [esi + 0x101e42c2], al
inc esi
cmp esi, 0x48
jb 0x1004d320
jmp 0x1004d3b5
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x101e4314]
xor ebx, dword [0x101e4310]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x101e42c2]
xor al, bl
mov byte [esi + 0x101e42c2], al
inc esi
cmp esi, 0x48
jb 0x1004d370
push ecx
mov ecx, dword [ebp + 8]
push 0x101e4309
push 0x101e42c2
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004d3e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004d450
cmp byte [esi + 1], 0
jne 0x1004d497
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x30
jb 0x1004d410
jmp 0x1004d497
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x30
jb 0x1004d456
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x31]
push eax
push edi
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004d4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [0x101e5908], 0
push ebx
push esi
je 0x1004d537
cmp byte [0x101e5909], 0
jne 0x1004d585
mov byte [0x101e5909], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x101e5944]
xor ebx, dword [0x101e5940]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x101e590a]
xor al, bl
mov byte [esi + 0x101e590a], al
inc esi
cmp esi, 0x2f
jb 0x1004d4f0
jmp 0x1004d585
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x101e5944]
xor ebx, dword [0x101e5940]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x101e590a]
xor al, bl
mov byte [esi + 0x101e590a], al
inc esi
cmp esi, 0x2f
jb 0x1004d540
push ecx
mov ecx, dword [ebp + 8]
push 0x101e5938
push 0x101e590a
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004d5b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004d620
cmp byte [esi + 1], 0
jne 0x1004d667
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x2d
jb 0x1004d5e0
jmp 0x1004d667
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x2d
jb 0x1004d626
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x2e]
push eax
push edi
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004d690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004d700
cmp byte [esi + 1], 0
jne 0x1004d747
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x36
jb 0x1004d6c0
jmp 0x1004d747
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x36
jb 0x1004d706
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x37]
push eax
push edi
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004d770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004d7e0
cmp byte [esi + 1], 0
jne 0x1004d827
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x35
jb 0x1004d7a0
jmp 0x1004d827
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x35
jb 0x1004d7e6
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x36]
push eax
push edi
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004d850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004d8c0
cmp byte [esi + 1], 0
jne 0x1004d907
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x2b
jb 0x1004d880
jmp 0x1004d907
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x2b
jb 0x1004d8c6
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x2c]
push eax
push edi
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004d930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004d9a0
cmp byte [esi + 1], 0
jne 0x1004d9e7
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x26
jb 0x1004d960
jmp 0x1004d9e7
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x26
jb 0x1004d9a6
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x27]
push eax
push edi
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004da10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004da80
cmp byte [esi + 1], 0
jne 0x1004dac7
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x27
jb 0x1004da40
jmp 0x1004dac7
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x27
jb 0x1004da86
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x28]
push eax
push edi
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004daf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004db60
cmp byte [esi + 1], 0
jne 0x1004dba7
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x2c
jb 0x1004db20
jmp 0x1004dba7
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x2c
jb 0x1004db66
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x2d]
push eax
push edi
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004dbd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004dc40
cmp byte [esi + 1], 0
jne 0x1004dc87
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x1a
jb 0x1004dc00
jmp 0x1004dc87
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x1a
jb 0x1004dc46
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1b]
push eax
push edi
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004dcb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004dd20
cmp byte [esi + 1], 0
jne 0x1004dd67
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x29
jb 0x1004dce0
jmp 0x1004dd67
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x29
jb 0x1004dd26
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x2a]
push eax
push edi
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004dd90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004de00
cmp byte [esi + 1], 0
jne 0x1004de47
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x6c]
xor ebx, dword [esi + 0x68]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x66
jb 0x1004ddc0
jmp 0x1004de47
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x6c]
xor ebx, dword [esi + 0x68]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x66
jb 0x1004de06
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x67]
push eax
push edi
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004de70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004dee0
cmp byte [esi + 1], 0
jne 0x1004df27
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x1e
jb 0x1004dea0
jmp 0x1004df27
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x1e
jb 0x1004dee6
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1f]
push eax
push edi
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004df50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004dfc0
cmp byte [esi + 1], 0
jne 0x1004e007
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x2a
jb 0x1004df80
jmp 0x1004e007
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x2a
jb 0x1004dfc6
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x2b]
push eax
push edi
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004e030
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [0x101e47f0], 0
push ebx
push esi
je 0x1004e0a7
cmp byte [0x101e47f1], 0
jne 0x1004e0f5
mov byte [0x101e47f1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x101e4844]
xor ebx, dword [0x101e4840]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + str.To__tD]
xor al, bl
mov byte [esi + str.To__tD], al
inc esi
cmp esi, 0x47
jb 0x1004e060
jmp 0x1004e0f5
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x101e4844]
xor ebx, dword [0x101e4840]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + str.To__tD]
xor al, bl
mov byte [esi + str.To__tD], al
inc esi
cmp esi, 0x47
jb 0x1004e0b0
push ecx
mov ecx, dword [ebp + 8]
push 0x101e4838
push str.To__tD
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004e120
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x1017c400]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [ebp + 8]
mov ecx, 0x101e5e50
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [esp + 0x24], eax
lea eax, [esp + 0x28]
push edi
push eax
call fcn.1003ad50
cmp dword [esp + 0x40], 0xf
lea eax, [esp + 0x2c]
cmova eax, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop dword [eax]
mov ebx, dword [eax + 0x18]
mov dword [esp + 0x1c], ebx
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ecx + ebx + 0x78]
add ecx, ebx
mov dword [esp + 0x18], ecx
cmp ecx, ebx
je 0x1004e1fd
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x1004e1fd
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, ebx
sub ecx, 4
dec edx
mov dword [esp + 0x14], ecx
mov edi, 0x20f313ee
mov dword [esp + 0xc], edx
mov ecx, dword [ecx]
add ecx, ebx
mov bl, byte [ecx]
inc ecx
test bl, bl
je 0x1004e1f2
movsx esi, bl
lea ecx, [ecx + 1]
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
mov bl, byte [ecx - 1]
cmova edx, esi
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x1004e1c3
cmp edi, 0xeed9e15e
je 0x1004e204
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
mov ebx, dword [eax + 0x18]
test edx, edx
jne 0x1004e1a7
mov eax, dword [eax]
jmp 0x1004e180
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x1c]
push dword [esp + 0x20]
mov eax, dword [esi + 0x24]
push dword [esp + 0x28]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
mov ecx, dword [esp + 0x40]
mov esi, eax
cmp ecx, 0xf
jbe 0x1004e263
mov edx, dword [esp + 0x2c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1004e259
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004e2c6
push ecx
push edx
call fcn.100bf656
add esp, 8
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0xf
mov byte [esp + 0x2c], 0
test esi, esi
jne 0x1004e296
mov eax, dword [esp + 0x10]
mov dword [eax], esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.100bf244
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esp + 0x28]
cmp dword [eax + 0x14], 0xf
jbe 0x1004e2a2
mov eax, dword [eax]
push 0
push eax
call esi
mov ecx, dword [esp + 0x18]
add esp, 8
pop edi
mov dword [ecx], eax
mov eax, ecx
mov ecx, dword [esp + 0x40]
pop esi
pop ebx
xor ecx, esp
call fcn.100bf244
mov esp, ebp
pop ebp
ret 0xc
call fcn.1012a37e
int3