joyce8/EMBER2024-capa huggingface dataset:
Function at 0x518fb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x14
push 0
push 0
dec ecx
jne 0x518fb8
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x51914f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x534264]
mov dl, byte [0x519160]
cmp dl, byte [eax]
je 0x519003
cmp byte [esi + 0x3a], 0
je 0x518ff4
mov dl, 1
mov eax, ebx
call fcn.004fa1a8
jmp 0x519003
mov edx, dword [0x533c00]
mov dl, byte [edx]
mov eax, ebx
call fcn.004fa1a8
lea eax, [ebp - 0x10]
xor edx, edx
mov dl, byte [esi + 0x39]
mov cl, 1
call fcn.00414db0
lea ecx, [ebp - 0x10]
mov edx, 0x3f0
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x44]
lea eax, [ebp - 0x20]
mov dl, byte [esi + 0x30]
call fcn.00414f80
lea ecx, [ebp - 0x20]
mov edx, 0x413
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x44]
lea eax, [ebp - 0x30]
mov edx, dword [esi + 0x34]
call fcn.00414fe4
lea ecx, [ebp - 0x30]
mov edx, 0x412
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x44]
lea eax, [ebp - 0x40]
mov dl, byte [esi + 0x38]
call fcn.00414f80
lea ecx, [ebp - 0x40]
mov edx, 0x3ff
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x44]
lea eax, [ebp - 0x50]
mov dl, byte [esi + 0x3c]
call fcn.00414f80
lea ecx, [ebp - 0x50]
mov edx, 0x409
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x44]
lea eax, [ebp - 0x60]
mov edx, dword [esi + 0x40]
mov cl, 0xfc
call fcn.00414db0
lea ecx, [ebp - 0x60]
mov edx, 0x40a
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x44]
lea eax, [ebp - 0x70]
mov edx, dword [esi + 0x44]
mov cl, 0xfc
call fcn.00414db0
lea ecx, [ebp - 0x70]
mov edx, 0x407
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x44]
lea eax, [ebp - 0x80]
xor edx, edx
mov dl, byte [esi + 0x48]
mov cl, 1
call fcn.00414db0
lea ecx, [ebp - 0x80]
mov edx, 0x415
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x44]
lea eax, [ebp - 0x90]
mov edx, dword [esi + 0x4c]
call fcn.00414fe4
lea ecx, [ebp - 0x90]
mov edx, 0x414
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x44]
lea eax, [ebp - 0xa0]
mov edx, dword [esi + 0x50]
call fcn.00414fe4
lea ecx, [ebp - 0xa0]
mov edx, 0x417
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x44]
mov eax, dword [esi + 0x28]
mov dword [ebx + 8], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x519156
lea eax, [ebp - 0xa0]
mov edx, dword [0x40111c]
mov ecx, 0xa
call fcn.00404f5c
ret
Function at 0x100065d0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x1000661c
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x100065ff
cmp edi, 2
jb 0x100065ff
cmp byte [esi], cl
jne 0x100065ff
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017c928]
test edi, edi
jne 0x100065e5
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x1000664b
cmp cl, 0x23
jne 0x10006632
cmp byte [esi], cl
jne 0x10006632
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1017c928]
test cl, cl
jne 0x10006623
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10006740
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x10006753
mov dword [edi], 0
mov edx, 0x1017c510
call fcn.10006660
mov esi, eax
test esi, esi
je 0x1000683c
push esi
call fcn.1012f7c7
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x10006833
push 2
push 0
push esi
call fcn.1013015c
add esp, 0xc
test eax, eax
jne 0x10006833
push esi
call fcn.1012f7c7
mov ebx, eax
add esp, 4
cmp ebx, 0xffffffff
je 0x10006833
push 0
push dword [ebp + 8]
push esi
call fcn.1013015c
add esp, 0xc
test eax, eax
jne 0x10006833
mov eax, dword [0x10270558]
test eax, eax
je 0x100067c6
inc dword [eax + 0xac]
push dword [0x10270550]
push ebx
call fcn.10005790
add esp, 8
mov dword [ebp + 8], eax
test eax, eax
je 0x10006833
push esi
push ebx
push 1
push eax
call fcn.10133a36
add esp, 0x10
push esi
cmp eax, ebx
je 0x1000681d
call fcn.1012fe17
mov eax, dword [0x10270558]
add esp, 4
test eax, eax
je 0x10006805
dec dword [eax + 0xac]
push dword [0x10270550]
push dword [ebp + 8]
call fcn.100057a0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.1012fe17
add esp, 4
test edi, edi
je 0x1000682b
mov dword [edi], ebx
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.1012fe17
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x100098e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
lea edx, [ebp + 8]
mov esi, 4
mov eax, dword [edi + 0xe4]
mov ebx, dword [edi + 0xec]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1017c928]
sub esi, 1
jne 0x10009902
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3e8c], ebx
jne 0x10009939
push ecx
push dword [ebp + 8]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.1001d4c0
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x10009950
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov edx, ecx
push esi
push edi
lea esi, [ebp - 0x14]
mov edi, 0x10
movss xmm1, dword [edx + 0x100]
movss xmm0, dword [eax]
movss xmm2, dword [edx + 0x104]
subss xmm0, xmm1
mov ecx, dword [edx + 0xe4]
movss dword [ebp - 0x14], xmm0
movss xmm0, dword [eax + 4]
subss xmm0, xmm2
movss dword [ebp - 0x10], xmm0
movss xmm0, dword [eax + 8]
subss xmm0, xmm1
movss dword [ebp - 0xc], xmm0
movss xmm0, dword [eax + 0xc]
mov eax, dword [edx + 0xec]
subss xmm0, xmm2
mov edx, dword [eax + ecx*4 - 4]
movss dword [ebp - 8], xmm0
not edx
nop
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x1017c928]
sub edi, 1
jne 0x100099c0
not edx
pop edi
mov eax, edx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x1000d160
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x101903b8]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [0x10270558]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x11c], edx
mov edx, ecx
mov ebx, dword [esi + 0x3e58]
mov ecx, ebx
mov eax, dword [ebx + 0xc]
and eax, 4
or eax, 0x1000103
or edi, eax
cmp dword [ebx + 0x190], 0
mov dword [ebp + 0x10], edi
jne 0x1000d1b6
cmp dword [esi + 0x4a14], 0
mov eax, 0x228
je 0x1000d1bb
mov eax, 0x1f8
movss xmm4, dword [eax + ebx]
xorps xmm3, xmm3
movss xmm5, dword [eax + ebx + 4]
subss xmm4, dword [ecx + 0xf0]
subss xmm5, dword [ecx + 0xf4]
mov ecx, dword [ebp + 8]
movss xmm2, dword [0x101879f0]
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 2
cvttss2si eax, dword [ecx]
movd xmm1, eax
cvttss2si eax, dword [ecx + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
ucomiss xmm1, xmm3
cvtdq2ps xmm0, xmm0
lahf
xor ecx, ecx
test ah, 0x44
mov eax, 1
cmovnp ecx, eax
ucomiss xmm0, xmm3
lahf
test ah, 0x44
mov eax, dword [ebp - 0x118]
cmovnp eax, dword [ebp - 0x114]
or eax, ecx
comiss xmm3, xmm1
mov dword [ebp - 0x118], eax
jb 0x1000d24d
addss xmm1, xmm4
comiss xmm1, xmm2
jae 0x1000d24d
movaps xmm1, xmm2
comiss xmm3, xmm0
jb 0x1000d25e
addss xmm0, xmm5
comiss xmm0, xmm2
jae 0x1000d25e
movaps xmm0, xmm2
or dword [esi + 0x470c], 2
lea eax, [ebp - 0x10c]
push edx
push 0x1017baa4
push 0x100
push eax
movss dword [esi + 0x472c], xmm1
movss dword [esi + 0x4730], xmm0
mov dword [esi + 0x4714], 1
call fcn.10006580
movss xmm0, dword [esi + 0x37b0]
add esp, 0x10
cmp byte [ebp + 0xc], 0
movss dword [ebp - 0x114], xmm0
jne 0x1000d2b9
mov dword [esi + 0x37b0], 0
push edi
xor edx, edx
lea ecx, [ebp - 0x10c]
call fcn.10010c00
mov edi, dword [esi + 0x3e58]
add esp, 4
movss xmm0, dword [ebp - 0x114]
mov edx, dword [ebp - 0x11c]
movss dword [esi + 0x37b0], xmm0
cmp word [edi + 0xb6], 1
mov byte [ebp - 0x10d], al
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x114], edi
mov dword [edi + 0x74], edx
mov byte [edi + 0xc6], al
jne 0x1000d31d
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [ebx + 0xf0], ecx
mov dword [ebx + 0xf4], eax
mov edi, edx
mov al, 0x23
not edi
mov edx, 0x1017baa9
mov ebx, edi
nop word [eax + eax]
cmp al, 0x23
jne 0x1000d33e
cmp byte [edx], al
jne 0x1000d33e
cmp byte [edx + 1], al
cmove ebx, edi
movzx ecx, bl
movzx eax, al
xor ecx, eax
shr ebx, 8
mov al, byte [edx]
inc edx
xor ebx, dword [ecx*4 + 0x1017c928]
test al, al
jne 0x1000d330
mov edi, dword [ebp - 0x114]
not ebx
cmp dword [esi + 0x3ea4], ebx
jne 0x1000d370
xor edx, edx
xor ecx, ecx
call fcn.10009a90
mov eax, dword [ebp - 0x11c]
cmp dword [esi + 0x47e8], eax
jne 0x1000d3c1
test dword [ebp + 0x10], 0x800000
jne 0x1000d3c1
cmp word [edi + 0x14c], 0
jne 0x1000d39a
cmp byte [edi + 0x152], 0
je 0x1000d3c1
xor edx, edx
mov ecx, edi
call fcn.10013250
xor dl, dl
mov ecx, edi
call fcn.10018d60
mov edx, edi
mov ecx, ebx
call fcn.10009a90
mov eax, dword [esi + 0x480c]
mov dword [esi + 0x3ec4], eax
mov ecx, dword [ebp - 8]
mov al, byte [ebp - 0x10d]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.100c9808
mov esp, ebp
pop ebp
ret
Function at 0x1000d800
Capabilities:
Hash data with crc32

Disassembly:
mov eax, ecx
or ecx, 0xffffffff
push ebx
push esi
mov bl, byte [eax]
lea esi, [eax + 1]
test bl, bl
je 0x1000d83d
push edi
or edi, 0xffffffff
cmp bl, 0x23
jne 0x1000d823
cmp byte [esi], bl
jne 0x1000d823
cmp byte [esi + 1], bl
cmove ecx, edi
movzx edx, cl
movzx eax, bl
mov bl, byte [esi]
xor edx, eax
shr ecx, 8
inc esi
xor ecx, dword [edx*4 + 0x1017c928]
test bl, bl
jne 0x1000d814
pop edi
pop esi
not ecx
pop ebx
jmp fcn.1000d790
Function at 0x1001c600
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
push edi
mov edi, dword [0x10270558]
test bl, bl
je 0x1001c646
or edi, 0xffffffff
cmp bl, 0x23
jne 0x1001c627
cmp byte [esi], bl
jne 0x1001c627
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x1017c928]
test bl, bl
jne 0x1001c618
mov edi, dword [0x10270558]
mov esi, dword [edi + 0x5a74]
xor ecx, ecx
not eax
test esi, esi
jle 0x1001c66c
mov edi, dword [edi + 0x5a7c]
lea edx, [edi + 4]
nop dword [eax]
cmp dword [edx], eax
je 0x1001c672
inc ecx
add edx, 0x24
cmp ecx, esi
jl 0x1001c660
pop edi
pop esi
xor eax, eax
pop ebx
ret
lea eax, [ecx + ecx*8]
lea eax, [edi + eax*4]
pop edi
pop esi
pop ebx
ret
Function at 0x10026970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100269ac
mov eax, dword [0x10270558]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x10026996
dec dword [eax + 0xac]
push dword [0x10270550]
push ecx
call fcn.100057a0
add esp, 8
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100269e6
mov eax, dword [0x10270558]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x100269d0
dec dword [eax + 0xac]
push dword [0x10270550]
push ecx
call fcn.100057a0
add esp, 8
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x10026a20
mov eax, dword [0x10270558]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x10026a0a
dec dword [eax + 0xac]
push dword [0x10270550]
push ecx
call fcn.100057a0
add esp, 8
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x10026a76
mov eax, dword [0x10270558]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x10026a60
dec dword [eax + 0xac]
push dword [0x10270550]
push ecx
call fcn.100057a0
add esp, 8
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x10026ab0
mov eax, dword [0x10270558]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x10026a9a
dec dword [eax + 0xac]
push dword [0x10270550]
push ecx
call fcn.100057a0
add esp, 8
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x10026aea
mov eax, dword [0x10270558]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x10026ad4
dec dword [eax + 0xac]
push dword [0x10270550]
push ecx
call fcn.100057a0
add esp, 8
mov dword [esi + 0x5c], 0
lea ecx, [esi + 0x78]
pop esi
jmp fcn.10029790
Function at 0x10043ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x10043f00
cmp byte [esi + 1], 0
jne 0x10043f41
mov byte [esi + 1], 1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + edi + 2], al
inc edi
cmp edi, 0xb
jb 0x10043ec3
jmp 0x10043f41
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + edi + 2]
xor al, bl
mov byte [esi + edi + 2], al
inc edi
cmp edi, 0xb
jb 0x10043f02
lea ecx, [esi + 0xc]
lea eax, [esi + 2]
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
cmp eax, ecx
je 0x10043f6c
push 0xa
push eax
mov ecx, esi
call fcn.1001f000
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100524a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x10052500
cmp byte [esi + 1], 0
jne 0x10052541
mov byte [esi + 1], 1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + edi + 2], al
inc edi
cmp edi, 0x20
jb 0x100524c3
jmp 0x10052541
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + edi + 2]
xor al, bl
mov byte [esi + edi + 2], al
inc edi
cmp edi, 0x20
jb 0x10052502
lea ecx, [esi + 0x21]
lea eax, [esi + 2]
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
cmp eax, ecx
je 0x1005256c
push 0x1f
push eax
mov ecx, esi
call fcn.1001f000
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10052580
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x100525e0
cmp byte [esi + 1], 0
jne 0x10052621
mov byte [esi + 1], 1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + edi + 2], al
inc edi
cmp edi, 0x17
jb 0x100525a3
jmp 0x10052621
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + edi + 2]
xor al, bl
mov byte [esi + edi + 2], al
inc edi
cmp edi, 0x17
jb 0x100525e2
lea ecx, [esi + 0x18]
lea eax, [esi + 2]
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
cmp eax, ecx
je 0x1005264c
push 0x16
push eax
mov ecx, esi
call fcn.1001f000
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10052660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x100526c0
cmp byte [esi + 1], 0
jne 0x10052701
mov byte [esi + 1], 1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + edi + 2], al
inc edi
cmp edi, 0x1d
jb 0x10052683
jmp 0x10052701
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + edi + 2]
xor al, bl
mov byte [esi + edi + 2], al
inc edi
cmp edi, 0x1d
jb 0x100526c2
lea ecx, [esi + 0x1e]
lea eax, [esi + 2]
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
cmp eax, ecx
je 0x1005272c
push 0x1c
push eax
mov ecx, esi
call fcn.1001f000
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10052740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x100527a0
cmp byte [esi + 1], 0
jne 0x100527e1
mov byte [esi + 1], 1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + edi + 2], al
inc edi
cmp edi, 0x19
jb 0x10052763
jmp 0x100527e1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + edi + 2]
xor al, bl
mov byte [esi + edi + 2], al
inc edi
cmp edi, 0x19
jb 0x100527a2
lea ecx, [esi + 0x1a]
lea eax, [esi + 2]
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
cmp eax, ecx
je 0x1005280c
push 0x18
push eax
mov ecx, esi
call fcn.1001f000
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10052820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x10052880
cmp byte [esi + 1], 0
jne 0x100528c1
mov byte [esi + 1], 1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + edi + 2], al
inc edi
cmp edi, 0x1c
jb 0x10052843
jmp 0x100528c1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + edi + 2]
xor al, bl
mov byte [esi + edi + 2], al
inc edi
cmp edi, 0x1c
jb 0x10052882
lea ecx, [esi + 0x1d]
lea eax, [esi + 2]
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
cmp eax, ecx
je 0x100528ec
push 0x1b
push eax
mov ecx, esi
call fcn.1001f000
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10052900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x10052960
cmp byte [esi + 1], 0
jne 0x100529a1
mov byte [esi + 1], 1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + edi + 2], al
inc edi
cmp edi, 0xc
jb 0x10052923
jmp 0x100529a1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + edi + 2]
xor al, bl
mov byte [esi + edi + 2], al
inc edi
cmp edi, 0xc
jb 0x10052962
lea ecx, [esi + 0xd]
lea eax, [esi + 2]
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
cmp eax, ecx
je 0x100529cc
push 0xb
push eax
mov ecx, esi
call fcn.1001f000
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100529e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
je 0x10052a40
cmp byte [esi + 1], 0
jne 0x10052a81
mov byte [esi + 1], 1
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + edi + 2], al
inc edi
cmp edi, 0x18
jb 0x10052a03
jmp 0x10052a81
xor edi, edi
xor edx, edx
mov ebx, edi
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [esp + 0x14], edx
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + edi + 2]
xor al, bl
mov byte [esi + edi + 2], al
inc edi
cmp edi, 0x18
jb 0x10052a42
lea ecx, [esi + 0x19]
lea eax, [esi + 2]
mov esi, dword [ebp + 8]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
cmp eax, ecx
je 0x10052aac
push 0x17
push eax
mov ecx, esi
call fcn.1001f000
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4