joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a54d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67df04
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x70df38]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.004a56f0
lea edi, [esi + 4]
xor ebp, ebp
mov ecx, edi
mov dword [esp + 0x24], ebp
call fcn.004a5fa0
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
mov dword [edi], vtable.bdQoSProbe.0
mov dword [esi + 0x10], ecx
lea edi, [esi + 0x20]
mov ecx, edi
mov byte [esp + 0x24], 1
mov dword [esi], vtable.bdQoSProbe.1.0
mov dword [esi + 8], 0x4000
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], edx
mov dword [esi + 0x18], ebp
call fcn.004c7600
lea ecx, [esi + 0x38]
mov dword [esi + 0x30], ebp
call fcn.004a7d30
fld dword [0x6f9b34]
lea ecx, [esi + 0x60]
push ecx
fstp dword [esp]
push 4
mov byte [esp + 0x2c], 2
mov dword [esi + 0x58], ebp
mov dword [esi + 0x5c], 1
call fcn.004a41a0
fld dword [0x6f9b34]
lea ecx, [esi + 0x78]
push ecx
fstp dword [esp]
push 4
mov byte [esp + 0x2c], 3
call fcn.004a42f0
mov ecx, edi
mov byte [esp + 0x24], 4
call fcn.004c7570
mov ecx, dword [esi + 0x14]
call fcn.004a5760
mov eax, dword [esi + 8]
shr eax, 3
test eax, eax
mov dword [esp + 0x2c], eax
fild dword [esp + 0x2c]
jge 0x4a55be
fadd dword [0x6f9a18]
fmul qword [0x6f9c68]
fnstcw word [esp + 0x2c]
movzx eax, word [esp + 0x2c]
or eax, 0xc00
mov dword [esp + 0x30], eax
fldcw word [esp + 0x30]
fistp qword [esp + 0x14]
mov ecx, dword [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x14]
fldcw word [esp + 0x30]
call fcn.004a5770
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret 0xc

Function at 0x4ad31a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x70df38]
jne 0x4ad324
repz ret
jmp fcn.004bb75c
Function at 0x4af487
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x70e218]
je 0x4af4a2
inc edi
cmp edi, 0x17
jb 0x4af493
cmp edi, 0x17
jae 0x4af622
push ebp
push 3
call fcn.004b92dd
cmp eax, 1
pop ecx
je 0x4af5ee
push 3
call fcn.004b92dd
test eax, eax
pop ecx
jne 0x4af4d6
cmp dword [0x70dea0], 1
je 0x4af5ee
cmp ebx, 0xfc
je 0x4af621
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x780df8
push ebp
call fcn.004ae47c
add esp, 0xc
test eax, eax
je 0x4af50c
push esi
push esi
push esi
push esi
push esi
call fcn.004ad92f
add esp, 0x14
push 0x104
mov esi, 0x780e11
push esi
push 0
mov byte [0x780f15], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4af550
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004ae47c
add esp, 0xc
test eax, eax
je 0x4af550
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004ad92f
add esp, 0x14
push esi
call fcn.004b2c20
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4af595
push esi
call fcn.004b2c20
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x78110c
push 0x6984f4
sub ecx, eax
push ecx
push eax
call fcn.004be719
add esp, 0x14
test eax, eax
je 0x4af595
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004ad92f
add esp, 0x14
jmp 0x4af597
xor esi, esi
push 0x698ab0
push ebx
push ebp
call fcn.004b997f
add esp, 0xc
test eax, eax
je 0x4af5b7
push esi
push esi
push esi
push esi
push esi
call fcn.004ad92f
add esp, 0x14
push dword [edi*8 + 0x70e21c]
push ebx
push ebp
call fcn.004b997f
add esp, 0xc
test eax, eax
je 0x4af5d9
push esi
push esi
push esi
push esi
push esi
call fcn.004ad92f
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004be55c
add esp, 0xc
jmp 0x4af621
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x4af621
cmp ebp, 0xffffffff
je 0x4af621
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x70e21c]
push dword [esi]
call fcn.004b2c20
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4b8de3
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004af73a
xor ebx, ebx
cmp dword [0x7814cc], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4b8eb9
push 0x698f0c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
je 0x4b8f99
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push edi
call esi
cmp eax, ebx
je 0x4b8f99
push eax
call fcn.004af6cc
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x7814cc], eax
call esi
push eax
call fcn.004af6cc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x7814d0], eax
call esi
push eax
call fcn.004af6cc
mov dword [0x7814d4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004abb30
test eax, eax
pop ecx
pop ecx
je 0x4b8e87
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004ad92f
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4b8eb9
push str.GetUserObjectInformationW
push edi
call esi
push eax
call fcn.004af6cc
cmp eax, ebx
pop ecx
mov dword [0x7814dc], eax
je 0x4b8eb9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004af6cc
pop ecx
mov dword [0x7814d8], eax
mov eax, dword [0x7814d8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4b8f3e
cmp dword [0x7814dc], ecx
je 0x4b8f3e
push eax
call fcn.004af743
push dword [0x7814dc]
mov esi, eax
call fcn.004af743
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4b8f3e
cmp edi, ebx
je 0x4b8f3e
call esi
cmp eax, ebx
je 0x4b8f0b
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4b8f0b
test byte [ebp - 0x18], 1
jne 0x4b8f3e
lea eax, [ebp - 0x10]
push eax
call fcn.004abb67
test eax, eax
pop ecx
je 0x4b8f26
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004ad92f
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4b8f35
or dword [ebp + 0x10], 0x200000
jmp 0x4b8f79
or dword [ebp + 0x10], 0x40000
jmp 0x4b8f79
mov eax, dword [0x7814d0]
cmp eax, dword [ebp - 8]
je 0x4b8f79
push eax
call fcn.004af743
cmp eax, ebx
pop ecx
je 0x4b8f79
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4b8f79
mov eax, dword [0x7814d4]
cmp eax, dword [ebp - 8]
je 0x4b8f79
push eax
call fcn.004af743
cmp eax, ebx
pop ecx
je 0x4b8f79
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x7814cc]
call fcn.004af743
cmp eax, ebx
pop ecx
je 0x4b8f99
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4b8f9b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4be55c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004af73a
xor ebx, ebx
cmp dword [0x78180c], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4be632
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4be712
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x69d24c
push edi
call esi
cmp eax, ebx
je 0x4be712
push eax
call fcn.004af6cc
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x78180c], eax
call esi
push eax
call fcn.004af6cc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x781810], eax
call esi
push eax
call fcn.004af6cc
mov dword [0x781814], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004abb30
test eax, eax
pop ecx
pop ecx
je 0x4be600
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004ad92f
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4be632
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004af6cc
cmp eax, ebx
pop ecx
mov dword [0x78181c], eax
je 0x4be632
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004af6cc
pop ecx
mov dword [0x781818], eax
mov eax, dword [0x781818]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4be6b7
cmp dword [0x78181c], ecx
je 0x4be6b7
push eax
call fcn.004af743
push dword [0x78181c]
mov esi, eax
call fcn.004af743
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4be6b7
cmp edi, ebx
je 0x4be6b7
call esi
cmp eax, ebx
je 0x4be684
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4be684
test byte [ebp - 0x18], 1
jne 0x4be6b7
lea eax, [ebp - 0x10]
push eax
call fcn.004abb67
test eax, eax
pop ecx
je 0x4be69f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004ad92f
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4be6ae
or dword [ebp + 0x10], 0x200000
jmp 0x4be6f2
or dword [ebp + 0x10], 0x40000
jmp 0x4be6f2
mov eax, dword [0x781810]
cmp eax, dword [ebp - 8]
je 0x4be6f2
push eax
call fcn.004af743
cmp eax, ebx
pop ecx
je 0x4be6f2
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4be6f2
mov eax, dword [0x781814]
cmp eax, dword [ebp - 8]
je 0x4be6f2
push eax
call fcn.004af743
cmp eax, ebx
pop ecx
je 0x4be6f2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x78180c]
call fcn.004af743
cmp eax, ebx
pop ecx
je 0x4be712
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4be714
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4c7300
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x67e0f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x70df38]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call fcn.00477b90
mov esi, dword [esp + 0x38]
mov dword [esp + 0x30], 0
mov dword [esp + 0x10], 0x18
mov dword [esp + 0xc], 0
lea esp, [esp]
push 4
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
lea edx, [esp + 0x24]
push 4
push edx
mov dword [esp + 0x50], esi
call fcn.004776a0
add esp, 0x18
test al, al
jne 0x4c73a2
push str.Failed_to_serialize_ivseed.
push 0x6f8dcb
push str.dw_err
push 0x1d
push str.void___cdecl_bdCryptoUtils::calculateInitialVector_const_unsigned_int_unsigned_char__
push str.._bdCrypto_bdCryptoUtils.cpp
lea ecx, [esp + 0x30]
call fcn.00475a90
push eax
call fcn.00475c30
add esp, 0xc
cmp byte [0x77ffcc], 0
jne 0x4c7350
mov esi, dword [esp + 0x3c]
nop
lea eax, [esp + 0x10]
push eax
push esi
push 4
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x18]
call fcn.00477b00
test al, al
jne 0x4c73f7
push str.Hash_function_failed.
push 0x6f8dcb
push str.dw_err
push 0x1f
push str.void___cdecl_bdCryptoUtils::calculateInitialVector_const_unsigned_int_unsigned_char__
push str.._bdCrypto_bdCryptoUtils.cpp
lea ecx, [esp + 0x30]
call fcn.00475a90
push eax
call fcn.00475c30
add esp, 0xc
cmp byte [0x77ffcc], 0
jne 0x4c73b0
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call fcn.00477af0
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret

Function at 0x4c8a60
Capabilities:
Create tcp socket

Disassembly:
push 6
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
ret

Function at 0x4c8a70
Capabilities:
Connect socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x70df38]
xor eax, esp
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x20]
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
push ecx
mov word [esp + 4], 2
mov dword [esp + 8], eax
call dword [sym.imp.WSOCK32.dll_htons]
push 0x10
lea edx, [esp + 4]
mov word [esp + 6], ax
mov eax, dword [esp + 0x1c]
push edx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
test eax, eax
jge 0x4c8b5c
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
add eax, 0xffffd8ec
cmp eax, 0x3d
ja case.0x4c8adf.10005
movzx ecx, byte [eax + 0x4c8b88]
jmp dword [ecx*4 + 0x4c8b70]
mov eax, 0xfffffffe
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004ad31a
add esp, 0x14
ret
mov eax, 0xfffffffb
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004ad31a
add esp, 0x14
ret
mov eax, 0xfffffffa
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004ad31a
add esp, 0x14
ret
mov eax, 0xfffffff8
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004ad31a
add esp, 0x14
ret
mov eax, 0xfffffff7
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004ad31a
add esp, 0x14
ret
or eax, 0xffffffff
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004ad31a
add esp, 0x14
ret
mov ecx, dword [esp + 0x10]
xor ecx, esp
mov eax, 1
call fcn.004ad31a
add esp, 0x14
ret
Function at 0x4c8c50
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
push esi
mov esi, dword [esp + 0x114]
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], 1
call dword [sym.imp.WSOCK32.dll_select]
cmp eax, 0xffffffff
je 0x4c8cae
lea edx, [esp + 0xc]
push edx
push esi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
jne 0x4c8cae
xor al, al
pop esi
add esp, 0x10c
ret
mov al, 1
pop esi
add esp, 0x10c
ret

Function at 0x4c8cc0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x1c
mov eax, dword [0x70df38]
xor eax, esp
mov dword [esp + 0x18], eax
mov edx, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x28]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x14], 0x10
call dword [sym.imp.WSOCK32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x4c8d07
xor al, al
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004ad31a
add esp, 0x1c
ret
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 8]
call fcn.004c8620
mov ecx, dword [esp + 4]
mov dword [esi], ecx
mov ecx, dword [esp + 0x1c]
pop esi
xor ecx, esp
mov al, 1
call fcn.004ad31a
add esp, 0x1c
ret

Function at 0x4c8d30
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp esi, 0xffffffff
jne 0x4c8d41
mov eax, 0xfffffff6
pop esi
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0
push eax
push ecx
push esi
call dword [sym.imp.WSOCK32.dll_send]
mov ecx, eax
test ecx, ecx
jge 0x4c8db5
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
add eax, 0xffffd8ec
cmp eax, 0x3d
ja case.0x4c8d71.10005
movzx edx, byte [eax + 0x4c8de4]
jmp dword [edx*4 + 0x4c8dc8]
mov eax, 0xfffffff8
pop esi
ret
mov eax, 0xfffffffe
pop esi
ret
mov eax, 0xfffffff9
pop esi
ret
mov eax, 0xfffffffb
pop esi
ret
mov eax, 0xfffffffa
pop esi
ret
push esi
call fcn.004c8c50
add esp, 4
neg al
pop esi
sbb eax, eax
and eax, 6
add eax, 0xfffffff5
ret
or eax, 0xffffffff
pop esi
ret
cdq
add dword [0x781878], eax
mov eax, ecx
pop esi
adc dword [0x78187c], edx
ret

Function at 0x4c8e30
Capabilities:
Receive data
Receive data on socket

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp esi, 0xffffffff
jne 0x4c8e41
mov eax, 0xfffffff6
pop esi
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push 0
push eax
push ecx
push esi
call dword [sym.imp.WSOCK32.dll_recv]
mov ecx, eax
test ecx, ecx
jge 0x4c8eb5
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
add eax, 0xffffd8ec
cmp eax, 0x3d
ja case.0x4c8e71.10005
movzx edx, byte [eax + 0x4c8ee4]
jmp dword [edx*4 + 0x4c8ec8]
mov eax, 0xfffffffe
pop esi
ret
mov eax, 0xfffffffb
pop esi
ret
push esi
call fcn.004c8c50
add esp, 4
neg al
pop esi
sbb eax, eax
and eax, 6
add eax, 0xfffffff5
ret
mov eax, 0xfffffffa
pop esi
ret
mov eax, 0xfffffff8
pop esi
ret
mov eax, 0xfffffff7
pop esi
ret
or eax, 0xffffffff
pop esi
ret
cdq
add dword [0x781880], eax
mov eax, ecx
pop esi
adc dword [0x781884], edx
ret
Function at 0x4c8f30
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 0x14]
push 0
push 4
push eax
push ecx
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0xc]
test eax, eax
mov dword [ecx], eax
seta al
ret

Function at 0x4c8f60
Capabilities:
Resume thread

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
setne al
ret

Function at 0x4c8fa0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
push eax
call fcn.004cbb90
add esp, 4
test eax, eax
jne 0x4c9088
mov ecx, dword [esi + 4]
cmp ecx, 1
jl 0x4c908a
cmp ecx, 0x80
jg 0x4c908a
push edi
mov edi, dword [esp + 0x14]
xor edx, edx
mov eax, edi
div ecx
test edx, edx
jne 0x4c8fe4
test cl, 3
je 0x4c8fec
pop edi
mov eax, 0x10
pop esi
ret
mov edx, dword [esi]
imul edx, edx, 0x54
mov edx, dword [edx + 0x7818c0]
test edx, edx
je 0x4c9019
lea ecx, [esi + 0x88]
push ecx
mov ecx, dword [esp + 0x10]
add esi, 8
push esi
push eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
call edx
add esp, 0x14
pop edi
pop esi
ret
test edi, edi
push ebx
push ebp
je 0x4c9083
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
lea edi, [esi + 8]
lea ebx, [ebx]
xor eax, eax
test ecx, ecx
jle 0x4c9044
mov edx, dword [eax + ebp]
xor dword [edi + eax], edx
add eax, 4
cmp eax, dword [esi + 4]
jl 0x4c9036
mov ecx, dword [esi]
imul ecx, ecx, 0x54
mov edx, dword [ecx + 0x7818a4]
lea eax, [esi + 0x88]
push eax
push ebx
push edi
call edx
add esp, 0xc
test eax, eax
jne 0x4c9085
cmp dword [esi + 4], eax
jle 0x4c9074
mov ecx, dword [eax + ebx]
mov dword [edi + eax], ecx
add eax, 4
cmp eax, dword [esi + 4]
jl 0x4c9066
mov eax, dword [esi + 4]
mov ecx, eax
add ebx, eax
add ebp, eax
sub dword [esp + 0x1c], ecx
jne 0x4c9030
xor eax, eax
pop ebp
pop ebx
pop edi
pop esi
ret
mov eax, 0x10
pop esi
ret
Function at 0x4c9190
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov eax, dword [0x70df38]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
mov ebp, dword [esp + 0x2c]
push esi
mov esi, dword [esp + 0x3c]
mov eax, dword [esi]
push eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebx
call fcn.004cbb90
add esp, 4
test eax, eax
jne 0x4c91f6
mov ecx, dword [esi + 4]
cmp ecx, 1
jl 0x4c92d8
cmp ecx, 0x80
jg 0x4c92d8
push edi
mov edi, dword [esp + 0x3c]
xor edx, edx
mov eax, edi
div ecx
test edx, edx
jne 0x4c91f0
test cl, 3
je 0x4c9208
mov eax, 0x10
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004ad31a
add esp, 0x20
ret
mov ecx, dword [esi]
imul ecx, ecx, 0x54
mov ecx, dword [ecx + 0x7818c4]
test ecx, ecx
je 0x4c923d
lea edx, [esi + 0x88]
push edx
add esi, 8
push esi
push eax
push ebx
push ebp
call ecx
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004ad31a
add esp, 0x20
ret
test edi, edi
je 0x4c92c3
mov ecx, dword [esi]
imul ecx, ecx, 0x54
lea eax, [esi + 0x88]
push eax
mov eax, dword [ecx + 0x7818a8]
lea edx, [esp + 0x20]
push edx
push ebp
call eax
add esp, 0xc
test eax, eax
jne 0x4c91f5
cmp dword [esi + 4], eax
jle 0x4c92ac
lea edi, [esp + 0x1c]
mov edx, 0xfffffff8
sub edi, ebp
sub ebx, ebp
sub edx, esi
lea ecx, [esi + 8]
mov eax, ebp
mov dword [esp + 0x18], edx
mov edx, dword [edi + eax]
xor edx, dword [ecx]
mov ebp, dword [eax]
mov dword [ecx], ebp
mov dword [ebx + eax], edx
mov edx, dword [esp + 0x18]
add ecx, 4
add edx, ecx
add eax, 4
cmp edx, dword [esi + 4]
jl 0x4c9283
mov edi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x14]
mov ebx, dword [esp + 0x10]
mov eax, dword [esi + 4]
add ebp, eax
add ebx, eax
sub edi, eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], ebx
mov dword [esp + 0x3c], edi
jne 0x4c9245
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004ad31a
add esp, 0x20
ret
mov ecx, dword [esp + 0x28]
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x10
call fcn.004ad31a
add esp, 0x20
ret
Function at 0x4c9f80
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [ebp + 0xd0]
push esi
call fcn.004a8d90
add esp, 4
test eax, eax
jne 0x4ca0f3
imul esi, esi, 0x68
mov eax, dword [esi + 0x78008c]
push ebx
push edi
mov edi, dword [esi + 0x780088]
push eax
mov dword [esp + 0x1c], edi
call fcn.00475de0
push edi
mov ebx, eax
call fcn.00475de0
add esp, 8
test ebx, ebx
mov dword [esp + 0x10], eax
je 0x4ca0df
test eax, eax
je 0x4ca0cb
mov ecx, dword [esi + 0x7800dc]
push eax
push ebp
call ecx
mov edi, eax
add esp, 8
test edi, edi
jne 0x4ca0a4
cmp dword [esi + 0x78008c], eax
jbe 0x4ca01a
jmp 0x4ca000
mov edx, dword [ebp + 0x1a8]
mov cl, byte [edx + eax]
xor cl, 0x5c
mov byte [eax + ebx], cl
add eax, 1
cmp eax, dword [esi + 0x78008c]
jb 0x4ca000
mov edx, dword [esi + 0x7800d4]
push ebp
call edx
mov edi, eax
add esp, 4
test edi, edi
jne 0x4ca0a4
mov eax, dword [esi + 0x78008c]
mov ecx, dword [esi + 0x7800d8]
push eax
push ebx
push ebp
call ecx
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x4ca0a4
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x7800d8]
push edx
push eax
push ebp
call ecx
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x4ca0a4
mov edx, dword [esi + 0x7800dc]
push ebx
push ebp
call edx
mov edi, eax
add esp, 8
test edi, edi
jne 0x4ca0a4
cmp dword [esp + 0x18], eax
jbe 0x4ca09c
mov edi, dword [esp + 0x1c]
mov esi, ebx
sub esi, edi
mov ecx, dword [esp + 0x20]
cmp eax, dword [ecx]
jae 0x4ca09c
lea ecx, [eax + edi]
mov dl, byte [esi + ecx]
add eax, 1
cmp eax, dword [esp + 0x18]
mov byte [ecx], dl
jb 0x4ca083
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
xor edi, edi
mov edx, dword [ebp + 0x1a8]
push edx
call fcn.0047f960
mov eax, dword [esp + 0x14]
push eax
call fcn.0047f960
push ebx
call fcn.0047f960
add esp, 0xc
mov eax, edi
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret
push ebx
call fcn.0047f960
add esp, 4
pop edi
pop ebx
pop esi
mov eax, 0xd
pop ebp
pop ecx
ret
test eax, eax
je 0x4ca0ec
push eax
call fcn.0047f960
add esp, 4
pop edi
mov eax, 0xd
pop ebx
pop esi
pop ebp
pop ecx
ret
Function at 0x4ca100
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x18]
push ebp
call fcn.004a8d90
add esp, 4
test eax, eax
jne 0x4ca290
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, ebp
imul esi, esi, 0x68
push edi
mov edi, dword [esp + 0x2c]
test edi, edi
mov dword [ebx + 0xd0], ebp
mov eax, dword [esi + 0x780088]
mov dword [esp + 0x18], eax
jne 0x4ca14a
pop edi
pop esi
pop ebx
mov eax, 3
pop ebp
add esp, 0xc
ret
mov ecx, dword [esi + 0x78008c]
push ecx
call fcn.00475de0
add esp, 4
test eax, eax
mov dword [esp + 0x10], eax
jne 0x4ca16e
pop edi
pop esi
pop ebx
mov eax, 0xd
pop ebp
add esp, 0xc
ret
mov edx, dword [esi + 0x78008c]
push edx
call fcn.00475de0
add esp, 4
test eax, eax
mov dword [ebx + 0x1a8], eax
jne 0x4ca1a1
mov eax, dword [esp + 0x10]
push eax
call fcn.0047f960
add esp, 4
pop edi
pop esi
pop ebx
mov eax, 0xd
pop ebp
add esp, 0xc
ret
mov ecx, dword [esi + 0x78008c]
cmp edi, ecx
jbe 0x4ca1ea
mov edx, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x14]
push ecx
push eax
push edi
push edx
push ebp
call fcn.004a82b0
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x4ca26f
mov eax, dword [esi + 0x78008c]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jae 0x4ca217
sub eax, ecx
push eax
mov eax, dword [ebx + 0x1a8]
add eax, ecx
push eax
jmp 0x4ca20f
mov ecx, dword [esp + 0x28]
push edi
push ecx
push eax
call fcn.004ad5c0
mov eax, dword [esi + 0x78008c]
add esp, 0xc
cmp edi, eax
jae 0x4ca217
mov edx, dword [ebx + 0x1a8]
sub eax, edi
push eax
add edx, edi
push edx
call fcn.004cbbb0
add esp, 8
xor eax, eax
cmp dword [esi + 0x78008c], eax
jbe 0x4ca23f
mov ecx, dword [ebx + 0x1a8]
mov dl, byte [eax + ecx]
mov ecx, dword [esp + 0x10]
xor dl, 0x36
mov byte [eax + ecx], dl
add eax, 1
cmp eax, dword [esi + 0x78008c]
jb 0x4ca221
mov edx, dword [esi + 0x7800d4]
push ebx
call edx
mov edi, eax
add esp, 4
test edi, edi
jne 0x4ca26f
mov eax, dword [esi + 0x78008c]
mov ecx, dword [esp + 0x10]
mov edx, dword [esi + 0x7800d8]
push eax
push ecx
push ebx
call edx
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4ca27e
mov eax, dword [ebx + 0x1a8]
push eax
call fcn.0047f960
add esp, 4
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0047f960
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
add esp, 0xc
ret