joyce8/EMBER2024-capa huggingface dataset:
Function at 0x534d50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], esi
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
mov ebx, eax
imul ebx, edi
sub edi, dword [esi + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
add ebx, dword [esi + 0x14]
cmp dword [esi + 8], 0xfe
jge 0x534e63
mov ecx, dword [esi + 4]
mov eax, edi
cdq
inc edi
mov dword [ebp + 8], edi
idiv dword [ecx + 0x14]
mov ecx, dword [ecx + 0x10]
mov eax, dword [esi + 0x18]
imul ecx, edx
mov edx, 0x100
movzx eax, byte [ecx + eax]
mov ecx, 0x100
mov edi, eax
shl edi, 0x10
or edi, eax
imul edi, dword [esi + 8]
shr edi, 8
and edi, 0xff00ff
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, dword [ebp - 8]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
dec eax
or ecx, edi
mov dword [ebp + 0xc], eax
mov edi, dword [ebp + 8]
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [ebp - 4]
test eax, eax
jg 0x534d87
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
mov eax, edi
cdq
inc edi
mov dword [ebp + 8], edi
idiv dword [ecx + 0x14]
mov ecx, dword [ecx + 0x10]
mov eax, dword [esi + 0x18]
imul ecx, edx
mov edx, 0x100
movzx eax, byte [ecx + eax]
mov ecx, 0x100
mov edi, eax
shl edi, 0x10
or edi, eax
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, dword [ebp - 8]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
dec eax
or ecx, edi
mov dword [ebp + 0xc], eax
mov edi, dword [ebp + 8]
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [ebp - 4]
test eax, eax
jg 0x534e63
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x534f40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 8], edi
mov eax, dword [edi]
mov eax, dword [eax + 0x10]
mov ebx, eax
mov dword [ebp - 4], eax
mov eax, dword [edi + 8]
imul eax, dword [ebp + 0x10]
imul ebx, esi
sub esi, dword [edi + 0xc]
sar eax, 8
add ebx, dword [edi + 0x14]
cmp eax, 0xfe
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
jge 0x535060
mov ecx, dword [edi + 4]
mov eax, esi
cdq
inc esi
mov dword [ebp + 8], esi
idiv dword [ecx + 0x14]
mov ecx, dword [ecx + 0x10]
mov eax, dword [edi + 0x18]
imul ecx, edx
mov edx, 0x100
movzx eax, byte [ecx + eax]
mov ecx, 0x100
mov edi, eax
shl edi, 0x10
or edi, eax
imul edi, dword [ebp + 0x10]
shr edi, 8
and edi, 0xff00ff
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, dword [ebp + 8]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
dec eax
or ecx, edi
mov dword [ebp + 0xc], eax
mov edi, dword [ebp - 8]
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [ebp - 4]
test eax, eax
jg 0x534f82
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [edi + 4]
mov eax, esi
cdq
inc esi
mov dword [ebp + 8], esi
idiv dword [ecx + 0x14]
mov ecx, dword [ecx + 0x10]
mov eax, dword [edi + 0x18]
imul ecx, edx
mov edx, 0x100
movzx eax, byte [ecx + eax]
mov ecx, 0x100
mov edi, eax
shl edi, 0x10
or edi, eax
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, dword [ebp + 8]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
dec eax
or ecx, edi
mov dword [ebp + 0xc], eax
mov edi, dword [ebp - 8]
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [ebp - 4]
test eax, eax
jg 0x535060
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x535130
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
mov ecx, dword [esi]
mov dword [ebp - 8], ecx
mov edx, dword [ecx + 0x10]
mov ebx, edx
imul ebx, eax
sub eax, dword [esi + 0xc]
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
add ebx, dword [esi + 0x14]
cmp dword [esi + 8], 0xfe
mov dword [ebp - 0x10], ebx
jge 0x535269
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov ecx, eax
mov edi, dword [esi + 8]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [esi + 4]
mov edx, dword [eax + 0x10]
imul edx, ecx
mov ecx, 0x100
add edx, dword [esi + 0x18]
mov esi, dword [ebx]
movzx eax, byte [edx + 1]
movzx ebx, byte [edx + 2]
or eax, 0xff0000
imul eax, edi
shl ebx, 0x10
shr eax, 8
and eax, 0xff00ff
mov dword [ebp - 0xc], eax
shr eax, 0x10
sub ecx, eax
movzx eax, byte [edx]
or ebx, eax
mov edx, 0x100
mov eax, esi
imul ebx, edi
mov edi, dword [ebp - 0xc]
and eax, 0xff00ff
imul eax, ecx
shr esi, 8
and esi, 0xff00ff
imul esi, ecx
shr ebx, 8
shr eax, 8
and ebx, 0xff00ff
and eax, 0xff00ff
add ebx, eax
shr esi, 8
mov ecx, ebx
and esi, 0xff00ff
shr ecx, 8
add edi, esi
and ecx, 0xff00ff
mov eax, edi
mov esi, dword [ebp - 0x14]
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, edi
shl eax, 8
shl edx, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, ebx
mov ebx, dword [ebp - 0x10]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
mov eax, dword [ebp - 8]
shl ecx, 8
dec eax
or ecx, edi
mov dword [ebp - 8], eax
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [ebp - 0x18]
test eax, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], ebx
jg 0x535170
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp + 0xc]
mov eax, dword [ecx + 4]
mov edi, dword [eax + 0x10]
mov eax, edi
imul eax, dword [ebp - 4]
add eax, dword [ecx + 0x18]
cmp edx, edi
jne 0x5352b0
mov ecx, dword [ecx + 4]
cmp dword [ecx + 8], 1
jne 0x5352b0
mov ecx, dword [ebp - 8]
cmp dword [ecx + 8], 1
jne 0x5352b0
imul edi, esi
push edi
push eax
push ebx
call fcn.00d9a680
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov cx, word [eax]
dec esi
movzx edx, byte [eax + 2]
add eax, edi
or edx, 0xffffff00
mov word [ebp - 4], cx
movzx ecx, byte [ebp - 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [ebp - 4]
shl edx, 8
or edx, ecx
mov dword [ebx], edx
add ebx, dword [ebp - 0x18]
test esi, esi
jg 0x5352b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5352f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebx]
mov edi, dword [ebx + 8]
imul edi, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ecx + 0x10]
mov esi, edx
imul esi, eax
sub eax, dword [ebx + 0xc]
sar edi, 8
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], edi
add esi, dword [ebx + 0x14]
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], eax
cmp edi, 0xfe
jge 0x535438
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
nop dword [eax]
mov ecx, eax
mov esi, dword [esi]
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebx + 4]
mov edx, dword [eax + 0x10]
imul edx, ecx
mov ecx, 0x100
add edx, dword [ebx + 0x18]
movzx ebx, byte [edx + 1]
or ebx, 0xff0000
imul ebx, edi
movzx edi, byte [edx + 2]
shl edi, 0x10
shr ebx, 8
and ebx, 0xff00ff
mov eax, ebx
shr eax, 0x10
sub ecx, eax
movzx eax, byte [edx]
or edi, eax
mov edx, 0x100
imul edi, dword [ebp - 0xc]
mov eax, esi
and eax, 0xff00ff
shr esi, 8
imul eax, ecx
and esi, 0xff00ff
imul esi, ecx
shr edi, 8
and edi, 0xff00ff
shr eax, 8
and eax, 0xff00ff
shr esi, 8
add edi, eax
and esi, 0xff00ff
add ebx, esi
mov ecx, edi
mov esi, dword [ebp - 0x10]
mov eax, ebx
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, ebx
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, edi
mov edi, dword [ebp - 0xc]
xor edx, eax
mov eax, ebx
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl ebx, 8
sub ecx, eax
mov eax, dword [ebp - 8]
shl ecx, 8
dec eax
or ecx, ebx
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 0x14]
xor edx, ecx
mov dword [esi], edx
add esi, dword [ebp - 0x18]
test eax, eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], esi
jg 0x535340
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 4]
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ebx, dword [eax + 0x10]
mov eax, ebx
imul eax, dword [ebp - 4]
add eax, dword [ecx + 0x18]
cmp edx, ebx
jne 0x535480
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 8], 1
jne 0x535480
mov ecx, dword [ebp - 8]
cmp dword [ecx + 8], 1
jne 0x535480
imul ebx, edi
push ebx
push eax
push esi
call fcn.00d9a680
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov cx, word [eax]
dec edi
movzx edx, byte [eax + 2]
add eax, ebx
or edx, 0xffffff00
mov word [ebp - 4], cx
movzx ecx, byte [ebp - 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [ebp - 4]
shl edx, 8
or edx, ecx
mov dword [esi], edx
add esi, dword [ebp - 0x18]
test edi, edi
jg 0x535480
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5354c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx]
push ebx
push esi
push edi
mov eax, dword [eax + 0x10]
mov esi, eax
mov edi, dword [ebp + 8]
imul esi, edi
sub edi, dword [ecx + 0xc]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], eax
add esi, dword [ecx + 0x14]
cmp dword [ecx + 8], 0xfe
jge 0x5355f7
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ebx, dword [ecx + 8]
mov eax, edi
mov ecx, dword [ecx + 4]
inc edi
cdq
mov dword [ebp - 0x18], edi
mov edi, dword [esi]
idiv dword [ecx + 0x14]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ebp - 8]
imul ecx, edx
mov edx, 0x100
add ecx, dword [eax + 0x18]
movzx eax, byte [ecx + 1]
or eax, 0xff0000
imul eax, ebx
shr eax, 8
and eax, 0xff00ff
mov dword [ebp - 0x14], eax
shr eax, 0x10
sub edx, eax
movzx eax, byte [ecx + 2]
shl eax, 0x10
mov dword [ebp - 4], eax
movzx eax, byte [ecx]
mov ecx, dword [ebp - 4]
or ecx, eax
mov eax, edi
and eax, 0xff00ff
imul ecx, ebx
mov ebx, dword [ebp - 0x14]
imul eax, edx
shr edi, 8
and edi, 0xff00ff
imul edi, edx
mov edx, 0x100
shr ecx, 8
shr eax, 8
and ecx, 0xff00ff
and eax, 0xff00ff
add ecx, eax
shr edi, 8
and edi, 0xff00ff
mov dword [ebp - 4], ecx
add ebx, edi
shr ecx, 8
mov eax, ebx
mov edi, dword [ebp - 0x18]
shr eax, 8
and ecx, 0xff00ff
and eax, 0xff00ff
sub edx, eax
mov eax, ebx
shl eax, 8
shl edx, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, dword [ebp - 4]
xor edx, eax
mov eax, ebx
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl ebx, 8
sub ecx, eax
mov eax, dword [ebp - 0xc]
shl ecx, 8
dec eax
or ecx, ebx
mov dword [ebp - 0xc], eax
xor edx, ecx
mov ecx, dword [ebp - 8]
mov dword [esi], edx
add esi, dword [ebp - 0x10]
test eax, eax
jg 0x5354f5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ebx, dword [ebp + 0xc]
nop word [eax + eax]
mov ecx, dword [ecx + 4]
mov eax, edi
cdq
dec ebx
inc edi
idiv dword [ecx + 0x14]
mov ecx, dword [ecx + 0x10]
mov eax, dword [ebp - 8]
imul ecx, edx
add ecx, dword [eax + 0x18]
mov ax, word [ecx]
movzx ecx, byte [ecx + 2]
or ecx, 0xffffff00
mov word [ebp - 4], ax
movzx eax, byte [ebp - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 4]
shl ecx, 8
or ecx, eax
mov dword [esi], ecx
add esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
test ebx, ebx
jg 0x535600
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x535650
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
mov eax, dword [eax + 0x10]
mov esi, eax
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 8]
imul eax, dword [ebp + 0x10]
imul esi, ebx
sub ebx, dword [edi + 0xc]
sar eax, 8
add esi, dword [edi + 0x14]
cmp eax, 0xfe
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
jge 0x535790
mov ecx, dword [edi + 4]
mov eax, ebx
cdq
inc ebx
mov dword [ebp - 0x14], ebx
idiv dword [ecx + 0x14]
mov ecx, dword [ecx + 0x10]
imul ecx, edx
mov edx, 0x100
add ecx, dword [edi + 0x18]
mov edi, dword [esi]
movzx eax, byte [ecx + 1]
movzx ebx, byte [ecx + 2]
or eax, 0xff0000
imul eax, dword [ebp - 0xc]
shl ebx, 0x10
shr eax, 8
and eax, 0xff00ff
mov dword [ebp - 4], eax
shr eax, 0x10
sub edx, eax
movzx eax, byte [ecx]
or ebx, eax
mov eax, edi
imul ebx, dword [ebp - 0xc]
and eax, 0xff00ff
imul eax, edx
shr edi, 8
and edi, 0xff00ff
imul edi, edx
mov edx, 0x100
shr ebx, 8
shr eax, 8
and ebx, 0xff00ff
and eax, 0xff00ff
add ebx, eax
shr edi, 8
mov ecx, ebx
and edi, 0xff00ff
shr ecx, 8
add dword [ebp - 4], edi
and ecx, 0xff00ff
mov edi, dword [ebp - 4]
mov eax, edi
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, edi
shl eax, 8
shl edx, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, ebx
mov ebx, dword [ebp - 0x14]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
mov eax, dword [ebp - 8]
shl ecx, 8
dec eax
or ecx, edi
mov dword [ebp - 8], eax
mov edi, dword [ebp - 0x18]
xor edx, ecx
mov dword [esi], edx
add esi, dword [ebp - 0x10]
test eax, eax
jg 0x535692
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [edi + 4]
mov eax, ebx
cdq
inc ebx
idiv dword [ecx + 0x14]
mov ecx, dword [ecx + 0x10]
imul ecx, edx
add ecx, dword [edi + 0x18]
mov ax, word [ecx]
movzx ecx, byte [ecx + 2]
or ecx, 0xffffff00
mov word [ebp - 4], ax
movzx eax, byte [ebp - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 4]
shl ecx, 8
or ecx, eax
mov eax, dword [ebp - 8]
dec eax
mov dword [esi], ecx
add esi, dword [ebp - 0x10]
mov dword [ebp - 8], eax
test eax, eax
jg 0x535790
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5357e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 0xc], edi
mov eax, dword [edi]
mov eax, dword [eax + 0x10]
mov ebx, eax
imul ebx, esi
sub esi, dword [edi + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], esi
add ebx, dword [edi + 0x14]
cmp dword [edi + 8], 0xfe
mov dword [ebp - 4], ebx
mov dword [ebp + 0xc], eax
jge 0x535920
nop dword [eax]
mov ecx, dword [edi + 4]
mov ebx, dword [ebp + 8]
mov eax, ebx
cdq
inc ebx
mov esi, dword [edi + 8]
idiv dword [ecx + 0x14]
mov ecx, dword [ecx + 0x10]
mov eax, dword [edi + 0x18]
imul ecx, edx
mov edx, dword [ebp - 4]
mov dword [ebp + 8], ebx
mov edx, dword [edx]
mov edi, dword [ecx + eax]
mov ebx, edi
shr ebx, 8
mov ecx, 0x100
and ebx, 0xff00ff
and edi, 0xff00ff
imul ebx, esi
imul edi, esi
shr ebx, 8
and ebx, 0xff00ff
shr edi, 8
mov eax, ebx
and edi, 0xff00ff
shr eax, 0x10
sub ecx, eax
mov eax, edx
and eax, 0xff00ff
shr edx, 8
imul eax, ecx
and edx, 0xff00ff
imul edx, ecx
shr eax, 8
and eax, 0xff00ff
shr edx, 8
add edi, eax
and edx, 0xff00ff
add ebx, edx
mov ecx, edi
mov eax, ebx
shr ecx, 8
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
and ecx, 0xff00ff
sub edx, eax
mov eax, ebx
shl eax, 8
shl edx, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, edi
mov edi, dword [ebp - 0xc]
xor edx, eax
mov eax, ebx
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl ebx, 8
sub ecx, eax
mov eax, dword [ebp - 4]
shl ecx, 8
or ecx, ebx
xor edx, ecx
mov dword [eax], edx
add eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp + 0xc], eax
test eax, eax
jg 0x535820
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [edi + 4]
mov eax, esi
cdq
inc esi
mov dword [ebp + 8], esi
idiv dword [ecx + 0x14]
mov ecx, dword [ecx + 0x10]
mov eax, dword [edi + 0x18]
imul ecx, edx
mov edx, dword [ecx + eax]
mov edi, edx
shr edi, 8
mov ecx, 0x100
and edi, 0xff00ff
and edx, 0xff00ff
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
add edi, eax
and esi, 0xff00ff
add esi, edx
mov eax, edi
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
mov ecx, esi
sub edx, eax
shr ecx, 8
shl edx, 8
mov eax, edi
shl eax, 8
and ecx, 0xff00ff
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, dword [ebp + 8]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
dec eax
or ecx, edi
mov dword [ebp + 0xc], eax
mov edi, dword [ebp - 0xc]
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [ebp - 8]
test eax, eax
jg 0x535920
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x535a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp - 8], edi
mov eax, dword [edi]
mov eax, dword [eax + 0x10]
mov ebx, eax
mov dword [ebp - 4], eax
mov eax, dword [edi + 8]
imul eax, dword [ebp + 0x10]
imul ebx, esi
sub esi, dword [edi + 0xc]
sar eax, 8
add ebx, dword [edi + 0x14]
cmp eax, 0xfe
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
jge 0x535b34
mov ecx, dword [edi + 4]
mov eax, esi
cdq
inc esi
mov dword [ebp + 8], esi
idiv dword [ecx + 0x14]
mov ecx, dword [ecx + 0x10]
mov eax, dword [edi + 0x18]
imul ecx, edx
mov edx, dword [ebx]
mov esi, dword [ecx + eax]
mov edi, esi
shr edi, 8
mov ecx, 0x100
and edi, 0xff00ff
and esi, 0xff00ff
imul edi, dword [ebp + 0x10]
imul esi, dword [ebp + 0x10]
shr edi, 8
and edi, 0xff00ff
shr esi, 8
mov eax, edi
and esi, 0xff00ff
shr eax, 0x10
sub ecx, eax
mov eax, edx
and eax, 0xff00ff
shr edx, 8
imul eax, ecx
and edx, 0xff00ff
imul edx, ecx
shr eax, 8
and eax, 0xff00ff
shr edx, 8
add esi, eax
and edx, 0xff00ff
add edi, edx
mov ecx, esi
mov eax, edi
shr ecx, 8
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
and ecx, 0xff00ff
sub edx, eax
mov eax, edi
shl eax, 8
shl edx, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, dword [ebp + 8]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
dec eax
or ecx, edi
mov dword [ebp + 0xc], eax
mov edi, dword [ebp - 8]
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [ebp - 4]
test eax, eax
jg 0x535a42
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [edi + 4]
mov eax, esi
cdq
inc esi
mov dword [ebp + 8], esi
idiv dword [ecx + 0x14]
mov ecx, dword [ecx + 0x10]
mov eax, dword [edi + 0x18]
imul ecx, edx
mov edx, dword [ecx + eax]
mov edi, edx
shr edi, 8
mov ecx, 0x100
and edi, 0xff00ff
and edx, 0xff00ff
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
add edi, eax
and esi, 0xff00ff
add esi, edx
mov eax, edi
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
mov ecx, esi
sub edx, eax
shr ecx, 8
shl edx, 8
mov eax, edi
shl eax, 8
and ecx, 0xff00ff
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, dword [ebp + 8]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
dec eax
or ecx, edi
mov dword [ebp + 0xc], eax
mov edi, dword [ebp - 8]
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [ebp - 4]
test eax, eax
jg 0x535b34
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x535d00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], eax
cmp ebx, dword [edi + 0x6c]
jle 0x535d4f
mov dword [edi + 0x6c], ebx
push dword [edi + 0x68]
call fcn.00d9e0ad
lea eax, [ebx*4]
add esp, 4
test eax, eax
jne 0x535d3c
mov eax, dword [ebp - 4]
xor esi, esi
mov dword [edi + 0x68], esi
jmp 0x535d52
push eax
call fcn.00d9e0c8
mov esi, eax
add esp, 4
mov eax, dword [ebp - 4]
mov dword [edi + 0x68], esi
jmp 0x535d52
mov esi, dword [edi + 0x68]
push ebx
push eax
push esi
mov ecx, edi
call fcn.00521d80
mov eax, dword [edi + 0x48]
mov ecx, dword [edi + 0x50]
imul ecx, dword [ebp + 0x10]
mov eax, dword [eax + 0x10]
mov ebx, eax
imul ebx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
sar ecx, 8
mov dword [ebp - 8], ecx
add ebx, dword [edi + 0x64]
cmp ecx, 0xfe
jge 0x535e67
mov edx, dword [esi]
mov edi, edx
shr edi, 8
add esi, 4
and edi, 0xff00ff
mov dword [ebp - 4], esi
imul edi, ecx
and edx, 0xff00ff
imul edx, dword [ebp - 8]
mov ecx, 0x100
shr edi, 8
and edi, 0xff00ff
shr edx, 8
mov eax, edi
and edx, 0xff00ff
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
add edi, eax
and esi, 0xff00ff
add esi, edx
mov eax, edi
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
mov ecx, esi
sub edx, eax
shr ecx, 8
shl edx, 8
mov eax, edi
shl eax, 8
and ecx, 0xff00ff
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, dword [ebp - 4]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
dec eax
or ecx, edi
mov dword [ebp + 0xc], eax
xor edx, ecx
mov ecx, dword [ebp - 8]
mov dword [ebx], edx
add ebx, dword [ebp - 0xc]
test eax, eax
jg 0x535d87
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [esi]
mov ecx, 0x100
mov edi, edx
add esi, 4
shr edi, 8
and edx, 0xff00ff
and edi, 0xff00ff
mov dword [ebp - 4], esi
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
add edi, eax
and esi, 0xff00ff
add esi, edx
mov eax, edi
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
mov ecx, esi
sub edx, eax
shr ecx, 8
shl edx, 8
mov eax, edi
shl eax, 8
and ecx, 0xff00ff
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, dword [ebp - 4]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
dec eax
or ecx, edi
mov dword [ebp + 0xc], eax
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [ebp - 0xc]
test eax, eax
jg 0x535e67
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc