joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dbf50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x24]
test ebx, ebx
jle 0x4dc066
cmp ebx, 0x100
jle 0x4dbf72
mov ebx, 0x100
mov dword [ebp + 0x24], ebx
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], eax
jle 0x4dc066
mov ecx, dword [ebp + 0x18]
lea edx, [ecx*4]
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], edx
lea edx, [ecx*4]
mov ecx, dword [ebp + 8]
push esi
mov dword [ebp + 0x14], edx
mov edx, dword [ebp + 0xc]
push edi
mov esi, dword [ebp + 0x20]
mov edi, dword [esi + eax*4]
add edi, dword [ebp - 8]
mov dword [ebp + 0x18], 0
test edx, edx
jle 0x4dc051
lea ebx, [ebx]
mov esi, dword [ecx]
mov edx, dword [edi]
mov eax, edx
and eax, 0xffff00ff
imul eax, ebx
mov ecx, edx
and ecx, 0xff00
imul ecx, ebx
xor eax, ecx
mov ecx, edx
and ecx, 0xff00ff
imul ecx, ebx
and eax, 0xff0000
xor eax, ecx
shr eax, 8
mov ebx, eax
mov ecx, eax
and ecx, esi
xor ebx, esi
and ebx, 0xfefefe
lea ecx, [ebx + ecx*2]
shr ecx, 8
mov ebx, dword [ebp + 0x24]
and ecx, 0x10101
add ecx, 0x7f7f7f
xor ecx, 0x7f7f7f
sub eax, ecx
add eax, esi
or eax, ecx
mov ecx, dword [ebp + 8]
xor eax, edx
and eax, 0xffffff
xor eax, edx
mov edx, dword [ebp + 0x1c]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
mov edx, dword [edx + eax*4]
lea edi, [edi + edx*4]
mov edx, dword [ebp + 0xc]
inc eax
add ecx, 4
mov dword [ebp + 8], ecx
mov dword [ebp + 0x18], eax
cmp eax, edx
jl 0x4dbfc0
mov eax, dword [ebp - 4]
add ecx, dword [ebp + 0x14]
inc eax
mov dword [ebp + 8], ecx
mov dword [ebp - 4], eax
cmp eax, dword [ebp + 0x10]
jl 0x4dbfa2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20

Function at 0x4dd940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x1c]
test edx, edx
jle 0x4dd9e2
push esi
cmp edx, 0x100
jl 0x4dd95c
mov ecx, dword [ebp + 0x14]
jmp 0x4dd98a
mov eax, dword [ebp + 0x14]
mov ecx, eax
and ecx, 0xff00
mov esi, eax
imul ecx, edx
and esi, 0xffff00ff
imul esi, edx
and eax, 0xff00ff
imul eax, edx
xor ecx, esi
and ecx, 0xff0000
xor ecx, eax
shr ecx, 8
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jle 0x4dd9e0
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
lea edx, [eax*4]
mov dword [ebp + 0x14], edx
push ebx
mov edx, dword [esi]
mov eax, edx
not eax
mov ebx, eax
xor eax, ecx
and eax, 0xfefefe
and ebx, ecx
lea eax, [eax + ebx*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
mov ebx, eax
or ebx, edx
or eax, ecx
sub ebx, eax
and ebx, 0xffffff
mov dword [esi], ebx
add esi, dword [ebp + 0x14]
dec edi
jne 0x4dd9a3
pop ebx
pop edi
pop esi
pop ebp
ret 0x18
Function at 0x4dd9f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
jle 0x4dda91
push esi
cmp ecx, 0x100
jl 0x4dda0c
mov edx, dword [ebp + 0x14]
jmp 0x4dda3a
mov eax, dword [ebp + 0x14]
mov edx, eax
and edx, 0xff00
mov esi, eax
imul edx, ecx
and esi, 0xffff00ff
imul esi, ecx
and eax, 0xff00ff
imul eax, ecx
xor edx, esi
and edx, 0xff0000
xor edx, eax
shr edx, 8
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jle 0x4dda8f
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
lea ecx, [eax*4]
mov dword [ebp + 0x14], ecx
push ebx
mov eax, dword [esi]
mov ecx, eax
xor ecx, edx
mov ebx, eax
and ecx, 0xfefefe
and ebx, edx
lea ecx, [ecx + ebx*2]
shr ecx, 8
and ecx, 0x10101
add ecx, 0x7f7f7f
xor ecx, 0x7f7f7f
sub eax, ecx
add eax, edx
or eax, ecx
and eax, 0xffffff
mov dword [esi], eax
add esi, dword [ebp + 0x14]
dec edi
jne 0x4dda53
pop ebx
pop edi
pop esi
pop ebp
ret 0x18

Function at 0x4ddaa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x18]
test edx, edx
jle 0x4ddb40
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jle 0x4ddb3f
push esi
cmp edx, 0x100
jl 0x4ddac8
mov ecx, dword [ebp + 0x10]
jmp 0x4ddaf6
mov eax, dword [ebp + 0x10]
mov ecx, eax
and ecx, 0xff00
mov esi, eax
imul ecx, edx
and esi, 0xffff00ff
imul esi, edx
and eax, 0xff00ff
imul eax, edx
xor ecx, esi
and ecx, 0xff0000
xor ecx, eax
shr ecx, 8
test edi, edi
jle 0x4ddb3e
mov esi, dword [ebp + 8]
push ebx
mov edi, edi
mov edx, dword [esi]
mov eax, edx
not eax
mov ebx, eax
xor ebx, ecx
and eax, ecx
and ebx, 0xfefefe
lea eax, [ebx + eax*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
mov ebx, eax
or ebx, edx
or eax, ecx
sub ebx, eax
and ebx, 0xffffff
mov dword [esi], ebx
add esi, 4
dec edi
jne 0x4ddb00
pop ebx
pop esi
pop edi
pop ebp
ret 0x14

Function at 0x4ddfe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x18]
test edx, edx
jle 0x4de083
cmp edx, 0x100
jle 0x4ddffb
mov edx, 0x100
mov eax, dword [ebp + 0x14]
push esi
mov ecx, eax
and ecx, 0xff00
mov esi, eax
imul ecx, edx
and esi, 0xffff00ff
imul esi, edx
and eax, 0xff00ff
imul eax, edx
xor ecx, esi
and ecx, 0xff0000
xor ecx, eax
push edi
mov edi, dword [ebp + 0xc]
shr ecx, 8
test edi, edi
jle 0x4de081
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
lea edx, [eax*4]
mov dword [ebp + 0x18], edx
push ebx
mov edx, dword [esi]
mov eax, edx
not eax
mov ebx, eax
xor ebx, ecx
and eax, ecx
and ebx, 0xfefefe
lea eax, [ebx + eax*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
mov ebx, eax
or ebx, edx
or eax, ecx
sub ebx, eax
and ebx, 0xffffff
mov dword [esi], ebx
add esi, dword [ebp + 0x18]
dec edi
jne 0x4de043
pop ebx
pop edi
pop esi
pop ebp
ret 0x14
Function at 0x4de090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x18]
test ecx, ecx
jle 0x4de131
cmp ecx, 0x100
jle 0x4de0ab
mov ecx, 0x100
mov eax, dword [ebp + 0x14]
push esi
mov edx, eax
and edx, 0xff00
mov esi, eax
imul edx, ecx
and esi, 0xffff00ff
imul esi, ecx
and eax, 0xff00ff
imul eax, ecx
xor edx, esi
and edx, 0xff0000
xor edx, eax
push edi
mov edi, dword [ebp + 0xc]
shr edx, 8
test edi, edi
jle 0x4de12f
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
lea ecx, [eax*4]
mov dword [ebp + 0x18], ecx
push ebx
mov eax, dword [esi]
mov ecx, eax
xor ecx, edx
mov ebx, eax
and ecx, 0xfefefe
and ebx, edx
lea ecx, [ecx + ebx*2]
shr ecx, 8
and ecx, 0x10101
add ecx, 0x7f7f7f
xor ecx, 0x7f7f7f
sub eax, ecx
add eax, edx
or eax, ecx
or eax, 0xff000000
mov dword [esi], eax
add esi, dword [ebp + 0x18]
dec edi
jne 0x4de0f3
pop ebx
pop edi
pop esi
pop ebp
ret 0x14

Function at 0x4de140
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
test edx, edx
jle 0x4de1d6
cmp edx, 0x100
jle 0x4de15b
mov edx, 0x100
mov eax, dword [ebp + 0x10]
push esi
mov ecx, eax
and ecx, 0xff00
mov esi, eax
imul ecx, edx
and esi, 0xffff00ff
imul esi, edx
and eax, 0xff00ff
imul eax, edx
xor ecx, esi
and ecx, 0xff0000
xor ecx, eax
push edi
mov edi, dword [ebp + 0xc]
shr ecx, 8
test edi, edi
jle 0x4de1d4
mov esi, dword [ebp + 8]
push ebx
mov edx, dword [esi]
mov eax, edx
not eax
mov ebx, eax
xor ebx, ecx
and eax, ecx
and ebx, 0xfefefe
lea eax, [ebx + eax*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
mov ebx, eax
or ebx, edx
or eax, ecx
sub ebx, eax
or ebx, 0xff000000
mov dword [esi], ebx
add esi, 4
dec edi
jne 0x4de196
pop ebx
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x4de1e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jle 0x4de274
cmp ecx, 0x100
jle 0x4de1fb
mov ecx, 0x100
mov eax, dword [ebp + 0x10]
push esi
mov edx, eax
and edx, 0xff00
mov esi, eax
imul edx, ecx
and esi, 0xffff00ff
imul esi, ecx
and eax, 0xff00ff
imul eax, ecx
xor edx, esi
and edx, 0xff0000
xor edx, eax
push edi
mov edi, dword [ebp + 0xc]
shr edx, 8
test edi, edi
jle 0x4de272
mov esi, dword [ebp + 8]
push ebx
mov eax, dword [esi]
mov ecx, eax
xor ecx, edx
mov ebx, eax
and ecx, 0xfefefe
and ebx, edx
lea ecx, [ecx + ebx*2]
shr ecx, 8
and ecx, 0x10101
add ecx, 0x7f7f7f
xor ecx, 0x7f7f7f
sub eax, ecx
add eax, edx
or eax, ecx
or eax, 0xff000000
mov dword [esi], eax
add esi, 4
dec edi
jne 0x4de236
pop ebx
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x4de280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x1c]
test edx, edx
jle 0x4de33a
cmp edx, 0x100
jle 0x4de29b
mov edx, 0x100
mov eax, dword [ebp + 0x18]
push esi
mov ecx, eax
and ecx, 0xff00
mov esi, eax
imul ecx, edx
and esi, 0xffff00ff
imul esi, edx
and eax, 0xff00ff
imul eax, edx
xor ecx, esi
and ecx, 0xff0000
xor ecx, eax
mov eax, dword [ebp + 0x10]
shr ecx, 8
test eax, eax
jle 0x4de339
mov edx, dword [ebp + 0x14]
add edx, edx
add edx, edx
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp + 0x18], edx
mov edx, dword [ebp + 8]
mov dword [ebp + 0x1c], eax
test edi, edi
jle 0x4de32f
lea ebx, [ebx]
mov esi, dword [edx]
mov eax, esi
not eax
mov ebx, eax
xor eax, ecx
and eax, 0xfefefe
and ebx, ecx
lea eax, [eax + ebx*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
mov ebx, eax
or ebx, esi
or eax, ecx
sub ebx, eax
or ebx, 0xff000000
mov dword [edx], ebx
add edx, 4
dec edi
jne 0x4de2f0
mov edi, dword [ebp + 0xc]
add edx, dword [ebp + 0x18]
dec dword [ebp + 0x1c]
jne 0x4de2e6
pop edi
pop ebx
pop esi
pop ebp
ret 0x18

Function at 0x4de340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
jle 0x4de3f9
cmp ecx, 0x100
jle 0x4de35b
mov ecx, 0x100
mov eax, dword [ebp + 0x18]
push esi
mov edx, eax
and edx, 0xff00
mov esi, eax
imul edx, ecx
and esi, 0xffff00ff
imul esi, ecx
and eax, 0xff00ff
imul eax, ecx
xor edx, esi
and edx, 0xff0000
xor edx, eax
mov eax, dword [ebp + 0x10]
shr edx, 8
test eax, eax
jle 0x4de3f8
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
add ecx, ecx
push ebx
add ecx, ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp + 0x18], ecx
mov dword [ebp + 0x1c], eax
test edi, edi
jle 0x4de3ee
lea ebx, [ebx]
mov eax, dword [esi]
mov ecx, eax
xor ecx, edx
mov ebx, eax
and ecx, 0xfefefe
and ebx, edx
lea ecx, [ecx + ebx*2]
shr ecx, 8
and ecx, 0x10101
add ecx, 0x7f7f7f
xor ecx, 0x7f7f7f
sub eax, ecx
add eax, edx
or eax, ecx
or eax, 0xff000000
mov dword [esi], eax
add esi, 4
dec edi
jne 0x4de3b0
mov edi, dword [ebp + 0xc]
add esi, dword [ebp + 0x18]
dec dword [ebp + 0x1c]
jne 0x4de3a6
pop edi
pop ebx
pop esi
pop ebp
ret 0x18

Function at 0x4de4e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x4de54b
mov ecx, dword [ebp + 0x18]
lea edx, [ecx*4]
mov ecx, dword [ebp + 0x1c]
push ebx
mov dword [ebp + 0x18], edx
lea edx, [ecx*4]
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp + 0x1c], edx
mov edx, dword [ebp + 0xc]
push edi
mov dword [ebp + 0x14], eax
test esi, esi
jle 0x4de53d
mov edi, dword [ebp + 0x20]
add edi, edi
add edi, edi
mov edi, edi
mov eax, dword [edx]
mov ebx, eax
not ebx
xor ebx, eax
and ebx, 0xffffff
xor ebx, eax
mov dword [ecx], ebx
add ecx, 4
add edx, edi
dec esi
jne 0x4de520
mov esi, dword [ebp + 0x10]
add ecx, dword [ebp + 0x18]
add edx, dword [ebp + 0x1c]
dec dword [ebp + 0x14]
jne 0x4de513
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c
Function at 0x4de840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x24]
test eax, eax
jle 0x4de979
push ebx
push esi
cmp eax, 0x100
mov eax, dword [ebp + 0x14]
push edi
jl 0x4de8cd
test eax, eax
jle 0x4de976
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea edx, [ecx*4]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0x14], edx
lea edx, [ecx*4]
mov dword [ebp + 0x18], edx
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x4de8b9
mov dword [ebp + 0x24], eax
mov esi, dword [ebx]
mov eax, dword [edi]
mov ecx, esi
not ecx
call fcn.0044e940
and esi, 0xff000000
or eax, esi
mov dword [edi], eax
mov eax, dword [ebp + 0x20]
add eax, eax
add eax, eax
add edi, 4
add ebx, eax
dec dword [ebp + 0x24]
jne 0x4de891
add edi, dword [ebp + 0x14]
add ebx, dword [ebp + 0x18]
dec dword [ebp + 0x1c]
jne 0x4de887
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
test eax, eax
jle 0x4de976
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea edx, [ecx*4]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0x14], edx
lea edx, [ecx*4]
mov dword [ebp + 0x18], edx
mov dword [ebp - 4], eax
mov ecx, 1
lea ecx, [ecx]
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x4de96b
mov dword [ebp + 0x1c], eax
lea ebx, [ebx]
mov esi, dword [ebx]
mov eax, esi
not eax
mov ecx, eax
mov edx, eax
and ecx, 0xffff00ff
imul ecx, dword [ebp + 0x24]
and edx, 0xff00
imul edx, dword [ebp + 0x24]
and eax, 0xff00ff
imul eax, dword [ebp + 0x24]
xor ecx, edx
and ecx, 0xff0000
xor ecx, eax
mov eax, dword [edi]
shr ecx, 8
call fcn.0044e940
and esi, 0xff000000
or eax, esi
mov dword [edi], eax
mov eax, dword [ebp + 0x20]
add eax, eax
add eax, eax
mov ecx, 1
add edi, 4
add ebx, eax
sub dword [ebp + 0x1c], ecx
jne 0x4de910
add edi, dword [ebp + 0x14]
add ebx, dword [ebp + 0x18]
sub dword [ebp - 4], ecx
jne 0x4de900
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4de980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x24]
test ebx, ebx
jle 0x4deaa5
mov eax, dword [ebp + 0x14]
push esi
push edi
cmp ebx, 0x100
jl 0x4dea09
test eax, eax
jle 0x4deaa3
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea edx, [ecx*4]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0x14], edx
lea edx, [ecx*4]
mov dword [ebp + 0x18], edx
mov dword [ebp + 0x1c], eax
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x4de9f7
mov dword [ebp + 0xc], eax
mov esi, dword [ebx]
mov eax, dword [edi]
mov ecx, esi
call fcn.0044e940
and esi, 0xff000000
or eax, esi
mov dword [edi], eax
mov eax, dword [ebp + 0x20]
add eax, eax
add eax, eax
add edi, 4
add ebx, eax
dec dword [ebp + 0xc]
jne 0x4de9d1
add edi, dword [ebp + 0x14]
add ebx, dword [ebp + 0x18]
dec dword [ebp + 0x1c]
jne 0x4de9c7
pop edi
pop esi
pop ebx
pop ebp
ret 0x20
test eax, eax
jle 0x4deaa3
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 8]
lea edx, [ecx*4]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0x14], edx
lea edx, [ecx*4]
mov dword [ebp + 0x18], edx
mov dword [ebp + 0x24], eax
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x4dea95
mov dword [ebp + 0x1c], eax
jmp 0x4dea40
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
mov ecx, esi
and ecx, 0xffff00ff
imul ecx, ebx
mov edx, esi
and edx, 0xff00
imul edx, ebx
mov eax, esi
and eax, 0xff00ff
imul eax, ebx
xor ecx, edx
and ecx, 0xff0000
xor ecx, eax
mov eax, dword [edi]
shr ecx, 8
call fcn.0044e940
and esi, 0xff000000
or eax, esi
mov dword [edi], eax
mov eax, dword [ebp + 0x20]
add eax, eax
add eax, eax
add dword [ebp + 0xc], eax
add edi, 4
dec dword [ebp + 0x1c]
jne 0x4dea40
mov ecx, dword [ebp + 0x18]
add edi, dword [ebp + 0x14]
add dword [ebp + 0xc], ecx
dec dword [ebp + 0x24]
jne 0x4dea31
pop edi
pop esi
pop ebx
pop ebp
ret 0x20
Function at 0x4dec70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x24]
test edx, edx
jg 0x4deca4
mov edx, dword [ebp + 0x20]
mov eax, dword [ecx]
mov eax, dword [eax + 0x148]
push edx
mov edx, dword [ebp + 0x1c]
push edx
mov edx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push edx
call eax
pop ebp
ret 0x20
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x4ded43
mov ecx, dword [ebp + 0x18]
add ecx, ecx
add ecx, ecx
mov dword [ebp + 0x24], ecx
mov ecx, dword [ebp + 0x1c]
add ecx, ecx
push ebx
add ecx, ecx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp + 0x1c], ecx
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x10]
push edi
mov ecx, 1
test eax, eax
jle 0x4ded32
mov dword [ebp + 0x14], eax
jmp 0x4dece0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, ecx
not eax
mov edi, eax
mov ebx, eax
and edi, 0xffff00ff
imul edi, edx
and ebx, 0xff00
and eax, 0xff00ff
imul ebx, edx
imul eax, edx
xor edi, ebx
and edi, 0xff0000
xor edi, eax
mov eax, dword [ebp + 0x20]
shr edi, 8
add edi, ecx
add eax, eax
add eax, eax
add dword [ebp + 0xc], eax
mov dword [esi], edi
mov ecx, 1
add esi, 4
sub dword [ebp + 0x14], ecx
jne 0x4dece0
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0x1c]
add esi, dword [ebp + 0x24]
add dword [ebp + 0xc], edi
sub dword [ebp + 0x18], ecx
jne 0x4decd4
pop edi
pop esi
pop ebx
pop ebp
ret 0x20

Function at 0x4ded50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x24]
cmp edx, 0x100
jl 0x4ded88
mov edx, dword [ebp + 0x20]
mov eax, dword [ecx]
mov eax, dword [eax + 0x148]
push edx
mov edx, dword [ebp + 0x1c]
push edx
mov edx, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp + 8]
push edx
call eax
pop ebp
ret 0x20
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x4dee30
mov ecx, dword [ebp + 0x18]
add ecx, ecx
add ecx, ecx
mov dword [ebp + 0x24], ecx
mov ecx, dword [ebp + 0x1c]
push ebx
add ecx, ecx
push esi
mov esi, dword [ebp + 0xc]
add ecx, ecx
push edi
mov dword [ebp + 0x1c], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x10]
mov edi, 1
jmp 0x4dedc0
test eax, eax
jle 0x4dee22
mov dword [ebp + 0x14], eax
jmp 0x4dedd0
mov eax, dword [esi]
mov edi, eax
and edi, 0xffff00ff
mov ebx, eax
imul edi, edx
and ebx, 0xff00
imul ebx, edx
xor edi, ebx
mov ebx, eax
and ebx, 0xff00ff
imul ebx, edx
and edi, 0xff0000
xor edi, ebx
and eax, 0xff000000
shr edi, 8
or edi, eax
mov eax, dword [ebp + 0x20]
add eax, eax
mov dword [ecx], edi
add eax, eax
mov edi, 1
add ecx, 4
add esi, eax
sub dword [ebp + 0x14], edi
jne 0x4dedd0
mov eax, dword [ebp + 0x10]
add ecx, dword [ebp + 0x24]
add esi, dword [ebp + 0x1c]
sub dword [ebp + 0x18], edi
jne 0x4dedc0
pop edi
pop esi
pop ebx
pop ebp
ret 0x20
Function at 0x4deeb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 0x24]
mov eax, ecx
sar eax, 0x10
mov byte [ebp - 1], al
mov eax, dword [ebp + 0x14]
mov edx, ecx
sar edx, 8
mov byte [ebp - 2], dl
test eax, eax
jle 0x4defd4
mov edx, dword [ebp + 0x18]
add edx, edx
add edx, edx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 0x1c]
push ebx
add edx, edx
push esi
mov esi, dword [ebp + 8]
add edx, edx
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x4defbf
movzx edx, byte [ebp - 1]
movzx ecx, cl
mov dword [ebp + 0x1c], ecx
movzx ecx, byte [ebp - 2]
mov dword [ebp + 8], edx
mov dword [ebp - 8], ecx
mov dword [ebp + 0x14], eax
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx]
movzx ecx, bl
imul ecx, dword [ebp + 0x1c]
mov eax, 0x80808081
mul ecx
shr edx, 7
mov ecx, edx
mov edx, ebx
and edx, 0xff0000
imul edx, dword [ebp + 8]
mov eax, 0x80808081
mul edx
shr edx, 7
and edx, 0xff0000
mov edi, dword [esi]
and ecx, 0xff
or ecx, edx
mov edx, ebx
and edx, 0xff00
imul edx, dword [ebp - 8]
mov eax, 0x80808081
mul edx
shr edx, 7
and edx, 0xff00
or ecx, edx
mov eax, edi
not eax
mov edx, eax
xor eax, ecx
and eax, 0xfefefe
and edx, ecx
lea eax, [eax + edx*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
mov edx, eax
or eax, edi
or edx, ecx
sub eax, edx
xor eax, ebx
and eax, 0xffffff
xor eax, ebx
mov dword [esi], eax
mov eax, dword [ebp + 0x20]
add eax, eax
add eax, eax
add dword [ebp + 0xc], eax
add esi, 4
dec dword [ebp + 0x14]
jne 0x4def13
mov ecx, dword [ebp + 0x24]
mov eax, dword [ebp - 0x10]
add esi, dword [ebp - 0xc]
add dword [ebp + 0xc], eax
dec dword [ebp + 0x18]
jne 0x4deef1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4defe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x24]
sub esp, 0x10
test eax, eax
je 0x4df111
mov ecx, eax
sar ecx, 0x10
mov byte [ebp - 1], cl
mov ecx, dword [ebp + 0x14]
mov edx, eax
sar edx, 8
mov byte [ebp - 2], dl
test ecx, ecx
jle 0x4df111
mov edx, dword [ebp + 0x18]
add edx, edx
add edx, edx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 0x1c]
push ebx
add edx, edx
push esi
add edx, edx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp + 0x18], ecx
lea esp, [esp]
mov ecx, dword [ebp + 0x10]
test ecx, ecx
jle 0x4df0fc
movzx edx, byte [ebp - 1]
movzx eax, al
mov dword [ebp + 0x1c], eax
movzx eax, byte [ebp - 2]
mov dword [ebp + 8], edx
mov dword [ebp - 8], eax
mov dword [ebp + 0x14], ecx
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ecx]
movzx edx, bl
imul edx, dword [ebp + 0x1c]
mov eax, 0x80808081
mul edx
shr edx, 7
mov ecx, edx
mov edx, ebx
and edx, 0xff0000
imul edx, dword [ebp + 8]
mov eax, 0x80808081
mul edx
shr edx, 7
and edx, 0xff0000
and ecx, 0xff
or ecx, edx
mov esi, dword [edi]
mov edx, ebx
and edx, 0xff00
imul edx, dword [ebp - 8]
mov eax, 0x80808081
mul edx
shr edx, 7
and edx, 0xff00
or ecx, edx
mov edx, ecx
mov eax, ecx
and eax, esi
xor edx, esi
and edx, 0xfefefe
lea eax, [edx + eax*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
sub ecx, eax
add ecx, esi
or ecx, eax
mov eax, dword [ebp + 0x20]
xor ecx, ebx
and ecx, 0xffffff
add eax, eax
xor ecx, ebx
add eax, eax
add dword [ebp + 0xc], eax
mov dword [edi], ecx
add edi, 4
dec dword [ebp + 0x14]
jne 0x4df052
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp - 0x10]
add edi, dword [ebp - 0xc]
add dword [ebp + 0xc], ecx
dec dword [ebp + 0x18]
jne 0x4df030
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x4df220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x24]
test eax, eax
jle 0x4df3c2
push ebx
push esi
push edi
cmp eax, 0x100
jl 0x4df2e8
mov eax, dword [ebp + 0x14]
test eax, eax
jle 0x4df3bf
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0xc]
lea edx, [ecx*4]
mov ecx, dword [ebp + 0x1c]
mov dword [ebp + 0x14], edx
lea edx, [ecx*4]
mov dword [ebp + 0x18], edx
mov edx, dword [ebp + 8]
mov dword [ebp + 0x24], eax
mov eax, dword [ebp + 0x10]
mov ecx, 1
test eax, eax
jle 0x4df2d4
mov dword [ebp + 0xc], eax
lea ebx, [ebx]
mov esi, dword [edx]
mov ecx, dword [edi]
mov eax, esi
not eax
mov ebx, eax
xor eax, ecx
and eax, 0xfefefe
and ebx, ecx
lea eax, [eax + ebx*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
mov ebx, eax
or eax, esi
or ebx, ecx
sub eax, ebx
xor eax, ecx
and eax, 0xffffff
xor eax, ecx
mov dword [edx], eax
mov eax, dword [ebp + 0x20]
add eax, eax
add eax, eax
mov ecx, 1
add edx, 4
add edi, eax
sub dword [ebp + 0xc], ecx
jne 0x4df280
mov eax, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
add edi, dword [ebp + 0x18]
sub dword [ebp + 0x24], ecx
jne 0x4df273
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
mov ecx, dword [ebp + 0x14]
test ecx, ecx
jle 0x4df3bf
mov edx, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
add edx, edx
add edx, edx
mov dword [ebp + 0x14], edx
mov edx, dword [ebp + 0x1c]
add edx, edx
add edx, edx
mov dword [ebp + 0x18], edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 0x10]
mov edx, 1
test ecx, ecx
jle 0x4df3ad
mov dword [ebp + 0x1c], ecx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov edi, dword [esi]
mov ecx, edx
and ecx, 0xffff00ff
imul ecx, eax
mov ebx, edx
and ebx, 0xff00
imul ebx, eax
xor ecx, ebx
mov ebx, edx
and ebx, 0xff00ff
imul ebx, eax
and ecx, 0xff0000
xor ecx, ebx
shr ecx, 8
mov eax, edi
not eax
mov ebx, eax
xor eax, ecx
and eax, 0xfefefe
and ebx, ecx
lea eax, [eax + ebx*2]
shr eax, 8
and eax, 0x10101
add eax, 0x7f7f7f
xor eax, 0x7f7f7f
mov ebx, eax
or eax, edi
or ebx, ecx
sub eax, ebx
xor eax, edx
and eax, 0xffffff
xor eax, edx
mov dword [esi], eax
mov eax, dword [ebp + 0x20]
add eax, eax
add eax, eax
add dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x24]
mov edx, 1
add esi, 4
sub dword [ebp + 0x1c], edx
jne 0x4df320
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x18]
add esi, dword [ebp + 0x14]
add dword [ebp + 0xc], edi
sub dword [ebp - 4], edx
jne 0x4df315
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20