joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a5f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x524f40
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x10]
push eax
call fcn.0046a050
mov dword [ebp - 4], 0
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or edi, 0xffffffff
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46a654
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, esi
call fcn.00468de0
mov ecx, esi
call fcn.0046a460
lea ecx, [ebp - 0x10]
push ecx
mov ecx, esi
call fcn.00469020
mov dword [ebp - 4], 2
push eax
call fcn.00469380
add esp, 4
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
lock xadd dword [edx], edi
dec edi
test edi, edi
jg 0x46a69c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [0x589088]
push 0
push 0
push 8
call fcn.00432430
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x46bcc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0xf
sub eax, edi
or eax, ecx
jge 0x46bd2b
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46bd3c
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x1e], dx
mov ecx, 0x53bc60
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46bd50
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46bd32
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x1e], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46bd90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0xb
sub eax, edi
or eax, ecx
jge 0x46bdfb
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46be0c
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x16], dx
mov ecx, 0x53bcc0
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46be20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46be02
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x16], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46be60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov edi, 0x10
sub eax, edi
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
sub eax, edi
or eax, ecx
jge 0x46becd
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46bede
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x20], dx
mov ecx, 0x53bcd8
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46bef2
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46bed4
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x20], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46bf30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0x16
sub eax, edi
or eax, ecx
jge 0x46bf9b
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46bfac
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x2c], dx
mov ecx, 0x53bcf8
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46bfc0
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46bfa2
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x2c], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46c000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0x17
sub eax, edi
or eax, ecx
jge 0x46c06b
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46c07c
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x2e], dx
mov ecx, 0x53bd24
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46c090
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46c072
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x2e], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46c0d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0x12
sub eax, edi
or eax, ecx
jge 0x46c13b
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46c14c
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x24], dx
mov ecx, 0x53bd54
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46c160
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46c142
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x24], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46c1a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0x26
sub eax, edi
or eax, ecx
jge 0x46c20b
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46c21c
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x4c], dx
mov ecx, 0x53bd78
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46c230
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46c212
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x4c], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46c270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0x2c
sub eax, edi
or eax, ecx
jge 0x46c2db
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46c2ec
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x58], dx
mov ecx, 0x53bdc8
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46c300
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46c2e2
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x58], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46c340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0x11
sub eax, edi
or eax, ecx
jge 0x46c3ab
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46c3bc
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x22], dx
mov ecx, 0x53be20
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46c3d0
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46c3b2
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x22], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46c410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0x16
sub eax, edi
or eax, ecx
jge 0x46c47b
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46c48c
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x2c], dx
mov ecx, 0x53be44
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46c4a0
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46c482
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x2c], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46c4e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0x12
sub eax, edi
or eax, ecx
jge 0x46c54b
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46c55c
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x24], dx
mov ecx, 0x53be70
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46c570
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46c552
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x24], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46c5b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0x26
sub eax, edi
or eax, ecx
jge 0x46c61b
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46c62c
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x4c], dx
mov ecx, 0x53be98
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46c640
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46c622
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x4c], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46c680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0x2c
sub eax, edi
or eax, ecx
jge 0x46c6eb
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46c6fc
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x58], dx
mov ecx, 0x53bee8
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46c710
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46c6f2
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x58], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46c750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0x12
sub eax, edi
or eax, ecx
jge 0x46c7bb
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46c7cc
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x24], dx
mov ecx, 0x53c004
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46c7e0
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46c7c2
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x24], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46c820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0xc
sub eax, edi
or eax, ecx
jge 0x46c88b
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46c89c
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x18], dx
mov ecx, 0x53c028
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46c8b0
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46c892
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x18], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46c8f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0x14
sub eax, edi
or eax, ecx
jge 0x46c95b
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46c96c
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x28], dx
mov ecx, 0x53c040
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46c980
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46c962
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x28], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46ca90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x525481
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x587978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [0x587944]
mov edx, dword [eax + 0xc]
mov ecx, 0x587944
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, 1
mov dword [ebp - 0x10], ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
mov edi, 0xc
sub eax, edi
or eax, ecx
jge 0x46cafb
push edi
mov ecx, esi
call fcn.00406d20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jge 0x46cb0c
push 0x80070057
call fcn.00406170
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + 0x18], dx
mov ecx, 0x53c07c
sub ecx, eax
mov edx, edi
mov ebx, 0xe620
xor bx, word [ecx + eax]
add eax, 2
dec edx
mov word [eax - 2], bx
jne 0x46cb20
mov eax, dword [esi]
cmp dword [eax - 8], edi
jl 0x46cb02
mov dword [eax - 0xc], edi
mov eax, dword [esi]
xor ecx, ecx
mov word [eax + 0x18], cx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret