joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44ff80
Capabilities:
Hash data using fnv

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
mov eax, 0x1fffffff
push ebx
mov ebx, ecx
bsr ecx, eax
push edi
mov edi, 1
mov dword [esp + 8], ebx
mov eax, edi
shl eax, cl
cmp edx, eax
ja 0x4500d9
lea eax, [edx - 1]
or eax, edi
bsr ecx, eax
push ebp
push esi
mov esi, dword [ebx + 4]
lea ebp, [ebx + 0xc]
push esi
lea ecx, [ecx + 1]
shl edi, cl
mov ecx, ebp
lea eax, [edi + edi]
push eax
call fcn.0044fbe0
lea eax, [edi - 1]
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x18], eax
mov ecx, dword [ebx + 4]
mov ecx, dword [ecx]
mov edx, ecx
cmp ecx, esi
je 0x4500b3
movzx eax, byte [ecx + 8]
xor eax, 0x811c9dc5
mov edx, dword [edx]
imul edi, eax, 0x1000193
movzx eax, byte [ecx + 9]
xor edi, eax
movzx eax, byte [ecx + 0xa]
imul edi, edi, 0x1000193
xor edi, eax
movzx eax, byte [ecx + 0xb]
imul edi, edi, 0x1000193
xor edi, eax
imul eax, edi, 0x1000193
mov edi, dword [ebx + 0x18]
and edi, eax
mov eax, dword [ebp]
lea ebp, [eax + edi*8]
mov dword [esp + 0x1c], ebp
cmp dword [ebp], esi
jne 0x450032
mov dword [ebp], ecx
mov dword [ebp + 4], ecx
jmp 0x4500a6
mov eax, dword [ebp + 4]
mov ebx, dword [ecx + 8]
cmp ebx, dword [eax + 8]
jne 0x45006c
mov eax, dword [eax]
mov dword [esp + 0x14], eax
cmp eax, ecx
je 0x450067
mov ebx, dword [ecx + 4]
mov ebp, dword [esp + 0x14]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], eax
mov eax, dword [eax + 4]
mov dword [eax], ecx
mov dword [ebp + 4], edi
mov ebp, dword [esp + 0x1c]
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
mov dword [ebp + 4], ecx
jmp 0x4500a2
mov ebp, dword [ebp]
mov edi, eax
cmp ebp, eax
je 0x450083
mov eax, dword [eax + 4]
mov edi, eax
cmp ebx, dword [eax + 8]
je 0x4500bd
cmp ebp, eax
jne 0x450075
mov ebp, dword [ecx + 4]
mov dword [ebp], edx
mov ebx, dword [edx + 4]
mov dword [ebx], edi
mov eax, dword [edi + 4]
mov dword [eax], ecx
mov dword [edi + 4], ebx
mov dword [edx + 4], ebp
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [eax], ecx
mov ebx, dword [esp + 0x10]
lea ebp, [ebx + 0xc]
mov ecx, edx
cmp edx, esi
jne 0x44ffe1
pop esi
pop ebp
pop edi
pop ebx
add esp, 8
ret 4
mov ebx, dword [ecx + 4]
mov ebp, dword [eax]
mov dword [ebx], edx
mov edi, dword [edx + 4]
mov dword [edi], ebp
mov eax, dword [ebp + 4]
mov dword [eax], ecx
mov dword [ebp + 4], edi
mov dword [edx + 4], ebx
mov dword [ecx + 4], eax
jmp 0x4500a2
push str.invalid_hash_bucket_count
call fcn.0050f544
int3
Function at 0x456990
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [ecx]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov eax, dword [eax + 0x10]
mov ebp, dword [esp + 0x18]
push esi
push edi
mov dword [esp + 0x10], eax
nop word [eax + eax]
mov eax, dword [esp + 0x1c]
mov edx, 0x100
mov edi, eax
dec ebp
shr edi, 8
and eax, 0xff00ff
and edi, 0xff00ff
mov ecx, edi
shr ecx, 0x10
sub edx, ecx
mov ecx, dword [ebx]
mov esi, ecx
shr ecx, 8
and ecx, 0xff00ff
and esi, 0xff00ff
imul ecx, edx
imul esi, edx
mov edx, 0x100
shr ecx, 8
and ecx, 0xff00ff
shr esi, 8
add edi, ecx
and esi, 0xff00ff
add esi, eax
mov eax, edi
shr eax, 8
mov ecx, esi
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [esp + 0x10]
test ebp, ebp
jg 0x4569b0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x45cc40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x30], esi
mov eax, dword [esi + 0x14]
mov ebx, dword [eax + 8]
mov eax, ebx
shr eax, 0x18
mov dword [esp + 0xc], ebx
cmp al, 0xff
jae 0x45ccaa
test al, al
jne 0x45cc70
mov word [esp + 0xc], 0
mov byte [esp + 0xe], al
jmp 0x45cca6
mov ecx, eax
movzx eax, bl
imul eax, ecx
add eax, 0x7f
shr eax, 8
mov byte [esp + 0xc], al
movzx eax, byte [esp + 0xd]
imul eax, ecx
add eax, 0x7f
shr eax, 8
mov byte [esp + 0xd], al
movzx eax, byte [esp + 0xe]
imul eax, ecx
add eax, 0x7f
shr eax, 8
mov byte [esp + 0xe], al
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, 1
xor edx, edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ebp
cmp dword [esi + 0x1c], ebp
jle 0x45ce20
mov eax, dword [esp + 0x40]
movsd xmm2, qword [0x551110]
dec eax
movd xmm1, eax
mov eax, 0x10
cvtdq2pd xmm1, xmm1
mov dword [esp + 0x20], eax
mov ecx, dword [esi + 0x14]
movaps xmm0, xmm1
mulsd xmm0, qword [ecx + eax]
mov ecx, dword [ecx + eax + 8]
mov eax, ecx
shr eax, 0x18
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], ecx
addsd xmm0, xmm2
movsd qword [esp + 0x2c], xmm0
mov esi, dword [esp + 0x2c]
sub esi, edx
mov dword [esp + 0x28], esi
cmp al, 0xff
jae 0x45cd68
test al, al
jne 0x45cd26
mov word [esp + 0x10], 0
mov byte [esp + 0x12], al
jmp 0x45cd60
mov edx, eax
movzx eax, cl
imul eax, edx
add eax, 0x7f
shr eax, 8
mov byte [esp + 0x10], al
movzx eax, byte [esp + 0x11]
imul eax, edx
add eax, 0x7f
shr eax, 8
mov byte [esp + 0x11], al
movzx eax, byte [esp + 0x12]
imul eax, edx
mov edx, dword [esp + 0x14]
add eax, 0x7f
shr eax, 8
mov byte [esp + 0x12], al
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], 0
test esi, esi
jle 0x45ce01
mov eax, ebx
mov ebp, ecx
shr ebx, 8
mov edi, ecx
mov ecx, dword [esp + 0x10]
and ebx, 0xff00ff
shr ebp, 8
and eax, 0xff00ff
and ebp, 0xff00ff
mov dword [esp + 0x24], eax
sub ebp, ebx
and edi, 0xff00ff
shl ebx, 8
sub edi, eax
mov dword [esp + 0x2c], edi
nop
mov eax, ecx
inc ecx
shl eax, 8
cdq
idiv esi
mov edx, ebp
mov esi, eax
mov eax, ebp
imul edi, esi
imul edx, esi
imul eax, esi
mov esi, dword [esp + 0x28]
shr edi, 8
add edi, dword [esp + 0x24]
add edx, ebx
xor edi, edx
add eax, ebx
mov edx, dword [esp + 0x14]
and edi, 0xff00ff
xor edi, eax
mov eax, dword [esp + 0x3c]
mov dword [eax + edx*4], edi
inc edx
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x14], edx
cmp ecx, esi
jl 0x45cdb0
mov ecx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov esi, dword [esp + 0x34]
inc ebp
mov eax, dword [esp + 0x20]
mov ebx, ecx
add eax, 0x10
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
cmp ebp, dword [esi + 0x1c]
jl 0x45cce1
mov ecx, dword [esp + 0x40]
pop ebp
cmp edx, ecx
jge 0x45ce36
mov eax, dword [esp + 0x38]
sub ecx, edx
lea edi, [eax + edx*4]
mov eax, ebx
rep stosd dword es:[edi], eax
pop edi
pop esi
pop ebx
add esp, 0x28
ret 8
Function at 0x45e440
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
mov edx, 0x100
mov ebp, dword [edi + 0x4c]
cmp ebp, 1
mov esi, dword [edi + 0x1a8]
sete al
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], ebp
mov byte [esi + 0x1c], al
mov eax, dword [edi + 4]
push dword [edi + 0x64]
mov ecx, dword [eax + 8]
mov eax, 0x2fe
cmovne eax, edx
push eax
push 1
push edi
call ecx
xor ebx, ebx
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14]
add esp, 0x10
mov dword [esp + 0x10], ebx
cmp dword [edi + 0x64], ebx
jle 0x45e573
nop dword [eax]
mov ecx, dword [esi + ebx*4 + 0x20]
cdq
idiv ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
cmp ebp, 1
jne 0x45e4be
mov eax, dword [esi + 0x18]
add dword [eax + ebx*4], 0xff
mov eax, dword [esi + 0x18]
lea edi, [ecx*2 - 2]
mov ebp, dword [eax + ebx*4]
lea eax, [ecx + 0xfe]
cdq
xor ebx, ebx
idiv edi
xor esi, esi
mov edx, eax
nop word [eax + eax]
cmp esi, edx
jle 0x45e504
imul eax, ebx, 0x1fe
add ecx, 0xfe
add ecx, eax
add ecx, 0x1fe
inc ebx
mov eax, ecx
cdq
idiv edi
mov edx, eax
cmp esi, edx
jg 0x45e4f2
mov ecx, dword [esp + 0x14]
movzx ecx, cl
movzx eax, bl
imul ecx, eax
mov byte [esi + ebp], cl
inc esi
mov ecx, dword [esp + 0x1c]
cmp esi, 0xff
jle 0x45e4e0
cmp dword [esp + 0x18], 1
jne 0x45e551
mov ecx, 1
lea edx, [ebp - 1]
movzx eax, byte [ebp]
lea edx, [edx - 1]
mov byte [edx + 1], al
movzx eax, byte [ebp + 0xff]
mov byte [ecx + ebp + 0xff], al
inc ecx
cmp ecx, 0xff
jle 0x45e530
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x18]
inc ebx
mov esi, dword [esp + 0x20]
cmp ebx, dword [eax + 0x64]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], ebx
jl 0x45e4a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x46c960
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ea25
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x58213c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x10]
movzx eax, bl
xor eax, 0x811c9dc5
mov esi, dword [ebp + 0xc]
imul ecx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
mov dword [ebp - 0x10], ebx
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, ebx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
lea eax, [ebp - 0x10]
imul edi, ecx, 0x1000193
mov ecx, esi
push edi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0042f880
mov eax, dword [eax + 4]
test eax, eax
je 0x46c9fd
cmp eax, dword [esi + 4]
je 0x46c9fd
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [ebp + 0xc], bx
push 1
mov word [ebp + 0xe], ax
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push 1
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_GetGlyphIndicesW]
cmp eax, 0xffffffff
je 0x46cb25
mov eax, dword [ebp + 0x10]
mov ecx, 0xffff
cmp ax, cx
je 0x46cb25
movzx eax, ax
mov ecx, esi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push edi
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], ebx
push eax
call fcn.0042f880
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x46cb09
cmp dword [esi + 8], 0xfffffff
je 0x46cb3a
lea eax, [esi + 4]
mov dword [ebp - 0x24], eax
push 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
call fcn.005118c7
mov ecx, dword [ebp - 0x10]
mov ebx, eax
add esp, 4
mov dword [ebp - 0x20], ebx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], 0
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x1c]
inc ecx
mov dword [ebp - 4], 1
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x551150]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x551150]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
jbe 0x46cafc
mov ecx, esi
call fcn.00450320
push edi
lea eax, [ebx + 8]
mov ecx, esi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0042f880
mov ecx, dword [eax]
jmp 0x46caff
mov ecx, dword [ebp - 0x1c]
push ebx
push ecx
push edi
mov ecx, esi
call fcn.00450250
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0xc], ecx
movzx eax, word [ebp + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.unordered_map_set_too_long
call fcn.0050f544
int3
Function at 0x46d310
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53eb15
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x58213c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0x10]
movzx eax, dl
xor eax, 0x811c9dc5
mov esi, dword [ebp + 0xc]
imul ecx, eax, 0x1000193
mov eax, edx
sar eax, 8
movzx eax, al
mov edi, dword [ebp + 8]
xor ecx, eax
mov eax, edx
sar eax, 0x10
imul ecx, ecx, 0x1000193
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
sar eax, 0x18
movzx eax, al
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, esi
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0042f880
lea ebx, [esi + 4]
mov eax, dword [eax + 4]
test eax, eax
je 0x46d3ad
mov ecx, dword [ebx]
lea ebx, [esi + 4]
cmp eax, ecx
je 0x46d3ad
mov eax, dword [eax + 0xc]
jmp 0x46d4d3
push 0x55127c
xor eax, eax
push eax
push eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x24]
push eax
push 0x82
push dword [ebp + 0x10]
push edi
call dword [sym.imp.GDI32.dll_GetGlyphOutlineW]
mov edx, dword [ebp + 0x10]
movzx eax, dl
xor eax, 0x811c9dc5
movsx edi, word [ebp - 0x14]
imul ecx, eax, 0x1000193
movzx eax, dh
xor ecx, eax
movzx eax, byte [ebp + 0x12]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp + 0x13]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, esi
push eax
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0042f880
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x46d4ce
cmp dword [esi + 8], 0xfffffff
je 0x46d4ef
mov dword [ebp - 0x30], ebx
push 0x10
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], eax
call fcn.005118c7
mov ecx, dword [ebp + 0x10]
add esp, 4
mov dword [ebp - 0x2c], eax
add eax, 8
mov dword [ebp - 0x3c], eax
mov dword [eax], ecx
mov dword [eax + 4], 0
mov ecx, dword [esi + 8]
mov eax, dword [esi + 0x1c]
inc ecx
mov dword [ebp - 4], 1
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
shr ecx, 0x1f
addsd xmm0, qword [ecx*8 + 0x551150]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x551150]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [esi]
jbe 0x46d4bc
mov ecx, esi
call fcn.00450320
mov ebx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
push ebx
push dword [ebp - 0x3c]
mov ecx, esi
push eax
call fcn.0042f880
mov ecx, dword [eax]
jmp 0x46d4c2
mov ecx, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x28]
push dword [ebp - 0x2c]
push ecx
push ebx
mov ecx, esi
call fcn.00450250
mov dword [eax + 0xc], edi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00511b56
mov esp, ebp
pop ebp
ret
push str.unordered_map_set_too_long
call fcn.0050f544
int3
Function at 0x470a50
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, ecx
cmp ebp, dword [edi + 0x6c]
jle 0x470a7e
mov dword [edi + 0x6c], ebp
push dword [edi + 0x68]
call fcn.0051723e
lea eax, [ebp*4]
push eax
call fcn.00517259
add esp, 8
mov dword [edi + 0x68], eax
mov eax, dword [edi + 0x68]
mov ecx, edi
mov esi, dword [esp + 0x18]
push ebp
push esi
push eax
mov dword [esp + 0x28], eax
call fcn.004317d0
mov eax, dword [edi + 0x48]
mov ecx, dword [edi + 0x50]
imul ecx, dword [esp + 0x20]
mov eax, dword [eax + 0x10]
mov ebx, eax
imul ebx, esi
mov dword [esp + 0x10], eax
sar ecx, 8
mov dword [esp + 0x18], ecx
add ebx, dword [edi + 0x64]
cmp ecx, 0xfe
jge 0x470ba0
mov edx, dword [esp + 0x1c]
dec ebp
mov eax, edx
add edx, 4
mov dword [esp + 0x1c], edx
mov edx, dword [eax]
mov edi, edx
shr edi, 8
and edx, 0xff00ff
imul edx, dword [esp + 0x18]
and edi, 0xff00ff
imul edi, ecx
mov ecx, 0x100
shr edx, 8
shr edi, 8
and edx, 0xff00ff
and edi, 0xff00ff
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
add edi, eax
and esi, 0xff00ff
add esi, edx
mov eax, edi
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
mov ecx, esi
sub edx, eax
shr ecx, 8
shl edx, 8
mov eax, edi
shl eax, 8
and ecx, 0xff00ff
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
xor edx, ecx
mov ecx, dword [esp + 0x18]
mov dword [ebx], edx
add ebx, dword [esp + 0x10]
test ebp, ebp
jg 0x470ac0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esp + 0x1c]
dec ebp
mov edx, dword [ecx]
mov edi, edx
add ecx, 4
shr edi, 8
mov dword [esp + 0x1c], ecx
and edi, 0xff00ff
mov eax, edi
mov ecx, 0x100
shr eax, 0x10
and edx, 0xff00ff
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
add edi, eax
and esi, 0xff00ff
add esi, edx
mov eax, edi
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
mov ecx, esi
sub edx, eax
shr ecx, 8
shl edx, 8
mov eax, edi
shl eax, 8
and ecx, 0xff00ff
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [esp + 0x10]
test ebp, ebp
jg 0x470ba0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x470c60
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, ecx
cmp ebp, dword [edi + 0x6c]
jle 0x470c8e
mov dword [edi + 0x6c], ebp
push dword [edi + 0x68]
call fcn.0051723e
lea eax, [ebp*4]
push eax
call fcn.00517259
add esp, 8
mov dword [edi + 0x68], eax
mov eax, dword [edi + 0x68]
mov ecx, edi
mov esi, dword [esp + 0x18]
push ebp
push esi
push eax
mov dword [esp + 0x28], eax
call fcn.00431b60
mov eax, dword [edi + 0x48]
mov ecx, dword [edi + 0x50]
imul ecx, dword [esp + 0x20]
mov eax, dword [eax + 0x10]
mov ebx, eax
imul ebx, esi
mov dword [esp + 0x10], eax
sar ecx, 8
mov dword [esp + 0x18], ecx
add ebx, dword [edi + 0x64]
cmp ecx, 0xfe
jge 0x470db0
mov edx, dword [esp + 0x1c]
dec ebp
mov eax, edx
add edx, 4
mov dword [esp + 0x1c], edx
mov edx, dword [eax]
mov edi, edx
shr edi, 8
and edx, 0xff00ff
imul edx, dword [esp + 0x18]
and edi, 0xff00ff
imul edi, ecx
mov ecx, 0x100
shr edx, 8
shr edi, 8
and edx, 0xff00ff
and edi, 0xff00ff
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
add edi, eax
and esi, 0xff00ff
add esi, edx
mov eax, edi
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
mov ecx, esi
sub edx, eax
shr ecx, 8
shl edx, 8
mov eax, edi
shl eax, 8
and ecx, 0xff00ff
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
xor edx, ecx
mov ecx, dword [esp + 0x18]
mov dword [ebx], edx
add ebx, dword [esp + 0x10]
test ebp, ebp
jg 0x470cd0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
mov ecx, dword [esp + 0x1c]
dec ebp
mov edx, dword [ecx]
mov edi, edx
add ecx, 4
shr edi, 8
mov dword [esp + 0x1c], ecx
and edi, 0xff00ff
mov eax, edi
mov ecx, 0x100
shr eax, 0x10
and edx, 0xff00ff
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
add edi, eax
and esi, 0xff00ff
add esi, edx
mov eax, edi
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
mov ecx, esi
sub edx, eax
shr ecx, 8
shl edx, 8
mov eax, edi
shl eax, 8
and ecx, 0xff00ff
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [esp + 0x10]
test ebp, ebp
jg 0x470db0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x470e70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, ecx
cmp ebp, dword [edi + 0x6c]
jle 0x470e96
mov dword [edi + 0x6c], ebp
push dword [edi + 0x68]
call fcn.0051723e
push ebp
call fcn.00517259
add esp, 8
mov dword [edi + 0x68], eax
mov eax, dword [edi + 0x68]
mov ecx, edi
mov esi, dword [esp + 0x14]
push ebp
push esi
push eax
mov dword [esp + 0x24], eax
call fcn.00431f80
mov eax, dword [edi + 0x48]
mov edx, dword [edi + 0x50]
imul edx, dword [esp + 0x1c]
mov eax, dword [eax + 0x10]
mov ebx, eax
imul ebx, esi
mov dword [esp + 0x14], eax
sar edx, 8
mov dword [esp + 0x1c], edx
add ebx, dword [edi + 0x64]
cmp edx, 0xfe
jge 0x470fa0
mov ecx, dword [esp + 0x18]
dec ebp
movzx eax, byte [ecx]
inc ecx
mov edi, eax
mov dword [esp + 0x18], ecx
shl edi, 0x10
mov ecx, 0x100
or edi, eax
imul edi, edx
mov edx, 0x100
shr edi, 8
and edi, 0xff00ff
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
test ebp, ebp
jg 0x470ed8
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov ecx, dword [esp + 0x18]
mov edx, 0x100
dec ebp
movzx eax, byte [ecx]
inc ecx
mov edi, eax
mov dword [esp + 0x18], ecx
shl edi, 0x10
mov ecx, 0x100
or edi, eax
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [esp + 0x14]
test ebp, ebp
jg 0x470fa0
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x471060
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, ecx
cmp ebp, dword [edi + 0x6c]
jle 0x471086
mov dword [edi + 0x6c], ebp
push dword [edi + 0x68]
call fcn.0051723e
push ebp
call fcn.00517259
add esp, 8
mov dword [edi + 0x68], eax
mov eax, dword [edi + 0x68]
mov ecx, edi
mov esi, dword [esp + 0x14]
push ebp
push esi
push eax
mov dword [esp + 0x24], eax
call fcn.00432220
mov eax, dword [edi + 0x48]
mov edx, dword [edi + 0x50]
imul edx, dword [esp + 0x1c]
mov eax, dword [eax + 0x10]
mov ebx, eax
imul ebx, esi
mov dword [esp + 0x14], eax
sar edx, 8
mov dword [esp + 0x1c], edx
add ebx, dword [edi + 0x64]
cmp edx, 0xfe
jge 0x471190
mov ecx, dword [esp + 0x18]
dec ebp
movzx eax, byte [ecx]
inc ecx
mov edi, eax
mov dword [esp + 0x18], ecx
shl edi, 0x10
mov ecx, 0x100
or edi, eax
imul edi, edx
mov edx, 0x100
shr edi, 8
and edi, 0xff00ff
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
test ebp, ebp
jg 0x4710c8
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
mov ecx, dword [esp + 0x18]
mov edx, 0x100
dec ebp
movzx eax, byte [ecx]
inc ecx
mov edi, eax
mov dword [esp + 0x18], ecx
shl edi, 0x10
mov ecx, 0x100
or edi, eax
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [esp + 0x14]
test ebp, ebp
jg 0x471190
pop edi
pop esi
pop ebp
pop ebx
ret 0xc