joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429e13
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
xor ebx, ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.00429f9f
lea edi, [esi + 0x474]
push ebx
mov ecx, esi
call fcn.00429fcf
mov dword [edi], eax
inc ebx
add edi, 4
cmp ebx, 0x200
jb 0x429e36
and dword [ebp - 4], 0
lea ebx, [esi + 0x74]
mov edi, 0x100
mov eax, dword [ebp - 4]
mov ecx, esi
add eax, 0x1000
push eax
call fcn.00429fcf
inc dword [ebp - 4]
mov dword [ebx], eax
add ebx, 4
cmp dword [ebp - 4], edi
jb 0x429e58
and dword [ebp - 4], 0
lea ebx, [esi + 0xc74]
mov eax, dword [ebp - 4]
mov ecx, esi
add eax, 0x2000
push eax
call fcn.00429fcf
inc dword [ebp - 4]
mov dword [ebx], eax
add ebx, 4
cmp dword [ebp - 4], 0x10
jb 0x429e7f
mov ecx, esi
call fcn.004299c9
and dword [esi + 0x1db4], 0
xor eax, eax
or cl, 0xff
sub cl, al
mov byte [ebp + eax - 0x110], cl
inc eax
cmp eax, edi
jb 0x429ead
and dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
cmp dword [ebp - 4], 0x14
jge 0x429f28
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, 0x14
mov dword [ebp - 0x10], eax
jge 0x429f1f
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov ebx, edi
movzx eax, byte [eax + ecx]
movzx edx, byte [ecx + edx - 1]
add eax, edx
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ecx - 1]
xor eax, edx
cdq
idiv ebx
mov eax, dword [ebp - 0xc]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
mov byte [ebp + eax - 0x210], dl
jge 0x429f31
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x14
jl 0x429ee4
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x15
jl 0x429ed6
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jb 0x429ec9
xor eax, eax
mov dword [ebp + 8], eax
movzx ecx, byte [ebp + eax - 0x210]
cmp eax, ecx
je 0x429f5b
lea ecx, [ebp + ecx - 0x110]
lea eax, [ebp + eax - 0x110]
mov bl, byte [ecx]
mov dl, byte [eax]
mov byte [eax], bl
mov eax, dword [ebp + 8]
mov byte [ecx], dl
inc eax
cmp eax, edi
mov dword [ebp + 8], eax
jl 0x429f36
cmp byte [ebp + 0xc], 0
je 0x429f82
lea eax, [ebp - 0x110]
push edi
add esi, 0x1cb4
push eax
push esi
call fcn.0047f2d6
add esp, 0xc
jmp 0x429f98
xor eax, eax
movzx ecx, byte [ebp + eax - 0x110]
mov byte [ecx + esi + 0x1cb4], al
inc eax
cmp eax, edi
jb 0x429f84
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x42fe41
Capabilities:
Get number of processors

Disassembly:
mov eax, 0x483f60
call fcn.0047f2b0
push ecx
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
mov dword [ebp - 0x10], esi
call fcn.0042cf72
lea ecx, [esi + 0x28]
mov dword [ebp - 4], ebx
call fcn.0042d363
push 0xf
mov dword [esi], 0x48f5e8
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], 0x64
mov dword [esi + 0x24], ebx
mov dword [esi + 0x30], 0xff000000
call dword [0x4877e0]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x34], eax
mov dword [esi + 0x18], 0xff000000
mov dword [esi + 0x2c], ebx
mov byte [esi + 0x3c], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x10], 0x24
mov byte [esi + 0x14], 1
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x43791d
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x4848c7
call fcn.0047f2b0
push ecx
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0042cb9c
mov dword [esi], 0x487c14
lea ecx, [esi + 0x14]
mov dword [ebp - 4], edi
call fcn.0042d363
push edi
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 1
call fcn.0042cb9c
push edi
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 2
call fcn.0042cb9c
lea ebx, [esi + 0x4c]
push edi
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.0042cb9c
mov dword [ebx], 0x487c40
push edi
lea ecx, [esi + 0x58]
mov byte [ebp - 4], 4
call fcn.0042cb9c
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 5
mov dword [esi], 0x48f638
mov dword [esi + 0xc], 0x9f
mov dword [esi + 0x30], edi
mov dword [esi + 0x64], edi
call fcn.00455e66
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x44224c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4856d5
call fcn.0047f2b0
push ecx
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0042cb9c
mov dword [esi], 0x487c14
lea ecx, [esi + 0x24]
mov dword [ebp - 4], edi
call fcn.0042d363
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 1
call fcn.0042d363
push fcn.0043b26a
push 0x419ca4
lea eax, [esi + 0x44]
push 7
push 0xc
push eax
mov byte [ebp - 4], 2
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
call fcn.0047f493
lea ebx, [esi + 0x98]
push edi
mov ecx, ebx
mov byte [ebp - 4], 3
call fcn.0042cb9c
mov edi, 0x487c3c
mov dword [ebx], edi
lea ebx, [esi + 0xa4]
push 0
mov ecx, ebx
mov byte [ebp - 4], 4
call fcn.0042cb9c
mov dword [ebx], edi
and byte [esi + 0x13], 0
mov ecx, esi
mov byte [ebp - 4], 5
mov dword [esi], 0x48f7e0
mov dword [esi + 0xc], 0xae
call fcn.00442a50
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x444530
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x485992
call fcn.0047f2b0
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.0044d062
xor ebx, ebx
lea ecx, [esi + 0x88]
mov dword [ebp - 4], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x70], ebx
call fcn.0042af67
lea ecx, [esi + 0xa4]
mov byte [ebp - 4], 1
call fcn.0042af67
lea ecx, [esi + 0xcc]
mov byte [ebp - 4], 2
call fcn.0045ad77
lea ecx, [esi + 0x18c]
mov byte [ebp - 4], 3
call fcn.0045a0da
lea edi, [esi + 0x240]
mov byte [ebp - 4], 4
lea ecx, [edi + 8]
call fcn.0042d363
mov dword [edi], 0x48f818
mov dword [edi + 4], ebx
lea ecx, [esi + 0x250]
mov byte [ebp - 4], 5
call fcn.0042b32b
push 0x4ac8a0
push 0x4ac674
push 2
push 0x4b4d28
mov byte [ebp - 4], 6
mov dword [esi], 0x48f7f4
call fcn.0041d96d
push 0x3bd8
call fcn.0047f2dc
mov ecx, eax
add esp, 0x14
mov dword [ebp - 0x14], ecx
cmp ecx, ebx
mov byte [ebp - 4], 7
je 0x4445f7
call fcn.0043074a
jmp 0x4445f9
xor eax, eax
mov byte [ebp - 4], 6
mov dword [esi + 0xc], eax
mov byte [esi + 0xa0], bl
mov byte [esi + 0xbc], bl
mov byte [esi + 0xbd], bl
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc8], ebx
call fcn.0044f520
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0xc5], bl
mov word [esi + 0x84], bx
mov dword [esi + 0x3c], ebx
mov byte [esi + 0x30], bl
mov byte [esi + 0xc4], bl
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x44871b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x40]
push ebx
push esi
mov esi, dword [edx + 4]
mov ebx, dword [edx]
push edi
mov edi, dword [ecx + 0x48]
imul eax, ebx
imul edi, esi
add eax, edi
mov edi, dword [edx + 8]
mov edx, dword [edx + 0xc]
add eax, dword [ecx + 8]
sub edx, esi
mov esi, dword [ecx + 0x44]
sub edi, ebx
sub esi, edi
test edx, edx
jle 0x4487a5
shl esi, 2
mov dword [ebp - 8], esi
mov dword [ebp - 4], edx
test edi, edi
jle 0x44879d
mov dword [ebp + 8], edi
mov edx, dword [eax]
add eax, 4
mov esi, edx
mov ebx, edx
shr esi, 0xd
and esi, 0xff
and ebx, 0xff
xor esi, ebx
mov esi, dword [ecx + esi*4 + 0x8a8]
jmp 0x448789
cmp dword [esi + 8], edx
je 0x4487ac
mov esi, dword [esi]
test esi, esi
jne 0x448782
or dl, 0xff
mov esi, dword [ebp + 0xc]
inc dword [ebp + 0xc]
dec dword [ebp + 8]
mov byte [esi], dl
jne 0x44875f
add eax, dword [ebp - 8]
dec dword [ebp - 4]
jne 0x448758
pop edi
pop esi
pop ebx
leave
ret 0xc
mov dl, byte [esi + 4]
jmp 0x448790
Function at 0x44b2fb
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x485eb2
call fcn.0047f2b0
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
push ebx
mov dword [ebp - 0x10], esi
call fcn.0042cb9c
mov dword [esi], 0x487c14
push fcn.0043b26a
push 0x419ca4
push 5
lea eax, [esi + 0x30]
push 0xc
push eax
mov dword [ebp - 4], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
call fcn.0047f493
lea edi, [esi + 0x6c]
push ebx
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0042cb9c
mov ecx, dword [ebp - 0xc]
mov dword [edi], 0x487c40
mov dword [esi], 0x48f850
mov byte [esi + 0x10], bl
mov dword [esi + 0xc], 0xad
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x455f3b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esi + 0x74], eax
mov eax, dword [esi + 0x8c]
cmp ecx, eax
jbe 0x455f5e
mov ecx, eax
test ecx, ecx
mov dword [esi + 0x78], ecx
je 0x4560eb
xor edi, edi
cmp dword [esi + 0x6c], edi
jne 0x455ff8
mov eax, dword [esi + 0x88]
cmp eax, edi
je 0x455ff8
mov ebx, 0x4000
cmp eax, ebx
jae 0x455f91
mov ebx, eax
cmp ebx, edi
je 0x4560f3
push ebx
push dword [esi + 0x64]
push esi
call fcn.00457a33
add esp, 0xc
test eax, eax
je 0x456109
sub dword [esi + 0x88], ebx
mov eax, dword [esi + 0x64]
test byte [esi + 0x3c], 1
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], ebx
je 0x455ff8
test ebx, ebx
jbe 0x455ff8
mov eax, dword [esi + 0x98]
mov ecx, dword [esi + 0x64]
and eax, 0xfffd
add ecx, edi
or al, 2
mov edx, eax
xor edx, 1
imul edx, eax
shr edx, 8
xor byte [ecx], dl
mov eax, dword [esi + 0x64]
mov al, byte [edi + eax]
push eax
lea eax, [esi + 0x90]
push eax
call fcn.00456223
inc edi
pop ecx
cmp edi, ebx
pop ecx
jb 0x455fbf
mov eax, dword [esi + 0x9c]
mov ecx, dword [esi + 0x6c]
cmp eax, ecx
jbe 0x456007
mov eax, ecx
test eax, eax
je 0x456036
mov edx, dword [esi + 0x68]
sub ecx, eax
lea edi, [edx + eax]
mov dl, byte [edi - 1]
sub dword [esi + 0x8c], eax
sub dword [esi + 0x9c], eax
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x68], edi
jne 0x456036
cmp dl, byte [esi + 0xa0]
jne 0x456112
cmp word [esi + 0x3e], 0
jne 0x45608b
mov eax, dword [esi + 0x78]
mov edi, dword [esi + 0x6c]
cmp eax, edi
jae 0x456049
mov edi, eax
push edi
push dword [esi + 0x68]
push dword [esi + 0x74]
call fcn.0047f2d6
push edi
lea ebx, [esi + 0x84]
push dword [esi + 0x74]
push dword [ebx]
call fcn.0045611b
sub dword [esi + 0x8c], edi
sub dword [esi + 0x6c], edi
sub dword [esi + 0x78], edi
add dword [esi + 0x74], edi
add dword [esi + 0x68], edi
add dword [esi + 0x7c], edi
add esp, 0x18
add dword [ebp - 4], edi
mov dword [ebx], eax
mov eax, dword [esi + 0x8c]
jmp 0x4560dd
mov eax, dword [esi + 0x74]
mov ebx, dword [esi + 0x7c]
mov dword [ebp + 8], eax
lea eax, [esi + 0x68]
push 2
push eax
call fcn.00456277
pop ecx
mov dword [ebp + 0xc], eax
test eax, eax
pop ecx
je 0x4560ad
cmp eax, 1
jne 0x4560fe
mov edi, dword [esi + 0x7c]
sub edi, ebx
lea ebx, [esi + 0x84]
push edi
push dword [ebp + 8]
push dword [ebx]
call fcn.0045611b
sub dword [esi + 0x8c], edi
add dword [ebp - 4], edi
add esp, 0xc
cmp dword [ebp + 0xc], 1
mov dword [ebx], eax
mov eax, dword [esi + 0x8c]
je 0x4560eb
test eax, eax
je 0x4560eb
cmp dword [esi + 0x78], 0
jne 0x455f69
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [esi + 0x84]
cmp eax, dword [esi + 0x44]
je 0x456105
mov dword [esi + 8], 0x12
xor eax, eax
jmp 0x4560ee
mov dword [esi + 8], 7
jmp 0x456105
mov dword [esi + 8], 0x13
jmp 0x456105
Function at 0x45611b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edx, 0xff
not eax
jb 0x4561fc
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [ecx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, edx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x48fba0]
xor eax, ebx
inc ecx
mov esi, eax
movzx ebx, byte [ecx]
and esi, edx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x48fba0]
xor esi, eax
inc ecx
mov eax, esi
movzx ebx, byte [ecx]
and eax, edx
xor eax, ebx
shr esi, 8
mov eax, dword [eax*4 + 0x48fba0]
xor eax, esi
inc ecx
mov esi, eax
movzx ebx, byte [ecx]
and esi, edx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x48fba0]
xor esi, eax
inc ecx
mov eax, esi
movzx ebx, byte [ecx]
and eax, edx
xor eax, ebx
shr esi, 8
mov eax, dword [eax*4 + 0x48fba0]
xor eax, esi
inc ecx
mov esi, eax
movzx ebx, byte [ecx]
and esi, edx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x48fba0]
xor esi, eax
inc ecx
mov eax, esi
movzx ebx, byte [ecx]
and eax, edx
xor eax, ebx
shr esi, 8
mov eax, dword [eax*4 + 0x48fba0]
xor eax, esi
inc ecx
mov esi, eax
movzx ebx, byte [ecx]
and esi, edx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x48fba0]
xor eax, esi
inc ecx
dec edi
jne 0x45613e
pop ebx
cmp dword [ebp + 0x10], 0
je 0x45621d
movzx edi, byte [ecx]
mov esi, eax
and esi, edx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x48fba0]
xor eax, esi
inc ecx
dec dword [ebp + 0x10]
jne 0x456202
pop edi
pop esi
not eax
pop ebp
ret

Function at 0x456223
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [esp + 4]
push esi
push edi
mov edx, 0xff
mov esi, dword [ecx]
movzx edi, byte [esp + 0x10]
mov eax, esi
and eax, edx
xor eax, edi
shr esi, 8
mov eax, dword [eax*4 + 0x48fba0]
xor eax, esi
mov dword [ecx], eax
and eax, edx
add eax, dword [ecx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [ecx + 4], eax
mov eax, dword [ecx + 8]
movzx esi, byte [ecx + 7]
mov edi, eax
and edi, edx
xor esi, edi
pop edi
shr eax, 8
mov edx, dword [esi*4 + 0x48fba0]
pop esi
xor edx, eax
mov dword [ecx + 8], edx
ret
Function at 0x45abb6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
test edi, edi
je 0x45abe0
movzx eax, word [esi + 4]
movzx ecx, word [esi + 6]
shr eax, 3
imul eax, ecx
imul eax, dword [esi + 0x78]
cmp ebx, eax
jbe 0x45abf9
push 0x1be
push 0x4ae55c
lea ecx, [ebp - 8]
call fcn.00428131
mov ecx, eax
call fcn.0042823d
mov ax, word [esi + 4]
cmp ax, 0x10
jne 0x45ac40
test bl, 1
je 0x45ac21
push 0x1c2
push 0x4ae55c
lea ecx, [ebp - 8]
call fcn.00428131
mov ecx, eax
call fcn.0042823d
shr ebx, 1
xor eax, eax
test ebx, ebx
jle 0x45ac83
movsx ecx, word [edi + eax*2]
mov dword [ebp + 8], ecx
mov ecx, dword [esi + 0x7c]
fild dword [ebp + 8]
fstp dword [ecx + eax*4]
inc eax
cmp eax, ebx
jl 0x45ac29
jmp 0x45ac83
cmp ax, 8
je 0x45ac5f
push 0x1ca
push 0x4ae55c
lea ecx, [ebp - 8]
call fcn.00428131
mov ecx, eax
call fcn.0042823d
xor eax, eax
test ebx, ebx
jbe 0x45ac83
movsx ecx, byte [eax + edi]
xor ecx, 0x80
shl ecx, 8
mov dword [ebp + 8], ecx
mov ecx, dword [esi + 0x7c]
fild dword [ebp + 8]
fstp dword [ecx + eax*4]
inc eax
cmp eax, ebx
jb 0x45ac65
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x45c4a0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x45c4d0
push esi
call fcn.004602f0
mov al, byte [esi + 0x40]
add esp, 4
test al, al
je 0x45c4c9
mov dword [esi + 0x14], 0xcf
mov al, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x45c553
mov eax, dword [esi + 0x190]
mov cl, byte [eax + 0x10]
test cl, cl
je 0x45c53f
mov eax, dword [esi + 8]
test eax, eax
je 0x45c4f4
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x190]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45c53b
cmp eax, 2
je 0x45c53f
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45c4e7
cmp eax, 3
je 0x45c51a
cmp eax, 1
jne 0x45c4e7
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x45c4e7
mov edx, dword [esi + 0x11c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45c4e7
xor al, al
pop esi
ret
mov eax, dword [esi + 0x7c]
push esi
mov dword [esi + 0x84], eax
call fcn.0045c580
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x45c573
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x14
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.0045c580
add esp, 4
pop esi
ret
Function at 0xfb1790
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
xor eax, eax
cmp dword [esp + 0x20], 0
je 0xfb1860
mov ebx, dword [esp + 0x24]
test ebx, ebx
je 0xfb1860
mov ebp, dword [esp + 0x28]
mov esi, 0x1505
test ebp, ebp
je 0xfb17dd
xor edi, edi
nop
movzx ecx, byte [ebx + edi]
test ecx, ecx
je 0xfb17dd
mov edx, esi
shl edx, 5
add edx, esi
mov esi, edx
and esi, ecx
xor edx, ecx
lea esi, [edx + esi*2]
inc edi
cmp ebp, edi
jne 0xfb17c0
mov ecx, dword [esp + 0x20]
mov ebx, dword [ecx + 0x20]
lea edi, [ebx - 1]
mov edx, ebx
sub edx, 1
mov dword [esp + 8], edx
jb 0xfb1860
and edi, esi
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
jmp 0xfb1804
inc edi
dec ebx
je 0xfb185e
mov eax, edi
and eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ebp, dword [edx + eax*4]
cmp ebp, 0xffffffff
je 0xfb185e
mov eax, dword [ecx + 8]
cmp dword [eax + ebp*4], esi
jne 0xfb1800
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + ebp*4]
mov dword [esp], eax
push eax
call fcn.00fb91a0
mov ecx, dword [esp + 0x24]
add esp, 4
cmp eax, dword [esp + 0x28]
jne 0xfb1800
push dword [esp + 0x28]
push dword [esp + 4]
push dword [esp + 0x2c]
call fcn.00fb91c0
mov ecx, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jne 0xfb1800
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + ebp*4]
jmp 0xfb1860
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xfb99b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, dword [ecx]
cmp eax, 0x270
jne 0xfb9a3e
xor eax, eax
mov edx, 0x80000000
nop
nop
nop
nop
nop
nop
nop
nop
lea esi, [eax + 0x270]
mov edi, esi
not edi
and edi, 0x270
and esi, 0x58f
sub esi, edi
mov edi, dword [ecx + esi*4 + 8]
lea ebp, [edi - 0x80000000]
mov ebx, edi
or ebx, 0x7ffffffe
and ebx, ebp
mov ebp, dword [ecx + esi*4 + 4]
and ebp, edx
or ebx, ebp
mov ebp, esi
and ebp, 0x18d
xor esi, 0x18d
lea esi, [esi + ebp*2]
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + esi*4 + 4]
shr ebx, 1
xor edi, ebx
mov dword [ecx + eax*4 + 0x9c4], edi
inc eax
cmp eax, 0x270
jne 0xfb99d0
mov eax, 0x270
jmp 0xfb9a50
cmp eax, 0x4e0
jb 0xfb9a50
mov esi, ecx
call fcn.00fb9aa0
mov ecx, esi
mov eax, dword [esi]
lea edx, [eax + 1]
mov dword [ecx], edx
mov edx, dword [ecx + eax*4 + 4]
mov eax, edx
shr eax, 0xb
and eax, dword [ecx + 0x1384]
xor eax, edx
mov ecx, eax
shl ecx, 7
and ecx, 0x9d2c5680
mov edx, ecx
and edx, eax
add edx, edx
sub ecx, edx
add ecx, eax
mov edx, ecx
shl edx, 0xf
and edx, 0xefc60000
xor edx, ecx
mov eax, edx
shr eax, 0x12
xor eax, edx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0xfb9aa0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
xor eax, eax
mov edx, 0x80000000
nop
nop
nop
nop
nop
mov edi, eax
and edi, 0x70
mov esi, eax
or esi, 0x270
add esi, edi
mov ebp, dword [ecx + esi*4 + 4]
and ebp, edx
mov edi, dword [ecx + esi*4 + 8]
mov ebx, edi
and ebx, 0x7ffffffe
or ebx, ebp
shr ebx, 1
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + esi*4 + 0x638]
xor edi, ebx
mov dword [ecx + eax*4 + 4], edi
inc eax
cmp eax, 0xe3
jne 0xfb9ab0
mov esi, dword [ecx + 0xd50]
mov eax, 0x355
and esi, 0x80000000
mov edi, dword [ecx + eax*4]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4 - 0xd50]
xor edi, edx
mov dword [ecx + eax*4 - 0x9c4], edi
inc eax
cmp eax, 0x4e1
jne 0xfb9b00
mov edx, 0x80000000
and edx, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov esi, eax
and esi, 0x7fffffff
or edx, esi
shr edx, 1
xor eax, 0x7ffffffe
and eax, esi
je 0xfb9b62
mov eax, 0x9908b0df
mov esi, eax
and esi, edx
add eax, edx
add esi, esi
sub eax, esi
xor eax, dword [ecx + 0x634]
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xfbac00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
push eax
sub esp, 8
mov dword [ebp - 0x14], esp
sub esp, 0x40
mov dword [ebp - 0x1c], esp
sub esp, 0x80
mov dword [ebp - 0x20], esp
mov eax, dword [0xff9d3c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x234], 0xc1c6cfc4
mov word [ebp - 0x230], 0
xor ecx, ecx
nop
mov edx, ecx
not edx
movzx esi, byte [ebp + ecx - 0x234]
lea ebx, [ecx + 0xd1]
mov edi, 0x2e
sub edi, ecx
xor ebx, edi
and ebx, esi
xor ebx, edi
mov al, 0xea
sub al, bl
mov byte [ebp + ecx - 0x234], al
and edx, 6
mov eax, ecx
and eax, 1
xor ecx, 0xfffffffe
or ecx, edx
not ecx
lea ecx, [ecx + eax*2]
cmp ecx, 6
jb 0xfbac40
mov ecx, dword [ebp - 0x234]
mov dword [ebp - 0x1b4], 0x63f161f7
mov dword [ebp - 0x1b0], 0x67c965b6
mov dword [ebp - 0x1ac], 0x5b88598b
mov dword [ebp - 0x1a8], 0x5ffa5d82
mov dword [ebp - 0x1a4], 0x53ce51cc
mov word [ebp - 0x1a0], 0x5554
mov dword [ebp - 0x19e], 0
mov byte [ebp - 0x19a], 0
mov edx, 0x5bcc3c98
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [ebp + edx - 0x5bcc3e4c]
xor ebx, edx
mov esi, ebx
and esi, 5
mov eax, ebx
and eax, 2
mov edi, eax
xor edi, 2
imul edi, esi
or esi, 2
imul esi, eax
xor ebx, 7
add ebx, edi
add ebx, esi
inc bl
mov byte [ebp + edx - 0x5bcc3e4c], bl
inc edx
cmp edx, 0x5bcc3cb3
jne 0xfbace0
lea esi, [ebp - 0x1b4]
push ecx
push 0
push esi
call dword [ebp - 0x10]
mov ecx, 0xff9d40
push eax
call 0xfea5b0
movzx eax, al
mov eax, dword [eax*4 + 0xff3958]
mov ecx, 0x7bbfa073
xor ecx, dword [0xff3960]
add eax, ecx
inc eax
xor ebx, ebx
jmp eax