joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003b1b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1003b220
cmp byte [esi + 1], 0
jne 0x1003b267
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x11
jb 0x1003b1e0
jmp 0x1003b267
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x11
jb 0x1003b226
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x12]
push eax
push edi
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1003b390
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push ebx
push esi
mov dword [eax], ecx
mov dword [eax + 4], 4
mov eax, dword fs:[0x30]
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0x18]
mov dword [ebp - 0x10], ebx
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ecx + ebx + 0x78]
add ecx, ebx
mov dword [ebp - 0xc], ecx
cmp ecx, ebx
je 0x1003b438
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x1003b438
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, ebx
nop dword [eax + eax]
sub ecx, 4
dec edx
mov dword [ebp - 8], ecx
mov edi, 0x108133cc
mov dword [ebp - 4], edx
mov ecx, dword [ecx]
add ecx, ebx
mov bl, byte [ecx]
inc ecx
test bl, bl
je 0x1003b42e
nop word [eax + eax]
movsx esi, bl
lea ecx, [ecx + 1]
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
mov bl, byte [ecx - 1]
cmova edx, esi
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x1003b400
cmp edi, 0xc0a7f4ce
je 0x1003b43f
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov ebx, dword [eax + 0x18]
test edx, edx
jne 0x1003b3e0
mov eax, dword [eax]
jmp 0x1003b3b6
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
mov esi, dword [ebp - 0x14]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + edx]
lea eax, [esi + 8]
push eax
push 4
push 4
push dword [ebp + 8]
add ecx, edx
call ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1003b480
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword fs:[0x30]
push ebx
push esi
mov dword [ebp - 0x14], ecx
mov eax, dword [eax + 0xc]
push edi
mov eax, dword [eax + 0xc]
nop dword [eax + eax]
mov ebx, dword [eax + 0x18]
mov dword [ebp - 0x10], ebx
mov edx, dword [ebx + 0x3c]
mov ecx, dword [edx + ebx + 0x78]
add ecx, ebx
mov dword [ebp - 0xc], ecx
cmp ecx, ebx
je 0x1003b518
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x1003b518
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, ebx
sub ecx, 4
dec edx
mov dword [ebp - 8], ecx
mov edi, 0xf8c5d648
mov dword [ebp - 4], edx
mov ecx, dword [ecx]
add ecx, ebx
mov bl, byte [ecx]
inc ecx
test bl, bl
je 0x1003b50e
nop
movsx esi, bl
lea ecx, [ecx + 1]
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
mov bl, byte [ecx - 1]
cmova edx, esi
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x1003b4e0
cmp edi, 0x9639f91a
je 0x1003b51c
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov ebx, dword [eax + 0x18]
test edx, edx
jne 0x1003b4c5
mov eax, dword [eax]
jmp 0x1003b4a0
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov ecx, dword [eax + edx]
add ecx, edx
mov edx, dword [ebp - 0x14]
lea eax, [edx + 8]
push eax
push dword [eax]
push dword [edx + 4]
push dword [edx]
call ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10042840
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov ebx, ecx
or eax, 0xffffffff
push esi
push edi
mov edi, 4
lea esi, [ebx + 4]
jmp dword [edi*4 + 0x10043a88]

Function at 0x100488e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10048950
cmp byte [esi + 1], 0
jne 0x10048997
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x2e
jb 0x10048910
jmp 0x10048997
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x2e
jb 0x10048956
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x2f]
push eax
push edi
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100489c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10048a30
cmp byte [esi + 1], 0
jne 0x10048a77
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x23
jb 0x100489f0
jmp 0x10048a77
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x23
jb 0x10048a36
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x24]
push eax
push edi
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004b5d0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1017c400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101f1a5c]
push ebx
mov ebx, ecx
mov dword [ebp - 0x30], ebx
push esi
push edi
test eax, eax
jne 0x1004b721
mov esi, dword [0x101f8418]
test esi, esi
jne 0x1004b6b3
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop
mov ebx, dword [eax + 0x18]
mov dword [ebp - 0x2c], ebx
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ecx + ebx + 0x78]
add ecx, ebx
mov dword [ebp - 0x28], ecx
cmp ecx, ebx
je 0x1004b688
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x1004b688
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, ebx
sub ecx, 4
dec edx
mov dword [ebp - 0x24], ecx
mov edi, 0x18a0ef62
mov dword [ebp - 0x20], edx
mov ecx, dword [ecx]
add ecx, ebx
mov bl, byte [ecx]
inc ecx
test bl, bl
je 0x1004b67e
nop
movsx esi, bl
lea ecx, [ecx + 1]
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
mov bl, byte [ecx - 1]
cmova edx, esi
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x1004b650
cmp edi, 0xa292d30a
je 0x1004b68c
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov ebx, dword [eax + 0x18]
test edx, edx
jne 0x1004b635
mov eax, dword [eax]
jmp 0x1004b610
mov esi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x30]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov esi, dword [eax + edx]
add esi, edx
mov dword [0x101f8418], esi
lea eax, [ebp - 0x1c]
mov ecx, 0x101e3f90
push eax
call fcn.1003ae30
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
cmova eax, dword [ebp - 0x1c]
push eax
push dword [0x101f1a90]
call esi
mov ecx, dword [ebp - 8]
mov dword [0x101f1a5c], eax
cmp ecx, 0xf
jbe 0x1004b70f
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1004b700
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004b738
push ecx
push edx
call fcn.100bf656
mov eax, dword [0x101f1a5c]
add esp, 8
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
push ebx
call eax
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100bf244
mov esp, ebp
pop ebp
ret
call fcn.1012a37e
int3
Function at 0x1004b740
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1017c400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101f1a58]
movss dword [ebp - 0x34], xmm1
movss dword [ebp - 0x20], xmm0
push ebx
push esi
push edi
test eax, eax
jne 0x1004b8ab
mov esi, dword [0x101f841c]
test esi, esi
jne 0x1004b833
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0x18]
mov dword [ebp - 0x30], ebx
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ecx + ebx + 0x78]
add ecx, ebx
mov dword [ebp - 0x2c], ecx
cmp ecx, ebx
je 0x1004b808
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x1004b808
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, ebx
nop dword [eax]
mov esi, dword [ecx - 4]
sub ecx, 4
add esi, ebx
mov dword [ebp - 0x28], ecx
dec edx
mov edi, 0x2990e47e
mov dword [ebp - 0x24], edx
mov bl, byte [esi]
inc esi
test bl, bl
je 0x1004b801
nop dword [eax + eax]
movsx edx, bl
lea esi, [esi + 1]
sub bl, 0x41
mov ecx, edx
or ecx, 0x20
cmp bl, 0x19
mov bl, byte [esi - 1]
cmova ecx, edx
xor ecx, edi
imul edi, ecx, 0x1000193
test bl, bl
jne 0x1004b7d0
cmp edi, 0xee0769ee
je 0x1004b80f
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov ebx, dword [eax + 0x18]
test edx, edx
jne 0x1004b7b0
mov eax, dword [eax]
jmp 0x1004b784
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x30]
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov esi, dword [eax + edx]
add esi, edx
mov dword [0x101f841c], esi
lea eax, [ebp - 0x1c]
mov ecx, 0x101e3fa8
push eax
call fcn.1003a730
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
cmova eax, dword [ebp - 0x1c]
push eax
push dword [0x101f1a90]
call esi
mov ecx, dword [ebp - 8]
mov dword [0x101f1a58], eax
cmp ecx, 0xf
jbe 0x1004b88f
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1004b880
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004b8db
push ecx
push edx
call fcn.100bf656
mov eax, dword [0x101f1a58]
add esp, 8
movss xmm1, dword [ebp - 0x34]
movss xmm0, dword [ebp - 0x20]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
sub esp, 8
mov dword [ebp - 0x20], eax
movss dword [esp + 4], xmm1
movss dword [esp], xmm0
call dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
add esp, 8
fstp dword [ebp - 0x20]
movss xmm0, dword [ebp - 0x20]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100bf244
mov esp, ebp
pop ebp
ret
call fcn.1012a37e
int3
Function at 0x1004b8f0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1017c400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x101f1a60]
push ebx
mov ebx, edx
mov dword [ebp - 0x30], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x34], edi
test eax, eax
jne 0x1004ba57
mov esi, dword [0x101f8420]
test esi, esi
jne 0x1004b9e9
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0x18]
mov dword [ebp - 0x2c], ebx
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ecx + ebx + 0x78]
add ecx, ebx
mov dword [ebp - 0x28], ecx
cmp ecx, ebx
je 0x1004b9b8
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x1004b9b8
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, ebx
nop dword [eax]
sub ecx, 4
dec edx
mov dword [ebp - 0x24], ecx
mov edi, 0xc9fd1edb
mov dword [ebp - 0x20], edx
mov ecx, dword [ecx]
add ecx, ebx
mov bl, byte [ecx]
inc ecx
test bl, bl
je 0x1004b9ae
nop word [eax + eax]
movsx esi, bl
lea ecx, [ecx + 1]
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
mov bl, byte [ecx - 1]
cmova edx, esi
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x1004b980
cmp edi, 0xe605150f
je 0x1004b9bf
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov ebx, dword [eax + 0x18]
test edx, edx
jne 0x1004b960
mov eax, dword [eax]
jmp 0x1004b934
mov esi, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x30]
mov eax, dword [esi + 0x24]
mov edi, dword [ebp - 0x34]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov esi, dword [eax + edx]
add esi, edx
mov dword [0x101f8420], esi
lea eax, [ebp - 0x1c]
mov ecx, 0x101e3fc0
push eax
call fcn.1003a150
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
cmova eax, dword [ebp - 0x1c]
push eax
push dword [0x101f1a90]
call esi
mov ecx, dword [ebp - 8]
mov dword [0x101f1a60], eax
cmp ecx, 0xf
jbe 0x1004ba45
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1004ba36
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004ba6f
push ecx
push edx
call fcn.100bf656
mov eax, dword [0x101f1a60]
add esp, 8
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
push ebx
push edi
call eax
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100bf244
mov esp, ebp
pop ebp
ret
call fcn.1012a37e
int3
Function at 0x1004ba80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [0x101e5168], 0
push ebx
push esi
je 0x1004baf1
cmp byte [0x101e5169], 0
jne 0x1004bb32
mov byte [0x101e5169], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x101e51ac]
xor ebx, dword [0x101e51a8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x101e516a], al
inc esi
cmp esi, 0x3e
jb 0x1004bab0
jmp 0x1004bb32
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x101e51ac]
xor ebx, dword [0x101e51a8]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x101e516a], al
inc esi
cmp esi, 0x3e
jb 0x1004baf3
push ecx
mov ecx, dword [ebp + 8]
push 0x101e51a7
push 0x101e516a
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004bcb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [0x101e4ef0], 0
push ebx
push esi
je 0x1004bd21
cmp byte [0x101e4ef1], 0
jne 0x1004bd62
mov byte [0x101e4ef1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x101e4f3c]
xor ebx, dword [0x101e4f38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x101e4ef2], al
inc esi
cmp esi, 0x40
jb 0x1004bce0
jmp 0x1004bd62
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x101e4f3c]
xor ebx, dword [0x101e4f38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x101e4ef2], al
inc esi
cmp esi, 0x40
jb 0x1004bd23
push ecx
mov ecx, dword [ebp + 8]
push 0x101e4f31
push 0x101e4ef2
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004be00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [0x101e4af0], 0
push ebx
push esi
je 0x1004be71
cmp byte [0x101e4af1], 0
jne 0x1004beb2
mov byte [0x101e4af1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x101e4b74]
xor ebx, dword [0x101e4b70]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x101e4af2], al
inc esi
cmp esi, 0x77
jb 0x1004be30
jmp 0x1004beb2
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x101e4b74]
xor ebx, dword [0x101e4b70]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x101e4af2], al
inc esi
cmp esi, 0x77
jb 0x1004be73
push ecx
mov ecx, dword [ebp + 8]
push 0x101e4b68
push 0x101e4af2
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004bfd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004c040
cmp byte [esi + 1], 0
jne 0x1004c087
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x74]
xor ebx, dword [esi + 0x70]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x6d
jb 0x1004c000
jmp 0x1004c087
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x74]
xor ebx, dword [esi + 0x70]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x6d
jb 0x1004c046
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x6e]
push eax
push edi
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004c0b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004c120
cmp byte [esi + 1], 0
jne 0x1004c167
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x32
jb 0x1004c0e0
jmp 0x1004c167
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x3c]
xor ebx, dword [esi + 0x38]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x32
jb 0x1004c126
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x33]
push eax
push edi
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004c190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004c200
cmp byte [esi + 1], 0
jne 0x1004c247
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x1b
jb 0x1004c1c0
jmp 0x1004c247
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x1b
jb 0x1004c206
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1c]
push eax
push edi
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4