joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5002f0
Capabilities:
Set registry value

Disassembly:
push edi
sub esp, 0x10
mov edi, dword [esp + 0x18]
mov dl, byte [esp + 0x20]
mov al, byte [0x569f00]
test al, al
jne 0x500309
test dl, dl
je 0x50032a
mov ecx, dword [0x5745e0]
mov edx, 4
lea eax, [esp + 0x1c]
push edx
push eax
push edx
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 0x10
pop edi
ret
mov dword [esp], 0x574600
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], 0x77d1a0
mov dword [esp + 8], eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x5745e4]
push eax
push 0x574600
push edi
push 0x791240
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
add esp, 0x10
pop edi
ret

Function at 0x500370
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x500460
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
mov al, byte [0x569f00]
test al, al
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], ebx
je 0x5003c2
mov ebx, dword [0x5745e0]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push edx
push 3
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x500440
lea ecx, [ebp - 0x20]
mov eax, dword [ebp + 8]
push eax
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
push 0x791260
call sub.MFC42.DLL_CString::operator
push esp
mov eax, dword [ebp + 0x10]
push eax
push 0x77d1a0
push 0x574600
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edx, dword [ebp - 0x20]
mov eax, dword [0x5745e4]
push eax
push 0x574600
push edx
push 0x791240
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [0x5745e4]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
mov ebx, dword [ebp + 8]
push edx
push ecx
push ebx
push 0x791240
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructA]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::CString
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x5004b0
Capabilities:
Set registry value

Disassembly:
push edi
push ebx
sub esp, 0xc
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
xor ecx, ecx
lea edx, [esp + 4]
mov dword [esp], ecx
lea eax, [esp]
push eax
push edx
push ecx
push 0xf003f
push ecx
push 0x76acc0
push ecx
push ebx
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x500527
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x5004fa
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x5004f2
mov edx, dword [esp + 4]
inc eax
push eax
push edi
push 1
push 0
push 0x76acc0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0xc
pop ebx
pop edi
ret
xor eax, eax
add esp, 0xc
pop ebx
pop edi
ret
Function at 0x500530
Capabilities:
Set registry value

Disassembly:
push edi
push esi
push ebp
sub esp, 0x10
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x28]
xor ecx, ecx
lea edx, [esp + 4]
mov dword [esp], ecx
lea eax, [esp]
push eax
push edx
push ecx
push 0xf003f
push ecx
push 0x76acc0
push ecx
push esi
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x50061e
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x500583
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x50057b
mov edx, dword [esp + 4]
inc eax
push eax
push edi
push 1
push 0
push 0x76acc0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [esp + 4]
xor ecx, ecx
lea edx, [esp + 8]
lea eax, [esp]
push eax
push edx
push ecx
push 0xf003f
push ecx
push 0x76acc0
push ecx
push 0x791280
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x500613
mov edi, ebp
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x5005da
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x5005d2
mov edx, dword [esp + 8]
inc eax
push eax
push ebp
push 1
push 0
push 0x76acc0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0x10
pop ebp
pop esi
pop edi
ret
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x10
pop ebp
pop esi
pop edi
ret
Function at 0x5020a0
Capabilities:
Read file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0x76d6c0
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
test edi, edi
je 0x502154
mov dword [esp], edi
mov dword [esp + 4], 0
mov dword [esp + 8], 2
call dword [sym.imp.MSVCRT.dll_fseek]
mov dword [esp], edi
call dword [sym.imp.MSVCRT.dll_ftell]
mov esi, eax
mov dword [esp], esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebx, eax
test ebx, ebx
je 0x50214b
mov dword [esp], edi
xor edx, edx
mov dword [esp + 4], edx
mov dword [esp + 8], edx
call dword [sym.imp.MSVCRT.dll_fseek]
mov dword [esp], ebx
mov dword [esp + 4], 1
mov dword [esp + 8], esi
mov dword [esp + 0xc], edi
call dword [sym.imp.MSVCRT.dll_fread]
mov dword [esp], edi
call dword [sym.imp.MSVCRT.dll_fclose]
push ebx
push esi
push 0
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov esi, eax
mov dword [esp], ebx
call dword [sym.imp.MSVCRT.dll_free]
mov eax, esi
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp], edi
call dword [sym.imp.MSVCRT.dll_fclose]
xor eax, eax
add esp, 0x10
pop ebx
pop esi
pop edi
ret

Function at 0x502930
Capabilities:
Write file on windows

Disassembly:
push edi
sub esp, 0x10
mov edi, ecx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov edi, dword [edi + 4]
test edi, edi
je 0x502965
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edi
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
pop edi
ret 0xc
xor eax, eax
add esp, 0x10
pop edi
ret 0xc

Function at 0x502970
Capabilities:
Read file on windows

Disassembly:
push edi
sub esp, 0x10
mov edi, ecx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov edi, dword [edi + 4]
test edi, edi
je 0x5029a5
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
pop edi
ret 0xc
xor eax, eax
add esp, 0x10
pop edi
ret 0xc
Function at 0x506740
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x506870
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov edx, dword [ecx + 0xf5198]
test edx, edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ecx
je 0x506845
xor bl, bl
mov eax, ecx
lea ecx, [eax + 0xf5194]
push edx
push 4
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 4
je 0x50679a
mov bl, 1
jmp 0x5067d4
mov eax, dword [ebp - 0x18]
lea ecx, [eax + 0xf51a0]
mov edx, dword [eax + 0xf5198]
push edx
push 4
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 4
jne 0x5067d2
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0xf5194]
cmp eax, dword [edx + 0xf5190]
jg 0x5067d4
mov bl, 1
jmp 0x5067d4
mov bl, 1
test bl, bl
je 0x50684e
lea eax, [ebp - 0x28]
push 0x46f
push eax
call fcn.00509440
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
push esp
push eax
call fcn.00504640
add esp, 8
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 0xf5198]
mov byte [eax + 0xf518e], 0
push esp
push edx
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 8
mov eax, dword [ebp - 0x18]
mov dword [eax + 0xf5198], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call sub.MFC42.DLL_CString::CString
mov ebx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov eax, ecx
mov byte [eax + 0xf518e], 0
mov ebx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x509040
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
sub esp, 0x1c
mov ebp, ecx
mov ebx, dword [esp + 0x28]
mov eax, dword [ebp]
test eax, eax
je 0x509059
mov ecx, ebp
call fcn.005092c0
mov dword [esp], ebx
mov dword [esp + 4], 0x76d7e0
call dword [sym.imp.MSVCRT.dll_fopen]
mov dword [ebp], eax
test eax, eax
je 0x50912a
mov byte [esp + 0x10], 0x52
mov al, 0x46
mov byte [esp + 0x11], 0x49
mov byte [esp + 0x12], al
mov byte [esp + 0x13], al
lea edx, [esp + 0x10]
mov ebx, dword [ebp]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], ebx
call dword [sym.imp.MSVCRT.dll_fwrite]
lea eax, [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004acc90
lea eax, [esp + 0x10]
mov edx, dword [ebp]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], edx
call dword [sym.imp.MSVCRT.dll_fwrite]
mov byte [esp + 0x14], 0x57
mov byte [esp + 0x15], 0x41
mov byte [esp + 0x16], 0x56
mov byte [esp + 0x17], 0x45
lea eax, [esp + 0x14]
mov edx, dword [ebp]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], edx
call dword [sym.imp.MSVCRT.dll_fwrite]
mov eax, 1
add esp, 0x1c
pop ebx
pop ebp
ret 4
xor eax, eax
add esp, 0x1c
pop ebx
pop ebp
ret 4

Function at 0x509140
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
sub esp, 0x1c
mov edi, ecx
mov esi, dword [esp + 0x28]
mov eax, dword [edi]
test eax, eax
je 0x50925e
mov byte [esp + 0x10], 0x66
mov byte [esp + 0x11], 0x6d
mov byte [esp + 0x12], 0x74
mov byte [esp + 0x13], 0x20
lea eax, [esp + 0x10]
mov edx, dword [edi]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], edx
call dword [sym.imp.MSVCRT.dll_fwrite]
lea eax, [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0x12
call fcn.004acc90
lea eax, [esp + 0x10]
mov edx, dword [edi]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], edx
call dword [sym.imp.MSVCRT.dll_fwrite]
mov dword [esp], esi
mov eax, dword [edi]
mov dword [esp + 4], 1
mov dword [esp + 8], 0x12
mov dword [esp + 0xc], eax
call dword [sym.imp.MSVCRT.dll_fwrite]
mov byte [esp + 0x14], 0x64
mov al, 0x61
mov byte [esp + 0x15], al
mov byte [esp + 0x16], 0x74
mov byte [esp + 0x17], al
lea edx, [esp + 0x14]
mov esi, dword [edi]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], esi
call dword [sym.imp.MSVCRT.dll_fwrite]
mov eax, dword [edi]
mov dword [esp], eax
call dword [sym.imp.MSVCRT.dll_ftell]
mov dword [edi + 8], eax
lea eax, [esp + 0x10]
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004acc90
lea eax, [esp + 0x10]
mov edx, dword [edi]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x1c
pop esi
pop edi
ret 4
Function at 0x509270
Capabilities:
Write file on windows

Disassembly:
push esi
push ebp
sub esp, 0x14
mov ebp, ecx
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov edx, dword [ebp]
test edx, edx
je 0x5092aa
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], esi
mov dword [esp + 0xc], edx
call dword [sym.imp.MSVCRT.dll_fwrite]
add dword [ebp + 4], esi
add esp, 0x14
pop ebp
pop esi
ret 8
add esp, 0x14
pop ebp
pop esi
ret 8

Function at 0x5092c0
Capabilities:
Write file on windows

Disassembly:
push edi
push ebx
sub esp, 0x14
mov edi, ecx
mov eax, dword [edi]
mov dword [esp], eax
call dword [sym.imp.MSVCRT.dll_ftell]
mov ebx, eax
add ebx, 0xfffffff8
mov edx, dword [edi]
mov dword [esp], edx
mov dword [esp + 4], 4
mov dword [esp + 8], 0
call dword [sym.imp.MSVCRT.dll_fseek]
lea edx, [esp + 0x10]
mov dword [esp], edx
mov dword [esp + 4], ebx
call fcn.004acc90
lea eax, [esp + 0x10]
mov edx, dword [edi]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], edx
call dword [sym.imp.MSVCRT.dll_fwrite]
mov eax, dword [edi]
mov edx, dword [edi + 8]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], 0
call dword [sym.imp.MSVCRT.dll_fseek]
lea eax, [esp + 0x10]
mov edx, dword [edi + 4]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004acc90
lea eax, [esp + 0x10]
mov edx, dword [edi]
mov dword [esp], eax
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], edx
call dword [sym.imp.MSVCRT.dll_fwrite]
mov eax, dword [edi]
mov dword [esp], eax
call dword [sym.imp.MSVCRT.dll_fclose]
mov dword [edi], 0
add esp, 0x14
pop ebx
pop edi
ret

Function at 0x5093b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push edi
push ebp
push ebx
sub esp, 8
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov dword [esp], edi
mov dword [esp + 4], ebp
call fcn.00509390
mov ebx, eax
push 0
push ebp
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x5093f5
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5093f5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
add esp, 8
pop ebx
pop ebp
pop edi
ret
xor eax, eax
add esp, 8
pop ebx
pop ebp
pop edi
ret

Function at 0x50e6d3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x50e72b
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x50e72b
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jne 0x50e72b
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret
Function at 0x50e754
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftDirect3D
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x50e7c2
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x50e7b9
cmp dword [ebp - 0xc], 4
jne 0x50e7b9
cmp dword [ebp - 0x10], edi
je 0x50e7b9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x56a260], edi
xor eax, eax
jmp 0x50e7ea
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x56a260], edi
jge 0x50e7e5
mov dword [0x56a260], edi
call fcn.0050e72f
test eax, eax
je 0x50e7e5
emms
mov dword [0x56a260], 1
mov eax, dword [0x56a260]
pop edi
leave
ret

Function at 0x50e8ca
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
push ebx
push edi
push 0x25
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
xor bl, bl
and byte [ebp + 0x73], bl
push eax
mov dword [ebp - 0x24], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x50e901
inc bl
mov byte [ebp + 0x73], 1
cmp dword [ebp - 0x14], 1
jne 0x50e923
cmp dword [ebp - 0x20], 4
ja 0x50e92d
jne 0x50e91d
cmp dword [ebp - 0x1c], 0xa
jb 0x50e91d
cmp word [ebp - 0x18], 0x55d
jae 0x50e92d
mov byte [ebp + 0x73], 1
jmp 0x50e92d
cmp dword [ebp - 0x14], 2
jne 0x50e943
test bl, bl
je 0x50e95e
mov eax, dword [ebp + 0x7c]
sub eax, 6
je 0x50e94e
dec eax
je 0x50e947
sub eax, 3
jne 0x50e943
cmp byte [ebp + 0x73], 0
je 0x50e96f
xor eax, eax
jmp 0x50e977
call fcn.0050e7ed
jmp 0x50e977
cmp byte [ebp + 0x73], 0
jne 0x50e943
call fcn.0050e825
and eax, 4
jmp 0x50e977
cmp dword [ebp + 0x7c], 0xa
je 0x50e96f
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
jmp 0x50e977
call fcn.0050e825
and eax, 8
pop edi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x5100cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x18], eax
jae 0x5101ed
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
jae 0x5101d1
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 0xc], edi
shr edi, 2
and edi, esi
mov dword [ebp - 4], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 0xc]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp - 4]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 0xc]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0x10]
add ecx, 8
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov esi, 0xffc03fc0
jne 0x510123
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x18]
mov dword [ebp + 0xc], edx
jb 0x510101
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret
Function at 0x5104b9
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x510600
mov edx, 0xf81f
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x5105db
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff07e0
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x1002]
mov ebp, eax
and ebp, 0xffff07e0
add ebp, ecx
mov ecx, edi
and ecx, 0xffff07e0
add ebp, ecx
mov ecx, esi
and ecx, 0xffff07e0
shr ebx, 2
lea ecx, [ecx + ebp + 0x40]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff07e0
lea eax, [eax + esi + 0x1002]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x510522
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x5104f9
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x51072d
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
mov edx, dword [esi + 0x18]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
add ebp, edx
cmp edx, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], ebp
jae 0x510873
mov eax, 0x83e0
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [edx + esi*2]
mov dword [esp + 0x10], ebx
add edi, edx
cmp edx, esi
mov ebx, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x51084e
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx edx, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
and ebp, eax
mov ebx, edx
and ebx, eax
add ebx, ebp
mov ebp, edi
and ebp, eax
add ebx, ebp
mov dword [esp + 0x24], ecx
and ecx, 0x7c1f
mov ebp, esi
and ebp, eax
lea ebx, [ebx + ebp + 0x10040]
mov ebp, edx
and ebp, 0x7c1f
add ebp, ecx
mov ecx, edi
and ecx, 0x7c1f
add ebp, ecx
mov ecx, esi
and ecx, 0x7c1f
lea ecx, [ecx + ebp + 0x802]
shr ecx, 2
shr ebx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and ecx, eax
and edx, eax
add edx, ecx
and edi, eax
add edx, edi
mov edi, dword [esp + 0x1c]
and esi, eax
and ebx, 0xffff7c1f
lea ecx, [edx + esi + 0x10040]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [ecx], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x510796
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea edx, [edx + edi*2]
cmp edx, ebp
mov dword [esp + 0x20], edx
jb 0x51076d
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x51087c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x5109c6
mov edx, 0xf0f0
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x5109a1
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff0f0f
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x2020]
mov ebp, eax
and ebp, 0xffff0f0f
add ebp, ecx
mov ecx, edi
and ecx, 0xffff0f0f
add ebp, ecx
mov ecx, esi
and ecx, 0xffff0f0f
shr ebx, 2
lea ecx, [ecx + ebp + 0x202]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff0f0f
lea eax, [eax + esi + 0x2020]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x5108e5
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x5108bc
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret