joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004f190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1019d948], 0
push ebx
push esi
je 0x1004f207
cmp byte [0x1019d949], 0
jne 0x1004f255
mov byte [0x1019d949], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1019d97c]
xor ebx, dword [0x1019d978]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1019d94a]
xor al, bl
mov byte [esi + 0x1019d94a], al
inc esi
cmp esi, 0x28
jb 0x1004f1c0
jmp 0x1004f255
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1019d97c]
xor ebx, dword [0x1019d978]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1019d94a]
xor al, bl
mov byte [esi + 0x1019d94a], al
inc esi
cmp esi, 0x28
jb 0x1004f210
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x1019d971
push 0x1019d94a
call fcn.1004d640
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004f280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1019da70], 0
push ebx
push esi
je 0x1004f2f7
cmp byte [0x1019da71], 0
jne 0x1004f345
mov byte [0x1019da71], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1019da8c]
xor ebx, dword [0x1019da88]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1019da72]
xor al, bl
mov byte [esi + 0x1019da72], al
inc esi
cmp esi, 0x15
jb 0x1004f2b0
jmp 0x1004f345
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1019da8c]
xor ebx, dword [0x1019da88]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1019da72]
xor al, bl
mov byte [esi + 0x1019da72], al
inc esi
cmp esi, 0x15
jb 0x1004f300
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x1019da86
push 0x1019da72
call fcn.1004d640
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004f370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1019dae0], 0
push ebx
push esi
je 0x1004f3e7
cmp byte [0x1019dae1], 0
jne 0x1004f435
mov byte [0x1019dae1], 1
xor esi, esi
nop word [eax + eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1019db0c]
xor ebx, dword [0x1019db08]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1019dae2]
xor al, bl
mov byte [esi + 0x1019dae2], al
inc esi
cmp esi, 0x1f
jb 0x1004f3a0
jmp 0x1004f435
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x1019db0c]
xor ebx, dword [0x1019db08]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [esi + 0x1019dae2]
xor al, bl
mov byte [esi + 0x1019dae2], al
inc esi
cmp esi, 0x1f
jb 0x1004f3f0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
push 0x1019db00
push 0x1019dae2
call fcn.1004d640
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10054520
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10054587
cmp byte [esi + 1], 0
jne 0x100545cc
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x12
jb 0x10054546
jmp 0x100545cc
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x12
jb 0x10054590
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x13]
push eax
push edi
call fcn.1004d640
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1005e820
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [ebx]
mov edi, dword [ebp + 0x10]
cmp edi, 7
ja case.default.0x1005e836
jmp dword [edi*4 + 0x1005e9cc]
mov ecx, esi
and ecx, 3
sub edi, ecx
sub ecx, 1
je 0x1005e879
sub ecx, 1
je 0x1005e866
sub ecx, 1
jne 0x1005e88c
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017b5a8]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017b5a8]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017b5a8]
inc esi
mov edx, edi
sar edx, 3
test edx, edx
je 0x1005e90e
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017b5a8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017b5a8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017b5a8]
mov ecx, eax
movzx eax, cl
shr ecx, 8
mov eax, dword [eax*4 + 0x1017b5a8]
xor eax, dword [esi + 4]
add esi, 8
xor eax, ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017b5a8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017b5a8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017b5a8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017b5a8]
sub edx, 1
jne 0x1005e895
and edi, 7
jmp 0x1005e831
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017b5a8]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017b5a8]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017b5a8]
inc esi
xor eax, dword [esi]
movzx ecx, al
shr eax, 8
pop edi
pop esi
xor eax, dword [ecx*4 + 0x1017b5a8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017b5a8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017b5a8]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x1017b5a8]
mov dword [ebx], eax
pop ebx
pop ebp
ret
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017b5a8]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017b5a8]
inc esi
movzx edx, byte [esi]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1017b5a8]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
ret
Function at 0x1005ef10
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push 0x200
mov esi, ecx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
push 4
call fcn.1010f1ca
add esp, 0x10
test eax, eax
je 0x1005ef38
mov dword [eax], esi
jmp 0x1005ef3a
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0x1005ec70
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 8], eax
test eax, eax
je 0x1005ef76
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x1005ef84
push ecx
push eax
call sub.MSVCP140.dll__Thrd_detach
add esp, 8
test eax, eax
jne 0x1005ef84
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
push 6
mov dword [ebp - 4], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
push 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x100622d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1030cb40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1030e2e4]
test eax, eax
jne 0x10062408
push ebx
push esi
cmp byte [0x102ef270], al
je 0x10062354
cmp byte [0x102ef271], al
jne 0x10062398
mov byte [0x102ef271], 1
xor esi, esi
nop dword [eax]
xor edx, edx
mov ebx, esi
xor edx, dword [0x102ef284]
xor ebx, dword [0x102ef280]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 0x24], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102ef272], al
inc esi
cmp esi, 0xc
jb 0x10062310
jmp 0x10062398
xor esi, esi
xor edx, edx
mov ebx, esi
xor edx, dword [0x102ef284]
xor ebx, dword [0x102ef280]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
xor ebx, eax
mov dword [ebp - 0x24], edx
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [esi + 0x102ef272], al
inc esi
cmp esi, 0xc
jb 0x10062356
lea eax, [ebp - 0x1d]
push eax
push 0x102ef27d
push 0x102ef272
lea ecx, [ebp - 0x1c]
call fcn.1004d640
cmp dword [ebp - 8], 0xf
lea eax, [ebp - 0x1c]
cmova eax, dword [ebp - 0x1c]
push eax
push dword [0x1030e33c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 8]
mov dword [0x1030e2e4], eax
pop esi
pop ebx
cmp ecx, 0xf
jbe 0x10062408
mov edx, dword [ebp - 0x1c]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100623f9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100623f9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1010f1fa
mov eax, dword [0x1030e2e4]
add esp, 8
movss xmm0, dword [ebp + 0xc]
sub esp, 8
mov dword [ebp - 0x24], eax
movss dword [esp + 4], xmm0
movss xmm0, dword [ebp + 8]
movss dword [esp], xmm0
call dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
call fcn.1010f522
mov esp, ebp
pop ebp
ret
Function at 0x10062ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10062d47
cmp byte [esi + 1], 0
jne 0x10062d8c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1a
jb 0x10062d06
jmp 0x10062d8c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1a
jb 0x10062d50
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x1b]
push eax
push edi
call fcn.1004d640
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10062db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10062e17
cmp byte [esi + 1], 0
jne 0x10062e5c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1e
jb 0x10062dd6
jmp 0x10062e5c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1e
jb 0x10062e20
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x1f]
push eax
push edi
call fcn.1004d640
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10062e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10062ee7
cmp byte [esi + 1], 0
jne 0x10062f2c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1f
jb 0x10062ea6
jmp 0x10062f2c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x1f
jb 0x10062ef0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x20]
push eax
push edi
call fcn.1004d640
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10062f50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10062fb7
cmp byte [esi + 1], 0
jne 0x10062ffc
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x20
jb 0x10062f76
jmp 0x10062ffc
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x20
jb 0x10062fc0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x21]
push eax
push edi
call fcn.1004d640
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10063020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10063087
cmp byte [esi + 1], 0
jne 0x100630cc
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x21
jb 0x10063046
jmp 0x100630cc
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x21
jb 0x10063090
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x22]
push eax
push edi
call fcn.1004d640
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100630f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10063157
cmp byte [esi + 1], 0
jne 0x1006319c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x22
jb 0x10063116
jmp 0x1006319c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x22
jb 0x10063160
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x23]
push eax
push edi
call fcn.1004d640
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100631c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10063227
cmp byte [esi + 1], 0
jne 0x1006326c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x23
jb 0x100631e6
jmp 0x1006326c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x23
jb 0x10063230
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x24]
push eax
push edi
call fcn.1004d640
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10063290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100632f7
cmp byte [esi + 1], 0
jne 0x1006333c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x24
jb 0x100632b6
jmp 0x1006333c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x24
jb 0x10063300
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x25]
push eax
push edi
call fcn.1004d640
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10063360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100633c7
cmp byte [esi + 1], 0
jne 0x1006340c
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x25
jb 0x10063386
jmp 0x1006340c
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x25
jb 0x100633d0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x26]
push eax
push edi
call fcn.1004d640
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10063430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10063497
cmp byte [esi + 1], 0
jne 0x100634dc
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x26
jb 0x10063456
jmp 0x100634dc
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x26
jb 0x100634a0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x27]
push eax
push edi
call fcn.1004d640
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4