joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45dd38
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
mov edi, dword [ebp + 8]
mov ebx, dword [eax + 0xc]
mov eax, dword [esi + 8]
imul ebx, edi
imul eax, dword [ebp + 0x10]
add ebx, dword [esi + 0x14]
sub edi, dword [esi + 0xc]
sar eax, 8
mov dword [ebp - 4], esi
cmp eax, 0xfe
jge 0x45de1a
inc eax
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov ecx, dword [esi + 4]
mov eax, edi
cdq
idiv dword [ecx + 0x10]
mov ecx, dword [ecx + 0xc]
inc edi
mov dword [ebp + 8], edi
imul ecx, edx
add ecx, dword [esi + 0x18]
mov edx, dword [ebp + 0x10]
mov esi, dword [ebx]
movzx edi, byte [ecx + 2]
movzx eax, byte [ecx]
shl edi, 0x10
or edi, eax
movzx eax, byte [ecx + 1]
imul edi, edx
or eax, 0xffff0000
imul eax, edx
shr edi, 8
xor edi, eax
movzx eax, byte [ecx + 1]
or eax, 0xff0000
imul eax, edx
and edi, 0xff00ff
xor edi, eax
mov ecx, esi
and esi, 0xff00ff
mov eax, edi
shr eax, 0x18
shr ecx, 8
mov edx, 0x100
sub edx, eax
imul esi, edx
mov eax, ecx
and eax, 0xffff00ff
imul eax, edx
shr esi, 8
xor esi, eax
mov eax, 0xff00ff
and ecx, eax
imul ecx, edx
and esi, eax
xor esi, ecx
add esi, edi
mov edi, dword [ebp + 8]
mov dword [ebx], esi
mov esi, dword [ebp - 4]
mov eax, dword [esi]
add ebx, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x45dd74
jmp 0x45de5e
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
mov ecx, dword [esi + 4]
mov eax, edi
cdq
idiv dword [ecx + 0x10]
imul edx, dword [ecx + 0xc]
add edx, dword [esi + 0x18]
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 1]
or ecx, 0xffffff00
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
mov dword [ebx], ecx
mov eax, dword [esi]
inc edi
add ebx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
dec eax
mov dword [ebp + 8], eax
test eax, eax
jg 0x45de20
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x45de65
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
mov eax, dword [ebx]
push edi
mov esi, dword [eax + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
imul esi, edi
add esi, dword [ebx + 0x14]
sub edi, dword [ebx + 0xc]
cmp dword [ebx + 8], 0xfe
mov dword [ebp - 4], esi
jge 0x45df42
mov dword [ebp + 0xc], eax
mov ecx, dword [ebx + 4]
mov eax, edi
cdq
idiv dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
mov ecx, dword [ebx + 8]
inc edi
mov dword [ebp + 8], edi
imul esi, edx
add esi, dword [ebx + 0x18]
inc ecx
mov edx, 0x100
movzx edi, byte [esi + 2]
movzx eax, byte [esi]
shl edi, 0x10
or edi, eax
movzx eax, byte [esi + 1]
imul edi, ecx
or eax, 0xffff0000
imul eax, ecx
shr edi, 8
xor edi, eax
movzx eax, byte [esi + 1]
mov esi, dword [ebp - 4]
or eax, 0xff0000
mov esi, dword [esi]
imul eax, ecx
and edi, 0xff00ff
xor edi, eax
mov ecx, esi
shr ecx, 8
and esi, 0xff00ff
mov eax, edi
shr eax, 0x18
sub edx, eax
imul esi, edx
mov eax, ecx
and eax, 0xffff00ff
imul eax, edx
shr esi, 8
xor esi, eax
mov eax, 0xff00ff
and ecx, eax
imul ecx, edx
and esi, eax
xor esi, ecx
mov ecx, dword [ebp - 4]
add esi, edi
mov edi, dword [ebp + 8]
mov dword [ecx], esi
mov eax, dword [ebx]
add ecx, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp - 4], ecx
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x45de95
jmp 0x45df83
mov dword [ebp + 8], eax
mov ecx, dword [ebx + 4]
mov eax, edi
cdq
idiv dword [ecx + 0x10]
imul edx, dword [ecx + 0xc]
add edx, dword [ebx + 0x18]
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 1]
or ecx, 0xffffff00
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
mov dword [esi], ecx
mov eax, dword [ebx]
inc edi
add esi, dword [eax + 0xc]
mov eax, dword [ebp + 8]
dec eax
mov dword [ebp + 8], eax
test eax, eax
jg 0x45df45
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x45df8a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
mov dword [ebp - 4], esi
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 8]
imul eax, dword [ebp + 0x10]
mov ebx, ecx
imul ebx, edx
sub edx, dword [esi + 0xc]
add ebx, dword [esi + 0x14]
sar eax, 8
mov dword [ebp + 8], edx
cmp eax, 0xfe
jge 0x45e06d
inc eax
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 4]
mov ecx, edx
inc edx
mov dword [ebp + 8], edx
mov edx, dword [eax + 0xc]
imul edx, ecx
add edx, dword [esi + 0x18]
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebx]
movzx edi, byte [edx + 2]
movzx eax, byte [edx]
shl edi, 0x10
or edi, eax
movzx eax, byte [edx + 1]
imul edi, ecx
or eax, 0xffff0000
imul eax, ecx
shr edi, 8
xor edi, eax
movzx eax, byte [edx + 1]
or eax, 0xff0000
imul eax, ecx
mov ecx, esi
and edi, 0xff00ff
xor edi, eax
and esi, 0xff00ff
shr ecx, 8
mov eax, edi
shr eax, 0x18
mov edx, 0x100
sub edx, eax
imul esi, edx
mov eax, ecx
and eax, 0xffff00ff
imul eax, edx
shr esi, 8
xor esi, eax
mov eax, 0xff00ff
and ecx, eax
imul ecx, edx
mov edx, dword [ebp + 8]
and esi, eax
xor esi, ecx
add esi, edi
mov dword [ebx], esi
mov esi, dword [ebp - 4]
mov eax, dword [esi]
add ebx, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x45dfcb
jmp 0x45e0c5
mov eax, dword [esi + 4]
mov edi, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
imul edx, dword [ebp + 8]
add edx, dword [esi + 0x18]
cmp dword [eax + 0xc], 3
jne 0x45e098
cmp ecx, 3
jne 0x45e098
imul edi, edi, 3
push edi
push edx
push ebx
call fcn.004a40e0
add esp, 0xc
jmp 0x45e0c5
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 1]
or ecx, 0xffffff00
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
mov dword [ebx], ecx
mov eax, dword [esi]
add ebx, dword [eax + 0xc]
mov eax, dword [esi + 4]
add edx, dword [eax + 0xc]
dec edi
test edi, edi
jg 0x45e098
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x45e0cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
mov dword [ebp - 4], esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
mov ebx, ecx
imul ebx, eax
sub eax, dword [esi + 0xc]
add ebx, dword [esi + 0x14]
cmp dword [esi + 8], 0xfe
mov dword [ebp + 8], eax
jge 0x45e1a4
mov ecx, dword [ebp + 0xc]
mov dword [ebp + 0xc], ecx
mov ecx, eax
inc eax
mov dword [ebp + 8], eax
mov eax, dword [esi + 4]
mov edx, dword [eax + 0xc]
imul edx, ecx
add edx, dword [esi + 0x18]
mov ecx, dword [esi + 8]
inc ecx
movzx edi, byte [edx + 2]
movzx eax, byte [edx]
shl edi, 0x10
or edi, eax
movzx eax, byte [edx + 1]
imul edi, ecx
or eax, 0xffff0000
imul eax, ecx
mov esi, dword [ebx]
shr edi, 8
xor edi, eax
movzx eax, byte [edx + 1]
or eax, 0xff0000
imul eax, ecx
mov ecx, esi
and edi, 0xff00ff
xor edi, eax
and esi, 0xff00ff
shr ecx, 8
mov eax, edi
shr eax, 0x18
mov edx, 0x100
sub edx, eax
imul esi, edx
mov eax, ecx
and eax, 0xffff00ff
imul eax, edx
shr esi, 8
xor esi, eax
mov eax, 0xff00ff
and ecx, eax
imul ecx, edx
and esi, eax
xor esi, ecx
add esi, edi
mov dword [ebx], esi
mov esi, dword [ebp - 4]
mov eax, dword [esi]
add ebx, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
mov eax, dword [ebp + 8]
jg 0x45e101
jmp 0x45e1fc
mov eax, dword [esi + 4]
mov edi, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
imul edx, dword [ebp + 8]
add edx, dword [esi + 0x18]
cmp dword [eax + 0xc], 3
jne 0x45e1cf
cmp ecx, 3
jne 0x45e1cf
imul edi, edi, 3
push edi
push edx
push ebx
call fcn.004a40e0
add esp, 0xc
jmp 0x45e1fc
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 1]
or ecx, 0xffffff00
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
mov dword [ebx], ecx
mov eax, dword [esi]
add ebx, dword [eax + 0xc]
mov eax, dword [esi + 4]
add edx, dword [eax + 0xc]
dec edi
test edi, edi
jg 0x45e1cf
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x45e203
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
mov edi, dword [ebp + 8]
mov ebx, dword [eax + 0xc]
mov eax, dword [esi + 8]
imul ebx, edi
imul eax, dword [ebp + 0x10]
sub edi, dword [esi + 0xc]
add ebx, dword [esi + 0x14]
sar eax, 8
mov dword [ebp - 4], esi
mov dword [ebp + 8], edi
cmp eax, 0xfe
jge 0x45e2d1
inc eax
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov ecx, dword [esi + 4]
mov eax, edi
cdq
idiv dword [ecx + 0x10]
mov eax, dword [ecx + 0xc]
inc edi
mov dword [ebp + 8], edi
imul eax, edx
add eax, dword [esi + 0x18]
mov esi, dword [ebx]
mov edx, 0x100
movzx eax, byte [eax]
mov ecx, eax
shl ecx, 0x10
or ecx, eax
imul ecx, dword [ebp + 0x10]
mov edi, ecx
shr edi, 8
xor edi, ecx
and edi, 0xff00ff
xor edi, ecx
mov ecx, esi
and esi, 0xff00ff
mov eax, edi
shr eax, 0x18
sub edx, eax
shr ecx, 8
imul esi, edx
mov eax, ecx
and eax, 0xffff00ff
imul eax, edx
shr esi, 8
xor esi, eax
mov eax, 0xff00ff
and ecx, eax
imul ecx, edx
and esi, eax
xor esi, ecx
add esi, edi
mov edi, dword [ebp + 8]
mov dword [ebx], esi
mov esi, dword [ebp - 4]
mov eax, dword [esi]
add ebx, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x45e242
jmp 0x45e352
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov ecx, dword [esi + 4]
mov eax, edi
cdq
idiv dword [ecx + 0x10]
imul edx, dword [ecx + 0xc]
add edx, dword [esi + 0x18]
mov esi, dword [ebx]
mov ecx, esi
movzx eax, byte [edx]
mov edi, eax
shl edi, 8
or edi, eax
shl edi, 8
or edi, eax
shl edi, 8
or edi, eax
and esi, 0xff00ff
mov eax, edi
shr eax, 0x18
shr ecx, 8
mov edx, 0x100
sub edx, eax
imul esi, edx
mov eax, ecx
and eax, 0xffff00ff
imul eax, edx
shr esi, 8
xor esi, eax
mov eax, 0xff00ff
and ecx, eax
imul ecx, edx
and esi, eax
xor esi, ecx
add esi, edi
mov edi, dword [ebp + 8]
mov dword [ebx], esi
mov esi, dword [ebp - 4]
inc edi
mov eax, dword [esi]
mov dword [ebp + 8], edi
add ebx, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x45e2d7
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x45e359
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
mov edi, dword [ebp + 8]
mov ebx, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
imul ebx, edi
sub edi, dword [esi + 0xc]
add ebx, dword [esi + 0x14]
cmp dword [esi + 8], 0xfe
mov dword [ebp - 4], esi
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], eax
jge 0x45e41b
mov ecx, dword [esi + 4]
mov eax, edi
cdq
idiv dword [ecx + 0x10]
mov eax, dword [ecx + 0xc]
mov ecx, dword [esi + 8]
inc edi
mov dword [ebp + 8], edi
imul eax, edx
add eax, dword [esi + 0x18]
mov esi, dword [ebx]
inc ecx
movzx eax, byte [eax]
mov edx, eax
shl edx, 0x10
or edx, eax
imul edx, ecx
mov edi, edx
shr edi, 8
xor edi, edx
and edi, 0xff00ff
xor edi, edx
mov ecx, esi
and esi, 0xff00ff
mov eax, edi
shr eax, 0x18
shr ecx, 8
mov edx, 0x100
sub edx, eax
imul esi, edx
mov eax, ecx
and eax, 0xffff00ff
imul eax, edx
shr esi, 8
xor esi, eax
mov eax, 0xff00ff
and ecx, eax
imul ecx, edx
and esi, eax
xor esi, ecx
add esi, edi
mov edi, dword [ebp + 8]
mov dword [ebx], esi
mov esi, dword [ebp - 4]
mov eax, dword [esi]
add ebx, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x45e38c
jmp 0x45e496
mov ecx, dword [esi + 4]
mov eax, edi
cdq
idiv dword [ecx + 0x10]
imul edx, dword [ecx + 0xc]
add edx, dword [esi + 0x18]
mov esi, dword [ebx]
mov ecx, esi
movzx eax, byte [edx]
mov edi, eax
shl edi, 8
or edi, eax
shl edi, 8
or edi, eax
shl edi, 8
or edi, eax
and esi, 0xff00ff
mov eax, edi
shr eax, 0x18
shr ecx, 8
mov edx, 0x100
sub edx, eax
imul esi, edx
mov eax, ecx
and eax, 0xffff00ff
imul eax, edx
shr esi, 8
xor esi, eax
mov eax, 0xff00ff
and ecx, eax
imul ecx, edx
and esi, eax
xor esi, ecx
add esi, edi
mov edi, dword [ebp + 8]
mov dword [ebx], esi
mov esi, dword [ebp - 4]
inc edi
mov eax, dword [esi]
mov dword [ebp + 8], edi
add ebx, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x45e41b
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x45e49d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, ecx
push ebx
mov eax, dword [edx]
push esi
mov eax, dword [eax + 0xc]
mov ebx, eax
mov dword [ebp - 8], eax
mov eax, dword [edx + 8]
imul eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
imul ebx, edi
add ebx, dword [edx + 0x14]
sub edi, dword [edx + 0xc]
sar eax, 8
mov dword [ebp - 4], edx
cmp eax, 0xfe
jge 0x45e56e
lea esi, [eax + 1]
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x10], esi
mov dword [ebp + 0xc], eax
mov eax, dword [edx + 4]
mov ecx, edi
mov eax, dword [eax + 0xc]
imul eax, ecx
add eax, dword [edx + 0x18]
inc edi
mov dword [ebp + 8], edi
movzx eax, byte [eax]
mov ecx, eax
shl ecx, 0x10
or ecx, eax
imul ecx, esi
mov esi, dword [ebx]
mov edi, ecx
shr edi, 8
xor edi, ecx
and edi, 0xff00ff
xor edi, ecx
mov ecx, esi
and esi, 0xff00ff
mov eax, edi
shr eax, 0x18
shr ecx, 8
mov edx, 0x100
sub edx, eax
imul esi, edx
mov eax, ecx
and eax, 0xffff00ff
imul eax, edx
shr esi, 8
xor esi, eax
mov eax, 0xff00ff
and ecx, eax
imul ecx, edx
mov edx, dword [ebp - 4]
and esi, eax
xor esi, ecx
add esi, edi
mov edi, dword [ebp + 8]
mov dword [ebx], esi
mov eax, dword [edx]
mov esi, dword [ebp + 0x10]
add ebx, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x45e4e1
jmp 0x45e60f
mov eax, dword [edx + 4]
mov esi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
imul ecx, edi
add ecx, dword [edx + 0x18]
cmp dword [eax + 0xc], 3
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], ecx
jne 0x45e59f
cmp dword [ebp - 8], 3
jne 0x45e59f
imul esi, esi, 3
push esi
push ecx
push ebx
call fcn.004a40e0
add esp, 0xc
jmp 0x45e60f
movzx eax, byte [ecx]
mov esi, dword [ebx]
mov edi, eax
shl edi, 8
or edi, eax
shl edi, 8
or edi, eax
shl edi, 8
or edi, eax
mov ecx, esi
shr ecx, 8
and esi, 0xff00ff
mov eax, edi
shr eax, 0x18
mov edx, 0x100
sub edx, eax
mov eax, ecx
imul esi, edx
and eax, 0xffff00ff
imul eax, edx
shr esi, 8
xor esi, eax
mov eax, 0xff00ff
and ecx, eax
imul ecx, edx
and esi, eax
xor esi, ecx
mov ecx, dword [ebp - 4]
add esi, edi
mov dword [ebx], esi
mov eax, dword [ecx]
add ebx, dword [eax + 0xc]
mov eax, dword [ecx + 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x45e59f
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x45e616
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, ecx
push ebx
mov eax, dword [edx]
push esi
mov eax, dword [eax + 0xc]
push edi
mov edi, dword [ebp + 8]
mov ebx, eax
imul ebx, edi
add ebx, dword [edx + 0x14]
sub edi, dword [edx + 0xc]
cmp dword [edx + 8], 0xfe
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
jge 0x45e6da
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [edx + 4]
mov ecx, edi
mov eax, dword [eax + 0xc]
imul eax, ecx
add eax, dword [edx + 0x18]
mov ecx, dword [edx + 8]
mov esi, dword [ebx]
movzx eax, byte [eax]
mov edx, eax
inc edi
shl edx, 0x10
or edx, eax
inc ecx
imul edx, ecx
mov dword [ebp + 8], edi
mov edi, edx
shr edi, 8
xor edi, edx
and edi, 0xff00ff
xor edi, edx
mov ecx, esi
and esi, 0xff00ff
mov eax, edi
shr eax, 0x18
shr ecx, 8
mov edx, 0x100
sub edx, eax
imul esi, edx
mov eax, ecx
and eax, 0xffff00ff
imul eax, edx
shr esi, 8
xor esi, eax
mov eax, 0xff00ff
and ecx, eax
imul ecx, edx
mov edx, dword [ebp - 4]
and esi, eax
xor esi, ecx
add esi, edi
mov edi, dword [ebp + 8]
mov dword [ebx], esi
mov eax, dword [edx]
add ebx, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x45e64c
jmp 0x45e77b
mov eax, dword [edx + 4]
mov esi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
imul ecx, edi
add ecx, dword [edx + 0x18]
cmp dword [eax + 0xc], 3
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], ecx
jne 0x45e70b
cmp dword [ebp - 8], 3
jne 0x45e70b
imul esi, esi, 3
push esi
push ecx
push ebx
call fcn.004a40e0
add esp, 0xc
jmp 0x45e77b
movzx eax, byte [ecx]
mov esi, dword [ebx]
mov edi, eax
shl edi, 8
or edi, eax
shl edi, 8
or edi, eax
shl edi, 8
or edi, eax
mov ecx, esi
shr ecx, 8
and esi, 0xff00ff
mov eax, edi
shr eax, 0x18
mov edx, 0x100
sub edx, eax
mov eax, ecx
imul esi, edx
and eax, 0xffff00ff
imul eax, edx
shr esi, 8
xor esi, eax
mov eax, 0xff00ff
and ecx, eax
imul ecx, edx
and esi, eax
xor esi, ecx
mov ecx, dword [ebp - 4]
add esi, edi
mov dword [ebx], esi
mov eax, dword [ecx]
add ebx, dword [eax + 0xc]
mov eax, dword [ecx + 4]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x45e70b
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x45e782
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
mov eax, dword [ebx]
mov esi, dword [ebp + 8]
push edi
mov edi, dword [eax + 0xc]
mov eax, dword [ebx + 8]
imul edi, esi
imul eax, dword [ebp + 0x10]
sub esi, dword [ebx + 0xc]
add edi, dword [ebx + 0x14]
sar eax, 8
mov dword [ebp + 8], esi
cmp eax, 0xfe
jge 0x45e85f
inc eax
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov ecx, dword [ebx + 4]
mov eax, esi
cdq
idiv dword [ecx + 0x10]
mov eax, dword [ecx + 0xc]
inc esi
mov dword [ebp + 8], esi
imul eax, edx
add eax, dword [ebx + 0x18]
mov edx, 0xff00ff
mov ecx, dword [eax]
mov esi, ecx
mov eax, ecx
shr eax, 8
and eax, 0xffff00ff
imul eax, dword [ebp + 0x10]
and esi, edx
imul esi, dword [ebp + 0x10]
shr ecx, 8
and ecx, edx
imul ecx, dword [ebp + 0x10]
shr esi, 8
xor esi, eax
and esi, edx
xor esi, ecx
movzx ecx, byte [edi + 2]
mov eax, esi
shr eax, 0x18
shl ecx, 0x10
mov edx, 0x100
sub edx, eax
movzx eax, byte [edi]
or ecx, eax
movzx eax, byte [edi + 1]
imul ecx, edx
imul eax, edx
and eax, 0xff00
add eax, esi
mov esi, dword [ebp + 8]
shr ecx, 8
and ecx, 0xff00ff
add ecx, eax
mov byte [edi], cl
mov eax, ecx
shr eax, 8
shr ecx, 0x10
mov byte [edi + 1], al
mov byte [edi + 2], cl
mov eax, dword [ebx]
add edi, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x45e7bd
jmp 0x45e8d5
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov ecx, dword [ebx + 4]
mov eax, esi
cdq
idiv dword [ecx + 0x10]
mov eax, dword [ebx + 0x18]
imul edx, dword [ecx + 0xc]
movzx ecx, byte [edi + 2]
mov esi, dword [edx + eax]
mov eax, esi
shr eax, 0x18
shl ecx, 0x10
mov edx, 0x100
sub edx, eax
movzx eax, byte [edi]
or ecx, eax
movzx eax, byte [edi + 1]
imul ecx, edx
imul eax, edx
and eax, 0xff00
add eax, esi
mov esi, dword [ebp + 8]
shr ecx, 8
and ecx, 0xff00ff
add ecx, eax
mov eax, ecx
shr eax, 0x10
mov byte [edi + 2], al
mov eax, ecx
shr eax, 8
mov byte [edi + 1], al
mov byte [edi], cl
mov eax, dword [ebx]
inc esi
add edi, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x45e865
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x45e8dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
mov eax, dword [ebx]
mov esi, dword [ebp + 8]
push edi
mov edi, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
imul edi, esi
sub esi, dword [ebx + 0xc]
add edi, dword [ebx + 0x14]
cmp dword [ebx + 8], 0xfe
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], eax
jge 0x45e9b2
mov ecx, dword [ebx + 4]
mov eax, esi
cdq
idiv dword [ecx + 0x10]
mov eax, dword [ecx + 0xc]
inc esi
mov dword [ebp + 8], esi
imul eax, edx
add eax, dword [ebx + 0x18]
mov edx, dword [ebx + 8]
inc edx
mov ecx, dword [eax]
mov esi, ecx
mov eax, ecx
shr eax, 8
and eax, 0xffff00ff
imul eax, edx
and esi, 0xff00ff
imul esi, edx
shr ecx, 8
shr esi, 8
xor esi, eax
mov eax, 0xff00ff
and ecx, eax
imul ecx, edx
and esi, eax
xor esi, ecx
movzx ecx, byte [edi + 2]
mov eax, esi
shr eax, 0x18
shl ecx, 0x10
mov edx, 0x100
sub edx, eax
movzx eax, byte [edi]
or ecx, eax
movzx eax, byte [edi + 1]
imul ecx, edx
imul eax, edx
and eax, 0xff00
add eax, esi
mov esi, dword [ebp + 8]
shr ecx, 8
and ecx, 0xff00ff
add ecx, eax
mov byte [edi], cl
mov eax, ecx
shr eax, 8
shr ecx, 0x10
mov byte [edi + 1], al
mov byte [edi + 2], cl
mov eax, dword [ebx]
add edi, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x45e90b
jmp 0x45ea22
mov ecx, dword [ebx + 4]
mov eax, esi
cdq
idiv dword [ecx + 0x10]
mov eax, dword [ebx + 0x18]
imul edx, dword [ecx + 0xc]
movzx ecx, byte [edi + 2]
mov esi, dword [edx + eax]
mov eax, esi
shr eax, 0x18
shl ecx, 0x10
mov edx, 0x100
sub edx, eax
movzx eax, byte [edi]
or ecx, eax
movzx eax, byte [edi + 1]
imul ecx, edx
imul eax, edx
and eax, 0xff00
add eax, esi
mov esi, dword [ebp + 8]
shr ecx, 8
and ecx, 0xff00ff
add ecx, eax
mov eax, ecx
shr eax, 0x10
mov byte [edi + 2], al
mov eax, ecx
shr eax, 8
mov byte [edi + 1], al
mov byte [edi], cl
mov eax, dword [ebx]
inc esi
add edi, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x45e9b2
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x45ea29
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
mov eax, dword [ebx]
push edi
mov eax, dword [eax + 0xc]
mov edi, eax
mov dword [ebp - 4], eax
imul edi, edx
mov eax, dword [ebx + 8]
imul eax, dword [ebp + 0x10]
add edi, dword [ebx + 0x14]
sub edx, dword [ebx + 0xc]
sar eax, 8
cmp eax, 0xfe
jge 0x45eb08
inc eax
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [ebx + 4]
mov ecx, edx
mov eax, dword [eax + 0xc]
imul eax, ecx
add eax, dword [ebx + 0x18]
inc edx
mov dword [ebp + 8], edx
mov ecx, dword [eax]
mov esi, ecx
mov eax, ecx
shr eax, 8
and eax, 0xffff00ff
imul eax, dword [ebp + 0x10]
shr ecx, 8
mov edx, 0xff00ff
and esi, edx
imul esi, dword [ebp + 0x10]
and ecx, edx
imul ecx, dword [ebp + 0x10]
shr esi, 8
xor esi, eax
and esi, edx
xor esi, ecx
movzx ecx, byte [edi + 2]
mov eax, esi
shr eax, 0x18
shl ecx, 0x10
mov edx, 0x100
sub edx, eax
movzx eax, byte [edi]
or ecx, eax
movzx eax, byte [edi + 1]
imul ecx, edx
imul eax, edx
mov edx, dword [ebp + 8]
and eax, 0xff00
shr ecx, 8
add eax, esi
and ecx, 0xff00ff
add ecx, eax
mov byte [edi], cl
mov eax, ecx
shr eax, 8
shr ecx, 0x10
mov byte [edi + 1], al
mov byte [edi + 2], cl
mov eax, dword [ebx]
add edi, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x45ea67
jmp 0x45eb92
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
imul esi, edx
add esi, dword [ebx + 0x18]
cmp dword [eax + 0xc], 3
mov dword [ebp + 8], ecx
jne 0x45eb36
cmp dword [ebp - 4], 3
jne 0x45eb36
imul ecx, ecx, 3
push ecx
push esi
push edi
call fcn.004a40e0
add esp, 0xc
jmp 0x45eb92
mov eax, dword [esi]
movzx ecx, byte [edi + 2]
shr eax, 0x18
shl ecx, 0x10
mov edx, 0x100
sub edx, eax
movzx eax, byte [edi]
or ecx, eax
movzx eax, byte [edi + 1]
imul ecx, edx
imul eax, edx
and eax, 0xff00
add eax, dword [esi]
shr ecx, 8
and ecx, 0xff00ff
add ecx, eax
mov eax, ecx
shr eax, 0x10
mov byte [edi + 2], al
mov eax, ecx
shr eax, 8
mov byte [edi + 1], al
mov byte [edi], cl
mov eax, dword [ebx]
add edi, dword [eax + 0xc]
mov eax, dword [ebx + 4]
add esi, dword [eax + 0xc]
mov eax, dword [ebp + 8]
dec eax
mov dword [ebp + 8], eax
test eax, eax
jg 0x45eb36
pop edi
pop esi
pop ebx
leave
ret 0xc