joyce8/EMBER2024-capa huggingface dataset:
Function at 0x544624
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x586530
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x544646
shr eax, 1
xor eax, 0xedb88320
jmp 0x544648
shr eax, 1
dec edx
jne 0x544634
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x54462d
mov byte [0x586930], 1
pop esi
pop ebx
ret

Function at 0x544664
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x586930], 0
jne 0x54467b
call fcn.00544624
mov eax, edi
dec eax
test eax, eax
jl 0x5446a4
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x586530]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x544685
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x547450
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x547481
dec al
je 0x5474c2
dec al
je 0x547506
dec al
je 0x547571
jmp 0x5475fb
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x5475fb
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x547491
jmp 0x5475fb
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5475fb
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x5474d2
jmp 0x5475fb
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5475fb
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x547534
xor ebp, ebp
jmp 0x547545
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x54754e
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x547516
jmp 0x5475fb
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x5475fb
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x5475c9
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.005446ac
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x547585
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x54de4c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x84], 2
jne 0x54de8f
cmp dword [ebp - 0x90], 5
ja 0x54de93
cmp dword [ebp - 0x90], 5
jne 0x54de8f
cmp dword [ebp - 0x8c], 1
jae 0x54de93
xor eax, eax
jmp 0x54de95
mov al, 1
mov esp, ebp
pop ebp
ret

Function at 0x552f6c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x553139
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebx + 0xc]
mov eax, dword [esi + 0x2f4]
call fcn.0053216c
mov edx, dword [ebx + 0x28]
mov eax, dword [esi + 0x2d0]
call fcn.0053216c
mov edx, dword [ebx + 0x2c]
mov eax, dword [esi + 0x2dc]
call fcn.0053216c
mov edx, dword [ebx + 0x30]
mov eax, dword [esi + 0x2e4]
call fcn.0053216c
mov edx, dword [ebx + 0x34]
mov eax, dword [esi + 0x34c]
call fcn.0053216c
mov edx, dword [ebx + 0x24]
mov eax, dword [esi + 0x350]
call fcn.0053216c
mov edx, dword [ebx + 0x38]
mov eax, dword [esi + 0x314]
call fcn.0053216c
xor edx, edx
mov dl, byte [ebx + 0x3c]
mov eax, dword [esi + 0x35c]
call fcn.0042f68c
mov dl, byte [ebx + 0x3d]
mov eax, dword [esi + 0x304]
mov ecx, dword [eax]
call dword [ecx + 0xb8]
mov edx, dword [ebx + 0x40]
mov eax, dword [esi + 0x308]
call fcn.0042f68c
mov edx, dword [ebx + 0x44]
mov eax, dword [esi + 0x30c]
call fcn.0042f68c
xor edx, edx
mov dl, byte [ebx + 0x58]
mov eax, dword [esi + 0x338]
call fcn.0042f68c
mov edx, dword [ebx + 0x5c]
mov eax, dword [esi + 0x344]
call fcn.0042f68c
mov edx, ebx
mov eax, dword [esi + 0x324]
call fcn.0054ecbc
mov dl, byte [ebx + 0x10]
mov eax, dword [esi + 0x378]
mov ecx, dword [eax]
call dword [ecx + 0xb8]
mov eax, dword [ebx + 0x60]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x5530d9
inc eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x388]
call fcn.00551544
call fcn.0055103c
mov edi, eax
lea ecx, [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x60]
call fcn.004730b0
mov edx, dword [ebp - 0xc]
mov eax, edi
call fcn.00550ed4
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x60]
call fcn.004730b0
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov eax, dword [ebx + 0x60]
call fcn.00473298
mov edx, dword [ebp - 0x10]
mov eax, dword [edi + 0x30]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 4]
dec dword [ebp - 8]
jne 0x553080
lea edx, [ebp - 0x18]
mov eax, dword [esi + 0x2f4]
call fcn.00532158
mov eax, dword [ebp - 0x18]
xor edx, edx
call fcn.00404b0c
je 0x55310d
lea edx, [ebp - 0x1c]
mov eax, dword [esi + 0x2d0]
call fcn.00532158
mov eax, dword [ebp - 0x1c]
xor edx, edx
call fcn.00404b0c
jne 0x553111
xor edx, edx
jmp 0x553113
mov dl, 1
mov eax, dword [esi + 0x2e8]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x553140
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.004047c0
ret
Function at 0x565400
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov edi, dword [0x581328]
xor eax, eax
push ebp
push 0x565531
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi]
mov dl, byte [eax + 0x14]
xor dl, 1
mov eax, dword [ebx + 0x2dc]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, dword [edi]
mov dl, byte [eax + 0x14]
xor dl, 1
mov eax, dword [ebx + 0x2e4]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, dword [edi]
mov dl, byte [eax + 0x14]
xor dl, 1
mov eax, dword [ebx + 0x2e8]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, dword [edi]
mov dl, byte [eax + 0x14]
xor dl, 1
mov eax, dword [ebx + 0x2f0]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, dword [edi]
mov dl, byte [eax + 0x14]
xor dl, 1
mov eax, dword [ebx + 0x2fc]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov eax, dword [edi]
mov dl, byte [eax + 0x14]
xor dl, 1
mov eax, dword [ebx + 0x2f8]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
mov edx, dword [esi + 0xc]
mov eax, dword [ebx + 0x2dc]
call fcn.0053216c
mov eax, dword [ebx + 0x2e4]
mov eax, dword [eax + 0x218]
mov edx, dword [esi + 0x28]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [esi + 0x2c]
mov eax, dword [ebx + 0x2e8]
call fcn.00564abc
mov edx, dword [esi + 0x2c]
mov eax, ebx
call fcn.00565604
mov edx, dword [esi + 0x30]
mov eax, dword [ebx + 0x2f0]
call fcn.0042f68c
mov edx, dword [esi + 0x34]
mov eax, dword [ebx + 0x2fc]
call fcn.0042f68c
mov edx, esi
mov eax, dword [ebx + 0x2f8]
call fcn.0054ecbc
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x2dc]
call fcn.00532158
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.00404b0c
setne dl
mov eax, dword [ebx + 0x2d0]
mov ecx, dword [eax]
call dword [ecx + 0x5c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x565538
lea eax, [ebp - 4]
call fcn.004047a8
ret
Function at 0x56cc74
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov ebx, dword [ebp + 8]
add ebx, 0xfffffffc
xor eax, eax
push ebp
push 0x56cd51
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx]
mov edx, 0x56cd68
call fcn.0056c644
lea eax, [ebp - 0x20]
push eax
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [ebp - 0x18]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.00569d94
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov edx, 0x56cd78
call fcn.0056c744
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x28]
call fcn.00569d94
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebx]
mov edx, 0x56cd98
call fcn.0056c744
mov eax, dword [ebp - 8]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x2c]
call fcn.00569d94
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebx]
mov edx, 0x56cdb8
call fcn.0056c744
mov eax, dword [ebp - 4]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x30]
call fcn.00569d94
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebx]
mov edx, 0x56cdd8
call fcn.0056c744
mov eax, dword [ebx]
mov edx, 8
call fcn.0056c63c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56cd58
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.0040411c
ret
Function at 0x56fc38
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x56fc40
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x56fe94
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, ebx
call fcn.00570910
mov esi, eax
test esi, esi
je 0x56fe5c
mov eax, ebx
call fcn.00570890
cmp eax, dword [ebx + 0x2d0]
jne 0x56fe5c
mov eax, ebx
call fcn.0043e450
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x56fe5c
xor eax, eax
push ebp
push 0x56fe55
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_EmptyClipboard
mov eax, esi
mov edx, dword [0x476394]
call fcn.004034ec
test al, al
je 0x56fd5d
lea ecx, [ebp - 0x20]
mov eax, dword [0x581328]
mov eax, dword [eax]
mov edx, dword [eax + 0x48]
mov ebx, esi
mov eax, ebx
call fcn.0047709c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
call fcn.0040436c
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00474e8c
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
call fcn.00404970
lea ecx, [ebp - 0x14]
mov eax, dword [0x581328]
mov eax, dword [eax]
mov edx, dword [eax + 0x48]
mov eax, ebx
call fcn.00477180
mov eax, dword [ebp - 0x14]
xor edx, edx
call fcn.00404b0c
je 0x56fd2e
push dword [ebp - 0x10]
push 0x56fea8
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404ac4
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x10]
call fcn.0040436c
mov edx, dword [ebp - 0x24]
mov eax, 1
call fcn.00467fa0
mov eax, dword [0x581898]
cmp dword [eax], 2
jne 0x56fd5d
mov edx, dword [ebp - 0x10]
mov eax, 0xd
call fcn.00468000
mov dl, 1
mov eax, dword [0x413a44]
call fcn.00403344
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x56fe3b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x56feb4
call fcn.00404568
mov edx, eax
mov ecx, 6
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
push 0x56fec4
mov al, byte [0x56fecc]
push eax
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x464334]
call fcn.00465ab4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x56fdde
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56fde5
mov eax, dword [ebp - 0xc]
call fcn.00403374
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56fe9b
lea eax, [ebp - 0x24]
call fcn.004040f8
lea eax, [ebp - 0x20]
call fcn.004047a8
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040411c
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004047c0
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40752f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x5d40c8
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x407586
push esi
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x407586
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jne 0x407586
xor eax, eax
inc eax
jmp 0x407588
xor eax, eax
leave
ret 0x10

Function at 0x4075b1
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push edi
lea eax, [ebp - 4]
push eax
push 0x5d40c8
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
xor edi, edi
test eax, eax
jne 0x40761f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push str.DisableMMX
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407616
cmp dword [ebp - 0xc], 4
jne 0x407616
cmp dword [ebp - 0x10], edi
je 0x407616
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x61a240], edi
xor eax, eax
jmp 0x40765e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x61a240], edi
jge 0x407659
lea eax, [ebp - 0x34]
push eax
mov dword [0x61a240], edi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x34], di
jne 0x407659
cmp word [ebp - 0x14], 5
jb 0x407659
call fcn.0040758c
test eax, eax
je 0x407659
emms
mov dword [0x61a240], 1
mov eax, dword [0x61a240]
pop edi
leave
ret
Function at 0x40ad18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x14], eax
jae 0x40ae39
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
jae 0x40ae1d
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 8], edi
shr edi, 2
and edi, esi
mov dword [ebp + 0x10], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 8]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp + 0x10]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 8]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0xc]
add ecx, 8
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov esi, 0xffc03fc0
jne 0x40ad6f
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x14]
mov dword [ebp + 0xc], edx
jb 0x40ad4d
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 0x18
Function at 0x40b105
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x20]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1064]
push edi
mov edi, dword [esi + 0x1058]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x20]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x40b24c
mov edx, 0xf81f
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1060]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x40b227
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff07e0
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x1002]
mov ebp, eax
and ebp, 0xffff07e0
add ebp, ecx
mov ecx, edi
and ecx, 0xffff07e0
add ebp, ecx
mov ecx, esi
and ecx, 0xffff07e0
shr ebx, 2
lea ecx, [ecx + ebp + 0x40]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff07e0
lea eax, [eax + esi + 0x1002]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x40b16e
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1058]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1058]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x40b145
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x40b379
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x20]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1064]
mov edx, dword [esi + 0x20]
push edi
mov edi, dword [esi + 0x1058]
imul ebp, edi
add ebp, edx
cmp edx, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], ebp
jae 0x40b4bf
mov eax, 0x83e0
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1060]
lea esi, [edx + esi*2]
mov dword [esp + 0x10], ebx
add edi, edx
cmp edx, esi
mov ebx, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x40b49a
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx edx, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
and ebp, eax
mov ebx, edx
and ebx, eax
add ebx, ebp
mov ebp, edi
and ebp, eax
add ebx, ebp
mov dword [esp + 0x24], ecx
and ecx, 0x7c1f
mov ebp, esi
and ebp, eax
lea ebx, [ebx + ebp + 0x10040]
mov ebp, edx
and ebp, 0x7c1f
add ebp, ecx
mov ecx, edi
and ecx, 0x7c1f
add ebp, ecx
mov ecx, esi
and ecx, 0x7c1f
lea ecx, [ecx + ebp + 0x802]
shr ecx, 2
shr ebx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and ecx, eax
and edx, eax
add edx, ecx
and edi, eax
add edx, edi
mov edi, dword [esp + 0x1c]
and esi, eax
and ebx, 0xffff7c1f
lea ecx, [edx + esi + 0x10040]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [ecx], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x40b3e2
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1058]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1058]
lea edx, [edx + edi*2]
cmp edx, ebp
mov dword [esp + 0x20], edx
jb 0x40b3b9
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x40b4c8
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x20]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1064]
push edi
mov edi, dword [esi + 0x1058]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x20]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x40b612
mov edx, 0xf0f0
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1060]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x40b5ed
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff0f0f
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x2020]
mov ebp, eax
and ebp, 0xffff0f0f
add ebp, ecx
mov ecx, edi
and ecx, 0xffff0f0f
add ebp, ecx
mov ecx, esi
and ecx, 0xffff0f0f
shr ebx, 2
lea ecx, [ecx + ebp + 0x202]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff0f0f
lea eax, [eax + esi + 0x2020]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x40b531
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1058]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1058]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x40b508
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret