joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47be3c
Capabilities:
Get disk information via ioctl

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffeec
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x104
call fcn.00402d24
mov esi, 0x47bec8
lea edi, [esp + 4]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov byte [esp + 8], bl
or esi, 0xffffffff
push 0
push 0
push 3
push 0
push 3
push 0
lea eax, [esp + 0x1c]
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x47bebc
push 0
lea eax, [esp + 4]
push eax
push 0xc
lea eax, [esp + 0x114]
push eax
push 0
push 0
push 0x2d1080
push ebx
call sub.kernel32.dll_DeviceIoControl
test eax, eax
jle 0x47beb6
mov esi, dword [esp + 0x10c]
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, esi
add esp, 0x114
pop edi
pop esi
pop ebx
ret

Function at 0x47bfcc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffae0
push ebx
push esi
push edi
mov ebx, eax
mov dword [ebp - 4], 0xffffffff
call fcn.0047b2f8
xor edx, edx
push ebp
push 0x47c164
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, ebx
call fcn.0047be3c
mov esi, eax
lea eax, [ebp - 0x211]
xor ecx, ecx
mov edx, 0x104
call fcn.00402d24
lea eax, [ebp - 0x10d]
xor ecx, ecx
mov edx, 0x104
call fcn.00402d24
lea eax, [ebp - 0x315]
xor ecx, ecx
mov edx, 0x104
call fcn.00402d24
lea eax, [ebp - 0x51e]
xor ecx, ecx
mov edx, 0x208
call fcn.00402d24
push esi
mov esi, 0x47c178
lea edi, [ebp - 0x211]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
pop esi
mov byte [ebp - 0x211], bl
push esi
mov esi, 0x47c27c
lea edi, [ebp - 0x10d]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
pop esi
mov byte [ebp - 0x10d], bl
cmp esi, 0xffffffff
jne 0x47c08d
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00403b8c
jmp 0x47c16b
lea eax, [ebp - 0x211]
push eax
call sub.kernel32.dll_GetDriveTypeA
mov ebx, eax
push 0x104
lea eax, [ebp - 0x315]
push eax
lea eax, [ebp - 0x10d]
push eax
call sub.kernel32.dll_QueryDosDeviceA
test eax, eax
jne 0x47c0c6
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00403b8c
jmp 0x47c16b
lea ecx, [ebp - 0x315]
mov edx, ebx
mov eax, esi
call fcn.0047bdf8
test eax, eax
jne 0x47c0e8
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00403b8c
jmp 0x47c16b
mov byte [ebp - 9], 0
xor edx, edx
mov dword [ebp - 8], edx
push 0
push eax
lea eax, [ebp - 8]
push eax
call dword [0x4d9c40]
test eax, eax
jne 0x47c151
mov ebx, 3
mov word [ebp - 0x51e], 0
push 0
push 0x104
lea eax, [ebp - 0x51e]
push eax
lea eax, [ebp - 9]
push eax
mov eax, dword [ebp - 8]
push eax
call dword [0x4d9c3c]
test eax, eax
jne 0x47c136
cmp byte [ebp - 9], 0
je 0x47c13a
xor eax, eax
jmp 0x47c13c
mov al, 1
neg al
sbb eax, eax
test eax, eax
jne 0x47c151
push 0x1f4
call sub.kernel32.dll_Sleep_1
dec ebx
jne 0x47c107
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c16b
call fcn.0047b8a4
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47c58c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404570
xor eax, eax
push ebp
push 0x47c651
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004040c0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040cfa4
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00404158
mov ebx, 0x104
mov eax, ebx
call fcn.004083a4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47c62c
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404580
push eax
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
test eax, eax
jne 0x47c60c
call fcn.00403b8c
jmp 0x47c633
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.004042b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c633
mov eax, dword [ebp - 8]
call fcn.0040270c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c658
lea eax, [ebp - 0xc]
call fcn.004040c0
lea eax, [ebp - 4]
call fcn.004040c0
ret

Function at 0x47d2a8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x47d2b0
push ecx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x47d437
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004040c0
lea eax, [ebp - 0x10]
call fcn.004040c0
mov eax, 0x104
call fcn.004083a4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x47d364
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
mov dl, byte [ebp - 1]
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x28]
call fcn.00402c08
mov edx, 0x47d444
lea eax, [ebp - 0x28]
mov cl, 2
call fcn.00402bd8
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x20]
call fcn.00404324
mov eax, dword [ebp - 0x20]
call fcn.00404580
push eax
call sub.kernel32.dll_QueryDosDeviceA
test eax, eax
jbe 0x47d34e
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004042b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d36b
mov eax, dword [ebp - 0xc]
call fcn.0040270c
ret

Function at 0x48331c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4833ab
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.kernel32.dll_GetLogicalDriveStringsA
mov ebx, eax
mov eax, edi
call fcn.004040c0
mov esi, ebx
test esi, esi
jns 0x483363
add esi, 3
sar esi, 2
dec esi
test esi, esi
jl 0x483392
inc esi
lea ebx, [ebp - 0x104]
lea eax, [ebp - 0x108]
mov dl, byte [ebx]
call fcn.004042a8
mov edx, dword [ebp - 0x108]
mov eax, edi
call fcn.00404388
add ebx, 4
dec esi
jne 0x483372
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4833b2
lea eax, [ebp - 0x108]
call fcn.004040c0
ret
Function at 0x4833bc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x483457
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x483437
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
add al, 0xbf
sub al, 0x1a
jb 0x483405
add al, 0xfa
sub al, 0x1a
jb 0x483405
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x483441
lea eax, [ebp - 8]
mov edx, ebx
call fcn.004042a8
lea eax, [ebp - 8]
mov edx, 0x483470
call fcn.00404388
mov eax, dword [ebp - 8]
call fcn.00404580
push eax
call sub.kernel32.dll_GetDriveTypeA
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x483441
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48345e
lea eax, [ebp - 8]
call fcn.004040c0
ret

Function at 0x487bc8
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], 0xffffffff
mov eax, 0x200
call fcn.004026ec
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x487c90
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, 0x200
call fcn.00402d24
xor edx, edx
push ebp
push 0x487c70
push dword fs:[edx]
mov dword fs:[edx], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, esi
mov dword [eax + 4], edi
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [ebx], eax
xor eax, eax
mov dword [ebx + 4], eax
push 0
lea eax, [ebp - 0xc]
push eax
push edi
push esi
push 0x200
push ebx
push 0x2d1400
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_DeviceIoControl
test eax, eax
jne 0x487c59
call sub.kernel32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x487c66
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x487c7a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x487c97
mov eax, dword [ebp - 0x10]
call fcn.0040270c
ret
Function at 0x48a5fc
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x12c], ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x48a7a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 0x121]
xor ecx, ecx
mov edx, 0x105
call fcn.00402d24
push 0x104
lea eax, [ebp - 0x121]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x121]
mov ecx, 0x105
call fcn.00404330
mov eax, dword [ebp - 0x12c]
lea edx, [ebp - 0x128]
call fcn.0040cfa4
mov edx, dword [ebp - 0x128]
lea eax, [ebp - 0xc]
mov ecx, 0x48a7c0
call fcn.004043cc
lea eax, [ebp - 0x130]
mov ecx, dword [ebp - 0xc]
mov edx, 0x48a7d8
call fcn.004043cc
mov eax, dword [ebp - 0x130]
call fcn.004832d0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404580
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test bx, bx
jne 0x48a6d8
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax], edx
jmp 0x48a781
xor eax, eax
push ebp
push 0x48a770
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, bx
call fcn.004026ec
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x48a75f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
push eax
movzx eax, bx
push eax
push 0
push edi
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x48a800
mov eax, dword [ebp - 0x14]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x48a749
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
call fcn.004070a4
movzx eax, ax
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 8]
mov dword [esi], eax
mov byte [ebp - 5], 0xff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a766
mov eax, dword [ebp - 0x14]
call fcn.0040270c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a7ae
lea eax, [ebp - 0x130]
mov edx, 3
call fcn.004040e4
lea eax, [ebp - 0xc]
call fcn.004040c0
ret
Function at 0x48d610
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x48d6e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
mov eax, esi
call fcn.004040c0
mov eax, 0x104
call fcn.004083a4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48d6c4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x10]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x14]
call fcn.00402c08
mov edx, 0x48d6f4
lea eax, [ebp - 0x14]
mov cl, 2
call fcn.00402bd8
lea edx, [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.00404324
mov eax, dword [ebp - 0xc]
call fcn.00404580
push eax
call sub.kernel32.dll_QueryDosDeviceA
test eax, eax
jbe 0x48d6ae
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.004042b8
mov byte [ebp - 1], 0xff
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d6cb
mov eax, dword [ebp - 8]
call fcn.0040270c
ret

Function at 0x48d6f8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404570
xor eax, eax
push ebp
push 0x48d7bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004040c0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040cfa4
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00404158
mov ebx, 0x104
mov eax, ebx
call fcn.004083a4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x48d798
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404580
push eax
call sub.kernel32.dll_GetVolumeNameForVolumeMountPointA
test eax, eax
jne 0x48d778
call fcn.00403b8c
jmp 0x48d79f
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.004042b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d79f
mov eax, dword [ebp - 8]
call fcn.0040270c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d7c4
lea eax, [ebp - 0xc]
call fcn.004040c0
lea eax, [ebp - 4]
call fcn.004040c0
ret
Function at 0x4914a4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x4d6798]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4d6798]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4d6798]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4d6798]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4d631c]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x4914cf
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x49159c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x4d6798]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4d6798]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4d6798]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4d6798]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4d631c]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x4915d7
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4916b8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4d6798]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4d6798]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4d6798]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4d6798]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4d631c]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
xor ecx, ecx
mov cl, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + 0x4d6798]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4d6798]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4d6798]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4d6798]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x491703
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x49d13c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404af8
lea eax, [ebp - 8]
call fcn.00404af8
xor eax, eax
push ebp
push 0x49d265
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004047a0
mov eax, dword [ebp - 4]
call fcn.00404914
add eax, eax
call fcn.004083a4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x49d243
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404914
test eax, eax
jle 0x49d1bc
mov eax, dword [ebp - 4]
call fcn.00404914
add eax, eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404904
mov edx, dword [ebp - 0x10]
pop ecx
call fcn.004028e8
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.004049e4
jne 0x49d1d5
lea eax, [ebp - 8]
mov edx, 0x49d278
call fcn.00404800
xor edi, edi
mov eax, dword [ebp - 4]
call fcn.00404914
mov esi, eax
add esi, esi
dec esi
test esi, esi
jl 0x49d216
inc esi
xor ebx, ebx
mov eax, dword [ebp - 8]
call fcn.00404914
push eax
mov eax, edi
pop edx
mov ecx, edx
cdq
idiv ecx
inc edx
mov eax, dword [ebp - 8]
mov ax, word [eax + edx*2 - 2]
mov edx, dword [ebp - 0x10]
xor al, byte [edx + ebx]
mov edx, dword [ebp - 0x10]
mov byte [edx + ebx], al
inc edi
inc ebx
dec esi
jne 0x49d1eb
mov eax, dword [ebp - 4]
call fcn.00404914
mov edx, eax
add edx, edx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.0049d3f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d24a
mov eax, dword [ebp - 0x10]
call fcn.0040270c
ret
Function at 0x49d28c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
call fcn.00404af8
lea eax, [ebp - 8]
call fcn.00404af8
xor eax, eax
push ebp
push 0x49d3cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.004047a0
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0049d4e4
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x49d3aa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.004049e4
jne 0x49d2fe
lea eax, [ebp - 8]
mov edx, 0x49d3e0
call fcn.00404800
xor edi, edi
mov esi, dword [ebp - 0x14]
dec esi
test esi, esi
jl 0x49d336
inc esi
xor ebx, ebx
mov eax, dword [ebp - 8]
call fcn.00404914
push eax
mov eax, edi
pop edx
mov ecx, edx
cdq
idiv ecx
inc edx
mov eax, dword [ebp - 8]
mov ax, word [eax + edx*2 - 2]
mov edx, dword [ebp - 0x10]
xor al, byte [edx + ebx]
mov edx, dword [ebp - 0x10]
mov byte [edx + ebx], al
inc edi
inc ebx
dec esi
jne 0x49d30b
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
call fcn.00404ab4
cmp dword [ebp - 0x14], 0
jbe 0x49d374
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00404904
mov edx, dword [ebp - 0x14]
add edx, edx
xor ecx, ecx
call fcn.00402d24
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00404904
mov edx, eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.004028e8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00404904
push eax
call sub.kernel32.dll_lstrlenW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00404ab4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49d3b1
cmp dword [ebp - 0x10], 0
je 0x49d3a9
mov eax, dword [ebp - 0x10]
call fcn.0040270c
ret