joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10067aac
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x10067e9e
lea esp, [esp + 2]
lea esp, [esp + 4]
jne 0x100673bd
je 0x10067389
bswap edx
jmp 0x10067efd
mov edx, dword [ebp]
shl bl, 2
jb 0x10067f33
lea ebx, [edi + 0x4522]
bswap ebx
jmp 0x10067f3b
bswap ebx
setle bh
jmp 0x10068030
lea ebx, [edi + 0x4522]
jmp 0x10067f1d
setle bh
jmp 0x10068030
cmc
je 0x10067f9e
jne 0x10067f9e
jo 0x10067fe2
push 0xffffffffffffff85
test al, 0x16
idiv cl
cmp eax, 0x6c2b68ba
xor al, 0x27
dec esi
invalid
mov eax, dword [esp]
neg al
mov eax, dword [ebp + 4]
jmp 0x10067f68
lea edx, [esp + ecx]
mov dx, 0xbcb8
jmp 0x10067fa6
div dword [ebp + 8]
mov dword [ebp + 4], edx
jmp 0x10067f88
xchg ebx, eax
mov dx, di
mov dx, 0xf263
lea edx, [eax*4]
jmp 0x10068001
pop dword [ebp]
mov dl, byte [esp]
mov bx, word [esp]
bswap edx
jmp 0x1005326e
mov eax, 0x6ef6b738
jmp 0x10067f7e
xchg edx, ebx
mov dh, cl
clc
jbe 0x1006800c
bswap edx
clc
jmp 0x10068048
mov dword [ebp + 8], ebx
mov dh, byte [esp]
not dl
pushfd
jmp 0x10067fb7
jmp 0x10068045
sub esp, 0x16
jge 0x100680ec
add esp, 0x10
lea esp, [esp + 2]
jmp 0x10068089
xchg ebx, eax
bsf eax, ecx
ja 0x10067fd0
mov eax, 0x6ef6b738
mov eax, dword [esp]
neg al
jmp 0x10067f83
bswap edx
clc
rdtsc
jmp 0x1006800e
sub ebp, 8
call fcn.10068073
lea esp, [esp + 2]
xchg edx, ebx
mov dword [ebp], ebx
jmp 0x100680cc
btr bx, cx
mov dword [esp + 7], esp
jmp 0x100680b6
push ebx
lea esp, [esp + 2]
jmp 0x1006810f
sub esp, 0x16
jb 0x1006809c
btr bx, cx
mov dword [esp + 7], esp
push ebx
lea esp, [esp + 2]
jmp 0x1006810f
add esp, 0x10
lea esp, [esp + 2]
jmp 0x10068089
invalid
mov dword [ebp + 4], eax
call fcn.100680f5
mov bl, 0xaa
jo 0x10068149
xor cl, byte [esi + 0x491e9ce1]
push ds
dec esi
and eax, 0x4cb3ab8
xchg ebp, eax
loope 0x100680ff
pop edi
stosd dword es:[edi], eax
and edi, dword [edx - 0x2321657f]
mov al, 0xf5
call [esi]
push ds
scasd eax, dword es:[edi]
enter 0xffffffffffffec83, 6
jae 0x100683d1
lea esp, [esp + 2]
jmp 0x100683d5
add al, byte [eax]
add ch, al
je 0x100681b6
invalid
mov al, ah
pushal
rdtsc
call 0x10068177
xchg edx, ecx
push edi
push ecx
jmp 0x100681c8
rcr ch, cl
neg cx
jmp 0x100681e6
fldpi
sub eax, 0xca53d051
xor al, 0xe1
ljmp 0xb882
mov dword [esi], ecx
mov cx, 0x9811
cmc
jnp 0x100681b2
jp 0x100681db
adc al, 0x8b
sbb edi, dword [esi - 0x73]
xor eax, 0xddd2b9ae
rcr ch, cl
neg cx
jmp 0x100681e6
sti
ror byte [ebp - 0x6d], cl
xchg ebx, eax
lea ecx, [edx + 0x6d1cccd1]
stc
jge 0x10068254
jl 0x10068230
fsubr qword [edi]
and dword ss:[ecx + 0x3dfa0ed3], ebp
cdq
inc edi
int1
je 0x100681e3
jo 0x1006821a
loop 0x10068226
mov dword [0x1c8afb86], eax
and al, 0x8d
cdq
retf 0x968
xchg bl, bh
mov bl, byte [esp]
lea ebx, [ecx + 0x100968ca]
xchg ebx, eax
mov ax, cx
jmp 0x1006818d
mov cl, byte [esp]
xchg ch, bh
mov bh, 0xec
jmp 0x100576bd
iretd
bts cx, sp
bts ecx, edi
jmp 0x1006825b
ja 0x1006821a
mov cl, byte [esp]
xchg ch, bh
jmp 0x10068278
bts cx, sp
bts ecx, edi
mov dword [esi + 4], ebx
neg ecx
jmp 0x10068239
mov bh, 0xec
jmp 0x100576bd
lea esp, [esp + 2]
xchg edx, ecx
jmp 0x10068206

Function at 0x100680f5
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop bx
lea esp, [esp + 2]
jmp fcn.1004c988
Function at 0x10180179
Capabilities:
Parse pe header

Disassembly:
mov dword [esp], edx
mov dword [esp + 0x14], esi
jmp 0x10180163

Function at 0x101802ed
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
call fcn.1017b2b5
mov word [esp], di
pop word [esp]
mov dword [esp + 8], ebx
call fcn.10180120
pushal
mov dword [esp + 0x30], edi
lea esp, [esp + 0x30]
jmp 0x10180284
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x1017b2b0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x1018023d
pop word [esp + 3]
mov byte [esp + 1], cl
jmp 0x10180152
Function at 0x4035d4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x58d008], 0x8088405
inc edx
mov dword [ebx + 0x58d008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40a1b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x40a202
test eax, edx
je 0x40a205
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x40a1c5
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x40a1eb
add ecx, 4
js 0x40a1db
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x40a1e8
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x40a211
test edx, edx
jne 0x40a1b8
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x42c90c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42c912
ret
Function at 0x4e6478
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0x10325476
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
add eax, 0x18
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 0x40
call fcn.00403bfc
pop ecx
pop ecx
pop ebp
ret
Function at 0x4ee05c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405894
xor eax, eax
push ebp
push 0x4ee1d4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 0x628
call fcn.00403bfc
lea edx, [ebp - 0xc]
mov eax, dword [0x5a3b78]
call fcn.00477b14
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
mov ecx, 0x4ee1e0
call fcn.004072f8
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov ecx, 0x4ee1f0
call fcn.004072f8
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.00405da0
push 0
mov eax, dword [ebp - 0x18]
call fcn.00405db0
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
push 2
lea eax, [ebp - 0x158]
push eax
push 0x104
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
push 0x104
mov eax, dword [ebp - 8]
add eax, 0x105
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
mov eax, dword [ebp - 8]
add eax, 0x310
push eax
push 0x104
mov eax, dword [ebp - 8]
add eax, 0x20a
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x40]
push 0x104
mov eax, dword [ebp - 8]
add eax, 0x314
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
push 0x104
mov eax, dword [ebp - 8]
add eax, 0x314
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
mov eax, dword [ebp - 8]
add eax, 0x620
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x38]
mov eax, dword [ebp - 8]
add eax, 0x624
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
lea eax, [ebp - 0x14]
call fcn.004072b4
lea eax, [ebp - 0x10]
call fcn.004072b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ee1db
lea eax, [ebp - 0x18]
call fcn.00405c1c
lea eax, [ebp - 0x14]
call fcn.004072b4
lea eax, [ebp - 0x10]
call fcn.004072b4
lea eax, [ebp - 0xc]
call fcn.004072b4
lea eax, [ebp - 4]
call fcn.00405404
ret
Function at 0x5016d4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x170]
mov dl, byte [ebp - 5]
mov eax, dword [ebp - 4]
call fcn.005019b0
mov edx, dword [ebp - 4]
mov dword [edx + 0x170], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x170]
and eax, 0xff
mov edx, dword [ebp - 4]
add dword [edx + 0x174], eax
mov eax, dword [ebp - 4]
imul eax, dword [eax + 0x174], 0x8088405
inc eax
mov edx, dword [ebp - 4]
mov dword [edx + 0x174], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x174]
shr edx, 0x18
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x178]
mov eax, dword [ebp - 4]
call fcn.005019b0
mov edx, dword [ebp - 4]
mov dword [edx + 0x178], eax
pop ecx
pop ecx
pop ebp
ret

Function at 0x501790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x5017d7
inc eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
call fcn.00501758
mov edx, dword [ebp - 8]
xor byte [edx], al
mov eax, dword [ebp - 8]
mov dl, byte [eax]
mov eax, dword [ebp - 4]
call fcn.005016d4
inc dword [ebp - 8]
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x5017b2
mov esp, ebp
pop ebp
ret

Function at 0x501888
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x1d]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405894
xor eax, eax
push ebp
push 0x501910
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005017dc
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
call fcn.00501758
mov edx, dword [ebp - 0x10]
xor al, byte [ebp + edx - 0x1d]
mov byte [ebp - 0x11], al
mov dl, byte [ebp - 0x11]
mov eax, dword [ebp - 4]
call fcn.005016d4
mov eax, dword [ebp - 0x10]
mov dl, byte [ebp - 0x11]
mov byte [ebp + eax - 0x1d], dl
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xc
jne 0x5018c4
mov al, byte [ebp - 0x12]
mov byte [ebp - 9], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x501917
lea eax, [ebp - 8]
call fcn.00405404
ret
Function at 0x5155b4
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, 0x80
mov ecx, eax
xor byte [ecx], dl
inc ecx
dec esi
jne 0x5155bc
pop esi
ret

Function at 0x515f2c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], edx
xor ebp, ebp
mov esi, eax
mov ebx, dword [esp]
test ebx, ebx
jle 0x515f60
mov edi, 1
mov eax, edi
mov ecx, 7
cdq
idiv ecx
mov ecx, edx
add ecx, ecx
add ecx, ecx
movzx eax, byte [esi]
shl eax, cl
xor ebp, eax
inc esi
inc edi
dec ebx
jne 0x515f44
mov eax, ebp
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x516e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
xor eax, eax
push ebp
push 0x516f6e
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
mov eax, dword [ebp + 0xc]
call fcn.00516e28
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
mov ecx, edi
mov edx, esi
call fcn.0040572c
mov edx, dword [ebp - 0x14]
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.00516b40
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.0040549c
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
mov ecx, edi
mov edx, esi
call fcn.0040572c
mov edx, dword [ebp - 0x1c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call fcn.00516c38
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.0040549c
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00405b34
mov esi, ebx
test esi, esi
jle 0x516f48
mov ebx, 1
lea eax, [ebp - 0xc]
call fcn.00405904
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x516f29
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00405458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x516f75
lea eax, [ebp - 0x1c]
mov edx, 7
call fcn.00405428
ret
Function at 0x51858c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, edx
cmp ebx, 0x80
jle 0x5185ba
push 0x5186dc
mov ecx, 2
mov dl, 1
mov eax, dword [0x5184a0]
call fcn.005184f4
call fcn.00404d58
cmp ebx, 1
jge 0x5185da
push 0x518704
mov ecx, 2
mov dl, 1
mov eax, dword [0x5184a0]
call fcn.005184f4
call fcn.00404d58
cmp dword [ebp - 4], 0
jle 0x5185e9
cmp dword [ebp - 4], 0x400
jle 0x518604
push 0x518728
mov ecx, 3
mov dl, 1
mov eax, dword [0x5184a0]
call fcn.005184f4
call fcn.00404d58
mov edx, dword [ebp + 8]
mov ecx, ebx
call fcn.004032ec
mov edx, ebx
cmp edx, 0x7f
jg 0x518640
mov eax, dword [ebp + 8]
lea eax, [eax + edx - 1]
mov ecx, edx
sub ecx, ebx
mov esi, dword [ebp + 8]
movzx ecx, byte [esi + ecx]
add cl, byte [eax]
movzx ecx, cl
movzx ecx, byte [ecx + 0x59a1e0]
mov byte [eax + 1], cl
inc edx
inc eax
cmp edx, 0x80
jne 0x51861c
mov ebx, dword [ebp - 4]
add ebx, 7
test ebx, ebx
jns 0x51864d
add ebx, 7
sar ebx, 3
mov ecx, dword [ebp - 4]
add ecx, 8
movzx eax, bl
add eax, eax
add eax, eax
add eax, eax
sub ecx, eax
mov eax, 1
shl eax, cl
push eax
mov eax, 0xff
pop edx
mov ecx, edx
xor edx, edx
div ecx
mov eax, edx
movzx esi, bl
mov edx, 0x80
sub edx, esi
mov ecx, dword [ebp + 8]
and al, byte [ecx + edx]
movzx eax, al
mov ecx, dword [ebp + 8]
movzx eax, byte [eax + 0x59a1e0]
mov byte [ecx + edx], al
mov edx, 0x7f
sub edx, esi
cmp edx, 0
jl 0x5186cc
mov eax, dword [ebp + 8]
lea eax, [eax + edx + 1]
movzx ecx, bl
add ecx, edx
mov esi, dword [ebp + 8]
movzx ecx, byte [esi + ecx]
xor cl, byte [eax]
movzx ecx, cl
movzx ecx, byte [ecx + 0x59a1e0]
mov byte [eax - 1], cl
dec edx
dec eax
cmp edx, 0xffffffff
jne 0x5186aa
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x518eb0
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax + 4], edx
xor esi, esi
mov ebx, 0x59a2e0
movzx eax, byte [ebx]
dec eax
movzx edx, al
mov ecx, edx
and ecx, 0x1f
push ecx
mov ecx, 0x1f
pop edi
sub ecx, edi
mov edi, 1
shl edi, cl
shr edx, 5
mov eax, dword [esp]
and edi, dword [eax + edx*4]
je 0x518f2b
mov eax, esi
and eax, 0x8000001f
jns 0x518f0a
dec eax
or eax, 0xffffffe0
inc eax
mov ecx, 0x1f
sub ecx, eax
mov eax, 1
shl eax, cl
mov edx, esi
test edx, edx
jns 0x518f21
add edx, 0x1f
sar edx, 5
mov ecx, dword [esp + 4]
or dword [ecx + edx*4], eax
inc esi
inc ebx
cmp esi, 0x38
jne 0x518ed5
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x518f38
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [esp + 4]
xor edx, edx
mov dword [eax + 4], edx
xor esi, esi
mov ebx, 0x59a328
movzx eax, byte [ebx]
dec eax
movzx edx, al
mov ecx, edx
and ecx, 0x1f
push ecx
mov ecx, 0x1f
pop edi
sub ecx, edi
mov edi, 1
shl edi, cl
shr edx, 5
mov eax, dword [esp]
and edi, dword [eax + edx*4]
je 0x518fb3
mov eax, esi
and eax, 0x8000001f
jns 0x518f92
dec eax
or eax, 0xffffffe0
inc eax
mov ecx, 0x1f
sub ecx, eax
mov eax, 1
shl eax, cl
mov edx, esi
test edx, edx
jns 0x518fa9
add edx, 0x1f
sar edx, 5
mov ecx, dword [esp + 4]
or dword [ecx + edx*4], eax
inc esi
inc ebx
cmp esi, 0x30
jne 0x518f5d
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x5196ac
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp], eax
mov esi, 0x59a728
mov byte [esp + 4], 4
mov edi, dword [esp]
add edi, 2
mov al, 4
mov edx, edi
mov ecx, edx
movzx ebx, byte [ecx]
movzx ebx, byte [esi + ebx]
mov byte [ecx], bl
inc edx
dec al
jne 0x5196c9
add edi, 4
dec byte [esp + 4]
jne 0x5196c5
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x5196e8
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov dword [esp], eax
mov esi, 0x59a828
mov byte [esp + 4], 4
mov edi, dword [esp]
add edi, 2
mov al, 4
mov edx, edi
mov ecx, edx
movzx ebx, byte [ecx]
movzx ebx, byte [esi + ebx]
mov byte [ecx], bl
inc edx
dec al
jne 0x519705
add edi, 4
dec byte [esp + 4]
jne 0x519701
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x519828
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], eax
mov byte [esp + 8], 4
mov eax, dword [esp]
add eax, 2
mov dword [esp + 0xc], eax
mov bl, 4
mov eax, dword [esp + 0xc]
lea edx, [esp + 4]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
add eax, 4
dec bl
jne 0x51984b
xor ebx, ebx
lea esi, [esp + 4]
mov eax, dword [esp + 0xc]
mov edi, eax
movzx edx, byte [esi]
mov al, 2
call fcn.005197f0
push eax
movzx ebp, bl
mov eax, ebp
inc eax
and eax, 3
movzx edx, byte [esp + eax + 8]
mov al, 3
call fcn.005197f0
pop edx
xor dl, al
mov eax, ebp
add eax, 2
and eax, 3
xor dl, byte [esp + eax + 4]
add ebp, 3
and ebp, 3
xor dl, byte [esp + ebp + 4]
mov byte [edi], dl
inc ebx
add edi, 4
inc esi
cmp bl, 4
jne 0x519864
inc dword [esp + 0xc]
dec byte [esp + 8]
jne 0x519841
lea eax, [esp + 4]
mov edx, 4
call fcn.00518538
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x5198cc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], eax
mov byte [esp + 8], 4
mov eax, dword [esp]
add eax, 2
mov dword [esp + 0xc], eax
mov bl, 4
mov eax, dword [esp + 0xc]
lea edx, [esp + 4]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
add eax, 4
dec bl
jne 0x5198ef
xor ebx, ebx
lea esi, [esp + 4]
mov eax, dword [esp + 0xc]
mov edi, eax
movzx edx, byte [esi]
mov al, 0xe
call fcn.005197f0
push eax
movzx ebp, bl
mov eax, ebp
inc eax
and eax, 3
movzx edx, byte [esp + eax + 8]
mov al, 0xb
call fcn.005197f0
pop edx
xor dl, al
push edx
mov eax, ebp
add eax, 2
and eax, 3
movzx edx, byte [esp + eax + 8]
mov al, 0xd
call fcn.005197f0
pop edx
xor dl, al
push edx
add ebp, 3
and ebp, 3
movzx edx, byte [esp + ebp + 8]
mov al, 9
call fcn.005197f0
pop edx
xor dl, al
mov byte [edi], dl
inc ebx
add edi, 4
inc esi
cmp bl, 4
jne 0x519908
inc dword [esp + 0xc]
dec byte [esp + 8]
jne 0x5198e5
lea eax, [esp + 4]
mov edx, 4
call fcn.00518538
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5199a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov byte [esp + 0xc], 0
mov eax, dword [esp]
add eax, 2
mov dword [esp + 0x10], eax
movzx eax, byte [esp + 0xc]
add eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
xor ebx, ebx
mov eax, dword [esp + 0x10]
mov esi, eax
mov edi, esi
mov edx, ebp
mov eax, ebx
call fcn.0051998c
xor byte [edi], al
inc ebx
add esi, 4
cmp bl, 4
jne 0x5199d9
inc byte [esp + 0xc]
inc dword [esp + 0x10]
cmp byte [esp + 0xc], 4
jne 0x5199c1
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x51aa38
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, eax
mov eax, ecx
dec eax
test eax, eax
jl 0x51aa4d
inc eax
movzx ecx, byte [edx]
xor byte [esi], cl
inc esi
inc edx
dec eax
jne 0x51aa43
pop esi
ret

Function at 0x51ac68
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x51ac71
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.004032ec
cmp dword [ebp - 0xc], 0
jl 0x51acfc
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.004032ec
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
movzx eax, byte [ebp - 0x100c]
xor byte [esi], al
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.004032ec
movzx eax, byte [esi]
mov byte [ebp + ebx - 0x200d], al
dec dword [ebp - 0xc]
inc esi
cmp dword [ebp - 0xc], 0
jge 0x51acaa
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00518538
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x51ad14
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x51ad1d
mov eax, dword [ebp - 4]
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x2010]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.004032ec
cmp dword [ebp - 0x10], 0
jl 0x51adb2
lea edx, [ebp - 0x1010]
lea eax, [ebp - 0x2010]
mov ecx, ebx
call fcn.004032ec
lea edx, [ebp - 0x1010]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x2010]
lea eax, [ebp - 0x200f]
call fcn.004032ec
movzx eax, byte [esi]
mov byte [ebp - 9], al
movzx eax, byte [ebp - 9]
mov byte [ebp + ebx - 0x2011], al
movzx eax, byte [ebp - 9]
xor al, byte [ebp - 0x1010]
mov byte [esi], al
dec dword [ebp - 0x10]
inc esi
cmp dword [ebp - 0x10], 0
jge 0x51ad56
lea eax, [ebp - 0x1010]
mov edx, ebx
call fcn.00518538
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x51adc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x51add1
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.004032ec
cmp dword [ebp - 0xc], 0
jl 0x51ae60
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.004032ec
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
movzx eax, byte [ebp - 0x100c]
xor byte [esi], al
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.004032ec
movzx eax, byte [ebp - 0x100c]
mov byte [ebp + ebx - 0x200d], al
dec dword [ebp - 0xc]
inc esi
cmp dword [ebp - 0xc], 0
jge 0x51ae0a
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00518538
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x51ae78
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x51ae81
mov eax, dword [ebp - 4]
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0x10]
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x200c]
mov eax, dword [ebp + 0xc]
mov ecx, ebx
call fcn.004032ec
cmp dword [ebp - 0xc], 0
jl 0x51af10
lea edx, [ebp - 0x100c]
lea eax, [ebp - 0x200c]
mov ecx, ebx
call fcn.004032ec
lea edx, [ebp - 0x100c]
mov ecx, ebx
mov eax, dword [ebp - 8]
call dword [ebp + 0x14]
mov ecx, ebx
dec ecx
lea edx, [ebp - 0x200c]
lea eax, [ebp - 0x200b]
call fcn.004032ec
movzx eax, byte [ebp - 0x100c]
mov byte [ebp + ebx - 0x200d], al
movzx eax, byte [ebp - 0x100c]
xor byte [esi], al
dec dword [ebp - 0xc]
inc esi
cmp dword [ebp - 0xc], 0
jge 0x51aeba
lea eax, [ebp - 0x100c]
mov edx, ebx
call fcn.00518538
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10