joyce8/EMBER2024-capa huggingface dataset:
Function at 0x461994
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004061cc
xor eax, eax
push ebp
push 0x2db0e85
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00405fe4
mov esi, eax
mov eax, esi
test eax, eax
jns 0x4619cf
add eax, 3
sar eax, 2
mov dword [ebp - 0x10], eax
mov edi, esi
and edi, 0x80000003
jns 0x4619e4
dec edi
or edi, 0xfffffffc
inc edi
test edi, edi
jle 0x461a1e
lea eax, [ebp - 4]
call fcn.00406234
lea ebx, [eax + esi - 1]
cmp esi, 4
jle 0x461a07
lea eax, [ebp - 4]
call fcn.00406234
lea edx, [eax + esi - 5]
jmp 0x461a0d
lea edx, [ebp - 8]
add edx, edi
dec edx
mov eax, edi
dec eax
test eax, eax
jl 0x461a1e
inc eax
mov cl, byte [edx]
xor byte [ebx], cl
dec edx
dec ebx
dec eax
jne 0x461a15
lea eax, [ebp - 4]
call fcn.00406234
mov esi, dword [ebp - 0x10]
dec esi
mov edx, esi
shl edx, 2
lea ebx, [eax + edx]
lea eax, [ebp - 4]
call fcn.00406234
mov edx, dword [ebp - 0x10]
sub edx, 2
shl edx, 2
lea edx, [eax + edx]
mov eax, esi
cmp eax, 0
jl 0x461a64
test eax, eax
jne 0x461a54
lea edx, [ebp - 8]
mov ecx, dword [edx]
xor dword [ebx], ecx
sub edx, 4
sub ebx, 4
dec eax
cmp eax, 0xffffffff
jne 0x461a4d
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00405d64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2db0e8c
lea eax, [ebp - 4]
call fcn.00405d10
ret

Function at 0x461d20
Capabilities:
Hash data with crc32

Disassembly:
push ebx
cmp byte [0x2ed150c], 0
jne 0x461d5f
xor ebx, ebx
mov ecx, 0x2edff88
mov eax, ebx
mov edx, 0xfffffff8
test al, 1
je 0x461d45
shr eax, 1
xor eax, 0xedb88320
jmp 0x461d47
shr eax, 1
inc edx
jne 0x461d38
mov dword [ecx], eax
inc ebx
add ecx, 4
cmp ebx, 0x100
jne 0x461d31
mov byte [0x2ed150c], 1
pop ebx
ret
Function at 0x461d64
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.0040692c
mov ebx, 0x2edff88
lea esi, [ebp - 0x14]
xor eax, eax
push ebp
push 0x2db1332
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
call fcn.0045a670
test al, al
je 0x461f1c
call fcn.00461d20
mov dword [ebp - 8], 0xffffffff
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00406610
push eax
call dword [0x2ee03a4]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x461f1c
xor ecx, ecx
push ebp
push 0x2db1315
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, 0x100000
call fcn.0040365c
mov dword [ebp - 0x10], eax
xor ecx, ecx
push ebp
push 0x2db12f6
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp dword [ebp + 0x14], 0
jne 0x461e0d
cmp dword [ebp + 0x10], 0
je 0x461e21
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [0x2ee03a8]
cmp dword [ebp + 0xc], 0
jne 0x461e32
cmp dword [ebp + 8], 0x100000
jae 0x461e3b
jmp 0x461e34
jge 0x461e3b
mov eax, dword [ebp + 8]
mov dword [esi], eax
jmp 0x461e41
mov dword [esi], 0x100000
push 0
push esi
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [0x2ee03ac]
mov eax, dword [esi]
xor edx, edx
sub dword [ebp + 8], eax
sbb dword [ebp + 0xc], edx
cmp dword [esi], 0
jbe 0x461ed9
mov eax, dword [esi]
dec eax
test eax, eax
jl 0x461e96
inc eax
xor edx, edx
mov ecx, dword [ebp - 0x10]
movzx ecx, byte [ecx + edx]
xor ecx, dword [ebp - 8]
and ecx, 0xff
mov ecx, dword [ebx + ecx*4]
mov edi, dword [ebp - 8]
shr edi, 8
and edi, 0xffffff
xor ecx, edi
mov dword [ebp - 8], ecx
inc edx
dec eax
jne 0x461e6e
cmp dword [ebp + 0xc], 0
jne 0x461ea7
cmp dword [ebp + 8], 0x100000
jae 0x461eb0
jmp 0x461ea9
jge 0x461eb0
mov eax, dword [ebp + 8]
mov dword [esi], eax
jmp 0x461eb6
mov dword [esi], 0x100000
push 0
push esi
mov eax, dword [esi]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [0x2ee03ac]
mov eax, dword [esi]
xor edx, edx
sub dword [ebp + 8], eax
sbb dword [ebp + 0xc], edx
cmp dword [esi], 0
ja 0x461e64
and dword [ebp - 8], 0x7fffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2db12fd
mov eax, dword [ebp - 0x10]
call fcn.0040367c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2db1339
lea eax, [ebp - 4]
call fcn.0040641c
ret
Function at 0x461fa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 4], eax
call fcn.00461d20
push dword [ebp + 0x14]
push dword [ebp + 0x10]
mov eax, dword [ebp - 4]
call fcn.0041f5b8
mov eax, dword [ebp - 4]
call fcn.0041f5cc
push edx
push eax
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
add eax, dword [ebp + 8]
adc edx, dword [ebp + 0xc]
cmp edx, dword [esp + 4]
jne 0x461fe2
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x461ffa
jmp 0x461fe6
pop edx
pop eax
jle 0x461ffa
mov eax, dword [ebp - 4]
call fcn.0041f5cc
sub eax, dword [ebp + 0x10]
sbb edx, dword [ebp + 0x14]
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], edx
mov dword [ebp - 0x10], 0x80000
mov eax, dword [ebp - 0x10]
cdq
cmp edx, dword [ebp + 0xc]
jne 0x462011
cmp eax, dword [ebp + 8]
jbe 0x462019
jmp 0x462013
jle 0x462019
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.0040365c
mov dword [ebp - 0xc], eax
xor ecx, ecx
push ebp
push 0x2db14c9
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov dword [ebp - 8], 0xffffffff
jmp 0x46209c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
test eax, eax
jle 0x46207a
mov ecx, dword [ebp - 8]
shr ecx, 8
and ecx, 0xffffff
xor ebx, ebx
mov bl, byte [edx]
xor ebx, dword [ebp - 8]
and ebx, 0xff
xor ecx, dword [ebx*4 + 0x2edff88]
mov dword [ebp - 8], ecx
inc edx
dec eax
jne 0x462053
mov eax, dword [ebp - 0x10]
cdq
sub dword [ebp + 8], eax
sbb dword [ebp + 0xc], edx
mov eax, dword [ebp - 0x10]
cdq
cmp edx, dword [ebp + 0xc]
jne 0x462094
cmp eax, dword [ebp + 8]
jbe 0x46209c
jmp 0x462096
jle 0x46209c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0xc], 0
jne 0x4620aa
cmp dword [ebp + 8], 0
ja 0x46203b
jmp 0x4620ac
jg 0x46203b
and dword [ebp - 8], 0x7fffffff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2db14d0
mov eax, dword [ebp - 0xc]
call fcn.0040367c
ret

Function at 0x4620dc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
call fcn.00461d20
or ebx, 0xffffffff
mov eax, esi
call fcn.00405fe4
test eax, eax
jle 0x46211e
mov edx, 1
xor ecx, ecx
mov cl, byte [esi + edx - 1]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x2edff88]
shr ebx, 8
and ebx, 0xffffff
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x4620f8
and ebx, 0x7fffffff
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4739a8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004061cc
mov eax, dword [ebp - 8]
call fcn.004061cc
xor eax, eax
push ebp
push 0x2dc2e4c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x2edbcf8]
mov byte [eax], 1
mov byte [ebx + 8], 0
mov al, byte [ebp + 8]
mov byte [ebx + 0x35], al
inc dword [0x2ed1658]
xor eax, eax
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x20]
mov edx, dword [ebp - 4]
call fcn.00405d64
lea eax, [ebx + 0x24]
mov edx, dword [ebp - 8]
call fcn.00405d64
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [ebx + 0x30], eax
lea eax, [ebp - 0xc]
push eax
push 4
push ebx
push 0x2dc2d5c
push 0
push 0
call fcn.00408918
mov dword [ebx + 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2dc2e53
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405d34
ret
Function at 0x491320
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x491346
push edi
push esi
not eax
mov edi, ecx
mov esi, dword [0x2ed4f74]
xor ecx, ecx
test esi, esi
je 0x491347
mov cl, byte [edx]
xor cl, al
shr eax, 8
inc edx
xor eax, dword [esi + ecx*4]
dec edi
jne 0x491334
not eax
pop esi
pop edi
ret
push eax
push edx
call fcn.004912fc
mov esi, eax
xor ecx, ecx
pop edx
pop eax
jmp 0x491334

Function at 0x4913e8
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
mov esi, eax
mov eax, dword [edx]
mov ebx, dword [edx + 4]
bswap eax
bswap ebx
mov dword [esi], eax
mov dword [esi + 4], ebx
mov eax, dword [edx + 8]
mov ebx, dword [edx + 0xc]
bswap eax
bswap ebx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
mov eax, dword [edx + 0x10]
mov ebx, dword [edx + 0x14]
bswap eax
bswap ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ebx
mov eax, dword [edx + 0x18]
mov ebx, dword [edx + 0x1c]
bswap eax
bswap ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
mov eax, dword [edx + 0x20]
mov ebx, dword [edx + 0x24]
bswap eax
bswap ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edx + 0x28]
mov ebx, dword [edx + 0x2c]
bswap eax
bswap ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov eax, dword [edx + 0x30]
mov ebx, dword [edx + 0x34]
bswap eax
bswap ebx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
mov eax, dword [edx + 0x38]
mov ebx, dword [edx + 0x3c]
bswap eax
bswap ebx
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
lea esi, [esi + 0x40]
mov ecx, 0x30
mov eax, dword [esi - 8]
mov edi, dword [esi - 0x1c]
mov edx, eax
mov ebx, eax
ror eax, 0x11
ror edx, 0x13
shr ebx, 0xa
xor eax, edx
xor eax, ebx
add edi, eax
mov eax, dword [esi - 0x3c]
mov ebx, eax
mov edx, eax
ror eax, 7
ror edx, 0x12
shr ebx, 3
xor eax, edx
xor eax, ebx
add eax, edi
add eax, dword [esi - 0x40]
mov dword [esi], eax
add esi, 4
dec ecx
jne 0x491473
pop ebx
pop edi
pop esi
ret
Function at 0x4914b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov ebx, eax
lea esi, [ebp - 0x20]
lea edx, [ebx + 0x50]
lea eax, [ebp - 0x120]
call fcn.004913e8
mov eax, dword [ebx]
mov dword [esi], eax
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 8]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [ebx + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x1c], eax
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov edx, eax
mov ebx, eax
ror eax, 6
ror edx, 0xb
ror ecx, 0x19
xor eax, edx
mov edx, dword [ebp - 8]
xor eax, ecx
mov ecx, dword [ebp - 4]
add ecx, eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, edx
mov dword [ebp - 0xc], ebx
and eax, ebx
xor eax, edx
add eax, dword [edi*4 + 0x2ed4f98]
add eax, ecx
mov ecx, dword [ebp - 0x14]
add eax, dword [ebp + edi*4 - 0x120]
mov ebx, dword [ebp - 0x20]
add ecx, eax
mov esi, eax
mov dword [ebp - 0x10], ecx
mov eax, ebx
mov edx, ebx
ror eax, 2
mov ecx, ebx
ror edx, 0xd
ror ecx, 0x16
xor eax, edx
xor eax, ecx
mov ecx, dword [ebp - 0x1c]
add esi, eax
mov eax, ebx
mov edx, ebx
or eax, ecx
and eax, dword [ebp - 0x18]
and edx, ecx
or eax, edx
inc edi
add esi, eax
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
cmp edi, 0x40
jne 0x491505
pop edi
pop esi
pop ebx
mov eax, dword [esi]
add dword [ebx], eax
mov eax, dword [esi + 4]
add dword [ebx + 4], eax
mov eax, dword [esi + 8]
add dword [ebx + 8], eax
mov eax, dword [esi + 0xc]
add dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
add dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
add dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
add dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
add dword [ebx + 0x1c], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x491730
Capabilities:
Hash data using sha256

Disassembly:
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret
Function at 0x491808
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffed0
mov dword [esp], eax
lea edi, [esp + 0x110]
mov ebp, edx
mov esi, 0x10
lea ebx, [esp + 0x10]
mov eax, dword [ebp]
call fcn.004913e4
mov dword [ebx], eax
add ebp, 4
add ebx, 4
dec esi
jne 0x491827
mov esi, 0x30
lea ebx, [esp + 0x14]
mov eax, dword [ebx]
call fcn.00491768
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x34]
call fcn.0049178c
mov edx, dword [ebx - 4]
add edx, dword [esp + 4]
add edx, dword [ebx + 0x20]
add eax, edx
mov dword [ebx + 0x3c], eax
add ebx, 4
dec esi
jne 0x491843
mov esi, 8
mov eax, dword [esp]
mov edx, edi
mov ecx, dword [eax]
mov dword [edx], ecx
add edx, 4
add eax, 4
dec esi
jne 0x491875
mov esi, 0x40
mov ebx, 0x2ed5098
lea ebp, [esp + 0x10]
mov eax, dword [edi]
call fcn.004917b0
mov dword [esp + 4], eax
mov eax, dword [edi]
mov edx, eax
and edx, dword [edi + 4]
and eax, dword [edi + 8]
xor edx, eax
mov eax, dword [edi + 4]
and eax, dword [edi + 8]
xor edx, eax
mov eax, edx
add eax, dword [esp + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x10]
call fcn.004917dc
mov edx, dword [edi + 0x10]
and edx, dword [edi + 0x14]
mov ecx, dword [edi + 0x10]
not ecx
and ecx, dword [edi + 0x18]
xor edx, ecx
mov dword [esp + 0xc], edx
add eax, dword [edi + 0x1c]
add eax, dword [esp + 0xc]
add eax, dword [ebx]
add eax, dword [ebp]
mov edx, dword [edi + 0x18]
mov dword [edi + 0x1c], edx
mov edx, dword [edi + 0x14]
mov dword [edi + 0x18], edx
mov edx, dword [edi + 0x10]
mov dword [edi + 0x14], edx
mov edx, dword [edi + 0xc]
add edx, eax
mov dword [edi + 0x10], edx
mov edx, dword [edi + 8]
mov dword [edi + 0xc], edx
mov edx, dword [edi + 4]
mov dword [edi + 8], edx
mov edx, dword [edi]
mov dword [edi + 4], edx
add eax, dword [esp + 8]
mov dword [edi], eax
add ebp, 4
add ebx, 4
dec esi
jne 0x491890
mov esi, 8
mov eax, edi
mov edx, dword [esp]
mov ecx, dword [eax]
add dword [edx], ecx
add edx, 4
add eax, 4
dec esi
jne 0x491929
add esp, 0x130
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x491b14
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, 0x40
mov ecx, eax
xor byte [ecx], dl
inc ecx
dec esi
jne 0x491b1c
pop esi
ret

Function at 0x4ab6bc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
and edx, edx
je 0x4ab6d8
and ecx, ecx
jle 0x4ab6d8
push ebx
imul eax, eax, 0x8088405
inc eax
mov ebx, eax
shr ebx, 0x18
mov byte [edx], bl
inc edx
dec ecx
jne 0x4ab6c5
pop ebx
ret
Function at 0x4abf70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
xor ebx, ebx
cmp ebx, dword [ebp - 0xc]
jge 0x4abfe5
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov edi, dword [eax]
call dword [edi + 4]
mov edx, dword [esi]
mov ecx, dword [edx + 0x10]
dec ecx
mov eax, dword [esi]
mov eax, dword [eax + 0x24]
mov edx, eax
inc eax
call fcn.004038cc
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx]
mov edx, dword [esi]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + ebx], al
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x24]
lea ecx, [ecx + edx - 1]
mov edx, dword [ebp - 8]
mov byte [ecx], al
inc ebx
cmp ebx, dword [ebp - 0xc]
jl 0x4abf8f
mov eax, dword [esi]
mov byte [eax + 4], 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4abff4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
add ebx, 0xfffffffc
xor esi, esi
cmp esi, dword [ebp - 0xc]
jge 0x4ac06b
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebx]
mov edx, dword [eax + 0x24]
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 4]
mov edx, dword [ebx]
mov ecx, dword [edx + 0x10]
dec ecx
mov eax, dword [ebx]
mov eax, dword [eax + 0x24]
mov edx, eax
inc eax
call fcn.004038cc
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
mov edx, dword [ebx]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0x1c]
mov cl, byte [ecx]
mov byte [edx + eax - 1], cl
mov eax, dword [ebp - 4]
mov al, byte [eax + esi]
mov edx, dword [ebx]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + esi], al
inc esi
cmp esi, dword [ebp - 0xc]
jl 0x4ac013
mov eax, dword [ebx]
mov byte [eax + 4], 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ac078
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
xor ebx, ebx
cmp ebx, dword [ebp - 0xc]
jge 0x4ac0ee
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov edi, dword [eax]
call dword [edi + 4]
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx]
mov edx, dword [esi]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + ebx], al
mov edx, dword [esi]
mov ecx, dword [edx + 0x10]
dec ecx
mov eax, dword [esi]
mov eax, dword [eax + 0x24]
mov edx, eax
inc eax
call fcn.004038cc
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
mov edx, dword [esi]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebp - 8]
mov cl, byte [ecx + ebx]
xor byte [edx + eax - 1], cl
inc ebx
cmp ebx, dword [ebp - 0xc]
jl 0x4ac097
mov eax, dword [esi]
mov byte [eax + 4], 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ac848
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
xor ebx, ebx
cmp ebx, dword [ebp - 0xc]
jge 0x4ac8be
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov edi, dword [eax]
call dword [edi + 4]
mov edx, dword [esi]
mov ecx, dword [edx + 0x10]
dec ecx
mov eax, dword [esi]
mov eax, dword [eax + 0x24]
mov edx, eax
inc eax
call fcn.004038cc
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
mov edx, dword [esi]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx]
mov byte [edx + eax - 1], cl
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx]
mov edx, dword [esi]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + ebx], al
inc ebx
cmp ebx, dword [ebp - 0xc]
jl 0x4ac867
mov eax, dword [esi]
mov byte [eax + 4], 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4ac8cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
add ebx, 0xfffffffc
xor esi, esi
cmp esi, dword [ebp - 0xc]
jge 0x4ac943
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x1c]
mov eax, dword [ebx]
mov edx, dword [eax + 0x24]
mov eax, dword [ebx]
mov edi, dword [eax]
call dword [edi + 4]
mov edx, dword [ebx]
mov ecx, dword [edx + 0x10]
dec ecx
mov eax, dword [ebx]
mov eax, dword [eax + 0x24]
mov edx, eax
inc eax
call fcn.004038cc
mov eax, dword [ebx]
mov eax, dword [eax + 0x10]
mov edx, dword [ebx]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebx]
mov ecx, dword [ecx + 0x1c]
mov cl, byte [ecx]
mov byte [edx + eax - 1], cl
mov eax, dword [ebp - 4]
mov al, byte [eax + esi]
mov edx, dword [ebx]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + esi], al
inc esi
cmp esi, dword [ebp - 0xc]
jl 0x4ac8eb
mov eax, dword [ebx]
mov byte [eax + 4], 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ac950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
add esi, 0xfffffffc
xor ebx, ebx
cmp ebx, dword [ebp - 0xc]
jge 0x4ac9c6
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x1c]
mov eax, dword [esi]
mov edx, dword [eax + 0x24]
mov eax, dword [esi]
mov edi, dword [eax]
call dword [edi + 4]
mov edx, dword [esi]
mov ecx, dword [edx + 0x10]
dec ecx
mov eax, dword [esi]
mov eax, dword [eax + 0x24]
mov edx, eax
inc eax
call fcn.004038cc
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
mov edx, dword [esi]
mov edx, dword [edx + 0x24]
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + ebx]
xor byte [edx + eax - 1], cl
mov eax, dword [ebp - 4]
mov al, byte [eax + ebx]
mov edx, dword [esi]
mov edx, dword [edx + 0x1c]
xor al, byte [edx]
mov edx, dword [ebp - 8]
mov byte [edx + ebx], al
inc ebx
cmp ebx, dword [ebp - 0xc]
jl 0x4ac96f
mov eax, dword [esi]
mov byte [eax + 4], 3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret