joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf05dff1
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0xf232d50]
push esi
push edi
xor edi, edi
inc edi
and eax, edi
mov dword [0xf232b48], edi
je 0xf05e00b
mov dword [0xf232b44], edi
mov ecx, dword [0xf232b4c]
xor esi, esi
cmp eax, esi
mov dword [0xf232d40], ecx
je 0xf05e039
push esi
push esi
call fcn.0f0a8276
test eax, eax
je 0xf05e039
mov dword [0xf232b48], esi
mov dword [0xf232b44], esi
call fcn.0f04eb49
cmp dword [0xf0b189c], esi
mov eax, dword [0xf2330dc]
mov dword [0xf233010], eax
mov dword [0xf233014], eax
mov dword [0xf233018], esi
mov dword [0xf232b40], esi
je 0xf05e088
push 0xf005d84
call fcn.0f01dc27
cmp eax, esi
pop ecx
je 0xf05e088
push 0xf005d7c
push eax
mov dword [0xf105770], edi
call fcn.0f01df40
test eax, eax
pop ecx
pop ecx
jne 0xf05e088
mov dword [0xf105774], edi
cmp dword [0xf105770], esi
mov dword [0xf0b189c], esi
je 0xf05e0c5
movzx eax, word [0xf2330c4]
push esi
push dword [0xf232d40]
push eax
push 0xf005d60
push dword [0xf208c7c]
call sym.ntvdm.exe_getIntelRegistersPointer
add esp, 0x14
cmp dword [0xf105774], esi
je 0xf05e0c5
call sym.ntvdm.exe_DispatchInterrupts
push esi
push esi
push esi
push esi
mov dword [0xf232fe4], edi
call fcn.0f06432f
pop edi
pop esi
jmp fcn.0f04eb49
Function at 0xf074955
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0xf232b50]
push edi
mov edi, dword [esi + 0x508]
add edi, dword [ebp + 8]
cmp dword [ebp + 0x18], 0
je 0xf0749b7
mov eax, dword [ebp + 0x14]
test eax, eax
je 0xf074a0a
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
mov cl, byte [esi + 0x500]
mov bl, byte [esi + 0x510]
mov dl, byte [esi + 0x524]
and dl, al
xor bl, cl
and bl, byte [esi + 0x524]
not dl
and dl, cl
and bl, al
or dl, bl
mov byte [edi], dl
dec edi
dec dword [ebp + 0xc]
dec dword [ebp + 0x14]
jne 0xf074980
jmp 0xf074a0a
mov eax, dword [esi + 0x504]
mov ecx, dword [ebp + 0x14]
add eax, dword [ebp + 0x10]
test ecx, ecx
je 0xf074a0a
mov dword [ebp + 0x18], ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx]
mov dl, byte [eax]
mov bl, byte [esi + 0x524]
and bl, cl
mov cl, byte [esi + 0x510]
xor cl, dl
and cl, byte [esi + 0x524]
not bl
and bl, dl
mov edx, dword [ebp + 0xc]
mov byte [ebp + 0x17], cl
movzx ecx, byte [edx]
mov dl, byte [ebp + 0x17]
and dl, cl
or bl, dl
mov byte [edi], bl
dec edi
dec dword [ebp + 0xc]
sub eax, 4
dec dword [ebp + 0x18]
jne 0xf0749ca
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0xf074b4b
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [0xf232b50]
push edi
mov edi, dword [esi + 0x508]
add edi, dword [ebp + 8]
add eax, eax
cmp dword [ebp + 0x18], 0
je 0xf074bab
test eax, eax
je 0xf074beb
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
mov cl, byte [esi + 0x500]
mov bl, byte [esi + 0x510]
mov dl, byte [esi + 0x524]
and dl, al
xor bl, cl
and bl, byte [esi + 0x524]
not dl
and dl, cl
and bl, al
or dl, bl
mov byte [edi], dl
dec edi
dec dword [ebp + 0xc]
dec dword [ebp + 0x14]
jne 0xf074b74
jmp 0xf074beb
mov ecx, dword [esi + 0x504]
add ecx, dword [ebp + 0x10]
test eax, eax
je 0xf074beb
mov dword [ebp + 0x14], eax
mov dl, byte [ecx]
mov bl, byte [esi + 0x510]
mov al, byte [esi + 0x524]
xor bl, dl
mov edx, dword [ebp + 0xc]
movzx edx, byte [edx]
and bl, al
and al, dl
and bl, dl
not al
and al, byte [ecx]
sub ecx, 4
or bl, al
mov byte [edi], bl
dec edi
dec dword [ebp + 0xc]
dec dword [ebp + 0x14]
jne 0xf074bbb
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xf07585e
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [0xf232b50]
push edi
mov edi, dword [esi + 0x508]
add edi, dword [ebp + 8]
add ecx, ecx
cmp dword [ebp + 0x18], 0
je 0xf0758c2
test ecx, ecx
je 0xf075912
mov dword [ebp + 0x14], ecx
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
mov cl, byte [esi + 0x500]
mov bl, byte [esi + 0x510]
mov dl, byte [esi + 0x524]
and dl, al
xor bl, cl
and bl, byte [esi + 0x524]
not dl
and dl, cl
and bl, al
or dl, bl
mov byte [edi], dl
inc edi
inc dword [ebp + 0xc]
dec dword [ebp + 0x14]
jne 0xf07588b
jmp 0xf075912
mov eax, dword [esi + 0x504]
add eax, dword [ebp + 0x10]
test ecx, ecx
je 0xf075912
mov dword [ebp + 0x18], ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx]
mov dl, byte [eax]
mov bl, byte [esi + 0x524]
and bl, cl
mov cl, byte [esi + 0x510]
xor cl, dl
and cl, byte [esi + 0x524]
not bl
and bl, dl
mov edx, dword [ebp + 0xc]
mov byte [ebp + 0x17], cl
movzx ecx, byte [edx]
mov dl, byte [ebp + 0x17]
and dl, cl
or bl, dl
mov byte [edi], bl
inc edi
inc dword [ebp + 0xc]
add eax, 4
dec dword [ebp + 0x18]
jne 0xf0758d2
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0xf0760f7
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0xf232b50]
push edi
mov edi, dword [esi + 0x508]
add edi, dword [ebp + 8]
cmp dword [ebp + 0x18], 0
je 0xf076159
mov eax, dword [ebp + 0x14]
test eax, eax
je 0xf0761ac
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
mov cl, byte [esi + 0x500]
mov bl, byte [esi + 0x510]
mov dl, byte [esi + 0x524]
and dl, al
xor bl, cl
and bl, byte [esi + 0x524]
not dl
and dl, cl
and bl, al
or dl, bl
mov byte [edi], dl
inc edi
inc dword [ebp + 0xc]
dec dword [ebp + 0x14]
jne 0xf076122
jmp 0xf0761ac
mov eax, dword [esi + 0x504]
mov ecx, dword [ebp + 0x14]
add eax, dword [ebp + 0x10]
test ecx, ecx
je 0xf0761ac
mov dword [ebp + 0x18], ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx]
mov dl, byte [eax]
mov bl, byte [esi + 0x524]
and bl, cl
mov cl, byte [esi + 0x510]
xor cl, dl
and cl, byte [esi + 0x524]
not bl
and bl, dl
mov edx, dword [ebp + 0xc]
mov byte [ebp + 0x17], cl
movzx ecx, byte [edx]
mov dl, byte [ebp + 0x17]
and dl, cl
or bl, dl
mov byte [edi], bl
inc edi
inc dword [ebp + 0xc]
add eax, 4
dec dword [ebp + 0x18]
jne 0xf07616c
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xf0764e8
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [0xf232b50]
push edi
mov edi, dword [esi + 0x508]
add edi, dword [ebp + 8]
add ecx, ecx
cmp dword [ebp + 0x18], 0
je 0xf076556
test ecx, ecx
je 0xf0765a8
mov dword [ebp + 0x14], ecx
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
mov ecx, dword [esi + 0x530]
mov dl, byte [esi + 0x518]
mov bl, byte [esi + 0x520]
and eax, 0xf
mov eax, dword [ecx + eax*4]
mov cl, byte [esi + 0x500]
and dl, al
xor dl, byte [esi + 0x51c]
xor bl, cl
and dl, cl
and bl, al
or dl, bl
mov byte [edi], dl
dec edi
dec dword [ebp + 0xc]
dec dword [ebp + 0x14]
jne 0xf076515
jmp 0xf0765a8
mov eax, dword [esi + 0x504]
add eax, dword [ebp + 0x10]
test ecx, ecx
je 0xf0765a8
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx]
mov edx, dword [esi + 0x530]
mov bl, byte [esi + 0x518]
and ecx, 0xf
mov edx, dword [edx + ecx*4]
mov cl, byte [eax]
and bl, dl
xor bl, byte [esi + 0x51c]
mov dword [ebp + 0x18], edx
mov dl, byte [esi + 0x520]
xor dl, cl
and dl, byte [ebp + 0x18]
and bl, cl
or bl, dl
mov byte [edi], bl
dec edi
dec dword [ebp + 0xc]
sub eax, 4
dec dword [ebp + 0x14]
jne 0xf076566
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0xf077086
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [0xf232b50]
push edi
mov edi, dword [esi + 0x508]
add edi, dword [ebp + 8]
add ecx, ecx
cmp dword [ebp + 0x18], 0
je 0xf0770f4
test ecx, ecx
je 0xf077146
mov dword [ebp + 0x14], ecx
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
mov ecx, dword [esi + 0x530]
mov dl, byte [esi + 0x518]
mov bl, byte [esi + 0x520]
and eax, 0xf
mov eax, dword [ecx + eax*4]
mov cl, byte [esi + 0x500]
and dl, al
xor dl, byte [esi + 0x51c]
xor bl, cl
and dl, cl
and bl, al
or dl, bl
mov byte [edi], dl
inc edi
inc dword [ebp + 0xc]
dec dword [ebp + 0x14]
jne 0xf0770b3
jmp 0xf077146
mov eax, dword [esi + 0x504]
add eax, dword [ebp + 0x10]
test ecx, ecx
je 0xf077146
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx]
mov edx, dword [esi + 0x530]
mov bl, byte [esi + 0x518]
and ecx, 0xf
mov edx, dword [edx + ecx*4]
mov cl, byte [eax]
and bl, dl
xor bl, byte [esi + 0x51c]
mov dword [ebp + 0x18], edx
mov dl, byte [esi + 0x520]
xor dl, cl
and dl, byte [ebp + 0x18]
and bl, cl
or bl, dl
mov byte [edi], bl
inc edi
inc dword [ebp + 0xc]
add eax, 4
dec dword [ebp + 0x14]
jne 0xf077104
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xf077701
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0xf232b50]
push edi
mov edi, dword [esi + 0x508]
add edi, dword [ebp + 8]
cmp dword [ebp + 0x18], 0
je 0xf07776d
mov eax, dword [ebp + 0x14]
test eax, eax
je 0xf0777c2
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
mov ecx, dword [esi + 0x530]
mov dl, byte [esi + 0x518]
mov bl, byte [esi + 0x520]
and eax, 0xf
mov eax, dword [ecx + eax*4]
mov cl, byte [esi + 0x500]
and dl, al
xor dl, byte [esi + 0x51c]
xor bl, cl
and dl, cl
and bl, al
or dl, bl
mov byte [edi], dl
dec edi
dec dword [ebp + 0xc]
dec dword [ebp + 0x14]
jne 0xf07772c
jmp 0xf0777c2
mov eax, dword [esi + 0x504]
mov ecx, dword [ebp + 0x14]
add eax, dword [ebp + 0x10]
test ecx, ecx
je 0xf0777c2
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx]
mov edx, dword [esi + 0x530]
mov bl, byte [esi + 0x518]
and ecx, 0xf
mov edx, dword [edx + ecx*4]
mov cl, byte [eax]
and bl, dl
xor bl, byte [esi + 0x51c]
mov dword [ebp + 0x18], edx
mov dl, byte [esi + 0x520]
xor dl, cl
and dl, byte [ebp + 0x18]
and bl, cl
or bl, dl
mov byte [edi], bl
dec edi
dec dword [ebp + 0xc]
sub eax, 4
dec dword [ebp + 0x14]
jne 0xf077780
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0xf078097
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0xf232b50]
push edi
mov edi, dword [esi + 0x508]
add edi, dword [ebp + 8]
cmp dword [ebp + 0x18], 0
je 0xf078103
mov eax, dword [ebp + 0x14]
test eax, eax
je 0xf078158
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
mov ecx, dword [esi + 0x530]
mov dl, byte [esi + 0x518]
mov bl, byte [esi + 0x520]
and eax, 0xf
mov eax, dword [ecx + eax*4]
mov cl, byte [esi + 0x500]
and dl, al
xor dl, byte [esi + 0x51c]
xor bl, cl
and dl, cl
and bl, al
or dl, bl
mov byte [edi], dl
inc edi
inc dword [ebp + 0xc]
dec dword [ebp + 0x14]
jne 0xf0780c2
jmp 0xf078158
mov eax, dword [esi + 0x504]
mov ecx, dword [ebp + 0x14]
add eax, dword [ebp + 0x10]
test ecx, ecx
je 0xf078158
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx]
mov edx, dword [esi + 0x530]
mov bl, byte [esi + 0x518]
and ecx, 0xf
mov edx, dword [edx + ecx*4]
mov cl, byte [eax]
and bl, dl
xor bl, byte [esi + 0x51c]
mov dword [ebp + 0x18], edx
mov dl, byte [esi + 0x520]
xor dl, cl
and dl, byte [ebp + 0x18]
and bl, cl
or bl, dl
mov byte [edi], bl
inc edi
inc dword [ebp + 0xc]
add eax, 4
dec dword [ebp + 0x14]
jne 0xf078116
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xf078b0e
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [0xf232b50]
push edi
mov edi, dword [esi + 0x508]
add edi, dword [ebp + 8]
add ecx, ecx
cmp dword [ebp + 0x18], 0
je 0xf078b70
test ecx, ecx
je 0xf078bb8
mov dword [ebp + 0x14], ecx
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
mov dl, byte [esi + 0x518]
mov cl, byte [esi + 0x500]
mov bl, byte [esi + 0x520]
and dl, al
xor dl, byte [esi + 0x51c]
xor bl, cl
and dl, cl
and bl, al
or dl, bl
mov byte [edi], dl
dec edi
dec dword [ebp + 0xc]
dec dword [ebp + 0x14]
jne 0xf078b3b
jmp 0xf078bb8
mov eax, dword [esi + 0x504]
add eax, dword [ebp + 0x10]
test ecx, ecx
je 0xf078bb8
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
mov bl, byte [esi + 0x518]
mov cl, byte [eax]
and bl, dl
xor bl, byte [esi + 0x51c]
mov dl, byte [esi + 0x520]
and bl, cl
xor dl, cl
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx]
and dl, cl
or bl, dl
mov byte [edi], bl
dec edi
dec dword [ebp + 0xc]
sub eax, 4
dec dword [ebp + 0x14]
jne 0xf078b80
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0xf078c75
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0xf232b50]
mov edx, dword [ebp + 0x14]
mov ecx, dword [eax + 0x508]
add ecx, dword [ebp + 8]
push esi
add edx, edx
cmp dword [ebp + 0x18], 0
push edi
je 0xf078cbb
test edx, edx
je 0xf078ce7
mov esi, dword [ebp + 0xc]
mov edi, edx
mov dl, byte [esi]
and dl, byte [eax + 0x514]
or dl, byte [eax + 0x510]
xor dl, byte [eax + 0x500]
mov byte [ecx], dl
dec ecx
dec esi
dec edi
jne 0xf078c9e
jmp 0xf078ce7
mov esi, dword [eax + 0x504]
add esi, dword [ebp + 0x10]
test edx, edx
je 0xf078ce7
mov edi, dword [ebp + 0xc]
push ebx
mov bl, byte [edi]
and bl, byte [eax + 0x514]
or bl, byte [eax + 0x510]
xor bl, byte [esi]
sub esi, 4
mov byte [ecx], bl
dec ecx
dec edi
dec edx
jne 0xf078ccc
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0xf078dd4
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [0xf232b50]
push edi
mov edi, dword [esi + 0x508]
add edi, dword [ebp + 8]
add eax, eax
cmp dword [ebp + 0x18], 0
je 0xf078e44
test eax, eax
je 0xf078e9d
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
mov al, byte [esi + 0x514]
mov dl, byte [esi + 0x518]
mov bl, byte [esi + 0x520]
and al, cl
or al, byte [esi + 0x510]
mov cl, byte [esi + 0x500]
and dl, al
xor dl, byte [esi + 0x51c]
xor bl, cl
and dl, cl
and bl, al
or dl, bl
mov byte [edi], dl
dec edi
dec dword [ebp + 0xc]
dec dword [ebp + 0x14]
jne 0xf078e01
jmp 0xf078e9d
mov ecx, dword [esi + 0x504]
add ecx, dword [ebp + 0x10]
test eax, eax
mov dword [ebp + 0x14], ecx
je 0xf078e9d
mov dword [ebp + 0x18], eax
jmp 0xf078e5c
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
mov al, byte [esi + 0x514]
mov cl, byte [ecx]
mov bl, byte [esi + 0x520]
sub dword [ebp + 0x14], 4
and al, dl
or al, byte [esi + 0x510]
mov dl, byte [esi + 0x518]
and dl, al
xor dl, byte [esi + 0x51c]
xor bl, cl
and dl, cl
and bl, al
or dl, bl
mov byte [edi], dl
dec edi
dec dword [ebp + 0xc]
dec dword [ebp + 0x18]
jne 0xf078e59
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0xf079496
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [0xf232b50]
push edi
mov edi, dword [esi + 0x508]
add edi, dword [ebp + 8]
add ecx, ecx
cmp dword [ebp + 0x18], 0
je 0xf0794f8
test ecx, ecx
je 0xf079540
mov dword [ebp + 0x14], ecx
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
mov dl, byte [esi + 0x518]
mov cl, byte [esi + 0x500]
mov bl, byte [esi + 0x520]
and dl, al
xor dl, byte [esi + 0x51c]
xor bl, cl
and dl, cl
and bl, al
or dl, bl
mov byte [edi], dl
inc edi
inc dword [ebp + 0xc]
dec dword [ebp + 0x14]
jne 0xf0794c3
jmp 0xf079540
mov eax, dword [esi + 0x504]
add eax, dword [ebp + 0x10]
test ecx, ecx
je 0xf079540
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
mov bl, byte [esi + 0x518]
mov cl, byte [eax]
and bl, dl
xor bl, byte [esi + 0x51c]
mov dl, byte [esi + 0x520]
and bl, cl
xor dl, cl
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx]
and dl, cl
or bl, dl
mov byte [edi], bl
inc edi
inc dword [ebp + 0xc]
add eax, 4
dec dword [ebp + 0x14]
jne 0xf079508
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xf0795fd
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0xf232b50]
mov edx, dword [ebp + 0x14]
mov ecx, dword [eax + 0x508]
add ecx, dword [ebp + 8]
push esi
add edx, edx
cmp dword [ebp + 0x18], 0
push edi
je 0xf079643
test edx, edx
je 0xf07966f
mov esi, dword [ebp + 0xc]
mov edi, edx
mov dl, byte [esi]
and dl, byte [eax + 0x514]
or dl, byte [eax + 0x510]
xor dl, byte [eax + 0x500]
mov byte [ecx], dl
inc ecx
inc esi
dec edi
jne 0xf079626
jmp 0xf07966f
mov esi, dword [eax + 0x504]
add esi, dword [ebp + 0x10]
test edx, edx
je 0xf07966f
mov edi, dword [ebp + 0xc]
push ebx
mov bl, byte [edi]
and bl, byte [eax + 0x514]
or bl, byte [eax + 0x510]
xor bl, byte [esi]
add esi, 4
mov byte [ecx], bl
inc ecx
inc edi
dec edx
jne 0xf079654
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0xf07975c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [0xf232b50]
push edi
mov edi, dword [esi + 0x508]
add edi, dword [ebp + 8]
add eax, eax
cmp dword [ebp + 0x18], 0
je 0xf0797cc
test eax, eax
je 0xf079825
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
mov al, byte [esi + 0x514]
mov dl, byte [esi + 0x518]
mov bl, byte [esi + 0x520]
and al, cl
or al, byte [esi + 0x510]
mov cl, byte [esi + 0x500]
and dl, al
xor dl, byte [esi + 0x51c]
xor bl, cl
and dl, cl
and bl, al
or dl, bl
mov byte [edi], dl
inc edi
inc dword [ebp + 0xc]
dec dword [ebp + 0x14]
jne 0xf079789
jmp 0xf079825
mov ecx, dword [esi + 0x504]
add ecx, dword [ebp + 0x10]
test eax, eax
mov dword [ebp + 0x14], ecx
je 0xf079825
mov dword [ebp + 0x18], eax
jmp 0xf0797e4
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
mov al, byte [esi + 0x514]
mov cl, byte [ecx]
mov bl, byte [esi + 0x520]
add dword [ebp + 0x14], 4
and al, dl
or al, byte [esi + 0x510]
mov dl, byte [esi + 0x518]
and dl, al
xor dl, byte [esi + 0x51c]
xor bl, cl
and dl, cl
and bl, al
or dl, bl
mov byte [edi], dl
inc edi
inc dword [ebp + 0xc]
dec dword [ebp + 0x18]
jne 0xf0797e1
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xf079f89
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0xf232b50]
push edi
mov edi, dword [esi + 0x508]
add edi, dword [ebp + 8]
cmp dword [ebp + 0x18], 0
je 0xf079fe9
mov eax, dword [ebp + 0x14]
test eax, eax
je 0xf07a034
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
mov dl, byte [esi + 0x518]
mov cl, byte [esi + 0x500]
mov bl, byte [esi + 0x520]
and dl, al
xor dl, byte [esi + 0x51c]
xor bl, cl
and dl, cl
and bl, al
or dl, bl
mov byte [edi], dl
dec edi
dec dword [ebp + 0xc]
dec dword [ebp + 0x14]
jne 0xf079fb4
jmp 0xf07a034
mov eax, dword [esi + 0x504]
mov ecx, dword [ebp + 0x14]
add eax, dword [ebp + 0x10]
test ecx, ecx
je 0xf07a034
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
mov bl, byte [esi + 0x518]
mov cl, byte [eax]
and bl, dl
xor bl, byte [esi + 0x51c]
mov dl, byte [esi + 0x520]
and bl, cl
xor dl, cl
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx]
and dl, cl
or bl, dl
mov byte [edi], bl
dec edi
dec dword [ebp + 0xc]
sub eax, 4
dec dword [ebp + 0x14]
jne 0xf079ffc
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0xf07a1cd
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0xf232b50]
mov ecx, dword [eax + 0x508]
add ecx, dword [ebp + 8]
cmp dword [ebp + 0x18], 0
push esi
push edi
je 0xf07a20f
mov edi, dword [ebp + 0x14]
test edi, edi
je 0xf07a23e
mov esi, dword [ebp + 0xc]
mov dl, byte [eax + 0x514]
and dl, byte [esi]
or dl, byte [eax + 0x510]
xor dl, byte [eax + 0x500]
mov byte [ecx], dl
dec ecx
dec esi
dec edi
jne 0xf07a1f2
jmp 0xf07a23e
mov esi, dword [eax + 0x504]
mov edx, dword [ebp + 0x14]
add esi, dword [ebp + 0x10]
test edx, edx
je 0xf07a23e
mov edi, dword [ebp + 0xc]
push ebx
mov bl, byte [eax + 0x514]
and bl, byte [edi]
or bl, byte [eax + 0x510]
xor bl, byte [esi]
sub esi, 4
mov byte [ecx], bl
dec ecx
dec edi
dec edx
jne 0xf07a223
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0xf07a4be
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [0xf232b50]
push edi
mov edi, dword [esi + 0x508]
add edi, dword [ebp + 8]
cmp dword [ebp + 0x18], 0
je 0xf07a52c
test eax, eax
je 0xf07a585
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
mov al, byte [esi + 0x514]
mov dl, byte [esi + 0x518]
mov bl, byte [esi + 0x520]
and al, cl
or al, byte [esi + 0x510]
mov cl, byte [esi + 0x500]
and dl, al
xor dl, byte [esi + 0x51c]
xor bl, cl
and dl, cl
and bl, al
or dl, bl
mov byte [edi], dl
dec edi
dec dword [ebp + 0xc]
dec dword [ebp + 0x14]
jne 0xf07a4e9
jmp 0xf07a585
mov ecx, dword [esi + 0x504]
add ecx, dword [ebp + 0x10]
test eax, eax
mov dword [ebp + 0x18], ecx
je 0xf07a585
mov dword [ebp + 0x14], eax
jmp 0xf07a544
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
mov al, byte [esi + 0x514]
mov cl, byte [ecx]
mov bl, byte [esi + 0x520]
sub dword [ebp + 0x18], 4
and al, dl
or al, byte [esi + 0x510]
mov dl, byte [esi + 0x518]
and dl, al
xor dl, byte [esi + 0x51c]
xor bl, cl
and dl, cl
and bl, al
or dl, bl
mov byte [edi], dl
dec edi
dec dword [ebp + 0xc]
dec dword [ebp + 0x14]
jne 0xf07a541
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0xf07acc5
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0xf232b50]
push edi
mov edi, dword [esi + 0x508]
add edi, dword [ebp + 8]
cmp dword [ebp + 0x18], 0
je 0xf07ad25
mov eax, dword [ebp + 0x14]
test eax, eax
je 0xf07ad70
mov dword [ebp + 0x14], eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
mov dl, byte [esi + 0x518]
mov cl, byte [esi + 0x500]
mov bl, byte [esi + 0x520]
and dl, al
xor dl, byte [esi + 0x51c]
xor bl, cl
and dl, cl
and bl, al
or dl, bl
mov byte [edi], dl
inc edi
inc dword [ebp + 0xc]
dec dword [ebp + 0x14]
jne 0xf07acf0
jmp 0xf07ad70
mov eax, dword [esi + 0x504]
mov ecx, dword [ebp + 0x14]
add eax, dword [ebp + 0x10]
test ecx, ecx
je 0xf07ad70
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
mov bl, byte [esi + 0x518]
mov cl, byte [eax]
and bl, dl
xor bl, byte [esi + 0x51c]
mov dl, byte [esi + 0x520]
and bl, cl
xor dl, cl
mov ecx, dword [ebp + 0xc]
movzx ecx, byte [ecx]
and dl, cl
or bl, dl
mov byte [edi], bl
inc edi
inc dword [ebp + 0xc]
add eax, 4
dec dword [ebp + 0x14]
jne 0xf07ad38
pop edi
pop esi
pop ebx
pop ebp
ret