joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416cc0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x416ced
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x416ced
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0xd3e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00d3e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd3e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd3e06a
add dl, dl
jne 0xd3e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd3e0dc
xor eax, eax
add dl, dl
jne 0xd3e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd3e17d
add dl, dl
jne 0xd3e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd3e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd3e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd3e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd3e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd3e075
mov eax, 1
add dl, dl
jne 0xd3e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd3e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd3e0e1
sub eax, ebx
mov ebx, 1
jne 0xd3e128
mov ecx, 1
add dl, dl
jne 0xd3e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd3e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd3e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd3e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd3e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd3e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd3e136
cmp eax, 0x7d00
jae 0xd3e16d
cmp eax, 0x500
jb 0xd3e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd3e075
cmp eax, 0x7f
ja 0xd3e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd3e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd3e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd3e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x403408
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x528008], 0x8088405
inc edx
mov dword [ebx + 0x528008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40967c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x4096ce
test eax, edx
je 0x4096d1
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x409691
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4096b7
add ecx, 4
js 0x4096a7
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x4096b4
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x4096dd
test edx, edx
jne 0x409684
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x42c96c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x42c972
ret
Function at 0x441cec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x441ea7
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00405918
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x441ec0
call fcn.004054ac
mov eax, ebx
call fcn.004271cc
mov edi, eax
dec edi
test edi, edi
jl 0x441da4
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.004271a0
mov edx, dword [0x437cb0]
call fcn.00404498
test al, al
je 0x441da0
push dword [ebp - 8]
mov edx, esi
mov eax, ebx
call fcn.004271a0
lea edx, [ebp - 0x14]
call fcn.00451bcc
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00405918
push dword [ebp - 0x18]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405528
inc esi
dec edi
jne 0x441d52
movzx eax, byte [0x441ec4]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x441ed0
mov eax, dword [ebp - 8]
call fcn.0040ebf8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
call fcn.0040522c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.00451bcc
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x441ec0
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x360]
call fcn.00451bcc
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x441ec0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x441ec0
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x441edc
call fcn.0040aa34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x441eae
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.004051b8
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004051b8
lea eax, [ebp - 0x14]
call fcn.00405194
lea eax, [ebp - 0x10]
call fcn.00405194
lea eax, [ebp - 8]
mov edx, 2
call fcn.004051b8
ret
Function at 0x4f7f68
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp + 8]
mov cl, byte [eax + 0x10]
mov eax, dword [ebp + 8]
mov dl, byte [eax + 0x38]
mov eax, dword [ebp + 8]
mov al, byte [eax - 1]
call fcn.004f8838
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x42c660]
call fcn.00432c98
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f80d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
mov edx, dword [edx + 0xc]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
sub edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
mov edx, dword [edx + 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
sub edx, dword [eax]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x34]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 0x30]
cdq
idiv ecx
imul dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x2c]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x34]
mov edx, dword [eax]
call dword [edx + 0x20]
mov ebx, eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x20]
sub ebx, eax
sar ebx, 1
jns 0x4f8034
adc ebx, 0
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x20]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x2c]
mov ecx, eax
xor edx, edx
xor eax, eax
call fcn.0041c24c
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x34]
call fcn.0043326c
push eax
mov eax, dword [ebp - 4]
call fcn.0043326c
pop ecx
pop edx
call fcn.0042e5e0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
cmp byte [eax + 0x38], 3
setne al
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x20]
call fcn.0042d1f4
push eax
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
mov ecx, dword [ecx + 4]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
mov edx, dword [edx]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
call fcn.004b5f50
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f80de
mov eax, dword [ebp - 4]
call fcn.0040430c
ret
Function at 0x50e600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50e6b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00405194
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x50e642
mov eax, dword [ebp - 0x18]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jle 0x50e69a
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov dl, byte [edx + ecx - 1]
mov ecx, dword [ebp - 8]
shr ecx, 8
xor dl, cl
call fcn.0040537c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
call fcn.00405460
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
movzx eax, byte [eax + edx - 1]
add eax, dword [ebp - 8]
imul dword [ebp - 0xc]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x14]
jne 0x50e653
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50e6b7
lea eax, [ebp - 0x1c]
call fcn.00405194
ret
Function at 0x50e728
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50e8b7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00405194
mov dword [ebp - 0x18], 0x18f7
cmp byte [ebp - 5], 0
je 0x50e7f3
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x50e784
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
test eax, eax
jle 0x50e89c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
mov edx, dword [ebp - 0x18]
shr edx, 8
xor al, dl
mov byte [ebp - 0x11], al
lea ecx, [ebp - 0x28]
xor eax, eax
mov al, byte [ebp - 0x11]
mov edx, 2
call fcn.00409d74
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00405460
mov eax, dword [ebp - 0xc]
xor eax, eax
mov al, byte [ebp - 0x11]
add eax, 0x173
imul eax, eax, 0x770f
add eax, 0xbf76
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x50e799
jmp 0x50e89c
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x50e80a
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sar eax, 1
jns 0x50e814
adc eax, 0
test eax, eax
jle 0x50e89c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x10]
dec eax
mov edx, eax
add edx, edx
inc edx
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.0040568c
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x50e8cc
call fcn.004054ac
mov eax, dword [ebp - 0x2c]
call fcn.00409d9c
mov byte [ebp - 0x11], al
lea eax, [ebp - 0x34]
mov dl, byte [ebp - 0x11]
mov ecx, dword [ebp - 0x18]
shr ecx, 8
xor dl, cl
call fcn.0040537c
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xc]
call fcn.00405460
mov eax, dword [ebp - 0xc]
xor eax, eax
mov al, byte [ebp - 0x11]
add eax, 0x173
imul eax, eax, 0x770f
add eax, 0xbf76
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x50e826
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50e8be
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.004051b8
ret
Function at 0x50e8d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50ea5f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00405194
mov dword [ebp - 0x18], 0xe5f0
cmp byte [ebp - 5], 0
je 0x50e99b
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x50e92c
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
test eax, eax
jle 0x50ea44
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
mov edx, dword [ebp - 0x18]
shr edx, 8
xor al, dl
mov byte [ebp - 0x11], al
lea ecx, [ebp - 0x28]
xor eax, eax
mov al, byte [ebp - 0x11]
mov edx, 2
call fcn.00409d74
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00405460
mov eax, dword [ebp - 0xc]
xor eax, eax
mov al, byte [ebp - 0x11]
add eax, 0x173
imul eax, eax, 0xf404
add eax, 0x76b9
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x50e941
jmp 0x50ea44
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x50e9b2
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sar eax, 1
jns 0x50e9bc
adc eax, 0
test eax, eax
jle 0x50ea44
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x10]
dec eax
mov edx, eax
add edx, edx
inc edx
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.0040568c
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x50ea74
call fcn.004054ac
mov eax, dword [ebp - 0x2c]
call fcn.00409d9c
mov byte [ebp - 0x11], al
lea eax, [ebp - 0x34]
mov dl, byte [ebp - 0x11]
mov ecx, dword [ebp - 0x18]
shr ecx, 8
xor dl, cl
call fcn.0040537c
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xc]
call fcn.00405460
mov eax, dword [ebp - 0xc]
xor eax, eax
mov al, byte [ebp - 0x11]
add eax, 0x173
imul eax, eax, 0xf404
add eax, 0x76b9
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x50e9ce
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ea66
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.004051b8
ret
Function at 0x50ea78
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50ec07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00405194
mov dword [ebp - 0x18], 0x5191
cmp byte [ebp - 5], 0
je 0x50eb43
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x50ead4
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
test eax, eax
jle 0x50ebec
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
mov edx, dword [ebp - 0x18]
shr edx, 8
xor al, dl
mov byte [ebp - 0x11], al
lea ecx, [ebp - 0x28]
xor eax, eax
mov al, byte [ebp - 0x11]
mov edx, 2
call fcn.00409d74
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00405460
mov eax, dword [ebp - 0xc]
xor eax, eax
mov al, byte [ebp - 0x11]
add eax, 0x173
imul eax, eax, 0x58b2
add eax, 0xa41a
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x50eae9
jmp 0x50ebec
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x50eb5a
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sar eax, 1
jns 0x50eb64
adc eax, 0
test eax, eax
jle 0x50ebec
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x10]
dec eax
mov edx, eax
add edx, edx
inc edx
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.0040568c
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x50ec1c
call fcn.004054ac
mov eax, dword [ebp - 0x2c]
call fcn.00409d9c
mov byte [ebp - 0x11], al
lea eax, [ebp - 0x34]
mov dl, byte [ebp - 0x11]
mov ecx, dword [ebp - 0x18]
shr ecx, 8
xor dl, cl
call fcn.0040537c
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xc]
call fcn.00405460
mov eax, dword [ebp - 0xc]
xor eax, eax
mov al, byte [ebp - 0x11]
add eax, 0x173
imul eax, eax, 0x58b2
add eax, 0xa41a
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x50eb76
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ec0e
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.004051b8
ret
Function at 0x50ec20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50edaf
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00405194
mov dword [ebp - 0x18], 0x99c3
cmp byte [ebp - 5], 0
je 0x50eceb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x50ec7c
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
test eax, eax
jle 0x50ed94
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
mov edx, dword [ebp - 0x18]
shr edx, 8
xor al, dl
mov byte [ebp - 0x11], al
lea ecx, [ebp - 0x28]
xor eax, eax
mov al, byte [ebp - 0x11]
mov edx, 2
call fcn.00409d74
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00405460
mov eax, dword [ebp - 0xc]
xor eax, eax
mov al, byte [ebp - 0x11]
add eax, 0x173
imul eax, eax, 0x8cdd
add eax, 0xa753
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x50ec91
jmp 0x50ed94
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x50ed02
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sar eax, 1
jns 0x50ed0c
adc eax, 0
test eax, eax
jle 0x50ed94
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x10]
dec eax
mov edx, eax
add edx, edx
inc edx
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.0040568c
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x50edc4
call fcn.004054ac
mov eax, dword [ebp - 0x2c]
call fcn.00409d9c
mov byte [ebp - 0x11], al
lea eax, [ebp - 0x34]
mov dl, byte [ebp - 0x11]
mov ecx, dword [ebp - 0x18]
shr ecx, 8
xor dl, cl
call fcn.0040537c
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xc]
call fcn.00405460
mov eax, dword [ebp - 0xc]
xor eax, eax
mov al, byte [ebp - 0x11]
add eax, 0x173
imul eax, eax, 0x8cdd
add eax, 0xa753
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x50ed1e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50edb6
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.004051b8
ret
Function at 0x50edc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50ef57
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00405194
mov dword [ebp - 0x18], 0x5ea2
cmp byte [ebp - 5], 0
je 0x50ee93
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x50ee24
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
test eax, eax
jle 0x50ef3c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
mov al, byte [eax + edx - 1]
mov edx, dword [ebp - 0x18]
shr edx, 8
xor al, dl
mov byte [ebp - 0x11], al
lea ecx, [ebp - 0x28]
xor eax, eax
mov al, byte [ebp - 0x11]
mov edx, 2
call fcn.00409d74
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00405460
mov eax, dword [ebp - 0xc]
xor eax, eax
mov al, byte [ebp - 0x11]
add eax, 0x173
imul eax, eax, 0x9e75
add eax, 0xb9ed
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x50ee39
jmp 0x50ef3c
mov eax, dword [ebp - 4]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x50eeaa
mov eax, dword [ebp - 0x24]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sar eax, 1
jns 0x50eeb4
adc eax, 0
test eax, eax
jle 0x50ef3c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 1
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x10]
dec eax
mov edx, eax
add edx, edx
inc edx
mov ecx, 2
mov eax, dword [ebp - 4]
call fcn.0040568c
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x50ef6c
call fcn.004054ac
mov eax, dword [ebp - 0x2c]
call fcn.00409d9c
mov byte [ebp - 0x11], al
lea eax, [ebp - 0x34]
mov dl, byte [ebp - 0x11]
mov ecx, dword [ebp - 0x18]
shr ecx, 8
xor dl, cl
call fcn.0040537c
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xc]
call fcn.00405460
mov eax, dword [ebp - 0xc]
xor eax, eax
mov al, byte [ebp - 0x11]
add eax, 0x173
imul eax, eax, 0x9e75
add eax, 0xb9ed
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x50eec6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50ef5e
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.004051b8
ret