joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464290
Capabilities:
Send data
Send data on socket

Disassembly:
cmp byte [ecx], 0
je 0x45d4d3
mov al, byte [ecx + 1]
test al, al
je 0x45d4d3
xor ecx, ecx
jmp 0x561f40
ret
push esi
mov esi, ecx
mov ecx, dword [esi]
mov eax, dword [ecx + 0x3fc4]
test eax, eax
je 0x4643be
mov al, byte [ecx + 0x28]
test al, al
je 0x464301
call fcn.00460c60
mov ecx, dword [esi]
push 1
call fcn.00460cb0
mov eax, dword [esi]
cmp dword [eax + 0x3fc4], 3
jne 0x464325
cmp dword [0x7c569c], 5
je 0x4642f8
push 0x1ec5
push str.D:devF1_1999_2002SourceNetComm.cpp
push 1
mov ecx, 0x8ad25c
call fcn.004d7a50
test al, al
je 0x4642f8
push str.Entering__SynchronizeWithServer___
push 0x8ad25c
call fcn.004d7aa0
add esp, 8
mov ecx, dword [esi]
call fcn.0045f390
jmp 0x464325
push edi
mov byte [ecx + 0x28], 1
xor edi, edi
mov ecx, dword [esi]
lea ecx, [edi + ecx + 0x4180]
call fcn.004fffa0
add edi, 0x368
cmp edi, 0x16240
jl 0x464308
pop edi
mov eax, dword [esi]
mov ecx, dword [eax + 0x3fc4]
cmp ecx, 2
je 0x464337
cmp ecx, 1
jne 0x46436f
mov ecx, dword [0x7c56a4]
cmp ecx, 7
je 0x464360
mov dl, byte [0x7d105c]
test dl, dl
je 0x464351
cmp ecx, 5
je 0x464360
mov ecx, dword [eax + 0x3fb8]
push 1
call fcn.0057a570
jmp 0x464389
mov ecx, dword [eax + 0x3fb8]
push 0
call fcn.0057a570
jmp 0x464389
fld dword [0x59f0a0]
mov byte [eax + 0x14], 1
fstp dword [eax + 0x10]
mov edx, dword [esi]
mov eax, dword [0x59f0b8]
mov dword [edx + 0x390], eax
mov ecx, dword [esi]
mov dword [ecx + 0x388], 0
mov edx, dword [esi]
mov dword [edx + 0x380], 0
mov ecx, dword [esi]
push 1
add ecx, 0x1a3c0
call fcn.0045c8b0
mov ecx, dword [esi]
add ecx, 0x1b790
pop esi
jmp 0x45d4c0
pop esi
ret
test ecx, ecx
jne 0x561f4a
mov ecx, dword [0x5e4dfc]
mov edx, 1
jmp fcn.00562ac0
Function at 0x493c80
Capabilities:
Terminate process

Disassembly:
sub esp, 0x114
push ebx
push esi
mov esi, dword [esp + 0x120]
cmp esi, 1
mov ebx, ecx
jle 0x493de9
mov al, byte [0x5ea438]
push edi
mov byte [esp + 0x20], al
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 0x18c]
stosw word es:[edi], ax
push ecx
mov dword [esp + 0x14], str.Undefined_Error
mov dword [esp + 0x18], str.Warning
mov dword [esp + 0x1c], str.Error
mov dword [esp + 0x20], str.Critical_Error
mov edx, dword [esp + esi*4 + 0x14]
push edx
stosb byte es:[edi], al
lea eax, [esp + 0x28]
push str.OSC__s_on_line__d_:
push eax
call fcn.0058815f
mov edx, dword [esp + 0x138]
add esp, 0x10
test edx, edx
je 0x493d71
or ecx, 0xffffffff
xor eax, eax
lea edi, [esp + 0x20]
repne scasb al, byte es:[edi]
or ecx, 0xffffffff
push ebp
mov bp, word [0x5c64d4]
mov word [edi - 1], bp
lea eax, [esp + 0x24]
mov dword [esp + 0x10], eax
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
sub edi, ecx
mov edx, ecx
or ecx, 0xffffffff
mov esi, edi
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x128]
or ecx, 0xffffffff
lea edi, [esp + 0x24]
repne scasb al, byte es:[edi]
mov word [edi - 1], bp
lea edi, [esp + 0x24]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ax, word [0x5c30b4]
mov word [edi - 1], ax
pop ebp
mov eax, dword [ebx + 8]
test eax, eax
pop edi
jne 0x493da1
lea ecx, [ebx + 0x10c]
push 0x5c302c
push ecx
call fcn.00587db0
add esp, 8
test eax, eax
mov dword [ebx + 8], eax
je 0x493da1
push 0
push 0
push eax
call fcn.00587f64
add esp, 0xc
mov eax, dword [ebx + 8]
test eax, eax
je 0x493dc9
lea edx, [esp + 0x1c]
push edx
push 0x5c2c18
push eax
call fcn.005887b1
mov eax, dword [ebx + 8]
push 0x5c30b4
push eax
call fcn.005887b1
add esp, 0x14
cmp esi, 3
je 0x493dd3
cmp esi, 2
jne 0x493de9
mov ebx, dword [ebx + 0x1a4]
test ebx, ebx
je 0x493df6
lea ecx, [esp + 0x1c]
push ecx
mov ecx, ebx
call fcn.004986d0
pop esi
xor eax, eax
pop ebx
add esp, 0x114
ret 8
push 0
push str.OSC_Read_Error
lea edx, [esp + 0x24]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.00589ca4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x4986d0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x80
test eax, eax
je 0x498711
push 0x7f
push eax
lea eax, [esp + 8]
push eax
call fcn.00587dd0
add esp, 0xc
push 0
push str.Options_Error
lea ecx, [esp + 8]
push ecx
push 0
mov byte [esp + 0x8f], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.00589ca4
add esp, 0x80
ret 4
Function at 0x4a18d0
Capabilities:
Check mutex on windows

Disassembly:
push 0x1a4
push str.D:devF1_1999_2002Sourceosman.cpp
push 2
mov ecx, 0x8ad25c
call fcn.004d7a50
test al, al
je 0x4a18fc
push str.Entered_OSMan::Enter__
push 0x8ad25c
call fcn.004d7aa0
add esp, 8
push str._F1_Challenge_99_02_APP_MUTEX_
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [0x7ce2d8], eax
je 0x4a1924
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4a1924
xor eax, eax
ret
mov eax, 1
ret
Function at 0x4add50
Capabilities:
Copy file

Disassembly:
sub esp, 0x200
mov dl, byte [0x5ea438]
xor eax, eax
push esi
push edi
mov esi, ecx
mov byte [esp + 8], dl
mov ecx, 0x3f
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x108], dl
mov ecx, 0x3f
lea edi, [esp + 0x109]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [0x5ec440]
test eax, eax
jne 0x4add9c
mov eax, 0x5ea438
push str.quickChatText.txt
push eax
lea eax, [esp + 0x110]
push 0x5be860
push eax
call fcn.0058815f
add esp, 0x10
push 0xee
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.004b0220
mov edx, dword [str.quickChatText.txt]
or ecx, 0xffffffff
xor eax, eax
lea edi, [esp + 8]
repne scasb al, byte es:[edi]
mov eax, dword [0x5c5e64]
mov ecx, dword [0x5c5e68]
dec edi
mov dword [edi], edx
mov edx, dword [0x5c5e6c]
mov dword [edi + 4], eax
mov ax, word [0x5c5e70]
mov dword [edi + 8], ecx
push 0
mov dword [edi + 0xc], edx
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x110]
push edx
mov word [edi + 0x10], ax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop edi
pop esi
add esp, 0x200
ret

Function at 0x4b0540
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x21c
mov al, byte [0x5ea438]
push esi
push edi
mov byte [esp + 0x24], al
mov esi, ecx
xor eax, eax
mov ecx, 0x7f
lea edi, [esp + 0x25]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 8]
stosb byte es:[edi], al
call fcn.005668b0
lea edi, [esi + 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x4b0584
mov dword [esi + 0x114], 1
push 0x200
lea edx, [esp + 0x28]
mov ecx, edi
call fcn.00568620
push 1
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x10]
call fcn.00566b20
test al, al
jne 0x4b05bf
lea ecx, [esp + 8]
call fcn.005668d0
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x21c
ret 4
push 0x200
lea edx, [esp + 0x28]
mov ecx, edi
call fcn.00568910
lea edx, [esp + 0x24]
lea eax, [esp + 0x24]
sub edi, edx
lea esp, [esp]
mov cl, byte [eax]
mov byte [edi + eax], cl
inc eax
test cl, cl
jne 0x4b05e0
test byte [0x7cb710], 1
mov ecx, esi
je 0x4b05f9
push 2
jmp 0x4b05fb
push 1
call fcn.004ae750
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.004a1d10
mov edx, dword [esi + 0x1f00]
mov al, byte [esi + 0x2f08]
xor ecx, ecx
test edx, edx
setg cl
test al, al
mov dword [esi + 0x1f00], ecx
je 0x4b063e
mov ecx, dword [esi + 0x2f8c]
mov eax, 0x22
cmp ecx, eax
jge 0x4b063e
mov dword [esi + 0x2f8c], eax
mov al, byte [esi + 0x2ed8]
test al, al
je 0x4b065d
mov ecx, dword [esi + 0x2f8c]
mov eax, 0x21
cmp ecx, eax
jge 0x4b065d
mov dword [esi + 0x2f8c], eax
mov eax, dword [esi + 0x138]
test eax, eax
jne 0x4b066c
mov eax, 0x5ea438
push eax
mov ecx, 0x8ac368
call fcn.004c5690
mov eax, dword [esi + 0x1f78]
lea edx, [eax + eax*8]
mov edi, dword [esi + edx*4 + 0x24f8]
mov ecx, 0x5ec6d0
call fcn.0042bc10
neg al
sbb eax, eax
neg eax
add eax, edi
cmp eax, 1
jge 0x4b06a5
mov eax, 1
jmp 0x4b06af
cmp eax, 0x68
Function at 0x4bb950
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x8c]
xor ebx, ebx
cmp eax, ebx
push edi
je 0x4bb970
push eax
call fcn.00587bcf
add esp, 4
mov dword [esi + 0x8c], ebx
mov eax, dword [esi + 0x90]
cmp eax, ebx
je 0x4bb989
push eax
call fcn.00587bcf
add esp, 4
mov dword [esi + 0x90], ebx
mov ecx, dword [esi + 0x94]
cmp ecx, ebx
mov dword [esi + 0x98], ebx
je 0x4bb9c2
mov edx, dword [esi + 8]
xor eax, eax
cmp edx, ebx
jle 0x4bb9b3
cmp byte [ecx + eax], 1
jne 0x4bb9ae
inc dword [esi + 0x98]
inc eax
cmp eax, edx
jl 0x4bb9a2
push ecx
call fcn.00587bcf
add esp, 4
mov dword [esi + 0x94], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0xc], 2
mov eax, 0xbf800000
mov dword [esi + 0x14], eax
mov ecx, eax
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov edx, eax
mov dword [esi + 0x68], edx
mov dword [esi + 0x6c], edx
mov dword [esi + 0x70], edx
mov dword [esi + 0x74], ecx
mov dword [esi + 0x78], ecx
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x80], eax
or eax, 0xffffffff
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov byte [esi + 0xa8], bl
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
mov byte [esi + 0xb4], bl
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
mov dword [esi + 0xd0], ebx
mov byte [esi + 0xd4], bl
mov dword [esi + 0xdc], ebx
lea edi, [esi + 0xe0]
mov dword [esi + 0xbc], eax
mov dword [esi + 0xc0], eax
mov dword [esi + 0xd8], eax
mov ecx, 0xa
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebx
ret
Function at 0x4c2300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esi]
xor ebx, ebx
cmp edi, ebx
je 0x4c2344
nop
mov ebp, edi
cmp byte [ebp + 8], bl
mov edi, dword [edi + 4]
je 0x4c2337
mov ecx, dword [ebp]
cmp ecx, ebx
mov dword [esp + 0x10], ecx
je 0x4c2337
call fcn.004c0b10
mov eax, dword [esp + 0x10]
push eax
call fcn.00587bcf
add esp, 4
push ebp
call fcn.00587bcf
add esp, 4
cmp edi, ebx
jne 0x4c2310
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ebp, dword [esi + 0x10]
cmp ebp, ebx
je 0x4c23a3
mov eax, ebp
cmp byte [eax + 8], bl
mov ebp, dword [ebp + 4]
mov dword [esp + 0x10], eax
je 0x4c2396
mov edi, dword [eax]
cmp edi, ebx
je 0x4c2396
mov eax, dword [edi + 8]
cmp eax, ebx
je 0x4c237a
push eax
call fcn.00587bcf
add esp, 4
mov eax, dword [edi]
cmp eax, ebx
je 0x4c2389
push eax
call fcn.00587bcf
add esp, 4
push edi
call fcn.00587bcf
mov eax, dword [esp + 0x14]
add esp, 4
push eax
call fcn.00587bcf
add esp, 4
cmp ebp, ebx
jne 0x4c2356
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x70], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov byte [esi + 0x6c], 1
mov ecx, dword [0x7d0a24]
pop edi
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x80], ecx
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x503533
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x18], eax
jae 0x503654
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
jae 0x503638
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 0xc], edi
shr edi, 2
and edi, esi
mov dword [ebp - 4], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 0xc]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp - 4]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 0xc]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0x10]
add ecx, 8
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov esi, 0xffc03fc0
jne 0x50358a
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x18]
mov dword [ebp + 0xc], edx
jb 0x503568
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret
Function at 0x503920
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x503a67
mov edx, 0xf81f
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x503a42
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff07e0
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x1002]
mov ebp, eax
and ebp, 0xffff07e0
add ebp, ecx
mov ecx, edi
and ecx, 0xffff07e0
add ebp, ecx
mov ecx, esi
and ecx, 0xffff07e0
shr ebx, 2
lea ecx, [ecx + ebp + 0x40]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff07e0
lea eax, [eax + esi + 0x1002]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x503989
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x503960
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x503b94
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
