joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52dc30
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0x10]
shl ecx, 4
add ecx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x30], ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], edi
cmp eax, ecx
je 0x52ddfe
push ebx
push esi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [ebp - 0x20], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [eax + 0xc]
add ecx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x2c], ecx
cmp edx, ecx
jge 0x52dded
nop dword [eax]
mov edi, dword [edi]
mov eax, edx
mov ebx, dword [ebp - 8]
mov esi, dword [edi + 0xc]
mov ecx, dword [ebx + 4]
sub eax, dword [ebx + 0x10]
imul esi, edx
cdq
add esi, dword [edi]
mov dword [ebx + 0x14], esi
idiv dword [ecx + 0x18]
mov eax, dword [ebp - 0x1c]
imul edx, dword [ecx + 0xc]
mov dword [ebp - 0xc], eax
add edx, dword [ecx]
mov dword [ebx + 0x18], edx
mov eax, dword [edi + 0x10]
mov ecx, eax
imul ecx, dword [ebp - 0x20]
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
sub ebx, dword [edi + 0xc]
add ecx, esi
cmp dword [edi + 8], 0xfe
jge 0x52dda0
nop
mov esi, dword [edi + 4]
mov eax, ebx
cdq
inc ebx
mov dword [ebp - 0x28], ebx
idiv dword [esi + 0x14]
mov ebx, dword [esi + 0x10]
mov esi, 0x100
imul ebx, edx
add ebx, dword [edi + 0x18]
movzx edx, byte [ebx + 1]
or edx, 0xff0000
imul edx, dword [edi + 8]
movzx edi, byte [ebx + 2]
shl edi, 0x10
shr edx, 8
and edx, 0xff00ff
mov eax, edx
shr eax, 0x10
sub esi, eax
movzx eax, byte [ecx + 1]
imul eax, esi
shr eax, 8
add eax, edx
movzx edx, byte [ecx + 2]
mov dword [ebp - 0x24], eax
movzx eax, byte [ebx]
mov ebx, dword [ebp - 8]
or edi, eax
movzx eax, byte [ecx]
shl edx, 0x10
or edx, eax
imul edi, dword [ebx + 8]
mov ebx, dword [ebp - 0x24]
imul edx, esi
shr edi, 8
and edi, 0xff00ff
shr edx, 8
and edx, 0xff00ff
add edi, edx
mov edx, 0x100
mov eax, edi
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, ebx
shr eax, 8
or edx, edi
mov edi, dword [ebp - 8]
neg al
or al, bl
and edx, 0xff00ff
mov ebx, dword [ebp - 0x28]
mov byte [ecx + 1], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, dword [ebp - 0xc]
dec eax
mov byte [ecx], dl
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
test eax, eax
jg 0x52dcd0
jmp 0x52ddda
mov esi, dword [edi + 4]
mov eax, ebx
cdq
inc ebx
idiv dword [esi + 0x14]
mov esi, dword [esi + 0x10]
imul esi, edx
add esi, dword [edi + 0x18]
mov ax, word [esi]
mov dl, byte [esi + 2]
mov word [ebp - 4], ax
movzx eax, al
mov byte [ecx], al
movzx eax, byte [ebp - 3]
mov byte [ecx + 1], al
mov eax, dword [ebp - 0xc]
dec eax
mov byte [ecx + 2], dl
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
test eax, eax
jg 0x52dda0
mov edx, dword [ebp - 0x14]
inc edx
mov dword [ebp - 0x14], edx
cmp edx, dword [ebp - 0x2c]
jl 0x52dc80
mov eax, dword [ebp - 0x18]
add eax, 0x10
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x30]
jne 0x52dc58
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x532e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 8], eax
push edi
mov dword [ebp - 4], esi
cmp ebx, dword [esi + 0x6c]
jle 0x532e7b
mov dword [esi + 0x6c], ebx
push dword [esi + 0x68]
call fcn.00d9e0ad
add esp, 4
test ebx, ebx
jne 0x532e68
mov eax, dword [ebp - 8]
xor edi, edi
mov dword [esi + 0x68], edi
jmp 0x532e7e
push ebx
call fcn.00d9e0c8
mov edi, eax
add esp, 4
mov eax, dword [ebp - 8]
mov dword [esi + 0x68], edi
jmp 0x532e7e
mov edi, dword [esi + 0x68]
push ebx
push eax
push edi
mov ecx, esi
call fcn.00521a50
mov eax, dword [esi + 0x48]
mov eax, dword [eax + 0x10]
mov esi, eax
imul esi, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x50]
imul ecx, dword [ebp + 0x10]
add esi, dword [eax + 0x64]
mov dword [ebp - 4], esi
sar ecx, 8
mov dword [ebp - 0x10], ecx
cmp ecx, 0xfe
jge 0x532f90
nop dword [eax]
movzx eax, byte [edi]
mov edx, 0x100
inc edi
dec ebx
mov dword [ebp - 8], edi
mov edi, eax
shl edi, 0x10
or edi, eax
imul edi, ecx
mov ecx, 0x100
shr edi, 8
and edi, 0xff00ff
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [esi]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, dword [ebp - 4]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
mov edi, dword [ebp - 8]
xor edx, ecx
mov ecx, dword [ebp - 0x10]
mov dword [esi], edx
add esi, dword [ebp - 0xc]
mov dword [ebp - 4], esi
test ebx, ebx
jg 0x532ec0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
movzx eax, byte [edi]
mov ecx, 0x100
inc edi
mov edx, 0x100
mov dword [ebp - 8], edi
dec ebx
mov edi, eax
shl edi, 0x10
or edi, eax
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [esi]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, dword [ebp - 4]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
mov edi, dword [ebp - 8]
xor edx, ecx
mov dword [esi], edx
add esi, dword [ebp - 0xc]
mov dword [ebp - 4], esi
test ebx, ebx
jg 0x532f90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x533050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 8], eax
push edi
mov dword [ebp - 4], esi
cmp ebx, dword [esi + 0x6c]
jle 0x53309b
mov dword [esi + 0x6c], ebx
push dword [esi + 0x68]
call fcn.00d9e0ad
add esp, 4
test ebx, ebx
jne 0x533088
mov eax, dword [ebp - 8]
xor edi, edi
mov dword [esi + 0x68], edi
jmp 0x53309e
push ebx
call fcn.00d9e0c8
mov edi, eax
add esp, 4
mov eax, dword [ebp - 8]
mov dword [esi + 0x68], edi
jmp 0x53309e
mov edi, dword [esi + 0x68]
push ebx
push eax
push edi
mov ecx, esi
call fcn.00536cc0
mov eax, dword [esi + 0x48]
mov eax, dword [eax + 0x10]
mov esi, eax
imul esi, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x50]
imul ecx, dword [ebp + 0x10]
add esi, dword [eax + 0x64]
mov dword [ebp - 4], esi
sar ecx, 8
mov dword [ebp - 0x10], ecx
cmp ecx, 0xfe
jge 0x5331b0
nop dword [eax]
movzx eax, byte [edi]
mov edx, 0x100
inc edi
dec ebx
mov dword [ebp - 8], edi
mov edi, eax
shl edi, 0x10
or edi, eax
imul edi, ecx
mov ecx, 0x100
shr edi, 8
and edi, 0xff00ff
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [esi]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, dword [ebp - 4]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
mov edi, dword [ebp - 8]
xor edx, ecx
mov ecx, dword [ebp - 0x10]
mov dword [esi], edx
add esi, dword [ebp - 0xc]
mov dword [ebp - 4], esi
test ebx, ebx
jg 0x5330e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
movzx eax, byte [edi]
mov ecx, 0x100
inc edi
mov edx, 0x100
mov dword [ebp - 8], edi
dec ebx
mov edi, eax
shl edi, 0x10
or edi, eax
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [esi]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, dword [ebp - 4]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
mov edi, dword [ebp - 8]
xor edx, ecx
mov dword [esi], edx
add esi, dword [ebp - 0xc]
mov dword [ebp - 4], esi
test ebx, ebx
jg 0x5331b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x533270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edi
cmp esi, dword [edi + 0x6c]
jle 0x5332be
mov dword [edi + 0x6c], esi
push dword [edi + 0x68]
call fcn.00d9e0ad
lea eax, [esi + esi*2]
add esp, 4
test eax, eax
jne 0x5332ab
mov eax, dword [ebp - 4]
xor ebx, ebx
mov dword [edi + 0x68], ebx
jmp 0x5332c1
push eax
call fcn.00d9e0c8
mov ebx, eax
add esp, 4
mov eax, dword [ebp - 4]
mov dword [edi + 0x68], ebx
jmp 0x5332c1
mov ebx, dword [edi + 0x68]
push esi
push eax
push ebx
mov ecx, edi
call fcn.00536f60
mov eax, dword [edi + 0x48]
mov eax, dword [eax + 0x10]
mov edi, eax
imul edi, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x50]
imul edx, dword [ebp + 0x10]
add edi, dword [eax + 0x64]
mov dword [ebp - 0xc], edi
sar edx, 8
mov dword [ebp - 8], edx
cmp edx, 0xfe
jge 0x5333e8
nop dword [eax]
mov edi, dword [edi]
mov ecx, ebx
add ebx, 3
dec esi
mov dword [ebp - 0x14], ebx
movzx eax, byte [ecx + 1]
movzx ebx, byte [ecx + 2]
or eax, 0xff0000
imul eax, edx
mov edx, 0x100
shl ebx, 0x10
shr eax, 8
and eax, 0xff00ff
mov dword [ebp - 4], eax
shr eax, 0x10
sub edx, eax
movzx eax, byte [ecx]
or ebx, eax
mov eax, edi
imul ebx, dword [ebp - 8]
and eax, 0xff00ff
imul eax, edx
shr edi, 8
and edi, 0xff00ff
imul edi, edx
mov edx, 0x100
shr ebx, 8
shr eax, 8
and ebx, 0xff00ff
and eax, 0xff00ff
add ebx, eax
shr edi, 8
mov ecx, ebx
and edi, 0xff00ff
shr ecx, 8
add dword [ebp - 4], edi
and ecx, 0xff00ff
mov edi, dword [ebp - 4]
mov eax, edi
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, edi
shl eax, 8
shl edx, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, ebx
mov ebx, dword [ebp - 0x14]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
mov edi, dword [ebp - 0xc]
xor edx, ecx
mov dword [edi], edx
add edi, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edi
test esi, esi
jg 0x533300
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, ebx
dec esi
add ebx, 3
mov ax, word [ecx]
movzx ecx, byte [ecx + 2]
or ecx, 0xffffff00
mov word [ebp - 4], ax
movzx eax, byte [ebp - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 4]
shl ecx, 8
or ecx, eax
mov dword [edi], ecx
add edi, dword [ebp - 0x10]
test esi, esi
jg 0x5333e8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x533430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edi
cmp esi, dword [edi + 0x6c]
jle 0x53347e
mov dword [edi + 0x6c], esi
push dword [edi + 0x68]
call fcn.00d9e0ad
lea eax, [esi + esi*2]
add esp, 4
test eax, eax
jne 0x53346b
mov eax, dword [ebp - 4]
xor ebx, ebx
mov dword [edi + 0x68], ebx
jmp 0x533481
push eax
call fcn.00d9e0c8
mov ebx, eax
add esp, 4
mov eax, dword [ebp - 4]
mov dword [edi + 0x68], ebx
jmp 0x533481
mov ebx, dword [edi + 0x68]
push esi
push eax
push ebx
mov ecx, edi
call fcn.005373e0
mov eax, dword [edi + 0x48]
mov eax, dword [eax + 0x10]
mov edi, eax
imul edi, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x50]
imul edx, dword [ebp + 0x10]
add edi, dword [eax + 0x64]
mov dword [ebp - 0xc], edi
sar edx, 8
mov dword [ebp - 8], edx
cmp edx, 0xfe
jge 0x5335a8
nop dword [eax]
mov edi, dword [edi]
mov ecx, ebx
add ebx, 3
dec esi
mov dword [ebp - 0x14], ebx
movzx eax, byte [ecx + 1]
movzx ebx, byte [ecx + 2]
or eax, 0xff0000
imul eax, edx
mov edx, 0x100
shl ebx, 0x10
shr eax, 8
and eax, 0xff00ff
mov dword [ebp - 4], eax
shr eax, 0x10
sub edx, eax
movzx eax, byte [ecx]
or ebx, eax
mov eax, edi
imul ebx, dword [ebp - 8]
and eax, 0xff00ff
imul eax, edx
shr edi, 8
and edi, 0xff00ff
imul edi, edx
mov edx, 0x100
shr ebx, 8
shr eax, 8
and ebx, 0xff00ff
and eax, 0xff00ff
add ebx, eax
shr edi, 8
mov ecx, ebx
and edi, 0xff00ff
shr ecx, 8
add dword [ebp - 4], edi
and ecx, 0xff00ff
mov edi, dword [ebp - 4]
mov eax, edi
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, edi
shl eax, 8
shl edx, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, ebx
mov ebx, dword [ebp - 0x14]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
shl ecx, 8
or ecx, edi
mov edi, dword [ebp - 0xc]
xor edx, ecx
mov dword [edi], edx
add edi, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], edi
test esi, esi
jg 0x5334c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, ebx
dec esi
add ebx, 3
mov ax, word [ecx]
movzx ecx, byte [ecx + 2]
or ecx, 0xffffff00
mov word [ebp - 4], ax
movzx eax, byte [ebp - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [ebp - 4]
shl ecx, 8
or ecx, eax
mov dword [edi], ecx
add edi, dword [ebp - 0x10]
test esi, esi
jg 0x5335a8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5335f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], eax
cmp ebx, dword [edi + 0x6c]
jle 0x53363f
mov dword [edi + 0x6c], ebx
push dword [edi + 0x68]
call fcn.00d9e0ad
lea eax, [ebx*4]
add esp, 4
test eax, eax
jne 0x53362c
mov eax, dword [ebp - 4]
xor esi, esi
mov dword [edi + 0x68], esi
jmp 0x533642
push eax
call fcn.00d9e0c8
mov esi, eax
add esp, 4
mov eax, dword [ebp - 4]
mov dword [edi + 0x68], esi
jmp 0x533642
mov esi, dword [edi + 0x68]
push ebx
push eax
push esi
mov ecx, edi
call fcn.00537720
mov eax, dword [edi + 0x48]
mov ecx, dword [edi + 0x50]
imul ecx, dword [ebp + 0x10]
mov eax, dword [eax + 0x10]
mov ebx, eax
imul ebx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
sar ecx, 8
mov dword [ebp - 8], ecx
add ebx, dword [edi + 0x64]
cmp ecx, 0xfe
jge 0x533757
mov edx, dword [esi]
mov edi, edx
shr edi, 8
add esi, 4
and edi, 0xff00ff
mov dword [ebp - 4], esi
imul edi, ecx
and edx, 0xff00ff
imul edx, dword [ebp - 8]
mov ecx, 0x100
shr edi, 8
and edi, 0xff00ff
shr edx, 8
mov eax, edi
and edx, 0xff00ff
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
add edi, eax
and esi, 0xff00ff
add esi, edx
mov eax, edi
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
mov ecx, esi
sub edx, eax
shr ecx, 8
shl edx, 8
mov eax, edi
shl eax, 8
and ecx, 0xff00ff
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, dword [ebp - 4]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
dec eax
or ecx, edi
mov dword [ebp + 0xc], eax
xor edx, ecx
mov ecx, dword [ebp - 8]
mov dword [ebx], edx
add ebx, dword [ebp - 0xc]
test eax, eax
jg 0x533677
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [esi]
mov ecx, 0x100
mov edi, edx
add esi, 4
shr edi, 8
and edx, 0xff00ff
and edi, 0xff00ff
mov dword [ebp - 4], esi
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
add edi, eax
and esi, 0xff00ff
add esi, edx
mov eax, edi
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
mov ecx, esi
sub edx, eax
shr ecx, 8
shl edx, 8
mov eax, edi
shl eax, 8
and ecx, 0xff00ff
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, dword [ebp - 4]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
dec eax
or ecx, edi
mov dword [ebp + 0xc], eax
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [ebp - 0xc]
test eax, eax
jg 0x533757
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x534910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], esi
mov eax, dword [esi]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 0x10]
mov ebx, eax
imul ebx, edi
sub edi, dword [esi + 0xc]
mov dword [ebp - 4], eax
add ebx, dword [esi + 0x14]
cmp dword [esi + 8], 0xfe
jge 0x534a28
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
nop word [eax + eax]
mov eax, dword [esi + 4]
mov edx, edi
inc edi
mov dword [ebp + 8], edi
mov ecx, dword [eax + 0x10]
mov eax, dword [esi + 0x18]
imul ecx, edx
mov edx, 0x100
movzx eax, byte [ecx + eax]
mov ecx, 0x100
mov edi, eax
shl edi, 0x10
or edi, eax
imul edi, dword [esi + 8]
shr edi, 8
and edi, 0xff00ff
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, dword [ebp - 8]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
dec eax
or ecx, edi
mov dword [ebp + 0xc], eax
mov edi, dword [ebp + 8]
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [ebp - 4]
test eax, eax
jg 0x534950
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 4]
mov edx, dword [ebp + 0xc]
mov dword [ebp + 0xc], edx
mov ecx, dword [eax + 0x10]
mov eax, ecx
imul eax, edi
mov dword [ebp - 0x10], ecx
add eax, dword [esi + 0x18]
mov dword [ebp + 8], eax
cmp dword [ebp - 4], ecx
jne 0x534a70
mov esi, dword [esi + 4]
cmp dword [esi + 8], 1
jne 0x534a70
mov esi, dword [ebp - 0xc]
cmp dword [esi + 8], 1
jne 0x534a70
imul ecx, edx
push ecx
push eax
push ebx
call fcn.00d9a680
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, byte [eax]
mov ecx, 0x100
mov edi, eax
mov edx, 0x100
shl edi, 0x10
or edi, eax
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
shl ecx, 8
or ecx, edi
mov dword [ebp + 8], eax
xor edx, ecx
mov ecx, dword [ebp + 0xc]
dec ecx
mov dword [ebx], edx
add ebx, dword [ebp - 4]
mov dword [ebp + 0xc], ecx
test ecx, ecx
jg 0x534a70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x534b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], esi
mov eax, dword [esi]
mov dword [ebp - 0xc], eax
mov eax, dword [eax + 0x10]
mov ebx, eax
mov dword [ebp - 4], eax
mov eax, dword [esi + 8]
imul eax, dword [ebp + 0x10]
imul ebx, edi
sub edi, dword [esi + 0xc]
sar eax, 8
add ebx, dword [esi + 0x14]
mov dword [ebp + 0x10], eax
cmp eax, 0xfe
jge 0x534c4d
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 4]
mov edx, edi
inc edi
mov dword [ebp + 8], edi
mov ecx, dword [eax + 0x10]
mov eax, dword [esi + 0x18]
imul ecx, edx
mov edx, 0x100
movzx eax, byte [ecx + eax]
mov ecx, 0x100
mov edi, eax
shl edi, 0x10
or edi, eax
imul edi, dword [ebp + 0x10]
shr edi, 8
and edi, 0xff00ff
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
mov esi, dword [ebp - 8]
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 0xc]
shl ecx, 8
dec eax
or ecx, edi
mov dword [ebp + 0xc], eax
mov edi, dword [ebp + 8]
xor edx, ecx
mov dword [ebx], edx
add ebx, dword [ebp - 4]
test eax, eax
jg 0x534b75
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi + 4]
mov edx, dword [ebp + 0xc]
mov dword [ebp + 0xc], edx
mov ecx, dword [eax + 0x10]
mov eax, ecx
imul eax, edi
mov dword [ebp - 8], ecx
add eax, dword [esi + 0x18]
mov dword [ebp + 8], eax
cmp dword [ebp - 4], ecx
jne 0x534c95
mov esi, dword [esi + 4]
cmp dword [esi + 8], 1
jne 0x534c95
mov esi, dword [ebp - 0xc]
cmp dword [esi + 8], 1
jne 0x534c95
imul ecx, edx
push ecx
push eax
push ebx
call fcn.00d9a680
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
movzx eax, byte [eax]
mov ecx, 0x100
mov edi, eax
mov edx, 0x100
shl edi, 0x10
or edi, eax
mov eax, edi
shr eax, 0x10
sub ecx, eax
mov eax, dword [ebx]
mov esi, eax
shr eax, 8
and eax, 0xff00ff
and esi, 0xff00ff
imul eax, ecx
imul esi, ecx
shr eax, 8
and eax, 0xff00ff
shr esi, 8
and esi, 0xff00ff
add esi, edi
add edi, eax
mov eax, edi
mov ecx, esi
shr eax, 8
and eax, 0xff00ff
shr ecx, 8
sub edx, eax
and ecx, 0xff00ff
shl edx, 8
mov eax, edi
shl eax, 8
or edx, eax
mov eax, 0x100
sub eax, ecx
mov ecx, 0x100
or eax, esi
xor edx, eax
mov eax, edi
shr eax, 8
and edx, 0xff00ff
and eax, 0xff00ff
shl edi, 8
sub ecx, eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
shl ecx, 8
or ecx, edi
mov dword [ebp + 8], eax
xor edx, ecx
mov ecx, dword [ebp + 0xc]
dec ecx
mov dword [ebx], edx
add ebx, dword [ebp - 4]
mov dword [ebp + 0xc], ecx
test ecx, ecx
jg 0x534c95
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc