joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54e3c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, 0x98
call fcn.00585720
mov eax, dword [0x6019e4]
xor eax, esp
mov dword [esp + 0x94], eax
mov ecx, dword [esp + 0xa8]
push edi
mov edi, dword [esp + 0xa0]
mov dword [esp + 4], edi
mov eax, dword [ecx]
mov dword [esp + 0x68], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x6c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x70], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x74], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x78], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x7c], eax
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x80], eax
mov eax, dword [ecx + 0x1c]
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0x84], eax
mov dword [esp + 0x58], 0x61707865
mov dword [esp + 0x5c], 0x3320646e
mov eax, dword [ecx]
mov dword [esp + 0x88], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x8c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x90], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x60], 0x79622d32
mov dword [esp + 0x64], 0x6b206574
test eax, eax
je 0x54e5bd
push ebx
mov ebx, dword [esp + 0xa8]
push ebp
push esi
nop
mov esi, 0x40
cmp eax, esi
cmovb esi, eax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x24], esi
push eax
call fcn.0054e5e0
add esp, 8
xor eax, eax
test esi, esi
je 0x54e58c
cmp esi, 0x20
jb 0x54e564
lea edx, [edi - 1]
lea ecx, [esp + esi + 0x23]
add edx, esi
cmp edi, ecx
ja 0x54e4dc
lea ecx, [esp + 0x24]
cmp edx, ecx
jae 0x54e564
lea ecx, [ebx - 1]
add ecx, esi
cmp edi, ecx
ja 0x54e4e9
cmp edx, ebx
jae 0x54e564
mov ebp, esi
lea edx, [edi + 0x10]
lea esi, [esp + 0x24]
mov ecx, ebx
sub ecx, esi
and ebp, 0xffffffe0
mov dword [esp + 0x14], ecx
mov ecx, edi
sub ecx, esi
mov dword [esp + 0x18], ecx
mov ecx, ebx
mov ebx, dword [esp + 0x14]
sub ecx, edi
mov esi, dword [esp + 0x18]
mov edi, ecx
mov dword [esp + 0x1c], ecx
nop word [eax + eax]
movups xmm0, xmmword [esp + eax + 0x24]
lea ecx, [ebx + eax]
movups xmm1, xmmword [esp + ecx + 0x24]
lea ecx, [esi + eax]
lea edx, [edx + 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [esp + eax + 0x34]
add eax, 0x20
movups xmmword [esp + ecx + 0x24], xmm1
movups xmm1, xmmword [edi + edx - 0x20]
pxor xmm1, xmm0
movups xmmword [edx - 0x20], xmm1
cmp eax, ebp
jb 0x54e520
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0xb0]
cmp eax, esi
jae 0x54e58c
lea ecx, [esp + 0x24]
mov ebp, edi
sub ebx, ecx
sub ebp, ecx
lea edx, [esp + 0x24]
add edx, eax
inc eax
mov cl, byte [ebx + edx]
xor cl, byte [edx]
mov byte [edx + ebp], cl
cmp eax, esi
jb 0x54e572
mov ebx, dword [esp + 0xb0]
mov eax, dword [esp + 0xb4]
add edi, esi
inc dword [esp + 0x94]
sub eax, esi
add ebx, esi
mov dword [esp + 0x10], edi
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], eax
test eax, eax
jne 0x54e490
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x98]
pop edi
xor ecx, esp
call fcn.005852a8
add esp, 0x98
ret
Function at 0x5809d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.00585720
mov eax, dword [0x6019e4]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
mov ebx, dword [esp + 0xb8]
push ebp
push esi
mov esi, dword [esp + 0xbc]
xor ebp, ebp
mov dword [esp + 0x2c], eax
push edi
mov eax, dword [esi + 8]
mov dword [esp + 0x10], eax
sub eax, ebx
mov dword [esp + 0x24], eax
cmp dword [esi + 0xc], ebx
jae 0x580a30
push 0x4d4
push 0x5e5c38
push str.assertion_failed:_rec__orig_len___md_size
call fcn.004e7000
add esp, 0xc
cmp ebx, 0x40
jbe 0x580a4c
push 0x4d5
push 0x5e5c38
push str.assertion_failed:_md_size___EVP_MAX_MD_SIZE
call fcn.004e7000
add esp, 0xc
mov ecx, dword [esi + 0xc]
lea eax, [esp + 0x34]
neg eax
mov dword [esp + 0x20], ecx
and eax, 0x3f
lea edi, [esp + 0x34]
add edi, eax
lea eax, [ebx + 0x100]
mov dword [esp + 0x2c], edi
cmp ecx, eax
jbe 0x580a7a
mov ebp, ecx
sub ebp, ebx
sub ebp, 0x100
push ebx
xor esi, esi
mov dword [esp + 0x18], 0
push esi
push edi
call fcn.00587250
add esp, 0xc
mov dword [esp + 0x18], esi
cmp ebp, dword [esp + 0x20]
jae 0x580b2d
mov eax, dword [esp + 0xc0]
mov ecx, ebp
sub ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
mov eax, dword [eax + 0x14]
mov dword [esp + 0x28], eax
mov eax, ebp
mov edx, ecx
xor eax, dword [esp + 0x24]
xor edx, dword [esp + 0x10]
lea edi, [eax - 1]
not eax
shr eax, 0x1f
shr edi, 0x1f
and edi, eax
mov eax, ebp
xor eax, dword [esp + 0x10]
neg edi
or edx, eax
mov eax, dword [esp + 0x28]
xor edx, ebp
shr edx, 0x1f
neg edx
mov cl, byte [eax + ebp]
mov eax, edi
or eax, dword [esp + 0x14]
inc ebp
and eax, edx
mov edx, dword [esp + 0x18]
and edi, edx
mov dword [esp + 0x14], eax
and al, cl
or esi, edi
mov edi, dword [esp + 0x2c]
or byte [edx + edi], al
inc edx
mov ecx, edx
mov eax, edx
sub ecx, ebx
xor eax, ebx
xor ecx, ebx
or ecx, eax
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov ecx, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
cmp ebp, dword [esp + 0x20]
jb 0x580ab5
xor edx, edx
test ebx, ebx
je 0x580b61
mov ebp, dword [esp + 0x30]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + edi]
movzx eax, byte [esi + edi]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, ebx
mov eax, esi
xor ecx, ebx
xor eax, ebx
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, ebx
jb 0x580b37
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005852a8
add esp, 0xa8
ret
Function at 0x581530
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.00585720
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov eax, dword [ebx + 4]
mov edi, dword [esp + 0x28]
inc edi
mov eax, dword [eax + 0x64]
test byte [eax + 0x34], 1
je 0x58157d
mov ecx, dword [esp + 0x24]
mov edx, dword [esi + 8]
lea eax, [edi + ecx]
cmp eax, edx
jbe 0x58156d
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
add dword [esi + 0x14], ecx
sub edx, ecx
add dword [esi + 0x18], ecx
sub dword [esi + 0xc], ecx
mov dword [esi + 8], edx
jmp 0x581582
cmp edi, dword [esi + 8]
ja 0x581564
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 8]
push ebp
push dword [ebx + 0xb0]
mov al, byte [ecx + eax - 1]
movzx ebp, al
mov byte [esp + 0x30], al
mov dword [esp + 0x24], ebp
call fcn.004e8ff0
push eax
call fcn.00518170
add esp, 8
test eax, 0x200000
je 0x5815c8
or eax, 0xffffffff
sub eax, ebp
add dword [esi + 8], eax
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov edx, dword [esi + 8]
lea ecx, [edi + ebp]
mov ebx, edx
mov dword [esp + 0x10], edx
sub ebx, ecx
mov eax, edx
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, 0x100
xor ebx, edx
shr ebx, 0x1f
dec ebx
cmp edx, eax
cmovb eax, edx
xor edi, edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x581654
mov eax, dword [esi + 0x14]
mov esi, dword [esp + 0x20]
mov edx, esi
mov ebp, dword [esp + 0x10]
shr edx, 0x1f
dec ebp
mov dword [esp + 0x18], edx
add ebp, eax
nop
mov ecx, esi
lea ebp, [ebp - 1]
sub ecx, edi
mov eax, edi
shr ecx, 0x1f
inc edi
shr eax, 0x1f
xor cl, al
xor al, dl
or cl, al
movzx eax, byte [esp + 0x2c]
xor cl, dl
dec cl
movzx edx, cl
movzx ecx, byte [ebp + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x18]
cmp edi, dword [esp + 0x14]
jb 0x581610
mov esi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
not ebx
movzx eax, bl
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [ebp + 1]
neg ecx
and eax, ecx
sub edx, eax
mov eax, ecx
pop ebp
pop edi
mov dword [esi + 8], edx
and eax, 1
not ecx
pop esi
or eax, ecx
pop ebx
add esp, 0xc
ret
Function at 0x59ba21
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0059b8a0

Function at 0x59ef09
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0059ebc9
Function at 0x401230
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [edx]
push ebx
mov ebx, dword [ecx + 4]
push ebp
push esi
mov esi, dword [edx + 4]
push edi
xor edi, edi
mov ecx, edi
and ecx, 7
mov edx, dword [ecx + ebx]
add edx, eax
push edx
mov ebp, eax
call fcn.00401110
rol eax, 0xb
bswap eax
xor eax, esi
inc edi
cmp edi, 0x18
mov esi, ebp
jl 0x401242
mov edi, 0x1f
jmp 0x401270
mov ecx, edi
and ecx, 0x80000007
mov ebp, eax
jns 0x401281
dec ecx
or ecx, 0xfffffff8
inc ecx
mov edx, dword [ecx + ebx]
add edx, eax
push edx
call fcn.00401110
rol eax, 0xb
bswap eax
xor eax, esi
dec edi
mov esi, ebp
cmp edi, 0x17
jne 0x401270
mov ecx, dword [esp + 0x18]
pop edi
pop esi
mov dword [ecx], ebp
pop ebp
mov dword [ecx + 4], eax
pop ebx
ret 8

Function at 0x401580
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x50
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x58]
push ebx
mov ebx, dword [esp + 0x58]
push ebp
mov ebp, ecx
mov edx, dword [ebp]
push esi
mov dword [esp + 0xc], eax
mov eax, dword [edx]
push edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], 0
call eax
mov edi, dword [esp + 0x6c]
mov esi, eax
xor edx, edx
mov eax, edi
div esi
test edx, edx
jne 0x401683
mov ecx, dword [ebp + 0xc]
push esi
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.00468d50
add esp, 0xc
test edi, edi
je 0x40164d
mov eax, dword [esp + 0x10]
sub eax, ebx
mov dword [esp + 0x10], eax
jmp 0x4015f0
mov eax, dword [ebp]
mov eax, dword [eax + 0x24]
lea ecx, [esp + 0x1c]
push ecx
mov edx, ecx
push edx
mov ecx, ebp
call eax
xor ecx, ecx
test esi, esi
jle 0x401639
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
mov edi, ebx
sub edi, edx
sub eax, edx
lea edx, [eax + ebx]
lea esp, [esp]
lea eax, [esp + ecx + 0x1c]
mov bl, byte [edi + eax]
xor bl, byte [eax]
inc ecx
cmp ecx, esi
mov byte [edx + eax], bl
jl 0x401620
mov edi, dword [esp + 0x6c]
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add eax, esi
add ebx, esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], eax
cmp eax, edi
jne 0x4015f0
cmp dword [ebp + 0xc], 0
jne 0x401668
mov eax, dword [ebp]
mov edx, dword [eax]
mov ecx, ebp
call edx
push eax
call fcn.004691cd
add esp, 4
mov dword [ebp + 0xc], eax
mov eax, dword [ebp]
mov edx, dword [eax]
mov ecx, ebp
call edx
mov ecx, dword [ebp + 0xc]
push eax
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.00468d50
add esp, 0xc
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004690b5
add esp, 0x50
ret 0xc
Function at 0x4016a0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x94
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x9c]
push ebx
push ebp
mov ebp, dword [esp + 0xa0]
push edi
mov edi, ecx
mov dword [esp + 0xc], eax
mov eax, dword [edi]
mov edx, dword [eax]
xor ebx, ebx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebx
call edx
push eax
mov dword [esp + 0x1c], eax
mov eax, dword [edi + 0xc]
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.00468d50
add esp, 0xc
cmp dword [esp + 0xac], ebx
je 0x40179a
push esi
nop
mov esi, dword [esp + 0xb0]
mov eax, dword [esp + 0x1c]
sub esi, ebx
cmp esi, eax
jle 0x401713
mov esi, eax
push esi
lea edx, [esp + 0x64]
push ebp
push edx
call fcn.00468d50
mov eax, dword [edi]
mov eax, dword [eax + 0x24]
add esp, 0xc
lea ecx, [esp + 0x20]
push ecx
mov edx, ecx
push edx
mov ecx, edi
call eax
xor ecx, ecx
test esi, esi
jle 0x401769
lea edx, [esp + 0x20]
sub ebp, edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x20]
sub edx, eax
lea esp, [esp]
lea eax, [esp + ecx + 0x20]
mov bl, byte [eax + ebp]
xor bl, byte [eax]
inc ecx
cmp ecx, esi
mov byte [edx + eax], bl
jl 0x401750
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
push esi
lea ecx, [esp + 0x64]
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.00468d50
add dword [esp + 0x1c], esi
add ebx, esi
add ebp, esi
add esp, 0xc
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebx
cmp ebx, dword [esp + 0xb0]
jne 0x401700
pop esi
cmp dword [edi + 0xc], 0
jne 0x4017b4
mov eax, dword [edi]
mov edx, dword [eax]
mov ecx, edi
call edx
push eax
call fcn.004691cd
add esp, 4
mov dword [edi + 0xc], eax
mov eax, dword [edi]
mov edx, dword [eax]
mov ecx, edi
call edx
mov ecx, dword [edi + 0xc]
push eax
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.00468d50
mov ecx, dword [esp + 0xa8]
add esp, 0xc
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004690b5
add esp, 0x94
ret 0xc
Function at 0x4017f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x90
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x98]
push ebx
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, ecx
mov edx, dword [esi]
mov dword [esp + 0x10], eax
mov eax, dword [edx]
push edi
xor edi, edi
call eax
mov ebx, eax
cmp dword [esp + 0xac], edi
je 0x4018d3
mov ecx, dword [esi + 0xc]
push ebx
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.00468d50
lea eax, [ebx - 1]
lea ecx, [esp + ebx + 0x27]
add esp, 0xc
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ecx
mov edx, dword [esi]
mov edx, dword [edx + 0x24]
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call edx
mov bl, byte [ebp]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov al, bl
xor al, byte [esp + 0x5c]
push edx
mov byte [ecx + edi], al
lea eax, [esp + 0x21]
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.00468d50
mov edx, dword [esp + 0x1c]
inc edi
add esp, 0xc
inc ebp
mov byte [edx], bl
cmp edi, dword [esp + 0xac]
jne 0x401854
cmp dword [esi + 0xc], 0
jne 0x4018b9
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
push eax
call fcn.004691cd
add esp, 4
mov dword [esi + 0xc], eax
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, esi
call edx
mov ecx, dword [esi + 0xc]
push eax
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.00468d50
add esp, 0xc
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004690b5
add esp, 0x90
ret 0xc
Function at 0x4018f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x90
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x8c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x9c]
mov ebx, ecx
mov eax, dword [ebx]
mov edx, dword [eax]
push esi
push edi
mov edi, dword [esp + 0xa8]
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], 0
call edx
mov esi, eax
mov eax, dword [esp + 0xac]
xor edx, edx
div esi
test edx, edx
jne 0x401a0d
mov eax, dword [ebx + 0xc]
push esi
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.00468d50
add esp, 0xc
cmp dword [esp + 0xac], 0
je 0x4019d9
sub edi, ebp
mov dword [esp + 0x18], edi
mov edx, dword [ebx]
mov edx, dword [edx + 0x24]
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, ebx
call edx
xor ecx, ecx
test esi, esi
jle 0x4019a5
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x5c]
mov edi, ebp
sub edx, eax
sub edi, eax
add ebp, edx
mov edi, edi
lea eax, [esp + ecx + 0x5c]
mov dl, byte [edi + eax]
xor dl, byte [eax]
inc ecx
cmp ecx, esi
mov byte [eax + ebp], dl
jl 0x401990
mov ebp, dword [esp + 0x10]
lea eax, [esi - 1]
inc byte [esp + eax + 0x1c]
test eax, eax
jle 0x4019c0
cmp byte [esp + eax + 0x1c], 0
jne 0x4019c0
inc byte [esp + eax + 0x1b]
dec eax
test eax, eax
jg 0x4019b0
mov eax, dword [esp + 0x14]
add eax, esi
add ebp, esi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0xac]
jne 0x401965
cmp dword [ebx + 0xc], 0
jne 0x4019f3
mov eax, dword [ebx]
mov edx, dword [eax]
mov ecx, ebx
call edx
push eax
call fcn.004691cd
add esp, 4
mov dword [ebx + 0xc], eax
mov eax, dword [ebx]
mov edx, dword [eax]
mov ecx, ebx
call edx
mov ecx, dword [ebx + 0xc]
push eax
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.00468d50
add esp, 0xc
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004690b5
add esp, 0x90
ret 0xc
Function at 0x401a30
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x90
mov eax, dword [0x5808f0]
xor eax, esp
mov dword [esp + 0x8c], eax
mov eax, dword [esp + 0x94]
push ebx
mov ebx, ecx
mov edx, dword [ebx]
push esi
mov dword [esp + 8], eax
mov eax, dword [edx]
push edi
mov edi, dword [esp + 0xa4]
mov dword [esp + 0x10], 0
call eax
mov esi, eax
mov eax, dword [esp + 0xa8]
xor edx, edx
div esi
test edx, edx
jne 0x401b3d
mov ecx, dword [ebx + 0xc]
push esi
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.00468d50
add esp, 0xc
cmp dword [esp + 0xa8], 0
je 0x401b09
push ebp
mov ebp, dword [esp + 0x10]
sub ebp, edi
mov dword [esp + 0x10], ebp
jmp 0x401aab
mov ebp, dword [esp + 0x10]
push esi
add ebp, edi
lea eax, [esp + 0x60]
push ebp
push eax
call fcn.00468d50
mov edx, dword [ebx]
mov eax, dword [edx + 0x28]
add esp, 0xc
push edi
push ebp
mov ecx, ebx
call eax
test esi, esi
jle 0x401ae0
lea ebp, [esp + 0x1c]
mov eax, edi
sub ebp, edi
mov ecx, esi
mov dl, byte [eax + ebp]
xor byte [eax], dl
inc eax
sub ecx, 1
jne 0x401ad5
push esi
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.00468d50
mov eax, dword [esp + 0x20]
add eax, esi
add esp, 0xc
add edi, esi
mov dword [esp + 0x14], eax
cmp eax, dword [esp + 0xac]
jne 0x401aa7
pop ebp
cmp dword [ebx + 0xc], 0
jne 0x401b23
mov edx, dword [ebx]
mov eax, dword [edx]
mov ecx, ebx
call eax
push eax
call fcn.004691cd
add esp, 4
mov dword [ebx + 0xc], eax
mov edx, dword [ebx]
mov eax, dword [edx]
mov ecx, ebx
call eax
mov edx, dword [ebx + 0xc]
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
call fcn.00468d50
add esp, 0xc
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004690b5
add esp, 0x90
ret 0xc
Function at 0x402640
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [ecx + 8]
sub esp, 8
push ebx
push ebp
push esi
push edi
lea ebp, [ecx + 0x104]
mov ecx, dword [ecx + 4]
push eax
push ecx
push ebp
mov esi, ebp
call fcn.00468d50
add esp, 0xc
xor ebx, ebx
mov eax, dword [esi + 0x3c]
mov edx, eax
and edx, 0xff
movzx ecx, byte [edx + str.cw]
mov edx, eax
shr edx, 0x18
movzx edx, byte [edx + str.cw]
shl ecx, 8
xor ecx, edx
mov edx, eax
shr edx, 0x10
and edx, 0xff
movzx edx, byte [edx + str.cw]
shr eax, 8
shl ecx, 8
xor ecx, edx
and eax, 0xff
movzx eax, byte [eax + str.cw]
shl ecx, 8
mov edx, ebx
xor ecx, eax
and edx, 0x8000000f
jns 0x4026bf
dec edx
or edx, 0xfffffff0
inc edx
xor ecx, dword [edx*4 + 0x51d610]
lea eax, [esi + 0x44]
xor ecx, dword [esi]
mov edi, 3
mov dword [esi + 0x40], ecx
mov ecx, dword [eax - 0x40]
xor ecx, dword [eax - 4]
mov edx, dword [eax - 0x3c]
xor edx, ecx
mov dword [eax], ecx
mov ecx, dword [eax - 0x38]
xor ecx, edx
mov dword [eax + 4], edx
mov edx, dword [eax - 0x34]
xor edx, ecx
mov dword [eax + 8], ecx
mov ecx, dword [eax - 0x30]
xor ecx, edx
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
add eax, 0x14
sub edi, 1
jne 0x4026d3
inc ebx
add esi, 0x40
cmp ebx, 4
jl 0x402662
cmp dword [esp + 0x1c], edi
jne 0x402833
mov edx, ebp
xor esi, esi
lea edi, [esi + 0x40]
lea ecx, [edx + 0x108]
lea eax, [edx + 8]
lea ebx, [ebx]
mov ebp, dword [ecx - 8]
mov ebx, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], ebx
mov ebx, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], ebx
mov ebx, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], ebx
mov ebx, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], ebx
add esi, 4
sub edi, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edi
jl 0x402730
mov dword [esp + 0x1c], 0xf
add edx, 0x10
mov dword [esp + 0x14], edx
xor ebx, ebx
lea ecx, [ecx]
mov edi, dword [edx + ebx*4]
mov eax, edi
and eax, 0x80808080
mov edx, eax
shr edx, 7
sub eax, edx
and eax, 0x1b1b1b1b
mov ecx, edi
and ecx, 0xff7f7f7f
add ecx, ecx
xor eax, ecx
mov edx, eax
and eax, 0x80808080
mov ecx, eax
shr ecx, 7
sub eax, ecx
and eax, 0x1b1b1b1b
mov ecx, edx
and ecx, 0xff7f7f7f
add ecx, ecx
xor eax, ecx
mov esi, eax
and eax, 0x80808080
mov ecx, eax
shr ecx, 7
sub eax, ecx
and eax, 0x1b1b1b1b
mov ecx, esi
and ecx, 0xff7f7f7f
add ecx, ecx
xor eax, ecx
mov ecx, eax
xor ecx, edi
mov dword [esp + 0x10], eax
mov edi, ecx
xor edi, esi
mov ebp, ecx
shr ebp, 8
xor ebp, edi
shr ebp, 8
mov eax, ecx
xor eax, edx
xor ebp, eax
shl eax, 8
xor eax, edi
shl eax, 8
shr ebp, 8
xor eax, ecx
shl eax, 8
xor ebp, eax
xor ebp, dword [esp + 0x10]
inc ebx
xor ebp, esi
xor ebp, edx
cmp ebx, 4
mov edx, dword [esp + 0x14]
mov dword [edx + ebx*4 - 4], ebp
jl 0x402780
sub dword [esp + 0x1c], 1
jne 0x402774
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x403ce0
Capabilities:
Encrypt data using twofish

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
xor esi, esi
mov dword [esp + 0x18], ecx
mov dword [ecx + 4], esi
mov dword [ecx + 0xc], esi
mov dword [ecx], vtable.dwcl::DCP_TWOFISH.0
add ecx, 0x410
push edi
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ecx
jmp 0x403d10
movzx edi, byte [esi + 0x51d110]
mov ebx, edi
and ebx, 2
mov ecx, edi
mov edx, edi
je 0x403d37
and ecx, 1
je 0x403d2f
xor edx, 0x3b8
jmp 0x403d42
xor edx, 0x2d0
jmp 0x403d42
and ecx, 1
je 0x403d42
xor edx, 0x168
shr edx, 2
xor edx, edi
mov dword [esp + 0x20], edx
mov eax, edi
test ecx, ecx
je 0x403d56
xor eax, 0x168
shr eax, 1
mov edx, edi
test ebx, ebx
je 0x403d72
test ecx, ecx
je 0x403d6a
xor edx, 0x3b8
jmp 0x403d7c
xor edx, 0x2d0
jmp 0x403d7c
test ecx, ecx
je 0x403d7c
xor edx, 0x168
movzx esi, byte [esi + 0x51d210]
shr edx, 2
xor edx, eax
xor edx, edi
mov eax, esi
and eax, 2
mov ebp, edx
mov dword [esp + 0x18], eax
mov ebx, esi
mov edx, esi
je 0x403db0
and ebx, 1
je 0x403da8
xor edx, 0x3b8
jmp 0x403dbb
xor edx, 0x2d0
jmp 0x403dbb
and ebx, 1
je 0x403dbb
xor edx, 0x168
shr edx, 2
xor edx, esi
mov ecx, edx
mov dword [esp + 0x24], ecx
mov eax, esi
test ebx, ebx
je 0x403dd1
xor eax, 0x168
shr eax, 1
cmp dword [esp + 0x18], 0
mov edx, esi
je 0x403df0
test ebx, ebx
je 0x403de8
xor edx, 0x3b8
jmp 0x403dfa
xor edx, 0x2d0
jmp 0x403dfa
test ebx, ebx
je 0x403dfa
xor edx, 0x168
shr edx, 2
xor edx, eax
xor edx, esi
mov ebx, edx
shl edx, 8
mov eax, edx
or eax, ebx
shl eax, 8
or eax, ecx
mov ecx, dword [esp + 0x10]
shl eax, 8
or eax, esi
mov dword [ecx - 0x400], eax
mov eax, dword [esp + 0x10]
or edx, esi
mov esi, dword [esp + 0x14]
shl edx, 8
mov ecx, edi
shl ecx, 8
or ecx, dword [esp + 0x20]
or edx, ebx
shl ecx, 8
shl edx, 8
or edx, dword [esp + 0x24]
or ecx, ebp
shl ecx, 8
mov dword [eax + 0x400], edx
or ecx, ebp
mov dword [eax], ecx
mov ecx, dword [esp + 0x20]
mov edx, ecx
shl edx, 8
or edx, ebp
shl edx, 8
or edx, edi
shl edx, 8
or edx, ecx
inc esi
mov dword [eax + 0x800], edx
add eax, 4
cmp esi, 0x100
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
jl 0x403d10
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret