joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420ec0
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x14
mov eax, dword [eax + 0x14]
test eax, eax
je 0x420ee3
cmp eax, dword [ebx + 0x10]
je 0x420ee3
sub eax, 1
cmp dword [ebx + 0x18], eax
jae 0x420ee3
xor eax, eax
add esp, 0x14
pop ebx
pop esi
ret
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sub.msvcrt.dll_feof
test eax, eax
jne 0x420edb
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x420edb
mov ecx, dword [ebx + 0x10]
mov edx, dword [ebx + 0x14]
cmp ecx, edx
je 0x420f12
mov eax, dword [ebx + 0xc]
mov esi, ecx
jmp 0x420f37
lea eax, [ecx + ecx]
test ecx, ecx
mov esi, 0x1000
cmovne esi, eax
mov eax, dword [ebx + 0xc]
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00452a70
mov edx, dword [ebx + 0x14]
mov dword [ebx + 0x10], esi
mov dword [ebx + 0xc], eax
mov ecx, dword [ebx + 8]
sub esi, edx
add edx, eax
mov dword [esp], edx
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp + 0xc], ecx
call sub.msvcrt.dll_fread
mov esi, eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sub.msvcrt.dll_ferror
mov edx, eax
xor eax, eax
test edx, edx
jne 0x420edd
add dword [ebx + 0x14], esi
test esi, esi
setne al
jmp 0x420edd

Function at 0x4237d0
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, 0x7fffffff
sub esp, 0x18
mov dword [esp], str.COLUMNS
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4237f6
mov dword [esp], eax
call fcn.0047cc10
test eax, eax
cmovg ebx, eax
add esp, 0x18
mov eax, ebx
pop ebx
ret
Function at 0x45bc10
Capabilities:
Delete file

Disassembly:
push esi
push ebx
sub esp, 0x24
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0xc]
test eax, eax
jle 0x45bc2f
mov edx, dword [ebx + 0x44]
mov edx, dword [edx + 0xc]
mov dword [esp + 4], eax
mov dword [esp], ebx
call edx
mov eax, dword [ebx + 0x18]
test eax, eax
jle 0x45bc45
mov edx, dword [ebx + 0x44]
mov edx, dword [edx + 0xc]
mov dword [esp + 4], eax
mov dword [esp], ebx
call edx
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x45bc54
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov eax, dword [ebx + 0x38]
test eax, eax
je 0x45bc63
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov ecx, dword [ebx + 0x24]
test ecx, ecx
je 0x45bd00
mov edx, dword [ebx + 0x14]
test edx, edx
jne 0x45bcf0
mov eax, dword [ebx + 0x20]
xor esi, esi
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x28]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x3c]
test eax, eax
jle 0x45bccf
nop
mov eax, dword [ebx + 0x40]
mov eax, dword [eax + esi*4]
mov dword [esp], eax
call sub.msvcrt.dll_remove
mov eax, dword [ebx + 0x40]
mov eax, dword [eax + esi*4]
add esi, 1
mov dword [esp], eax
call sub.msvcrt.dll_free
cmp dword [ebx + 0x3c], esi
jg 0x45bca0
mov eax, dword [ebx + 0x40]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebx + 0x44]
mov eax, dword [eax + 0x20]
test eax, eax
je 0x45bcde
mov dword [esp], ebx
call eax
mov dword [esp + 0x30], ebx
add esp, 0x24
pop ebx
pop esi
jmp sub.msvcrt.dll_free
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_free
jmp 0x45bc75
and dword [ebx], 0xfffffffe
mov edx, 1
lea eax, [esp + 0x1c]
mov dword [esp], eax
lea ecx, [esp + 0x18]
mov eax, ebx
call fcn.0045afb0
jmp 0x45bc6e
Function at 0x46fb20
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.0046fb80
Function at 0x470510
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x470548
