joyce8/EMBER2024-capa huggingface dataset:
Function at 0xbc2490
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0xbc2591
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0xbc2591
push ebx
call fcn.00bc9720
add esp, 4
test eax, eax
je 0xbc24ea
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0xbc24f1
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0xbc24d0
jmp 0xbc24f3
mov esi, 0x1505
jmp 0xbc24f3
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0xbc2591
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0xbc2524
inc ebp
dec ebx
je 0xbc258f
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0xbc258f
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0xbc2520
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.00bc9720
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0xbc2520
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00bc9740
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0xbc2520
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0xbc258f
cmp dword [eax + 4], 2
mov edi, 0
jne 0xbc2591
mov edi, dword [eax + 8]
jmp 0xbc2591
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0xbc25c0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
fldz
fstp qword [esp + 0x10]
cmp dword [esp + 0x2c], 0
je 0xbc262b
mov esi, dword [esp + 0x30]
test esi, esi
je 0xbc262b
push esi
call fcn.00bc9720
add esp, 4
test eax, eax
je 0xbc260a
mov ecx, 0x1505
xor edi, edi
movzx edx, byte [esi + edi]
test edx, edx
je 0xbc2611
mov ebp, ecx
shl ebp, 5
add ebp, ecx
add ebp, edx
inc edi
mov ecx, ebp
cmp eax, edi
jne 0xbc25f0
jmp 0xbc2613
mov ebp, 0x1505
jmp 0xbc2613
mov ebp, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x2c]
mov edi, dword [ecx + 0x20]
lea ebx, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0xbc2637
fld qword [esp + 0x10]
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
and ebx, ebp
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0xbc2654
inc ebx
dec edi
je 0xbc262b
mov eax, ebx
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0xbc262b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebp
jne 0xbc2650
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.00bc9720
mov ecx, dword [esp + 0x30]
add esp, 4
cmp eax, dword [esp]
jne 0xbc2650
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x38]
call fcn.00bc9740
mov ecx, dword [esp + 0x38]
add esp, 0xc
test eax, eax
jne 0xbc2650
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + esi*4]
test eax, eax
je 0xbc262b
cmp dword [eax + 4], 3
jne 0xbc262b
fld qword [eax + 8]
fstp qword [esp + 0x10]
jmp 0xbc262b
Function at 0xbc26f0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor edi, edi
cmp dword [esp + 0x24], 0
je 0xbc27f1
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0xbc27f1
push ebx
call fcn.00bc9720
add esp, 4
test eax, eax
je 0xbc274a
mov ecx, 0x1505
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [ebx + ebp]
test edx, edx
je 0xbc2751
mov esi, ecx
shl esi, 5
add esi, ecx
add esi, edx
inc ebp
mov ecx, esi
cmp eax, ebp
jne 0xbc2730
jmp 0xbc2753
mov esi, 0x1505
jmp 0xbc2753
mov esi, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov ebx, dword [ecx + 0x20]
lea ebp, [ebx - 1]
mov eax, ebx
sub eax, 1
mov dword [esp + 0xc], eax
jb 0xbc27f1
and ebp, esi
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0xbc2784
inc ebp
dec ebx
je 0xbc27ef
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov edi, dword [edx + eax*4]
cmp edi, 0xffffffff
je 0xbc27ef
mov eax, dword [ecx + 8]
cmp dword [eax + edi*4], esi
jne 0xbc2780
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + edi*4]
mov dword [esp + 4], eax
push eax
call fcn.00bc9720
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0xbc2780
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00bc9740
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0xbc2780
mov eax, dword [ecx + 0x10]
mov eax, dword [eax + edi*4]
test eax, eax
je 0xbc27ef
cmp dword [eax + 4], 5
mov edi, 0
jne 0xbc27f1
mov edi, dword [eax + 8]
jmp 0xbc27f1
xor edi, edi
mov eax, edi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0xbc2b20
Capabilities:
Hash data using djb2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
xor eax, eax
cmp dword [esp + 0x24], 0
je 0xbc2b8d
mov esi, dword [esp + 0x28]
test esi, esi
je 0xbc2b8d
push esi
call fcn.00bc9720
add esp, 4
test eax, eax
je 0xbc2b6a
mov ecx, 0x1505
xor edi, edi
nop
nop
nop
nop
movzx edx, byte [esi + edi]
test edx, edx
je 0xbc2b71
mov ebx, ecx
shl ebx, 5
add ebx, ecx
add ebx, edx
inc edi
mov ecx, ebx
cmp eax, edi
jne 0xbc2b50
jmp 0xbc2b73
mov ebx, 0x1505
jmp 0xbc2b73
mov ebx, ecx
mov dword [esp], eax
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + 0x20]
lea ebp, [edi - 1]
mov eax, edi
sub eax, 1
mov dword [esp + 0xc], eax
jae 0xbc2b95
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
and ebp, ebx
mov eax, dword [ecx + 4]
mov dword [esp + 8], eax
jmp 0xbc2ba4
inc ebp
dec edi
je 0xbc2b8b
mov eax, ebp
and eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov esi, dword [edx + eax*4]
cmp esi, 0xffffffff
je 0xbc2b8b
mov eax, dword [ecx + 8]
cmp dword [eax + esi*4], ebx
jne 0xbc2ba0
mov eax, dword [ecx + 0xc]
mov eax, dword [eax + esi*4]
mov dword [esp + 4], eax
push eax
call fcn.00bc9720
mov ecx, dword [esp + 0x28]
add esp, 4
cmp eax, dword [esp]
jne 0xbc2ba0
push dword [esp]
push dword [esp + 8]
push dword [esp + 0x30]
call fcn.00bc9740
mov ecx, dword [esp + 0x30]
add esp, 0xc
test eax, eax
jne 0xbc2ba0
mov eax, dword [ecx + 0x10]
mov ecx, dword [eax + esi*4]
test ecx, ecx
mov eax, 0
je 0xbc2b8d
xor eax, eax
mov edx, dword [esp + 0x2c]
cmp dword [ecx + 4], edx
sete al
jmp 0xbc2b8d
Function at 0xbc9120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
je 0xbc913b
mov ebx, dword [esp + 0x18]
cmp eax, 1
jne 0xbc9143
mov word [ebx], 1
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
movzx ecx, word [ebx + 4]
add word [ebx], cx
cmp eax, 3
jl 0xbc91db
mov edx, 2
mov ecx, 2
sub ecx, eax
mov dword [esp], ecx
xor edi, edi
mov ebx, 1
jmp 0xbc9189
movzx ebp, word [esi + edi*4]
add word [esi + ebx*4], bp
mov word [esi + edi*4], bx
inc edi
mov ecx, dword [esp]
add ecx, ebx
inc ecx
inc ebx
cmp ecx, 1
je 0xbc91ea
mov esi, dword [esp + 0x18]
movzx ecx, word [esi + edi*4]
cmp edx, eax
jge 0xbc919e
movzx ebp, word [esi + edx*4]
cmp cx, bp
jae 0xbc91b0
mov word [esi + ebx*4], cx
mov word [esi + edi*4], bx
inc edi
cmp edx, eax
jge 0xbc9170
jmp 0xbc91b9
inc edx
mov word [esi + ebx*4], bp
cmp edx, eax
jge 0xbc9170
cmp edi, ebx
jge 0xbc91d0
movzx ebp, word [esi + edi*4]
movzx ecx, word [esi + edx*4]
cmp bp, cx
jb 0xbc9174
jmp 0xbc91d4
movzx ecx, word [esi + edx*4]
inc edx
add word [esi + ebx*4], cx
jmp 0xbc917d
lea edx, [eax - 2]
mov word [ebx + eax*4 - 8], 0
jmp 0xbc9272
lea edx, [eax - 2]
mov ebx, dword [esp + 0x18]
mov word [ebx + eax*4 - 8], 0
cmp eax, 3
jl 0xbc9272
lea edi, [eax - 3]
mov ebp, ebx
mov ebx, eax
and ebx, 3
xor ebx, 2
mov esi, edi
je 0xbc9224
mov esi, edi
movzx ecx, word [ebp + esi*4]
movzx ecx, word [ebp + ecx*4]
inc ecx
mov word [ebp + esi*4], cx
dec esi
dec ebx
jne 0xbc9210
mov ebx, dword [esp + 0x18]
cmp edi, 3
jb 0xbc9272
nop
nop
nop
movzx ecx, word [ebx + esi*4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4], cx
movzx ecx, word [ebx + esi*4 - 4]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 4], cx
movzx ecx, word [ebx + esi*4 - 8]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 8], cx
movzx ecx, word [ebx + esi*4 - 0xc]
movzx ecx, word [ebx + ecx*4]
inc ecx
mov word [ebx + esi*4 - 0xc], cx
add esi, 0xfffffffc
cmp esi, 0xffffffff
jne 0xbc9230
dec eax
mov ecx, 1
xor esi, esi
jmp 0xbc928c
lea ecx, [edi + edi]
inc esi
test edi, edi
je 0xbc913b
test edx, edx
mov dword [esp], ecx
js 0xbc92c0
lea edi, [edx + 1]
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx ecx, word [ebx + edx*4]
cmp esi, ecx
jne 0xbc92d0
inc ebp
dec edx
cmp edi, ebp
jne 0xbc92a0
mov edx, 0xffffffff
jmp 0xbc92d2
xor edi, edi
jmp 0xbc92d5
mov edi, ebp
mov ecx, dword [esp]
mov ebp, ecx
sub ebp, edi
jle 0xbc9280
and ebp, 3
je 0xbc9308
lea ecx, [ebx + eax*4]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ecx], si
inc ebx
add ecx, 0xfffffffc
cmp ebp, ebx
jne 0xbc92f0
mov ebp, dword [esp]
sub ebp, ebx
sub eax, ebx
mov ebx, dword [esp + 0x18]
jmp 0xbc930a
mov ebp, ecx
mov ecx, edi
sub ecx, dword [esp]
cmp ecx, 0xfffffffc
ja 0xbc9280
nop
nop
nop
nop
nop
nop
nop
nop
mov word [ebx + eax*4], si
mov word [ebx + eax*4 - 4], si
mov word [ebx + eax*4 - 8], si
mov word [ebx + eax*4 - 0xc], si
add eax, 0xfffffffc
add ebp, 0xfffffffc
cmp ebp, edi
jg 0xbc9320
jmp 0xbc9280
Function at 0xbc9d30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push edi
push esi
mov eax, dword [0xc0736c]
cmp eax, 0x270
jne 0xbc9da6
xor eax, eax
mov ecx, 0x80000000
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
lea edx, [eax + 0x270]
mov edi, dword [eax*4 + 0xc07370]
and edi, ecx
and edx, 1
mov esi, eax
or esi, 1
add esi, edx
mov edx, dword [esi*4 + 0xc07370]
mov esi, edx
and esi, 0x7ffffffe
or esi, edi
shr esi, 1
and edx, 1
neg edx
and edx, 0x9908b0df
xor edx, dword [eax*4 + 0xc079a4]
xor edx, esi
mov dword [eax*4 + 0xc07d30], edx
inc eax
cmp eax, 0x270
jne 0xbc9d50
mov eax, 0x270
jmp 0xbc9dbc
cmp eax, 0x4e0
jb 0xbc9dbc
mov ecx, 0xc0736c
call fcn.00bc9ff0
mov eax, dword [0xc0736c]
lea ecx, [eax + 1]
mov dword [0xc0736c], ecx
mov eax, dword [eax*4 + 0xc07370]
mov ecx, eax
shr ecx, 0xb
and ecx, dword [0xc086f0]
xor ecx, eax
mov eax, ecx
shl eax, 7
and eax, 0x9d2c5680
xor eax, ecx
mov ecx, eax
shl ecx, 0xf
and ecx, 0xefc40000
xor ecx, eax
shr ecx, 0x12
and eax, 0x7fff
xor eax, ecx
pop esi
pop edi
ret

Function at 0xbc9ff0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [ecx + 0x9c4]
mov eax, 0x3fe
nop
and esi, 0x80000000
mov edi, dword [ecx + eax*4 - 0x630]
mov edx, edi
and edx, 0x7ffffffe
or edx, esi
shr edx, 1
mov esi, edi
and edi, 1
neg edi
and edi, 0x9908b0df
xor edi, dword [ecx + eax*4]
xor edi, edx
mov dword [ecx + eax*4 - 0xff4], edi
inc eax
cmp eax, 0x4e1
jne 0xbca000
mov eax, 0x353
mov edi, 0x1c6
mov esi, 0x7fffffff
jmp 0xbca085
shr ebx, 1
xor ebx, edx
mov ebp, dword [ecx + eax*4 - 0xd48]
mov edx, ebx
xor edx, 0xffad4587
xor ebx, 0x52ba78
or ebx, ebp
not ebp
or ebp, edx
and ebx, ebp
not ebx
mov dword [ecx + eax*4 - 0x9bc], ebx
inc eax
add edi, 2
cmp eax, 0x4df
je 0xbca0bb
mov edx, dword [ecx + eax*4 + 4]
mov ebx, edx
not ebx
or ebx, 0x80000000
add edx, ebx
inc edx
mov ebx, edi
and ebx, 2
mov ebp, eax
xor ebp, 1
add ebp, ebx
mov ebx, dword [ecx + ebp*4 + 4]
and ebx, esi
or ebx, edx
mov edx, 0xffad4587
test bl, 1
je 0xbca050
mov edx, 0x66a5f558
jmp 0xbca050
mov esi, 0x80000000
and esi, dword [ecx + 0x1380]
mov eax, dword [ecx + 4]
mov edx, eax
and edx, 0x7ffffffe
or edx, esi
and eax, 1
neg eax
and eax, 0x9908b0df
xor eax, dword [ecx + 0x634]
shr edx, 1
xor eax, edx
mov dword [ecx + 0x9c0], eax
mov dword [ecx], 0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xc28e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
lea eax, [esp + 8]
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.00c2eda0
add esp, 0x14
test eax, eax
js 0xc28f23
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x28]
call fcn.00c2f180
add esp, 0x24
xor ebx, ebx
mov esi, 0
test eax, eax
js 0xc28e9c
mov ebp, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0xc28e6a
mov eax, 0xffffffff
jmp 0xc28e71
lea eax, [eax*2 + 2]
push eax
call 0xbf9ad0
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebp
push dword [esp + 0x18]
call fcn.00c2f750
add esp, 0x14
test eax, eax
jns 0xc28e9c
push esi
call fcn.00bf9ae0
add esp, 4
xor esi, esi
mov eax, dword [esp + 8]
mov dword [esp], 0x23242526
mov byte [esp + 4], 0
nop
nop
nop
nop
mov ecx, ebx
add cl, 0x21
xor cl, byte [esp + ebx]
add cl, 0xf8
mov byte [esp + ebx], cl
inc ebx
cmp ebx, 5
jne 0xc28eb0
mov ecx, dword [0xc09a74]
test ecx, ecx
je 0xc28f0a
mov edx, dword [esp]
xor edi, edi
mov ebx, dword [0xc09a78]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xb430e561
je 0xc28ef0
inc edi
cmp ecx, edi
jne 0xc28ee0
jmp 0xc28f0a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, edx
je 0xc28f0a
push eax
push 4
push ecx
push dword [0xc09a7c]
call fcn.00c2c3c0
add esp, 0x10
test esi, esi
jne 0xc28f25
mov eax, esp
push eax
call fcn.00c2e500
add esp, 4
test al, al
je 0xc28f23
cmp dword [esp], 1
je 0xc28f25
xor esi, esi
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xc2ae30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
cmp dword [ecx + 8], 0
je 0xc2aea0
mov edx, dword [ecx]
test edx, edx
je 0xc2aea0
mov dword [esp], 0x23242526
mov byte [esp + 4], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ebx, eax
add bl, 0x21
xor bl, byte [esp + eax]
add bl, 0xf8
mov byte [esp + eax], bl
inc eax
cmp eax, 5
jne 0xc2ae60
mov eax, dword [esp]
mov ebx, dword [0xc09a74]
test ebx, ebx
je 0xc2af0a
xor edi, edi
mov esi, dword [0xc09a78]
nop
nop
nop
cmp dword [esi + edi*8], 0xddb7c3f3
je 0xc2aee9
inc edi
cmp ebx, edi
jne 0xc2ae90
jmp 0xc2af0a
mov dword [esp], 0x3675744b
mov word [esp + 4], 0
mov eax, 0xb
mov ecx, 4
nop
nop
nop
nop
nop
nop
nop
nop
mov esi, ecx
and esi, 0xf
mov edx, eax
and edx, 0x10
or edx, esi
xor dl, byte [esp + eax - 0xb]
xor dl, 0x2f
add dl, 0xa8
mov byte [esp + eax - 0xb], dl
inc eax
dec ecx
cmp eax, 0x11
jne 0xc2aec0
mov eax, dword [esp]
jmp 0xc2b05b
mov esi, dword [esi + edi*8 + 4]
cmp esi, eax
je 0xc2af0a
push dword [ebp + 8]
push edx
push 8
push esi
push dword [0xc09a7c]
mov esi, ecx
call fcn.00c2c3c0
mov ecx, esi
add esp, 0x14
mov esi, dword [ebp + 0xc]
test esi, esi
je 0xc2afc4
cmp eax, 0xc000010a
jne 0xc2afc4
mov edx, 0xffffd8f0
mov eax, esi
mul edx
sub edx, esi
mov dword [esp], eax
mov dword [esp + 4], edx
mov ebx, dword [ecx]
mov dword [esp + 0xe], 0x23242526
mov byte [esp + 0x12], 0
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, eax
add dl, 0x21
xor dl, byte [esp + eax + 0xe]
add dl, 0xf8
mov byte [esp + eax + 0xe], dl
inc eax
cmp eax, 5
jne 0xc2af50
xor edi, edi
cmp esi, 0xffffffff
je 0xc2af6f
mov edi, esp
mov eax, dword [esp + 0xe]
mov esi, dword [0xc09a74]
test esi, esi
je 0xc2afc4
mov dword [esp + 8], ebx
xor ebx, ebx
mov edx, dword [0xc09a78]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edx + ebx*8], 0xa67d73aa
je 0xc2afa0
inc ebx
cmp esi, ebx
jne 0xc2af90
jmp 0xc2afc4
mov edx, dword [edx + ebx*8 + 4]
cmp edx, eax
je 0xc2afc4
push edi
push 0
push dword [esp + 0x10]
push 0xc
push edx
push dword [0xc09a7c]
mov esi, ecx
call fcn.00c2c3c0
mov ecx, esi
add esp, 0x18
test eax, eax
js 0xc2b05b
mov edx, dword [ecx]
test edx, edx
je 0xc2b05b
mov dword [esp + 8], edx
mov dword [esp], 0x23242526
mov byte [esp + 4], 0
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, ebx
add dl, 0x21
xor dl, byte [esp + ebx]
add dl, 0xf8
mov byte [esp + ebx], dl
inc ebx
cmp ebx, 5
jne 0xc2aff0
mov esi, dword [0xc09a74]
test esi, esi
je 0xc2b055
mov edx, dword [esp]
xor ebx, ebx
mov edi, dword [0xc09a78]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + ebx*8], 0xb430e561
je 0xc2b030
inc ebx
cmp esi, ebx
jne 0xc2b020
jmp 0xc2b055
mov esi, dword [edi + ebx*8 + 4]
cmp esi, edx
je 0xc2b055
push dword [esp + 8]
push 4
push esi
push dword [0xc09a7c]
mov esi, ecx
mov edi, eax
call fcn.00c2c3c0
mov eax, edi
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0xc2da10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 6
mov dword [esp], 0x47464534
mov word [esp + 4], 0
mov eax, 0xb5e58e64
mov ecx, 0x4a1a719b
nop
nop
movzx esi, byte [esp + eax + 0x4a1a719c]
mov edx, eax
and edx, esi
mov edi, edx
and edi, 2
mov ebx, edx
or edx, 2
imul edx, edi
xor edi, 2
and ebx, 0x6d
imul ebx, edi
add edx, ebx
lea edi, [eax + esi]
mov ebx, ecx
sub ebx, esi
and ebx, edx
not edx
and edx, edi
sub edx, ebx
add dl, 0xe0
mov byte [esp + eax + 0x4a1a719c], dl
inc eax
dec ecx
cmp eax, 0xb5e58e6a
jne 0xc2da30
mov eax, dword [esp]
mov eax, dword fs:[eax]
add esp, 6
pop esi
pop edi
pop ebx
ret

Function at 0xc2ddc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov esi, dword [esp + 0x48]
movzx eax, word [esi]
mov dword [esp + 0xa], 0xa7a6ffe9
mov byte [esp + 0xe], 0
xor ecx, ecx
nop
nop
nop
mov edx, ecx
add dl, 0x84
xor dl, byte [esp + ecx + 0xa]
add dl, 0xe0
mov byte [esp + ecx + 0xa], dl
inc ecx
cmp ecx, 5
jne 0xc2dde0
mov ecx, dword [esp + 0xa]
xor edx, edx
cmp ecx, eax
setne dl
xor eax, eax
jmp dword [edx*4 + 0xc07254]

Function at 0xc2ea30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov dword [esp], 0x32333435
mov eax, esp
xor edx, edx
xor ebx, ebx
nop
mov ecx, ebx
and cl, 0xfc
add cl, dl
xor cl, byte [eax]
xor cl, 0xfa
add cl, 0x30
mov byte [eax], cl
inc eax
add ebx, 2
inc dl
cmp ebx, 8
jne 0xc2ea50
mov eax, dword [esp]
mov edx, dword [0xc09a74]
test edx, edx
je 0xc2eac8
xor ebx, ebx
mov ecx, dword [0xc09a78]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ecx + ebx*8], 0xa269eeef
je 0xc2eaa0
inc ebx
cmp edx, ebx
jne 0xc2ea90
jmp 0xc2eac8
mov edx, dword [ecx + ebx*8 + 4]
cmp edx, eax
je 0xc2eac8
mov eax, esp
lea ecx, [esp + 0x1c]
push 5
push 0x18
push eax
push ecx
push dword [ebp + 8]
push 0x14
push edx
push dword [0xc09a7c]
call fcn.00c2c3c0
add esp, 0x20
test edi, edi
je 0xc2ead2
mov ecx, dword [esp + 8]
mov dword [edi], ecx
test esi, esi
je 0xc2eade
cmp byte [esp + 0x15], 0
setne byte [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xc2eda0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x48]
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
mov ebp, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
xor ebx, ebx
nop
nop
nop
cmp word [ecx + ebx], 0
lea ebx, [ebx + 2]
jne 0xc2edc0
add ebx, 0xfffffffe
and ebx, 0xfffe
mov word [esp + 4], bx
add ebx, 2
mov word [esp + 6], bx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], 0x18
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], 0x40
lea eax, [esp + 4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp], 0x32333435
mov eax, esp
xor ebx, ebx
xor ecx, ecx
nop
nop
nop
mov edx, ecx
and dl, 0xfc
add dl, bl
xor dl, byte [eax]
xor dl, 0xfa
add dl, 0x30
mov byte [eax], dl
inc eax
add ecx, 2
inc bl
cmp ecx, 8
jne 0xc2ee20
mov eax, dword [esp]
mov ecx, dword [0xc09a74]
test ecx, ecx
je 0xc2ee92
mov edx, ebp
xor ebx, ebx
mov ebp, dword [0xc09a78]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebp + ebx*8], 0xb7847e1b
je 0xc2ee71
inc ebx
cmp ecx, ebx
jne 0xc2ee60
jmp 0xc2ee92
mov ecx, dword [ebp + ebx*8 + 4]
cmp ecx, eax
je 0xc2ee92
lea eax, [esp + 0xc]
push esi
push eax
push edi
push edx
push 0x10
push ecx
push dword [0xc09a7c]
call fcn.00c2c3c0
add esp, 0x1c
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0xe9d528
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0xd2a008], 0x8088405
inc edx
mov dword [ebx + 0xd2a008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0xec9460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0xec948d
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [eax + esi*4]
mov ebp, dword [edx + esi*4]
mov dword [edi + esi*4], ebx
xor dword [eax + esi*4], ebp
inc esi
jne 0xec947e
and ecx, 3
je 0xec94a5
mov bl, byte [ecx + eax - 1]
mov bh, byte [ecx + edx - 1]
mov byte [ecx + edi - 1], bl
xor byte [ecx + eax - 1], bh
dec ecx
jne 0xec9492
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0xec94b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
push ebp
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
shr esi, 2
je 0xec94e9
lea ecx, [ecx + esi*4]
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebp, dword [eax + esi*4]
mov ebx, dword [edi + esi*4]
xor ebx, dword [edx + esi*4]
mov dword [edx + esi*4], ebx
xor ebx, dword [ecx + esi*4]
mov dword [edi + esi*4], ebp
mov dword [eax + esi*4], ebx
inc esi
jne 0xec94d1
pop esi
and esi, 3
je 0xec950e
mov bl, byte [esi + eax - 1]
mov bh, byte [esi + edx - 1]
xor bh, byte [esi + edi - 1]
mov byte [esi + edx - 1], bh
xor bh, byte [esi + ecx - 1]
mov byte [esi + edi - 1], bl
mov byte [esi + eax - 1], bh
dec esi
jne 0xec94ef
pop ebp
pop esi
pop edi
pop ebx
pop ebp
ret 8

Function at 0xec9518
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, ecx
shr esi, 2
je 0xec9544
lea edi, [edi + esi*4]
lea edx, [edx + esi*4]
lea eax, [eax + esi*4]
neg esi
mov ebx, dword [edx + esi*4]
xor ebx, dword [eax + esi*4]
mov dword [edi + esi*4], ebx
mov dword [eax + esi*4], ebx
inc esi
jne 0xec9535
and ecx, 3
je 0xec955c
mov bl, byte [ecx + edx - 1]
xor bl, byte [ecx + eax - 1]
mov byte [ecx + edi - 1], bl
mov byte [ecx + eax - 1], bl
dec ecx
jne 0xec9549
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0xec9564
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
shr ecx, 1
lea edi, [eax + ecx*8]
lea edx, [edx + ecx*8]
neg ecx
mov ebx, dword [edx + ecx*8]
mov eax, dword [edx + ecx*8 + 4]
xor dword [edi + ecx*8], ebx
xor dword [edi + ecx*8 + 4], eax
inc ecx
jne 0xec9570
pop edi
pop ebx
ret