joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a120
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
mov ecx, 0x101a157a
call fcn.10137ff6
mov esi, dword [0x1018ff68]
cmp byte [esi + 0x2d60], 0
je 0x1001a1c9
cmp dword [esi + 0x2d68], 0
lea edi, [esi + 0x2d6c]
je 0x1001a1bb
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x1001a173
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.1001b3d0
lea eax, [ebp + 0xc]
mov dword [edi], 0
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.1000b680
mov edx, dword [edi]
mov ecx, 0x1018ff64
push dword [esi + 0x2d68]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x2d74]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.1000b680
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001a640
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov ebx, ecx
mov ecx, 0x101a157a
push edi
mov dword [ebp - 8], ebx
call fcn.10137ff6
mov esi, dword [0x1018ff68]
mov dword [esi + 0x2d38], 0
test ebx, ebx
je 0x1001a739
lea edi, [esi + 0x2d3c]
mov dword [esi + 0x2d38], 0
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x1001a69f
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.1001b3d0
mov dword [edi], 0
cmp dword [edi + 4], 0
jne 0x1001a6b4
push 8
mov ecx, edi
call fcn.1001b3d0
mov eax, dword [edi]
mov ecx, dword [edi + 8]
mov dword [ebp - 4], 0
mov byte [ecx + eax], 0
inc dword [edi]
cmp dword [esi + 0x2d48], 0
jle 0x1001a6f6
xor ebx, ebx
mov eax, dword [esi + 0x2d50]
add eax, ebx
push edi
push eax
push esi
mov eax, dword [eax + 0x10]
call eax
mov eax, dword [ebp - 4]
add esp, 0xc
inc eax
add ebx, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x2d48]
jl 0x1001a6d1
mov edi, dword [edi]
mov ebx, 0x1018ff64
mov ecx, dword [ebp - 8]
mov edx, 0x101556c0
lea eax, [edi - 1]
neg edi
sbb edi, edi
and edi, eax
mov eax, dword [esi + 0x2d44]
test eax, eax
cmovne ebx, eax
call fcn.1000acd0
mov esi, eax
test esi, esi
je 0x1001a739
push esi
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029ec0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov ecx, 0x101a157a
mov esi, edx
call fcn.10137ff6
mov eax, 0x5e6ea9af
xor edi, edi
mul dword [ebp + 8]
mov ecx, 1
mov dword [ebp - 0x10], edi
shr edx, 0xb
imul eax, edx, 0x15b0
mov edx, dword [ebp + 8]
mov ebx, edx
sub ebx, eax
mov dword [ebp - 4], ebx
test edx, edx
je 0x1002a004
xor edx, edx
mov dword [ebp - 8], edx
cmp ebx, 7
jbe 0x10029f6a
mov eax, 7
sub eax, esi
mov dword [ebp - 0x10], eax
movzx eax, byte [esi]
add edx, 8
add ecx, eax
movzx eax, byte [esi + 1]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 2]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 3]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 4]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 5]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 6]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 7]
add edi, ecx
add esi, 8
add ecx, eax
mov eax, dword [ebp - 0x10]
add eax, esi
add edi, ecx
cmp eax, ebx
jb 0x10029f16
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 4]
xor ebx, ebx
xor edx, edx
cmp dword [ebp - 8], eax
jae 0x10029fc9
sub eax, dword [ebp - 8]
cmp eax, 2
jb 0x10029fbc
mov eax, dword [ebp - 8]
mov edi, ebx
mov edx, dword [ebp - 4]
sub edx, eax
sub edx, 2
shr edx, 1
inc edx
lea eax, [eax + edx*2]
mov dword [ebp - 8], eax
movzx eax, byte [esi]
add ecx, eax
movzx eax, byte [esi + 1]
add ebx, ecx
add esi, 2
add ecx, eax
add edi, ecx
sub edx, 1
jne 0x10029f94
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jae 0x10029fc4
movzx eax, byte [esi]
add ecx, eax
add edi, ecx
inc esi
lea eax, [edx + ebx]
add edi, eax
mov eax, 0x80078071
mov ebx, dword [ebp - 4]
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul eax, edx, 0xffff000f
add edi, eax
sub dword [ebp + 8], ebx
mov ebx, 0x15b0
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], ebx
jne 0x10029f02
shl edi, 0x10
lea eax, [ecx + edi]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002c980
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10160380]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov ecx, 0x101a157a
call fcn.10137ff6
mov edi, dword [0x1018ff68]
lea eax, [ebp - 0x14]
push eax
push dword [0x10197840]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
movd xmm1, eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x28]
cvtdq2ps xmm0, xmm0
push eax
movss dword [edi + 0x10], xmm1
movss dword [edi + 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x28]
sub ecx, dword [0x10197848]
mov edx, dword [ebp - 0x24]
sbb edx, dword [0x1019784c]
call fcn.10138420
mov edx, dword [0x10197854]
mov ecx, dword [0x10197850]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x18], xmm0
call fcn.10138420
movss xmm1, dword [ebp - 0x18]
cvtsd2ss xmm0, xmm0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
divss xmm1, xmm0
movss dword [edi + 0x18], xmm1
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov dword [0x10197848], eax
mov dword [0x1019784c], ecx
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [edi + 0x100], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [edi + 0x101], al
call esi
mov ecx, dword [0x1018ff68]
shr eax, 0xf
and al, 1
mov byte [edi + 0x103], 0
mov byte [edi + 0x102], al
cmp byte [ecx + 0x35b], 0
lea esi, [ecx + 0xe8]
je 0x1002cab1
cvttss2si eax, dword [esi]
mov dword [ebp - 0x1c], eax
cvttss2si eax, dword [ecx + 0xec]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x10197840]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi], 0xff7fffff
mov dword [esi + 4], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x1002cb19
mov ecx, dword [0x10197840]
cmp eax, ecx
je 0x1002cade
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x1002cb19
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1002cb19
lea eax, [ebp - 0x30]
push eax
push dword [0x10197840]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1002cb19
movd xmm0, dword [ebp - 0x30]
movd xmm1, dword [ebp - 0x2c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi], xmm0
movss dword [esi + 4], xmm1
cmp byte [edi + 0xb0], 0
mov eax, dword [0x1018ff68]
je 0x1002cb2c
or ecx, 0xffffffff
jmp 0x1002cb32
mov ecx, dword [eax + 0x1d38]
cmp dword [0x101811c8], ecx
je 0x1002cb70
test byte [eax + 8], 0x20
mov dword [0x101811c8], ecx
jne 0x1002cb70
cmp dword [eax + 0x1d38], 0xffffffff
je 0x1002cb68
cmp byte [eax + 0xb0], 0
jne 0x1002cb68
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
jmp 0x1002cb6a
push 0
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100dfbc8
mov esp, ebp
pop ebp
ret
Function at 0x1004ae30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004ae9e
cmp byte [esi + 1], 0
jne 0x1004aee2
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x1b
jb 0x1004ae60
jmp 0x1004aee2
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x1b
jb 0x1004aea3
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1c]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004af00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004af6e
cmp byte [esi + 1], 0
jne 0x1004afb2
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x28
jb 0x1004af30
jmp 0x1004afb2
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x34]
xor ebx, dword [esi + 0x30]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x28
jb 0x1004af73
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x29]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004afd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004b044
cmp byte [esi + 1], 0
jne 0x1004b091
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x20
jb 0x1004b004
jmp 0x1004b091
xor ecx, ecx
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x20
jb 0x1004b050
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x21]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004b0b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004b11e
cmp byte [esi + 1], 0
jne 0x1004b162
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x1d
jb 0x1004b0e0
jmp 0x1004b162
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x1d
jb 0x1004b123
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1e]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004ba90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004bafe
cmp byte [esi + 1], 0
jne 0x1004bb42
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x19
jb 0x1004bac0
jmp 0x1004bb42
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x19
jb 0x1004bb03
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1a]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004bb60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004bbce
cmp byte [esi + 1], 0
jne 0x1004bc12
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x17
jb 0x1004bb90
jmp 0x1004bc12
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x17
jb 0x1004bbd3
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x18]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004bc30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004bc9e
cmp byte [esi + 1], 0
jne 0x1004bce2
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x1c
jb 0x1004bc60
jmp 0x1004bce2
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x1c
jb 0x1004bca3
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x1d]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004bd00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004bd74
cmp byte [esi + 1], 0
jne 0x1004bdc1
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0xc
jb 0x1004bd34
jmp 0x1004bdc1
xor ecx, ecx
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0xc
jb 0x1004bd80
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xd]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004bde0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004be4e
cmp byte [esi + 1], 0
jne 0x1004be92
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x18
jb 0x1004be10
jmp 0x1004be92
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x24]
xor ebx, dword [esi + 0x20]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x18
jb 0x1004be53
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x19]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004beb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004bf1e
cmp byte [esi + 1], 0
jne 0x1004bf62
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x14
jb 0x1004bee0
jmp 0x1004bf62
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x14
jb 0x1004bf23
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x15]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1004bf80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004bfee
cmp byte [esi + 1], 0
jne 0x1004c032
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xd
jb 0x1004bfb0
jmp 0x1004c032
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x14]
xor ebx, dword [esi + 0x10]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0xd
jb 0x1004bff3
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0xe]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1004c050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, 0x1019da78
push edi
call fcn.10137ff6
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x1004c0be
cmp byte [esi + 1], 0
jne 0x1004c102
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x16
jb 0x1004c080
jmp 0x1004c102
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 4]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x16
jb 0x1004c0c3
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x17]
push eax
push edi
call fcn.1004c7e0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4