joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439915
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4399b2
push ebx
push esi
call fcn.004398de
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00438628
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x43995f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4399b1
push edi
push eax
call fcn.004359e2
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x43997f
call fcn.004350e2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4399b0
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00438628
add esp, 0x20
test eax, eax
jne 0x43999e
push edi
call fcn.004350e2
jmp 0x4399a6
push ebx
call fcn.004350e2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4399b5
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4399c6
pop esi
ret
push ebx
push edi
push esi
call fcn.004398de
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.004359e2
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4399ee
push ebx
push esi
push edi
call fcn.004296f0
add esp, 0xc
push 0
call fcn.004350e2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x439dbe
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00439a03
Function at 0x440ce0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x440d0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x440d0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0xa84470
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4dd000]
push edi
jmp 0xa8448a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa84491
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa84480
mov eax, 1
add ebx, ebx
jne 0xa844a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa844b4
jne 0xa844d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa844d3
dec eax
add ebx, ebx
jne 0xa844c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xa84498
add ebx, ebx
jne 0xa844cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xa84525
xor ecx, ecx
sub eax, 3
jb 0xa844eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa8455a
sar eax, 1
mov ebp, eax
jmp 0xa844f6
add ebx, ebx
jne 0xa844f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa844c4
inc ecx
add ebx, ebx
jne 0xa84504
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa844c4
add ebx, ebx
jne 0xa84511
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa84506
jne 0xa84522
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa84506
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa84544
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa84536
jmp 0xa84486
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa84544
add edi, ecx
jmp 0xa84486
pop esi
mov edi, esi
mov ecx, 0x17049
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xa84562
cmp byte [edi], 0xab
jne 0xa84562
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xa84567
lea edi, [esi + 0x681000]
mov eax, dword [edi]
or eax, eax
je 0xa845d6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x714330]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x714470]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa84594
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x714478]
or eax, eax
je 0xa845d0
mov dword [ebx], eax
add ebx, 4
jmp 0xa845b1
call dword [esi + 0x714474]
mov ebp, dword [esi + 0x71447c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa8460a
sub esp, 0xffffff80
jmp 0x78cf52
Function at 0x430003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x60377248
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x5ad310e6
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x419ad98
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x419ae2f
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, eax
mov dl, 1
mov eax, dword [sym.imp.adortl60.bpl__Adodb_TADOQuery_]
call sub.adortl60.bpl__Adodb_TADOQuery__bctr_qqrp18Classes_TComponent
mov ebx, eax
call sub.VEDatasets.bpl__Vedataset_Connection_qqrv
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x268]
lea eax, [ebp - 4]
push eax
call sub.VEDatasets.bpl__Vedataset_FirmaNo_qqrv
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
call sub.VEDatasets.bpl__Vedataset_DonemNo_qqrv
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x419ae48
call sub.rtl60.bpl__Sysutils_Format_qqrx17System_AnsiStringpx14System_TVarRecxi
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
call sub.adortl60.bpl__Adodb_TADOQuery_GetSQL_qqrv
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
call sub.dbrtl60.bpl__Db_TDataSet_Open_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419ae36
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x41a6cb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x41a6d10
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__Sysutils_FileExists_qqrx17System_AnsiString
test al, al
je 0x41a6cfa
push 3
push 0x41a6d1c
push 0x41a6d1c
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push 0x41a6d20
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a6d17
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x41a8128
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x41a8188
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__Sysutils_FileExists_qqrx17System_AnsiString
test al, al
je 0x41a8172
push 3
push 0x41a8194
push 0x41a8194
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push 0x41a8198
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a818f
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret
Function at 0x41ad3b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x41ad410
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__Sysutils_FileExists_qqrx17System_AnsiString
test al, al
je 0x41ad3fa
push 3
push 0x41ad41c
push 0x41ad41c
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push 0x41ad420
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ad417
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x41af668
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x41af6c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__Sysutils_FileExists_qqrx17System_AnsiString
test al, al
je 0x41af6b2
push 3
push 0x41af6d4
push 0x41af6d4
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push 0x41af6d8
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41af6cf
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x41b17c4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x41b1824
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__Sysutils_FileExists_qqrx17System_AnsiString
test al, al
je 0x41b180e
push 3
push 0x41b1830
push 0x41b1830
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push 0x41b1834
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b182b
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret
Function at 0x41ba3b4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x41ba414
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__Sysutils_FileExists_qqrx17System_AnsiString
test al, al
je 0x41ba3fe
push 3
push 0x41ba420
push 0x41ba420
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push 0x41ba424
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ba41b
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x41d604c
Capabilities:
Reference sql statements

Disassembly:
add esp, 0xfffffff8
mov eax, 0x41d6088
mov dword [esp], eax
mov eax, 0x41d60a4
mov dword [esp + 4], eax
mov eax, esp
mov edx, 1
call fcn.041d5a2c
mov edx, 0x41d60c4
mov eax, 0x41d6334
call fcn.041d5dec
pop ecx
pop edx
ret

Function at 0x41d6a2c
Capabilities:
Reference sql statements

Disassembly:
add esp, 0xffffffe4
mov eax, 0x41d6a94
mov dword [esp], eax
mov eax, 0x41d6ab4
mov dword [esp + 4], eax
mov eax, 0x41d6ad4
mov dword [esp + 8], eax
mov eax, 0x41d6af4
mov dword [esp + 0xc], eax
mov eax, 0x41d6b14
mov dword [esp + 0x10], eax
mov eax, 0x41d6b34
mov dword [esp + 0x14], eax
mov eax, 0x41d6b54
mov dword [esp + 0x18], eax
mov eax, esp
mov edx, 6
call fcn.041d5a2c
mov edx, 0x41d6b74
mov eax, 0x41d7874
call fcn.041d5dec
add esp, 0x1c
ret
Function at 0x4210fb0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
and edx, edx
je 0x4210fce
and ecx, ecx
jle 0x4210fce
push ebx
xor al, byte [edx]
imul eax, eax, 0x8088405
inc eax
mov ebx, eax
shr ebx, 0x18
mov byte [edx], bl
inc edx
dec ecx
jne 0x4210fb9
pop ebx
ret

Function at 0x4211014
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x4211039
and ecx, ecx
jle 0x4211039
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x421103b]
mov bl, byte [edx]
xor bl, al
shr ax, 8
xor ax, word [edi + ebx*2]
inc edx
dec ecx
jne 0x4211027
pop edi
pop ebx
ret

Function at 0x421123c
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x421125f
and ecx, ecx
jle 0x421125f
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x4211265]
mov bl, al
shr eax, 8
xor bl, byte [edx]
xor eax, dword [edi + ebx*4]
inc edx
dec ecx
jne 0x421124f
pop edi
pop ebx
ret

Function at 0x421d7c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
lea ebx, [esi + 0x1c]
mov eax, edx
lea edx, [ebx + 0x20]
mov ecx, 0x20
call sub.rtl60.bpl__System_Move_qqrpxvpvi
mov eax, dword [esi + 0x14]
dec eax
test eax, eax
jb 0x421d8a5
inc eax
mov dword [esp + 8], eax
mov dword [esp], 0
mov dword [esp + 4], 4
mov eax, 0x4231698
mov dword [esp + 0xc], eax
xor eax, eax
mov edx, dword [esp]
add edx, edx
mov ecx, eax
shr ecx, 1
and ecx, 1
add edx, ecx
shl edx, 7
lea ecx, [edx*8 + 0x422a190]
mov edx, dword [ebx + eax*4]
and edx, 0xff
mov esi, dword [ecx + edx*4]
lea edx, [eax + 1]
and edx, 0xf
xor dword [ebx + edx*4], esi
lea edx, [eax + 0xf]
and edx, 0xf
xor dword [ebx + edx*4], esi
inc eax
mov edx, dword [ebx + eax*4]
and edx, 0xff
mov esi, dword [ecx + edx*4]
lea edx, [eax + 1]
and edx, 0xf
xor dword [ebx + edx*4], esi
lea edx, [eax + 0xf]
and edx, 0xf
xor dword [ebx + edx*4], esi
inc eax
cmp eax, 0x10
jb 0x421d806
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
mov esi, 0x20
sub esi, edx
xor eax, eax
mov ecx, edx
mov edi, dword [ebx + eax*4]
shr edi, cl
mov ecx, esi
mov ebp, dword [ebx + eax*4]
shl ebp, cl
or edi, ebp
mov dword [ebx + eax*4], edi
inc eax
cmp eax, 0x10
jne 0x421d870
add dword [esp + 0xc], 4
dec dword [esp + 4]
jne 0x421d804
inc dword [esp]
dec dword [esp + 8]
jne 0x421d7f3
xor eax, eax
mov edx, 0xf
sub edx, eax
mov edx, dword [ebx + edx*4]
xor dword [ebx + eax*4], edx
inc eax
cmp eax, 8
jne 0x421d8a7
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4221cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov edi, dword [0x424019c]
mov edi, dword [edi]
mov esi, dword [ebp - 8]
mov eax, dword [esi]
call edi
mov dword [ebp - 4], eax
movzx edi, word [ebp - 2]
movzx eax, word [ebp - 4]
mov dword [ebp - 0xc], eax
mov edx, dword [0x424019c]
mov edx, dword [edx]
mov eax, dword [esi + 4]
call edx
mov dword [ebp - 4], eax
movzx eax, word [ebp - 2]
mov dword [ebp - 0x10], eax
movzx eax, word [ebp - 4]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 4], eax
movzx edx, word [ebx]
mov eax, edi
call fcn.04221ca0
mov edi, eax
movzx eax, word [ebx + 2]
add dword [ebp - 0xc], eax
movzx eax, word [ebx + 4]
add dword [ebp - 0x10], eax
movzx edx, word [ebx + 6]
mov eax, dword [ebp - 0x14]
call fcn.04221ca0
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x10]
xor esi, edi
movzx edx, word [ebx + 8]
mov eax, esi
call fcn.04221ca0
mov esi, eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x14]
add eax, esi
movzx edx, word [ebx + 0xa]
call fcn.04221ca0
add esi, eax
xor edi, eax
xor dword [ebp - 0x14], esi
xor esi, dword [ebp - 0xc]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
add ebx, 0xc
inc dword [ebp - 4]
cmp dword [ebp - 4], 8
jne 0x4221d1e
movzx edx, word [ebx]
mov eax, edi
call fcn.04221ca0
mov word [ebp - 2], ax
mov ax, word [ebp - 0x10]
add ax, word [ebx + 2]
mov word [ebp - 4], ax
mov edi, dword [0x424019c]
mov edi, dword [edi]
mov eax, dword [ebp - 4]
call edi
mov esi, dword [ebp - 8]
mov dword [esi], eax
mov ax, word [ebp - 0xc]
add ax, word [ebx + 4]
mov word [ebp - 2], ax
movzx edx, word [ebx + 6]
mov eax, dword [ebp - 0x14]
call fcn.04221ca0
mov word [ebp - 4], ax
mov ebx, dword [0x424019c]
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call ebx
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4222444
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
mov esi, eax
mov edx, dword [ebp + 8]
mov edi, eax
add edi, 0x100
mov ecx, 1
xor ebx, ebx
mov eax, ecx
and al, 0xff
mov byte [esi], al
mov eax, ecx
and eax, 0xff
mov byte [edi + eax], bl
lea eax, [ecx + ecx*4]
lea eax, [eax + eax*8]
mov ecx, 0x101
cdq
idiv ecx
mov ecx, edx
inc esi
inc ebx
cmp ebx, 0x100
jne 0x4222467
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4223dfc
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4223e12
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4223e0b
mov edx, esp
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xff
mov ebx, dword [ebp - 4]
shr ebx, 8
and ebx, 0xff
mov eax, dword [ebp - 4]
shr eax, 0x10
and eax, 0xff
mov esi, dword [ebp - 4]
shr esi, 0x18
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x20
jne 0x4223e9d
movzx ecx, byte [ecx + 0x42347f4]
mov esi, dword [edx + 0xc]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x42346f4]
mov esi, dword [edx + 0xc]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x42346f4]
mov esi, dword [edx + 0xc]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x42347f4]
mov edi, dword [edx + 0xc]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x18
jl 0x4223efa
movzx ecx, byte [ecx + 0x42347f4]
mov esi, dword [edx + 8]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x42347f4]
mov esi, dword [edx + 8]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x42346f4]
mov esi, dword [edx + 8]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x42346f4]
mov edi, dword [edx + 8]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x42346f4]
mov esi, dword [edx + 4]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x42347f4]
mov esi, dword [edx + 4]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x42346f4]
mov esi, dword [edx + 4]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x42347f4]
mov edi, dword [edx + 4]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x42346f4]
mov esi, dword [edx]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x42346f4]
mov esi, dword [edx]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x42347f4]
mov esi, dword [edx]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x42347f4]
mov edx, dword [edx]
shr edx, 0x18
xor esi, edx
mov dword [ebp - 8], esi
mov edx, dword [ecx*4 + 0x42348f4]
xor edx, dword [ebx*4 + 0x4234cf4]
xor edx, dword [eax*4 + 0x42350f4]
mov eax, dword [ebp - 8]
xor edx, dword [eax*4 + 0x42354f4]
mov eax, edx
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x42240fc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
and ecx, 0xff
imul ecx, ecx, 0x1010101
xor ebx, ebx
mov esi, dword [edx + ebx*4]
xor esi, ecx
mov dword [eax + ebx*4], esi
inc ebx
cmp ebx, 0x40
jne 0x422410c
pop esi
pop ebx
ret
Function at 0x4224120
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
mov edx, 0x42346f4
lea eax, [ebp - 0x100]
call fcn.042240fc
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x18]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x42346f4]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x42348f4]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x4224151
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 8
mov edx, 0x42347f4
lea eax, [ebp - 0x100]
call fcn.042240fc
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x17]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x42346f4]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x4234cf4]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0x400], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x42241a0
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x10
mov edx, 0x42346f4
lea eax, [ebp - 0x100]
call fcn.042240fc
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x16]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x42347f4]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x42350f4]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0x800], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x42241f3
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x18
mov edx, 0x42347f4
lea eax, [ebp - 0x100]
call fcn.042240fc
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x15]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x42347f4]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x42354f4]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0xc00], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x4224246
pop esi
pop ebx
mov esp, ebp
pop ebp
ret