joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43c500
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x43ca20
test edx, edx
je 0x43ca20
call fcn.0043c517
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x43ca60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0043c500
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x43cad1
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x43ca96
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x43d3e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x43d464
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x43d43c
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x43d444
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.0043d469

Function at 0x449030
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x449091
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x449074
cmp edi, 2
jb 0x449074
cmp byte [esi], cl
jne 0x449074
cmp byte [esi + 1], cl
jne 0x449074
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x66cd58]
jmp 0x449045
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x66cd58]
test edi, edi
jne 0x449045
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x4490c0
cmp cl, 0x23
jne 0x4490a7
cmp byte [esi], cl
jne 0x4490a7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x66cd58]
test cl, cl
jne 0x449098
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x4491d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x4491e4
mov dword [ebx], 0
mov edx, 0x66c7dc
call fcn.004490d0
mov esi, eax
test esi, esi
je 0x4492d2
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x4492c8
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x4492c8
push esi
call edi
mov edi, eax
add esp, 4
mov dword [ebp + 8], edi
cmp edi, 0xffffffff
je 0x4492c8
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x4492c8
mov eax, dword [0x688710]
test eax, eax
je 0x44925c
inc dword [eax + 0x370]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
je 0x4492c8
push esi
push dword [ebp + 8]
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x4492ad
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x688710]
add esp, 4
test eax, eax
je 0x44929a
dec dword [eax + 0x370]
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x4492bf
mov eax, dword [ebp + 8]
mov dword [ebx], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44b320
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x681c40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xf8]
lea edx, [ebp - 8]
push ebx
mov ebx, dword [ecx + 0x100]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 4
mov ebx, dword [ebx + eax*4 - 4]
mov dword [ebp - 8], edi
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x66cd58]
sub esi, 1
jne 0x44b353
mov eax, dword [0x688710]
not ebx
cmp dword [eax + 0x1c88], ebx
jne 0x44b382
mov dword [eax + 0x1c8c], ebx
cmp dword [eax + 0x1cc4], ebx
jne 0x44b391
mov byte [eax + 0x1cc8], 1
cmp dword [eax + 0x1c70], ebx
jne 0x44b3aa
push ecx
push edi
mov edx, 4
mov ecx, ebx
call fcn.00466ba0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005f582b
mov esp, ebp
pop ebp
ret 4
Function at 0x456710
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x681c40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
lea edx, [ebp - 8]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [0x688710]
push esi
push edi
mov esi, 4
mov edi, dword [eax + 0x1c4c]
mov eax, dword [edi + 0xf8]
mov ebx, dword [edi + 0x100]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x66cd58]
sub esi, 1
jne 0x456750
mov eax, dword [0x688710]
not ebx
cmp dword [eax + 0x1c70], ebx
jne 0x45678a
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.00466ba0
add esp, 8
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
lea ecx, [edi + 0xf8]
call fcn.00466d70
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005f582b
mov esp, ebp
pop ebp
ret
Function at 0x45be40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
cmp dword [edi + 0x30ec], 0
lea esi, [edi + 0x30f0]
je 0x45bec2
mov ecx, dword [esi + 4]
test ecx, ecx
jns 0x45be7c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
mov ecx, esi
call fcn.00467ac0
push dword [ebp + 8]
mov ecx, esi
mov dword [esi], 0
push ebx
call fcn.00449790
mov edx, dword [esi]
mov ecx, 0x68870c
push dword [edi + 0x30ec]
lea eax, [edx - 1]
neg edx
sbb edx, edx
and edx, eax
mov eax, dword [edi + 0x30f8]
test eax, eax
push edx
cmovne ecx, eax
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
mov ecx, esi
push ebx
call fcn.00449790
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45c2a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
mov dword [ebp - 4], ecx
push esi
lea esi, [ecx + 1]
push edi
test bl, bl
je 0x45c2e8
or edi, 0xffffffff
nop dword [eax]
cmp bl, 0x23
jne 0x45c2cf
cmp byte [esi], bl
jne 0x45c2cf
cmp byte [esi + 1], bl
cmove eax, edi
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
xor eax, dword [edx*4 + 0x66cd58]
test bl, bl
jne 0x45c2c0
mov ebx, dword [0x688710]
not eax
mov edi, dword [ebx + 0x30c4]
mov esi, edi
neg esi
sbb esi, esi
lea ecx, [edi + 4]
and esi, ecx
je 0x45c322
cmp dword [esi], eax
je 0x45c331
mov edx, dword [esi - 4]
mov ecx, dword [ebx + 0x30bc]
add edx, esi
add ecx, 4
xor esi, esi
add ecx, edi
cmp edx, ecx
cmovne esi, edx
test esi, esi
jne 0x45c303
mov ecx, dword [ebp - 4]
call fcn.0045c1c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x45c322
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46fcb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x46fcea
mov eax, dword [0x688710]
mov dword [esi + 4], 0
mov dword [esi], 0
test eax, eax
je 0x46fcdd
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 8], 0
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x46fd1b
mov eax, dword [0x688710]
mov dword [esi + 0x10], 0
mov dword [esi + 0xc], 0
test eax, eax
je 0x46fd0e
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x14], 0
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x46fd4c
mov eax, dword [0x688710]
mov dword [esi + 0x1c], 0
mov dword [esi + 0x18], 0
test eax, eax
je 0x46fd3f
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x46fd99
mov eax, dword [0x688710]
mov dword [esi + 0x40], 0
mov dword [esi + 0x3c], 0
test eax, eax
je 0x46fd8c
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x44], 0
mov ecx, dword [esi + 0x50]
test ecx, ecx
je 0x46fdca
mov eax, dword [0x688710]
mov dword [esi + 0x4c], 0
mov dword [esi + 0x48], 0
test eax, eax
je 0x46fdbd
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x50], 0
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x46fdfb
mov eax, dword [0x688710]
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0
test eax, eax
je 0x46fdee
dec dword [eax + 0x370]
push ecx
call edi
add esp, 4
mov dword [esi + 0x5c], 0
pop edi
lea ecx, [esi + 0x78]
pop esi
jmp fcn.004725c0
Function at 0x485560
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov ebx, edx
je 0x4855d2
mov cl, byte [ebx]
lea esi, [ebx + 1]
or eax, 0xffffffff
test cl, cl
je 0x4855a8
or edi, 0xffffffff
nop dword [eax]
cmp cl, 0x23
jne 0x48558f
cmp byte [esi], cl
jne 0x48558f
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x66cd58]
test cl, cl
jne 0x485580
mov ecx, dword [0x688710]
not eax
cmp dword [ecx + 0x1c88], eax
jne 0x4855be
mov dword [ecx + 0x1c8c], eax
cmp dword [ecx + 0x1cc4], eax
jne 0x485634
mov byte [ecx + 0x1cc8], 1
pop edi
pop esi
pop ebx
pop ebp
ret
mov edi, dword [0x688710]
xor edx, edx
mov eax, dword [edi + 0x1c4c]
mov ecx, dword [eax + 0xf8]
mov eax, dword [eax + 0x100]
push dword [eax + ecx*4 - 4]
mov ecx, ebx
call fcn.00449030
mov esi, eax
add esp, 4
cmp dword [edi + 0x1c88], esi
jne 0x48560a
mov dword [edi + 0x1c8c], esi
cmp dword [edi + 0x1cc4], esi
jne 0x485619
mov byte [edi + 0x1cc8], 1
cmp dword [edi + 0x1c70], esi
jne 0x485632
push ecx
push ebx
mov edx, 0xb
mov ecx, esi
call fcn.00466ba0
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4895d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f7d50
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x681c40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
cmp eax, ecx
mov edx, dword [esi + 0x34]
mov edi, edx
cmovb ecx, eax
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, dword [esi + 0xc]
add esp, 4
test ecx, ecx
je 0x489634
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x489645
push 0x48
push esi
call fcn.005f5c54
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x489bc0
Capabilities:
Access peb ldr_data

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f7e71
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x30
mov eax, dword [0x681c40]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x20], edi
mov esi, dword [ebx + 0x10]
mov dword [ebp - 0x28], edi
push 0
mov dword [ebp - 0x20], 0
call fcn.004a8c10
mov dword [ebp - 4], 0
mov dword [edi], vtable.CryptoPP::BaseN_Decoder.0
mov dword [edi + 4], vtable.CryptoPP::BaseN_Decoder.1.0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x30], 0xffffffff
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
push esi
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.004a9760
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.004ab2c0
mov esi, eax
push 0x14
mov byte [ebp - 4], 3
call fcn.005f5f16
mov ecx, eax
xorps xmm0, xmm0
mov eax, dword [ebx + 8]
add esp, 4
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 4], str.DecodingLookupArray
mov word [ecx + 8], 1
mov dword [ecx + 0xc], 0
mov dword [ecx], vtable.CryptoPP::AlgorithmParametersTemplate_int_const__.0
mov dword [ecx + 0x10], eax
mov byte [ebp - 4], 4
mov eax, dword [esi + 4]
mov dword [esi + 4], 0
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x24], eax
test edx, edx
je 0x489ce6
mov eax, dword [edx]
mov ecx, edx
push 1
call dword [eax]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov dword [ecx + 0xc], eax
mov edx, dword [esi + 4]
mov dword [ebp - 0x18], 0
test edx, edx
je 0x489d02
mov eax, dword [edx]
mov ecx, edx
push 1
call dword [eax]
mov ecx, dword [ebp - 0x1c]
mov dword [esi + 4], ecx
mov byte [esi + 8], 1
push esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.004ab240
mov dword [ebp - 0x20], 1
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x489d2e
mov eax, dword [ecx]
push 1
call dword [eax]
lea eax, [ebx + 0xc]
mov byte [ebp - 4], 2
push eax
push str.Log2Base
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x34], vtable.CryptoPP::NameValuePairs.0
call fcn.00497e00
push eax
mov ecx, edi
call fcn.004af120
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x489d63
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005f582b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x489d90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f7d50
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x681c40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
cmp eax, ecx
mov edx, dword [esi + 0x38]
mov edi, edx
cmovb ecx, eax
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, dword [esi + 0xc]
add esp, 4
test ecx, ecx
je 0x489de7
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x489df8
push 0x3c
push esi
call fcn.005f5c54
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x48c520
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x48c542
xor eax, eax
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax + 0x3f]
inc eax
xor byte [edx], cl
cmp eax, 3
jb 0x48c530
mov byte [esi + 4], 0
mov eax, esi
pop esi
ret
Function at 0x48ef00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
cmp byte [ebx + 0x4a], 0
je 0x48f094
movaps xmm5, xmmword [0x672f70]
lea ecx, [ebx + 8]
movaps xmm6, xmmword [0x672f90]
mov edx, 0x46
movups xmm4, xmmword [0x673020]
mov dword [ebp - 8], ecx
sub edx, ebx
push esi
mov ecx, 0x44
mov dword [ebp - 4], 0x3f
sub ecx, ebx
mov dword [ebp - 0x14], edx
push edi
mov dword [ebp - 0xc], ecx
mov edi, 0x43
sub edi, ebx
mov esi, 0x45
sub esi, ebx
mov dword [ebp - 0x10], edi
mov ecx, 0x3b
mov dword [ebp - 0x18], esi
sub ecx, ebx
xor eax, eax
sub dword [ebp - 4], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 0x1c], ecx
movd xmm0, eax
add ecx, ebx
pshufd xmm1, xmm0, 0
add edi, ebx
movd xmm0, dword [ebx - 8]
paddd xmm1, xmm6
punpcklbw xmm0, xmm0
add eax, 0x10
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm3, edi
xorps xmm1, xmm0
mov edi, dword [ebp - 0x10]
andps xmm1, xmm4
movd xmm0, ecx
mov ecx, dword [ebp - 4]
packuswb xmm1, xmm1
add ecx, ebx
packuswb xmm1, xmm1
movd dword [ebx - 8], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx - 4]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edx + ebx]
packuswb xmm1, xmm1
lea edx, [esi + ebx]
mov esi, dword [ebp - 0xc]
packuswb xmm1, xmm1
add esi, ebx
movd dword [ebx - 4], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [ebx]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
movd xmm2, ecx
xorps xmm1, xmm0
mov ecx, dword [ebp - 0x1c]
andps xmm1, xmm4
movd xmm0, edx
mov edx, dword [ebp - 0x14]
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [ebx], xmm1
movd xmm0, dword [ebx + 4]
punpcklbw xmm0, xmm0
movd xmm1, esi
mov esi, dword [ebp - 0x18]
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [ebx + 4], xmm3
add ebx, 0x10
cmp eax, 0x40
jb 0x48ef74
mov ebx, dword [ebp - 0x20]
pop edi
pop esi
cmp eax, 0x49
jae 0x48f090
lea edx, [ebx + eax]
lea ecx, [eax + 0x3f]
inc eax
xor byte [edx], cl
cmp eax, 0x49
jb 0x48f082
mov byte [ebx + 0x4a], 0
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f0a0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, edx
push edi
mov edi, ecx
cmp byte [esi + 0x15], 0
je 0x48f182
movd xmm0, dword [esi]
mov eax, 0x10
movups xmm2, xmmword [0x673020]
movaps xmm1, xmmword [0x672f90]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
movd xmm0, dword [esi + 4]
movaps xmm1, xmmword [0x672fa0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 4], xmm1
movd xmm0, dword [esi + 8]
movaps xmm1, xmmword [0x672fb0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 8], xmm1
movd xmm0, dword [esi + 0xc]
movaps xmm1, xmmword [0x672fc0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 0xc], xmm1
nop dword [eax + eax]
lea edx, [esi + eax]
lea ecx, [eax + 0x3f]
inc eax
xor byte [edx], cl
cmp eax, 0x14
jb 0x48f170
mov byte [esi + 0x15], 0
mov edx, esi
mov ecx, edi
call fcn.004981b0
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x491890
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1b], 0
je 0x491969
movd xmm0, dword [esi]
mov eax, 0x10
movups xmm2, xmmword [0x673020]
movaps xmm1, xmmword [0x672f90]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi], xmm1
movd xmm0, dword [esi + 4]
movaps xmm1, xmmword [0x672fa0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 4], xmm1
movd xmm0, dword [esi + 8]
movaps xmm1, xmmword [0x672fb0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 8], xmm1
movd xmm0, dword [esi + 0xc]
movaps xmm1, xmmword [0x672fc0]
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
andps xmm1, xmm2
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [esi + 0xc], xmm1
lea edx, [esi + eax]
lea ecx, [eax + 0x3f]
inc eax
xor byte [edx], cl
cmp eax, 0x1a
jb 0x491957
mov byte [esi + 0x1b], 0
mov eax, esi
pop esi
ret
Function at 0x491cb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x681f56], 0
je 0x491e16
movaps xmm5, xmmword [0x672f70]
xor eax, eax
movaps xmm6, xmmword [0x672f90]
movups xmm4, xmmword [0x673020]
push esi
push edi
lea edi, [eax + 0x4e]
nop dword [eax]
movd xmm0, eax
lea ecx, [edi - 0xb]
pshufd xmm1, xmm0, 0
lea esi, [edi - 3]
movd xmm0, dword [edi + 0x681eba]
lea edx, [edi - 2]
punpcklbw xmm0, xmm0
paddd xmm1, xmm6
punpcklwd xmm0, xmm0
add eax, 0x10
psrad xmm0, 0x18
movd xmm3, esi
xorps xmm1, xmm0
movd xmm2, edi
andps xmm1, xmm4
movd xmm0, ecx
packuswb xmm1, xmm1
lea ecx, [edi - 7]
packuswb xmm1, xmm1
movd dword [edi + 0x681eba], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [edi + 0x681ebe]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
lea ecx, [edi - 1]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [edi + 0x681ebe], xmm1
pshufd xmm1, xmm0, 0
movd xmm0, dword [edi + 0x681ec2]
paddd xmm1, xmm5
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm4
punpckldq xmm3, xmm0
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [edi + 0x681ec2], xmm1
movd xmm0, dword [edi + 0x681ec6]
punpcklbw xmm0, xmm0
movd xmm1, edx
punpcklwd xmm0, xmm0
punpckldq xmm1, xmm2
punpckldq xmm3, xmm1
psrad xmm0, 0x18
xorps xmm3, xmm0
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd dword [edi + 0x681ec6], xmm3
add edi, 0x10
cmp edi, 0x8e
jb 0x491ce0
pop edi
pop esi
cmp eax, 0x4d
jae 0x491e0f
nop word [eax + eax]
lea ecx, [eax + 0x3f]
xor byte [eax + str.W4520ji____.c__], cl
inc eax
cmp eax, 0x4d
jb 0x491e00
mov byte [0x681f56], 0
mov eax, str.W4520ji____.c__
ret