joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4958b0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebp, ecx
mov ebx, edx
mov dword [esp], eax
lea edi, [esp + 4]
mov eax, dword [esp]
cmp byte [eax + 4], 0
jne 0x4958df
mov ecx, 0x1f4
mov edx, 0x495980
mov eax, 0x4959dc
call fcn.00404c8c
mov eax, dword [esp]
mov eax, dword [eax + 8]
mov dword [edi], eax
mov eax, dword [esp]
mov eax, dword [eax + 0xc]
mov dword [edi + 4], eax
mov eax, dword [esp]
mov eax, dword [eax + 0x10]
mov dword [edi + 8], eax
mov esi, ebx
dec ebp
test ebp, ebp
jl 0x495953
inc ebp
mov eax, dword [edi + 8]
and eax, 0xffff
or eax, 2
mov bl, byte [esi]
mov edx, ebx
mov ecx, eax
xor ecx, 1
imul ecx, eax
shr ecx, 8
xor dl, cl
mov byte [esi], dl
mov edx, dword [edi]
mov eax, ebx
call fcn.00492b14
mov dword [edi], eax
mov eax, dword [edi]
and eax, 0xff
add dword [edi + 4], eax
imul ebx, dword [edi + 4], 0x8088405
inc ebx
mov dword [edi + 4], ebx
mov eax, ebx
shr eax, 0x18
mov edx, dword [edi + 8]
call fcn.00492b14
mov dword [edi + 8], eax
inc esi
dec ebp
jne 0x495901
mov eax, dword [esp]
mov edx, dword [edi]
mov dword [eax + 8], edx
mov eax, dword [esp]
mov edx, dword [edi + 4]
mov dword [eax + 0xc], edx
mov eax, dword [esp]
mov edx, dword [edi + 8]
mov dword [eax + 0x10], edx
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x495a1c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], edx
mov ebx, eax
mov dword [ebx + 8], 0x12345678
mov dword [ebx + 0xc], 0x23456789
mov dword [ebx + 0x10], 0x34567890
mov eax, dword [esp]
call fcn.00404f88
mov esi, eax
test esi, esi
jle 0x495a8a
mov edi, 1
mov eax, dword [esp]
mov al, byte [eax + edi - 1]
mov edx, dword [ebx + 8]
call fcn.00492b14
mov ebp, eax
mov dword [ebx + 8], ebp
and ebp, 0xff
add dword [ebx + 0xc], ebp
imul ebp, dword [ebx + 0xc], 0x8088405
inc ebp
mov dword [ebx + 0xc], ebp
mov eax, ebp
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.00492b14
mov dword [ebx + 0x10], eax
inc edi
dec esi
jne 0x495a4e
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49be04
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
test dl, dl
je 0x49be20
add esp, 0xfffffff0
call fcn.00404180
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 8]
call fcn.00405178
xor eax, eax
push ebp
push 0x49bf15
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, ebx
call fcn.00403e44
mov byte [ebx + 8], 0
mov eax, dword [ebp - 8]
call fcn.00491708
test al, al
je 0x49be75
push esi
push 0
mov eax, dword [ebx + 0x28]
push eax
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x49a344]
call fcn.0049a8fc
mov dword [ebx + 4], eax
jmp 0x49be8e
push esi
push 1
mov eax, dword [ebx + 0x28]
push eax
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x49a344]
call fcn.0049a8fc
mov dword [ebx + 4], eax
mov eax, dword [ebx + 4]
mov dword [eax + 0x34], ebx
mov edx, dword [ebx]
mov edx, dword [edx + 0x64]
mov dword [eax + 0x30], edx
mov dword [eax + 0x3c], ebx
mov edx, dword [ebx]
mov edx, dword [edx + 0x1c]
mov dword [eax + 0x38], edx
xor eax, eax
mov dword [ebx + 0x38], eax
mov byte [ebx + 0x3e], 1
lea eax, [ebx + 0xc]
mov edx, dword [ebp - 8]
call fcn.00404d00
mov dword [ebx + 0x94], ebx
mov eax, dword [ebx]
mov eax, dword [eax + 0x34]
mov dword [ebx + 0x90], eax
mov byte [ebx + 0x44], 0
mov word [ebx + 0x3c], si
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402c34
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00409fcc
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0049d400
mov eax, ebx
call fcn.0049cc78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49bf1c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404cd0
ret

Function at 0x49d514
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x49d5c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx + 0x34], dl
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x49d540
call fcn.00403e74
xor eax, eax
mov dword [ebx + 0x38], eax
cmp byte [ebx + 0x34], 0
je 0x49d5b2
cmp dword [ebx + 0x30], 0
je 0x49d5b2
xor eax, eax
push ebp
push 0x49d587
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
mov ecx, dword [ebx + 0x30]
mov dl, 1
mov eax, dword [0x41c378]
call fcn.004209a8
mov dword [ebx + 0x38], eax
mov edx, dword [ebx + 0xc]
mov cl, 6
mov eax, ebx
call fcn.0049cd24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49d5b2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d5cf
lea eax, [ebp - 4]
call fcn.00404cac
ret
Function at 0x4a4680
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.004204f4
mov dword [ebp - 0x18], eax
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 0x14]
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4a4504]
call fcn.004a4798
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4a4788
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
add eax, 0x30
call fcn.004a4650
test al, al
je 0x4a4754
mov byte [ebp - 5], 5
mov dl, 1
mov eax, dword [0x41c468]
call fcn.00403e44
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
call fcn.004a4880
mov dl, 1
mov eax, dword [0x492fd8]
call fcn.004933c4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x24], 0x200
mov edx, 0x400
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
call dword [ecx + 4]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004987a8
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.00420514
mov eax, dword [ebp - 0x14]
call fcn.004a27cc
cmp al, 4
jne 0x4a4754
mov byte [ebp - 5], 6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a478f
mov eax, dword [ebp - 0xc]
call fcn.00403e74
mov eax, dword [ebp - 0x10]
call fcn.00403e74
mov eax, dword [ebp - 0x14]
call fcn.00403e74
mov eax, dword [ebp - 0x18]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
call fcn.00420514
ret
Function at 0x4a4b78
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a4d1e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebx + 0x30]
mov ecx, 0xa
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, ebx
call fcn.004a4ae8
test al, al
je 0x4a4be4
lea edx, [ebp - 6]
mov ecx, 2
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
movzx edx, word [ebp - 6]
lea eax, [ebx + 0x40]
call fcn.00405314
lea eax, [ebx + 0x40]
call fcn.004051e0
mov edx, eax
movzx ecx, word [ebp - 6]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
jmp 0x4a4bec
lea eax, [ebx + 0x40]
call fcn.00404cac
mov eax, ebx
call fcn.004a4b00
test al, al
je 0x4a4c41
mov eax, esi
call fcn.004204f4
mov edi, eax
mov eax, esi
call fcn.004a480c
mov eax, esi
call fcn.004204f4
sub eax, edi
dec eax
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, edi
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x14]
lea eax, [ebx + 0x1c]
mov edx, dword [ebp - 4]
call fcn.00405314
lea eax, [ebx + 0x1c]
call fcn.004051e0
mov edx, eax
mov ecx, dword [ebp - 4]
inc ecx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
jmp 0x4a4c4e
lea eax, [ebx + 0x1c]
mov edx, 0x4a4d34
call fcn.00404d00
mov eax, ebx
call fcn.004a4af4
test al, al
je 0x4a4ca4
mov eax, esi
call fcn.004204f4
mov edi, eax
mov eax, esi
call fcn.004a480c
mov eax, esi
call fcn.004204f4
sub eax, edi
dec eax
mov dword [ebp - 4], eax
mov eax, edi
cdq
push edx
push eax
mov eax, esi
call fcn.00420514
lea eax, [ebx + 0x44]
mov edx, dword [ebp - 4]
call fcn.00405314
lea eax, [ebx + 0x44]
call fcn.004051e0
mov edx, eax
mov ecx, dword [ebp - 4]
inc ecx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
jmp 0x4a4cac
lea eax, [ebx + 0x44]
call fcn.00404cac
mov eax, ebx
call fcn.004a4b0c
test al, al
je 0x4a4ccc
lea edx, [ebp - 7]
mov ecx, 1
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov al, byte [ebp - 7]
mov byte [ebx + 0x3b], al
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov edi, eax
mov eax, esi
call fcn.004204f4
sub edi, eax
sub edi, 8
mov dword [ebx + 0xc], edi
lea edx, [ebp - 0xc]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0x14]
call fcn.00404d00
lea eax, [ebx + 0x14]
call fcn.00492aac
mov byte [ebx + 8], 1
mov byte [ebx + 0x26], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a4d25
lea eax, [ebp - 0xc]
call fcn.00404cac
ret
Function at 0x4abef0
Capabilities:
Encode data using xor

Disassembly:
and edx, edx
je 0x4abf13
and ecx, ecx
jle 0x4abf13
push ebx
push edi
xor ebx, ebx
lea edi, cs:[0x4abf19]
mov bl, al
shr eax, 8
xor bl, byte [edx]
xor eax, dword [edi + ebx*4]
inc edx
dec ecx
jne 0x4abf03
pop edi
pop ebx
ret

Function at 0x4b848c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, eax
lea ebx, [esi + 0x1c]
mov eax, edx
lea edx, [ebx + 0x20]
mov ecx, 0x20
call fcn.00402b08
mov eax, dword [esi + 0x14]
dec eax
test eax, eax
jb 0x4b8571
inc eax
mov dword [esp + 8], eax
mov dword [esp], 0
mov dword [esp + 4], 4
mov eax, 0x4ccc14
mov dword [esp + 0xc], eax
xor eax, eax
mov edx, dword [esp]
add edx, edx
mov ecx, eax
shr ecx, 1
and ecx, 1
add edx, ecx
shl edx, 7
lea ecx, [edx*8 + 0x4c5708]
mov edx, dword [ebx + eax*4]
and edx, 0xff
mov esi, dword [ecx + edx*4]
lea edx, [eax + 1]
and edx, 0xf
xor dword [ebx + edx*4], esi
lea edx, [eax + 0xf]
and edx, 0xf
xor dword [ebx + edx*4], esi
inc eax
mov edx, dword [ebx + eax*4]
and edx, 0xff
mov esi, dword [ecx + edx*4]
lea edx, [eax + 1]
and edx, 0xf
xor dword [ebx + edx*4], esi
lea edx, [eax + 0xf]
and edx, 0xf
xor dword [ebx + edx*4], esi
inc eax
cmp eax, 0x10
jb 0x4b84d2
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
mov esi, 0x20
sub esi, edx
xor eax, eax
mov ecx, edx
mov edi, dword [ebx + eax*4]
shr edi, cl
mov ecx, esi
mov ebp, dword [ebx + eax*4]
shl ebp, cl
or edi, ebp
mov dword [ebx + eax*4], edi
inc eax
cmp eax, 0x10
jne 0x4b853c
add dword [esp + 0xc], 4
dec dword [esp + 4]
jne 0x4b84d0
inc dword [esp]
dec dword [esp + 8]
jne 0x4b84bf
xor eax, eax
mov edx, 0xf
sub edx, eax
mov edx, dword [ebx + edx*4]
xor dword [ebx + eax*4], edx
inc eax
cmp eax, 8
jne 0x4b8573
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4bcb44
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 8], edx
mov edi, dword [0x4dbc4c]
mov edi, dword [edi]
mov esi, dword [ebp - 8]
mov eax, dword [esi]
call edi
mov dword [ebp - 4], eax
movzx edi, word [ebp - 2]
movzx eax, word [ebp - 4]
mov dword [ebp - 0xc], eax
mov edx, dword [0x4dbc4c]
mov edx, dword [edx]
mov eax, dword [esi + 4]
call edx
mov dword [ebp - 4], eax
movzx eax, word [ebp - 2]
mov dword [ebp - 0x10], eax
movzx eax, word [ebp - 4]
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 4], eax
movzx edx, word [ebx]
mov eax, edi
call fcn.004bcb14
mov edi, eax
movzx eax, word [ebx + 2]
add dword [ebp - 0xc], eax
movzx eax, word [ebx + 4]
add dword [ebp - 0x10], eax
movzx edx, word [ebx + 6]
mov eax, dword [ebp - 0x14]
call fcn.004bcb14
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x10]
xor esi, edi
movzx edx, word [ebx + 8]
mov eax, esi
call fcn.004bcb14
mov esi, eax
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x14]
add eax, esi
movzx edx, word [ebx + 0xa]
call fcn.004bcb14
add esi, eax
xor edi, eax
xor dword [ebp - 0x14], esi
xor esi, dword [ebp - 0xc]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
add ebx, 0xc
inc dword [ebp - 4]
cmp dword [ebp - 4], 8
jne 0x4bcb92
movzx edx, word [ebx]
mov eax, edi
call fcn.004bcb14
mov word [ebp - 2], ax
mov ax, word [ebp - 0x10]
add ax, word [ebx + 2]
mov word [ebp - 4], ax
mov edi, dword [0x4dbc4c]
mov edi, dword [edi]
mov eax, dword [ebp - 4]
call edi
mov esi, dword [ebp - 8]
mov dword [esi], eax
mov ax, word [ebp - 0xc]
add ax, word [ebx + 4]
mov word [ebp - 2], ax
movzx edx, word [ebx + 6]
mov eax, dword [ebp - 0x14]
call fcn.004bcb14
mov word [ebp - 4], ax
mov ebx, dword [0x4dbc4c]
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call ebx
mov dword [esi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4bd2b8
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x38]
mov esi, eax
mov edx, dword [ebp + 8]
mov edi, eax
add edi, 0x100
mov ecx, 1
xor ebx, ebx
mov eax, ecx
and al, 0xff
mov byte [esi], al
mov eax, ecx
and eax, 0xff
mov byte [edi + eax], bl
lea eax, [ecx + ecx*4]
lea eax, [eax + eax*8]
mov ecx, 0x101
cdq
idiv ecx
mov ecx, edx
inc esi
inc ebx
cmp ebx, 0x100
jne 0x4bd2db
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4bec70
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x4bec86
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x4bec7f
mov edx, esp
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xff
mov ebx, dword [ebp - 4]
shr ebx, 8
and ebx, 0xff
mov eax, dword [ebp - 4]
shr eax, 0x10
and eax, 0xff
mov esi, dword [ebp - 4]
shr esi, 0x18
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x20
jne 0x4bed11
movzx ecx, byte [ecx + 0x4cfd70]
mov esi, dword [edx + 0xc]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x4cfc70]
mov esi, dword [edx + 0xc]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x4cfc70]
mov esi, dword [edx + 0xc]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x4cfd70]
mov edi, dword [edx + 0xc]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
cmp dword [esi - 4], 0x18
jl 0x4bed6e
movzx ecx, byte [ecx + 0x4cfd70]
mov esi, dword [edx + 8]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x4cfd70]
mov esi, dword [edx + 8]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x4cfc70]
mov esi, dword [edx + 8]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x4cfc70]
mov edi, dword [edx + 8]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x4cfc70]
mov esi, dword [edx + 4]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x4cfd70]
mov esi, dword [edx + 4]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x4cfc70]
mov esi, dword [edx + 4]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x4cfd70]
mov edi, dword [edx + 4]
shr edi, 0x18
xor esi, edi
mov dword [ebp - 8], esi
movzx ecx, byte [ecx + 0x4cfc70]
mov esi, dword [edx]
and esi, 0xff
xor ecx, esi
movzx ebx, byte [ebx + 0x4cfc70]
mov esi, dword [edx]
shr esi, 8
and esi, 0xff
xor ebx, esi
movzx eax, byte [eax + 0x4cfd70]
mov esi, dword [edx]
shr esi, 0x10
and esi, 0xff
xor eax, esi
mov esi, dword [ebp - 8]
movzx esi, byte [esi + 0x4cfd70]
mov edx, dword [edx]
shr edx, 0x18
xor esi, edx
mov dword [ebp - 8], esi
mov edx, dword [ecx*4 + 0x4cfe70]
xor edx, dword [ebx*4 + 0x4d0270]
xor edx, dword [eax*4 + 0x4d0670]
mov eax, dword [ebp - 8]
xor edx, dword [eax*4 + 0x4d0a70]
mov eax, edx
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x4bef70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
and ecx, 0xff
imul ecx, ecx, 0x1010101
xor ebx, ebx
mov esi, dword [edx + ebx*4]
xor esi, ecx
mov dword [eax + ebx*4], esi
inc ebx
cmp ebx, 0x40
jne 0x4bef80
pop esi
pop ebx
ret
Function at 0x4bef94
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
mov edx, 0x4cfc70
lea eax, [ebp - 0x100]
call fcn.004bef70
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x18]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x4cfc70]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x4cfe70]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x4befc5
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 8
mov edx, 0x4cfd70
lea eax, [ebp - 0x100]
call fcn.004bef70
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x17]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x4cfc70]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x4d0270]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0x400], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x4bf014
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x10
mov edx, 0x4cfc70
lea eax, [ebp - 0x100]
call fcn.004bef70
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x16]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x4cfd70]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x4d0670]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0x800], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x4bf067
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x14]
shr ecx, 0x18
mov edx, 0x4cfd70
lea eax, [ebp - 0x100]
call fcn.004bef70
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x15]
xor eax, eax
lea ecx, [ebp - 0x100]
xor ebx, ebx
mov bl, byte [ecx]
movzx ebx, byte [ebx + 0x4cfd70]
xor ebx, edx
mov ebx, dword [ebx*4 + 0x4d0a70]
mov esi, dword [ebp + 8]
mov esi, dword [esi - 0x20]
mov dword [esi + eax*4 + 0xc00], ebx
inc eax
inc ecx
cmp eax, 0x100
jne 0x4bf0ba
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bf0ec
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
mov edx, 0x4cfd70
lea eax, [ebp - 0x100]
call fcn.004bef70
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x18]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x14]
xor eax, eax
lea ebx, [ebp - 0x100]
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x4cfc70]
xor esi, ecx
movzx esi, byte [esi + 0x4cfc70]
xor esi, edx
mov esi, dword [esi*4 + 0x4cfe70]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x4bf126
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 8
mov edx, 0x4cfd70
lea eax, [ebp - 0x100]
call fcn.004bef70
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x17]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x13]
xor eax, eax
lea ebx, [ebp - 0x100]
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x4cfd70]
xor esi, ecx
movzx esi, byte [esi + 0x4cfc70]
xor esi, edx
mov esi, dword [esi*4 + 0x4d0270]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4 + 0x400], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x4bf185
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 0x10
mov edx, 0x4cfc70
lea eax, [ebp - 0x100]
call fcn.004bef70
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x16]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x12]
xor eax, eax
lea ebx, [ebp - 0x100]
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x4cfc70]
xor esi, ecx
movzx esi, byte [esi + 0x4cfd70]
xor esi, edx
mov esi, dword [esi*4 + 0x4d0670]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4 + 0x800], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x4bf1e8
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0x10]
shr ecx, 0x18
mov edx, 0x4cfc70
lea eax, [ebp - 0x100]
call fcn.004bef70
mov eax, dword [ebp + 8]
xor edx, edx
mov dl, byte [eax - 0x15]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov cl, byte [eax - 0x11]
xor eax, eax
lea ebx, [ebp - 0x100]
movzx esi, byte [ebx]
movzx esi, byte [esi + 0x4cfd70]
xor esi, ecx
movzx esi, byte [esi + 0x4cfd70]
xor esi, edx
mov esi, dword [esi*4 + 0x4d0a70]
mov edi, dword [ebp + 8]
mov edi, dword [edi - 0x20]
mov dword [edi + eax*4 + 0xc00], esi
inc eax
inc ebx
cmp eax, 0x100
jne 0x4bf24b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bfa9c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x16]
lea eax, [ebp - 4]
mov ecx, 4
call fcn.00402b08
lea edx, [ebp - 0x12]
lea eax, [ebp - 8]
mov ecx, 4
call fcn.00402b08
mov ebx, dword [0x4db9a4]
mov ebx, dword [ebx]
lea edx, [ebp - 0x16]
lea eax, [ebp - 0x16]
mov ecx, 2
call ebx
mov byte [ebp - 0xd], 8
mov dword [ebp - 0x24], 0x4d1070
lea ebx, [ebp - 0x1e]
push ebp
xor edx, edx
mov dl, byte [ebp - 0x16]
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
call fcn.004bfa5c
pop ecx
mov byte [ebx], al
mov byte [ebp - 0xe], 7
mov eax, dword [ebp - 0x24]
lea esi, [eax + 1]
lea edi, [ebp - 0x15]
push ebp
xor edx, edx
mov dl, byte [edi]
xor eax, eax
mov al, byte [esi]
call fcn.004bfa5c
pop ecx
xor byte [ebx], al
inc edi
inc esi
dec byte [ebp - 0xe]
jne 0x4bfb13
inc ebx
add dword [ebp - 0x24], 8
dec byte [ebp - 0xd]
jne 0x4bfaf2
xor eax, eax
mov al, byte [ebp - 0x1e]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax + 4], edx
mov byte [ebp - 0xd], 7
lea eax, [ebp - 0x1d]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 4]
shl edx, 8
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx]
shr ecx, 0x18
or edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 4], edx
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
shl edx, 8
xor ecx, ecx
mov cl, byte [eax]
xor edx, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], edx
inc eax
dec byte [ebp - 0xd]
jne 0x4bfb4e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret