joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c09a0
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x4c09cd
push esi
lea esp, [esp]
movzx ecx, cl
movzx ecx, byte [ecx + 0x58a7d0]
lea esi, [eax*8]
xor ecx, esi
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x4c09b0
pop esi
ret

Function at 0x4cbf60
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
mov dword [ebp], 0
cmp dword [0x59bf10], 0
push esi
je 0x4cbfc2
mov eax, dword [0x5a2d00]
test eax, eax
je 0x4cbf8e
push eax
call dword [0x59bf64]
add esp, 4
lea eax, [esp + 0x10]
push eax
mov eax, 0x14
call fcn.004cb470
mov eax, dword [0x5a2d00]
add esp, 4
test eax, eax
je 0x4cbfb3
push eax
call dword [0x59bf6c]
add esp, 4
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x4cbfd1
lea eax, [esi + 7]
pop esi
pop ebp
pop ebx
ret
push 0x14
call dword [0x59bf34]
add esp, 4
mov esi, eax
jmp 0x4cbfb7
cmp dword [0x59bf14], 0
je 0x4cc015
mov eax, dword [0x59c018]
test eax, eax
je 0x4cbff1
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x4cc015
lea ecx, [esi + 4]
push ecx
push 0
push esi
push 0x4bf750
push 0
push 0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], edi
call fcn.005553a3
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x4cc025
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp dword [esi + 8], 0
jne 0x4cc03d
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call ebx
add esp, 4
mov dword [esi + 0x10], eax
mov dword [ebp], esi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x4cc410
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, eax
lea eax, [esi*8]
cmp eax, 0x400
jbe 0x4cc427
mov esi, 0x80
cmp esi, dword [edi]
jne 0x4cc430
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [0x5a2b9c]
test eax, eax
je 0x4cc43b
call eax
lea ecx, [esi*8]
push 0
push ecx
call fcn.004cb540
mov esi, eax
mov eax, dword [0x5a2ba0]
add esp, 8
mov dword [esp + 4], esi
test eax, eax
je 0x4cc45e
call eax
test esi, esi
je 0x4cc42b
mov edx, dword [edi + 0xc]
push ebx
push edx
call fcn.004bf5d0
push esi
mov dword [edi + 0xc], esi
call dword [0x59bf40]
mov ebx, eax
shr ebx, 3
lea eax, [ebx*8]
push eax
push 0
push esi
mov dword [edi], ebx
call fcn.00412eb0
mov ecx, dword [edi + 8]
add esp, 0x14
mov dword [edi + 8], 0
test ecx, ecx
je 0x4cc536
push ebp
mov esi, dword [ecx + 0xc]
mov dl, byte [esi]
xor eax, eax
test dl, dl
je 0x4cc4cc
mov edi, edi
movzx edx, dl
movzx edx, byte [edx + 0x58a7d0]
lea ebp, [eax*8]
xor edx, ebp
inc esi
xor eax, edx
mov dl, byte [esi]
test dl, dl
jne 0x4cc4b0
xor edx, edx
div ebx
mov eax, dword [esp + 0xc]
mov ebp, dword [ecx]
lea eax, [eax + edx*8]
test eax, eax
je 0x4cc512
mov esi, dword [eax]
test esi, esi
je 0x4cc4e8
mov edx, dword [eax + 4]
jmp 0x4cc4ea
xor edx, edx
inc esi
mov dword [eax], esi
mov dword [eax + 4], ecx
test edx, edx
je 0x4cc512
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x4cc50a
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x4cc52b
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x4cc52b
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x4cc521
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, ebp
test ebp, ebp
jne 0x4cc4a3
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
Function at 0x4dc0d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push esi
mov esi, dword [edi + 8]
test esi, esi
jne 0x4dc11c
push edi
call fcn.004d6270
mov esi, eax
add esp, 4
mov dword [edi + 8], eax
test esi, esi
je 0x4dc0ff
push 0
push 0
push 0
push 0x9f
push esi
call fcn.004cf760
add esp, 0x14
cmp dword [edi + 0x19c], 0
jne 0x4dc114
mov eax, dword [edi]
test byte [eax + 0x3c], 8
jne 0x4dc114
mov byte [edi + 0x17], 1
test esi, esi
je 0x4dc27a
mov al, byte [edi + 0x13]
test al, al
jne 0x4dc12f
inc dword [edi + 0x48]
mov ecx, dword [edi + 0x48]
mov dword [esp + 4], ecx
jmp 0x4dc13f
dec al
movzx edx, al
mov byte [edi + 0x13], al
mov eax, dword [edi + edx*4 + 0x18]
mov dword [esp + 4], eax
mov al, byte [edi + 0x13]
push ebx
test al, al
jne 0x4dc14f
inc dword [edi + 0x48]
mov ebx, dword [edi + 0x48]
jmp 0x4dc15b
dec al
movzx ecx, al
mov byte [edi + 0x13], al
mov ebx, dword [edi + ecx*4 + 0x18]
mov edx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x14]
push 2
push edx
push ebp
push 0x34
push esi
call fcn.004cf760
mov eax, 1
mov ecx, ebp
shl eax, cl
add esp, 0x14
or dword [esi + 0x60], eax
cmp ebp, 1
je 0x4dc199
mov ecx, dword [esi]
mov edx, dword [ecx + 0x10]
shl ebp, 4
mov ecx, dword [edx + ebp + 4]
cmp byte [ecx + 9], 0
je 0x4dc199
or dword [esi + 0x64], eax
mov edx, dword [esp + 0x18]
push 0
push ebx
push edx
push 0x17
push esi
call fcn.004cf760
mov eax, dword [esp + 0x20]
push eax
push 0
push ebx
push 0x53
push esi
call fcn.004cf760
mov ecx, dword [esi]
mov ebp, eax
mov eax, dword [esi + 0x20]
add esp, 0x28
dec eax
cmp byte [ecx + 0x41], 0
je 0x4dc1d1
mov eax, 0x5a2838
jmp 0x4dc1da
lea edx, [eax + eax*4]
mov eax, dword [esi + 4]
lea eax, [eax + edx*4]
mov ecx, dword [esp + 0x14]
push ebx
push 2
push ecx
push 0x35
push esi
mov byte [eax + 3], 0x90
call fcn.004cf760
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x18]
dec edx
add esp, 0x14
mov dword [eax + 0x5c], edx
mov ecx, dword [esi + 0x20]
mov eax, ebp
test ebp, ebp
pop ebp
jge 0x4dc208
lea eax, [ecx - 1]
mov edx, dword [esi]
cmp byte [edx + 0x41], 0
je 0x4dc217
mov eax, 0x5a2838
jmp 0x4dc220
mov edx, dword [esi + 4]
lea eax, [eax + eax*4]
lea eax, [edx + eax*4]
mov esi, dword [esp + 8]
mov dword [eax + 8], ecx
test esi, esi
je 0x4dc250
mov dl, byte [edi + 0x13]
cmp dl, 8
jae 0x4dc250
xor eax, eax
lea ecx, [edi + 0x78]
cmp dword [ecx + 0xc], esi
je 0x4dc27d
inc eax
add ecx, 0x14
cmp eax, 0xa
jl 0x4dc238
movzx eax, dl
mov dword [edi + eax*4 + 0x18], esi
inc byte [edi + 0x13]
test ebx, ebx
je 0x4dc279
mov dl, byte [edi + 0x13]
cmp dl, 8
jae 0x4dc279
xor eax, eax
lea ecx, [edi + 0x78]
cmp dword [ecx + 0xc], ebx
je 0x4dc283
inc eax
add ecx, 0x14
cmp eax, 0xa
jl 0x4dc261
movzx ecx, dl
mov dword [edi + ecx*4 + 0x18], ebx
inc byte [edi + 0x13]
pop ebx
pop esi
pop ecx
ret
mov byte [ecx + 6], 1
jmp 0x4dc250
pop ebx
mov byte [ecx + 6], 1
pop esi
pop ecx
ret
Function at 0x4ed310
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x24
movzx ecx, word [edi + 0x12]
mov edx, dword [edi + 0x34]
movzx eax, byte [edi + 6]
push ebx
mov ebx, dword [edx + 0x24]
push ebp
movzx ebp, word [edi + 0xe]
push esi
mov esi, dword [edi + 0x38]
lea edx, [ebp + ecx*2]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], 0
test ecx, ecx
jle 0x4ed451
lea eax, [esi + ebp]
mov dword [esp + 0x10], eax
jmp 0x4ed368
mov eax, dword [esp + 0x10]
movzx ebp, byte [eax]
movzx eax, byte [eax + 1]
shl ebp, 8
or ebp, eax
cmp ebp, dword [esp + 0x18]
jl 0x4ed4cf
mov eax, dword [esp + 0x1c]
add eax, 0xfffffffc
cmp ebp, eax
jg 0x4ed4cf
mov ecx, dword [esp + 0x14]
mov eax, dword [edi + 0x4c]
lea edx, [ecx + ebp]
push edx
push edi
call eax
movzx ecx, ax
sub ebx, ecx
add esp, 8
cmp ebx, dword [esp + 0x18]
mov dword [esp + 0x28], ecx
jl 0x4ed4aa
lea edx, [ecx + ebp]
cmp edx, dword [esp + 0x1c]
jg 0x4ed4aa
mov eax, dword [esp + 0x10]
mov edx, ebx
sar edx, 8
cmp dword [esp + 0xc], 0
mov byte [eax], dl
mov byte [eax + 1], bl
jne 0x4ed41d
cmp ebx, ebp
je 0x4ed431
mov eax, dword [edi + 0x34]
mov edx, dword [eax]
mov eax, dword [edx + 0xc8]
mov edx, dword [esp + 0x24]
mov dword [esp + 0xc], eax
movzx eax, byte [edx + esi + 5]
movzx edx, byte [edx + esi + 6]
shl eax, 8
or eax, edx
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, ebx
push ecx
lea ecx, [eax + esi]
push ecx
add eax, edx
push eax
call fcn.0040dc50
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x34]
add esp, 0xc
mov dword [esp + 0x14], eax
push ecx
mov ecx, dword [esp + 0x18]
add ebp, ecx
lea edx, [ebx + esi]
push ebp
push edx
call fcn.0040dc50
add esp, 0xc
mov eax, dword [esp + 0x20]
add dword [esp + 0x10], 2
inc eax
cmp eax, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
jl 0x4ed364
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov ecx, ebx
mov byte [eax + esi + 6], bl
sub ebx, edx
push ebx
add edx, esi
sar ecx, 8
push 0
push edx
mov byte [eax + esi + 5], cl
mov byte [eax + esi + 1], 0
mov byte [eax + esi + 2], 0
mov byte [eax + esi + 7], 0
call fcn.00412eb0
movzx edx, word [edi + 0x10]
add esp, 0xc
cmp ebx, edx
je 0x4ed4f4
push 0x58e0b0
push 0xdcc8
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.004e01f0
add esp, 0x10
pop esi
pop ebp
mov eax, 0xb
pop ebx
add esp, 0x24
ret
push 0x58e0b0
push 0xdcb0
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.004e01f0
add esp, 0x10
pop esi
pop ebp
mov eax, 0xb
pop ebx
add esp, 0x24
ret
push 0x58e0b0
push 0xdcaa
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.004e01f0
add esp, 0x10
pop esi
pop ebp
mov eax, 0xb
pop ebx
add esp, 0x24
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
Function at 0x4ed630
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, eax
movzx ecx, word [edi + 0x12]
movzx edx, word [edi + 0xe]
movzx eax, byte [edi + 6]
mov esi, dword [edi + 0x38]
movzx ebx, byte [esi + eax + 5]
lea ebp, [edx + ecx*2]
lea ecx, [esi + eax + 5]
lea edx, [esi + eax + 6]
mov dword [esp + 0x14], ecx
movzx ecx, byte [edx]
shl ebx, 8
or ebx, ecx
cmp ebp, ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], edx
jle 0x4ed6ab
test ebx, ebx
jne 0x4ed685
mov edx, dword [edi + 0x34]
mov ebx, 0x10000
cmp dword [edx + 0x24], ebx
je 0x4ed6ab
push 0x58e0b0
push 0xdd37
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.004e01f0
add esp, 0x10
pop edi
pop esi
pop ebp
mov eax, 0xb
pop ebx
add esp, 0xc
ret
cmp byte [esi + eax + 2], 0
jne 0x4ed6b9
cmp byte [esi + eax + 1], 0
je 0x4ed6f1
lea eax, [ebp + 2]
cmp eax, ebx
jg 0x4ed6f1
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
push edi
call fcn.004ed500
add esp, 0xc
test eax, eax
je 0x4ed6e9
mov ecx, dword [esp + 0x24]
pop edi
sub eax, esi
pop esi
pop ebp
mov dword [ecx], eax
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4ed73c
mov esi, dword [esp + 0x20]
lea edx, [esi + ebp + 2]
cmp edx, ebx
jle 0x4ed721
call fcn.004ed310
test eax, eax
jne 0x4ed73c
mov eax, dword [esp + 0x14]
movzx ebx, byte [eax]
mov ecx, dword [esp + 0x18]
movzx edx, byte [ecx]
shl ebx, 8
or ebx, edx
dec ebx
and ebx, 0xffff
inc ebx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
sub ebx, esi
mov eax, ebx
sar eax, 8
mov byte [ecx], al
mov eax, dword [esp + 0x24]
mov byte [edx], bl
mov dword [eax], ebx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x513520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsx edx, byte [ecx + 0x44]
mov edx, dword [ecx + edx*4 + 0x78]
mov edx, dword [edx + 0x3c]
push ebx
mov ebx, dword [ecx + 0x18]
push ebp
movzx ebp, word [ecx + 0x20]
push esi
mov esi, dword [esp + 0x18]
sub edx, ebx
push edi
mov edi, dword [esp + 0x14]
cmp ebp, edx
jae 0x513546
mov edx, ebp
lea ebp, [eax + edi]
cmp ebp, edx
ja 0x513565
add ebx, eax
mov eax, 0x1010
mov dword [esi + 0xc], edi
pop edi
mov dword [esi + 0x10], ebx
mov word [esi + 8], ax
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov edx, dword [esp + 0x18]
push edx
push eax
push ecx
call fcn.00513470
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x5142d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov esi, eax
call fcn.004c40c0
movsx edx, byte [esi + 0x44]
mov ecx, dword [esp + 0x64]
mov edi, dword [esi + 0x10]
xor eax, eax
mov word [esp + 0x18], ax
mov dword [esp + 0x30], ecx
mov ecx, dword [esi + 0x18]
mov dword [esp + 0x28], eax
mov eax, dword [esi + edx*4 + 0x78]
mov eax, dword [eax + 0x3c]
movzx edx, word [esi + 0x20]
sub eax, ecx
cmp edx, eax
jae 0x51430e
mov eax, edx
cmp edi, eax
ja 0x51432a
mov ebx, ecx
mov ecx, 0x1010
mov ebp, edi
mov dword [esp + 0x20], ebx
mov word [esp + 0x18], cx
mov dword [esp + 0x1c], ebp
jmp 0x51434b
push 1
push 0
push esi
lea esi, [esp + 0x1c]
call fcn.00513470
add esp, 0xc
test eax, eax
jne 0x514416
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov al, byte [ebx]
cmp al, 0x80
jae 0x514356
movzx edi, al
jmp 0x514365
lea esi, [esp + 0x64]
mov ecx, ebx
call fcn.004c04c0
mov edi, dword [esp + 0x64]
cmp edi, 3
jb 0x5143de
cmp edi, ebp
jg 0x5143de
mov al, byte [edi + ebx - 1]
lea ecx, [edi + ebx - 1]
cmp al, 0x80
jae 0x51437f
movzx edx, al
jmp 0x51438c
lea esi, [esp + 0x64]
call fcn.004c04c0
mov edx, dword [esp + 0x64]
lea eax, [edx - 1]
cmp eax, 8
ja 0x5143de
cmp edx, 7
je 0x5143de
movzx eax, byte [edx + 0x58af90]
lea ecx, [eax + edi]
cmp ebp, ecx
jb 0x5143de
lea ecx, [esp + 0x38]
push ecx
mov ecx, ebp
sub ecx, eax
add ecx, ebx
call fcn.004c4f60
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov dword [eax], edx
mov dword [eax + 4], ecx
add esp, 4
lea eax, [esp + 0x10]
call fcn.004c4480
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x50
ret
test dword [esp + 0x18], 0x2460
jne 0x5143ef
cmp dword [esp + 0x28], 0
je 0x5143f8
lea eax, [esp + 0x10]
call fcn.004c43e0
push 0x58e0b0
push 0x117c7
push str.database_corruption_at_line__d_of___.10s_
push 0xb
call fcn.004e01f0
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret
Function at 0x514420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebx
mov ebx, dword [esp + 0x38]
push esi
mov esi, dword [eax + 0x14]
push edi
mov eax, esi
call fcn.004c40c0
mov edi, dword [esi + 0x10]
mov eax, dword [esi + 0x14]
mov ecx, edi
add ecx, 0xffffffff
adc eax, 0xffffffff
test eax, eax
ja 0x5144f0
jb 0x514458
cmp ecx, 0x7ffffffe
ja 0x5144f0
mov edx, dword [esp + 0x38]
xor ecx, ecx
mov word [esp + 0x14], cx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x24], ecx
movsx eax, byte [esi + 0x44]
mov edx, dword [esi + eax*4 + 0x78]
mov eax, dword [edx + 0x3c]
mov ecx, dword [esi + 0x18]
movzx edx, word [esi + 0x20]
sub eax, ecx
cmp edx, eax
jae 0x514485
mov eax, edx
cmp edi, eax
ja 0x51449d
mov eax, 0x1010
mov dword [esp + 0x1c], ecx
mov word [esp + 0x14], ax
mov dword [esp + 0x18], edi
jmp 0x5144b2
push 1
push 0
push esi
lea esi, [esp + 0x18]
call fcn.00513470
add esp, 0xc
test eax, eax
jne 0x514514
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push 0
push ecx
push edx
push eax
call fcn.004ee7a0
add esp, 0x10
test dword [esp + 0x14], 0x2460
mov dword [ebx], eax
jne 0x5144de
cmp dword [esp + 0x24], 0
je 0x5144e7
lea eax, [esp + 0xc]
call fcn.004c43e0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x28
ret
push 0x58e0b0
push 0x117e9
push str.database_corruption_at_line__d_of___.10s_
push 0xb
mov dword [ebx], 0
call fcn.004e01f0
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x53f8c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, eax
xor eax, eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], eax
mov dword [edx + 0x18], eax
mov dword [edx + 0x1c], eax
mov dword [edx + 0x20], eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 0x1c], eax
push edi
mov dword [ecx + 0x20], eax
mov ebx, 1
mov edi, ebx
xor edi, ebp
mov eax, edi
shr eax, 2
or edi, eax
mov eax, edi
shr eax, 1
or eax, edi
mov edi, dword [esi]
and eax, 1
dec eax
and edi, eax
or dword [edx], edi
mov edi, dword [esi + 4]
and edi, eax
or dword [edx + 4], edi
mov edi, dword [esi + 8]
and edi, eax
or dword [edx + 8], edi
mov edi, dword [esi + 0xc]
and edi, eax
or dword [edx + 0xc], edi
mov edi, dword [esi + 0x10]
and edi, eax
or dword [edx + 0x10], edi
mov edi, dword [esi + 0x14]
and edi, eax
or dword [edx + 0x14], edi
mov edi, dword [esi + 0x18]
and edi, eax
or dword [edx + 0x18], edi
mov edi, dword [esi + 0x1c]
and edi, eax
or dword [edx + 0x1c], edi
mov edi, dword [esi + 0x20]
and edi, eax
or dword [edx + 0x20], edi
mov edi, dword [esi + 0x24]
and edi, eax
or dword [ecx], edi
mov edi, dword [esi + 0x28]
add esi, 0x24
and edi, eax
or dword [ecx + 4], edi
mov edi, dword [esi + 8]
and edi, eax
or dword [ecx + 8], edi
mov edi, dword [esi + 0xc]
and edi, eax
or dword [ecx + 0xc], edi
mov edi, dword [esi + 0x10]
and edi, eax
or dword [ecx + 0x10], edi
mov edi, dword [esi + 0x14]
and edi, eax
or dword [ecx + 0x14], edi
mov edi, dword [esi + 0x18]
and edi, eax
or dword [ecx + 0x18], edi
mov edi, dword [esi + 0x1c]
and edi, eax
or dword [ecx + 0x1c], edi
mov edi, dword [esi + 0x20]
and edi, eax
or dword [ecx + 0x20], edi
inc ebx
add esi, 0x24
cmp ebx, 0x10
jb 0x53f905
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x53f9c0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [edx], eax
mov dword [edx + 4], eax
mov dword [edx + 8], eax
mov dword [edx + 0xc], eax
mov dword [edx + 0x10], eax
mov dword [edx + 0x14], eax
push ebx
mov dword [edx + 0x18], eax
push ebp
mov dword [edx + 0x1c], eax
mov dword [edx + 0x20], eax
add ecx, 0x6c
mov ebp, 1
lea ebx, [ebx]
mov ebx, ebp
xor ebx, dword [esp + 0xc]
add ecx, 0x24
mov eax, ebx
shr eax, 2
or ebx, eax
mov eax, ebx
shr eax, 1
or eax, ebx
mov ebx, dword [ecx - 0x24]
and eax, 1
dec eax
and ebx, eax
or dword [edi], ebx
mov ebx, dword [ecx - 0x20]
and ebx, eax
or dword [edi + 4], ebx
mov ebx, dword [ecx - 0x1c]
and ebx, eax
or dword [edi + 8], ebx
mov ebx, dword [ecx - 0x18]
and ebx, eax
or dword [edi + 0xc], ebx
mov ebx, dword [ecx - 0x14]
and ebx, eax
or dword [edi + 0x10], ebx
mov ebx, dword [ecx - 0x10]
and ebx, eax
or dword [edi + 0x14], ebx
mov ebx, dword [ecx - 0xc]
and ebx, eax
or dword [edi + 0x18], ebx
mov ebx, dword [ecx - 8]
and ebx, eax
or dword [edi + 0x1c], ebx
mov ebx, dword [ecx - 4]
and ebx, eax
or dword [edi + 0x20], ebx
mov ebx, dword [ecx]
and ebx, eax
or dword [esi], ebx
mov ebx, dword [ecx + 4]
and ebx, eax
or dword [esi + 4], ebx
mov ebx, dword [ecx + 8]
and ebx, eax
or dword [esi + 8], ebx
mov ebx, dword [ecx + 0xc]
and ebx, eax
or dword [esi + 0xc], ebx
mov ebx, dword [ecx + 0x10]
and ebx, eax
or dword [esi + 0x10], ebx
mov ebx, dword [ecx + 0x14]
and ebx, eax
or dword [esi + 0x14], ebx
mov ebx, dword [ecx + 0x18]
and ebx, eax
or dword [esi + 0x18], ebx
mov ebx, dword [ecx + 0x1c]
and ebx, eax
or dword [esi + 0x1c], ebx
mov ebx, dword [ecx + 0x20]
and ebx, eax
or dword [esi + 0x20], ebx
mov ebx, dword [ecx + 0x24]
add ecx, 0x24
and ebx, eax
or dword [edx], ebx
mov ebx, dword [ecx + 4]
and ebx, eax
or dword [edx + 4], ebx
mov ebx, dword [ecx + 8]
and ebx, eax
or dword [edx + 8], ebx
mov ebx, dword [ecx + 0xc]
and ebx, eax
or dword [edx + 0xc], ebx
mov ebx, dword [ecx + 0x10]
and ebx, eax
or dword [edx + 0x10], ebx
mov ebx, dword [ecx + 0x14]
and ebx, eax
or dword [edx + 0x14], ebx
mov ebx, dword [ecx + 0x18]
and ebx, eax
or dword [edx + 0x18], ebx
mov ebx, dword [ecx + 0x1c]
and ebx, eax
or dword [edx + 0x1c], ebx
mov ebx, dword [ecx + 0x20]
and ebx, eax
or dword [edx + 0x20], ebx
inc ebp
add ecx, 0x24
cmp ebp, 0x10
jb 0x53fa20
pop ebp
pop ebx
ret
Function at 0x542bb0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov eax, dword [ecx + 8]
push ebx
mov ebx, dword [edx + 8]
push ebp
push esi
push edi
cmp eax, ebx
jb 0x542bd0
mov esi, dword [ecx + 0xc]
mov edi, dword [edx + 0xc]
mov ebp, eax
jmp 0x542bda
mov esi, dword [edx + 0xc]
mov edi, dword [ecx + 0xc]
mov ebp, ebx
mov ebx, eax
mov eax, dword [esp + 0x1c]
push ebp
push eax
call fcn.004b0e80
add esp, 8
mov dword [esp + 0x14], eax
test eax, eax
jl 0x542c4b
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0xc]
xor edx, edx
test ebx, ebx
jbe 0x542c1a
mov ecx, ebx
mov edx, ebx
mov ebx, dword [edi]
xor ebx, dword [esi]
add eax, 4
mov dword [eax - 4], ebx
add edi, 4
add esi, 4
sub ecx, 1
jne 0x542c01
mov ecx, dword [esp + 0x1c]
cmp edx, ebp
jae 0x542c35
mov ecx, ebp
sub ecx, edx
mov edx, dword [esi]
mov dword [eax], edx
add eax, 4
add esi, 4
sub ecx, 1
jne 0x542c22
mov ecx, dword [esp + 0x1c]
push ecx
mov dword [ecx + 8], ebp
mov dword [ecx], 0
call fcn.004b0380
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x542c50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, ecx
xor esi, esi
mov ebx, eax
test edi, edi
je 0x542c97
mov ecx, dword [esp + 0x20]
mov eax, dword [ebp]
push ecx
push eax
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
dec edi
add ebp, 4
call fcn.00542a30
mov ecx, dword [esp + 0x20]
xor ecx, esi
mov esi, dword [esp + 0x24]
mov dword [ebx], ecx
add esp, 0x10
add ebx, 4
test edi, edi
jne 0x542c65
pop edi
mov dword [ebx], esi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x542cb0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov ebx, ecx
xor edi, edi
mov esi, eax
test ebx, ebx
je 0x542cf9
mov ecx, dword [esp + 0x20]
mov eax, dword [ebp]
push ecx
push eax
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
dec ebx
add ebp, 4
call fcn.00542a30
mov ecx, dword [esi]
xor ecx, dword [esp + 0x20]
add esp, 0x10
xor ecx, edi
mov edi, dword [esp + 0x14]
mov dword [esi], ecx
add esi, 4
test ebx, ebx
jne 0x542cc5
xor dword [esi], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret