joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c940
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10160380]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov ecx, 0x101a157e
call fcn.10138266
mov edi, dword [0x10190058]
lea eax, [ebp - 0x14]
push eax
push dword [0x10197930]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
movd xmm1, eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x28]
cvtdq2ps xmm0, xmm0
push eax
movss dword [edi + 0x10], xmm1
movss dword [edi + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x28]
sub ecx, dword [0x10197938]
mov edx, dword [ebp - 0x24]
sbb edx, dword [0x1019793c]
call fcn.10138690
mov edx, dword [0x10197944]
mov ecx, dword [0x10197940]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x18], xmm0
call fcn.10138690
movss xmm1, dword [ebp - 0x18]
cvtsd2ss xmm0, xmm0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
divss xmm1, xmm0
movss dword [edi + 0x18], xmm1
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [0x10197938], eax
mov dword [0x1019793c], ecx
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [edi + 0x100], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [edi + 0x101], al
call esi
mov ecx, dword [0x10190058]
shr eax, 0xf
and al, 1
mov byte [edi + 0x103], 0
mov byte [edi + 0x102], al
cmp byte [ecx + 0x35b], 0
lea esi, [ecx + 0xe8]
je 0x1002ca71
cvttss2si eax, dword [esi]
mov dword [ebp - 0x1c], eax
cvttss2si eax, dword [ecx + 0xec]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x10197930]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi], 0xff7fffff
mov dword [esi + 4], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x1002cad9
mov ecx, dword [0x10197930]
cmp eax, ecx
je 0x1002ca9e
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x1002cad9
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1002cad9
lea eax, [ebp - 0x30]
push eax
push dword [0x10197930]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1002cad9
movd xmm0, dword [ebp - 0x30]
movd xmm1, dword [ebp - 0x2c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi], xmm0
movss dword [esi + 4], xmm1
cmp byte [edi + 0xb0], 0
mov eax, dword [0x10190058]
je 0x1002caec
or ecx, 0xffffffff
jmp 0x1002caf2
mov ecx, dword [eax + 0x1d38]
cmp dword [0x101811c8], ecx
je 0x1002cb30
test byte [eax + 8], 0x20
mov dword [0x101811c8], ecx
jne 0x1002cb30
cmp dword [eax + 0x1d38], 0xffffffff
je 0x1002cb28
cmp byte [eax + 0xb0], 0
jne 0x1002cb28
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
jmp 0x1002cb2a
push 0
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100dfe28
mov esp, ebp
pop ebp
ret
Function at 0x1004ade0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10138266
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004ae4e
cmp byte [esi + 1], 0
jne 0x1004ae92
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x1b
jb 0x1004ae10
jmp 0x1004ae92
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x1b
jb 0x1004ae53
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1c]
push eax
push edi
call fcn.1004c790
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004aeb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10138266
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004af1e
cmp byte [esi + 1], 0
jne 0x1004af62
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x28
jb 0x1004aee0
jmp 0x1004af62
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x28
jb 0x1004af23
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x29]
push eax
push edi
call fcn.1004c790
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004af80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10138266
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004aff4
cmp byte [esi + 1], 0
jne 0x1004b041
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x20
jb 0x1004afb4
jmp 0x1004b041
xor ecx, ecx
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x20
jb 0x1004b000
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x21]
push eax
push edi
call fcn.1004c790
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004b060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10138266
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004b0ce
cmp byte [esi + 1], 0
jne 0x1004b112
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x1d
jb 0x1004b090
jmp 0x1004b112
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x1d
jb 0x1004b0d3
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1e]
push eax
push edi
call fcn.1004c790
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004ba40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10138266
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004baae
cmp byte [esi + 1], 0
jne 0x1004baf2
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x19
jb 0x1004ba70
jmp 0x1004baf2
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x19
jb 0x1004bab3
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1a]
push eax
push edi
call fcn.1004c790
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004bb10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10138266
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004bb7e
cmp byte [esi + 1], 0
jne 0x1004bbc2
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x17
jb 0x1004bb40
jmp 0x1004bbc2
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x17
jb 0x1004bb83
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x18]
push eax
push edi
call fcn.1004c790
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004bbe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10138266
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004bc4e
cmp byte [esi + 1], 0
jne 0x1004bc92
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x1c
jb 0x1004bc10
jmp 0x1004bc92
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x1c
jb 0x1004bc53
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1d]
push eax
push edi
call fcn.1004c790
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004bcb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10138266
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004bd24
cmp byte [esi + 1], 0
jne 0x1004bd71
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0xc
jb 0x1004bce4
jmp 0x1004bd71
xor ecx, ecx
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0xc
jb 0x1004bd30
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xd]
push eax
push edi
call fcn.1004c790
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004bd90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10138266
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004bdfe
cmp byte [esi + 1], 0
jne 0x1004be42
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x18
jb 0x1004bdc0
jmp 0x1004be42
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x18
jb 0x1004be03
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x19]
push eax
push edi
call fcn.1004c790
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004be60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10138266
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004bece
cmp byte [esi + 1], 0
jne 0x1004bf12
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x14
jb 0x1004be90
jmp 0x1004bf12
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x14
jb 0x1004bed3
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x15]
push eax
push edi
call fcn.1004c790
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004bf30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10138266
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004bf9e
cmp byte [esi + 1], 0
jne 0x1004bfe2
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xd
jb 0x1004bf60
jmp 0x1004bfe2
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xd
jb 0x1004bfa3
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xe]
push eax
push edi
call fcn.1004c790
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004c000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10138266
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004c06e
cmp byte [esi + 1], 0
jne 0x1004c0b2
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x16
jb 0x1004c030
jmp 0x1004c0b2
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x16
jb 0x1004c073
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x17]
push eax
push edi
call fcn.1004c790
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004c0d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10138266
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004c13e
cmp byte [esi + 1], 0
jne 0x1004c182
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x15
jb 0x1004c100
jmp 0x1004c182
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x15
jb 0x1004c143
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x16]
push eax
push edi
call fcn.1004c790
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004c1a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10138266
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004c20e
cmp byte [esi + 1], 0
jne 0x1004c252
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xe
jb 0x1004c1d0
jmp 0x1004c252
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xe
jb 0x1004c213
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xf]
push eax
push edi
call fcn.1004c790
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004c270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10138266
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004c2de
cmp byte [esi + 1], 0
jne 0x1004c322
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x10
jb 0x1004c2a0
jmp 0x1004c322
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x10
jb 0x1004c2e3
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x11]
push eax
push edi
call fcn.1004c790
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004c340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10138266
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004c3b4
cmp byte [esi + 1], 0
jne 0x1004c401
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0xb
jb 0x1004c374
jmp 0x1004c401
xor ecx, ecx
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0xb
jb 0x1004c3c0
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xc]
push eax
push edi
call fcn.1004c790
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4