joyce8/EMBER2024-capa huggingface dataset:
Function at 0x492b90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
mov ebx, dword [esi + 0x78]
add esi, 0x70
cmp dword [esi + 4], ebx
push edi
jbe 0x492bab
call fcn.004af167
mov edi, dword [esi + 4]
cmp edi, dword [esi + 8]
jbe 0x492bb8
call fcn.004af167
cmp edi, ebx
je 0x492bc7
mov eax, dword [esi + 8]
call fcn.0040fc10
mov dword [esi + 8], eax
mov ecx, dword [esp + 0x3c]
xor eax, eax
xor ebp, ebp
cmp dword [ecx + 0x98], eax
jle 0x492c6a
lea edi, [ecx + 0x9c]
add ecx, 0xc4
mov dword [esp + 0x10], ecx
jmp 0x492bf2
xor eax, eax
mov ebx, dword [edi + 4]
mov edx, dword [edi]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax]
lea ecx, [eax + eax*4]
mov eax, dword [ecx*4 + 0x4d5b5c]
lea ecx, [ecx*4 + 0x4d5b5c]
mov ecx, dword [ecx + 4]
add ecx, ebx
mov dword [esp + 0x20], ecx
add eax, edx
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], edx
push ecx
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], eax
call dword [0x4c92a0]
lea eax, [esp + 0x24]
push eax
call fcn.0040f810
mov ecx, dword [esp + 0x3c]
add dword [esp + 0x10], 4
add ebp, 1
add edi, 8
cmp ebp, dword [ecx + 0x98]
jl 0x492bf0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4

Function at 0x492f60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c4a28
mov eax, dword fs:[0]
push eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4fbbfc]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x24]
lea eax, [ebx + 0x160]
push eax
push 0
push str.CVideoRenderer
push 0x4d5b40
mov ecx, ebx
call fcn.0049c5f0
mov dword [esp + 0x1c], 0
mov dword [ebx], vtable.CVideoRender.0
mov dword [ebx + 0xc], vtable.CVideoRender.1.0
mov dword [ebx + 0x10], vtable.CVideoRender.2.0
mov dword [ebx + 0xe0], vtable.CVideoRender.3.0
mov dword [ebx + 0xe4], vtable.CVideoRender.4.0
mov edx, dword [ebp]
mov eax, dword [edx + 0x20]
mov ecx, ebp
call eax
mov esi, eax
xor eax, eax
lea edi, [ebx + 0x18c]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov dword [ebx + 0x164], eax
mov dword [ebx + 0x168], eax
mov dword [ebx + 0x16c], eax
mov dword [ebx + 0x170], eax
mov dword [ebx + 0x174], eax
mov dword [ebx + 0x178], eax
mov dword [ebx + 0x17c], eax
mov dword [ebx + 0x180], eax
mov dword [ebx + 0x184], eax
mov dword [ebx + 0x188], eax
xor esi, esi
mov dword [ebx + 0x1b4], ebp
call fcn.004099e0
mov ecx, dword [eax + 0x30]
mov dword [ebx + 0x1b8], ecx
mov dword [ebx + 0x1d0], esi
mov dword [ebx + 0x1cc], esi
mov eax, ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x4943a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4c3968
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4fbbfc]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esi], vtable.CWindow.0
mov dword [esi + 4], vtable.CWinHookList.0
call fcn.0040a980
mov dword [esi + 0xc], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x10], edi
push eax
mov dword [esi + 0x14], vtable.CCriticalSection.0
call dword [0x4c9214]
mov word [esi + 0x68], di
mov dword [esi + 0x30], edi
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x498080
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4c2eff
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x4fbbfc]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov eax, dword [esi + 0x30]
test eax, eax
mov dword [esp + 0x18], 1
je 0x4980c0
push eax
call dword [0x4c91fc]
cmp dword [esi + 0x58], 0
je 0x4980d1
mov eax, dword [esi + 0x58]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [esi + 0x10]
push eax
call dword [0x4c9208]
lea ecx, [esi + 4]
mov dword [esp + 0x18], 0xffffffff
call fcn.00499990
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret

Function at 0x499e80
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4c311e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4fbbfc]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
lea ebx, [esi + 0x7c]
push ebx
push ecx
push edx
mov ecx, esi
call fcn.004995a0
mov ebp, dword [esp + 0x34]
xor edi, edi
push ebp
push edi
lea ecx, [esi + 0x54]
mov dword [esp + 0x28], edi
mov dword [esi], vtable.CBaseRenderer.2.0
mov dword [esi + 0xc], vtable.CBaseRenderer.1.0
mov dword [esi + 0x10], vtable.CBaseRenderer.0
mov dword [esi + 0x50], edi
call fcn.00495cc0
push ebp
push 1
lea ecx, [esi + 0x58]
mov byte [esp + 0x28], 1
call fcn.00495cc0
push ebp
lea ecx, [esi + 0x5c]
push 1
mov byte [esp + 0x28], 2
call fcn.00495cc0
push ebx
mov ebx, dword [0x4c9214]
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
call ebx
lea eax, [esi + 0x94]
push eax
call ebx
lea ecx, [esi + 0xc4]
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], 1
push ecx
mov dword [esi + 0xb4], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 0xc0], edi
call ebx
cmp dword [ebp], edi
jl 0x499f77
mov edx, dword [esi + 0x5c]
push edx
call dword [0x4c91f8]
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x10
Function at 0x402eb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
cmp eax, 0x480240
je 0x402ee4
cmp eax, 0x4844a8
je 0x402ee4
cmp eax, 0x480314
je 0x402ee4
cmp eax, 0x480350
je 0x402ee4
cmp eax, 0x48038c
je 0x402ee4
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00403270
mov dword [ebp + 0xc], ecx
pop ebp
jmp fcn.00403fd0
Function at 0x405df0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4935ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor edx, edx
push edi
mov edi, dword [ebp + 0xc]
nop dword [eax + eax]
mov cl, byte [edx + esi]
lea eax, [ecx - 0x41]
cmp al, 0x19
ja 0x405e22
movsx eax, cl
sub eax, 0x41
jmp 0x405e64
lea eax, [ecx - 0x61]
cmp al, 0x19
ja 0x405e31
movsx eax, cl
sub eax, 0x47
jmp 0x405e64
lea eax, [ecx - 0x30]
cmp al, 9
ja 0x405e40
movsx eax, cl
add eax, 4
jmp 0x405e64
cmp cl, 0x2b
jne 0x405e4c
mov eax, 0x3e
jmp 0x405e64
cmp cl, 0x2f
jne 0x405e58
mov eax, 0x3f
jmp 0x405e64
cmp cl, 0x3d
jne 0x405ee1
or eax, 0xffffffff
mov dword [ebp + edx*4 - 0x14], eax
inc edx
cmp edx, 4
jl 0x405e10
mov edx, dword [ebp - 0x14]
cmp edx, 0xffffffff
je 0x405ee1
mov esi, dword [ebp - 0x10]
cmp esi, 0xffffffff
je 0x405ee1
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp ecx, 0xffffffff
jne 0x405e92
cmp eax, ecx
jne 0x405ee1
lea ebx, [ecx + 2]
jmp 0x405e9d
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
add ebx, 2
shl edx, 6
and ecx, 0x3f
or edx, esi
and eax, 0x3f
shl edx, 6
or edx, ecx
shl edx, 6
or edx, eax
mov eax, edx
shr eax, 0x10
mov byte [edi], al
cmp ebx, 1
jbe 0x405ec6
mov ecx, edx
shr ecx, 8
mov byte [edi + 1], cl
cmp ebx, 2
jbe 0x405ece
mov byte [edi + 2], dl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004291ff
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004291ff
mov esp, ebp
pop ebp
ret

Function at 0x406c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
test esi, esi
je 0x406c65
push ebx
mov ebx, dword [ebp + 0xc]
sub ebx, eax
nop word [eax + eax]
movzx edx, byte [ebx + eax]
lea eax, [eax + 1]
movzx ecx, byte [eax - 1]
xor edx, ecx
or edi, edx
sub esi, 1
jne 0x406c50
pop ebx
mov eax, 0x100
sub eax, edi
pop edi
shr eax, 8
pop esi
pop ebp
ret
Function at 0x407350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x4935ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x40], edi
movups xmm0, xmmword [edi + 0x3c8]
movups xmmword [ebp - 0x34], xmm0
test ebx, ebx
jle 0x4074b5
dec ebx
add edx, 3
shr ebx, 4
inc ebx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ebx
push esi
movzx ecx, byte [edx - 3]
lea esi, [edx - 1]
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], ecx
movzx ecx, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 6]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], ecx
movzx ecx, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xa]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], ecx
movzx ecx, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
lea eax, [ebp - 0x14]
push eax
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], ecx
call fcn.00407330
add esp, 8
xor edi, edi
mov edx, dword [ebp + edi - 0x34]
lea esi, [esi + 4]
mov ebx, dword [ebp + edi - 0x14]
mov ecx, edx
shr ecx, 0x18
mov eax, ebx
shr eax, 0x18
xor cl, al
mov eax, ebx
mov byte [esi - 6], cl
mov ecx, edx
shr ecx, 0x10
shr eax, 0x10
xor cl, al
mov eax, ebx
mov byte [esi - 5], cl
mov ecx, edx
shr eax, 8
xor dl, bl
shr ecx, 8
xor cl, al
mov byte [esi - 3], dl
mov eax, dword [ebp + edi - 0x24]
mov dword [ebp + edi - 0x34], eax
add edi, 4
mov byte [esi - 4], cl
cmp edi, 0x10
jl 0x407434
mov edx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x40]
add edx, 0x10
sub dword [ebp - 0x3c], 1
mov dword [ebp - 0x38], edx
jne 0x407390
movups xmm0, xmmword [ebp - 0x34]
mov eax, edi
pop esi
pop edi
pop ebx
movups xmmword [eax + 0x3c8], xmm0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004291ff
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
movups xmmword [edi + 0x3c8], xmm0
pop edi
xor ecx, ebp
pop ebx
call fcn.004291ff
mov esp, ebp
pop ebp
ret
Function at 0x408150
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4935ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
movups xmm0, xmmword [ebx + 0x3c8]
mov edi, dword [ebp + 0xc]
movups xmmword [ebp - 0x14], xmm0
test edi, edi
jle 0x4082ad
mov edx, dword [ebp - 8]
dec edi
shr edi, 4
add esi, 2
inc edi
nop word [eax + eax]
movzx ecx, byte [esi - 2]
movzx eax, byte [esi - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 3]
xor dword [ebp - 0x14], ecx
movzx ecx, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 7]
xor dword [ebp - 0x10], ecx
movzx ecx, byte [esi + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xb]
xor dword [ebp - 0xc], ecx
movzx ecx, byte [esi + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xd]
shl ecx, 8
or ecx, eax
lea eax, [ebp - 0x14]
push eax
xor edx, ecx
push ebx
mov dword [ebp - 8], edx
call fcn.00408130
mov ecx, dword [ebp - 0x14]
add esp, 8
mov eax, ecx
mov byte [esi + 1], cl
shr eax, 0x18
mov byte [esi - 2], al
mov eax, ecx
shr eax, 0x10
mov byte [esi - 1], al
mov eax, ecx
mov ecx, dword [ebp - 0x10]
shr eax, 8
mov byte [esi], al
mov eax, ecx
shr eax, 0x18
mov byte [esi + 2], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 3], al
mov eax, ecx
shr eax, 8
mov byte [esi + 4], al
mov byte [esi + 5], cl
mov ecx, dword [ebp - 0xc]
mov eax, ecx
shr eax, 0x18
mov byte [esi + 6], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 7], al
mov eax, ecx
shr eax, 8
mov edx, dword [ebp - 8]
lea esi, [esi + 0x10]
mov byte [esi - 8], al
mov eax, edx
shr eax, 0x18
mov byte [esi - 6], al
mov eax, edx
shr eax, 0x10
mov byte [esi - 5], al
mov eax, edx
shr eax, 8
mov byte [esi - 7], cl
mov byte [esi - 4], al
mov byte [esi - 3], dl
sub edi, 1
jne 0x408190
movups xmm0, xmmword [ebp - 0x14]
mov ecx, dword [ebp - 4]
pop edi
pop esi
movups xmmword [ebx + 0x3c8], xmm0
xor ecx, ebp
pop ebx
call fcn.004291ff
mov esp, ebp
pop ebp
ret
Function at 0x409540
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x4935ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
mov ecx, edx
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 0x8c], eax
lea esi, [ecx + 1]
mov eax, dword [ebp + 0x18]
push edi
mov dword [ebp - 0x94], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409570
lea eax, [ebp - 0x84]
sub ecx, esi
push eax
push ecx
push edx
call fcn.0041df70
mov eax, dword [ebp + 0x1c]
xor edi, edi
add eax, 0x1f
mov dword [ebp - 0x88], edi
cdq
add esp, 0xc
and edx, 0x1f
lea ebx, [edx + eax]
sar ebx, 5
test ebx, ebx
jle 0x409666
mov eax, dword [ebp + 0x14]
nop dword [eax]
mov ecx, dword [ebp - 0x8c]
xorps xmm0, xmm0
mov edx, dword [ebp + 0x10]
xor esi, esi
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
test eax, eax
jle 0x409627
lea eax, [edi + 1]
mov dword [ebp - 0x90], eax
mov edi, eax
lea eax, [ebp - 0x44]
push eax
push edx
push ecx
lea eax, [ebp - 0x84]
xor ecx, ecx
push eax
test esi, esi
mov eax, edi
cmovne eax, ecx
push eax
call fcn.004093a0
add esp, 0x14
lea ecx, [ebp - 0x44]
mov edx, 0x20
xor eax, eax
nop
movups xmm0, xmmword [ebp + eax - 0x24]
movups xmm1, xmmword [ebp + eax - 0x44]
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x24], xmm1
add eax, 0x10
cmp eax, 0x20
jl 0x409600
inc esi
cmp esi, dword [ebp + 0x14]
jl 0x4095d5
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + 0x1c]
mov ecx, edi
cmp edi, esi
jge 0x409654
mov edi, dword [ebp - 0x94]
lea edx, [ebp - 0x24]
nop dword [eax]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [edi + ecx], al
add ecx, ebx
cmp ecx, esi
jl 0x409640
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0x14]
inc edi
mov dword [ebp - 0x88], edi
cmp edi, ebx
jl 0x4095b0
lea eax, [ebp - 0x84]
push 0x40
push eax
call fcn.00424070
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004291ff
mov esp, ebp
pop ebp
ret
Function at 0x40a5f0
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movups xmm0, xmmword [0x47e5d8]
movups xmmword [eax + 0x1000], xmm0
lea edx, [eax + 0x800]
movups xmm0, xmmword [0x47e5e8]
movups xmmword [eax + 0x1010], xmm0
movups xmm0, xmmword [0x47e5f8]
movups xmmword [eax + 0x1020], xmm0
movups xmm0, xmmword [0x47e608]
movups xmmword [eax + 0x1030], xmm0
movq xmm0, qword [0x47e618]
movq qword [eax + 0x1040], xmm0
xor eax, eax
nop word [eax + eax]
mov ecx, dword [eax + 0x47e620]
lea edx, [edx + 4]
mov dword [edx - 0x804], ecx
mov ecx, dword [eax + 0x47ea20]
mov dword [edx - 0x404], ecx
mov ecx, dword [eax + 0x47ee20]
mov dword [edx - 4], ecx
mov ecx, dword [eax + 0x47f220]
add eax, 4
mov dword [edx + 0x3fc], ecx
cmp eax, 0x400
jl 0x40a650
pop ebp
ret

Function at 0x40a690
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov ebx, dword [ecx + 0x1048]
mov edi, dword [ecx + 0x104c]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
test eax, eax
jle 0x40a785
push esi
mov esi, dword [ebp + 8]
dec eax
shr eax, 3
add esi, 2
inc eax
mov dword [ebp + 0xc], eax
nop word [eax + eax]
movzx ebx, byte [esi + 1]
movzx eax, byte [esi]
movzx edi, byte [esi + 5]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi - 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi - 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 4]
or edi, eax
movzx eax, byte [esi + 3]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 2]
shl edi, 8
or edi, eax
lea eax, [ebp - 0x10]
push ecx
push eax
push edi
push ebx
call fcn.00409840
mov ecx, dword [ebp - 4]
lea esi, [esi + 8]
xor ecx, dword [ebp - 0x10]
add esp, 0x10
mov edx, dword [ebp - 8]
mov eax, ecx
xor edx, dword [ebp - 0xc]
shr eax, 8
mov byte [esi - 9], al
mov eax, ecx
shr eax, 0x10
mov byte [esi - 8], al
mov eax, edx
shr eax, 8
mov byte [esi - 5], al
mov eax, edx
mov byte [esi - 0xa], cl
shr ecx, 0x18
mov byte [esi - 6], dl
shr eax, 0x10
shr edx, 0x18
sub dword [ebp + 0xc], 1
mov byte [esi - 7], cl
mov ecx, dword [ebp + 0x10]
mov byte [esi - 4], al
mov byte [esi - 3], dl
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
jne 0x40a6d0
mov eax, ecx
pop esi
mov dword [eax + 0x104c], edi
pop edi
mov dword [eax + 0x1048], ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ecx + 0x104c], edi
pop edi
mov dword [ecx + 0x1048], ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a7a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
push ebx
push edi
mov edi, dword [ebp + 0x10]
mov edx, dword [edi + 0x1048]
mov ebx, dword [edi + 0x104c]
test eax, eax
jle 0x40a86b
push esi
mov esi, dword [ebp + 8]
dec eax
shr eax, 3
add esi, 2
inc eax
mov dword [ebp + 0x10], eax
movzx ecx, byte [esi + 5]
lea eax, [ebp - 8]
shl ecx, 8
push edi
push eax
movzx eax, byte [esi + 4]
or ecx, eax
movzx eax, byte [esi + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
xor ecx, ebx
push ecx
movzx ecx, byte [esi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi - 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi - 2]
shl ecx, 8
or ecx, eax
xor ecx, edx
push ecx
call fcn.00409c70
mov edx, dword [ebp - 8]
lea esi, [esi + 8]
mov ebx, dword [ebp - 4]
mov eax, edx
shr eax, 8
add esp, 0x10
mov byte [esi - 9], al
mov eax, edx
shr eax, 0x10
mov byte [esi - 8], al
mov eax, edx
shr eax, 0x18
mov byte [esi - 7], al
mov eax, ebx
shr eax, 8
mov byte [esi - 5], al
mov eax, ebx
shr eax, 0x10
mov byte [esi - 4], al
mov eax, ebx
shr eax, 0x18
sub dword [ebp + 0x10], 1
mov byte [esi - 0xa], dl
mov byte [esi - 6], bl
mov byte [esi - 3], al
jne 0x40a7d1
pop esi
mov dword [edi + 0x104c], ebx
mov dword [edi + 0x1048], edx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a940
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ebx
push edi
mov ebx, dword [ecx + 0x1048]
mov edi, dword [ecx + 0x104c]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
test eax, eax
jle 0x40aa39
push esi
mov esi, dword [ebp + 8]
dec eax
shr eax, 3
add esi, 2
inc eax
mov dword [ebp + 0xc], eax
nop word [eax + eax]
movzx ebx, byte [esi - 2]
movzx eax, byte [esi - 1]
movzx edi, byte [esi + 2]
shl ebx, 8
or ebx, eax
shl edi, 8
movzx eax, byte [esi]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 1]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi + 3]
or edi, eax
movzx eax, byte [esi + 4]
shl edi, 8
or edi, eax
movzx eax, byte [esi + 5]
shl edi, 8
or edi, eax
lea eax, [ebp - 0x10]
push ecx
push eax
push edi
push ebx
call fcn.00409840
mov ecx, dword [ebp - 4]
lea esi, [esi + 8]
xor ecx, dword [ebp - 0x10]
add esp, 0x10
mov edx, dword [ebp - 8]
mov eax, ecx
xor edx, dword [ebp - 0xc]
shr eax, 0x18
mov byte [esi - 0xa], al
mov eax, ecx
shr eax, 0x10
mov byte [esi - 9], al
mov eax, ecx
shr eax, 8
mov byte [esi - 8], al
mov eax, edx
shr eax, 0x18
mov byte [esi - 6], al
mov eax, edx
shr eax, 0x10
mov byte [esi - 5], al
mov eax, edx
shr eax, 8
sub dword [ebp + 0xc], 1
mov byte [esi - 7], cl
mov ecx, dword [ebp + 0x10]
mov byte [esi - 4], al
mov byte [esi - 3], dl
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
jne 0x40a980
mov eax, ecx
pop esi
mov dword [eax + 0x104c], edi
pop edi
mov dword [eax + 0x1048], ebx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ecx + 0x104c], edi
pop edi
mov dword [ecx + 0x1048], ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40aa50
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
push ebx
push edi
mov edi, dword [ebp + 0x10]
mov edx, dword [edi + 0x1048]
mov ebx, dword [edi + 0x104c]
test eax, eax
jle 0x40ab1b
push esi
mov esi, dword [ebp + 8]
dec eax
shr eax, 3
add esi, 2
inc eax
mov dword [ebp + 0x10], eax
movzx ecx, byte [esi + 2]
lea eax, [ebp - 8]
shl ecx, 8
push edi
push eax
movzx eax, byte [esi + 3]
or ecx, eax
movzx eax, byte [esi + 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi - 1]
xor ecx, ebx
push ecx
movzx ecx, byte [esi - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
xor ecx, edx
push ecx
call fcn.00409c70
mov edx, dword [ebp - 8]
lea esi, [esi + 8]
mov ebx, dword [ebp - 4]
mov eax, edx
shr eax, 0x18
add esp, 0x10
mov byte [esi - 0xa], al
mov eax, edx
shr eax, 0x10
mov byte [esi - 9], al
mov eax, edx
shr eax, 8
mov byte [esi - 8], al
mov eax, ebx
shr eax, 0x18
mov byte [esi - 6], al
mov eax, ebx
shr eax, 0x10
mov byte [esi - 5], al
mov eax, ebx
shr eax, 8
sub dword [ebp + 0x10], 1
mov byte [esi - 7], dl
mov byte [esi - 4], al
mov byte [esi - 3], bl
jne 0x40aa81
pop esi
mov dword [edi + 0x104c], ebx
mov dword [edi + 0x1048], edx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ab30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov edx, dword [edi + 0x1048]
mov ecx, dword [edi + 0x104c]
mov dword [ebp - 4], edx
mov dword [ebp + 0x10], ecx
test eax, eax
jle 0x40ac44
push ebx
push esi
mov esi, dword [ebp + 8]
dec eax
shr eax, 3
add esi, 2
inc eax
mov dword [ebp + 0xc], eax
push edi
lea eax, [ebp - 0xc]
push eax
push ecx
push edx
call fcn.00409c70
movzx ebx, byte [esi - 2]
lea esi, [esi + 8]
movzx eax, byte [esi - 9]
add esp, 0x10
mov edx, dword [ebp - 0xc]
mov ecx, edx
shl ebx, 8
or ebx, eax
shr ecx, 0x18
movzx eax, byte [esi - 8]
shl ebx, 8
or ebx, eax
movzx eax, byte [esi - 7]
shl ebx, 8
or ebx, eax
mov eax, ebx
shr eax, 0x18
xor cl, al
mov eax, ebx
mov byte [esi - 0xa], cl
mov ecx, edx
shr ecx, 0x10
shr eax, 0x10
xor cl, al
mov eax, ebx
mov byte [esi - 9], cl
xor bl, dl
shr eax, 8
mov ecx, edx
mov edx, dword [ebp - 8]
shr ecx, 8
xor cl, al
mov byte [esi - 7], bl
movzx ebx, byte [esi - 6]
movzx eax, byte [esi - 5]
shl ebx, 8
or ebx, eax
mov byte [esi - 8], cl
movzx eax, byte [esi - 4]
mov ecx, edx
shl ebx, 8
or ebx, eax
shr ecx, 0x18
movzx eax, byte [esi - 3]
shl ebx, 8
or ebx, eax
mov eax, ebx
shr eax, 0x18
xor cl, al
mov eax, ebx
mov byte [esi - 6], cl
mov ecx, edx
shr ecx, 0x10
shr eax, 0x10
xor cl, al
mov eax, ebx
mov byte [esi - 5], cl
xor bl, dl
mov ecx, edx
shr eax, 8
mov edx, dword [ebp - 4]
shr ecx, 8
xor cl, al
mov byte [esi - 3], bl
mov byte [esi - 4], cl
mov ecx, dword [ebp + 0x10]
lea eax, [edx + 1]
add ecx, 1
mov dword [ebp + 0x10], ecx
cmovne eax, edx
sub dword [ebp + 0xc], 1
mov edx, eax
mov dword [ebp - 4], edx
jne 0x40ab67
pop esi
pop ebx
mov dword [edi + 0x104c], ecx
mov dword [edi + 0x1048], edx
pop edi
mov esp, ebp
pop ebp
ret