joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ab2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov al, byte [ecx + 0x10]
mov dword [ebp - 8], ecx
mov byte [ebp - 1], al
test al, al
je 0x4ab45d
mov eax, dword [ecx + 4]
add ecx, 8
push ebx
push esi
push edi
mov edx, dword [eax + 0x1c]
imul edx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
add edx, dword [eax + 0x10]
mov eax, ecx
lea ebx, [edx + edi*2]
xor edi, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
add edx, 0xa
and edi, 1
cmove eax, edx
test edi, edi
cmove edx, ecx
movzx eax, word [eax]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x14]
movzx ecx, word [edx]
lea esi, [eax - 1]
mov al, byte [ebp - 1]
mov dword [ebp - 0xc], esi
cmp al, 0x10
jne 0x4ab3e4
test esi, esi
js 0x4ab45a
mov eax, dword [ebp + 0xc]
mov esi, ecx
mov ecx, dword [ebp + 0x10]
movzx edi, ax
movzx edx, di
mov eax, ecx
mov dword [ebp - 0x10], edx
movzx edx, si
mov dword [ebp + 8], eax
mov dword [ebp + 0x14], edx
mov dword [ebp + 0xc], ebx
test ecx, ecx
jle 0x4ab3c0
test bl, 2
je 0x4ab38d
lea eax, [ebx + 2]
movzx edx, di
mov dword [ebp + 0xc], eax
lea eax, [ecx - 1]
mov word [ebx], si
mov dword [ebp + 8], eax
mov dword [ebp + 0x14], edx
movzx ecx, si
jmp 0x4ab390
mov ecx, dword [ebp - 0x10]
sar eax, 1
push eax
movzx ecx, cx
shl ecx, 0x10
movzx eax, dx
or ecx, eax
push ecx
push dword [ebp + 0xc]
call dword [0x53fa04]
mov eax, dword [ebp + 8]
add esp, 0xc
test al, 1
je 0x4ab3bd
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
mov word [edx + eax*2 - 2], cx
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
add ebx, dword [eax + 0x1c]
sub dword [ebp - 0xc], 1
movzx eax, si
movzx esi, di
mov edi, eax
jns 0x4ab356
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
movzx eax, al
mov edx, 0x10
sub edx, eax
mov eax, ecx
and ecx, 0xfffff0f0
mov dword [ebp + 8], edx
and eax, 0xf0f
shl ecx, 0xc
or ecx, eax
mov eax, dword [ebp + 0xc]
mov edi, ecx
movzx eax, ax
shl edi, 4
or edi, ecx
mov ecx, eax
and ecx, 0xfffff0f0
and eax, 0xf0f
shl ecx, 0xc
or ecx, eax
mov eax, ecx
shl eax, 4
or eax, ecx
mov dword [ebp + 0xc], eax
test esi, esi
js 0x4ab45a
push dword [ebp + 0x10]
mov ecx, ebx
push edx
push eax
mov edx, edi
call fcn.004aafe0
mov eax, dword [ebp - 8]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [eax + 4]
add ebx, dword [eax + 0x1c]
sub esi, 1
mov eax, edi
mov edi, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
jns 0x4ab430
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4ac440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
mov al, byte [esi + 0x10]
test al, al
je 0x4ac589
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x18], 0
jne 0x4ac4a4
movzx edx, word [esi + 8]
mov esi, dword [esi + 4]
cmp al, 0x10
jne 0x4ac481
push edx
push dword [ebp + 0xc]
mov edx, edi
mov ecx, esi
call fcn.004ab6d0
add esp, 8
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
movzx eax, al
mov ecx, 0x10
sub ecx, eax
push ecx
push edx
push dword [ebp + 0xc]
mov edx, edi
mov ecx, esi
call fcn.004ab9a0
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
push ebx
mov edx, dword [eax]
mov ecx, dword [eax + 8]
mov ebx, dword [eax + 4]
sub ecx, edx
mov eax, dword [eax + 0xc]
sub eax, ebx
mov dword [ebp - 0x10], ecx
mov ecx, dword [esi + 4]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 0x1c]
mov dword [ebp + 0xc], eax
imul eax, ebx
sub ebx, dword [edi + 8]
add eax, dword [ecx + 0x10]
mov ecx, dword [edi + 0x14]
imul ebx, ecx
mov dword [ebp + 8], ecx
lea eax, [eax + edx*2]
sub ebx, dword [edi + 4]
add ebx, dword [edi]
mov edi, dword [ebp - 0x10]
add ebx, edx
movzx edx, word [esi + 8]
sub dword [ebp + 8], edi
lea ecx, [edi + edi]
sub dword [ebp + 0xc], ecx
mov ecx, edx
and edx, 0xfffff0f0
mov esi, ecx
and esi, 0xf
shl edx, 0xc
and ecx, 0xf0f
mov dword [ebp - 0xc], esi
or edx, ecx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], edi
movzx edi, byte [ebx]
mov ecx, esi
mov edx, 0xf
inc ebx
lea edi, [edi + 1]
shr edi, 4
imul ecx, edi
shr ecx, 4
sub edx, ecx
movzx ecx, word [eax]
mov esi, ecx
and ecx, 0xf0f
and esi, 0xfffff0f0
shl esi, 0xc
or esi, ecx
mov ecx, edx
shr ecx, 3
add ecx, edx
imul esi, ecx
mov ecx, dword [ebp - 0x14]
imul ecx, edi
add esi, ecx
shr esi, 4
mov ecx, esi
shr ecx, 0xc
xor ecx, esi
shr esi, 0xc
and ecx, 0xf0f
xor ecx, esi
mov esi, dword [ebp - 0xc]
mov word [eax], cx
add eax, 2
sub dword [ebp - 4], 1
jne 0x4ac513
add eax, dword [ebp + 0xc]
add ebx, dword [ebp + 8]
sub dword [ebp - 8], 1
mov edi, dword [ebp - 0x10]
jne 0x4ac510
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4ac820
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
sar dword [ebp + 8], 3
mov eax, ecx
push ebx
mov ebx, dword [ebp + 0xc]
sub eax, edx
push esi
push edi
mov dword [ebp - 4], eax
movzx ecx, word [eax + edx]
lea edx, [edx + 2]
movzx eax, word [edx - 2]
mov edi, ecx
mov esi, eax
and edi, 0x7e0
shl edi, 0x10
and esi, 0x7e0
or edi, ecx
shl esi, 0x10
or esi, eax
and edi, 0xfffff81f
and esi, 0xfffff81f
dec ebx
sub edi, esi
imul edi, dword [ebp + 8]
shr edi, 5
add edi, esi
mov eax, edi
shr eax, 0x10
xor eax, edi
and eax, 0x7e0
xor eax, edi
mov word [edx - 2], ax
mov eax, dword [ebp - 4]
test ebx, ebx
jg 0x4ac835
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4acc40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ecx + 4]
cmp dword [ebx + 0x18], 0
jne 0x4acc6b
push dword [ebp + 0xc]
mov edx, ebx
mov ecx, edi
call fcn.004ac930
add esp, 4
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edx, dword [ebp + 0xc]
mov eax, dword [edi + 0x1c]
mov dword [ebp + 8], eax
push esi
mov esi, dword [edx + 4]
mov eax, esi
imul eax, dword [ebp + 8]
mov ecx, dword [edx]
lea eax, [eax + ecx*2]
add eax, dword [edi + 0x10]
mov edi, dword [ebx + 0x14]
mov dword [ebp + 0xc], edi
mov edi, esi
sub edi, dword [ebx + 8]
imul edi, dword [ebp + 0xc]
sub edi, dword [ebx + 4]
add edi, dword [ebx]
mov ebx, dword [edx + 8]
add edi, ecx
sub ebx, ecx
mov ecx, dword [edx + 0xc]
sub ecx, esi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
lea ecx, [ebx + ebx]
sub dword [ebp + 8], ecx
sub dword [ebp + 0xc], ebx
movzx ecx, word [eax]
movzx edx, byte [edi]
mov esi, ecx
and esi, 0x7e0
inc edi
shl esi, 0x10
or esi, ecx
mov ecx, 0x100
sub ecx, edx
and esi, 0xfffff81f
shr ecx, 3
imul esi, ecx
shr esi, 5
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
and ecx, 0x7e0
xor ecx, esi
mov word [eax], cx
add eax, 2
sub ebx, 1
jne 0x4accb5
add eax, dword [ebp + 8]
add edi, dword [ebp + 0xc]
sub dword [ebp - 4], 1
mov ebx, dword [ebp - 8]
jne 0x4accb5
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4acd20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov ecx, dword [eax + 0x1c]
imul ecx, dword [ebp + 0xc]
movsx edx, word [ebx]
add ecx, dword [eax + 0x10]
mov eax, dword [ebp + 8]
lea esi, [ecx + eax*2]
test edx, edx
jle 0x4acd78
push edi
mov ecx, dword [ebp + 0x10]
lea ebx, [ebx + edx*2]
lea edi, [edx + edx]
movzx eax, byte [ecx]
add ecx, edx
mov dword [ebp + 0x10], ecx
test eax, eax
je 0x4acd6e
cmp eax, 0xff
jne 0x4acd7e
lea eax, [edx + edx]
push eax
push 0
push esi
call fcn.004d43f0
add esp, 0xc
add esi, edi
movsx edx, word [ebx]
test edx, edx
jg 0x4acd43
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
mov edi, 0x100
sub edi, eax
shr edi, 3
nop dword [eax + eax]
movzx eax, word [esi]
mov ecx, eax
and ecx, 0x7e0
shl ecx, 0x10
or ecx, eax
and ecx, 0xfffff81f
imul ecx, edi
shr ecx, 5
mov eax, ecx
shr eax, 0x10
xor eax, ecx
and eax, 0x7e0
xor eax, ecx
mov word [esi], ax
add esi, 2
sub edx, 1
jne 0x4acd90
jmp 0x4acd70
Function at 0x4ace40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ecx + 4]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [eax + 0x1c]
imul edx, esi
push edi
mov edi, dword [ebp + 0x14]
add edx, dword [eax + 0x10]
mov eax, dword [ebp + 8]
movsx edi, word [edi]
mov dword [ebp - 0xc], edi
lea ebx, [edx + eax*2]
mov edx, dword [ecx + 0xc]
movzx eax, word [ecx + 0x16]
mov dword [ebp - 0x14], edx
mov dl, byte [ecx + 0x1a]
movzx ecx, word [ecx + 0x18]
test dl, dl
mov byte [ebp + 0xf], dl
mov edx, 0
setne dl
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], edx
mov edx, dword [ebp + 8]
xor edx, esi
mov dword [ebp - 4], ecx
and edx, dword [ebp - 0x10]
test edi, edi
jle 0x4acf91
movzx ecx, cx
test edx, edx
movzx eax, ax
cmove ecx, eax
mov eax, dword [ebp - 8]
movzx esi, cx
movzx ecx, ax
mov eax, dword [ebp - 4]
movzx eax, ax
cmove ecx, eax
mov dword [ebp + 8], esi
movzx ecx, cx
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x10]
lea eax, [edi + edi]
add dword [ebp + 0x14], eax
movzx eax, byte [edx]
add edx, edi
mov dword [ebp + 0x10], edx
test eax, eax
je 0x4acf4a
cmp eax, 0xff
jne 0x4acfa8
cmp byte [ebp + 0xf], 0
je 0x4acf9a
movzx ecx, cx
mov eax, edi
mov dword [ebp - 8], eax
mov edx, ebx
movzx esi, si
mov dword [ebp - 0xc], edx
test edi, edi
jle 0x4acf4a
test bl, 2
je 0x4acf22
mov ecx, dword [ebp + 8]
lea edx, [ebx + 2]
mov esi, dword [ebp - 4]
lea eax, [edi - 1]
mov word [ebx], cx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
movzx esi, si
movzx ecx, cx
sar eax, 1
push eax
movzx ecx, cx
shl ecx, 0x10
movzx eax, si
or ecx, eax
push ecx
push edx
call dword [0x53fa04]
mov eax, dword [ebp - 8]
add esp, 0xc
test al, 1
je 0x4acf4a
mov ecx, dword [ebp - 0xc]
mov word [ecx + eax*2 - 2], si
lea ebx, [ebx + edi*2]
mov eax, dword [ebp + 8]
mov esi, edi
and esi, dword [ebp - 0x10]
mov edi, dword [ebp + 0x14]
movzx ecx, ax
mov eax, dword [ebp - 4]
movzx eax, ax
movsx edi, word [edi]
cmove ecx, eax
mov eax, dword [ebp - 4]
test esi, esi
movzx edx, cx
movzx ecx, ax
mov eax, dword [ebp + 8]
movzx eax, ax
cmove ecx, eax
mov dword [ebp - 0xc], edi
movzx esi, cx
mov ecx, edx
mov dword [ebp + 8], esi
mov dword [ebp - 4], ecx
test edi, edi
jg 0x4acec4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push edi
push esi
push ebx
call dword [0x53fa08]
add esp, 0xc
jmp 0x4acf4a
inc eax
mov ecx, 0x20
shr eax, 3
mov edx, edi
mov esi, eax
imul esi, dword [ebp - 0x14]
sub ecx, eax
mov dword [ebp - 8], ecx
mov edi, ecx
movzx eax, word [ebx]
mov ecx, eax
and ecx, 0x7e0
shl ecx, 0x10
or ecx, eax
and ecx, 0xfffff81f
imul ecx, edi
add ecx, esi
shr ecx, 5
mov eax, ecx
shr eax, 0x10
xor eax, ecx
and eax, 0x7e0
xor eax, ecx
mov word [ebx], ax
add ebx, 2
sub edx, 1
jne 0x4acfc0
mov edi, dword [ebp - 0xc]
jmp 0x4acf4d
Function at 0x4ad000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
cmp dword [edx + 0x18], 0
jne 0x4ad02b
movzx eax, word [ecx + 0x14]
mov ecx, dword [ecx + 4]
push eax
push dword [ebp + 0xc]
call fcn.004ab6d0
add esp, 8
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ecx + 4]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ecx + 0x1c]
push edi
mov dword [ebp - 4], ebx
mov edi, dword [esi + 4]
mov eax, edi
mov edx, dword [esi]
imul eax, ebx
lea eax, [eax + edx*2]
add eax, dword [ecx + 0x10]
mov ecx, dword [ebp + 8]
mov ebx, dword [ecx + 0x14]
mov dword [ebp + 0xc], ebx
mov ebx, edi
sub ebx, dword [ecx + 8]
imul ebx, dword [ebp + 0xc]
sub ebx, dword [ecx + 4]
add ebx, dword [ecx]
mov ecx, dword [esi + 8]
add ebx, edx
sub ecx, edx
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov ecx, dword [esi + 0xc]
sub ecx, edi
mov dword [ebp + 8], ecx
lea ecx, [edx + edx]
sub dword [ebp - 4], ecx
mov ecx, dword [ebp - 0xc]
sub dword [ebp + 0xc], edx
mov ecx, dword [ecx + 0xc]
mov dword [ebp - 0xc], ecx
mov edi, edx
nop word [eax + eax]
movzx ecx, word [eax]
movzx esi, byte [ebx]
mov edx, ecx
and edx, 0x7e0
inc esi
shl edx, 0x10
inc ebx
or edx, ecx
shr esi, 3
mov ecx, dword [ebp - 0xc]
and edx, 0xfffff81f
sub ecx, edx
imul esi, ecx
shr esi, 5
add esi, edx
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
and ecx, 0x7e0
xor ecx, esi
mov word [eax], cx
add eax, 2
sub edi, 1
jne 0x4ad090
add eax, dword [ebp - 4]
add ebx, dword [ebp + 0xc]
sub dword [ebp + 8], 1
mov edx, dword [ebp - 8]
jne 0x4ad088
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4ad0f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, 0x20
push edi
mov eax, dword [esi + 4]
mov edi, dword [esi + 0xc]
mov esi, dword [ebp + 0x10]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 4], ecx
imul ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x10]
mov eax, dword [ebp + 8]
lea eax, [ecx + eax*2]
movzx ecx, byte [ebp + 0x14]
inc ecx
shr ecx, 3
imul edi, ecx
sub ebx, ecx
nop word [eax + eax]
movzx ecx, word [eax]
mov edx, ecx
and edx, 0x7e0
shl edx, 0x10
or edx, ecx
and edx, 0xfffff81f
imul edx, ebx
add edx, edi
shr edx, 5
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
and ecx, 0x7e0
xor ecx, edx
mov word [eax], cx
add eax, dword [ebp - 4]
sub esi, 1
jne 0x4ad130
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4ad180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ecx + 4]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [eax + 0x1c]
dec esi
mov edx, edi
mov dword [ebp - 8], ecx
imul edx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edi
add edx, dword [eax + 0x10]
mov eax, dword [ebp + 8]
lea ebx, [edx + eax*2]
movzx eax, word [ecx + 0x14]
movzx ecx, ax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
cmp byte [eax + 0x1a], 0
je 0x4ad288
mov edx, dword [ebp + 8]
xor edx, dword [ebp + 0xc]
movzx eax, word [eax + 0x18]
and edx, 1
mov dword [ebp + 0x14], eax
test esi, esi
js 0x4ad2a8
movzx ecx, ax
test edx, edx
mov eax, dword [ebp - 4]
movzx eax, ax
cmove ecx, eax
mov eax, dword [ebp - 4]
movzx edi, cx
movzx ecx, ax
mov eax, dword [ebp + 0x14]
movzx eax, ax
cmove ecx, eax
movzx ecx, cx
mov dword [ebp + 0xc], ecx
mov eax, dword [ebp + 0x10]
movzx edx, cx
mov dword [ebp - 8], edx
movzx edx, di
mov dword [ebp + 0x14], eax
mov dword [ebp - 4], edx
mov dword [ebp + 8], ebx
test eax, eax
jle 0x4ad26c
test bl, 2
je 0x4ad239
lea eax, [ebx + 2]
movzx edx, cx
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x10]
dec eax
mov word [ebx], di
mov dword [ebp + 0x14], eax
mov dword [ebp - 4], edx
movzx ecx, di
jmp 0x4ad23c
mov ecx, dword [ebp - 8]
sar eax, 1
push eax
movzx ecx, cx
shl ecx, 0x10
movzx eax, dx
or ecx, eax
push ecx
push dword [ebp + 8]
call dword [0x53fa04]
mov eax, dword [ebp + 0x14]
add esp, 0xc
test al, 1
je 0x4ad269
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov word [edx + eax*2 - 2], cx
mov ecx, dword [ebp + 0xc]
add ebx, dword [ebp - 0xc]
sub esi, 1
movzx eax, cx
movzx ecx, di
mov edi, eax
mov dword [ebp + 0xc], ecx
jns 0x4ad200
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
test esi, esi
js 0x4ad2a8
nop dword [eax]
push dword [ebp + 0x10]
push ecx
push ebx
call dword [0x53fa08]
mov ecx, dword [ebp - 0x10]
add esp, 0xc
add ebx, edi
sub esi, 1
jns 0x4ad290
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4ad420
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
movzx eax, cl
and esi, 0xffffff00
mov ebx, 0x100
shl esi, 0xe
or esi, eax
mov eax, ecx
shr eax, 3
shr ecx, 0x18
and eax, 0x1fe000
shl esi, 2
sub ebx, ecx
push edi
mov edi, dword [ebp + 8]
or esi, eax
shr ebx, 3
movzx eax, word [edx]
lea edx, [edx + 2]
mov ecx, eax
and ecx, 0x7e0
shl ecx, 0x10
or ecx, eax
and ecx, 0xfffff81f
imul ecx, ebx
add ecx, esi
shr ecx, 5
mov eax, ecx
shr eax, 0x10
xor eax, ecx
and eax, 0x7e0
xor eax, ecx
mov word [edx - 2], ax
sub edi, 1
jne 0x4ad455
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4ad4d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
push esi
push edi
mov edi, dword [ecx + 0x10]
mov edx, dword [eax + 0x1c]
imul edx, dword [ebp + 0xc]
add edx, dword [eax + 0x10]
mov eax, dword [ebp + 8]
mov dword [ebp + 8], edi
lea eax, [edx + eax*2]
mov edx, dword [ecx + 0xc]
mov dword [ebp + 0xc], edx
mov edx, dword [ebp + 0x14]
movsx esi, word [edx]
test esi, esi
jle 0x4ad57d
push ebx
mov ebx, dword [ebp + 0x10]
lea edx, [edx + esi*2]
mov dword [ebp + 0x14], edx
lea ecx, [esi + esi]
movzx edx, byte [ebx]
add ebx, esi
mov dword [ebp + 0x10], ebx
test edx, edx
je 0x4ad570
lea ecx, [edx + 1]
mov ebx, 0x20
imul ecx, edi
shr ecx, 0xb
mov edi, ecx
imul edi, dword [ebp + 0xc]
sub ebx, ecx
nop dword [eax]
movzx ecx, word [eax]
mov edx, ecx
and edx, 0x7e0
shl edx, 0x10
or edx, ecx
and edx, 0xfffff81f
imul edx, ebx
add edx, edi
shr edx, 5
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
and ecx, 0x7e0
xor ecx, edx
mov word [eax], cx
add eax, 2
sub esi, 1
jne 0x4ad530
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
jmp 0x4ad572
add eax, ecx
mov edx, dword [ebp + 0x14]
movsx esi, word [edx]
test esi, esi
jg 0x4ad502
pop ebx
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x4ad940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp dword [edx + 0x18], 0
jne 0x4ad974
movzx eax, word [ecx + 0x14]
push eax
mov eax, 0x100
sub eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 4]
push eax
push dword [ebp + 0xc]
call fcn.004ad760
add esp, 0xc
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ecx + 4]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ecx + 0x1c]
push edi
mov dword [ebp - 4], ebx
mov edi, dword [esi + 4]
mov eax, edi
mov edx, dword [esi]
imul eax, ebx
lea eax, [eax + edx*2]
add eax, dword [ecx + 0x10]
mov ecx, dword [ebp + 8]
mov ebx, dword [ecx + 0x14]
mov dword [ebp + 0xc], ebx
mov ebx, edi
sub ebx, dword [ecx + 8]
imul ebx, dword [ebp + 0xc]
sub ebx, dword [ecx + 4]
add ebx, dword [ecx]
mov ecx, dword [esi + 8]
add ebx, edx
sub ecx, edx
mov dword [ebp - 0xc], ecx
mov ecx, dword [esi + 0xc]
mov edx, dword [ebp - 0xc]
sub ecx, edi
mov esi, dword [ebp - 8]
mov dword [ebp + 8], ecx
lea ecx, [edx + edx]
sub dword [ebp - 4], ecx
mov ecx, dword [esi + 0xc]
mov esi, dword [esi + 0x10]
sub dword [ebp + 0xc], edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], esi
mov edi, edx
nop dword [eax]
movzx edx, byte [ebx]
inc ebx
movzx ecx, word [eax]
inc edx
imul edx, esi
mov esi, ecx
and esi, 0x7e0
shl esi, 0x10
or esi, ecx
mov ecx, 0x20
and esi, 0xfffff81f
shr edx, 0xb
sub ecx, edx
imul edx, dword [ebp - 0x10]
imul esi, ecx
add esi, edx
shr esi, 5
mov ecx, esi
shr ecx, 0x10
xor ecx, esi
and ecx, 0x7e0
xor ecx, esi
mov esi, dword [ebp - 8]
mov word [eax], cx
add eax, 2
sub edi, 1
jne 0x4ad9e0
add eax, dword [ebp - 4]
add ebx, dword [ebp + 0xc]
sub dword [ebp + 8], 1
mov edx, dword [ebp - 0xc]
jne 0x4ad9d7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4ada50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, 0x20
push edi
mov eax, dword [esi + 4]
mov edi, dword [esi + 0xc]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 4], ecx
imul ecx, dword [ebp + 0xc]
add ecx, dword [eax + 0x10]
mov eax, dword [ebp + 8]
lea eax, [ecx + eax*2]
movzx ecx, byte [ebp + 0x14]
inc ecx
imul ecx, dword [esi + 0x10]
mov esi, dword [ebp + 0x10]
shr ecx, 0xb
imul edi, ecx
sub ebx, ecx
nop dword [eax + eax]
movzx ecx, word [eax]
mov edx, ecx
and edx, 0x7e0
shl edx, 0x10
or edx, ecx
and edx, 0xfffff81f
imul edx, ebx
add edx, edi
shr edx, 5
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
and ecx, 0x7e0
xor ecx, edx
mov word [eax], cx
add eax, dword [ebp - 4]
sub esi, 1
jne 0x4ada90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4adae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ecx + 4]
mov ecx, dword [ecx + 8]
push ebx
mov edx, dword [eax + 0x1c]
mov dword [ebp - 4], edx
imul edx, dword [ebp + 0xc]
add edx, dword [eax + 0x10]
sub dword [ebp + 0x14], 1
mov eax, dword [ebp + 8]
lea ebx, [edx + eax*2]
mov dword [ebp + 0xc], ebx
js 0x4adb92
push esi
push edi
mov edi, ecx
movzx eax, cl
and edi, 0xffffff00
shl edi, 0xe
or edi, eax
mov eax, ecx
shr eax, 3
and eax, 0x1fe000
shl edi, 2
or edi, eax
shr ecx, 0x18
mov eax, 0x100
sub eax, ecx
shr eax, 3
mov dword [ebp + 8], eax
nop dword [eax]
mov esi, dword [ebp + 0x10]
mov eax, ebx
mov ebx, dword [ebp + 8]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov edx, ecx
and edx, 0x7e0
shl edx, 0x10
or edx, ecx
and edx, 0xfffff81f
imul edx, ebx
add edx, edi
shr edx, 5
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
and ecx, 0x7e0
xor ecx, edx
mov word [eax - 2], cx
sub esi, 1
jne 0x4adb48
mov ebx, dword [ebp + 0xc]
add ebx, dword [ebp - 4]
sub dword [ebp + 0x14], 1
mov dword [ebp + 0xc], ebx
jns 0x4adb40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4af3b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ecx + 4]
push ebx
push esi
mov esi, dword [ebp + 8]
mov edx, dword [eax + 0x1c]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
imul edx, edi
sub edi, dword [ecx + 0x10]
add edx, dword [eax + 0x10]
mov eax, dword [ecx + 8]
lea edx, [edx + esi*4]
sub esi, dword [ecx + 0xc]
mov ebx, dword [eax + 0x1c]
imul edi, ebx
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], ebx
lea ecx, [edi + esi*2]
add ecx, dword [eax + 0x10]
mov dword [ebp - 8], ecx
nop
mov eax, dword [ebp + 0x10]
mov dword [ebp + 8], eax
mov eax, edx
mov dword [ebp + 0xc], ecx
nop dword [eax + eax]
movzx edx, word [ecx]
lea eax, [eax + 4]
mov edi, dword [eax - 4]
mov esi, edx
and esi, 0xf
mov ecx, edx
shl esi, 0x14
and ecx, 0xf000
or esi, ecx
mov ecx, edx
shr ecx, 4
and edx, 0xf00
shl esi, 4
and ecx, 0xf
or esi, ecx
or esi, edx
mov edx, 0x100
mov ebx, esi
shl ebx, 4
or ebx, esi
mov esi, edi
mov ecx, ebx
and esi, 0xff00ff
shr ecx, 0x18
sub edx, ecx
mov ecx, edi
shr ecx, 8
imul esi, edx
and ecx, 0xffff00ff
imul ecx, edx
shr edi, 8
and edi, 0xff00ff
imul edi, edx
shr esi, 8
xor esi, ecx
mov ecx, dword [ebp + 0xc]
and esi, 0xff00ff
add ecx, 2
mov dword [ebp + 0xc], ecx
xor esi, edi
add esi, ebx
sub dword [ebp + 8], 1
mov dword [eax - 4], esi
jne 0x4af400
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
add ecx, dword [ebp - 0x10]
sub dword [ebp + 0x14], 1
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
jne 0x4af3f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4af770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ecx + 4]
push ebx
push esi
mov esi, dword [ebp + 8]
mov edx, dword [eax + 0x1c]
mov dword [ebp - 0xc], edx
push edi
mov edi, dword [ebp + 0xc]
imul edx, edi
sub edi, dword [ecx + 0x10]
add edx, dword [eax + 0x10]
mov eax, dword [ecx + 8]
lea ebx, [edx + esi*2]
sub esi, dword [ecx + 0xc]
mov edx, dword [eax + 0x1c]
imul edi, edx
mov dword [ebp - 0x10], edx
mov dword [ebp + 0xc], ebx
lea edx, [edi + esi*2]
add edx, dword [eax + 0x10]
movzx eax, byte [ecx + 0x18]
inc eax
mov dword [ebp + 8], edx
shr eax, 3
mov dword [ebp - 8], eax
nop word [eax + eax]
mov ecx, dword [ebp + 0x10]
mov edi, edx
mov eax, ebx
sub edi, ebx
mov ebx, ecx
nop dword [eax + eax]
movzx edx, word [eax]
lea eax, [eax + 2]
movzx ecx, word [edi + eax - 2]
mov esi, edx
and esi, 0x7e0
shl esi, 0x10
or esi, edx
mov edx, ecx
and edx, 0x7e0
and esi, 0xfffff81f
shl edx, 0x10
or edx, ecx
and edx, 0xfffff81f
sub edx, esi
imul edx, dword [ebp - 8]
shr edx, 5
add edx, esi
mov ecx, edx
shr ecx, 0x10
xor ecx, edx
and ecx, 0x7e0
xor ecx, edx
mov word [eax - 2], cx
sub ebx, 1
jne 0x4af7d0
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
add ebx, dword [ebp - 0xc]
add edx, dword [ebp - 0x10]
sub dword [ebp + 0x14], 1
mov dword [ebp + 0xc], ebx
mov dword [ebp + 8], edx
jne 0x4af7c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10