joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1db650
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
lea eax, [esp + 0x1c]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x4c]
call fcn.001e5330
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x1ef13c]
Function at 0x1de8e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov dword [esp + 4], 0x292a2bd4
mov word [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 5
ja 0x1de949
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0x4bcaea47
and eax, 0xcbcaea47
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x9d
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 6
jb 0x1de910
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
push ecx
push 0
push dword [eax + 0x18]
call dword [0x1f9bbc]
add esp, 0x10
ret
Function at 0x1decf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x30
mov edx, dword [ecx + 8]
test edx, edx
je 0x1dee00
xor eax, eax
cmp dword [ecx], 0
jne 0x1dee64
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 4], edx
mov eax, dword [ecx + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0x80878685
mov word [esp + 0x10], 0
mov byte [esp + 0x12], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x1dedd1
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 0xc]
mov esi, eax
xor esi, 0xfa434561
mov edi, eax
xor edi, 0x5bcba9e
or eax, 0x7a434561
and eax, edi
lea eax, [esi + eax*2]
lea esi, [eax + edx]
and eax, edx
mov edx, esi
not edx
and edx, eax
add edx, eax
not eax
and eax, esi
sub eax, edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov edx, eax
xor edx, 0xe5
and eax, 0x1a
add eax, eax
sub eax, edx
mov edx, dword [esp]
mov byte [esp + edx + 0xc], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x1ded70
mov eax, dword [esp + 0xc]
mov esi, dword [0x1f1ba0]
test esi, esi
je 0x1dee64
mov edx, dword [esp + 0x40]
xor edi, edi
mov ebx, dword [0x1f1ba4]
nop
cmp dword [ebx + edi*8], 0xeeeb5415
je 0x1dee6d
inc edi
cmp esi, edi
jne 0x1dedf0
jmp 0x1dee64
mov dword [esp + 0x14], 0x79babbbc
mov byte [esp + 0x18], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x1dee60
nop
nop
mov eax, dword [esp + 4]
mov ecx, dword [esp + 4]
movzx ecx, byte [esp + ecx + 0x14]
lea edx, [eax + ecx]
add edx, 0xd1cb6c9f
add eax, 0xd1cb6c9f
and eax, ecx
add eax, eax
sub edx, eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
add al, 0xe5
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x14], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x1dee20
mov eax, dword [esp + 0x14]
add esp, 0x30
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x1dee64
lea eax, [esp + 4]
lea edi, [esp + 0x14]
push eax
push edi
push edx
push ecx
push 4
push dword [0x1f1ba8]
push esi
call fcn.001e1c60
add esp, 0x1c
jmp 0x1dee64
Function at 0x1deeb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x1defaa
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp + 4], 0x80878685
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 6
ja 0x1def52
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
mov edi, edx
xor edi, 0xfa434561
mov ebx, edx
xor ebx, 0x5bcba9e
or edx, 0x7a434561
and edx, ebx
lea edx, [edi + edx*2]
lea edi, [edx + esi]
and edx, esi
mov esi, edi
not esi
and esi, edx
add esi, edx
not edx
and edx, edi
sub edx, esi
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
mov esi, edx
xor esi, 0xe5
and edx, 0x1a
add edx, edx
sub edx, esi
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 7
jb 0x1deef0
mov edx, dword [0x1f1ba0]
test edx, edx
je 0x1def9e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x1f1ba4]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x625b6034
je 0x1def80
inc edi
cmp edx, edi
jne 0x1def70
jmp 0x1def9e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x1def9e
push eax
push 1
push dword [0x1f1ba8]
push edx
mov esi, ecx
call fcn.001e1c60
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x1df260
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, ecx
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x1df2f8
push 0xfb1631b0
push dword [0x1f1b94]
call fcn.001e47c0
add esp, 8
test eax, eax
je 0x1df2bd
mov ecx, dword [esi]
test ecx, ecx
je 0x1df2f5
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x1df2d1
cmp dword [esp + 4], 0
je 0x1df2d1
mov dword [esi + 4], 3
jmp 0x1df2f5
mov ecx, ebx
mov dword [esi + 4], 1
mov eax, dword [esi]
mov dword [esp + 0x10], eax
jmp 0x1df3c7
lea eax, [esp + 0xc]
push eax
call fcn.001e50f0
add esp, 4
test al, al
je 0x1df2f5
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x1df2f2
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
mov ecx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebx
cmp eax, 2
jne 0x1df3c7
mov dword [esp + 4], 0x80878685
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x1df391
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, eax
xor esi, 0xfa434561
mov ebx, eax
xor ebx, 0x5bcba9e
or eax, 0x7a434561
and eax, ebx
lea eax, [esi + eax*2]
lea esi, [eax + edx]
and eax, edx
mov edx, esi
not edx
and edx, eax
add edx, eax
not eax
and eax, esi
sub eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov edx, eax
xor edx, 0xe5
and eax, 0x1a
add eax, eax
sub eax, edx
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x1df330
mov eax, dword [esp + 4]
mov edx, dword [0x1f1ba0]
test edx, edx
je 0x1df4a4
xor esi, esi
mov ebx, dword [0x1f1ba4]
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x495ce5ca
je 0x1df480
inc esi
cmp edx, esi
jne 0x1df3b0
jmp 0x1df4a4
mov dword [esp + 4], 0x80878685
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x1df451
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, eax
xor esi, 0xfa434561
mov ebx, eax
xor ebx, 0x5bcba9e
or eax, 0x7a434561
and eax, ebx
lea eax, [esi + eax*2]
lea esi, [eax + edx]
and eax, edx
mov edx, esi
not edx
and edx, eax
add edx, eax
not eax
and eax, esi
sub eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov edx, eax
xor edx, 0xe5
and eax, 0x1a
add eax, eax
sub eax, edx
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x1df3f0
mov eax, dword [esp + 4]
mov edx, dword [0x1f1ba0]
test edx, edx
je 0x1df4a4
xor esi, esi
mov ebx, dword [0x1f1ba4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x1b788dcf
je 0x1df480
inc esi
cmp edx, esi
jne 0x1df470
jmp 0x1df4a4
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x1df4a4
push dword [esp + 0x34]
push ecx
push edi
push ebp
push dword [esp + 0x20]
push 5
push dword [0x1f1ba8]
push edx
call fcn.001e1c60
add esp, 0x20
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x1df850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov esi, ecx
mov edi, dword [ebp + 0x1c]
test edi, edi
jne 0x1df869
lea edi, [esp + 0x10]
mov eax, dword [esi + 4]
test eax, eax
je 0x1df87a
cmp eax, 2
je 0x1df8f0
jmp 0x1df91d
push 0xfb1631b0
push dword [0x1f1b94]
call fcn.001e47c0
add esp, 8
test eax, eax
je 0x1df8bb
mov ecx, dword [esi]
test ecx, ecx
je 0x1df8e8
mov dword [esp + 4], 0
lea edx, [esp + 4]
push edx
push ecx
call eax
test eax, eax
je 0x1df8c4
cmp dword [esp + 4], 0
je 0x1df8c4
mov dword [esi + 4], 3
jmp 0x1df8e8
mov dword [esi + 4], 1
jmp 0x1df91d
lea eax, [esp + 0xc]
push eax
call fcn.001e50f0
add esp, 4
test al, al
je 0x1df8e8
mov eax, dword [esp + 0xc]
mov ecx, 2
cmp eax, 3
je 0x1df8e5
mov ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 4]
cmp eax, 2
jne 0x1df91d
mov ebx, dword [ebp + 0x18]
push 0xc95dc39
push dword [0x1f9bb4]
call fcn.001e47c0
add esp, 8
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi]
call eax
jmp 0x1dfa04
mov ecx, dword [esi]
mov dword [esp + 4], 0x80878685
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x1df9b1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, eax
xor esi, 0xfa434561
mov ebx, eax
xor ebx, 0x5bcba9e
or eax, 0x7a434561
and eax, ebx
lea eax, [esi + eax*2]
lea esi, [eax + edx]
and eax, edx
mov edx, esi
not edx
and edx, eax
add edx, eax
not eax
and eax, esi
sub eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov edx, eax
xor edx, 0xe5
and eax, 0x1a
add eax, eax
sub eax, edx
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x1df950
mov eax, dword [esp + 4]
mov edx, dword [0x1f1ba0]
test edx, edx
je 0x1dfa04
xor esi, esi
mov ebx, dword [0x1f1ba4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x3baba5e0
je 0x1df9e0
inc esi
cmp edx, esi
jne 0x1df9d0
jmp 0x1dfa04
mov edx, dword [ebx + esi*8 + 4]
cmp edx, eax
je 0x1dfa04
push edi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
push ecx
push 5
push dword [0x1f1ba8]
push edx
call fcn.001e1c60
add esp, 0x20
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x1e3180
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
mov ebx, dword [esp + 0x30]
mov ecx, ebx
add ecx, ebp
adc edx, 0
xor eax, eax
mov esi, 0xfffffffe
cmp esi, ecx
mov ecx, 0
sbb ecx, edx
mov esi, dword [esp + 0x2c]
jb 0x1e31ff
mov ecx, ebx
shr ecx, 2
mov edx, ebp
mov edi, esi
xchg esi, edx
rep movsd dword es:[edi], dword [esi]
xchg esi, edx
mov edx, ebx
and edx, 0xfffffffc
add esi, edx
add edx, ebp
mov ecx, ebx
xor ecx, 0xfffffffc
mov ebp, ebx
or ebp, 3
and ebp, ecx
mov ecx, ebp
shr ecx, 1
mov ebx, edx
mov edi, esi
xchg esi, ebx
rep movsw word es:[edi], word [esi]
xchg esi, ebx
mov ecx, dword [esp + 0x30]
test cl, 1
je 0x1e339e
and ebp, 0xfffffffe
movzx ecx, byte [edx + ebp]
mov byte [esi + ebp], cl
jmp 0x1e339e
mov dword [esp + 4], 0x8c8d8a8b
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 3
ja 0x1e3263
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov edx, eax
xor edx, 0xe2d23922
mov edi, eax
xor edi, 0x1d2dc6dd
or eax, 0x62d23922
and eax, edi
lea eax, [edx + eax*2]
xor eax, ecx
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add al, 0x56
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 4
jb 0x1e3220
mov eax, dword [esp + 4]
mov ecx, dword [0x1f1ba0]
test ecx, ecx
je 0x1e32ba
xor edx, edx
mov edi, dword [0x1f1ba4]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x54ca534e
je 0x1e3290
inc edx
cmp ecx, edx
jne 0x1e3280
jmp 0x1e32ba
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, eax
je 0x1e32ba
lea eax, [esp + 0xc]
push 2
push 0
push 0
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push 7
push dword [0x1f1ba8]
push ecx
call fcn.001e1c60
add esp, 0x28
test eax, eax
mov edi, dword [esp + 0x28]
js 0x1e339e
push 0xc95dc39
push dword [0x1f9bb4]
call fcn.001e47c0
add esp, 8
push 0
push 0
push ebx
push esi
push edi
push ebp
push dword [esp + 0x24]
call eax
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], 0x8c8d8a8b
mov dword [esp], 0
mov edx, dword [esp]
cmp edx, 3
ja 0x1e3355
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov esi, dword [esp]
movzx esi, byte [esp + esi + 4]
mov edi, edx
xor edi, 0xe2d23922
mov ebx, edx
xor ebx, 0x1d2dc6dd
or edx, 0x62d23922
and edx, ebx
lea edx, [edi + edx*2]
xor edx, esi
mov dword [esp + 8], edx
mov edx, dword [esp + 8]
add dl, 0x56
mov esi, dword [esp]
mov byte [esp + esi + 4], dl
inc dword [esp]
mov edx, dword [esp]
cmp edx, 4
jb 0x1e3310
mov edx, dword [0x1f1ba0]
test edx, edx
je 0x1e339e
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x1f1ba4]
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x625b6034
je 0x1e3380
inc edi
cmp edx, edi
jne 0x1e3370
jmp 0x1e339e
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x1e339e
push ecx
push 1
push dword [0x1f1ba8]
push edx
mov esi, eax
call fcn.001e1c60
mov eax, esi
add esp, 0x10
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1e4170
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [esp + 8], 0x636261b0
mov word [esp + 0xc], 0
mov byte [esp + 0xe], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x1e41f4
nop
nop
nop
nop
nop
nop
mov eax, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 8]
mov edx, eax
xor edx, 0x7cf80f98
mov esi, eax
xor esi, 0x307f067
or eax, 0x7cf80f98
and eax, esi
lea eax, [edx + eax*2]
lea edx, [eax + ecx]
and eax, ecx
mov ecx, edx
xor ecx, eax
add ecx, eax
not eax
and eax, edx
add eax, eax
sub eax, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
add al, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 8], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x1e41a0
mov eax, dword [esp + 8]
mov eax, dword fs:[eax]
mov ecx, dword [0x1f053c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx

Function at 0x1e46d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], 0xd9dadbf4
mov word [esp + 8], 0
mov byte [esp + 0xa], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 6
ja 0x1e4739
nop
nop
nop
mov eax, dword [esp]
mov edx, dword [esp]
movzx edx, byte [esp + edx + 4]
mov esi, eax
xor esi, 0xe426c4f
and eax, 0xe426c4f
lea eax, [esi + eax*2]
xor eax, edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add al, 0x75
mov edx, dword [esp]
mov byte [esp + edx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 7
jb 0x1e4700
mov eax, dword [esp + 4]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x1f0664]
mov edx, dword [eax + 0xc]
add edx, 0xc
xor eax, eax
mov esi, dword [edx]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x1f066c]
mov eax, dword [esi + 0x28]
xor edi, edi
jmp dword [edi*4 + 0x1f067c]
xor ebx, ebx
cmp dword [esi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x1f0674]
mov edi, 1
jmp dword [edi*4 + 0x1f067c]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x1e47c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov ebp, dword [esp + 0x48]
movzx eax, word [ebp]
mov dword [esp + 8], 0x23228bfd
mov word [esp + 0xc], 0
mov dword [esp + 4], 0
mov ecx, dword [esp + 4]
cmp ecx, 5
ja 0x1e482e
nop
mov ecx, dword [esp + 4]
mov edx, dword [esp + 4]
movzx edx, byte [esp + edx + 8]
mov esi, ecx
xor esi, 0x65f14cc8
and ecx, 0xe5f14cc8
lea ecx, [esi + ecx*2]
xor ecx, edx
mov dword [esp], ecx
mov ecx, dword [esp]
add cl, 0x18
mov edx, dword [esp + 4]
mov byte [esp + edx + 8], cl
inc dword [esp + 4]
mov ecx, dword [esp + 4]
cmp ecx, 6
jb 0x1e47f0
xor ecx, ecx
cmp dword [esp + 8], eax
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x1f0684]
mov ecx, dword [ebp + 0x3c]
mov edx, dword [ebp + ecx]
mov dword [esp + 4], 0x90a505c
mov dword [esp], 0
mov esi, dword [esp]
cmp esi, 3
ja 0x1e489b
nop
nop
mov esi, dword [esp]
mov edi, dword [esp]
movzx edi, byte [esp + edi + 4]
mov ebx, esi
xor ebx, 0x7c011083
and esi, 0xfc011083
lea esi, [ebx + esi*2]
xor esi, edi
mov dword [esp + 8], esi
mov ebx, dword [esp + 8]
add bl, 0x71
mov esi, dword [esp]
mov byte [esp + esi + 4], bl
inc dword [esp]
mov esi, dword [esp]
cmp esi, 4
jb 0x1e4860
xor ebx, ebx
cmp edx, dword [esp + 4]
setne bl
jmp dword [ebx*4 + 0x1f068c]
mov esi, dword [ebp + ecx + 0x7c]
mov edi, dword [ebp + ecx + 0x78]
test esi, esi
sete cl
test edi, edi
sete dl
or dl, cl
movzx ecx, dl
mov dword [esp + 0x14], edi
jmp dword [ecx*4 + 0x1f0694]
mov dword [esp + 0x1c], esi
mov eax, dword [ebp + edi + 0x20]
add eax, ebp
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + edi + 0x24]
add eax, ebp
mov dword [esp + 0x24], eax
mov eax, dword [ebp + edi + 0x1c]
add eax, ebp
mov dword [esp + 0x20], eax
xor ecx, ecx
xor eax, eax
cmp ecx, dword [ebp + edi + 0x18]
setb al
mov dword [esp + 0x28], 1
jmp dword [eax*4 + 0x1f069c]
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1e5330
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x30
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x50]
mov esi, dword [esp + 0x44]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x1e5350
mov ecx, eax
sar ecx, 1
and eax, 8
mov ebx, ecx
xor ebx, 4
add ebx, eax
and ecx, 1
mov eax, ebx
or eax, 1
add eax, ecx
jns 0x1e537c
mov eax, 0xffffffff
jmp 0x1e537e
add eax, eax
push eax
call fcn.001ac630
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x1e53c1
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x1e53b0
mov word [ecx], 0
lea ecx, [ebx + ebx]
mov word [esp + 0xc], cx
lea ecx, [ebx*2 + 2]
mov word [esp + 0xe], cx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x18
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 4], 0x94959a9b
mov byte [esp + 8], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 4
ja 0x1e547d
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 4]
mov esi, edx
xor esi, 0x1e447ae6
mov ebx, edx
xor ebx, 0x61bb8519
or edx, 0x1e447ae6
and edx, ebx
add edx, edx
mov ebx, edx
and ebx, esi
xor edx, esi
lea edx, [edx + ebx*2]
xor edx, ecx
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x14]
add cl, 0x82
mov edx, dword [esp]
mov byte [esp + edx + 4], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 5
jb 0x1e5430
mov esi, dword [esp + 4]
mov ecx, dword [0x1f1ba0]
test ecx, ecx
je 0x1e54e3
xor edx, edx
mov ebx, dword [0x1f1ba4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x88a3caae
je 0x1e54b0
inc edx
cmp ecx, edx
jne 0x1e54a0
jmp 0x1e54e3
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x1e54e3
lea edx, [esp + 4]
lea esi, [esp + 0x18]
push edi
push ebp
push edx
push esi
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push 6
push dword [0x1f1ba8]
push ecx
mov edi, eax
call fcn.001e1c60
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.001ac640
add esp, 4
mov eax, esi
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1e5500
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x1e5520
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x1e553b
mov eax, 0xffffffff
jmp 0x1e553e
add eax, 0xa
push eax
call fcn.001ac630
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov edx, eax
add edx, 8
movzx edi, word [ebx]
test di, di
je 0x1e5581
add ebx, 2
nop
nop
nop
mov word [edx], di
add edx, 2
movzx edi, word [ebx]
add ebx, 2
test di, di
jne 0x1e5570
mov word [edx], 0
mov edi, 3
sub edi, esi
and edi, 2
mov edx, ecx
and edx, 0xfffd
imul edx, edi
and esi, 2
or ecx, 2
imul ecx, esi
lea esi, [ecx + edx]
mov word [esp + 4], si
add ecx, edx
add ecx, 2
mov word [esp + 6], cx
mov dword [esp + 8], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x94959a9b
mov byte [esp + 0x2c], 0
mov dword [esp], 0
mov ecx, dword [esp]
cmp ecx, 4
ja 0x1e565d
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [esp]
mov ecx, dword [esp]
movzx ecx, byte [esp + ecx + 0x28]
mov esi, edx
xor esi, 0x1e447ae6
mov edi, edx
xor edi, 0x61bb8519
or edx, 0x1e447ae6
and edx, edi
add edx, edx
mov edi, edx
and edi, esi
xor edx, esi
lea edx, [edx + edi*2]
xor edx, ecx
mov dword [esp + 0xc], edx
mov ecx, dword [esp + 0xc]
add cl, 0x82
mov edx, dword [esp]
mov byte [esp + edx + 0x28], cl
inc dword [esp]
mov ecx, dword [esp]
cmp ecx, 5
jb 0x1e5610
mov esi, dword [esp + 0x28]
mov ecx, dword [0x1f1ba0]
test ecx, ecx
je 0x1e56b9
xor edx, edx
mov edi, dword [0x1f1ba4]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x8896be63
je 0x1e5690
inc edx
cmp ecx, edx
jne 0x1e5680
jmp 0x1e56b9
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x1e56b9
lea edx, [esp + 0x28]
lea esi, [esp + 0x10]
push edx
push esi
push 2
push dword [0x1f1ba8]
push ecx
mov edi, eax
call fcn.001e1c60
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.001ac640
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x1e56cf
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1e56e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x30
mov dword [esp + 0x10], 0x94959a9b
mov byte [esp + 0x14], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x1e5761
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 4]
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax + 0x10]
mov edx, ecx
xor edx, 0x1e447ae6
mov esi, ecx
xor esi, 0x61bb8519
or ecx, 0x1e447ae6
and ecx, esi
add ecx, ecx
mov esi, ecx
and esi, edx
xor ecx, edx
lea ecx, [ecx + esi*2]
xor ecx, eax
mov dword [esp + 8], ecx
mov eax, dword [esp + 8]
add al, 0x82
mov ecx, dword [esp + 4]
mov byte [esp + ecx + 0x10], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 5
jb 0x1e5710
mov esi, dword [ebp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [0x1f1ba0]
test edx, edx
je 0x1e57b8
mov ecx, dword [ebp + 8]
xor edi, edi
mov ebx, dword [0x1f1ba4]
nop
nop
nop
cmp dword [ebx + edi*8], 0x77a9e0c4
je 0x1e5790
inc edi
cmp edx, edi
jne 0x1e5780
jmp 0x1e57b8
mov edx, dword [ebx + edi*8 + 4]
cmp edx, eax
je 0x1e57b8
lea eax, [esp + 0x10]
lea edi, [esp + 8]
push 5
push 0x18
push eax
push edi
push ecx
push 5
push dword [0x1f1ba8]
push edx
call fcn.001e1c60
add esp, 0x20
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x1e57c5
mov edx, dword [esp + 0x18]
mov dword [esi], edx
test ecx, ecx
je 0x1e57d1
cmp byte [esp + 0x25], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret