joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5144f0
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x5467a4]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
push edi
mov eax, dword [0x5467a4]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], esi
call fcn.00436280
mov edx, dword [edi + 0xc]
cmp edx, 8
jb 0x45aafb
mov eax, dword [edi + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
xor esi, esi
cmp ecx, esi
mov dword [esp + 0x18], ecx
je 0x45a9eb
cmp eax, esi
je 0x45a9eb
add edx, 0xfffffff8
cmp edx, eax
jb 0x45aafb
cmp ecx, esi
mov ebx, dword [edi + 8]
mov edi, 8
mov dword [esp + 0x10], esi
ja 0x45aa22
mov al, 1
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.004e7d6f
mov esp, ebp
pop ebp
ret
xor esi, esi
push esi
mov dword [esp + 0x38], esi
mov word [esp + 0x28], si
push 0x51a1d4
lea esi, [esp + 0x28]
mov dword [esp + 0x40], 7
call fcn.00407330
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x40]
xor esi, esi
push ecx
mov edx, Ordinal_4
mov dword [esp + 0xa0], esi
call fcn.00456dc0
mov byte [esp + 0x98], 2
cmp dword [esp + 0x38], 8
jb 0x45aa7b
mov edx, dword [esp + 0x24]
push edx
call fcn.004e7d7e
add esp, 4
mov eax, dword [edi + ebx]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [ecx + 0xc]
add edi, 4
mov dword [esp + 0x34], esi
mov word [esp + 0x24], si
lea esi, [eax + edi]
cmp esi, ecx
mov dword [esp + 0x38], 7
lea ecx, [esp + 0x3c]
ja 0x45aaeb
push eax
add edi, ebx
push edi
call fcn.00457770
lea edx, [esp + 0x3c]
mov edi, esi
mov esi, dword [esp + 0x14]
push edx
call fcn.004399d0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x98], 0xffffffff
call fcn.00456e40
mov eax, dword [esp + 0x10]
add eax, 1
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
jb 0x45aa20
jmp 0x45a9fb
mov dword [esp + 0x98], 0xffffffff
call fcn.00456e40
xor al, al
jmp 0x45a9fd
Function at 0x45c490
Capabilities:
Read data from internet
Receive data

Disassembly:
mov eax, dword [eax]
sub esp, 8
test eax, eax
push ebx
push edi
jne 0x45c4a6
or eax, 0xffffffff
pop edi
pop ebx
add esp, 8
ret 4
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push ecx
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x45c49b
mov edx, dword [esp + 0xc]
add dword [esi + 0xc], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
cmp edi, dword [esi + 4]
je 0x45c53a
mov ecx, edi
sub ecx, dword [esi + 0x18]
cmp ecx, 0x3e8
jbe 0x45c50c
mov ebx, dword [esi + 0xc]
mov eax, ebx
sub eax, dword [esi + 0x1c]
xor edx, edx
div ecx
test eax, eax
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
jge 0x45c503
fadd qword [0x52ca60]
fstp qword [esi + 0x10]
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], ebx
mov eax, dword [esi + 0xc]
fild dword [esi + 0xc]
test eax, eax
jge 0x45c51c
fadd qword [0x52ca60]
mov ecx, edi
sub ecx, dword [esi]
test ecx, ecx
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
jge 0x45c532
fadd qword [0x52ca60]
fdivp st(1)
mov dword [esi + 4], edi
fstp qword [esi + 0x20]
mov eax, dword [esp + 0xc]
pop edi
pop ebx
add esp, 8
ret 4

Function at 0x45e130
Capabilities:
Check os version

Disassembly:
sub esp, 0x124
mov eax, dword [0x5467a4]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push ebp
push esi
push edi
push 0x114
lea eax, [esp + 0x18]
push 0
push eax
mov esi, ecx
mov dword [esp + 0x1c], 0
call fcn.004f1960
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, esi
xor edi, edi
call fcn.004ab0c0
test eax, eax
jbe 0x45e1bb
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x45e199
mov eax, dword [esi + 8]
sub eax, ecx
sar eax, 2
cmp edi, eax
jb 0x45e19e
call fcn.004e89bf
mov edx, dword [esi + 4]
mov eax, dword [edx + edi*4]
push eax
call fcn.004e7d7e
add esp, 4
mov eax, esi
add edi, 1
call fcn.004ab0c0
cmp edi, eax
jb 0x45e186
mov ebx, dword [esi + 8]
cmp dword [esi + 4], ebx
jbe 0x45e1c8
call fcn.004e89bf
mov edi, dword [esi + 4]
cmp edi, dword [esi + 8]
jbe 0x45e1d5
call fcn.004e89bf
cmp edi, ebx
je 0x45e1fe
mov eax, dword [esi + 8]
sub eax, ebx
sar eax, 2
test eax, eax
lea ecx, [eax*4]
lea ebp, [ecx + edi]
jle 0x45e1fb
push ecx
push ebx
push ecx
push edi
call fcn.004e8215
add esp, 0x10
mov dword [esi + 8], ebp
cmp dword [esp + 0x24], 2
jne 0x45e219
push esi
call fcn.0045daa0
push esi
call fcn.0045ded0
push esi
call fcn.0045d960
jmp 0x45e234
xor edi, edi
cmp dword [esp + 0x10], 0
jne 0x45e234
push esi
call fcn.0045dc60
add edi, 1
cmp edi, 0xa
mov dword [esp + 0x10], eax
jl 0x45e21b
mov eax, dword [esi + 4]
test eax, eax
jne 0x45e23f
xor esi, esi
jmp 0x45e247
mov esi, dword [esi + 8]
sub esi, eax
sar esi, 2
mov ecx, dword [esp + 0x130]
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.004e7d6f
add esp, 0x124
ret
Function at 0x45f640
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, eax
test esi, esi
push edi
jne 0x45f68f
cmp byte [ebx + 0x2c], al
jne 0x45f687
mov byte [ebx + 0x2c], 1
mov dword [ebx + 0x30], 2
mov edx, dword [str.Failed_to_open_file]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x45f668
sub eax, esi
push edx
lea edi, [ebx + 0x34]
mov esi, eax
call fcn.004628e0
or eax, 0xffffffff
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x3c], eax
pop edi
pop esi
xor al, al
pop ebx
ret 4
push ebp
mov edi, ebx
call fcn.0045ec20
push 2
or eax, 0xffffffff
push 0
push esi
mov dword [ebx + 8], eax
mov dword [ebx + 4], eax
call fcn.004e8f57
push esi
call fcn.004ec98b
push 0
push 0
push esi
mov ebp, eax
call fcn.004e8f57
add esp, 0x1c
test ebp, ebp
jg 0x45f6ee
cmp byte [ebx + 0x2c], 0
jne 0x45f752
mov byte [ebx + 0x2c], 1
mov dword [ebx + 0x30], 0xc
mov edx, dword [str.Error_document_empty.]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x45f6e3
jmp 0x45f73c
lea eax, [ebp + 1]
push eax
call fcn.004e7d83
push esi
push 1
mov edi, eax
push ebp
push edi
mov byte [edi], 0
call fcn.004ec504
add esp, 0x14
cmp eax, 1
je 0x45f75b
push edi
call fcn.004e7d7e
add esp, 4
cmp byte [ebx + 0x2c], 0
jne 0x45f752
mov byte [ebx + 0x2c], 1
mov dword [ebx + 0x30], 2
mov edx, dword [str.Failed_to_open_file]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x45f733
sub eax, esi
push edx
lea edi, [ebx + 0x34]
mov esi, eax
call fcn.004628e0
or eax, 0xffffffff
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x3c], eax
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret 4
mov byte [edi + ebp], 0
cmp byte [edi], 0
mov eax, edi
mov esi, edi
je 0x45f78c
mov cl, byte [eax]
cmp cl, 0xd
jne 0x45f77f
mov byte [esi], 0xa
add eax, 1
add esi, 1
cmp byte [eax], 0xa
jne 0x45f787
jmp 0x45f784
mov byte [esi], cl
add esi, 1
add eax, 1
cmp byte [eax], 0
jne 0x45f768
push 0
mov byte [esi], 0
mov edx, dword [ebx]
mov eax, dword [edx + 8]
push 0
push edi
mov ecx, ebx
call eax
push edi
call fcn.004e7d7e
add esp, 4
pop ebp
xor eax, eax
cmp byte [ebx + 0x2c], al
pop edi
pop esi
sete al
pop ebx
ret 4
Function at 0x466ea0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x50e738
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5467a4]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov edi, ecx
mov ebp, dword [esp + 0x8c]
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 4]
mov esi, dword [edi + 0x14]
sub eax, 2
cmp esi, eax
mov ebx, 1
ja 0x466f0a
cmp dword [edi + 0x18], eax
je 0x466f0a
push ebx
push eax
call fcn.00407060
test al, al
je 0x466f0a
cmp dword [edi + 0x18], 0x10
mov dword [edi + 0x14], esi
jb 0x466f03
mov eax, dword [edi + 4]
jmp 0x466f06
lea eax, [edi + 4]
mov byte [eax + esi], 0
mov esi, dword [ebp + 4]
mov ecx, dword [ebp + 8]
sub ecx, ebx
add esi, ebx
cmp esi, ecx
mov dword [esp + 0x18], ecx
je 0x4670dc
jmp 0x466f26
mov ecx, dword [esp + 0x18]
mov al, byte [esi]
add esi, ebx
cmp al, 0x22
mov byte [esp + 0x20], al
je 0x4670dc
cmp al, 0x5c
jne 0x46702a
cmp esi, ecx
je 0x467045
mov al, byte [esi]
movsx eax, al
add esi, ebx
add eax, 0xffffffde
cmp eax, 0x53
mov dword [esp + 0x8c], esi
ja case.0x466f67.35
movzx eax, byte [eax + 0x46711c]
jmp dword [eax*4 + 0x4670f4]
push 0x22
jmp 0x46702f
push 0x2f
jmp 0x46702f
push 0x5c
jmp 0x46702f
push 8
jmp 0x46702f
push 0xc
jmp 0x46702f
push 0xa
jmp 0x46702f
push 0xd
jmp 0x46702f
push 9
jmp 0x46702f
mov eax, dword [esp + 0x88]
lea edx, [esp + 0x1c]
push edx
push ecx
push ebp
push eax
lea ecx, [esp + 0x9c]
call fcn.00467170
test al, al
je 0x467080
mov ecx, dword [esp + 0x1c]
push ecx
lea esi, [esp + 0x44]
call fcn.00465780
add esp, 4
push 0xffffffffffffffff
push 0
push eax
mov esi, edi
mov dword [esp + 0x8c], ebx
call fcn.0041cd20
mov dword [esp + 0x80], 0xffffffff
cmp dword [esp + 0x58], 0x10
jb 0x46700c
mov edx, dword [esp + 0x44]
push edx
call fcn.004e7d7e
add esp, 4
mov esi, dword [esp + 0x8c]
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], 0
mov byte [esp + 0x44], 0
jmp 0x467036
mov eax, dword [esp + 0x20]
push eax
mov eax, ebx
call fcn.0041ce10
cmp esi, dword [esp + 0x18]
jne 0x466f22
jmp 0x4670dc
push str.Empty_escape_sequence_in_string
lea ecx, [esp + 0x60]
call fcn.00406a50
mov edx, dword [esp + 0x88]
push esi
push ebp
lea ecx, [esp + 0x64]
mov dword [esp + 0x88], 0
call fcn.00467440
cmp dword [esp + 0x74], 0x10
mov bl, al
jb 0x4670dc
mov ecx, dword [esp + 0x60]
push ecx
jmp 0x4670d4
xor al, al
jmp 0x4670de
push 0x1d
push str.Bad_escape_sequence_in_string
lea ecx, [esp + 0x2c]
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], 0
mov byte [esp + 0x30], 0
call fcn.00406f00
mov edx, dword [esp + 0x88]
push esi
push ebp
lea ecx, [esp + 0x2c]
mov dword [esp + 0x88], 2
call fcn.00467440
cmp dword [esp + 0x3c], 0x10
mov bl, al
jb 0x4670dc
mov edx, dword [esp + 0x28]
push edx
call fcn.004e7d7e
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret 8
Function at 0x46ef20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x14]
xor edx, edx
cmp eax, edx
push edi
mov edi, dword [ebp + 0x10]
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x20], 0x46e9e0
mov dword [esp + 0x34], 0x46ebe0
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x28], 0x46e870
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x10], edx
je 0x46ef7f
cmp esi, edx
je 0x46ef7f
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x18]
cmp eax, edx
mov dword [esp + 0x1c], edx
je 0x46efa3
mov ecx, dword [ecx]
cmp ecx, 0xffffffff
je 0x46efa3
push edx
lea edx, [esp + 0x20]
push edx
push 5
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
mov eax, dword [esp + 0x1c]
add dword [edi], eax
lea ecx, [esp + 0x20]
adc dword [edi + 4], edx
mov edi, dword [ebx + 0x14]
lea edx, [esp + 0x34]
mov eax, edi
mov dword [edi + 0x1d0], ecx
mov dword [edi + 0x3bd10], 1
mov dword [edi + 0x3bcd4], edx
call fcn.00476120
xor ebx, ebx
cmp eax, ebx
jne 0x46efed
mov eax, dword [esp + 0x10]
push eax
mov ecx, edi
call fcn.004761b0
add esp, 4
cmp eax, ebx
je 0x46eff8
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp dword [esp + 0x10], ebx
je 0x46f099
mov edx, dword [esi]
mov edi, dword [esi + 4]
mov ecx, edx
or ecx, edi
jne 0x46f017
fld qword [0x52ca70]
fld st(0)
jmp 0x46f083
mov ecx, dword [esi + 0x10]
add ecx, dword [esi + 8]
mov eax, dword [esi + 0x14]
adc eax, dword [esi + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, eax
and eax, 0x7fffffff
mov dword [esp + 0x14], eax
fild qword [esp + 0x10]
and ecx, 0x80000000
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
fild qword [esp + 0x10]
mov eax, edi
mov ecx, edi
and eax, 0x7fffffff
fchs
mov dword [esp + 0x10], edx
faddp st(1)
mov dword [esp + 0x14], eax
fld qword [0x52ca70]
and ecx, 0x80000000
fmul st(1), st(0)
fild qword [esp + 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
fild qword [esp + 0x10]
fchs
faddp st(1)
fdivp st(2)
fxch st(1)
mov ecx, dword [ebp + 0x14]
fxch st(1)
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
sub esp, 0x10
fstp qword [esp + 8]
fstp qword [esp]
call eax
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x46f0b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x515da8
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push ebx
push esi
push edi
mov eax, dword [0x5467a4]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov dword [esp + 0x44], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [esp + 0x70]
push ecx
mov dword [esp + 0x70], 0x46ea40
call fcn.0043a480
xor ebx, ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
mov dword [esp + 0xc0], ebx
mov eax, dword [esp + 0x44]
add eax, 0x18
cmp eax, ebx
mov dword [esp + 0x50], 0x46ebe0
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], 0x46e870
mov dword [esp + 0x60], edx
mov dword [esp + 0x64], esi
mov dword [esp + 0x40], ebx
je 0x46f162
mov ecx, dword [ecx]
cmp ecx, 0xffffffff
je 0x46f162
push ebx
lea edx, [esp + 0x44]
push edx
push 5
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x40]
add dword [edi], eax
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x50]
adc dword [edi + 4], ebx
mov edi, dword [ecx + 0x14]
lea edx, [esp + 0x68]
mov dword [edi + 0x3bcd4], eax
mov eax, edi
mov dword [edi + 0x1d0], edx
mov dword [edi + 0x3bd10], 1
call fcn.00476120
cmp eax, ebx
jne 0x46f1ae
lea ecx, [esp + 0x5c]
push ecx
mov ecx, edi
call fcn.004761b0
add esp, 4
cmp eax, ebx
je 0x46f1ee
mov eax, dword [esp + 0x70]
cmp eax, ebx
je 0x46f1d4
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0x74]
push edx
call fcn.00407900
mov eax, dword [esp + 0x74]
add esp, 4
push eax
call fcn.004e7d7e
add esp, 4
xor al, al
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [esi]
mov edi, dword [esi + 4]
mov ecx, edx
or ecx, edi
jne 0x46f203
fld qword [0x52ca70]
fld st(0)
jmp 0x46f26f
mov ecx, dword [esi + 0x10]
add ecx, dword [esi + 8]
mov eax, dword [esi + 0x14]
adc eax, dword [esi + 0xc]
mov dword [esp + 0x44], ecx
mov ecx, eax
and eax, 0x7fffffff
mov dword [esp + 0x48], eax
fild qword [esp + 0x44]
and ecx, 0x80000000
mov dword [esp + 0x48], ecx
mov dword [esp + 0x44], ebx
fild qword [esp + 0x44]
mov eax, edi
mov ecx, edi
fchs
and eax, 0x7fffffff
faddp st(1)
mov dword [esp + 0x44], edx
fld qword [0x52ca70]
mov dword [esp + 0x48], eax
and ecx, 0x80000000
fmul st(1), st(0)
fild qword [esp + 0x44]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x44], ebx
fild qword [esp + 0x44]
fchs
faddp st(1)
fdivp st(2)
fxch st(1)
mov ecx, dword [ebp + 0x14]
fxch st(1)
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
sub esp, 0x10
fstp qword [esp + 8]
fstp qword [esp]
call eax
mov eax, dword [esp + 0x70]
cmp eax, ebx
je 0x46f2ab
mov ecx, dword [esp + 0x44]
mov edi, dword [esp + 0x74]
push ecx
call fcn.00407900
mov edx, dword [esp + 0x74]
add esp, 4
push edx
call fcn.004e7d7e
add esp, 4
mov al, 1
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x473120
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x473130
pop edi
pop ebx
ret

Function at 0x473160
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
sar ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x473170
pop esi
pop ebp
pop ebx
ret

Function at 0x4732e0
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, ecx
xor eax, eax
test edi, edi
lea edx, [eax + 1]
je 0x473322
push ebx
push ebp
mov ebx, dword [esp + 0x14]
movzx ebx, word [ebx + edx*2]
mov ecx, esi
and ecx, 1
mov ebp, ecx
neg ebp
sar ebp, 4
and ebp, 0x7f
shr ebx, 4
xor ebx, ebp
mov ebp, dword [esp + 0x18]
add eax, dword [ebp + ebx*4]
add edx, edx
shr esi, 1
or edx, ecx
sub edi, 1
jne 0x4732f1
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x473470
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [esp + 0x10], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
push ebp
mov dword [esp + 8], edx
push edi
mov dword [esp + 0x10], ecx
xor edx, edx
lea ebx, [ebx]
cmp edx, dword [esp + 0x20]
jae 0x4735e7
mov eax, edx
or eax, 8
xor edi, edi
cmp eax, 1
je 0x473500
mov ebp, dword [esp + 0x1c]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 4]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x4734d6
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
add edi, eax
mov dword [ecx + edx*4], edi
add edx, 1
cmp edx, 8
jb 0x4734c0
cmp edx, 0x10
jae 0x473582
lea eax, [edx - 8]
mov dword [esp + 0x18], eax
cmp edx, dword [esp + 0x20]
jae 0x4735e7
or eax, 8
xor edi, edi
cmp eax, 1
je 0x473562
mov ebp, dword [esp + 0x1c]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 0x104]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x473535
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x24]
add edi, eax
mov eax, dword [esp + 0x18]
mov dword [ecx + edx*4], edi
add edx, 1
add eax, 1
cmp edx, 0x10
mov dword [esp + 0x18], eax
jb 0x473521
cmp edx, dword [esp + 0x20]
jae 0x4735e7
lea eax, [edx - 0x10]
mov dword [esp + 0x18], eax
nop
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x4735c6
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x4735a0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
add edi, eax
mov eax, dword [esp + 0x18]
mov dword [ecx + edx*4], edi
add edx, 1
add eax, 1
cmp edx, dword [esp + 0x20]
mov dword [esp + 0x18], eax
jb 0x473590
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x475160
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
lea eax, [edi + 0x32550]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jmp 0x475180
xor edx, edx
lea ecx, [edx + 1]
mov dword [esp + 0xc], 4
lea ecx, [ecx]
movzx ebx, word [edi + ecx*2 + 0x32bf4]
mov eax, esi
and eax, 1
mov ebp, eax
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
xor ebx, ebp
add edx, dword [edi + ebx*4 + 0x30ea0]
add ecx, ecx
shr esi, 1
or ecx, eax
sub dword [esp + 0xc], 1
jne 0x475190
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
add esi, 1
mov dword [eax], edx
add eax, 4
cmp esi, 0x10
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jb 0x475180
pop esi
pop ebp
mov dword [edi + 0x32590], 0
pop ebx
add esp, 0xc
ret

Function at 0x4751f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x210
push ebx
push ebp
push edi
mov edi, 4
lea ebp, [esi + 0x30ea0]
movzx ebx, byte [esi + edi + 0x306a0]
mov ecx, ebx
mov edx, ebx
and edx, 1
shr ecx, 1
or edx, 2
sub ecx, 1
shl edx, cl
mov eax, edi
push ebp
sub eax, edx
sub edx, ebx
lea edx, [esi + edx*2 + 0x32b0e]
push edx
call fcn.004732e0
mov dword [esp + edi*4 + 0x24], eax
add edi, 1
add esp, 8
cmp edi, 0x80
jb 0x475204
lea ebp, [esp + 0x1c]
sub ebp, esi
lea eax, [esi + 0x32910]
lea ecx, [esi + 0x31d58]
sub ebp, 0x31d50
lea edi, [esi + 0x31950]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 4
jmp 0x475284
mov ecx, dword [esp + 0xc]
xor ebx, ebx
cmp dword [esi + 0x32594], ebx
jbe 0x4752e1
mov edi, edi
mov eax, ebx
or eax, 0x40
xor edx, edx
cmp eax, 1
je 0x4752d3
lea esp, [esp]
mov ebp, dword [esp + 0x10]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebp + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edx, dword [esi + ebp*4 + 0x30ea0]
mov eax, ecx
cmp eax, 1
jne 0x4752a0
mov ebp, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov dword [edi + ebx*4], edx
add ebx, 1
cmp ebx, dword [esi + 0x32594]
jb 0x475290
mov eax, 0xe
cmp dword [esi + 0x32594], eax
jbe 0x475308
mov edi, edi
mov edx, eax
shr edx, 1
sub edx, 5
shl edx, 4
add dword [edi + eax*4], edx
add eax, 1
cmp eax, dword [esi + 0x32594]
jb 0x4752f0
mov eax, dword [edi]
mov dword [ecx - 8], eax
mov edx, dword [edi + 4]
mov dword [ecx - 4], edx
mov eax, dword [edi + 8]
mov dword [ecx], eax
mov edx, dword [edi + 0xc]
mov dword [ecx + 4], edx
mov eax, 4
add ecx, 8
jmp 0x475330
movzx edx, byte [esi + eax + 0x306a0]
mov edx, dword [edi + edx*4]
add edx, dword [ecx + ebp]
add eax, 1
mov dword [ecx], edx
add ecx, 4
cmp eax, 0x80
jb 0x475330
add dword [esp + 0x10], 0x80
add dword [esp + 0xc], 0x200
sub ebp, 0x200
add edi, 0x100
sub dword [esp + 0x18], 1
mov dword [esp + 0x14], ebp
jne 0x475280
pop edi
pop ebp
mov dword [esi + 0x3bcf8], 0
pop ebx
add esp, 0x210
ret