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x47053e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x47054a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x470530
xor eax, eax
pop ebx
pop esi
ret

Function at 0x474370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [ebp + 8]
call sub.msvcrt.dll__errno
test ebx, ebx
mov dword [eax], 0
je 0x47451e
cmp byte [ebx], 0
je 0x4744e8
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x474500
test al, 0x10
je 0x4744e8
lea edi, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov ebx, edi
mov dword [esp + 8], 0x104
mov dword [esp], edi
call sub.msvcrt.dll__fullpath
mov edx, dword [ebx]
add ebx, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4743d4
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [ebx + 2]
cmove ebx, edx
add al, al
sbb ebx, 3
sub ebx, edi
lea eax, [ebx + 0x233]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je 0x47450f
lea edx, [eax + 0x22c]
lea eax, [ebx + 1]
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [ebp - 0x12c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x12c]
cmp byte [esi + 0x22c], 0
je 0x474463
movzx eax, byte [esi + ebx + 0x22b]
cmp al, 0x2f
je 0x474463
cmp al, 0x5c
je 0x474463
mov edi, 0x5c
mov word [edx + ebx], di
mov eax, edx
mov ecx, dword [eax]
add eax, 4
lea edx, [ecx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x474465
mov ecx, edx
shr ecx, 0x10
test edx, 0x8080
cmove edx, ecx
lea ecx, [eax + 2]
cmove eax, ecx
add dl, dl
sbb eax, 3
mov edx, 0x2a
mov word [eax], dx
xor ecx, ecx
xor eax, eax
lea edx, [esi + 0x120]
xor ebx, ebx
mov word [esi + 0x11c], cx
mov edi, edx
mov ecx, 0x41
mov dword [esi + 0x224], 0xffffffff
mov dword [esi + 0x228], 0
mov dword [esi + 0x118], 0
mov word [esi + 0x11e], bx
rep stosd dword es:[edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x14
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 2
xor eax, eax
jmp 0x4744e0
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
xor eax, eax
jmp 0x4744e0
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
xor eax, eax
jmp 0x4744e0
Function at 0x421930
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.004b9bb0
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x421975
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x421975
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x5176f0
call fcn.004c4dd2
add esp, 0xc
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.004cc5d8
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4219ee
call fcn.00421810
test eax, eax
jle 0x4219ee
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push 0
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret
push 0x10
lea ecx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x421a10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
push str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
call fcn.00421930
push 0x16
call fcn.004c1cbe
add esp, 0x14
push 3
call fcn.004b7ed5
nop
nop
nop
nop
nop
nop

Function at 0x421a40
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 4
call fcn.004b9bb0
push edi
mov edi, dword [esp + 0x14]
xor cl, cl
test edi, edi
mov byte [esp + 4], cl
jbe 0x421a78
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
sub esi, eax
mov dl, byte [esi + eax]
mov bl, byte [eax]
xor dl, bl
or cl, dl
inc eax
dec edi
jne 0x421a65
pop esi
mov byte [esp + 8], cl
pop ebx
mov eax, dword [esp + 4]
pop edi
and eax, 0xff
pop ecx
ret
Function at 0x425240
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14
