joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4855c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, edx
sub esp, 0xc
push ebx
push esi
mov dword [esp - 0x30], ebp
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
mov dword [ebp - 0xc], esi
mov edx, edx
mov ebx, dword [esi + 4]
lea eax, [ecx + 4]
mov dword [ebp - 8], eax
mov eax, dword [eax]
mov ecx, ecx
add eax, ebx
mov dword [esi + 4], eax
cmp eax, 2
mov dword [esp - 0x38], 0x7ab2449d
jbe 0x4856d0
cmp ebx, 2
jbe 0x485607
mov edi, edi
mov edi, dword [esi]
jmp 0x485609
mov edi, esi
mov ecx, 0x6133086f
mov dword [esp - 0x1c], 0x20ac000b
xor ecx, 0x6c795df9
add ecx, 0x31dcec9d
xor ecx, 0x761b8050
add ecx, 0xebace1e
xchg ebx, ebx
sub ecx, 0x57f7907f
mul ecx
pushf
mov dword [esp - 0x40], ebx
mov ecx, 0x10420069
xor ecx, 0x1e7b51c6
xor ecx, 0x1f78c296
add ecx, 0x3758bc88
mov ebp, ebp
add ecx, 0x6878de2
add ecx, 0x17c00a2f
add ecx, 0x991e182d
mov dword [esp - 0xc], ebp
popf
cmovb eax, ecx
push eax
xchg esp, esp
call fcn.00490c90
add esp, 4
mov edx, eax
mov esi, esi
mov dword [ebp - 4], edx
test ebx, ebx
je 0x4856b1
mov ecx, edx
mov dword [esp - 0xc], edx
sub edi, edx
mov edx, ebx
jmp 0x48569a
mov ax, word [edi + ecx]
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
sub edx, 1
mov dword [esp - 0x38], esi
jne 0x48569a
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
mov esi, esi
xor edi, edi
mov eax, dword [eax]
cmp eax, 2
mov dword [esp - 0x38], ebx
ja 0x4856df
test eax, eax
je 0x485782
jmp 0x4856e4
mov edx, esi
mov dword [ebp - 4], edx
mov dword [esp - 0x20], 0x3bebe0
jmp 0x4856b4
mov eax, dword [ecx]
mov dword [ebp + 8], eax
lea esi, [edx + ebx*2]
mov dword [esp - 0x2c], 0x6e13b306
jmp 0x4856f8
lea ecx, [edi + ebx]
mov edx, 0x50798846
add edx, 0x1327db8f
mov dword [esp - 0x2c], ecx
sub edx, 0x420948fb
add edx, 0x573d91c8
xor edx, 0x17784e02
add edx, 0xbfc6251
xchg esp, esp
and ecx, 3
lea esi, [esi + 2]
shl ecx, 3
mov dword [esp - 0x30], edi
mov eax, 0x70acfd01
xor eax, 0x4ae9b665
xor eax, 0x1c8b3420
xchg edx, edx
add eax, 0x2025e3b4
add eax, 0x34b5e1f9
sar edx, cl
mov ecx, edi
mov edi, edi
and ecx, 3
shl ecx, 3
sar eax, cl
mov ecx, dword [ebp + 8]
mov ebp, ebp
xor dl, al
movsx ax, dl
xor ax, word [ecx + edi*2]
mov dword [esp - 0x14], edx
inc edi
mov word [esi - 2], ax
mov eax, dword [ebp - 8]
cmp edi, dword [eax]
mov edi, edi
jb 0x4856f8
mov esi, dword [ebp - 0xc]
cmp ebx, 2
jbe 0x485795
xchg edx, edx
push dword [esi]
call fcn.00490c60
add esp, 4
xchg ebp, ebp
cmp dword [esi + 4], 2
jbe 0x4857a4
mov eax, dword [ebp - 4]
mov dword [esp - 0x28], ebx
mov dword [esi], eax
pop edi
mov eax, esi
pop esi
xchg esi, esi
pop ebx
mov esp, ebp
pop ebp
mov dword [esp - 0x38], 0xa50304a
ret 4
Function at 0x4857c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, ebx
push esi
mov esi, dword [ebp + 8]
push edi
xchg ecx, ecx
mov edi, ecx
mov dword [ebp - 0xc], edi
lea edx, [esi + 2]
mov ecx, dword [edi + 4]
mov dword [esp - 0x18], 0x6dd1c437
mov dword [ebp - 8], ecx
lea ebx, [ebx]
mov ax, word [esi]
add esi, 2
xchg ebx, ebx
test ax, ax
jne 0x4857ec
sub esi, edx
mov dword [esp - 0x44], 0x7971f2c
sar esi, 1
lea eax, [ecx + esi]
mov dword [edi + 4], eax
cmp eax, 2
mov dword [esp - 0x30], 0x51be16e4
jbe 0x4858cf
cmp ecx, 2
jbe 0x485827
mov ebx, dword [edi]
mov esi, esi
jmp 0x485829
mov ebx, edi
mov ecx, 0x1dd1caa6
add ecx, 0x20638883
mov dword [esp - 0x40], 0x5cc54083
xor ecx, 0x14316af6
xor ecx, 0x7502d8d2
sub ecx, 0x24667590
mov dword [esp - 0x30], edi
sub ecx, 0x3aa06b7b
mul ecx
pushf
mov ecx, 0x29b43f8b
mov ebp, ebp
add ecx, 0x3980227a
add ecx, 0x1bd88213
add ecx, 0x3508d5
add ecx, 0x80be1312
mov edx, edx
popf
cmovb eax, ecx
push eax
call fcn.00490c90
mov dword [esp - 0x3c], 0x3bf09eca
mov ecx, eax
add esp, 4
mov eax, dword [ebp - 8]
mov dword [esp - 0x34], 0x1b1e9baf
mov dword [ebp - 4], ecx
test eax, eax
je 0x4858d4
sub ebx, ecx
xchg ebx, ebx
mov edx, eax
lea ecx, [ecx]
mov ax, word [ebx + ecx]
lea ecx, [ecx + 2]
mov dword [esp - 0x1c], 0x1c169d7c
mov word [ecx - 2], ax
sub edx, 1
jne 0x4858b0
xchg edi, edi
mov ecx, dword [ebp - 4]
jmp 0x4858d4
mov ecx, edi
mov dword [ebp - 4], edi
xor edx, edx
test esi, esi
mov edi, edi
je 0x485940
mov edi, dword [ebp - 8]
lea ebx, [ecx + edi*2]
mov dword [esp - 0x14], ecx
jmp 0x4858f0
lea ecx, [edx + edi]
mov eax, 0x57005e5c
mov dword [esp - 0xc], esi
sub eax, 0x4e6e1ea
sub eax, 0xdcc81e
sub eax, 0x4ab913f1
xchg esi, esi
add eax, 0x7526a48e
and ecx, 3
lea ebx, [ebx + 2]
mov dword [esp - 0x28], 0x7cc7fa65
shl ecx, 3
sar eax, cl
mov ecx, dword [ebp + 8]
xchg esi, esi
cbw
xor ax, word [ecx + edx*2]
inc edx
mov word [ebx - 2], ax
mov dword [esp - 0x3c], ebx
cmp edx, esi
jb 0x4858f0
mov edi, dword [ebp - 0xc]
cmp dword [ebp - 8], 2
mov dword [esp - 0x14], esi
jbe 0x485956
push dword [edi]
call fcn.00490c60
add esp, 4
mov edi, edi
cmp dword [edi + 4], 2
mov eax, edi
jbe 0x485965
mov edx, dword [ebp - 4]
xchg ebx, ebx
mov dword [edi], edx
pop edi
pop esi
pop ebx
mov dword [esp - 0xc], 0x2b00998c
mov esp, ebp
pop ebp
ret 4
Function at 0x485b60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xchg ebp, ebp
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [esi], 0x7b73be18
mov ebp, ebp
sub dword [esi], 0x58d14aef
add dword [esi], 0x5ac5e6f9
add dword [esi], 0x521670
sub dword [esi], 0x7dba7092
xchg edx, edx
mov dword [esi + 4], 0x31a54797
sub dword [esi + 4], 0x35c5227
add dword [esi + 4], 0x675f14e
add dword [esi + 4], 0x3b1a7588
mov edi, edi
sub dword [esi + 4], 0x6fd95c46
mov eax, dword [ecx + 4]
cmp edx, eax
mov ebp, ebp
jae 0x485d3d
cmp eax, 2
jbe 0x485bcb
mov dword [esp - 0x40], esi
mov ecx, dword [ecx]
lea ecx, [ecx + edx*2]
sub eax, edx
mov dword [esp - 0x28], 0x517921ee
mov dword [ebp + 8], ecx
mov ecx, dword [ebp + 0x10]
cmp eax, ecx
push ebx
mov dword [esp - 0x38], 0x53786ead
cmovb ecx, eax
mov ebx, esi
mov dword [esi + 4], ecx
cmp ecx, 2
xchg ebp, ebp
jbe 0x485c77
mov eax, ecx
mov ecx, 0x77a6b56c
sub ecx, 0x355c41ad
mov dword [esp - 0x1c], ecx
add ecx, 0x335b4275
sub ecx, 0x6cc7cb1
add ecx, 0x946740b
sub ecx, 0x781fad8c
xchg edi, edi
mul ecx
pushf
mov ecx, 0x2320a3e
add ecx, 0x763c42a9
mov dword [esp - 0x40], ecx
sub ecx, 0x5a8c7ad5
add ecx, 0x20b73bc8
sub ecx, 0x192fb234
xor ecx, 0x7068d1fd
mov dword [esp - 0x40], ebp
add ecx, 0xaafe75a4
popf
cmovb eax, ecx
push eax
xchg esi, esi
call fcn.00490c90
mov edx, dword [ebp + 0xc]
mov ebx, eax
mov dword [esp - 0x40], 0x335f7b6d
add esp, 4
mov dword [esi], ebx
push edi
xor edi, edi
xchg edi, edi
cmp dword [esi + 4], edi
jbe 0x485d2a
sub dword [ebp + 8], ebx
lea ecx, [edi + edx]
mov dword [esp - 0x20], ecx
mov eax, 0x4f78dfda
add eax, 0x1c0571b2
sub eax, 0x5f1b3354
mov dword [esp - 0x30], 0x47dd0c36
xor eax, 0xa70a51e
add eax, 0x2e79fd37
xor eax, 0x4f27fcac
mov edx, edx
and ecx, 3
lea ebx, [ebx + 2]
shl ecx, 3
mov dword [esp - 0x38], 0x73b6afb2
mov edx, 0x35f99787
add edx, 0x6a5a1a8
add edx, 0x30e6f7c7
xor edx, 0x211bcec6
mov dword [esp - 0x14], esi
sub edx, 0x44df8f17
xor edx, 0x7c142be8
sar edx, cl
mov dword [esp - 0x1c], 0x7d45d0f6
mov ecx, edi
and ecx, 3
inc edi
shl ecx, 3
xchg ecx, ecx
sar eax, cl
xor dl, al
mov eax, dword [ebp + 8]
mov ebp, ebp
movsx cx, dl
mov edx, dword [ebp + 0xc]
xor cx, word [ebx + eax - 2]
mov word [ebx - 2], cx
mov dword [esp - 0x20], ecx
cmp edi, dword [esi + 4]
jb 0x485c88
pop edi
mov dword [esp - 0x44], 0x4ad7b61b
pop ebx
mov eax, esi
pop esi
mov ebp, ebp
pop ebp
ret 0xc
mov eax, esi
pop esi
pop ebp
mov dword [esp - 0x30], esp
ret 0xc
Function at 0x485de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov dword [esp - 0x14], 0x3da6e652
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 0xc]
mov esi, esi
push edi
mov eax, dword [ebx]
cmp esi, 7
ja case.default.0x485e03
mov dword [esp - 0x44], ecx
jmp dword [esi*4 + 0x486026]
mov ecx, edx
and ecx, 3
sub esi, ecx
sub ecx, 1
xchg esi, esi
je 0x485e60
sub ecx, 1
je 0x485e47
mov ebp, ebp
sub ecx, 1
jne 0x485e75
movzx ecx, byte [edx]
xor ecx, eax
mov dword [esp - 0x30], 0x5d62c88d
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4c11b8]
mov dword [esp - 0x24], 0x7fcdd229
inc edx
movzx ecx, byte [edx]
xor ecx, eax
shr eax, 8
mov dword [esp - 0x18], ebx
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4c11b8]
inc edx
xchg edi, edi
movzx ecx, byte [edx]
xor ecx, eax
shr eax, 8
xchg edi, edi
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4c11b8]
inc edx
mov edi, esi
xchg edi, edi
shr edi, 3
test edi, edi
je 0x485f27
xor eax, dword [edx]
xchg esi, esi
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4c11b8]
mov dword [esp - 0x40], 0x1b6d54d8
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4c11b8]
movzx ecx, al
mov dword [esp - 0x1c], ebp
shr eax, 8
xor eax, dword [ecx*4 + 0x4c11b8]
movzx ecx, al
shr eax, 8
mov dword [esp - 0x20], ecx
xor eax, dword [ecx*4 + 0x4c11b8]
xor eax, dword [edx + 4]
add edx, 8
movzx ecx, al
mov ebp, ebp
shr eax, 8
xor eax, dword [ecx*4 + 0x4c11b8]
movzx ecx, al
mov dword [esp - 0x30], edx
shr eax, 8
xor eax, dword [ecx*4 + 0x4c11b8]
movzx ecx, al
shr eax, 8
mov dword [esp - 0xc], 0x30e5a829
xor eax, dword [ecx*4 + 0x4c11b8]
movzx ecx, al
shr eax, 8
mov ecx, ecx
xor eax, dword [ecx*4 + 0x4c11b8]
sub edi, 1
jne 0x485e84
mov dword [esp - 0x1c], 0x54f941ce
and esi, 7
jmp 0x485dfa
movzx ecx, byte [edx]
xor ecx, eax
mov dword [esp - 0x10], edi
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4c11b8]
inc edx
mov dword [esp - 0x10], edx
movzx ecx, byte [edx]
xor ecx, eax
shr eax, 8
movzx ecx, cl
mov dword [esp - 0x14], ebp
xor eax, dword [ecx*4 + 0x4c11b8]
inc edx
movzx ecx, byte [edx]
xor ecx, eax
mov dword [esp - 0x18], 0x3f137092
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4c11b8]
inc edx
mov ebp, ebp
xor eax, dword [edx]
movzx ecx, al
shr eax, 8
pop edi
mov dword [esp - 0x14], edi
pop esi
xor eax, dword [ecx*4 + 0x4c11b8]
movzx ecx, al
mov edx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x4c11b8]
movzx ecx, al
shr eax, 8
xchg esp, esp
xor eax, dword [ecx*4 + 0x4c11b8]
movzx ecx, al
shr eax, 8
mov ebx, ebx
xor eax, dword [ecx*4 + 0x4c11b8]
mov dword [ebx], eax
pop ebx
pop ebp
xchg ebx, ebx
ret 8
movzx ecx, byte [edx]
xor ecx, eax
mov dword [esp - 0x1c], 0x1b0db121
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4c11b8]
mov esp, esp
inc edx
movzx ecx, byte [edx]
xor ecx, eax
mov edi, edi
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4c11b8]
mov dword [esp - 0x1c], ebx
inc edx
movzx ecx, byte [edx]
xor ecx, eax
shr eax, 8
mov ecx, ecx
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4c11b8]
pop edi
mov dword [esp - 0x40], edi
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
mov dword [esp - 0x20], ebp
ret 8
Function at 0x486050
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4c11bc], 0
jne 0x486156
xor edx, edx
nop
mov dword [esp - 0x38], 0x38b6172c
mov ecx, edx
mov eax, edx
and ecx, 1
shr eax, 1
mov dword [esp - 0x14], edx
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov dword [esp - 0x24], ebx
mov eax, ecx
shr ecx, 1
and eax, 1
mov dword [esp - 0x14], edi
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov dword [esp - 0x1c], ecx
shr eax, 1
and ecx, 1
neg ecx
mov dword [esp - 0x2c], 0x51036258
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [esp - 0x28], 0x15f2fe30
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [esp - 0x24], 0x1924a34c
xor eax, ecx
mov ecx, eax
shr eax, 1
mov dword [esp - 0x20], edx
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
xchg ebp, ebp
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
mov dword [esp - 0x1c], 0x2f0b71aa
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov ebx, ebx
shr eax, 1
and ecx, 1
neg ecx
mov dword [esp - 0x3c], ebp
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov dword [esp - 0xc], ebp
shr ecx, 1
and eax, 1
neg eax
mov dword [esp - 0xc], 0xa759fa4
and eax, 0xedb88320
xor eax, ecx
mov dword [edx*4 + 0x4c11b8], eax
mov dword [esp - 0x14], 0x7d5eb9f8
inc edx
cmp edx, 0x100
jb 0x486068
mov dword [esp - 0x38], ebx
ret
Function at 0x486c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [esp - 0x34], 0x8d0e958
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xchg edx, edx
mov edi, esi
mov dword [ebp - 4], ecx
shr edi, 2
mov ecx, 0x18f09b57
mov ebp, ebp
sub ecx, 0x2e6fc78
sub ecx, 0x2994233
add ecx, 0x3a274ded
mov ebp, ebp
xor ecx, 0x4d97aa9d
mov eax, edi
mul ecx
xchg esp, esp
pushf
mov ecx, 0x7bf97cbf
sub ecx, 0x6cd7a86b
mov esp, esp
add ecx, 0xeefdb
add ecx, 0x552b9f25
add ecx, 0x9ba39cab
mov dword [esp - 0x18], edi
popf
cmovb eax, ecx
push eax
call fcn.00490c90
mov dword [esp - 0x1c], 0x20239ee0
add esp, 4
mov ebx, eax
push esi
mov dword [esp - 0x34], 0x13f1aef9
mov esi, dword [ebp - 4]
push ebx
lea ecx, [esi + 4]
call fcn.0047b0e0
xchg edx, edx
test al, al
je 0x486d0a
mov esi, dword [esi]
mov dword [esp - 0x1c], 0x45f9b5e1
test edi, edi
je 0x486ce0
mov eax, dword [ebp + 8]
mov edx, ebx
mov dword [esp - 0x10], 0x42df4dab
sub edx, eax
lea esp, [esp]
mov ecx, dword [eax + edx]
mov ebx, ebx
lea eax, [eax + 4]
xor ecx, esi
mov dword [eax - 4], ecx
sub edi, 1
xchg ebx, ebx
jne 0x486ccc
push ebx
call fcn.00490c60
add esp, 4
mov dword [esp - 0x10], 0x3871896a
mov al, 0x44
xor al, 0x7c
add al, 0x19
sub al, 0x4a
xchg esp, esp
xor al, 6
pop edi
pop esi
mov ebp, ebp
pop ebx
mov esp, ebp
pop ebp
xchg edi, edi
ret 8
push ebx
call fcn.00490c60
add esp, 4
mov dword [esp - 0x30], 0x49d31448
xor al, al
pop edi
pop esi
mov edx, edx
pop ebx
mov esp, ebp
pop ebp
mov dword [esp - 0x38], 0x1d1be459
ret 8

Function at 0x486d30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xchg esp, esp
push ecx
push ebx
push esi
mov ebp, ebp
mov esi, dword [ebp + 0xc]
mov ebx, ecx
shr esi, 2
mov ecx, 0x5825cc78
mov esi, esi
xor ecx, 0x7eeba017
add ecx, 0x55f84b86
sub ecx, 0x791df18
mov dword [esp - 0x30], esp
sub ecx, 0x7534d8d9
mov eax, esi
mov dword [ebp - 4], ebx
xchg edi, edi
mul ecx
pushf
mov ecx, 0x40e02954
xor ecx, 0x6414847f
xchg esi, esi
add ecx, 0x2ad9cb8e
xor ecx, 0x683566e6
xor ecx, 0x76a0792e
add ecx, 0xaea4988e
mov ebx, ebx
popf
push edi
cmovb eax, ecx
push eax
xchg edx, edx
call fcn.00490c90
mov ebx, dword [ebx]
add esp, 4
mov edi, eax
mov dword [esp - 0x1c], ecx
test esi, esi
je 0x486dd8
mov edx, dword [ebp + 8]
mov ecx, edi
mov ecx, ecx
sub edx, edi
jmp 0x486dc2
mov eax, dword [ecx + edx]
lea ecx, [ecx + 4]
xchg ebp, ebp
xor eax, ebx
mov dword [ecx - 4], eax
sub esi, 1
jne 0x486dc2
mov dword [esp - 0x1c], esi
push dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
push edi
add ecx, 4
xchg esi, esi
call fcn.0047b680
push edi
test al, al
mov dword [esp - 0x18], 0x9050a8f
je 0x486e1f
call fcn.00490c60
add esp, 4
mov dword [esp - 0x18], edx
mov al, 0x12
add al, 0x29
sub al, 0xb
xchg esi, esi
add al, 4
xor al, 0x60
xor al, 0x55
mov dword [esp - 0x1c], esp
pop edi
pop esi
pop ebx
mov esp, ebp
xchg esi, esi
pop ebp
ret 8
call fcn.00490c60
add esp, 4
xchg ebp, ebp
xor al, al
pop edi
pop esi
mov dword [esp - 0x18], ebx
pop ebx
mov esp, ebp
pop ebp
xchg edi, edi
ret 8
Function at 0x486e40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov dword [esp - 0x10], ebx
mov eax, 0xf18a37f
add eax, 0x6afcac41
xor eax, 0x2e655ddb
mov dword [esp - 0x10], 0x1d61d61a
add eax, 0x17da8ee5
xor eax, 0x6c4ab108
call fcn.00491ea0
push ebx
xchg ecx, ecx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.00491ed0
mov dword [esp - 0x1c], ecx
mov ebx, eax
mov edi, 0x5de8b12d
xor edi, 0x48b5b2e7
xchg ecx, ecx
add edi, 0x177c806
add edi, 0x549ff456
sub edi, 0x26bb14a
mov dword [esp - 0x18], ebp
sub edi, 0x93f66fe
sub edi, 0x5fc9a7de
and ebx, 0x3ff
mov dword [esp - 0x24], 0x6151b7c4
jbe 0x486ee8
call fcn.00491ed0
movzx esi, ax
shl esi, 0x10
mov dword [esp - 0x38], edx
call fcn.00491ed0
movzx eax, ax
or eax, esi
mov dword [ebp + edi*4 - 0x1008], eax
xchg ecx, ecx
inc edi
cmp edi, ebx
jb 0x486ebf
mov edi, edi
lea eax, [ebx*4]
mov ecx, 0x373f5653
sub ecx, 0x4bf85de
xor ecx, 0x869142d
mov dword [esp - 0x18], ecx
sub ecx, 0x5459294
add ecx, 0x1b1ae324
sub ecx, 0x4fec14e4
mov dword [esp - 0x44], 0x72038440
mov dword [ebp - 8], eax
mov eax, ebx
mul ecx
pushf
mov dword [esp - 0x44], ecx
mov ecx, 0x77e61eff
sub ecx, 0x14771e12
xor ecx, 0x8a24475
mov dword [esp - 0x2c], edi
sub ecx, 0x2bdb2411
sub ecx, 0x16e5aeec
add ecx, 0x538af6e5
xor ecx, 0x8368977f
mov dword [esp - 0x2c], 0x5b36fdb6
popf
cmovb eax, ecx
push eax
mov dword [esp - 0xc], 0x221105f7
call fcn.00490c90
mov edi, eax
add esp, 4
mov eax, dword [ebp - 4]
mov edx, edx
mov esi, dword [eax]
test ebx, ebx
je 0x486fac
xchg ebx, ebx
lea edx, [ebp - 0x1008]
mov ecx, edi
sub edx, edi
mov eax, dword [ecx + edx]
mov dword [esp - 0x28], 0x6af5ff48
lea ecx, [ecx + 4]
xor eax, esi
mov dword [ecx - 4], eax
sub ebx, 1
xchg ebx, ebx
jne 0x486f8f
mov eax, dword [ebp - 4]
push dword [ebp - 8]
lea ecx, [eax + 4]
mov dword [esp - 0x14], 0x57960c46
push edi
call fcn.0047b680
push edi
xchg edi, edi
mov bl, al
call fcn.00490c60
add esp, 4
mov al, bl
mov dword [esp - 0x1c], esp
pop edi
pop esi
pop ebx
mov dword [esp - 0x40], 0x237be284
mov esp, ebp
pop ebp
ret
Function at 0x4874f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ebp, ebp
sub esp, 0x208
lea eax, [ebp - 0x208]
push esi
mov dword [esp - 0x40], ebx
push edi
sub esp, 4
mov dword [esp], 0x30c83db1
mov dword [esp - 0x34], 0x65610bee
xor dword [esp], 0x108ace0e
xor dword [esp], 0x61649c35
add dword [esp], 0x5dd7a9f
xor dword [esp], 0x4703eb2d
xchg esp, esp
push eax
mov eax, dword [0x4c0b18]
xor eax, dword [0x4c0968]
mov dword [esp - 0x3c], esi
call eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x208]
xchg ebx, ebx
lea edx, [ecx + 2]
mov dword [edi], 0x6e7d1286
sub dword [edi], 0x5c5f67c1
mov dword [esp - 0x10], 0x21960c14
add dword [edi], 0x1e1dca5f
sub dword [edi], 0x1174e20d
sub dword [edi], 0x1ec69317
mov ax, word [ecx]
mov dword [esp - 0x3c], 0x425e508d
add ecx, 2
test ax, ax
jne 0x48757d
sub ecx, edx
mov dword [esp - 0x2c], edx
mov eax, edi
sar ecx, 1
mov dword [edi + 4], ecx
cmp ecx, 2
mov dword [esp - 0x40], 0x3ff8e36e
jbe 0x487622
mov eax, ecx
mov ecx, 0x64bfcddf
mov dword [esp - 0x1c], edi
sub ecx, 0x191d12d4
xor ecx, 0x1de5be45
add ecx, 0x1d0f7de3
sub ecx, 0x7356832f
mov ebp, ebp
mul ecx
pushf
mov ecx, 0x5875bf43
mov dword [esp - 0x24], 0x77ce0bad
sub ecx, 0x4d49f532
sub ecx, 0x6b78658
add ecx, 0x1d5181c7
xor ecx, 0x64568627
mov dword [esp - 0x34], esp
add ecx, 0xba6cbc58
popf
cmovb eax, ecx
mov dword [esp - 0x30], 0x6df757a4
push eax
call fcn.00490c90
add esp, 4
mov dword [esp - 0x24], 0x311c452a
mov dword [edi], eax
xor esi, esi
cmp dword [edi + 4], esi
mov dword [esp - 0x14], 0x27b8517
jbe 0x48769b
push ebx
lea ebx, [ebp - 0x208]
sub ebx, eax
mov esp, esp
jmp 0x487641
mov ecx, esi
lea eax, [eax + 2]
and ecx, 3
xchg esp, esp
mov edx, 0x590d7a92
xor edx, 0x5948b8de
xor edx, 0x229b7ef2
mov ecx, ecx
sub edx, 0x1f7997d3
xor edx, 0x7e68d1dd
sub edx, 0xa925ee6
mov dword [esp - 0x2c], edx
xor edx, 0x9d1d2a1
shl ecx, 3
inc esi
mov dword [esp - 0x34], esp
sar edx, cl
movsx cx, dl
xor cx, word [eax + ebx - 2]
mov esp, esp
mov word [eax - 2], cx
cmp esi, dword [edi + 4]
jb 0x487641
pop ebx
xchg esi, esi
mov eax, edi
pop edi
pop esi
mov esp, ebp
xchg ebx, ebx
pop ebp
ret

Function at 0x488750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov ebx, ebx
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov ebx, ebx
push dword [ebp + 8]
call fcn.004887f0
mov esi, eax
mov dword [esp - 0x20], edi
test esi, esi
je 0x4887e4
cmp byte [esi + 4], 4
mov edi, edi
jne 0x4887e4
movzx eax, word [esi + 5]
inc eax
mov ebp, ebp
push eax
call fcn.00490c90
mov edi, eax
mov dword [esp - 0x24], ecx
add esp, 4
movzx eax, word [esi + 5]
xor edx, edx
mov byte [eax + edi], 0x23
mov edx, edx
sub byte [eax + edi], 0xe
add byte [eax + edi], 0x50
xor byte [eax + edi], 0x79
add byte [eax + edi], 0x2a
mov ebx, ebx
xor byte [eax + edi], 0x46
xor eax, eax
cmp ax, word [esi + 5]
mov dword [esp - 0xc], 0x63f102f4
jae 0x4887e4
mov eax, dword [esi + 8]
movzx ecx, dx
mov dword [esp - 0x30], 0x58832eae
inc edx
mov al, byte [eax + ecx]
xor al, 0x37
xchg esp, esp
mov byte [ecx + edi], al
cmp dx, word [esi + 5]
jb 0x4887c1
mov dword [esp - 0x18], ebx
mov eax, edi
pop edi
pop esi
xchg edx, edx
pop ebp
ret 0xc
Function at 0x48be00
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov dword [esp - 0xc], 0x244fede9
mov edi, ecx
xor esi, esi
cmp dword [edi + 4], esi
mov esp, esp
jle 0x48bef2
xor ecx, ecx
lea ecx, [ecx]
mov ebp, ebp
mov eax, dword [edi + 8]
lea ecx, [ecx + 0xc]
inc esi
mov ebp, ebp
mov dword [ecx + eax - 0xc], 0x2a637414
add dword [ecx + eax - 0xc], 0x1bf991e7
xor dword [ecx + eax - 0xc], 0x5145b756
mov dword [esp - 0x18], 0x5143f771
sub dword [ecx + eax - 0xc], 0xfb36806
add dword [ecx + eax - 0xc], 0x56b05605
sub dword [ecx + eax - 0xc], 0x34cf6e0c
mov dword [esp - 0x24], ebp
xor dword [ecx + eax - 0xc], 0x294632a0
mov eax, dword [edi + 8]
mov dword [ecx + eax - 8], 0x2f0934bd
mov ecx, ecx
add dword [ecx + eax - 8], 0x2689e89
sub dword [ecx + eax - 8], 0x1e97d818
add dword [ecx + eax - 8], 0x28b42bec
xor dword [ecx + eax - 8], 0x38e62493
mov dword [esp - 0x44], 0x6a5783a7
xor dword [ecx + eax - 8], 0x3680389
mov eax, dword [edi + 8]
mov dword [ecx + eax - 4], 0x23d13497
xor dword [ecx + eax - 4], 0x5ff490d2
mov dword [esp - 0x34], 0x3f2488d1
sub dword [ecx + eax - 4], 0x41a238c5
sub dword [ecx + eax - 4], 0xdf934ad
add dword [ecx + eax - 4], 0x1ab0b409
sub dword [ecx + eax - 4], 0x473aeadc
mov dword [esp - 0x18], esp
cmp esi, dword [edi + 4]
jl 0x48be20
push dword [edi + 8]
mov dword [edi], 0x63d8b52c
xchg esi, esi
sub dword [edi], 0x2740e7bd
add dword [edi], 0x1b7306eb
sub dword [edi], 0x3376226d
sub dword [edi], 0x2494b1ed
mov dword [esp - 0x34], 0x3317a0d
mov dword [edi + 4], 0x3cc3a717
add dword [edi + 4], 0x66f1694
sub dword [edi + 4], 0x2ef6ac7d
mov edx, edx
sub dword [edi + 4], 0x707e03
add dword [edi + 4], 0x5067b52a
sub dword [edi + 4], 0x13aeebb9
sub dword [edi + 4], 0x50845c9c
mov dword [esp - 0x2c], 0x6b662ebe
call fcn.00490c60
add esp, 4
pop edi
pop esi
mov dword [esp - 0x3c], 0x43c593e4
ret