joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x6c
mov eax, dword [0x59a024]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
mov esi, dword [esp + 0x7c]
push edi
mov edi, dword [esp + 0x78]
mov eax, dword [edi + 0x1c]
mov dword [esi], eax
mov ecx, dword [edi + 4]
mov eax, dword [esp + 0x7c]
mov dword [esi + 0x14], ecx
mov ecx, dword [esi]
mov dword [esi + 0x40], eax
mov edx, dword [edi + 0x3c]
mov dword [esi + 0x30], edx
lea edx, [esp + 8]
push edx
mov dword [esi + 0x124], 0
push eax
mov eax, dword [ecx + 0x16]
call eax
add esp, 8
test eax, eax
jne 0x41e87b
xor ecx, ecx
cmp dword [edi + 4], ecx
push ebp
sete cl
mov dword [esi + 4], edi
lea ebp, [esi + 0xb8]
mov edi, 0x3f
mov al, 0x20
mov dword [esi + 8], ecx
mov edi, edi
cmp byte [esp + edi + 0xc], al
jne 0x41e7ca
cmp byte [esp + edi + 0xb], al
jne 0x41e7bf
cmp byte [esp + edi + 0xa], al
jne 0x41e7c2
cmp byte [esp + edi + 9], al
jne 0x41e7c7
sub edi, 4
jns 0x41e7a0
jmp 0x41e7ca
dec edi
jmp 0x41e7ca
sub edi, 2
jmp 0x41e7ca
sub edi, 3
inc edi
test ebp, ebp
jne 0x41e7e1
lea edx, [edi + 1]
push edx
call fcn.00420e30
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x41e7f8
test edi, edi
je 0x41e7f4
push edi
lea eax, [esp + 0x10]
push eax
push ebp
call fcn.0040dc50
add esp, 0xc
mov byte [edi + ebp], 0
mov ecx, dword [esp + 0x6c]
xor edx, edx
and cl, 4
cmp cl, 4
sete dl
push 0xc
lea eax, [esp + 0x50]
push str.ActivCard_SA
push eax
mov dword [esi + 0x10], edx
call fcn.00409be4
add esp, 0xc
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x130], eax
mov al, byte [esp + 0x6c]
pop ebp
test al, 2
jne 0x41e85c
mov dword [esi + 0xc], 1
test al, 1
jne 0x41e860
pop edi
mov dword [esi + 0x18], 1
mov dword [esi + 0x1c], 4
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00409b58
add esp, 0x6c
ret
test al, 1
je 0x41e8c2
push 1
push esi
call fcn.0041e290
add esp, 8
test eax, eax
je 0x41e89a
cmp dword [esi + 0xc], 0
je 0x41e8c2
cmp dword [esi + 0x18], 0
jne 0x41e8c2
pop edi
mov dword [esi + 0x18], 1
mov dword [esi + 0x1c], 2
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00409b58
add esp, 0x6c
ret
mov edx, esi
call fcn.0041d870
test eax, eax
je 0x41e8c2
cmp dword [esi + 0x11c], 0
jne 0x41e8b8
mov ecx, dword [esi + 4]
mov dword [ecx + 0x60], 0x64
mov dword [esi + 0x11c], 1
mov ecx, dword [esp + 0x70]
pop edi
pop esi
xor ecx, esp
call fcn.00409b58
add esp, 0x6c
ret

Function at 0x420e00
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor cl, cl
xor eax, eax
test esi, esi
jbe 0x420e26
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov dl, byte [eax + ebp]
xor dl, byte [eax + edi]
inc eax
or cl, dl
cmp eax, esi
jb 0x420e17
pop edi
pop ebp
movzx eax, cl
pop esi
ret
Function at 0x434520
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, dword [esi + 4]
test ebp, ebp
jne 0x434531
cmp dword [esi + 0x20], ebp
jne 0x4345a8
xor eax, eax
pop ebp
ret
jle 0x4345a8
mov eax, dword [esi + 0x18]
add eax, dword [esi + 0x20]
push edi
movzx edi, byte [esi]
shl edi, 0x10
cmp ebp, 1
jle 0x43454e
movzx ecx, byte [esi + 1]
shl ecx, 8
or edi, ecx
mov ecx, dword [esi + 8]
mov dword [esi + 4], 0
test ecx, ecx
jbe 0x434574
cmp dword [esi + 0xc], ecx
jb 0x434574
mov dword [esi + 0xc], 0
mov byte [eax], 0xd
inc eax
mov byte [eax], 0xa
inc eax
add dword [esi + 0x20], 2
mov ecx, 0x12
lea esp, [esp]
mov edx, edi
shr edx, cl
inc eax
and edx, 0x3f
sub ecx, 6
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax - 1], dl
jns 0x434580
mov cl, 0x3d
pop edi
cmp ebp, 1
jne 0x4345a1
mov byte [eax - 2], cl
mov byte [eax - 1], cl
add dword [esi + 0x20], 4
mov eax, dword [esi + 0x10]
test eax, eax
je 0x43452d
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
push ecx
mov ecx, dword [esi + 0x14]
push edx
push ecx
call eax
add esp, 0xc
mov dword [esi + 0x20], 0
test eax, eax
jge 0x43452d
or eax, 0xffffffff
pop ebp
ret
Function at 0x4796e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
push edi
mov edi, dword [ebx]
push eax
call fcn.00482e50
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x47970d
pop edi
pop esi
pop ebp
mov eax, 0xb3
pop ebx
add esp, 8
ret
mov esi, dword [ebp + 0x38]
test esi, esi
je 0x47975b
cmp dword [esi], 1
jne 0x47975b
cmp dword [esi + 4], 0
je 0x47975b
mov dword [ebx], 0
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x10], 0
test ebx, ebx
jne 0x479771
mov esi, dword [esi + 0x14]
test esi, esi
jbe 0x4797ff
mov ecx, dword [esp + 0x24]
push ebp
mov dword [ecx], esi
call fcn.00484200
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push ebp
call fcn.00484200
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 0x91
pop ebx
add esp, 8
ret
cmp dword [esi + 0xc], 0
je 0x4797ef
cmp dword [esi + 0x14], 0
je 0x4797ef
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x3c]
lea eax, [esi + 0x18]
push eax
mov eax, dword [esi + 0x4c]
push edi
lea ecx, [esp + 0x20]
push ecx
push ebx
push edx
call eax
add esp, 0x18
test eax, eax
je 0x4797ac
call fcn.004207d0
call fcn.00477c10
mov dword [esp + 0x10], eax
jmp 0x4797ef
mov ecx, dword [esi + 0x10]
movzx eax, byte [ecx + ebx - 1]
cmp eax, ecx
ja 0x4797e7
test eax, eax
je 0x4797e7
xor edi, edi
test eax, eax
jbe 0x4797d9
lea ecx, [ebx + ecx - 1]
mov edx, eax
movzx ebx, byte [ecx]
xor ebx, eax
or edi, ebx
dec ecx
sub edx, 1
jne 0x4797c8
test edi, edi
jne 0x4797e7
mov edx, dword [esp + 0x14]
sub edx, eax
mov eax, dword [esp + 0x24]
mov dword [eax], edx
jmp 0x4797ef
mov dword [esp + 0x10], 0x40
push esi
call fcn.00483ff0
add esp, 4
mov dword [ebp + 0x38], 0
push ebp
call fcn.00484200
mov eax, dword [esp + 0x14]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x479820
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x20]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, dword [eax]
push ebp
call fcn.00482e50
add esp, 4
mov dword [esp + 0x14], eax
test eax, eax
jne 0x47984d
pop edi
pop ebp
mov eax, 0xb3
pop ebx
add esp, 0xc
ret
mov ebx, dword [eax + 0x38]
test ebx, ebx
je 0x47987c
cmp dword [ebx], 1
jne 0x47987c
push esi
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x14], 0
test esi, esi
jne 0x479891
mov ecx, dword [ebx + 0x10]
add ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
mov dword [edx], ecx
jmp 0x4799aa
push eax
call fcn.00484200
add esp, 4
pop edi
pop ebp
mov eax, 0x91
pop ebx
add esp, 0xc
ret
cmp dword [ebx + 0xc], 0
je 0x479909
cmp dword [ebx + 4], 0
je 0x479909
push eax
call fcn.00484200
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
push esi
push edx
push eax
push ebp
call fcn.00479560
mov ebx, eax
add esp, 0x18
test ebx, ebx
je 0x4798cc
mov ecx, dword [esp + 0x30]
mov dword [ecx], 0
mov edx, dword [esp + 0x30]
mov eax, dword [edx]
add esi, eax
sub edi, eax
lea eax, [esp + 0x18]
push eax
push esi
push ebp
mov dword [esp + 0x24], edi
call fcn.004796e0
add esp, 0xc
test eax, eax
jne 0x4798f7
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x30]
add dword [ecx], edx
test ebx, ebx
je 0x4799bb
pop esi
pop edi
pop ebp
mov eax, ebx
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
mov eax, dword [ebx + 0x3c]
push ecx
mov ecx, dword [ebx + 0x4c]
push edi
lea edx, [esp + 0x1c]
push edx
push esi
push eax
call ecx
mov edi, eax
add esp, 0x18
mov ebp, 0x40
test edi, edi
je 0x479946
call fcn.004207d0
cmp eax, 0xffffe002
je 0x479944
call fcn.00477ae0
jmp 0x479946
mov eax, ebp
mov dword [esp + 0x14], eax
test edi, edi
jne 0x47998c
cmp dword [ebx + 0xc], edi
je 0x47998c
mov edx, dword [esp + 0x10]
movzx eax, byte [edx + esi - 1]
lea ecx, [edx + esi - 1]
cmp eax, dword [ebx + 0x10]
ja 0x479988
test eax, eax
je 0x479988
xor esi, esi
test eax, eax
jbe 0x479982
mov edx, eax
movzx edi, byte [ecx]
xor edi, eax
or esi, edi
dec ecx
sub edx, 1
jne 0x479971
test esi, esi
jne 0x479988
sub dword [esp + 0x10], eax
jmp 0x47998c
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
push ebx
mov dword [eax], ecx
call fcn.00483ff0
mov edx, dword [esp + 0x1c]
add esp, 4
mov dword [edx + 0x38], 0
mov eax, dword [esp + 0x18]
push eax
call fcn.00484200
mov eax, dword [esp + 0x18]
add esp, 4
pop esi
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x487a40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x40
mov eax, dword [0x59a024]
xor eax, esp
mov dword [esp + 0x3c], eax
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x50]
push edi
push eax
push ecx
lea edx, [esp + 0x28]
push edx
xor edi, edi
call fcn.004a86b0
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x487b05
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x54]
push 3
lea ecx, [edi + 1]
mov edx, esi
call fcn.004879d0
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x487b05
jmp 0x487aa0
movzx ecx, byte [esp + eax + 0x34]
xor cl, byte [esp + eax + 0x20]
movzx edx, byte [esp + eax + 0x21]
xor dl, byte [esp + eax + 0x35]
mov byte [esp + eax + 0xc], cl
movzx ecx, byte [esp + eax + 0x22]
xor cl, byte [esp + eax + 0x36]
mov byte [esp + eax + 0xd], dl
movzx edx, byte [esp + eax + 0x23]
xor dl, byte [esp + eax + 0x37]
mov byte [esp + eax + 0xe], cl
movzx ecx, byte [esp + eax + 0x24]
xor cl, byte [esp + eax + 0x38]
mov byte [esp + eax + 0xf], dl
mov byte [esp + eax + 0x10], cl
add eax, 5
cmp eax, 0x14
jl 0x487aa0
or byte [esp + 0xc], 0x80
or byte [esp + 0x1f], 1
push 0x14
lea edx, [esp + 0x10]
push edx
push ebp
call fcn.004b1780
add esp, 0xc
mov edi, eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
test edi, edi
je 0x487be2
cmp edi, 0xfffffffc
je 0x487bc0
cmp edi, 0xfffffffd
je 0x487b9e
cmp edi, 0xfffffffe
je 0x487b7c
push 0xffffe001
call fcn.004207c0
add esp, 4
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00409b58
add esp, 0x40
ret
push 0xffffe013
call fcn.004207c0
add esp, 4
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00409b58
add esp, 0x40
ret
push 0xffffe002
call fcn.004207c0
add esp, 4
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00409b58
add esp, 0x40
ret
push 0xffffe005
call fcn.004207c0
add esp, 4
pop edi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x3c]
xor ecx, esp
call fcn.00409b58
add esp, 0x40
ret
mov ecx, dword [esp + 0x48]
pop edi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.00409b58
add esp, 0x40
ret
Function at 0x48e8f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x8c
mov ecx, dword [esp + 0x94]
and dword [esp + 0x98], 0x3fffffff
push edi
xor edi, edi
cmp dword [ecx + 8], 0x40000000
mov dword [esp + 0xc], 0x120
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], 0x122
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 0xce5363b4
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], 0xce5363b5
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], 0xce536358
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], 0xce536359
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], 0xce53635b
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], 0xce53635a
mov dword [esp + 0x64], edi
mov dword [esp + 0x68], edi
mov dword [esp + 0x6c], 0xce536360
mov dword [esp + 0x70], edi
mov dword [esp + 0x74], edi
mov dword [esp + 0x78], 0xce534369
mov dword [esp + 0x7c], edi
mov dword [esp + 0x80], edi
mov eax, ecx
je 0x48e9bc
mov eax, dword [ecx + 0x28]
cmp eax, edi
jne 0x48e9ca
xor eax, eax
pop edi
add esp, 0x8c
ret
mov edx, dword [eax + 0x2c]
cmp edx, edi
je 0x48e9d7
mov dword [esp + 4], edx
jmp 0x48e9dd
mov eax, dword [eax]
mov dword [esp + 4], eax
mov edx, dword [esp + 4]
test byte [edx + 0xc], 8
je 0x48e9c0
mov edx, dword [esp + 0x9c]
push ebx
push ebp
push esi
push 0xa
lea eax, [esp + 0x1c]
push eax
push edx
push ecx
call fcn.00485c20
add esp, 0x10
xor ebp, ebp
xor ebx, ebx
lea esi, [esp + 0x20]
lea ebx, [ebx]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x48ea34
cmp eax, edi
je 0x48ea34
push eax
mov eax, dword [esp + 0xa4]
push eax
inc ebp
call fcn.00420810
add esp, 8
mov dword [esi - 4], eax
cmp eax, edi
je 0x48ea3d
inc ebx
add esi, 0xc
cmp ebx, 0xa
jb 0x48ea10
cmp ebp, edi
je 0x48eae6
mov ebp, dword [esp + 0xa8]
mov edx, dword [esp + 0xa4]
push 0xa
lea ecx, [esp + 0x1c]
push ecx
push ebp
push edx
call fcn.00485c20
add esp, 0x10
xor ebx, ebx
lea esi, [esp + 0x20]
lea ebx, [ebx]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x48eadd
cmp eax, edi
je 0x48eadd
mov ecx, dword [esi - 4]
mov dword [esp + 0x98], eax
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0xb0]
lea eax, [esp + 0x94]
push eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x9c], ecx
mov ecx, dword [esi - 8]
push ecx
push ebp
push edx
push eax
call fcn.0048e340
add esp, 0x18
test eax, eax
jne 0x48eaf3
mov ecx, dword [esp + 0x14]
mov edx, dword [esi - 8]
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0xa8]
push edx
push ebp
push eax
push ecx
call fcn.004849f0
add esp, 0x14
test eax, eax
jne 0x48eaf3
inc ebx
add esi, 0xc
cmp ebx, 0xa
jb 0x48ea70
pop esi
pop ebp
pop ebx
xor eax, eax
pop edi
add esp, 0x8c
ret
pop esi
pop ebp
pop ebx
mov eax, 5
pop edi
add esp, 0x8c
ret
Function at 0x48eb10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x78]
push ebx
push ebp
push esi
xor esi, esi
push edi
push 7
lea eax, [esp + 0x30]
push eax
push ecx
push edx
mov dword [esp + 0x3c], 0x11
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], 0x123
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], 0x124
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], 0x125
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], 0x126
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], 0x127
mov dword [esp + 0x7c], esi
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], 0x128
mov dword [esp + 0x88], esi
mov dword [esp + 0x8c], esi
call fcn.00485c20
add esp, 0x10
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x18], esi
lea edi, [esp + 0x34]
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x48ec12
cmp eax, esi
je 0x48ec12
cmp ebp, esi
jne 0x48ebda
lea ecx, [edi - 8]
mov dword [esp + 0x10], ecx
mov ebp, ecx
cmp ebx, esi
jne 0x48ec32
mov edx, dword [esp + 0x84]
push eax
push edx
call fcn.00420810
add esp, 8
mov dword [edi - 4], eax
cmp eax, esi
jne 0x48ec1d
mov dword [esp + 0x14], 2
mov eax, dword [esp + 0x14]
cmp ebp, esi
jne 0x48ec39
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret
cmp ebp, esi
je 0x48ec1d
cmp ebx, esi
jne 0x48ec1d
lea ebx, [edi - 0x14]
mov eax, dword [esp + 0x18]
inc eax
add edi, 0xc
mov dword [esp + 0x18], eax
cmp eax, 7
jb 0x48ebc2
mov eax, esi
jmp 0x48ec02
mov eax, 5
jmp 0x48ec02
cmp ebx, esi
jne 0x48ec41
lea ebx, [esp + 0x74]
cmp eax, esi
jne 0x48ed20
mov ecx, dword [esp + 0x8c]
sub ebx, ebp
mov eax, 0x2aaaaaab
imul ebx
sar edx, 1
mov eax, edx
shr eax, 0x1f
lea ebx, [edx + eax + 1]
mov edx, dword [esp + 0x88]
push ebx
push ebp
push ecx
push edx
call fcn.00485c20
add esp, 0x10
cmp eax, esi
jne 0x48ed20
xor ebp, ebp
cmp ebx, esi
jbe 0x48eced
mov edi, dword [esp + 0x10]
add edi, 8
lea esp, [esp]
mov eax, dword [edi - 4]
mov ecx, dword [edi]
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x88]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x24]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x94]
push eax
push ecx
push edx
call fcn.0048e060
add esp, 0x10
test eax, eax
jne 0x48ed28
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 4]
mov dword [edi - 4], ecx
mov edx, dword [eax + 8]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push eax
push esi
push ecx
mov dword [edi], edx
call fcn.00412eb0
inc ebp
add esp, 0xc
add edi, 0xc
cmp ebp, ebx
jb 0x48ec90
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x88]
mov edx, dword [esp + 0x90]
mov eax, dword [edi]
push ebx
push ecx
mov ecx, dword [esp + 0x94]
and ecx, 0x3fffffff
push ecx
mov dword [edi + 0x18], edx
mov edx, dword [eax + 0x24]
push eax
call edx
add esp, 0x10
mov dword [edi + 0x18], esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret
pop edi
pop esi
pop ebp
mov eax, 5
pop ebx
add esp, 0x70
ret
Function at 0x48f8e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x3c
push ebx
push esi
push edi
xor edi, edi
mov esi, edx
mov ebx, ecx
mov dword [esp + 0xc], edi
cmp esi, edi
jne 0x48f90b
push 0xffffe005
call fcn.004207c0
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x3c
ret
cmp eax, edi
jne 0x48f926
push 0xffffe042
call fcn.004207c0
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x3c
ret
push eax
push esi
call fcn.0048f570
lea eax, [esp + 0x20]
push eax
push esi
call fcn.00554940
add esp, 0x10
test eax, eax
movzx eax, word [esp + 0x1e]
je 0x48f949
mov eax, 0x180
push ebp
push eax
push 0x10a
push esi
call fcn.00416f2e
mov esi, eax
add esp, 0xc
cmp esi, edi
jl 0x48f980
push 0x578804
push esi
call fcn.005545d1
mov ebp, eax
add esp, 8
mov dword [esp + 0x14], ebp
test ebp, ebp
jne 0x48f98b
push esi
call fcn.00411853
add esp, 4
pop ebp
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x3c
ret
push ebx
call fcn.00436d60
mov esi, eax
add esp, 4
cmp byte [esi], 0
je 0x48faa8
nop
push 0x3d
push esi
call fcn.00409ef0
push 8
push 0x565a48
push esi
mov ebx, eax
call fcn.00409be4
add esp, 0x14
test eax, eax
jne 0x48f9c6
mov dword [esp + 0x10], 1
test ebx, ebx
je 0x48fabb
mov ecx, ebx
sub ecx, esi
inc ecx
push ecx
push esi
push edi
call fcn.0048f3f0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x48faca
lea edx, [esp + 0x18]
push edx
lea eax, [ebx + 1]
push eax
call fcn.00436e00
mov edi, eax
add esp, 8
test edi, edi
je 0x48fa30
push edi
call fcn.00436d60
mov ecx, eax
add esp, 4
lea ebp, [ecx + 1]
lea ecx, [ecx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x48fa10
sub ecx, ebp
push ecx
push eax
push esi
call fcn.0048f3f0
push edi
mov esi, eax
call fcn.00420770
mov ebp, dword [esp + 0x24]
add esp, 0x10
test esi, esi
je 0x48faca
push 1
push 0x596160
push esi
call fcn.0048f3f0
mov ecx, dword [esp + 0x24]
mov edi, eax
lea eax, [ecx + ebx + 1]
push eax
call fcn.00436d60
mov esi, eax
add esp, 0x10
cmp byte [esi], 0
jne 0x48f9a0
test edi, edi
je 0x48faa8
cmp dword [esp + 0x10], 0
jne 0x48fa7c
push str.library_n
push ebp
call fcn.0055440f
add esp, 8
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48fa81
push ebp
sub eax, edx
push 1
push eax
push edi
call fcn.0040b251
push 0x596160
push ebp
call fcn.0055440f
push edi
call fcn.00420770
add esp, 0x1c
push ebp
call fcn.0040b073
add esp, 4
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x3c
ret
push edi
mov edx, esi
call fcn.0048f460
add esp, 4
mov edi, eax
jmp 0x48fa63
push esi
call fcn.00420770
push ebp
call fcn.0040b073
add esp, 8
pop ebp
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x3c
ret
Function at 0x4955b0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push eax
mov ebx, ecx
call fcn.004a9af0
mov esi, eax
mov eax, dword [esi]
lea eax, [eax + eax + 2]
add esp, 4
cmp ebx, eax
jb 0x49575c
mov ecx, ebx
sub ecx, eax
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x20], ecx
ja 0x49575c
mov byte [ebp], 0
mov ecx, dword [esi + 4]
push edi
call ecx
mov edi, eax
test edi, edi
je 0x4956bd
mov edx, dword [esi + 0x10]
push edi
call edx
mov eax, dword [esp + 0x34]
add esp, 4
test eax, eax
jbe 0x49561b
mov ecx, dword [esi + 0x14]
push eax
mov eax, dword [esp + 0x30]
push eax
push edi
call ecx
add esp, 0xc
mov eax, dword [esi]
mov ecx, dword [esi + 0x18]
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [eax + ebp + 1]
push eax
push edi
call ecx
mov edx, dword [esi + 0xc]
push 1
push edi
call edx
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x3c]
add esp, 0x18
sub eax, edi
je 0x495657
push eax
mov eax, dword [esi]
lea ecx, [ebp + eax*2 + 1]
push 0
push ecx
call fcn.00412eb0
add esp, 0xc
mov edx, ebp
sub edx, edi
lea eax, [edx + ebx]
mov byte [eax - 1], 1
test edi, edi
je 0x495675
mov ecx, dword [esp + 0x20]
push edi
push ecx
push eax
call fcn.0040dc50
add esp, 0xc
mov ecx, dword [esp + 0x34]
lea eax, [ebp + 1]
mov dword [esp + 0x14], eax
test ecx, ecx
jne 0x49569c
mov edx, dword [esi]
push edx
push eax
call fcn.00493950
add esp, 8
test eax, eax
je 0x4956ab
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x38]
push edx
push ecx
push eax
call fcn.0040dc50
add esp, 0xc
sub ebx, dword [esi]
dec ebx
push ebx
call fcn.00420e30
mov edi, eax
add esp, 4
test edi, edi
jne 0x4956d5
push 0xffffe013
call fcn.004207c0
add esp, 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret
mov eax, dword [esi]
mov ecx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push ebx
push edi
call fcn.00494f10
xor eax, eax
add esp, 0x10
mov dword [esp + 0x10], eax
test ebx, ebx
jbe 0x495711
mov edx, dword [esi]
add edx, eax
mov al, byte [edi + eax]
xor byte [edx + ebp + 1], al
mov eax, dword [esp + 0x10]
lea ecx, [edx + ebp + 1]
inc eax
mov dword [esp + 0x10], eax
cmp eax, ebx
jb 0x4956f5
mov eax, dword [esi]
push ebx
lea ecx, [eax + ebp + 1]
push ecx
push eax
mov eax, dword [esp + 0x34]
push edi
call fcn.00494f10
xor eax, eax
add esp, 0x10
mov dword [esp + 0x10], eax
cmp dword [esi], eax
jbe 0x495748
mov dl, byte [edi + eax]
mov ebp, dword [esp + 0x14]
xor byte [eax + ebp], dl
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, dword [esi]
jb 0x495731
push ebx
push edi
call fcn.00420790
add esp, 8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push 0xffffe004
call fcn.004207c0
add esp, 4
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 8
ret