call fcn.004b9bb0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp + 8], 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
push eax
mov esi, ecx
push eax
inc esi
push esi
push ebx
push 8
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
jg 0x4252c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ec
jne 0x4252ad
push 0
push 0
push esi
push ebx
push 0
push 0xfde9
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
jg 0x4252c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
jne 0x425356
mov eax, dword [ebp + 0xc]
push eax
jmp 0x425343
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.004b9bb0
mov ecx, dword [ebp + 8]
mov eax, esp
push edi
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ecx
push 0xfde9
mov dword [ebp - 4], eax
call esi
test eax, eax
je 0x425356
lea edx, [ebp - 0x14]
push 8
push edx
mov edx, dword [ebp + 0xc]
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push eax
push 0xfde9
call esi
test eax, eax
je 0x425356
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x14]
push eax
push ecx
call fcn.004b9ac4
mov esi, eax
add esp, 8
test esi, esi
jne 0x4253e3
call fcn.004ba9fa
cmp dword [eax], 2
je 0x42533f
call fcn.004ba9fa
cmp dword [eax], 9
jne 0x42534e
mov edx, dword [ebp + 0xc]
push edx
push ebx
call fcn.004b629c
add esp, 8
mov esi, eax
test esi, esi
jne 0x4253e3
push 0xa9
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.00424260
mov eax, dword [ebp + 0xc]
push 0x4d8c78
push eax
push 0x4ee144
push ebx
push str.fopen_
push 5
call fcn.004249e0
add esp, 0x2c
call fcn.004ba9fa
cmp dword [eax], 2
jne 0x4253bf
push 0xac
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.00424260
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xae
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.00424260
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x51bb70
call fcn.00421da0
mov edi, eax
add esp, 4
test edi, edi
jne 0x42540b
push esi
call fcn.004b6a9c
add esp, 4
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push edi
call fcn.00421ed0
push esi
push 1
push 0x6a
push edi
call fcn.00422280
add esp, 0x18
mov eax, edi
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.004b9bb0
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x24]
mov dword [esi], 0
mov eax, dword [ebp]
test dword [eax + 0x10], 0x100000
je 0x433052
mov ecx, dword [esp + 0x20]
push 0
push 0
push ecx
push ebp
call dword [eax + 0x18]
add esp, 0x10
test eax, eax
jge 0x433044
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov dword [esi], eax
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
mov ebx, dword [eax + 4]
mov eax, dword [ebp + 0x5c]
test ah, 1
je 0x43308c
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4331fb
push 0x20b
push str..cryptoevpevp_enc.c
push 0x8a
push 0x65
push 6
call fcn.00424260
add esp, 0x14
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp ebx, 1
jbe 0x4331fb
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4331da
mov eax, dword [ebp + 0x64]
test eax, eax
je 0x4331da
cmp ebx, 0x20
jbe 0x4330c7
push str.b___sizeof_ctx__final
push 0x218
push str..cryptoevpevp_enc.c
call fcn.00421a10
add esp, 0xc
mov dl, byte [ebx + ebp + 0x6b]
mov eax, ebx
mov byte [esp + 0x14], dl
push edi
mov esi, dword [esp + 0x18]
mov edi, 1
and esi, 0xff
mov ecx, esi
sub eax, esi
xor ecx, ebx
mov edx, esi
or eax, ecx
mov ecx, ebx
not edx
not eax
sar edx, 0x1f
sar ecx, 0x1f
sar eax, 0x1f
and dl, cl
mov ecx, esi
or al, dl
lea edx, [esi - 1]
not ecx
sar edx, 0x1f
sar ecx, 0x1f
and dl, cl
not dl
and al, dl
cmp ebx, edi
mov byte [esp + 0x14], al
jbe 0x433197
lea edx, [ebx + ebp + 0x6a]
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edx, edi
mov al, byte [ecx]
sub edx, esi
mov ebp, eax
mov eax, esi
xor eax, edi
mov ecx, edi
not eax
sar eax, 0x1f
sar edx, 0x1f
and eax, 0xff
and edx, 0xff
and eax, edx
mov edx, esi
not ecx
sar ecx, 0x1f
sar edx, 0x1f
and ecx, 0xff
and edx, 0xff
xor ebp, esi
and ecx, edx
mov edx, ebp
or eax, ecx
lea ecx, [ebp - 1]
not edx
sar ecx, 0x1f
sar edx, 0x1f
and cl, dl
mov edx, dword [esp + 0x10]
and cl, al
not al
or cl, al
mov al, byte [esp + 0x14]
and al, cl
inc edi
dec edx
cmp edi, ebx
mov byte [esp + 0x14], al
mov dword [esp + 0x10], edx
jb 0x433121
mov ebp, dword [esp + 0x20]
lea edi, [ebx - 1]
xor esi, esi
test edi, edi
jbe 0x4331b2
mov ecx, dword [esp + 0x24]
mov dl, byte [esi + ebp + 0x6c]
and dl, al
mov byte [esi + ecx], dl
inc esi
cmp esi, edi
jb 0x4331a4
mov cl, byte [esp + 0x18]
mov eax, dword [esp + 0x14]
sub bl, cl
mov ecx, dword [esp + 0x28]
and eax, 0xff
and ebx, 0xff
and ebx, eax
pop edi
pop esi
mov dword [ecx], ebx
pop ebp
and eax, 1
pop ebx
add esp, 0xc
ret
push 0x215
push str..cryptoevpevp_enc.c
push 0x6d
push 0x65
push 6
call fcn.00424260
add esp, 0x14
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov dword [esi], 0
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x438ef0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x80
call fcn.004b9bb0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x9c]
xor eax, eax
push edi
test esi, esi
je 0x438f1b
mov ebx, dword [esp + 0x94]
mov eax, 1
mov dword [ebx], esi
jmp 0x438f2d
mov ebx, dword [esp + 0x94]
mov ecx, dword [ebx]
mov dword [esp + 0xa0], ecx
mov esi, ecx
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x4390d3
push esi
call fcn.0043b5b0
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x438f63
push str.j____int_sizeof_ctx__key_
push 0x68
push str..cryptohmachmac.c
call fcn.00421a10
add esp, 0xc
mov ebp, dword [esp + 0x9c]
cmp edi, ebp
jge 0x438fc0
mov edx, dword [esp + 0xa4]
lea edi, [ebx + 4]
push edx
push esi
push edi
call fcn.00431cd0
add esp, 0xc
test eax, eax
je 0x4390c6
mov eax, dword [esp + 0x98]
push ebp
push eax
push edi
call fcn.00431e80
add esp, 0xc
test eax, eax
je 0x4390c6
lea esi, [ebx + 0x4c]
lea ecx, [ebx + 0x50]
push esi
push ecx
push edi
call fcn.00431fb0
add esp, 0xc
test eax, eax
je 0x4390c6
jmp 0x438fff
test ebp, ebp
jl 0x438fcc
cmp ebp, 0x80
jle 0x438fe0
push str.len_0__len__int_sizeof_ctx__key_
push 0x75
push str..cryptohmachmac.c
call fcn.00421a10
add esp, 0xc
mov esi, dword [esp + 0x98]
mov ecx, ebp
mov edx, ecx
lea edi, [ebx + 0x50]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x4c]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x80
je 0x439024
mov ecx, 0x80
xor eax, eax
sub ecx, esi
lea edi, [esi + ebx + 0x50]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0xa0]
xor eax, eax
mov cl, byte [ebx + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x43902d
mov ebp, dword [esp + 0xa4]
lea edi, [ebx + 0x1c]
push ebp
push esi
push edi
call fcn.00431cd0
add esp, 0xc
test eax, eax
je 0x4390c6
push esi
call fcn.0043b5b0
lea edx, [esp + 0x14]
push eax
push edx
push edi
call fcn.00431e80
add esp, 0x10
test eax, eax
je 0x4390c6
xor eax, eax
mov cl, byte [ebx + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x439074
lea edi, [ebx + 0x34]
push ebp
push esi
push edi
call fcn.00431cd0
add esp, 0xc
test eax, eax
je 0x4390c6
push esi
call fcn.0043b5b0
lea edx, [esp + 0x14]
push eax
push edx
push edi
call fcn.00431e80
add esp, 0x10
test eax, eax
je 0x4390c6
lea eax, [ebx + 0x1c]
add ebx, 4
push eax
push ebx
call fcn.00432050
add esp, 8
test eax, eax
jne 0x4390dc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x80
ret
test eax, eax
je 0x4390b2
jmp 0x43902b
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x80
ret
Function at 0x45f6f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.004b9bb0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
mov ebx, dword [esi + 0x160]
mov dword [esi], eax
mov dword [esi + 8], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], eax
cmp edi, 0xc
mov dword [ebp - 4], ebx
mov dword [esi + 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x16c], eax
mov dword [esi + 0x168], eax
jne 0x45f768
mov eax, dword [ebp + 0xc]
mov ecx, esi
mov edi, 1
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov eax, dword [eax + 8]
mov byte [esi + 0xf], 1
mov dword [ecx + 8], eax
jmp 0x45f87b
cmp edi, 0x10
mov dword [ebp - 0xc], edi
jb 0x45f7b1
mov eax, edi
shr eax, 4
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
mov eax, esi
sub ecx, esi
mov edx, 0x10
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
dec edx
jne 0x45f784
mov ebx, dword [ebp - 4]
lea ecx, [esi + 0x60]
push ecx
push esi
call ebx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
add esp, 8
add edx, 0x10
sub edi, 0x10
dec eax
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], eax
jne 0x45f778
xor eax, eax
cmp edi, eax
je 0x45f7d1
jbe 0x45f7c7
mov ecx, dword [ebp + 0xc]
mov eax, esi
sub ecx, esi
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec edi
jne 0x45f7be
lea eax, [esi + 0x60]
push eax
push esi
call ebx
add esp, 8
mov eax, dword [ebp - 0xc]
mov ecx, 3
xor edx, edx
call fcn.004ccca0
mov edi, edx
mov dl, byte [esi + 8]
mov ecx, edi
mov ebx, eax
mov al, byte [esi + 9]
mov dword [ebp - 8], edi
shr ecx, 0x18
xor dl, cl
mov cl, byte [esi + 0xa]
mov byte [esi + 8], dl
mov edx, edi
shr edx, 0x10
xor al, dl
mov dl, byte [esi + 0xb]
mov byte [esi + 9], al
mov eax, edi
shr eax, 8
xor cl, al
mov eax, ebx
mov byte [esi + 0xa], cl
mov cl, byte [ebp - 8]
xor dl, cl
mov ecx, 0x18
mov byte [esi + 0xb], dl
mov edx, edi
call fcn.004c7e50
mov cl, byte [esi + 0xc]
mov edx, edi
xor cl, al
mov eax, ebx
mov byte [esi + 0xc], cl
mov ecx, 0x10
call fcn.004c7e50
mov dl, byte [esi + 0xd]
mov ecx, 8
xor dl, al
mov eax, ebx
mov byte [esi + 0xd], dl
mov edx, edi
call fcn.004c7e50
mov cl, byte [esi + 0xe]
lea edx, [esi + 0x60]
xor cl, al
mov al, byte [esi + 0xf]
xor al, bl
push edx
push esi
mov byte [esi + 0xe], cl
mov byte [esi + 0xf], al
call dword [ebp - 4]
mov eax, dword [esi + 0xc]
add esp, 8
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
bswap eax
mov edi, eax
mov ecx, dword [esi + 0x174]
lea edx, [esi + 0x20]
push ecx
push edx
push esi
call dword [esi + 0x170]
add esp, 0xc
inc edi
mov dword [ebp + 0xc], edi
mov eax, dword [ebp + 0xc]
bswap eax
mov dword [esi + 0xc], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x465cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.004b9bb0
mov eax, dword [ebp + 0x20]
push ebx
push esi
push edi
mov ecx, dword [eax]
test ecx, ecx
mov dword [ebp - 4], ecx
je 0x465d1d
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x465d1d
mov edx, dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
mov dl, byte [ecx + edx]
mov al, byte [esi]
xor dl, al
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
mov edx, dword [ebp + 0x10]
inc eax
inc esi
dec edx
inc ecx
and ecx, 0xf
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], esi
mov dword [ebp + 0x10], edx
mov dword [ebp - 4], ecx
jne 0x465cec
mov esi, dword [ebp + 0x18]
mov eax, dword [esi + 0xc]
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x18]
bswap eax
mov ebx, eax
mov eax, dword [ebp + 0x10]
cmp eax, 0x10
jb 0x465dad
mov edi, dword [ebp + 0x10]
shr edi, 4
add ebx, edi
cmp ebx, edi
mov dword [ebp + 0x18], ebx
jae 0x465d4b
sub edi, ebx
xor ebx, ebx
mov dword [ebp + 0x18], ebx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
push ecx
push edi
push edx
push eax
call dword [ebp + 0x24]
add esp, 0x14
mov eax, dword [ebp + 0x18]
bswap eax
test ebx, ebx
mov dword [esi + 0xc], eax
jne 0x465d8a
mov cl, byte [esi + 0xb]
mov eax, 0xb
inc cl
mov byte [esi + 0xb], cl
jne 0x465d8a
test eax, eax
je 0x465d8a
mov cl, byte [eax + esi - 1]
dec eax
inc cl
mov byte [eax + esi], cl
je 0x465d7a
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
shl edi, 4
sub eax, edi
add ecx, edi
add edx, edi
cmp eax, 0x10
mov dword [ebp + 0x10], eax
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], edx
jae 0x465d35
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x465e3e
mov edi, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x14]
mov edx, edi
xor ecx, ecx
push esi
push eax
mov dword [edx], ecx
push 1
push edi
push edi
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
call dword [ebp + 0x24]
add esp, 0x14
inc ebx
mov dword [ebp + 0x18], ebx
mov eax, dword [ebp + 0x18]
bswap eax
test ebx, ebx
mov dword [esi + 0xc], eax
jne 0x465e08
mov cl, byte [esi + 0xb]
mov eax, 0xb
inc cl
mov byte [esi + 0xb], cl
jne 0x465e08
test eax, eax
je 0x465e08
mov cl, byte [eax + esi - 1]
dec eax
inc cl
mov byte [eax + esi], cl
je 0x465df8
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
dec ecx
sub esi, edi
sub edx, edi
inc ecx
lea eax, [ebx + edi]
add ebx, ecx
mov dword [ebp - 4], ebx
mov bl, byte [esi + eax]
xor bl, byte [eax]
inc eax
dec ecx
mov byte [edx + eax - 1], bl
jne 0x465e22
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp - 4]
pop edi
pop esi
mov dword [ecx], edx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x20]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x488d20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov ecx, dword [eax + 4]
push edi
cmp ecx, dword [ebx + 4]
jge 0x488d39
mov esi, ebx
mov ebx, eax
jmp 0x488d3b
mov esi, eax
mov edi, dword [esp + 0x10]
mov eax, dword [esi + 4]
cmp eax, dword [edi + 8]
jg 0x488d4b
mov eax, edi
jmp 0x488d55
push eax
push edi
call fcn.0042d470
add esp, 8
test eax, eax
jne 0x488d5d
pop edi
pop esi
pop ebx
ret
mov ecx, dword [ebx + 4]
xor eax, eax
test ecx, ecx
jle 0x488d81
push ebp
mov edx, dword [esi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
mov ebp, dword [ecx + eax*4]
mov ecx, dword [edi]
xor edx, ebp
mov dword [ecx + eax*4], edx
mov ecx, dword [ebx + 4]
inc eax
cmp eax, ecx
jl 0x488d67
pop ebp
cmp eax, dword [esi + 4]
jge 0x488d98
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
mov ecx, dword [esi + 4]
inc eax
cmp eax, ecx
jl 0x488d86
mov eax, dword [esi + 4]
test eax, eax
mov dword [edi + 4], eax
jle 0x488db9
mov ecx, dword [edi]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x488db6
dec eax
test eax, eax
jg 0x488da8
mov dword [edi + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret