joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fac4
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffef4
mov dword [esp], edx
mov esi, eax
lea eax, [esp + 0x94]
xor ecx, ecx
mov edx, 0x78
call fcn.0045a0cc
lea eax, [esp + 0x14]
xor ecx, ecx
mov edx, 0x80
call fcn.0045a0cc
lea eax, [esp + 0x94]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x38
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add eax, 0x38
mov dword [esp + 0xc], eax
xor ecx, ecx
mov eax, 0x4d94a4
xor ebx, ebx
mov bl, byte [eax]
dec ebx
mov edx, ebx
and edx, 7
shr ebx, 3
movzx ebx, byte [esi + ebx]
and ebx, dword [edx*4 + 0x4d950c]
jbe 0x45fb42
mov edx, dword [esp + 4]
mov byte [edx + ecx], 1
jmp 0x45fb4a
mov edx, dword [esp + 4]
mov byte [edx + ecx], 0
inc ecx
inc eax
cmp ecx, 0x38
jne 0x45fb1e
xor eax, eax
mov dword [esp + 0x10], eax
mov edi, 0x4d952c
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 8
call fcn.0045a0cc
xor ecx, ecx
cmp ecx, 0x1c
jae 0x45fb7a
mov eax, 0x1c
jmp 0x45fb7f
mov eax, 0x38
xor ebx, ebx
mov bl, byte [edi]
add ebx, ecx
cmp eax, ebx
jbe 0x45fb8d
mov eax, ebx
jmp 0x45fb92
mov eax, ebx
sub eax, 0x1c
mov edx, dword [esp + 4]
mov al, byte [edx + eax]
mov edx, dword [esp + 8]
mov byte [edx + ecx], al
inc ecx
cmp ecx, 0x38
jne 0x45fb6e
xor ecx, ecx
mov esi, 0x4d94dc
xor eax, eax
mov al, byte [esi]
mov edx, dword [esp + 8]
cmp byte [edx + eax - 1], 0
jbe 0x45fbe9
mov eax, ecx
mov ebx, 6
xor edx, edx
div ebx
mov ebx, edx
mov eax, ecx
mov ebp, 6
xor edx, edx
div ebp
mov edx, dword [esp + 0xc]
lea eax, [edx + eax]
push eax
mov eax, dword [ebx*4 + 0x4d950c]
shr eax, 2
pop edx
or byte [edx], al
inc ecx
inc esi
cmp ecx, 0x30
jne 0x45fbad
mov edx, dword [esp + 0xc]
movzx edx, byte [edx]
shl edx, 0x18
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 2]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 4]
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 6]
or edx, ecx
mov eax, dword [esp + 0x10]
add eax, eax
mov dword [esp + eax*4 + 0x14], edx
mov edx, dword [esp + 0xc]
movzx edx, byte [edx + 1]
shl edx, 0x18
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 3]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 5]
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 7]
or edx, ecx
mov dword [esp + eax*4 + 0x18], edx
inc dword [esp + 0x10]
inc edi
cmp dword [esp + 0x10], 0x10
jne 0x45fb5c
mov edx, dword [esp]
lea eax, [esp + 0x14]
mov ecx, 0x80
call fcn.00402c74
add esp, 0x10c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45fc88
Capabilities:
Encrypt data using des
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffef4
mov dword [esp], edx
mov esi, eax
lea eax, [esp + 0x94]
xor ecx, ecx
mov edx, 0x78
call fcn.0045a0cc
lea eax, [esp + 0x14]
xor ecx, ecx
mov edx, 0x80
call fcn.0045a0cc
lea eax, [esp + 0x94]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x38
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
add eax, 0x38
mov dword [esp + 0xc], eax
xor ecx, ecx
mov eax, 0x4d94a4
xor ebx, ebx
mov bl, byte [eax]
dec ebx
mov edx, ebx
and edx, 7
shr ebx, 3
movzx ebx, byte [esi + ebx]
and ebx, dword [edx*4 + 0x4d950c]
jbe 0x45fd06
mov edx, dword [esp + 4]
mov byte [edx + ecx], 1
jmp 0x45fd0e
mov edx, dword [esp + 4]
mov byte [edx + ecx], 0
inc ecx
inc eax
cmp ecx, 0x38
jne 0x45fce2
xor eax, eax
mov dword [esp + 0x10], eax
mov edi, 0x4d952c
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov edx, 8
call fcn.0045a0cc
xor ecx, ecx
cmp ecx, 0x1c
jae 0x45fd3e
mov eax, 0x1c
jmp 0x45fd43
mov eax, 0x38
xor ebx, ebx
mov bl, byte [edi]
add ebx, ecx
cmp eax, ebx
jbe 0x45fd51
mov eax, ebx
jmp 0x45fd56
mov eax, ebx
sub eax, 0x1c
mov edx, dword [esp + 4]
mov al, byte [edx + eax]
mov edx, dword [esp + 8]
mov byte [edx + ecx], al
inc ecx
cmp ecx, 0x38
jne 0x45fd32
xor ecx, ecx
mov esi, 0x4d94dc
xor eax, eax
mov al, byte [esi]
mov edx, dword [esp + 8]
cmp byte [edx + eax - 1], 0
jbe 0x45fdad
mov eax, ecx
mov ebx, 6
xor edx, edx
div ebx
mov ebx, edx
mov eax, ecx
mov ebp, 6
xor edx, edx
div ebp
mov edx, dword [esp + 0xc]
lea eax, [edx + eax]
push eax
mov eax, dword [ebx*4 + 0x4d950c]
shr eax, 2
pop edx
or byte [edx], al
inc ecx
inc esi
cmp ecx, 0x30
jne 0x45fd71
mov edx, dword [esp + 0xc]
movzx edx, byte [edx]
shl edx, 0x18
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 2]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 4]
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 6]
or edx, ecx
mov eax, dword [esp + 0x10]
add eax, eax
mov dword [esp + eax*4 + 0x14], edx
mov edx, dword [esp + 0xc]
movzx edx, byte [edx + 1]
shl edx, 0x18
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 3]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 5]
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 0xc]
movzx ecx, byte [ecx + 7]
or edx, ecx
mov dword [esp + eax*4 + 0x18], edx
inc dword [esp + 0x10]
inc edi
cmp dword [esp + 0x10], 0x10
jne 0x45fd20
xor ecx, ecx
mov eax, ecx
add eax, eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x14]
mov edx, 0x1e
sub edx, dword [esp + 0x10]
mov ebx, dword [esp + edx*4 + 0x14]
mov esi, dword [esp + 0x10]
mov dword [esp + esi*4 + 0x14], ebx
mov dword [esp + edx*4 + 0x14], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x18]
mov edx, 0x1f
sub edx, dword [esp + 0x10]
mov ebx, dword [esp + edx*4 + 0x14]
mov esi, dword [esp + 0x10]
mov dword [esp + esi*4 + 0x18], ebx
mov dword [esp + edx*4 + 0x14], eax
inc ecx
cmp ecx, 8
jne 0x45fe31
mov edx, dword [esp]
lea eax, [esp + 0x14]
mov ecx, 0x80
call fcn.00402c74
add esp, 0x10c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x460088
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov ebx, 0x4d953c
mov esi, dword [esp]
mov esi, dword [esi]
mov edi, dword [esp + 4]
mov edi, dword [edi]
mov eax, dword [esp + 8]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], eax
mov dx, 4
mov eax, edi
call fcn.0045febc
mov edx, dword [esp + 0x10]
shl edx, 2
mov ecx, dword [esp + 0xc]
xor eax, dword [ecx + edx*4]
mov edx, eax
and edx, 0x3f
xor esi, dword [ebx + edx*4 + 0x600]
mov edx, eax
shr edx, 8
and edx, 0x3f
xor esi, dword [ebx + edx*4 + 0x400]
mov edx, eax
shr edx, 0x10
and edx, 0x3f
xor esi, dword [ebx + edx*4 + 0x200]
shr eax, 0x18
and eax, 0x3f
xor esi, dword [ebx + eax*4]
mov eax, dword [esp + 0x10]
shl eax, 2
mov edx, dword [esp + 0xc]
mov eax, dword [edx + eax*4 + 4]
xor eax, edi
mov edx, eax
and edx, 0x3f
xor esi, dword [ebx + edx*4 + 0x700]
mov edx, eax
shr edx, 8
and edx, 0x3f
xor esi, dword [ebx + edx*4 + 0x500]
mov edx, eax
shr edx, 0x10
and edx, 0x3f
xor esi, dword [ebx + edx*4 + 0x300]
shr eax, 0x18
and eax, 0x3f
xor esi, dword [ebx + eax*4 + 0x100]
mov dx, 4
mov eax, esi
call fcn.0045febc
mov edx, dword [esp + 0x10]
shl edx, 2
mov ecx, dword [esp + 0xc]
xor eax, dword [ecx + edx*4 + 8]
mov edx, eax
and edx, 0x3f
xor edi, dword [ebx + edx*4 + 0x600]
mov edx, eax
shr edx, 8
and edx, 0x3f
xor edi, dword [ebx + edx*4 + 0x400]
mov edx, eax
shr edx, 0x10
and edx, 0x3f
xor edi, dword [ebx + edx*4 + 0x200]
shr eax, 0x18
and eax, 0x3f
xor edi, dword [ebx + eax*4]
mov eax, dword [esp + 0x10]
shl eax, 2
mov edx, dword [esp + 0xc]
mov eax, dword [edx + eax*4 + 0xc]
xor eax, esi
mov edx, eax
and edx, 0x3f
xor edi, dword [ebx + edx*4 + 0x700]
mov edx, eax
shr edx, 8
and edx, 0x3f
xor edi, dword [ebx + edx*4 + 0x500]
mov edx, eax
shr edx, 0x10
and edx, 0x3f
xor edi, dword [ebx + edx*4 + 0x300]
shr eax, 0x18
and eax, 0x3f
xor edi, dword [ebx + eax*4 + 0x100]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 8
jne 0x4600b7
mov eax, dword [esp]
mov dword [eax], esi
mov eax, dword [esp + 4]
mov dword [eax], edi
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x460204
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, 0x4d953c
mov dword [esp], eax
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
mov eax, dword [esp]
call fcn.0045ff08
lea edx, [esp + 0x10]
lea eax, [esp + 0xc]
call fcn.0045ff48
xor ebx, ebx
mov dx, 4
mov eax, dword [esp + 0x10]
call fcn.0045febc
movzx edx, bx
mov edi, edx
shl edi, 2
mov edx, dword [esp + 8]
xor eax, dword [edx + edi*4]
mov edx, eax
and edx, 0x3f
mov edx, dword [esi + edx*4 + 0x600]
xor edx, dword [esp + 0xc]
mov ecx, eax
shr ecx, 8
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x400]
mov ecx, eax
shr ecx, 0x10
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x200]
shr eax, 0x18
and eax, 0x3f
xor edx, dword [esi + eax*4]
mov dword [esp + 0xc], edx
mov eax, dword [esp + 8]
mov eax, dword [eax + edi*4 + 4]
xor eax, dword [esp + 0x10]
mov edx, eax
and edx, 0x3f
mov edx, dword [esi + edx*4 + 0x700]
xor edx, dword [esp + 0xc]
mov ecx, eax
shr ecx, 8
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x500]
mov ecx, eax
shr ecx, 0x10
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x300]
shr eax, 0x18
and eax, 0x3f
xor edx, dword [esi + eax*4 + 0x100]
mov dword [esp + 0xc], edx
mov dx, 4
mov eax, dword [esp + 0xc]
call fcn.0045febc
mov edx, dword [esp + 8]
xor eax, dword [edx + edi*4 + 8]
mov edx, eax
and edx, 0x3f
mov edx, dword [esi + edx*4 + 0x600]
xor edx, dword [esp + 0x10]
mov ecx, eax
shr ecx, 8
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x400]
mov ecx, eax
shr ecx, 0x10
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x200]
shr eax, 0x18
and eax, 0x3f
xor edx, dword [esi + eax*4]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 8]
mov eax, dword [eax + edi*4 + 0xc]
xor eax, dword [esp + 0xc]
mov edx, eax
and edx, 0x3f
mov edx, dword [esi + edx*4 + 0x700]
xor edx, dword [esp + 0x10]
mov ecx, eax
shr ecx, 8
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x500]
mov ecx, eax
shr ecx, 0x10
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x300]
shr eax, 0x18
and eax, 0x3f
xor edx, dword [esi + eax*4 + 0x100]
mov dword [esp + 0x10], edx
inc ebx
cmp bx, 8
jne 0x460239
lea edx, [esp + 0x10]
lea eax, [esp + 0xc]
call fcn.0045ffe8
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
call fcn.0045ff28
add esp, 0x14
pop edi
pop esi
pop ebx
ret
Function at 0x4603dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
test edi, edi
jne 0x460401
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov al, 1
jmp 0x46054a
mov eax, dword [ebx + 0x610]
mov edx, eax
add edx, edi
shr edx, 3
shl edx, 3
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
cmp edx, dword [ebp - 0xc]
jae 0x46042d
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor eax, eax
jmp 0x46054a
test eax, eax
jbe 0x4604cf
mov edx, 8
sub edx, eax
mov dword [ebp - 8], edx
cmp edi, dword [ebp - 8]
jae 0x46045f
lea edx, [ebx + eax + 0x608]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.00402c74
add dword [ebx + 0x610], edi
xor edi, edi
jmp 0x4604cf
lea edx, [ebx + eax + 0x608]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00402c74
mov eax, dword [ebp - 8]
add dword [ebp - 4], eax
sub edi, dword [ebp - 8]
mov eax, dword [ebx + 0x608]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x60c]
mov dword [ebp - 0x10], eax
mov ecx, esi
mov edx, ebx
lea eax, [ebx + 0x608]
call fcn.004603a8
lea eax, [ebx + 0x600]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x604]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x600], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x604], eax
xor eax, eax
mov dword [ebx + 0x610], eax
cmp edi, 8
jb 0x460526
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov dword [ebp - 0x14], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004603a8
lea eax, [ebx + 0x600]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x604]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x600], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x604], eax
add dword [ebp - 4], 8
sub edi, 8
cmp edi, 8
jae 0x4604d4
test edi, edi
jbe 0x460540
lea edx, [ebx + 0x608]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.00402c74
mov dword [ebx + 0x610], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4607cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test edi, edi
jne 0x4607ed
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov al, 1
jmp 0x460933
mov eax, dword [ebx + 0x1210]
mov edx, eax
add edx, edi
shr edx, 3
shl edx, 3
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
cmp edx, dword [ebp - 8]
jae 0x460819
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
xor eax, eax
jmp 0x460933
test eax, eax
jbe 0x4608ba
mov edx, 8
sub edx, eax
mov dword [ebp - 4], edx
cmp edi, dword [ebp - 4]
jae 0x46084a
lea edx, [ebx + eax + 0x1208]
mov eax, esi
mov ecx, edi
call fcn.00402c74
add dword [ebx + 0x1210], edi
xor edi, edi
jmp 0x4608ba
lea edx, [ebx + eax + 0x1208]
mov eax, esi
mov ecx, dword [ebp - 4]
call fcn.00402c74
sub edi, dword [ebp - 4]
lea eax, [ebx + 0x1208]
mov eax, dword [eax]
lea edx, [ebx + 0x1200]
xor eax, dword [edx]
lea edx, [ebp - 0x10]
mov dword [edx], eax
lea eax, [ebx + 0x120c]
mov eax, dword [eax]
lea edx, [ebx + 0x1204]
xor eax, dword [edx]
lea edx, [ebp - 0xc]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.00460684
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebx + 0x1200], edx
mov edx, dword [eax + 4]
mov dword [ebx + 0x1204], edx
add dword [ebp + 0xc], 8
mov eax, dword [ebp - 4]
add esi, eax
xor eax, eax
mov dword [ebx + 0x1210], eax
cmp edi, 8
jb 0x460910
mov eax, dword [esi]
lea edx, [ebx + 0x1200]
xor eax, dword [edx]
lea edx, [ebp - 0x10]
mov dword [edx], eax
add esi, 4
mov eax, dword [esi]
lea edx, [ebx + 0x1204]
xor eax, dword [edx]
lea edx, [ebp - 0xc]
mov dword [edx], eax
add esi, 4
mov ecx, dword [ebp + 0xc]
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.00460684
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebx + 0x1200], edx
mov edx, dword [eax + 4]
mov dword [ebx + 0x1204], edx
add dword [ebp + 0xc], 8
sub edi, 8
cmp edi, 8
jae 0x4608bf
test edi, edi
jbe 0x460929
lea edx, [ebx + 0x1208]
mov eax, esi
mov ecx, edi
call fcn.00402c74
mov dword [ebx + 0x1210], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46093c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
test edi, edi
jne 0x460961
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov al, 1
jmp 0x460aaa
mov eax, dword [ebx + 0x1210]
mov edx, eax
add edx, edi
shr edx, 3
shl edx, 3
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
cmp edx, dword [ebp - 0xc]
jae 0x46098d
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor eax, eax
jmp 0x460aaa
test eax, eax
jbe 0x460a2f
mov edx, 8
sub edx, eax
mov dword [ebp - 8], edx
cmp edi, dword [ebp - 8]
jae 0x4609bf
lea edx, [ebx + eax + 0x1208]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.00402c74
add dword [ebx + 0x1210], edi
xor edi, edi
jmp 0x460a2f
lea edx, [ebx + eax + 0x1208]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.00402c74
mov eax, dword [ebp - 8]
add dword [ebp - 4], eax
sub edi, dword [ebp - 8]
mov eax, dword [ebx + 0x1208]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x120c]
mov dword [ebp - 0x10], eax
mov ecx, esi
mov edx, ebx
lea eax, [ebx + 0x1208]
call fcn.004606fc
lea eax, [ebx + 0x1200]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x1204]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x1200], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x1204], eax
xor eax, eax
mov dword [ebx + 0x1210], eax
cmp edi, 8
jb 0x460a86
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov dword [ebp - 0x14], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004606fc
lea eax, [ebx + 0x1200]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x1204]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x1200], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x1204], eax
add dword [ebp - 4], 8
sub edi, 8
cmp edi, 8
jae 0x460a34
test edi, edi
jbe 0x460aa0
lea edx, [ebx + 0x1208]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.00402c74
mov dword [ebx + 0x1210], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4661f4
Capabilities:
Encrypt data using camellia

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov edi, ecx
mov esi, dword [eax]
xor esi, dword [edx]
mov eax, dword [eax + 4]
xor eax, dword [edx + 4]
mov edx, eax
shr edx, 0x18
and edx, 0xff
mov dl, byte [edx + 0x4dbd3c]
mov byte [esp], dl
mov edx, eax
shr edx, 0x10
and edx, 0xff
mov dl, byte [edx + 0x4dbe3c]
mov byte [esp + 1], dl
mov edx, eax
shr edx, 8
and edx, 0xff
mov dl, byte [edx + 0x4dbf3c]
mov byte [esp + 2], dl
and eax, 0xff
mov al, byte [eax + 0x4dc03c]
mov byte [esp + 3], al
mov eax, esi
shr eax, 0x18
and eax, 0xff
mov al, byte [eax + 0x4dbe3c]
mov edx, esi
shr edx, 0x10
and edx, 0xff
mov dl, byte [edx + 0x4dbf3c]
mov ecx, esi
shr ecx, 8
and ecx, 0xff
mov cl, byte [ecx + 0x4dc03c]
mov ebx, esi
and ebx, 0xff
mov bl, byte [ebx + 0x4dbd3c]
mov byte [esp + 4], bl
mov bl, byte [esp]
xor bl, byte [esp + 2]
xor bl, byte [esp + 3]
xor bl, dl
xor bl, cl
xor bl, byte [esp + 4]
mov byte [esp + 5], bl
mov bl, byte [esp]
xor bl, byte [esp + 1]
xor bl, byte [esp + 3]
xor bl, al
xor bl, cl
xor bl, byte [esp + 4]
mov byte [esp + 6], bl
mov bl, byte [esp]
xor bl, byte [esp + 1]
xor bl, byte [esp + 2]
xor bl, al
xor bl, dl
xor bl, byte [esp + 4]
mov byte [esp + 7], bl
mov bl, byte [esp + 1]
xor bl, byte [esp + 2]
xor bl, byte [esp + 3]
xor bl, al
xor bl, dl
xor bl, cl
mov byte [esp + 8], bl
mov bl, byte [esp]
xor bl, byte [esp + 1]
xor bl, dl
xor bl, cl
xor bl, byte [esp + 4]
mov byte [esp + 9], bl
mov bl, byte [esp + 1]
xor bl, byte [esp + 2]
xor bl, al
xor bl, cl
xor bl, byte [esp + 4]
mov byte [esp + 0xa], bl
mov bl, byte [esp + 2]
xor bl, byte [esp + 3]
xor bl, al
xor bl, dl
xor bl, byte [esp + 4]
mov byte [esp + 0xb], bl
mov bl, byte [esp]
xor bl, byte [esp + 3]
xor al, bl
xor dl, al
xor cl, dl
mov eax, ecx
and eax, 0xff
xor edx, edx
mov dl, byte [esp + 0xb]
shl edx, 8
or eax, edx
xor edx, edx
mov dl, byte [esp + 0xa]
shl edx, 0x10
or eax, edx
xor edx, edx
mov dl, byte [esp + 9]
shl edx, 0x18
or eax, edx
mov dword [edi], eax
xor eax, eax
mov al, byte [esp + 8]
xor edx, edx
mov dl, byte [esp + 7]
shl edx, 8
or eax, edx
xor edx, edx
mov dl, byte [esp + 6]
shl edx, 0x10
or eax, edx
xor edx, edx
mov dl, byte [esp + 5]
shl edx, 0x18
or eax, edx
mov dword [edi + 4], eax
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4674b0
Capabilities:
Encrypt data using twofish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov esi, edx
mov ebp, eax
mov edi, 0x4dc16c
mov ecx, ebp
and cl, 0xff
mov eax, ebp
shr eax, 8
and al, 0xff
mov edx, ebp
shr edx, 0x10
and dl, 0xff
mov ebx, ebp
shr ebx, 0x18
mov byte [esp + 4], bl
cmp dword [esp], 0xc0
jbe 0x467535
and ecx, 0xff
mov cl, byte [edi + ecx + 0x100]
mov ebx, esi
add ebx, 0xc
xor cl, byte [ebx]
and eax, 0xff
mov al, byte [edi + eax]
mov ebx, esi
add ebx, 0xd
xor al, byte [ebx]
and edx, 0xff
mov dl, byte [edi + edx]
mov ebx, esi
add ebx, 0xe
xor dl, byte [ebx]
xor ebx, ebx
mov bl, byte [esp + 4]
mov bl, byte [edi + ebx + 0x100]
mov ebp, esi
add ebp, 0xf
xor bl, byte [ebp]
mov byte [esp + 4], bl
cmp dword [esp], 0x80
jbe 0x46758a
and ecx, 0xff
mov cl, byte [edi + ecx + 0x100]
mov ebx, esi
add ebx, 8
xor cl, byte [ebx]
and eax, 0xff
mov al, byte [edi + eax + 0x100]
mov ebx, esi
add ebx, 9
xor al, byte [ebx]
and edx, 0xff
mov dl, byte [edi + edx]
mov ebx, esi
add ebx, 0xa
xor dl, byte [ebx]
xor ebx, ebx
mov bl, byte [esp + 4]
mov bl, byte [edi + ebx]
mov ebp, esi
add ebp, 0xb
xor bl, byte [ebp]
mov byte [esp + 4], bl
and ecx, 0xff
mov cl, byte [edi + ecx]
mov ebx, esi
add ebx, 4
xor cl, byte [ebx]
and eax, 0xff
mov al, byte [edi + eax + 0x100]
mov ebx, esi
add ebx, 5
xor al, byte [ebx]
and edx, 0xff
mov dl, byte [edi + edx]
mov ebx, esi
add ebx, 6
xor dl, byte [ebx]
xor ebx, ebx
mov bl, byte [esp + 4]
mov bl, byte [edi + ebx + 0x100]
mov ebp, esi
add ebp, 7
xor bl, byte [ebp]
mov byte [esp + 4], bl
and ecx, 0xff
mov cl, byte [edi + ecx]
xor cl, byte [esi]
and ecx, 0xff
mov cl, byte [edi + ecx + 0x100]
and eax, 0xff
mov al, byte [edi + eax]
mov ebx, esi
inc ebx
xor al, byte [ebx]
and eax, 0xff
mov al, byte [edi + eax]
and edx, 0xff
mov dl, byte [edi + edx + 0x100]
mov ebx, esi
add ebx, 2
xor dl, byte [ebx]
and edx, 0xff
mov dl, byte [edi + edx + 0x100]
xor ebx, ebx
mov bl, byte [esp + 4]
mov bl, byte [edi + ebx + 0x100]
add esi, 3
xor bl, byte [esi]
and ebx, 0xff
mov bl, byte [edi + ebx]
mov byte [esp + 4], bl
xor ebx, ebx
mov bl, al
mov bl, byte [ebx + 0x4dc48c]
xor bl, cl
mov esi, edx
and esi, 0xff
xor bl, byte [esi + 0x4dc38c]
movzx esi, byte [esp + 4]
xor bl, byte [esi + 0x4dc38c]
mov byte [esp + 5], bl
xor ebx, ebx
mov bl, cl
mov bl, byte [ebx + 0x4dc38c]
mov esi, eax
and esi, 0xff
xor bl, byte [esi + 0x4dc48c]
mov esi, edx
and esi, 0xff
xor bl, byte [esi + 0x4dc48c]
xor bl, byte [esp + 4]
mov byte [esp + 6], bl
xor ebx, ebx
mov bl, cl
mov bl, byte [ebx + 0x4dc48c]
mov esi, eax
and esi, 0xff
xor bl, byte [esi + 0x4dc38c]
xor bl, dl
movzx esi, byte [esp + 4]
xor bl, byte [esi + 0x4dc48c]
mov byte [esp + 7], bl
and ecx, 0xff
xor al, byte [ecx + 0x4dc48c]
and edx, 0xff
xor al, byte [edx + 0x4dc48c]
xor edx, edx
mov dl, byte [esp + 4]
xor al, byte [edx + 0x4dc38c]
xor edx, edx
mov dl, byte [esp + 5]
xor ecx, ecx
mov cl, byte [esp + 6]
shl ecx, 8
or edx, ecx
xor ecx, ecx
mov cl, byte [esp + 7]
shl ecx, 0x10
or edx, ecx
and eax, 0xff
shl eax, 0x18
or edx, eax
mov eax, edx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret