joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422f5c
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
push ebp
push edx
mov esi, dword [eax + 0x38]
mov ebx, dword [edx]
mov edx, dword [edx + 4]
xchg bh, bl
xchg dh, dl
rol ebx, 0x10
rol edx, 0x10
xchg bh, bl
xchg dh, dl
xor ebx, dword [esi + 0x1044]
mov edi, 0x10
mov eax, ebx
shr ebx, 0x10
movzx ecx, bh
mov ebp, dword [esi + ecx*4]
movzx ecx, bl
add ebp, dword [esi + ecx*4 + 0x400]
movzx ecx, ah
xor ebp, dword [esi + ecx*4 + 0x800]
movzx ecx, al
add ebp, dword [esi + ecx*4 + 0xc00]
xor edx, dword [esi + edi*4 + 0x1000]
xor ebp, edx
mov edx, eax
mov ebx, ebp
dec edi
jne 0x422f82
pop eax
xor edx, dword [esi + 0x1000]
xchg bh, bl
xchg dh, dl
rol ebx, 0x10
rol edx, 0x10
xchg bh, bl
xchg dh, dl
mov dword [eax], edx
mov dword [eax + 4], ebx
pop ebp
pop ebx
pop esi
pop edi
ret

Function at 0x422fdc
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
push ebp
push edx
mov esi, dword [eax + 0x38]
mov ebx, dword [edx]
mov ebp, dword [edx + 4]
bswap ebx
bswap ebp
xor edi, edi
xor ebx, dword [esi + 0x1000]
mov eax, ebx
shr ebx, 0x10
movzx ecx, bh
mov edx, dword [esi + ecx*4]
movzx ecx, bl
add edx, dword [esi + ecx*4 + 0x400]
movzx ecx, ah
xor edx, dword [esi + ecx*4 + 0x800]
movzx ecx, al
add edx, dword [esi + ecx*4 + 0xc00]
xor ebp, dword [esi + edi*4 + 0x1004]
inc edi
xor edx, ebp
test edi, 0x10
mov ebp, eax
mov ebx, edx
je 0x422ff5
pop eax
xor ebp, dword [esi + 0x1044]
bswap ebx
bswap ebp
mov dword [eax], ebp
mov dword [eax + 4], ebx
pop ebp
pop ebx
pop esi
pop edi
ret

Function at 0x42304c
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
push ebp
push edx
mov esi, dword [eax + 0x38]
mov ebx, dword [edx]
mov ebp, dword [edx + 4]
bswap ebx
bswap ebp
xor ebx, dword [esi + 0x1044]
mov edi, 0x10
mov eax, ebx
shr ebx, 0x10
movzx ecx, bh
mov edx, dword [esi + ecx*4]
movzx ecx, bl
add edx, dword [esi + ecx*4 + 0x400]
movzx ecx, ah
xor edx, dword [esi + ecx*4 + 0x800]
movzx ecx, al
add edx, dword [esi + ecx*4 + 0xc00]
xor ebp, dword [esi + edi*4 + 0x1000]
xor edx, ebp
dec edi
mov ebp, eax
mov ebx, edx
jne 0x423068
pop eax
xor ebp, dword [esi + 0x1000]
bswap ebx
bswap ebp
mov dword [eax], ebp
mov dword [eax + 4], ebx
pop ebp
pop ebx
pop esi
pop edi
ret
Function at 0x4230b8
Capabilities:
Encode data using xor
Encrypt data using blowfish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call sym.NLSAgtConfig.exe__Cipher_TCipher_InitBegin_qqrri
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov edi, eax
add eax, 0x1000
mov dword [ebp - 0x18], eax
mov edx, edi
mov eax, 0x4be930
mov ecx, 0x1000
call fcn.0044ed08
mov edx, dword [ebp - 0x18]
mov eax, 0x4bf930
mov ecx, 0x48
call fcn.0044ed08
xor ebx, ebx
xor esi, esi
lea eax, [ebx]
cdq
idiv dword [ebp - 8]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov cl, byte [eax + edx]
shl ecx, 0x18
lea eax, [ebx + 1]
cdq
idiv dword [ebp - 8]
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + edx]
shl eax, 0x10
add ecx, eax
lea eax, [ebx + 2]
cdq
idiv dword [ebp - 8]
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + edx]
shl eax, 8
add ecx, eax
lea eax, [ebx + 3]
cdq
idiv dword [ebp - 8]
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + edx]
add ecx, eax
mov eax, dword [ebp - 0x18]
xor dword [eax + esi*4], ecx
lea eax, [ebx + 4]
cdq
idiv dword [ebp - 8]
mov ebx, edx
inc esi
cmp esi, 0x12
jne 0x42310e
lea eax, [ebp - 0x10]
xor ecx, ecx
mov edx, 8
call fcn.0044f52c
xor esi, esi
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [sym.NLSAgtConfig.exe__Decutil_SwapInteger]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov eax, dword [eax]
call edx
mov ebx, esi
add ebx, ebx
mov edx, dword [ebp - 0x18]
mov dword [edx + ebx*4], eax
mov edx, dword [sym.NLSAgtConfig.exe__Decutil_SwapInteger]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov eax, dword [eax + 4]
call edx
mov edx, dword [ebp - 0x18]
mov dword [edx + ebx*4 + 4], eax
inc esi
cmp esi, 9
jne 0x42317b
xor esi, esi
xor ebx, ebx
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, dword [sym.NLSAgtConfig.exe__Decutil_SwapInteger]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov eax, dword [eax]
call edx
mov edx, esi
shl edx, 7
lea edx, [edi + edx*8]
mov ecx, ebx
add ecx, ecx
mov dword [edx + ecx*4], eax
mov edx, dword [sym.NLSAgtConfig.exe__Decutil_SwapInteger]
mov edx, dword [edx]
lea eax, [ebp - 0x10]
mov eax, dword [eax + 4]
call edx
mov edx, esi
shl edx, 7
lea edx, [edi + edx*8]
mov ecx, ebx
add ecx, ecx
mov dword [edx + ecx*4 + 4], eax
inc ebx
cmp ebx, 0x80
jne 0x4231c0
inc esi
cmp esi, 4
jne 0x4231be
lea eax, [ebp - 0x10]
xor ecx, ecx
mov edx, 8
call fcn.0044f52c
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4232b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov edi, dword [sym.NLSAgtConfig.exe__Decutil_SwapInteger]
mov edi, dword [edi]
mov esi, dword [ebp - 8]
mov eax, dword [esi]
call edi
mov dword [ebp - 4], eax
movzx edi, word [ebp - 2]
movzx eax, word [ebp - 4]
mov dword [ebp - 0xc], eax
mov edx, dword [sym.NLSAgtConfig.exe__Decutil_SwapInteger]
mov edx, dword [edx]
mov eax, dword [esi + 4]
call edx
mov dword [ebp - 4], eax
movzx eax, word [ebp - 2]
mov dword [ebp - 0x10], eax
movzx eax, word [ebp - 4]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 4], eax
movzx edx, word [ebx]
mov eax, edi
call fcn.00423280
mov edi, eax
movzx eax, word [ebx + 2]
add dword [ebp - 0xc], eax
movzx eax, word [ebx + 4]
add dword [ebp - 0x10], eax
movzx edx, word [ebx + 6]
mov eax, dword [ebp - 0x14]
call fcn.00423280
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x10]
xor esi, edi
movzx edx, word [ebx + 8]
mov eax, esi
call fcn.00423280
mov esi, eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x14]
add eax, esi
movzx edx, word [ebx + 0xa]
call fcn.00423280
add esi, eax
xor edi, eax
xor dword [ebp - 0x14], esi
xor esi, dword [ebp - 0xc]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
add ebx, 0xc
inc dword [ebp - 4]
cmp dword [ebp - 4], 8
jne 0x4232fe
movzx edx, word [ebx]
mov eax, edi
call fcn.00423280
mov word [ebp - 2], ax
mov ax, word [ebp - 0x10]
add ax, word [ebx + 2]
mov word [ebp - 4], ax
mov edi, dword [sym.NLSAgtConfig.exe__Decutil_SwapInteger]
mov edi, dword [edi]
mov eax, dword [ebp - 4]
call edi
mov esi, dword [ebp - 8]
mov dword [esi], eax
mov ax, word [ebp - 0xc]
add ax, word [ebx + 4]
mov word [ebp - 2], ax
movzx edx, word [ebx + 6]
mov eax, dword [ebp - 0x14]
call fcn.00423280
mov word [ebp - 4], ax
mov ebx, dword [sym.NLSAgtConfig.exe__Decutil_SwapInteger]
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call ebx
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x423a24
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
mov esi, eax
mov edx, dword [ebp + 8]
mov edi, eax
add edi, 0x100
mov ecx, 1
xor ebx, ebx
mov eax, ecx
and al, 0xff
mov byte [esi], al
mov eax, ecx
and eax, 0xff
mov byte [edi + eax], bl
lea eax, [ecx + ecx*4]
lea eax, [eax + eax*8]
mov ecx, 0x101
cdq
idiv ecx
mov ecx, edx
inc esi
inc ebx
cmp ebx, 0x100
jne 0x423a47
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x423fa4
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push edi
push esi
push ebx
push ebp
push edx
mov ebx, dword [edx]
mov edx, dword [edx + 4]
xor edi, edi
mov esi, dword [eax + 0x38]
mov ecx, dword [eax + 0x40]
add edi, 0x9e3779b9
mov eax, edx
mov ebp, edx
shl eax, 4
shr ebp, 5
add eax, dword [esi]
add ebp, dword [esi + 4]
xor eax, edx
add eax, edi
xor eax, ebp
add eax, ebx
mov ebx, eax
shl eax, 4
mov ebp, ebx
shr ebp, 5
add eax, dword [esi + 8]
xor eax, ebx
add ebp, dword [esi + 0xc]
add eax, edi
xor eax, ebp
add edx, eax
dec ecx
jne 0x423fb6
pop eax
mov dword [eax], ebx
mov dword [eax + 4], edx
pop ebp
pop ebx
pop esi
pop edi
ret

Function at 0x423ffc
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push edi
push esi
push ebx
push ebp
push edx
mov ebx, dword [edx]
mov edx, dword [edx + 4]
mov esi, dword [eax + 0x38]
mov edi, 0x9e3779b9
mov ecx, dword [eax + 0x40]
imul edi, ecx
mov eax, ebx
mov ebp, ebx
shl eax, 4
shr ebp, 5
add eax, dword [esi + 8]
add ebp, dword [esi + 0xc]
xor eax, ebx
add eax, edi
xor eax, ebp
sub edx, eax
mov eax, edx
shl eax, 4
mov ebp, edx
shr ebp, 5
add eax, dword [esi]
xor eax, edx
add ebp, dword [esi + 4]
add eax, edi
xor eax, ebp
sub edi, 0x9e3779b9
sub ebx, eax
dec ecx
jne 0x424014
pop eax
mov dword [eax], ebx
mov dword [eax + 4], edx
pop ebp
pop ebx
pop esi
pop edi
ret

Function at 0x4240c0
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], edx
mov dword [esp], eax
xor ecx, ecx
mov eax, dword [esp + 4]
mov ebx, dword [eax]
mov eax, dword [eax + 4]
mov edx, dword [esp]
mov edx, dword [edx + 0x38]
mov dword [esp + 8], edx
mov edx, dword [esp]
mov edx, dword [edx + 0x40]
test edx, edx
jbe 0x42413b
mov esi, eax
shl esi, 4
mov edi, eax
shr edi, 5
xor esi, edi
mov edi, ecx
xor edi, eax
add esi, edi
mov edi, ecx
and edi, 3
mov ebp, dword [esp + 8]
add esi, dword [ebp + edi*4]
add ebx, esi
add ecx, 0x9e3779b9
mov esi, ebx
shl esi, 4
mov edi, ebx
shr edi, 5
xor esi, edi
mov edi, ecx
xor edi, ebx
add esi, edi
mov edi, ecx
shr edi, 0xb
and edi, 3
mov ebp, dword [esp + 8]
add esi, dword [ebp + edi*4]
add eax, esi
dec edx
jne 0x4240ed
mov edx, dword [esp + 4]
mov dword [edx], ebx
mov dword [edx + 4], eax
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42414c
Capabilities:
Encrypt data using xtea

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], edx
mov esi, dword [eax + 0x40]
imul ecx, esi, 0x9e3779b9
mov edx, dword [esp]
mov ebx, dword [edx]
mov edx, dword [edx + 4]
mov edi, dword [eax + 0x38]
mov dword [esp + 4], edi
test esi, esi
jbe 0x4241c2
mov eax, esi
mov esi, ebx
shl esi, 4
mov edi, ebx
shr edi, 5
xor esi, edi
mov edi, ecx
xor edi, ebx
add esi, edi
mov edi, ecx
shr edi, 0xb
and edi, 3
mov ebp, dword [esp + 4]
add esi, dword [ebp + edi*4]
sub edx, esi
sub ecx, 0x9e3779b9
mov esi, edx
shl esi, 4
mov edi, edx
shr edi, 5
xor esi, edi
mov edi, ecx
xor edi, edx
add esi, edi
mov edi, ecx
and edi, 3
mov ebp, dword [esp + 4]
add esi, dword [ebp + edi*4]
sub ebx, esi
dec eax
jne 0x424174
mov eax, dword [esp]
mov dword [eax], ebx
mov dword [eax + 4], edx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x424620
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
push ebp
push edx
mov edi, dword [eax + 0x38]
mov eax, dword [edx]
mov ebx, dword [edx + 4]
mov ecx, dword [edx + 8]
mov edx, dword [edx + 0xc]
mov ebp, 0x10
mov esi, eax
and eax, 0x3ff
mov eax, dword [eax*4 + 0x4bf978]
rol esi, 0xa
add eax, dword [edi]
xor eax, ebx
mov ebx, eax
and eax, 0x3ff
mov eax, dword [eax*4 + 0x4bf978]
rol ebx, 0xa
add eax, dword [edi + 4]
xor eax, ecx
mov ecx, eax
and eax, 0x3ff
mov eax, dword [eax*4 + 0x4bf978]
rol ecx, 0xa
add eax, dword [edi + 8]
xor eax, edx
mov edx, eax
and eax, 0x3ff
mov eax, dword [eax*4 + 0x4bf978]
rol edx, 0xa
add eax, dword [edi + 0xc]
xor eax, esi
add edi, 0x10
dec ebp
jne 0x424638
pop esi
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
pop ebp
pop ebx
pop edi
pop esi
ret

Function at 0x4246a8
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
push ebp
push edx
mov edi, dword [eax + 0x38]
lea edi, [edi + 0x100]
mov esi, dword [edx]
mov ebx, dword [edx + 4]
mov ecx, dword [edx + 8]
mov edx, dword [edx + 0xc]
mov ebp, 0x10
sub edi, 0x10
ror edx, 0xa
mov eax, edx
and eax, 0x3ff
mov eax, dword [eax*4 + 0x4bf978]
add eax, dword [edi + 0xc]
xor esi, eax
ror ecx, 0xa
mov eax, ecx
and eax, 0x3ff
mov eax, dword [eax*4 + 0x4bf978]
add eax, dword [edi + 8]
xor edx, eax
ror ebx, 0xa
mov eax, ebx
and eax, 0x3ff
mov eax, dword [eax*4 + 0x4bf978]
add eax, dword [edi + 4]
xor ecx, eax
ror esi, 0xa
mov eax, esi
and eax, 0x3ff
mov eax, dword [eax*4 + 0x4bf978]
add eax, dword [edi]
xor ebx, eax
dec ebp
jne 0x4246c6
pop eax
mov dword [eax], esi
mov dword [eax + 4], ebx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x42507c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0x38]
mov ebx, edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
xor ecx, dword [ebx]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 4]
xor ecx, dword [ebx + 4]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 8]
xor ecx, dword [ebx + 8]
mov dword [ebp - 8], ecx
mov eax, dword [eax + 0xc]
xor eax, dword [ebx + 0xc]
mov dword [ebp - 4], eax
lea ebx, [edx + 0x20]
lea ecx, [edx + 0xa0]
mov edx, 8
xor eax, eax
mov al, byte [ebp - 0x10]
mov eax, dword [ecx + eax*4]
movzx esi, byte [ebp - 0xf]
xor eax, dword [ecx + esi*4 + 0x400]
movzx esi, byte [ebp - 0xe]
xor eax, dword [ecx + esi*4 + 0x800]
movzx esi, byte [ebp - 0xd]
xor eax, dword [ecx + esi*4 + 0xc00]
movzx esi, byte [ebp - 0xc]
mov esi, dword [ecx + esi*4 + 0x400]
movzx edi, byte [ebp - 0xb]
xor esi, dword [ecx + edi*4 + 0x800]
movzx edi, byte [ebp - 0xa]
xor esi, dword [ecx + edi*4 + 0xc00]
movzx edi, byte [ebp - 9]
xor esi, dword [ecx + edi*4]
rol dword [ebp - 4], 1
lea edi, [esi + eax]
add edi, dword [ebx]
xor dword [ebp - 8], edi
lea eax, [eax + esi*2]
add eax, dword [ebx + 4]
xor dword [ebp - 4], eax
ror dword [ebp - 8], 1
xor eax, eax
mov al, byte [ebp - 8]
mov eax, dword [ecx + eax*4]
movzx esi, byte [ebp - 7]
xor eax, dword [ecx + esi*4 + 0x400]
movzx esi, byte [ebp - 6]
xor eax, dword [ecx + esi*4 + 0x800]
movzx esi, byte [ebp - 5]
xor eax, dword [ecx + esi*4 + 0xc00]
movzx esi, byte [ebp - 4]
mov esi, dword [ecx + esi*4 + 0x400]
movzx edi, byte [ebp - 3]
xor esi, dword [ecx + edi*4 + 0x800]
movzx edi, byte [ebp - 2]
xor esi, dword [ecx + edi*4 + 0xc00]
movzx edi, byte [ebp - 1]
xor esi, dword [ecx + edi*4]
rol dword [ebp - 0xc], 1
lea edi, [esi + eax]
add edi, dword [ebx + 8]
xor dword [ebp - 0x10], edi
lea eax, [eax + esi*2]
add eax, dword [ebx + 0xc]
xor dword [ebp - 0xc], eax
ror dword [ebp - 0x10], 1
add ebx, 0x10
dec edx
jne 0x4250c6
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax + 0x38]
mov edx, dword [ebp - 8]
xor edx, dword [ebx + 0x10]
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov edx, dword [ebp - 4]
xor edx, dword [ebx + 0x14]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x10]
xor edx, dword [ebx + 0x18]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0xc]
xor edx, dword [ebx + 0x1c]
mov dword [eax + 0xc], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4251d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 0x38]
mov ebx, edx
lea ecx, [edx + 0xa0]
mov eax, dword [ebp - 0x18]
mov esi, dword [eax]
xor esi, dword [ebx + 0x10]
mov dword [ebp - 0xc], esi
mov esi, dword [eax + 4]
xor esi, dword [ebx + 0x14]
mov dword [ebp - 0x10], esi
mov esi, dword [eax + 8]
xor esi, dword [ebx + 0x18]
mov dword [ebp - 4], esi
mov eax, dword [eax + 0xc]
xor eax, dword [ebx + 0x1c]
mov dword [ebp - 8], eax
lea ebx, [edx + 0x90]
mov edx, 8
xor eax, eax
mov al, byte [ebp - 0xc]
mov eax, dword [ecx + eax*4]
movzx esi, byte [ebp - 0xb]
xor eax, dword [ecx + esi*4 + 0x400]
movzx esi, byte [ebp - 0xa]
xor eax, dword [ecx + esi*4 + 0x800]
movzx esi, byte [ebp - 9]
xor eax, dword [ecx + esi*4 + 0xc00]
movzx esi, byte [ebp - 0xd]
mov esi, dword [ecx + esi*4]
movzx edi, byte [ebp - 0x10]
xor esi, dword [ecx + edi*4 + 0x400]
movzx edi, byte [ebp - 0xf]
xor esi, dword [ecx + edi*4 + 0x800]
movzx edi, byte [ebp - 0xe]
xor esi, dword [ecx + edi*4 + 0xc00]
rol dword [ebp - 4], 1
lea edi, [eax + esi*2]
add edi, dword [ebx + 0xc]
xor dword [ebp - 8], edi
add esi, eax
add esi, dword [ebx + 8]
xor dword [ebp - 4], esi
ror dword [ebp - 8], 1
xor eax, eax
mov al, byte [ebp - 4]
mov eax, dword [ecx + eax*4]
movzx esi, byte [ebp - 3]
xor eax, dword [ecx + esi*4 + 0x400]
movzx esi, byte [ebp - 2]
xor eax, dword [ecx + esi*4 + 0x800]
movzx esi, byte [ebp - 1]
xor eax, dword [ecx + esi*4 + 0xc00]
movzx esi, byte [ebp - 5]
mov esi, dword [ecx + esi*4]
movzx edi, byte [ebp - 8]
xor esi, dword [ecx + edi*4 + 0x400]
movzx edi, byte [ebp - 7]
xor esi, dword [ecx + edi*4 + 0x800]
movzx edi, byte [ebp - 6]
xor esi, dword [ecx + edi*4 + 0xc00]
rol dword [ebp - 0xc], 1
lea edi, [eax + esi*2]
add edi, dword [ebx + 4]
xor dword [ebp - 0x10], edi
add esi, eax
add esi, dword [ebx]
xor dword [ebp - 0xc], esi
ror dword [ebp - 0x10], 1
sub ebx, 0x10
dec edx
jne 0x425222
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax + 0x38]
mov edx, dword [ebp - 4]
xor edx, dword [ebx]
mov eax, dword [ebp - 0x18]
mov dword [eax], edx
mov edx, dword [ebp - 8]
xor edx, dword [ebx + 4]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0xc]
xor edx, dword [ebx + 8]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x10]
xor edx, dword [ebx + 0xc]
mov dword [eax + 0xc], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4253dc
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4253f2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4253eb
mov edx, esp
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xff
mov ebx, dword [ebp - 4]
shr ebx, 8
and ebx, 0xff
mov eax, dword [ebp - 4]
shr eax, 0x10
and eax, 0xff
mov esi, dword [ebp - 4]
shr esi, 0x18
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x20
jne 0x42547d
movzx ecx, byte [ecx + 0x4c0a78]
mov esi, dword [edx + 0xc]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x4c0978]
mov esi, dword [edx + 0xc]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x4c0978]
mov esi, dword [edx + 0xc]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x4c0a78]
mov edi, dword [edx + 0xc]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x18
jl 0x4254da
movzx ecx, byte [ecx + 0x4c0a78]
mov esi, dword [edx + 8]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x4c0a78]
mov esi, dword [edx + 8]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x4c0978]
mov esi, dword [edx + 8]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x4c0978]
mov edi, dword [edx + 8]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x4c0978]
mov esi, dword [edx + 4]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x4c0a78]
mov esi, dword [edx + 4]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x4c0978]
mov esi, dword [edx + 4]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x4c0a78]
mov edi, dword [edx + 4]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x4c0978]
mov esi, dword [edx]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x4c0978]
mov esi, dword [edx]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x4c0a78]
mov esi, dword [edx]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x4c0a78]
mov edx, dword [edx]
shr edx, 0x18
xor esi, edx
mov dword [ebp - 8], esi
mov edx, dword [ecx*4 + 0x4c0b78]
xor edx, dword [ebx*4 + 0x4c0f78]
xor edx, dword [eax*4 + 0x4c1378]
mov eax, dword [ebp - 8]
xor edx, dword [eax*4 + str.9g]
mov eax, edx
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4256dc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
and ecx, 0xff
imul ecx, ecx, 0x1010101
xor ebx, ebx
mov esi, dword [edx + ebx*4]
xor esi, ecx
mov dword [eax + ebx*4], esi
inc ebx
cmp ebx, 0x40
jne 0x4256ec
pop esi
pop ebx
ret
Function at 0x425700
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
mov edx, 0x4c0978
lea eax, [ebp - 0x100]
call fcn.004256dc
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x18]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x4c0978]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x4c0b78]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x425731
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 8
mov edx, 0x4c0a78
lea eax, [ebp - 0x100]
call fcn.004256dc
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x17]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x4c0978]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x4c0f78]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0x400], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x425780
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x10
mov edx, 0x4c0978
lea eax, [ebp - 0x100]
call fcn.004256dc
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x16]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x4c0a78]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x4c1378]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0x800], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x4257d3
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x18
mov edx, 0x4c0a78
lea eax, [ebp - 0x100]
call fcn.004256dc
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x15]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x4c0a78]
xor ebx, edx
mov ebx, dword [ebx*4 + str.9g]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0xc00], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x425826
pop esi
pop ebx
mov esp, ebp
pop ebp
ret