joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100362c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], edx
mov ebx, ecx
call fcn.100367c0
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 4]
test esi, esi
je 0x100362fe
lea ebx, [ebx]
test dl, 7
je 0x100362fb
movzx ecx, byte [edx]
inc edx
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x101ee690]
dec esi
jne 0x100362e0
mov dword [ebp - 4], edx
cmp esi, 8
jb 0x1003638f
push edi
mov edi, esi
shr edi, 3
lea ecx, [ecx]
xor ebx, dword [edx]
sub esi, 8
mov edx, dword [edx + 4]
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
movzx eax, al
mov ecx, dword [ecx*4 + 0x101ee690]
xor ecx, dword [eax*4 + 0x101eea90]
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x101eee90]
mov eax, ebx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x101ef690]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor ecx, dword [eax*4 + 0x101efa90]
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x101efe90]
movzx eax, dl
mov edx, dword [ebp - 4]
add edx, 8
mov dword [ebp - 4], edx
xor ecx, dword [eax*4 + 0x101ef290]
movzx eax, bl
xor ecx, dword [eax*4 + 0x101f0290]
mov ebx, ecx
dec edi
jne 0x10036310
pop edi
test esi, esi
je 0x100363ab
movzx ecx, byte [edx]
lea edx, [edx + 1]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x101ee690]
dec esi
jne 0x10036393
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x100367c0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x101ee690
call fcn.10036720
mov eax, 0x800
nop
mov edx, dword [eax + 0x101ede90]
movzx ecx, dl
shr edx, 8
xor edx, dword [ecx*4 + 0x101ee690]
movzx ecx, dl
mov dword [eax + 0x101ee290], edx
shr edx, 8
xor edx, dword [ecx*4 + 0x101ee690]
movzx ecx, dl
mov dword [eax + 0x101ee690], edx
shr edx, 8
xor edx, dword [ecx*4 + 0x101ee690]
movzx ecx, dl
mov dword [eax + 0x101eea90], edx
shr edx, 8
xor edx, dword [ecx*4 + 0x101ee690]
movzx ecx, dl
mov dword [eax + 0x101eee90], edx
shr edx, 8
xor edx, dword [ecx*4 + 0x101ee690]
movzx ecx, dl
mov dword [eax + 0x101ef290], edx
shr edx, 8
xor edx, dword [ecx*4 + 0x101ee690]
movzx ecx, dl
mov dword [eax + 0x101ef690], edx
shr edx, 8
xor edx, dword [ecx*4 + 0x101ee690]
mov dword [eax + 0x101efa90], edx
add eax, 4
cmp eax, 0xc00
jb 0x100367d0
ret
Function at 0x1003b4f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ac91e
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100df0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [esi + 0xf0]
mov dword [ebp - 4], 2
call fcn.1009cfdf
push dword [esi + 0xe4]
call fcn.1009cfdf
push dword [esi + 0xd8]
call fcn.1009cfdf
push dword [esi + 0xcc]
call fcn.1009cfdf
push dword [esi + 0xc0]
call fcn.1009cfdf
push dword [esi + 0xb4]
call fcn.1009cfdf
push dword [esi + 0xa8]
call fcn.1009cfdf
push dword [esi + 0x9c]
call fcn.1009cfdf
push dword [esi + 0x90]
call fcn.1009cfdf
push dword [esi + 0x84]
call fcn.1009cfdf
push dword [esi + 0x78]
call fcn.1009cfdf
add esp, 0x2c
lea ecx, [esi + 0x6c]
call fcn.100188e0
push dword [esi + 0x60]
call fcn.1009cfdf
add esp, 4
lea ecx, [esi + 0x54]
call fcn.10036050
push dword [esi + 0x48]
call fcn.1009cfdf
push dword [esi + 0x3c]
call fcn.1009cfdf
push dword [esi + 0x30]
call fcn.1009cfdf
push dword [esi + 0x24]
call fcn.1009cfdf
push dword [esi + 0x18]
call fcn.1009cfdf
push dword [esi + 0xc]
call fcn.1009cfdf
push dword [esi]
call fcn.1009cfdf
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003d230
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, edx
push edi
mov edi, ecx
cmp ebx, 0x200
jb 0x1003d3b3
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x1003d3b3
mov edx, dword [edi + 0x3c]
cmp edx, 0x1000
jae 0x1003d3b3
lea eax, [edx + 0x200]
cmp eax, ebx
ja 0x1003d3b3
test dl, 7
jne 0x1003d3b3
cmp dword [edx + edi], 0x4550
lea ecx, [edx + edi]
jne 0x1003d3b3
movzx edx, word [ecx + 4]
push esi
cmp edx, 0x200
ja 0x1003d2cd
je 0x1003d2c6
lea eax, [edx - 0x14c]
cmp eax, 0x78
ja case.0x1003d2b1.333
movzx eax, byte [eax + 0x1003d3d0]
jmp dword [eax*4 + 0x1003d3c0]
mov esi, 0x3030501
jmp 0x1003d300
mov esi, 0x3030701
jmp 0x1003d300
mov esi, 0x3030401
jmp 0x1003d300
cmp edx, 0x8664
ja 0x1003d2f3
je case.0x1003d2b1.332
mov eax, edx
sub eax, 0x5032
je 0x1003d2e5
sub eax, 0x32
jne case.0x1003d2b1.333
mov esi, 0xb
jmp 0x1003d300
mov esi, 0x3030103
jmp 0x1003d300
cmp edx, 0xaa64
jne case.0x1003d2b1.333
mov esi, 0xa
movzx eax, word [ecx + 6]
mov dword [ebp - 8], eax
movzx eax, word [ecx + 0x14]
mov dword [ebp - 4], eax
cmp eax, 0x400
ja case.0x1003d2b1.333
movzx eax, word [ecx + 0x18]
add ecx, 0x18
mov dword [ebp - 0xc], eax
cmp eax, 0x10b
mov eax, dword [ebp - 4]
je 0x1003d33d
cmp dword [ebp - 0xc], 0x20b
je 0x1003d33d
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
sub eax, edi
add eax, ecx
cmp eax, ebx
ja 0x1003d3a0
add ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
cmp eax, 0x40
ja 0x1003d3a0
cmp edx, 0x8664
jne 0x1003d3a0
xor edx, edx
test eax, eax
je 0x1003d3a0
mov eax, ecx
sub eax, edi
mov edi, dword [ebp - 8]
add eax, 0x28
cmp eax, ebx
ja 0x1003d3a0
cmp dword [ecx], 0x3436612e
jne 0x1003d37d
cmp dword [ecx + 4], 0x6d7278
je 0x1003d39b
inc edx
add ecx, 0x28
add eax, 0x28
cmp edx, edi
jb 0x1003d368
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, 1
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov esi, 0xa
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov eax, 1
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10049c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea eax, [ecx + 8]
add edx, 2
mov ecx, dword [ebp + 8]
movzx ecx, cl
shl ecx, 4
push esi
add edx, ecx
mov esi, 4
lea ebx, [ebx]
movzx ecx, byte [edx - 2]
lea edx, [edx + 4]
xor byte [eax - 8], cl
lea eax, [eax + 1]
movzx ecx, byte [edx - 5]
xor byte [eax - 5], cl
movzx ecx, byte [edx - 4]
xor byte [eax - 1], cl
movzx ecx, byte [edx - 3]
xor byte [eax + 3], cl
dec esi
jne 0x10049c60
pop esi
pop ebp
ret 4

Function at 0x1004a7d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x100df0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x10c], edx
push 0x100
mov dword [ebp - 0x110], esi
movzx eax, byte [esi + 0x62d]
movzx ebx, byte [esi + 0x62c]
mov dword [ebp - 0x108], eax
lea eax, [esi + 0x52c]
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.1009b860
add esp, 0xc
cmp dword [ebp + 0xc], 0
je 0x1004a8a0
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
sub dword [ebp - 0x10c], edi
mov ecx, dword [ebp - 0x108]
lea edi, [edi + 1]
inc ebx
and ebx, 0xff
movzx edx, byte [ebp + ebx - 0x104]
add ecx, edx
and ecx, 0xff
mov dword [ebp - 0x108], ecx
movzx eax, byte [ebp + ecx - 0x104]
mov byte [ebp + ebx - 0x104], al
mov byte [ebp + ecx - 0x104], dl
movzx ecx, byte [ebp + ebx - 0x104]
add ecx, edx
and ecx, 0xff
movzx eax, byte [ebp + ecx - 0x104]
mov ecx, dword [ebp - 0x10c]
xor al, byte [edi - 1]
mov byte [ecx + edi - 1], al
dec esi
jne 0x1004a835
mov esi, dword [ebp - 0x110]
pop edi
mov eax, dword [ebp - 0x108]
mov ecx, dword [ebp - 4]
mov byte [esi + 0x62c], bl
xor ecx, ebp
mov byte [esi + 0x62d], al
pop esi
pop ebx
call fcn.1009bea4
mov esp, ebp
pop ebp
ret 8
Function at 0x1004d430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
lea ecx, [ecx]
push 0x2000
mov eax, esi
mov ecx, edi
push 0x2911
xor eax, 0x1fff
push eax
call fcn.1004def0
mov byte [esi + 0x101f0698], al
inc esi
cmp esi, 0x2000
jl 0x1004d440
xor esi, esi
lea ebx, [ebx]
push 0x800
mov eax, esi
mov ecx, edi
push 0xaa7
xor eax, 0x7ff
push eax
call fcn.1004def0
mov byte [esi + 0x101f2698], al
inc esi
cmp esi, 0x800
jl 0x1004d470
xor eax, eax
lea ebx, [ebx]
mov edx, eax
mov ecx, eax
and edx, 0xfffffff8
and ecx, 4
shl edx, 7
or edx, ecx
mov ecx, eax
shl edx, 7
and ecx, 2
or edx, ecx
mov ecx, eax
shl edx, 7
and ecx, 1
or edx, ecx
mov ecx, eax
shl edx, 7
and ecx, 0x40
mov dword [eax*8 + 0x101f2e9c], edx
mov edx, eax
and edx, 0xffffff80
shl edx, 7
or edx, ecx
mov ecx, eax
shl edx, 7
and ecx, 0x20
or edx, ecx
mov ecx, eax
shl edx, 7
and ecx, 0x10
or edx, ecx
shl edx, 3
mov dword [eax*8 + 0x101f2e98], edx
inc eax
cmp eax, 0x100
jl 0x1004d4a0
mov ebx, dword [ebp + 8]
mov al, byte [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov byte [ebx], al
test ecx, ecx
je 0x1004d552
movdqu xmm0, xmmword [ecx]
lea esi, [ebx + 1]
mov ecx, edi
push esi
lea eax, [ebp - 8]
push eax
movdqu xmmword [esi], xmm0
call fcn.1004d3d0
mov ecx, dword [eax]
mov dword [ebx + 0x11], ecx
mov ecx, edi
mov eax, dword [eax + 4]
mov dword [ebx + 0x15], eax
lea eax, [esi + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.1004d3d0
mov ecx, dword [eax]
mov dword [ebx + 0x19], ecx
mov eax, dword [eax + 4]
mov dword [ebx + 0x1d], eax
mov al, byte [ebp + 0xc]
jmp 0x1004d576
xorps xmm0, xmm0
movdqu xmmword [ebx + 1], xmm0
mov dword [ebx + 0x1d], 0
mov dword [ebx + 0x19], 0
mov dword [ebx + 0x15], 0
mov dword [ebx + 0x11], 0
mov dword [ebx + 0x21], 0x80
pop edi
pop esi
pop ebx
cmp al, 1
je 0x1004d591
cmp al, 2
je 0x1004d591
cmp al, 3
mov eax, 0xfffffffc
jne 0x1004d596
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1004d5a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [ebp + 0x14]
cdq
and edx, 0xf
add eax, edx
push ebx
sar eax, 4
mov ebx, ecx
cmp dword [ebp + 0x14], 0x10
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], eax
je 0x1004d5cf
pop esi
mov eax, 0xfffffffa
pop ebx
mov esp, ebp
pop ebp
ret 0x14
test eax, eax
jle 0x1004d73a
mov eax, dword [ebp + 0xc]
add eax, 0x179
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
push edi
lea ecx, [eax + 8]
mov dword [ebp + 0x18], ecx
mov ecx, dword [ebp + 0x10]
mov edx, ecx
sub edx, eax
mov dword [ebp - 0x14], edx
push ecx
lea eax, [ebp - 0x40]
mov ecx, ebx
push eax
call fcn.1004d3d0
mov ecx, dword [ebp - 0x14]
mov edi, eax
add ecx, dword [ebp + 0x18]
push ecx
mov ecx, ebx
mov eax, dword [edi]
mov dword [ebp + 0xc], eax
mov eax, dword [edi + 4]
mov dword [ebp + 0x14], eax
lea eax, [ebp - 0x48]
push eax
call fcn.1004d3d0
mov esi, dword [edi]
mov dword [ebp - 0x2c], esi
mov esi, dword [edi + 4]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, edx
mov dword [ebp - 0x30], esi
mov esi, ecx
mov dword [ebp - 0x34], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov dword [ebp - 8], 0x10
mov eax, dword [esi + 0x19]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x1d]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x11]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x15]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
push dword [esi + 4]
lea eax, [ebp - 0x50]
push dword [esi]
push edx
push ecx
push eax
mov ecx, ebx
call fcn.1004e650
push dword [esi - 4]
mov dword [ebp - 0x1c], eax
mov ecx, ebx
push dword [esi - 8]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x58]
push eax
call fcn.1004df30
push dword [esi - 0xc]
mov ecx, dword [ebp - 4]
push dword [esi - 0x10]
mov edi, dword [eax]
mov ebx, dword [eax + 4]
mov eax, dword [ebp - 0x1c]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x60]
push eax
call fcn.1004e650
xor edi, dword [ebp - 0x20]
lea esi, [esi - 0x18]
add ebx, dword [ebp - 0x24]
xor edi, dword [ebp - 0xc]
sub ebx, dword [ebp - 0x28]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
xor ecx, edi
mov edi, dword [eax]
xor edx, ebx
dec dword [ebp - 8]
mov eax, dword [eax + 4]
mov ebx, dword [ebp - 4]
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x14], eax
jne 0x1004d660
mov esi, dword [ebp + 8]
xor ecx, dword [ebp - 0xc]
xor eax, dword [esi + 0x1d]
xor edi, dword [esi + 0x19]
xor edx, dword [esi + 0x15]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esi + 0x11], eax
mov eax, dword [ebp - 0x30]
mov dword [esi + 0x15], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp + 0xc], edi
mov edi, dword [ebp + 0x18]
mov dword [esi + 0x19], eax
mov eax, dword [ebp - 0x38]
push edx
mov dword [esi + 0x1d], eax
lea eax, [edi - 8]
push ecx
push eax
mov ecx, ebx
call fcn.1004d210
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0xc]
push edi
call fcn.1004d210
mov ecx, dword [ebp + 0x10]
add edi, 0x10
add ecx, 0x10
mov dword [ebp + 0x18], edi
dec dword [ebp - 0x10]
mov dword [ebp + 0x10], ecx
jne 0x1004d5f6
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1004d750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
lea ebx, [eax*8]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], ebx
mov ecx, 7
mov dword [ebp - 8], ecx
mov eax, dword [esi + 0x11]
mov edx, dword [esi + 0x1d]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x15]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], 0
push edi
mov edi, dword [esi + 0x19]
mov al, byte [eax]
mov byte [ebp + 0x17], al
mov eax, dword [ebp + 0x18]
mov byte [eax], 0
test ebx, ebx
jle 0x1004d8bf
mov eax, dword [ebp + 0xc]
mov bh, byte [ebp + 0x17]
inc eax
mov dword [ebp - 0x24], eax
lea ecx, [ecx]
mov bl, bh
mov dword [ebp + 0xc], 0x10
shr bl, cl
mov esi, eax
and bl, 1
push dword [esi + 4]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push dword [esi]
push edx
push edi
push eax
call fcn.1004d260
push dword [esi + 0xc]
mov ecx, dword [ebp - 0x10]
mov edi, eax
push dword [esi + 8]
lea eax, [ebp - 0x34]
push dword [edi + 4]
push dword [edi]
push eax
call fcn.1004df30
push dword [esi + 0x14]
push dword [esi + 0x10]
mov ecx, dword [eax]
push dword [edi + 4]
mov eax, dword [eax + 4]
push dword [edi]
mov dword [ebp + 0x14], eax
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x10]
push eax
call fcn.1004d260
mov edi, dword [ebp - 0x1c]
lea esi, [esi + 0x18]
xor edi, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
xor edx, dword [ebp - 0xc]
dec dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp + 0x14], edx
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
jne 0x1004d7c0
mov edx, dword [eax]
mov esi, ecx
mov ecx, dword [ebp - 8]
mov eax, edi
shr eax, 0x1f
xor al, bl
shl al, cl
mov ecx, dword [ebp + 0x18]
or byte [ecx], al
mov eax, dword [ebp + 0x14]
shr eax, 0x1f
mov dword [ebp - 4], eax
lea eax, [edi + edi]
or dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
lea edi, [eax + eax]
mov eax, edx
shr eax, 0x1f
or edi, eax
lea eax, [edx + edx]
mov dword [ebp - 0xc], edi
lea edx, [esi + esi]
mov edi, esi
shr edi, 0x1f
or edi, eax
movzx eax, bl
or edx, eax
dec dword [ebp - 8]
jns 0x1004d8a6
mov eax, dword [ebp - 0x18]
dec eax
cmp dword [ebp - 0x14], eax
je 0x1004d8a6
mov eax, dword [ebp + 0x10]
inc eax
mov dword [ebp - 8], 7
inc ecx
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x18], ecx
mov al, byte [eax]
mov byte [ebp + 0x17], al
mov bh, al
mov byte [ecx], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
inc eax
cmp eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
jl 0x1004d7b0
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov eax, 1
mov dword [esi + 0x11], ecx
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x19], edi
pop edi
mov dword [esi + 0x15], ecx
mov dword [esi + 0x1d], edx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1004d8e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [ebp + 0x14]
cdq
and edx, 0xf
add eax, edx
push ebx
sar eax, 4
mov ebx, ecx
cmp dword [ebp + 0x14], 0x10
push esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], eax
je 0x1004d90f
pop esi
mov eax, 0xfffffffa
pop ebx
mov esp, ebp
pop ebp
ret 0x14
test eax, eax
jle 0x1004da52
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
add eax, 0x179
mov esi, dword [ebp + 8]
mov edx, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
sub edx, eax
push edi
mov dword [ebp - 0x14], edx
lea edi, [eax + 8]
mov dword [ebp - 0xc], edi
lea esp, [esp]
push ecx
lea eax, [ebp - 0x30]
mov ecx, ebx
push eax
call fcn.1004d3d0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, edi
mov dword [ebp + 0xc], ecx
push eax
lea eax, [ebp - 0x38]
mov ecx, ebx
push eax
call fcn.1004d3d0
mov dword [ebp + 0x18], 0x10
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [esi + 0x19]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x1d]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x11]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 0x15]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
nop
push dword [esi + 4]
lea eax, [ebp - 0x40]
push dword [esi]
push edx
push ecx
push eax
mov ecx, ebx
call fcn.1004e650
push dword [esi - 4]
mov dword [ebp - 0x1c], eax
mov ecx, ebx
push dword [esi - 8]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x48]
push eax
call fcn.1004df30
push dword [esi - 0xc]
mov ecx, dword [ebp - 4]
push dword [esi - 0x10]
mov edi, dword [eax]
mov ebx, dword [eax + 4]
mov eax, dword [ebp - 0x1c]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x50]
push eax
call fcn.1004e650
xor edi, dword [ebp - 8]
lea esi, [esi - 0x18]
add ebx, dword [ebp - 0x20]
xor edi, dword [ebp - 0x24]
sub ebx, dword [ebp - 0x28]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
xor ecx, edi
mov edi, dword [eax]
xor edx, ebx
dec dword [ebp + 0x18]
mov eax, dword [eax + 4]
mov ebx, dword [ebp - 4]
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x14], eax
jne 0x1004d990
mov esi, dword [ebp + 8]
xor ecx, dword [ebp - 8]
add edi, dword [esi + 0x11]
xor edx, dword [esi + 0x1d]
add eax, dword [esi + 0x15]
mov dword [ebp + 0xc], edi
mov edi, dword [ebp - 0xc]
push edx
mov dword [ebp + 0x14], eax
push ecx
lea eax, [edi - 8]
mov ecx, ebx
push eax
call fcn.1004d210
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0xc]
push edi
call fcn.1004d210
mov ecx, dword [ebp + 0x10]
add edi, 0x10
add ecx, 0x10
mov dword [ebp - 0xc], edi
dec dword [ebp - 0x10]
mov dword [ebp + 0x10], ecx
jne 0x1004d940
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1004da60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [ebp + 0x14]
cdq
and edx, 0xf
push esi
add eax, edx
push edi
sar eax, 4
mov edi, ecx
cmp dword [ebp + 0x14], 0x10
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], eax
je 0x1004da8f
pop edi
mov eax, 0xfffffffa
pop esi
mov esp, ebp
pop ebp
ret 0x14
test eax, eax
jle 0x1004dbd1
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
inc eax
mov esi, dword [ebp + 8]
mov edx, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
sub edx, eax
push ebx
mov dword [ebp - 0x10], edx
lea ebx, [eax + 8]
mov dword [ebp - 8], ebx
push ecx
lea eax, [ebp - 0x30]
mov ecx, edi
push eax
call fcn.1004d3d0
mov ecx, edi
mov edx, dword [eax]
mov dword [ebp + 0xc], edx
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x10]
add eax, ebx
mov dword [ebp + 0x14], edx
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.1004d3d0
mov dword [ebp + 0x18], 0x10
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esi + 0x11]
xor dword [ebp + 0xc], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
xor eax, dword [esi + 0x15]
mov dword [ebp + 0x14], eax
mov eax, dword [esi + 0x19]
xor ebx, eax
xor ecx, dword [esi + 0x1d]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x1d]
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x15]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
push dword [esi + 4]
lea eax, [ebp - 0x40]
push dword [esi]
push ecx
push ebx
push eax
mov ecx, edi
call fcn.1004d260
push dword [esi + 0xc]
mov ecx, dword [ebp - 4]
mov edi, eax
push dword [esi + 8]
lea eax, [ebp - 0x48]
push dword [edi + 4]
push dword [edi]
push eax
call fcn.1004df30
push dword [esi + 0x14]
push dword [esi + 0x10]
mov ebx, dword [eax]
push dword [edi + 4]
mov eax, dword [eax + 4]
push dword [edi]
mov edi, dword [ebp - 4]
mov ecx, edi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x50]
push eax
call fcn.1004d260
xor ebx, dword [ebp - 0x18]
lea esi, [esi + 0x18]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x20]
xor ebx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x28]
xor ebx, dword [ebp + 0xc]
xor ecx, dword [ebp + 0x14]
dec dword [ebp + 0x18]
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x14], eax
jne 0x1004db15
mov esi, dword [ebp + 8]
push ecx
push ebx
mov dword [esi + 0x11], ebx
mov ebx, dword [ebp - 8]
mov dword [esi + 0x1d], eax
mov dword [esi + 0x15], ecx
mov ecx, edi
mov dword [esi + 0x19], edx
lea eax, [ebx - 8]
push eax
call fcn.1004d210
mov edx, dword [ebp + 0x14]
mov ecx, edi
push edx
mov edx, dword [ebp + 0xc]
push edx
push ebx
call fcn.1004d210
mov ecx, dword [ebp + 0x10]
add ebx, 0x10
add ecx, 0x10
mov dword [ebp - 8], ebx
dec dword [ebp - 0xc]
mov dword [ebp + 0x10], ecx
jne 0x1004dab5
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x1004dbe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ebx, [eax*8]
mov dword [ebp - 0x10], ecx
mov ecx, 7
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov eax, dword [edi + 0x11]
mov edx, dword [edi + 0x19]
mov esi, dword [edi + 0x1d]
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x15]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], 0
mov al, byte [eax]
mov byte [ebp + 0x17], al
mov eax, dword [ebp + 0x18]
mov byte [eax], 0
test ebx, ebx
jle 0x1004dd5b
mov eax, dword [ebp + 0xc]
mov bh, byte [ebp + 0x17]
inc eax
mov dword [ebp - 0x24], eax
lea ecx, [ecx]
mov bl, bh
mov dword [ebp - 0x18], 0x10
shr bl, cl
mov edi, eax
and bl, 1
push dword [edi + 4]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push dword [edi]
push esi
push edx
push eax
call fcn.1004d260
push dword [edi + 0xc]
mov ecx, dword [ebp - 0x10]
mov esi, eax
push dword [edi + 8]
lea eax, [ebp - 0x34]
push dword [esi + 4]
push dword [esi]
push eax
call fcn.1004df30
push dword [edi + 0x14]
push dword [edi + 0x10]
mov ecx, dword [eax]
push dword [esi + 4]
mov eax, dword [eax + 4]
push dword [esi]
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x3c]
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp - 0x10]
push eax
call fcn.1004d260
mov edx, dword [ebp + 0x14]
lea edi, [edi + 0x18]
xor edx, dword [ebp - 4]
mov esi, dword [ebp + 0xc]
xor esi, dword [ebp - 0xc]
dec dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp + 0x14], edx
mov dword [ebp + 0xc], esi
mov ecx, dword [eax + 4]
mov dword [ebp - 0xc], ecx
jne 0x1004dc50
mov edx, dword [eax]
mov esi, ecx
mov edi, dword [ebp + 0x14]
mov eax, edi
mov ecx, dword [ebp - 8]
shr eax, 0x1f
xor bl, al
mov al, bl
shl al, cl
mov ecx, dword [ebp + 0x18]
or byte [ecx], al
mov eax, dword [ebp + 0xc]
shr eax, 0x1f
mov dword [ebp - 4], eax
lea eax, [edi + edi]
or dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
lea edi, [eax + eax]
mov eax, edx
shr eax, 0x1f
or edi, eax
lea eax, [edx + edx]
mov dword [ebp - 0xc], edi
mov edi, esi
shr edi, 0x1f
add esi, esi
mov edx, edi
mov dword [ebp + 0x14], edi
or edx, eax
movzx eax, bl
or esi, eax
dec dword [ebp - 8]
jns 0x1004dd42
mov eax, dword [ebp - 0x1c]
dec eax
cmp dword [ebp - 0x14], eax
je 0x1004dd42
mov eax, dword [ebp + 0x10]
inc eax
mov dword [ebp - 8], 7
inc ecx
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x18], ecx
mov al, byte [eax]
mov byte [ebp + 0x17], al
mov bh, al
mov byte [ecx], 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
inc eax
cmp eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
jl 0x1004dc40
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov eax, 1
mov dword [edi + 0x11], ecx
mov ecx, dword [ebp - 0xc]
mov dword [edi + 0x1d], esi
mov dword [edi + 0x15], ecx
mov dword [edi + 0x19], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14