mov edx, dword [esi + 0x18]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
add ebp, edx
cmp edx, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], ebp
jae 0x503cda
mov eax, 0x83e0
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [edx + esi*2]
mov dword [esp + 0x10], ebx
add edi, edx
cmp edx, esi
mov ebx, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x503cb5
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx edx, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
and ebp, eax
mov ebx, edx
and ebx, eax
add ebx, ebp
mov ebp, edi
and ebp, eax
add ebx, ebp
mov dword [esp + 0x24], ecx
and ecx, 0x7c1f
mov ebp, esi
and ebp, eax
lea ebx, [ebx + ebp + 0x10040]
mov ebp, edx
and ebp, 0x7c1f
add ebp, ecx
mov ecx, edi
and ecx, 0x7c1f
add ebp, ecx
mov ecx, esi
and ecx, 0x7c1f
lea ecx, [ecx + ebp + 0x802]
shr ecx, 2
shr ebx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and ecx, eax
and edx, eax
add edx, ecx
and edi, eax
add edx, edi
mov edi, dword [esp + 0x1c]
and esi, eax
and ebx, 0xffff7c1f
lea ecx, [edx + esi + 0x10040]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [ecx], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x503bfd
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea edx, [edx + edi*2]
cmp edx, ebp
mov dword [esp + 0x20], edx
jb 0x503bd4
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x503ce3
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x503e2d
mov edx, 0xf0f0
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x503e08
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff0f0f
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x2020]
mov ebp, eax
and ebp, 0xffff0f0f
add ebp, ecx
mov ecx, edi
and ecx, 0xffff0f0f
add ebp, ecx
mov ecx, esi
and ecx, 0xffff0f0f
shr ebx, 2
lea ecx, [ecx + ebp + 0x202]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff0f0f
lea eax, [eax + esi + 0x2020]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x503d4c
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x503d23
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x503e36
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x105c]
push edi
mov edi, dword [edx + 0x1050]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x503f6c
push ebx
mov edx, dword [edx + 0x1058]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x503f47
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0x1c
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 8]
mov ecx, eax
and ecx, 0xffff00e3
mov ebx, ebp
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00e3
shr edx, 2
lea ecx, [ecx + ebx + 0x42]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xe3
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0x1c
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x42]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x503e95
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1050]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1050]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x503e71
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x504010
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
mov ebp, dword [edx + 0x1050]
push edi
mov edi, dword [edx + 0x105c]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x18]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x504154
push ebx
push esi
mov esi, 0xff1c
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x1058]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x50412e
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xe3
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 0x42]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x208]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x208]
shr eax, 2
and edx, 0xffff00e3
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x504079
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x1050]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x1050]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x504050
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret