joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495fd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x620cd4]
sub esp, 0x48
push esi
push edi
mov esi, ecx
push 0
mov ecx, dword [eax]
push 0
push eax
call dword [ecx + 0xb8]
fld dword [0x661364]
fcomp dword [0x588984]
fnstsw ax
test ah, 0x41
jne 0x496003
mov ecx, 1
jmp 0x496005
xor ecx, ecx
fld dword [0x661364]
fcomp dword [0x589dfc]
fnstsw ax
test ah, 1
je 0x49601f
mov eax, 1
jmp 0x496021
xor eax, eax
test ecx, eax
je 0x49603b
fld dword [0x661364]
fmul dword [0x588440]
fsin
fmul dword [0x58831c]
jmp 0x496041
fld dword [0x58831c]
fld dword [0x6213fc]
fmul dword [0x5883dc]
fadd dword [0x661364]
fst dword [0x661364]
fcomp dword [0x58877c]
fnstsw ax
test ah, 1
jne 0x496078
fld dword [0x661364]
fsub dword [0x58877c]
fstp dword [0x661364]
lea edx, [esi + 0x3a8]
mov ecx, 0x1a
xor eax, eax
mov edi, edx
rep stosd dword es:[edi], eax
fst dword [esp + 0x14]
fmul dword [0x5885d4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x20], 0x3f333333
mov ecx, dword [esp + 0x20]
lea eax, [esi + 0x3ac]
mov dword [esp + 0x24], 0x3f333333
mov dword [esp + 0x28], 0x3f333333
mov dword [esp + 0x2c], 0x3f800000
mov dword [eax], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x30], 0x3e99999a
mov dword [esp + 0x34], 0x3e99999a
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x38], 0x3e99999a
mov dword [esp + 0x3c], 0x3f800000
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x40], 0x3f800000
mov dword [esp + 0x44], 0x3f800000
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x30]
lea eax, [esi + 0x3cc]
mov dword [esp + 0x48], 0x3f800000
mov dword [esp + 0x4c], 0x3f800000
mov dword [esp + 0x10], 0xc2c80000
mov dword [eax], ecx
mov ecx, dword [esp + 0x34]
fstp dword [esp + 0x1c]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x38]
mov dword [esi + 0x3fc], 0x3f800000
mov dword [esi + 0x3f4], 0x42c80000
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x18], 0xbf800000
push edx
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x44]
lea eax, [esi + 0x3bc]
push 6
mov dword [edx], 3
mov dword [eax], ecx
mov ecx, dword [esp + 0x4c]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x50]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x54]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x10]
lea eax, [esi + 0x3dc]
add esi, 0x3e8
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esi], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 4], ecx
mov ecx, 0x620cd0
mov dword [esi + 8], eax
call fcn.0040cfb0
mov eax, dword [0x620cd4]
push 1
push 6
push eax
mov ecx, dword [eax]
call dword [ecx + 0xb8]
pop edi
pop esi
add esp, 0x48
ret
Function at 0x496630
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x48
mov edx, ecx
push esi
push edi
mov ecx, 0x1a
lea esi, [edx + 0x478]
xor eax, eax
mov edi, esi
mov dword [esp + 8], eax
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], 0x3f333333
mov ecx, dword [esp + 0x20]
lea eax, [edx + 0x47c]
mov dword [esp + 0x24], 0x3f333333
mov dword [esp + 0x28], 0x3f333333
mov dword [esp + 0x2c], 0x3f800000
mov dword [eax], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x30], 0x3e99999a
mov dword [esp + 0x34], 0x3e99999a
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x38], 0x3e99999a
mov dword [esp + 0x3c], 0x3f800000
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x40], 0x3f800000
mov dword [esp + 0x44], 0x3f800000
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x30]
lea eax, [edx + 0x49c]
mov dword [esp + 0x48], 0x3f800000
mov dword [esp + 0x4c], 0x3f800000
mov dword [edx + 0x4cc], 0x3f800000
mov dword [eax], ecx
mov ecx, dword [esp + 0x34]
mov dword [edx + 0x4c4], 0x43480000
mov dword [esp + 0x14], 0x3f800000
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x18], 0xbf800000
mov dword [esp + 0x1c], 0x3f800000
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x3c]
push esi
push 0
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x48]
lea eax, [edx + 0x48c]
mov dword [esi], 3
mov dword [eax], ecx
mov ecx, dword [esp + 0x4c]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x50]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x54]
mov dword [eax + 0xc], ecx
mov ecx, dword [esp + 0x10]
lea eax, [edx + 0x4ac]
add edx, 0x4b8
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [edx], eax
mov eax, dword [esp + 0x24]
mov dword [edx + 4], ecx
mov ecx, 0x620cd0
mov dword [edx + 8], eax
call fcn.0040cfb0
mov eax, dword [0x620cd4]
push 1
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0xb8]
pop edi
pop esi
add esp, 0x48
ret
Function at 0x4d2660
Capabilities:
Get memory capacity

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov byte [esi + 0x2cf07], bl
call fcn.004b7140
lea ebp, [esi + 0x2cdd0]
mov ecx, 0x1a
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
push 0x64f560
mov ecx, 0x64f558
call fcn.00432ca0
push ebx
push 0x36
call fcn.00401000
mov edi, eax
mov ecx, 0xd
xor eax, eax
mov dword [esi + 0x2ce74], edi
rep stosd dword es:[edi], eax
add esp, 8
mov ecx, esi
stosw word es:[edi], ax
call fcn.004d47a0
lea eax, [esi + 0x2ce3c]
mov ecx, 0x64ee90
push eax
mov byte [esi + 0x2cdd2], 1
mov byte [ebp], bl
mov byte [esi + 0x2cdd1], 1
call fcn.00443810
mov ecx, dword [esi + 0x2ce74]
mov dword [esi + 0x2ce38], eax
mov dword [esi + 0x2ce20], ecx
mov cl, byte [esi + 0x1608]
cmp cl, 1
mov dword [esi + 0x2cdd4], 0x3f800000
jg 0x4d270d
mov dword [esi + 0x2cdf0], 0x623aac
jmp 0x4d2717
mov dword [esi + 0x2cdf0], 0x628eda
mov ecx, esi
mov dword [esi + 0x2cdf8], ebx
mov dword [esi + 0x2ce00], ebx
mov dword [esi + 0x2ce04], ebx
mov dword [esi + 0x2ce08], ebx
mov dword [esi + 0x2ce0c], ebx
mov dword [esi + 0x2ce10], ebx
mov dword [esi + 0x2ce18], eax
mov dword [esi + 0x2cdf4], 0x623bd8
mov dword [esi + 0x2ce14], 0x5a3398
mov dword [esi + 0x2cdec], 0x5a3394
call fcn.004d4700
mov eax, dword [esi + 0x2cef0]
mov edx, dword [esi + 0x2cef4]
mov cl, byte [esi + 0x16e3]
mov dword [esi + 0x2ce30], eax
mov dword [esi + 0x2ce2c], edx
mov byte [eax], cl
mov edx, dword [esi + 0x2cef0]
mov al, byte [esi + 0x16e4]
mov byte [edx + 1], al
mov ecx, dword [esi + 0x2cef0]
mov dl, byte [esi + 0x16e5]
mov byte [ecx + 2], dl
mov eax, dword [esi + 0x2cef0]
mov cl, byte [esi + 0x16e6]
mov byte [eax + 3], cl
mov edx, dword [esi + 0x2cef0]
mov al, byte [esi + 0x16e7]
mov byte [edx + 4], al
mov ecx, dword [esi + 0x2cef0]
mov dl, byte [esi + 0x16e8]
mov byte [ecx + 5], dl
mov ecx, 0x64f558
mov dword [0x650d60], ebp
call fcn.00431f00
mov eax, dword [esi + 0x2ce38]
mov ecx, 0x64ee90
push eax
call fcn.00443ed0
push 0x6613e8
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
Function at 0x4d4aa0
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
lea ebp, [esi + 0x2cdd0]
mov ecx, 0x1a
xor eax, eax
mov edi, ebp
mov byte [esi + 0x2cf08], bl
push 0x64f960
rep stosd dword es:[edi], eax
mov ecx, 0x64f558
call fcn.00432ca0
push ebx
push 0x36
call fcn.00401000
mov edi, eax
mov ecx, 0xd
xor eax, eax
mov dword [esi + 0x2cea8], edi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 0x1c]
add esp, 8
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
mov ecx, esi
push eax
mov byte [esi + 0x2cdd2], 1
mov byte [ebp], 1
mov byte [esi + 0x2cdd1], 5
call fcn.004d7800
lea ecx, [esp + 0x14]
push ecx
mov ecx, 0x64ee90
call fcn.00443810
mov edx, dword [esi + 0x2cea8]
mov dword [esi + 0x2ce38], eax
mov dword [esi + 0x2ce20], edx
mov dword [esi + 0x2cdd4], 0x3f800000
mov dword [esi + 0x2cdf0], 0x623aac
mov dword [esi + 0x2cdf8], ebx
mov dword [esi + 0x2ce00], ebx
mov dword [esi + 0x2ce04], ebx
mov dword [esi + 0x2ce08], ebx
mov dword [esi + 0x2ce0c], ebx
mov dword [esi + 0x2ce10], ebx
mov dword [esi + 0x2ce18], eax
mov dword [esi + 0x2cdf4], 0x623bd8
mov dword [esi + 0x2ce14], 0x5a3398
mov dword [esi + 0x2cdec], 0x5a3394
lea edi, [esi + 0x2cef8]
mov dword [esp + 0x10], 2
push ebx
push 6
call fcn.00401000
mov dword [edi], eax
mov byte [eax], 0xff
mov eax, dword [edi]
add esp, 8
add edi, 4
mov byte [eax + 1], 0xff
mov ecx, dword [edi - 4]
mov byte [ecx + 4], 0xff
mov edx, dword [edi - 4]
mov byte [edx + 2], 0xff
mov eax, dword [edi - 4]
mov byte [eax + 3], 0xff
mov ecx, dword [edi - 4]
mov eax, dword [esp + 0x10]
dec eax
mov byte [ecx + 5], 0xff
mov dword [esp + 0x10], eax
jne 0x4d4ba5
mov edx, dword [esi + 0x2cef8]
mov eax, dword [esi + 0x2cefc]
mov dword [esi + 0x2ce30], edx
mov dword [esi + 0x2ce2c], eax
mov ecx, 0x64f558
mov dword [0x650d60], ebp
call fcn.00431f00
mov ecx, dword [esi + 0x2ce38]
push ecx
mov ecx, 0x64ee90
call fcn.00443ed0
push 0x661468
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x3c
ret
Function at 0x4f3e60
Capabilities:
Get memory capacity

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov esi, ecx
push 0x661510
call edi
mov al, byte [esi + 0xb8]
cmp al, 0xff
je 0x4f3e9a
and eax, 0xff
push 0
lea ecx, [eax + eax*2]
shl ecx, 4
add ecx, eax
mov eax, dword [0x64f52c]
shl ecx, 4
add ecx, eax
call fcn.00472450
push 0x661510
call edi
mov eax, dword [esp + 0x10]
mov ecx, 0x64f4e0
and eax, 0xff
push eax
call fcn.00473ad0
mov ebx, eax
cmp ebx, 0xff
je 0x4f3ed5
mov eax, dword [0x64f52c]
lea ecx, [ebx + ebx*2]
shl ecx, 4
add ecx, ebx
push 0
shl ecx, 4
add ecx, eax
jmp 0x4f3ede
mov ecx, dword [0x64f52c]
xor ebx, ebx
push ebx
call fcn.00472310
mov dword [esi + 0x18c], eax
mov byte [esi + 0xb8], bl
pop edi
pop esi
pop ebx
ret 4

Function at 0x4f5180
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xe8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x18], esi
fld dword [esi + 0x38]
fcomp dword [0x588314]
mov dword [esp + 0x1c], str.MusicName_1
mov dword [esp + 0x20], str.MusicName_2
mov dword [esp + 0x24], str.MusicName_3
mov dword [esp + 0x28], str.MusicName_4
mov dword [esp + 0x2c], str.MusicName_5
mov dword [esp + 0x30], str.MusicName_6
fnstsw ax
mov dword [esp + 0x34], str.MusicName_7
test ah, 1
jne 0x4f51f0
fld dword [esi + 0x3c]
fcomp dword [0x588314]
fnstsw ax
test ah, 1
je 0x4f51f0
fld dword [0x588318]
jmp 0x4f5229
fld dword [esi + 0x38]
call fcn.005755f0
cdq
xor eax, edx
sub eax, edx
cmp eax, 5
mov dword [esp + 0x10], eax
jg 0x4f5218
fild dword [esp + 0x10]
fmul dword [0x5892d8]
fsubr dword [0x588318]
jmp 0x4f5229
add eax, 0xfffffffb
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
fmul dword [0x5892d8]
fmul dword [0x58860c]
xor ebx, ebx
mov dword [esp + 0x10], ebx
call fcn.005755f0
mov edi, eax
lea ebp, [esp + 0x1c]
shl edi, 0x18
or edi, 0xffffff
mov dword [esp + 0x14], edi
jmp 0x4f5257
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov ecx, dword [esi + 0xc8]
lea eax, [esp + 0x78]
push eax
call fcn.00498df0
fild dword [esp + 0x10]
push 0xbc23d70a
push ecx
lea ecx, [esp + 0xc0]
mov esi, eax
fmul dword [0x588620]
fsubr dword [0x588330]
fstp dword [esp]
push 0
push ecx
mov ecx, 0x65cb50
call fcn.004937c0
push esi
lea edx, [esp + 0x3c]
push eax
push edx
call fcn.0055734a
push 1
mov eax, dword [ebp]
push edi
push 0x3fc00000
sub esp, 0x40
mov ecx, 0x10
lea esi, [esp + 0x84]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x661354]
push eax
call fcn.00553880
inc ebx
add ebp, 4
cmp ebx, 7
mov dword [esp + 0x10], ebx
jl 0x4f524f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xe8
ret
Function at 0x53e0d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x40
mov cl, byte [esp + 0x44]
mov byte [esp], 1
mov byte [esp + 1], 0x38
mov byte [esp + 2], 0x3a
mov byte [esp + 3], 0x3b
mov byte [esp + 4], 0x3c
mov byte [esp + 5], 0x3d
mov byte [esp + 6], 0x3e
mov byte [esp + 7], 0x3f
mov byte [esp + 8], 0x40
mov byte [esp + 9], 0x41
mov byte [esp + 0xa], 0x42
mov byte [esp + 0xb], 0x43
mov byte [esp + 0xc], 0x44
mov byte [esp + 0xd], 0x45
mov byte [esp + 0xe], 0x46
mov byte [esp + 0xf], 0x56
mov byte [esp + 0x10], 0x57
mov byte [esp + 0x11], 0x58
mov byte [esp + 0x12], 0x64
mov byte [esp + 0x13], 0x65
mov byte [esp + 0x14], 0x66
mov byte [esp + 0x15], 0x70
mov byte [esp + 0x16], 0x73
mov byte [esp + 0x17], 0x79
mov byte [esp + 0x18], 0x7b
mov byte [esp + 0x19], 0x7d
mov byte [esp + 0x1a], 0x7e
mov byte [esp + 0x1b], 0x8d
mov byte [esp + 0x1c], 0x90
mov byte [esp + 0x1d], 0x91
mov byte [esp + 0x1e], 0x92
mov byte [esp + 0x1f], 0x93
mov byte [esp + 0x20], 0x94
mov byte [esp + 0x21], 0x95
mov byte [esp + 0x22], 0x96
mov byte [esp + 0x23], 0x97
mov byte [esp + 0x24], 0x99
mov byte [esp + 0x25], 0xa0
mov byte [esp + 0x26], 0xa1
mov byte [esp + 0x27], 0xa2
mov byte [esp + 0x28], 0xa4
mov byte [esp + 0x29], 0xae
mov byte [esp + 0x2a], 0xb0
mov byte [esp + 0x2b], 0xb2
mov byte [esp + 0x2c], 0xb3
mov byte [esp + 0x2d], 0xb7
mov byte [esp + 0x2e], 0xb8
mov byte [esp + 0x2f], 0xc5
mov byte [esp + 0x30], 0xdb
mov byte [esp + 0x31], 0xdc
mov byte [esp + 0x32], 0xdd
mov byte [esp + 0x33], 0xde
mov byte [esp + 0x34], 0xdf
mov byte [esp + 0x35], 0xe3
mov byte [esp + 0x36], 0xe5
mov byte [esp + 0x37], 0xe6
mov byte [esp + 0x38], 0xe7
mov byte [esp + 0x39], 0xe8
mov byte [esp + 0x3a], 0xe9
mov byte [esp + 0x3b], 0xea
mov byte [esp + 0x3c], 0xeb
mov byte [esp + 0x3d], 0xec
mov byte [esp + 0x3e], 0xed
xor eax, eax
cmp cl, byte [esp + eax]
je 0x53e228
inc eax
cmp eax, 0x3f
jb 0x53e214
mov al, 1
add esp, 0x40
ret 4
xor al, al
add esp, 0x40
ret 4
Function at 0x55a474
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x1054]
push edi
mov edi, dword [edx + 0x1048]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x55a5c9
push ebx
mov ebx, 0xffc03fc0
mov edx, dword [edx + 0x1050]
lea edx, [eax + edx*4]
add edi, eax
cmp eax, edx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x55a5a4
mov esi, dword [eax + 4]
mov eax, dword [eax]
mov edx, dword [edi + 4]
mov edi, dword [edi]
mov ecx, eax
shr ecx, 2
and ecx, ebx
mov ebp, edi
shr ebp, 2
and ebp, ebx
add ecx, ebp
mov ebp, esi
shr ebp, 2
and ebp, ebx
add ecx, ebp
mov ebp, edx
shr ebp, 2
and ebp, ebx
lea ebx, [ecx + ebp - 0x7fff80]
mov ecx, eax
mov ebp, edi
and ecx, 0xff00ff
and ebp, 0xff00ff
add ecx, ebp
mov ebp, esi
and ebp, 0xff00ff
add ecx, ebp
mov ebp, edx
and ebp, 0xff00ff
shr eax, 2
lea ecx, [ecx + ebp + 0x20002]
shr ecx, 2
xor ebx, ecx
mov ecx, 0x3fc03fc0
and eax, ecx
shr edi, 2
and edi, ecx
add eax, edi
mov edi, dword [esp + 0x18]
shr esi, 2
and esi, ecx
add eax, esi
shr edx, 2
and edx, ecx
lea eax, [eax + edx + 0x800080]
and ebx, 0xff00ff
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 4
mov dword [eax], ebx
mov eax, dword [esp + 0x14]
add eax, 8
add edi, 8
cmp eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov ebx, 0xffc03fc0
jb 0x55a4d7
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1048]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1048]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x55a4b4
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x55a6ee
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1054]
push edi
mov edi, dword [esi + 0x1048]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x55a835
push ebx
mov edx, 0xf81f
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1050]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x55a810
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff07e0
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x1002]
mov ebp, eax
and ebp, 0xffff07e0
add ebp, ecx
mov ecx, edi
and ecx, 0xffff07e0
add ebp, ecx
mov ecx, esi
and ecx, 0xffff07e0
shr ebx, 2
lea ecx, [ecx + ebp + 0x40]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff07e0
lea eax, [eax + esi + 0x1002]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x55a757
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1048]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1048]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x55a72e
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x55a962
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1054]
mov edx, dword [esi + 0x18]
push edi
mov edi, dword [esi + 0x1048]
imul ebp, edi
add ebp, edx
cmp edx, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], ebp
jae 0x55aaa8
push ebx
mov eax, 0x83e0
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1050]
lea esi, [edx + esi*2]
mov dword [esp + 0x10], ebx
add edi, edx
cmp edx, esi
mov ebx, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x55aa83
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx edx, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
and ebp, eax
mov ebx, edx
and ebx, eax
add ebx, ebp
mov ebp, edi
and ebp, eax
add ebx, ebp
mov dword [esp + 0x24], ecx
and ecx, 0x7c1f
mov ebp, esi
and ebp, eax
lea ebx, [ebx + ebp + 0x10040]
mov ebp, edx
and ebp, 0x7c1f
add ebp, ecx
mov ecx, edi
and ecx, 0x7c1f
add ebp, ecx
mov ecx, esi
and ecx, 0x7c1f
lea ecx, [ecx + ebp + 0x802]
shr ecx, 2
shr ebx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and ecx, eax
and edx, eax
add edx, ecx
and edi, eax
add edx, edi
mov edi, dword [esp + 0x1c]
and esi, eax
and ebx, 0xffff7c1f
lea ecx, [edx + esi + 0x10040]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [ecx], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x55a9cb
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1048]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1048]
lea edx, [edx + edi*2]
cmp edx, ebp
mov dword [esp + 0x20], edx
jb 0x55a9a2
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x55aab1
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x1054]
push edi
mov edi, dword [esi + 0x1048]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x55abfb
push ebx
mov edx, 0xf0f0
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1050]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x55abd6
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff0f0f
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x2020]
mov ebp, eax
and ebp, 0xffff0f0f
add ebp, ecx
mov ecx, edi
and ecx, 0xffff0f0f
add ebp, ecx
mov ecx, esi
and ecx, 0xffff0f0f
shr ebx, 2
lea ecx, [ecx + ebp + 0x202]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff0f0f
lea eax, [eax + esi + 0x2020]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x55ab1a
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1048]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1048]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x55aaf1
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x55ac04
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x1054]
push edi
mov edi, dword [edx + 0x1048]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x55ad3a
push ebx
mov edx, dword [edx + 0x1050]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x55ad15
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0x1c
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 8]
mov ecx, eax
and ecx, 0xffff00e3
mov ebx, ebp
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00e3
shr edx, 2
lea ecx, [ecx + ebx + 0x42]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xe3
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0x1c
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x42]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x55ac63
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1048]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1048]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x55ac3f
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret