joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e88
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x7c5044], 0x8088405
inc edx
mov dword [0x7c5044], edx
mul edx
mov eax, edx
ret

Function at 0x4d9560
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov ecx, edx
test ecx, ecx
js 0x4d9576
mov ebx, dword [eax + ecx*4]
dec ecx
push ebx
jns 0x4d956f
mov eax, esp
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov edi, esi
test edi, edi
jl 0x4d95d2
inc edi
mov ebx, dword [ebp - 4]
mov eax, dword [ebx]
call fcn.0041d5a8
mov ecx, eax
mov eax, ecx
and eax, 0xff
cdq
idiv esi
add dword [ebp - 8], eax
mov eax, ecx
and eax, 0xff00
shr eax, 8
cdq
idiv esi
add dword [ebp - 0xc], eax
mov eax, ecx
and eax, 0xff0000
shr eax, 0x10
cdq
idiv esi
add dword [ebp - 0x10], eax
add ebx, 4
dec edi
jne 0x4d9596
mov cl, byte [ebp - 0x10]
mov dl, byte [ebp - 0xc]
mov al, byte [ebp - 8]
call fcn.00409560
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x50520c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50535b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004040b0
cmp dword [ebp - 4], 0
je 0x505333
lea eax, [ebp - 0x1c]
push eax
mov ecx, 2
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404538
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x505374
call fcn.0040437c
mov eax, dword [ebp - 0x18]
or edx, 0xffffffff
call fcn.0040ad6c
cmp eax, 0xffffffff
jne 0x5052a8
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea eax, [ebp - 0x24]
push eax
push 0
mov ecx, 0x505380
mov dl, 1
mov eax, dword [0x409aa0]
call fcn.0040e5ac
call fcn.00403ac4
lea ebx, [eax + 3]
lea edx, [eax + 7]
mov dword [ebp - 0x10], edx
add eax, 0x16
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
call fcn.00404330
mov edi, eax
sar edi, 1
jns 0x5052c8
adc edi, 0
dec edi
test edi, edi
jle 0x505333
mov dword [ebp - 0xc], 1
lea eax, [ebp - 0x2c]
push eax
mov edx, dword [ebp - 0xc]
add edx, edx
inc edx
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.00404538
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0x505374
call fcn.0040437c
mov eax, dword [ebp - 0x28]
call fcn.0040ad30
mov esi, eax
lea eax, [ebp - 0x30]
mov edx, esi
mov ecx, ebx
shr ecx, 8
xor dl, cl
call fcn.00404258
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.00404338
mov eax, dword [ebp - 8]
add ebx, esi
imul ebx, dword [ebp - 0x10]
add ebx, dword [ebp - 0x14]
inc dword [ebp - 0xc]
dec edi
jne 0x5052d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x505362
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.004040d4
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004040d4
ret
Function at 0x5514dc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004044e4
xor eax, eax
push ebp
push 0x5515cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.00550680
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040b398
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00551d50
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040b274
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00551dc4
xor eax, eax
mov dword [ebx + 0x3c], eax
mov byte [ebx + 0x40], 0
mov byte [ebx + 0x42], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5515d3
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004040d4
ret
Function at 0x5515dc
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004044e4
xor eax, eax
push ebp
push 0x5516dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.00550680
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
cmp dword [ebp - 4], 0
je 0x5516a2
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040b398
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00551d50
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040b274
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00551dc4
jmp 0x5516b4
xor edx, edx
mov eax, ebx
call fcn.00551d50
xor edx, edx
mov eax, ebx
call fcn.00551dc4
xor eax, eax
mov dword [ebx + 0x3c], eax
mov byte [ebx + 0x40], 0
mov byte [ebx + 0x42], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5516e3
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004040d4
ret
Function at 0x552090
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
call fcn.004160e4
cmp eax, 0x16
jge 0x5520c7
mov eax, dword [ebp - 8]
call fcn.004160e4
test eax, eax
jne 0x5521de
mov byte [ebp - 9], 1
jmp 0x5521de
mov eax, dword [ebp - 8]
call fcn.004160e4
cdq
push edx
push eax
push 0
push 0x10015
call fcn.005503c4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
neg edx
mov cx, 2
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x14]
call fcn.0040284c
mov dword [ebp - 0x10], eax
xor ecx, ecx
push ebp
push 0x5521d7
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 4]
cmp eax, dword [ebp - 0x14]
je 0x552128
call fcn.00403b64
jmp 0x5521de
mov eax, dword [ebp - 0x14]
sub eax, 0x16
xor edx, edx
jmp 0x552156
dec eax
test eax, eax
jl 0x552142
mov ecx, dword [ebp - 0x10]
cmp byte [ecx + eax], 0x50
jne 0x552134
test eax, eax
jl 0x55215e
mov edx, dword [ebp - 0x10]
add edx, eax
cmp dword [edx], 0x6054b50
je 0x552156
dec eax
xor edx, edx
test eax, eax
jl 0x55215e
test edx, edx
je 0x552135
test edx, edx
jne 0x552169
call fcn.00403b64
jmp 0x5521de
mov eax, dword [ebp - 4]
add eax, 4
mov cx, word [edx + 4]
mov word [eax + 4], cx
mov cx, word [edx + 6]
mov word [eax + 6], cx
mov cx, word [edx + 8]
mov word [eax + 8], cx
mov cx, word [edx + 0xa]
mov word [eax + 0xa], cx
mov ecx, dword [edx + 0xc]
mov dword [eax + 0xc], ecx
mov ecx, dword [edx + 0x10]
mov dword [eax + 0x10], ecx
mov dx, word [edx + 0x14]
mov word [eax + 0x14], dx
mov eax, dword [ebp - 8]
call fcn.004160e4
mov edx, dword [ebp - 4]
movzx edx, word [edx + 0x18]
sub eax, edx
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], eax
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5521de
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00402864
ret
mov al, byte [ebp - 9]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5578b4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x154]
mov edx, ebx
mov eax, edi
call fcn.00557ad8
mov esi, eax
mov dword [edi + 0x154], esi
and esi, 0xff
add dword [edi + 0x158], esi
imul esi, dword [edi + 0x158], 0x8088405
inc esi
mov dword [edi + 0x158], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x15c]
mov eax, edi
call fcn.00557ad8
mov dword [edi + 0x15c], eax
pop edi
pop esi
pop ebx
ret

Function at 0x557928
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
movzx esi, cx
dec esi
test esi, esi
jl 0x55794e
inc esi
mov eax, edi
call fcn.0055790c
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.005578b4
inc ebx
dec esi
jne 0x557938
pop edi
pop esi
pop ebx
ret
Function at 0x5579dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.004044e4
xor eax, eax
push ebp
push 0x557a51
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00557954
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.0055790c
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.005578b4
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x557a1c
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x557a58
lea eax, [ebp - 4]
call fcn.004040b0
ret
Function at 0x5584b4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55864f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x55860b
mov eax, dword [ebp - 4]
call fcn.005598ec
cmp ebx, eax
jge 0x55860b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xdc]
mov edx, ebx
call fcn.0054e734
mov edx, dword [0x550fec]
call fcn.004033fc
mov esi, eax
mov eax, esi
call fcn.00551cbc
test al, al
je 0x558601
mov edi, dword [esi + 0x3c]
test edi, edi
jne 0x5585f5
xor eax, eax
push ebp
push 0x5585ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.005589c4
mov edx, dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf0]
xor ecx, ecx
mov esi, dword [eax]
call dword [esi + 0xc]
lea edx, [ebp - 0x37]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf0]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 4]
movzx edx, word [ebp - 0x1b]
movzx eax, word [ebp - 0x19]
add edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf0]
mov cx, 1
mov esi, dword [eax]
call dword [esi + 0xc]
movzx esi, word [ebp - 0x17]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.00404664
mov eax, dword [ebp - 8]
call fcn.00404500
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xf0]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 4]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x144]
mov al, byte [eax + 0x24]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.005587b0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x144]
mov dl, byte [ebp - 9]
mov byte [eax + 0x24], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x558639
mov eax, dword [ebp - 4]
call fcn.00558a40
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0040b874
jmp 0x558639
mov eax, dword [ebp - 8]
call fcn.004040b0
jmp 0x558639
mov dword [ebp - 0x40], ebx
mov byte [ebp - 0x3c], 0
lea eax, [ebp - 0x40]
push eax
push 0
lea edx, [ebp - 0x44]
mov eax, 0xb3
call fcn.0040add4
mov ecx, dword [ebp - 0x44]
mov dl, 1
mov eax, dword [0x412008]
call fcn.0040e5ac
call fcn.00403ac4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x558656
lea eax, [ebp - 0x44]
call fcn.004040b0
ret
Function at 0x55bfc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
add esi, 0xfffffbf4
mov eax, dword [ebp + 8]
mov word [eax - 0x1a5c], 0
mov eax, dword [ebp + 8]
cmp dword [eax - 0x1a58], 0
jne 0x55c000
mov eax, dword [ebp + 8]
mov word [eax - 0x1a5c], 1
mov eax, dword [ebp + 8]
mov dword [eax - 0x1a58], 0x10000
mov eax, 0x7fff
mov edx, dword [esi]
mov edx, dword [edx + 0xb5c]
mov word [edx + eax*2], 0
mov eax, edx
xor ecx, ecx
mov edx, 0xfffe
call fcn.004094f4
mov eax, dword [esi]
mov eax, dword [eax + 0x190]
mov ax, word [eax*8 + 0x7bfb2a]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a62], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x190]
mov ax, word [eax*8 + 0x7bfb28]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a64], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x190]
movzx eax, word [eax*8 + 0x7bfb2c]
mov edx, dword [ebp + 8]
mov dword [edx - 0x1a68], eax
mov eax, dword [esi]
mov eax, dword [eax + 0x190]
mov ax, word [eax*8 + 0x7bfb2e]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a6a], ax
mov eax, dword [esi]
mov eax, dword [eax + 0x190]
cmp eax, 2
jg 0x55c0a4
mov eax, dword [esi]
mov eax, dword [eax + 0x234]
or word [eax + 8], 4
jmp 0x55c0b6
cmp eax, 8
jl 0x55c0b6
mov eax, dword [esi]
mov eax, dword [eax + 0x234]
or word [eax + 8], 2
mov eax, dword [ebp + 8]
mov word [eax - 0x10fe], 0
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax - 0x1104], edx
mov bx, 0x8000
mov eax, dword [ebp + 8]
lea edi, [eax - 0x420]
mov eax, dword [esi]
mov edx, dword [eax + 0xb54]
mov ecx, ebx
mov eax, dword [edi + 4]
call dword [edi]
mov edx, dword [ebp + 8]
mov word [edx - 0x1a5a], ax
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a5a], 0
je 0x55c10e
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a5a], 0xffff
jne 0x55c126
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a5f], 1
mov eax, dword [ebp + 8]
mov word [eax - 0x1a5a], 0
jmp 0x55c18a
mov eax, dword [ebp + 8]
mov byte [eax - 0x1a5f], 0
mov eax, dword [ebp + 8]
cmp word [eax - 0x1a5a], 0x106
jae 0x55c148
mov eax, dword [ebp + 8]
push eax
call fcn.0055bde8
pop ecx
mov eax, dword [ebp + 8]
mov word [eax - 0x1a6c], 0
xor ebx, ebx
movzx eax, bx
mov edx, dword [esi]
mov edx, dword [edx + 0xb54]
movzx eax, byte [edx + eax]
mov edx, dword [ebp + 8]
mov dx, word [edx - 0x1a6c]
shl edx, 5
xor ax, dx
and ax, 0x7fff
mov edx, dword [ebp + 8]
mov word [edx - 0x1a6c], ax
inc ebx
cmp bx, 2
jne 0x55c156
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x566144
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd0
mov dword [esp], edx
mov ebx, eax
lea edx, [esp + 0x20]
mov eax, dword [esp]
mov ecx, 0x10
call fcn.00402b08
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 4]
dec eax
test eax, eax
jl 0x5662a0
inc eax
mov dword [esp + 0x1c], eax
lea eax, [ebx + 8]
mov ebx, eax
mov edx, dword [esp + 0xc]
mov ecx, dword [ebx]
mov esi, dword [esp + 0x10]
mov eax, dword [ebx + 4]
add edx, eax
add eax, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shr edi, 0x11
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 9
xor eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, eax
shr edi, 0xf
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 0xb
xor eax, edi
mov edi, edx
mov edx, esi
mov esi, edi
mov edi, ecx
mov ecx, eax
mov eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 7
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 0xd
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, esi
shr edi, 0x11
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 9
xor eax, edi
add edx, eax
add eax, edx
mov edi, edx
shr edi, 3
xor edx, edi
add ecx, edx
add edx, ecx
mov edi, ecx
shl edi, 7
xor ecx, edi
add esi, ecx
add ecx, esi
mov edi, eax
shr edi, 0xf
xor esi, edi
add eax, esi
add esi, eax
mov edi, eax
shl edi, 0xb
xor eax, edi
xor edx, dword [esp + 0x14]
xor ecx, edx
mov dword [esp + 4], ecx
xor esi, dword [esp + 0x18]
xor eax, esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
add ebx, 8
dec dword [esp + 0x1c]
jne 0x566196
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov edx, dword [esp]
lea eax, [esp + 0x20]
mov ecx, 0x10
call fcn.00402b08
add esp, 0x30
pop edi
pop esi
pop ebx
ret
Function at 0x5662d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dl, byte [ebp + 8]
mov byte [eax], dl
mov edx, ebx
mov eax, 0x10
call fcn.005660fc
mov edx, eax
mov eax, 4
call fcn.00566104
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x24], 0x7c1d04
mov eax, dword [ebp - 4]
add eax, 8
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov ecx, dword [ebp - 0x24]
mov esi, dword [ecx]
mov ecx, esi
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx + 4]
mov dword [ebp - 0xc], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 8]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 8]
mov edi, dword [edi + 0xc]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], esi
mov esi, 8
mov edi, ecx
shl edi, 0xb
xor edx, edi
add dword [ebp - 0xc], edx
add ecx, ebx
mov edi, ebx
shr edi, 2
xor ecx, edi
add dword [ebp - 0x10], ecx
add ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
shl edi, 8
xor ebx, edi
add dword [ebp - 0x14], ebx
mov edi, dword [ebp - 0x10]
add dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x10]
shr edi, 0x10
xor dword [ebp - 0xc], edi
mov edi, dword [ebp - 0xc]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x14]
add dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x14]
shl edi, 0xa
xor dword [ebp - 0x10], edi
mov edi, dword [ebp - 0x10]
add dword [ebp - 0x1c], edi
mov edi, dword [ebp - 0x18]
add dword [ebp - 0x14], edi
mov edi, dword [ebp - 0x18]
shr edi, 4
xor dword [ebp - 0x14], edi
add edx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
add dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x1c]
shl edi, 8
xor dword [ebp - 0x18], edi
add ecx, dword [ebp - 0x18]
add dword [ebp - 0x1c], edx
mov edi, edx
shr edi, 9
xor dword [ebp - 0x1c], edi
add ebx, dword [ebp - 0x1c]
add edx, ecx
dec esi
jne 0x566358
mov dword [eax], edx
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov edx, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x14], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x18], edx
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x1c], edx
add eax, 0x20
add dword [ebp - 0x24], 4
dec dword [ebp - 0x20]
jne 0x566326
cmp byte [ebp + 8], 0
jne 0x566487
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x56645c
inc eax
mov dword [ebp - 0x20], 0
mov edx, dword [ebp - 4]
add edx, 8
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
dec ecx
sub ecx, dword [ebp - 0x20]
mov ebx, dword [edx]
mov dword [ebp + ecx*8 - 0xa4], ebx
mov ebx, dword [edx + 4]
mov dword [ebp + ecx*8 - 0xa0], ebx
inc dword [ebp - 0x20]
add edx, 8
dec eax
jne 0x566436
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
dec eax
test eax, eax
jl 0x566487
inc eax
lea edx, [ebp - 0xa4]
mov ebx, dword [ebp - 4]
add ebx, 8
mov ecx, dword [edx]
mov dword [ebx], ecx
mov ecx, dword [edx + 4]
mov dword [ebx + 4], ecx
add ebx, 8
add edx, 8
dec eax
jne 0x566474
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x566490
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe4
mov esi, eax
lea edi, [esp + 0xc]
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
mov ebp, edx
mov edx, ebp
mov eax, 0x7c1d14
mov ecx, 0x48
call fcn.00402b08
lea edx, [ebp + 0x48]
mov eax, 0x7c1d5c
mov ecx, 0x1000
call fcn.00402b08
xor edi, edi
mov esi, 0x12
mov dword [esp + 8], ebp
xor edx, edx
mov eax, 4
shl edx, 8
xor ecx, ecx
mov cl, byte [esp + edi + 0xc]
or edx, ecx
inc edi
cmp edi, 0x10
jl 0x5664ee
xor edi, edi
dec eax
jne 0x5664db
mov eax, dword [esp + 8]
xor dword [eax], edx
add dword [esp + 8], 4
dec esi
jne 0x5664d4
xor eax, eax
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
xor esi, esi
mov edx, esp
mov eax, ebp
mov cl, 1
call fcn.00566570
mov eax, dword [esp]
mov dword [ebp + esi*4], eax
mov eax, dword [esp + 4]
mov dword [ebp + esi*4 + 4], eax
add esi, 2
cmp esi, 0x11
jle 0x56650c
mov edi, 4
mov ebx, ebp
xor esi, esi
mov edx, esp
mov eax, ebp
mov cl, 1
call fcn.00566570
mov eax, dword [esp]
mov dword [ebx + esi*4 + 0x48], eax
mov eax, dword [esp + 4]
mov dword [ebx + esi*4 + 0x4c], eax
add esi, 2
cmp esi, 0xff
jle 0x566537
add ebx, 0x400
dec edi
jne 0x566535
add esp, 0x1c
pop ebp
pop edi
pop esi
pop ebx
ret