joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1021e491
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1021e4a0
pop dword [ebp - 0x30]
mov eax, 0x685a324a
add eax, 0xa7c7b256
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xa4a76074
sub dword [ebp - 0x40], 0x56551b29
mov dword [ebp - 0x3c], 0x4231e183
add dword [ebp - 0x3c], 0xf0016ac2
mov dword [ebp - 0x38], 0x48d9554c
add dword [ebp - 0x38], 0x372eee2
mov dword [ebp - 0x34], 0x7e60fad
add dword [ebp - 0x34], 0xf819f053
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x42714f80
sub dword [ebp - 0x40], 0xcdfee62a
mov dword [ebp - 0x3c], 0xea2d6740
add dword [ebp - 0x3c], 0x573efa35
mov dword [ebp - 0x38], 0x6fe2a022
add dword [ebp - 0x38], 0xf38ccc4a
mov dword [ebp - 0x34], 0xa9fca773
add dword [ebp - 0x34], 0x5603588d
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x42b48ffc
add eax, 0xcd835ed4
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3972a
push 0
call eax
mov ecx, 0x178dcd56
add ecx, 0xe8726927
mov edx, eax
mov ebx, 0x71563ae0
sub ebx, 0x6119ece0
add ebx, dword [ebp - 0x30]
mov esi, 0x250c92ba
mov edi, dword [ebx]
mov dword [ebp - 0x14], 0xbabc6df7
xor edi, esi
sub dword [ebp - 0x20], 0x2862686e
mov dword [edx], edi
sub dword [ebp - 0x10], esi
add edx, 0xa4d2a54c
sub edx, 0xa4d2a548
add ebx, 0xe2257d16
add ebx, 0x1dda82ee
loop 0x1021e5b7
add eax, 0xccc7
xor ebx, ebx
add ebx, eax
add eax, 0x9fac3a0
sub eax, 0x9fac39b
mov ecx, 0x74437562
sub ecx, 0x64437562
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x1021edc0
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and eax, 0xf
jmp dword [eax*4 + 0x102f4b90]
Function at 0x1021f550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x1038100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov edx, dword [ecx]
mov esi, dword [edx + 4]
cmp byte [esi + 0xd], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], ecx
je 0x1021f5c6
mov dword [ebp - 0x14], edx
mov edi, edx
cmp edi, dword [edx]
je 0x1021f61e
lea ebx, [ebp - 0x14]
mov ecx, ebx
call fcn.1021dab0
mov ebx, dword [ebx]
mov ecx, dword [ebx + 0x10]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dl, 1
cmp ecx, eax
jl 0x1021f60b
push dword [ebp + 0x14]
call dword [sym.imp.mozglue.dll_free]
add esp, 4
mov esi, dword [ebp + 8]
mov dword [esi], ebx
mov byte [esi + 4], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1021e470
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov dword [ebp - 0x20], edx
mov eax, dword [eax]
mov edi, esi
mov ecx, dword [esi + 0x10]
xor ebx, ebx
cmp ecx, eax
setge bl
xor edx, edx
cmp eax, ecx
setl dl
cmp byte [ebp + 0xc], 0
cmovne edx, ebx
mov ebx, edx
xor bl, 1
movzx esi, bl
mov esi, dword [edi + esi*8]
cmp byte [esi + 0xd], 0
je 0x1021f5cb
mov dword [ebp - 0x14], edi
test dl, dl
je 0x1021f605
mov edx, dword [ebp - 0x20]
jmp 0x1021f579
xor edx, edx
mov ebx, edi
jmp 0x1021f597
movzx eax, dl
lea esi, [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push eax
jmp 0x1021f62d
lea esi, [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push 1
push esi
call fcn.1021f400
mov eax, dword [esi]
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov byte [esi + 4], 1
jmp 0x1021f5b0
Function at 0x102afe00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x10]
cmp dword [edi + 0x14], 0xf
jbe 0x102afe17
mov edi, dword [edi]
test ebx, ebx
mov dword [ebp - 0x10], edx
mov eax, 0x811c9dc5
je 0x102afe36
xor edx, edx
movzx esi, byte [edi + edx]
xor esi, eax
imul eax, esi, 0x1000193
inc edx
cmp ebx, edx
jne 0x102afe25
mov dword [ebp - 0x14], edi
and eax, dword [ecx + 0x18]
mov edx, dword [ecx + 4]
mov ecx, dword [ecx + 0xc]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ecx + eax*8]
lea eax, [eax + eax + 1]
mov dword [ebp - 0x20], eax
mov esi, ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
je 0x102afe7a
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
mov eax, dword [eax + edi*4]
mov eax, dword [eax]
cmp esi, eax
je 0x102afe9d
cmp dword [esi + 0x18], ebx
jne 0x102afe99
cmp dword [esi + 0x1c], 0xf
jbe 0x102afe7e
mov edi, dword [esi + 8]
jmp 0x102afe81
mov eax, ecx
jmp 0x102afe66
lea edi, [esi + 8]
mov eax, dword [ebp - 0x14]
push ebx
push eax
push edi
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
je 0x102afeaa
mov esi, dword [esi]
jmp 0x102afe57
mov eax, dword [ebp - 0x10]
mov dword [eax], edx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
push ebx
push edi
push dword [ebp - 0x14]
call sub.VCRUNTIME140.dll_memcmp
add esp, 0xc
test eax, eax
je 0x102afec5
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
jmp 0x102afea2
mov eax, dword [ebp - 0x10]
mov dword [eax], esi
jmp 0x102afea2

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10013bf0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0xcc]
mov eax, dword [ecx + 0xd4]
push esi
push edi
lea esi, [ebp + 8]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10175088]
sub edi, 1
jne 0x10013c10
mov ecx, dword [0x102cee60]
not eax
pop edi
pop esi
cmp dword [ecx + 0x19ec], eax
jne 0x10013c42
mov dword [ecx + 0x19f0], eax
cmp dword [ecx + 0x1a20], eax
jne 0x10013c51
mov byte [ecx + 0x1a24], 1
pop ebp
ret 4

Function at 0x10013cc0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x102ce4c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
movss xmm0, dword [edx]
mov edi, 0x10
subss xmm0, dword [esi + 0xc]
mov ecx, dword [esi + 0xcc]
cvttss2si eax, xmm0
movss xmm0, dword [edx + 4]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0x14], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 8]
subss xmm0, dword [esi + 0xc]
mov dword [ebp - 0x10], eax
cvttss2si eax, xmm0
movss xmm0, dword [edx + 0xc]
subss xmm0, dword [esi + 0x10]
mov dword [ebp - 0xc], eax
cvttss2si eax, xmm0
mov dword [ebp - 8], eax
mov eax, dword [esi + 0xd4]
lea esi, [ebp - 0x14]
mov edx, dword [eax + ecx*4 - 4]
not edx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx ecx, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x10175088]
sub edi, 1
jne 0x10013d34
mov eax, dword [0x102cee60]
not edx
pop edi
pop esi
cmp dword [eax + 0x19ec], edx
jne 0x10013d65
mov dword [eax + 0x19f0], edx
cmp dword [eax + 0x1a20], edx
jne 0x10013d74
mov byte [eax + 0x1a24], 1
mov ecx, dword [ebp - 4]
mov eax, edx
xor ecx, ebp
call fcn.10110662
mov esp, ebp
pop ebp
ret 4

Function at 0x10014520
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
not ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
test edi, edi
je 0x10014583
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10014566
cmp edi, 2
jb 0x10014566
cmp byte [esi], cl
jne 0x10014566
cmp byte [esi + 1], cl
jne 0x10014566
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10175088]
jmp 0x10014537
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10175088]
test edi, edi
jne 0x10014537
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x100145b8
nop word [eax + eax]
cmp cl, 0x23
jne 0x1001459f
cmp byte [esi], cl
jne 0x1001459f
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10175088]
test cl, cl
jne 0x10014590
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x10015360
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
or eax, 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], str.Window
mov esi, 0x1017556d
mov cl, 0x57
or edi, 0xffffffff
cmp cl, 0x23
jne 0x10015392
cmp byte [esi], cl
jne 0x10015392
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10175088]
test cl, cl
jne 0x10015383
mov esi, dword [ebp + 8]
not eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x1001ee70
mov dword [ebp - 0xc], 0x1001edc0
mov edi, dword [esi + 0x2d48]
mov ecx, dword [esi + 0x2d4c]
mov dword [ebp - 8], 0x1001eea0
cmp edi, ecx
jne 0x10015479
inc edi
test ecx, ecx
je 0x100153ec
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x100153f1
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x10015479
mov eax, dword [0x102cee60]
test eax, eax
je 0x10015409
inc dword [eax + 0x374]
push ebx
push dword [0x102cee80]
lea eax, [edi + edi*2]
shl eax, 3
push eax
call dword [0x1019f200]
mov ebx, eax
add esp, 8
mov eax, dword [esi + 0x2d50]
test eax, eax
je 0x1001546c
mov ecx, dword [esi + 0x2d48]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push ebx
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [esi + 0x2d50]
add esp, 0xc
test ecx, ecx
je 0x1001545c
mov eax, dword [0x102cee60]
test eax, eax
je 0x1001545c
dec dword [eax + 0x374]
push dword [0x102cee80]
push ecx
call dword [0x1019f204]
add esp, 8
mov dword [esi + 0x2d50], ebx
mov dword [esi + 0x2d4c], edi
pop ebx
mov eax, dword [esi + 0x2d48]
movups xmm0, xmmword [ebp - 0x18]
pop edi
lea ecx, [eax + eax*2]
mov eax, dword [esi + 0x2d50]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 8]
movq qword [eax + ecx*8 + 0x10], xmm0
inc dword [esi + 0x2d48]
mov byte [esi], 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10016260
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x102cee60]
cmp byte [esi + 0x2d60], 0
je 0x100162fb
cmp dword [esi + 0x2d68], 0
push edi
lea edi, [esi + 0x2d6c]
je 0x100162ec
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x100162a6
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.1001f770
lea eax, [ebp + 0xc]
mov dword [edi], 0
push eax
push dword [ebp + 8]
mov ecx, edi
call fcn.1001f2d0
mov edx, dword [edi]
mov ecx, 0x102cee64
push dword [esi + 0x2d68]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [esi + 0x2d74]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebp
ret
lea eax, [ebp + 0xc]
mov ecx, edi
push eax
push dword [ebp + 8]
call fcn.1001f2d0
pop edi
pop esi
pop ebp
ret
Function at 0x1001a5c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x102cee60]
lea edx, [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax + 0x19b0]
mov esi, 4
mov eax, dword [ebp + 8]
add edi, 0xcc
mov dword [ebp + 8], eax
mov eax, dword [edi]
mov ebx, dword [edi + 8]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x10175088]
sub esi, 1
jne 0x1001a5f0
mov ecx, dword [edi + 4]
not ebx
mov esi, dword [edi]
cmp esi, ecx
jne 0x1001a637
inc esi
test ecx, ecx
je 0x1001a625
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1001a62a
mov eax, 8
cmp eax, esi
mov ecx, edi
cmovg esi, eax
push esi
call fcn.1001f870
mov ecx, dword [edi]
mov eax, dword [edi + 8]
mov dword [eax + ecx*4], ebx
inc dword [edi]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1001c8d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
mov eax, dword [0x102cee60]
mov dword [eax + 0x2d38], 0
je 0x1001c9c5
push esi
mov esi, dword [0x102cee60]
push edi
lea edi, [esi + 0x2d3c]
mov dword [esi + 0x2d38], 0
mov ecx, dword [edi + 4]
test ecx, ecx
jns 0x1001c924
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, edi
call fcn.1001f770
mov dword [edi], 0
cmp dword [edi + 4], 0
jne 0x1001c939
push 8
mov ecx, edi
call fcn.1001f770
mov eax, dword [edi]
mov ecx, dword [edi + 8]
push ebx
mov dword [ebp - 4], 0
mov byte [ecx + eax], 0
inc dword [edi]
cmp dword [esi + 0x2d48], 0
jle 0x1001c97c
xor ebx, ebx
mov eax, dword [esi + 0x2d50]
add eax, ebx
push edi
push eax
push esi
mov eax, dword [eax + 0x10]
call eax
mov eax, dword [ebp - 4]
add esp, 0xc
inc eax
add ebx, 0x18
mov dword [ebp - 4], eax
cmp eax, dword [esi + 0x2d48]
jl 0x1001c957
mov edi, dword [edi]
mov ebx, 0x102cee64
push 0x10175654
push dword [ebp + 8]
lea eax, [edi - 1]
neg edi
sbb edi, edi
and edi, eax
mov eax, dword [esi + 0x2d44]
test eax, eax
cmovne ebx, eax
call fcn.100143c0
mov esi, eax
add esp, 8
test esi, esi
je 0x1001c9c2
push esi
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100308f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x102ce4c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.10013dd0
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push dword [0x102cf418]
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x14]
movd xmm0, eax
lea eax, [ebp - 0x24]
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
push eax
cvtdq2ps xmm0, xmm0
movss dword [edi + 8], xmm1
movss dword [edi + 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [0x102cf420]
mov edx, dword [ebp - 0x20]
sbb edx, dword [0x102cf424]
call fcn.10110860
mov edx, dword [0x102cf42c]
mov ecx, dword [0x102cf428]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 0x18], xmm0
call fcn.10110860
movss xmm1, dword [ebp - 0x18]
cvtsd2ss xmm0, xmm0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
divss xmm1, xmm0
movss dword [edi + 0x10], xmm1
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov dword [0x102cf420], eax
mov dword [0x102cf424], ecx
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [edi + 0xf8], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [edi + 0xf9], al
call esi
shr eax, 0xf
and al, 1
mov byte [edi + 0xfb], 0
mov byte [edi + 0xfa], al
call fcn.10013dd0
cmp byte [eax + 0x353], 0
lea esi, [eax + 0xe0]
je 0x10030a17
cvttss2si eax, dword [eax + 0xe4]
cvttss2si ecx, dword [esi]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x102cf418]
mov dword [ebp - 0x1c], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi], 0xff7fffff
mov dword [esi + 4], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x10030a7f
mov ecx, dword [0x102cf418]
cmp eax, ecx
je 0x10030a44
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x10030a7f
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x10030a7f
lea eax, [ebp - 0x2c]
push eax
push dword [0x102cf418]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x10030a7f
movd xmm0, dword [ebp - 0x2c]
movd xmm1, dword [ebp - 0x28]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi], xmm0
movss dword [esi + 4], xmm1
cmp byte [edi + 0xa8], 0
pop edi
pop esi
je 0x10030a8f
or eax, 0xffffffff
jmp 0x10030a94
call fcn.10013de0
cmp dword [0x1019f350], eax
je 0x10030aa6
mov dword [0x1019f350], eax
call fcn.10030ac0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10110662
mov esp, ebp
pop ebp
ret
Function at 0x100502d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10050334
cmp byte [esi + 1], 0
jne 0x1005037f
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x10
jb 0x100502f6
jmp 0x1005037f
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x10
jb 0x10050340
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x11]
push eax
push edi
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100503a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10050404
cmp byte [esi + 1], 0
jne 0x1005044f
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x11
jb 0x100503c6
jmp 0x1005044f
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x11
jb 0x10050410
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x12]
push eax
push edi
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10050470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100504d4
cmp byte [esi + 1], 0
jne 0x1005051f
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x13
jb 0x10050496
jmp 0x1005051f
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x13
jb 0x100504e0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x14]
push eax
push edi
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10050540
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100505a4
cmp byte [esi + 1], 0
jne 0x100505ef
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x14
jb 0x10050566
jmp 0x100505ef
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x14
jb 0x100505b0
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x15]
push eax
push edi
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10050610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10050674
cmp byte [esi + 1], 0
jne 0x100506bf
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x15
jb 0x10050636
jmp 0x100506bf
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x15
jb 0x10050680
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x16]
push eax
push edi
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100506e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x10050744
cmp byte [esi + 1], 0
jne 0x1005078f
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [ebp - 8], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x16
jb 0x10050706
jmp 0x1005078f
xor ecx, ecx
mov dword [ebp - 8], ecx
nop dword [eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x1c]
xor ebx, dword [esi + 0x18]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [ebp - 8]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x16
jb 0x10050750
mov ecx, dword [ebp + 8]
lea eax, [ebp - 1]
push eax
lea eax, [esi + 0x17]
push eax
push edi
call fcn.1004f4a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4