joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4506b6
Capabilities:
Check os version
Encode data using base64
Encrypt data using aes mixcolumns step
Parse credit card information

Disassembly:
stosb byte es:[edi], al
jne 0x45cfaa
je 0x42eaa7
outsb dx, byte [esi]
daa
sub ecx, dword [edi]
test ch, bh
in al, 2
add byte [eax + eax*2], dh
je 0x45cfaa
cmp eax, ebx
mov word [ebp - 0x28], dx
mov word [esi + 0x53], bx
mov edi, edi
mov dword [ebp - 0x10], ebx
shr bl, 0x40
jle 0x43c77d
jg 0x43a409
nop
cpuid
ret 0x7d8d
lea edi, [ebp - 0x50]
js 0x459d7f
jns 0x43a416
fdiv st(6), st(0)
jns 0x459d7f
fiadd dword [ecx - 0x74df1c3f]
pop esi
or byte [eax - 0x5c], ch
or al, byte [eax + eax - 0x3d]
mov ax, word [ebp - 0x20]
mov cx, word [ebp - 0x24]
mov dx, word [ebp - 0x28]
push ebp
pop ebp
jne 0x450df4
je 0x43c797
cpuid
ret
je 0x450df4
invalid
mov word [ebp - 0x24], cx
and ebp, ebp
jno 0x44cd84
jmp fcn.0044cd44
jno 0x43a3eb
and byte [edx - 0x2d], 0xe0
lea esp, [esp + 4]
lea esi, [esi + 4]
push 0xd30569ff
mov dword [esp], ebx
pushfd
mov ebx, 0xf597a04e
sub ebx, 0x800edc60
popfd
push eax
pop eax
call fcn.0044210a
xor eax, 0xee850f71
mov al, 0xfd
push dword [edx + eax - 0x68]
xchg edx, eax
or word [esi + 0x50], di
jb 0x42ea9a
lea eax, [ebp - 0xc]
xchg edi, edx
xchg edx, edi
lea ecx, [ebp - 0x50]
push eax
push ecx
jmp 0x4506fe
push esi
mov dl, dl
call fcn.0044d49d
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x450723
mov ax, word [esi + 0x1e]
mov cx, word [esi + 0x1c]
shl edx, 0x20
mov dx, word [esi + 0x42]
mov word [ebp - 0x20], ax
mov eax, dword [ebp + 8]
js 0x44cd7a
jns 0x450744
pop ecx
invalid
jns 0x44cd7a
add eax, 0xc08446e9
mov word [esi + 0x1e], ax
mov eax, dword [ebp - 0x14]
push 0x4452b4
ret
inc ebp
add byte [edx + edi*8 + 0x45], al
add byte [eax + eax], al
add byte [eax + eax], al
add byte [ebp + 0x78], bl
inc ebx
add byte [eax + eax], al
add byte [ebx + edi*4 - 0xd81ffbd], dh
imul esi, dword [ecx + 0x20044], 0x300000
add byte [eax], al
push es
mov ebp, 0xc1a60043
inc esp
add byte [edx], cl
int1
inc esp
add byte [ecx - 0x63], ah
inc ebp
add byte [ecx + 0x6fb1d8f0], al
inc esp
add byte [eax + 0x420043d3], bh
inc esi
add byte [ebp - 0x63], dh
inc ebp
add byte [edi], cl
mov byte [0x2e42c31a], al
inc esi
add byte [eax - 0x7dffbc2d], bh
cld
mov eax, dword [ebp - 0xc]
mov edi, edi
lea ecx, [ebp - 0x1c]
ja 0x434ced
jbe 0x459d91
call 0x56cbaced
scasd eax, dword es:[edi]
std
invalid
jbe 0x434ced
fidivr dword [esi - 1]
jg 0x459d26
xchg bh, al
xchg al, bh
mov al, al
jns 0x4394f6
shl ch, 0x20
js 0x459db2
cpuid
nop
ret
lea esi, [esi + 8]
mov ax, ax
jmp dword [esi]
xchg si, ax
xchg si, ax
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
mov ax, word [ebp + eax]
lea esi, [esi + 0xc]
mov bx, bx
sbb word [ebp + ebx], ax
shr bh, 0x40
jmp dword [esi]
lea ebp, [ebp]
mov cl, byte [ebp + 0xc]
shr cx, 0x40
mov dx, word [ebp + 0x10]
jmp 0x45f6b5
push eax
push esi
shl bp, 0x20
mov ax, ax
mov byte [esi + 0xba], cl
js 0x443ff2
jns 0x45f6d1
scasd eax, dword es:[edi]
idiv dword [ecx]
jns 0x443ff2
xor eax, 0xfc0857c
and byte [ebx], 0x42
std
dec dword [edi]
test byte [ecx], bl
add byte [eax], al
add byte [ebp + 4], dh
or dword [ecx + 0x35948bc6], esi
insb byte es:[edi], dx
invalid
Function at 0x45a793
Capabilities:
Check os version
Encode data using base64

Disassembly:
push 0xe37fa68f
mov dword [esp], ebx
push 0x62
mov dword [esp], edx
call fcn.0045b498
xor al, 0x35
lea esp, [esp + 4]
lea esp, [esp - 4]
mov dword [esp], edi
mov edi, esp
pushfd
push 0x2f
mov dword [esp], ecx
pushfd
mov dword [esp], eax
js 0x448359
shl dl, 0x20
jns 0x45a7b8
jp 0x45a77c
call 0xdbe130cb
invalid
jns 0x448359
sbb byte [eax - 0x3dbbb71], 0x85
dec dword [edi]
sub byte [edi + 0x27], 0xff
dec dword [edi]
test dword [edx], esp
jb 0x45a7d1
add byte [ecx + 0x320374db], cl
dec ebp
inc edi

Function at 0x45b821
Capabilities:
Check os version
Encode data using base64

Disassembly:
add esp, 4
xor eax, eax
jb 0x456b61
sub cl, 0x34
shl al, 0x20
mov dl, byte [ebp + eax - 0xf0]
xor dl, cl
jb 0x44b696
add dl, 0x58
xchg bl, dh
xchg dh, bl
mov byte [ebp + eax - 8], dl
mov dx, dx
inc eax
cmp eax, 8
jl 0x45b835
jge 0x45b864
add dword [eax], esi
pop ss
enter 0x73e9, 0xfffffffffffffff8
invalid
jmp fcn.0045b0dc

Function at 0x45e5b0
Capabilities:
Check os version
Encode data using base64

Disassembly:
clc
lodsb al, byte [esi]
call fcn.0044b680
add eax, 0x24648dec
add al, 0xf5
sub word [ebp + ebx], ax
jmp dword [esi]
pop dword [esp - 4]
je 0x464f58
jne 0x45e5bf
pop ebx
out 0x6e, al
xor eax, eax
jb 0x454279
pop esi
mov esp, ebp
jne 0x464f51
je 0x45e5d4
sahf
dec dword [edi]
test byte [edi + 0x69], dh
add byte [eax], al
je 0x464f51
invalid
pop ebp
ret
shr bh, 0x40
mov al, byte [ebp - 0x62]
cmp al, 1
jne 0x464fad
je 0x464f6a
cwde
dec esp
mov cl, byte [ebp - 0x60]
xor eax, eax
jb 0x454282
sub cl, 0x34
shl eax, 0x20
mov dl, byte [ebp + eax - 0xf0]
xor dl, cl
jb 0x456b5a
add dl, 0x58
mov bp, bp
mov byte [ebp + eax - 8], dl
lea ecx, [ecx]
inc eax
cmp eax, 8
jl 0x464f7b
jge 0x464fa6
in eax, dx
mov ch, 0xe9
xor dword [ecx - 1], esp
push dword [0x89023cb3]
imul al
or cl, byte [edx]
add bh, al
dec esp
jmp fcn.0045b0dc
cmp al, 2
mov esi, esi
call 0x4699c0
invalid
add eax, 0x24448f62
cld

Function at 0x46095a
Capabilities:
Check os version
Encode data using base64
Encrypt data using aes mixcolumns step
Parse credit card information

Disassembly:
push 0x43b989
ret
and eax, 0x3326ff3b
mov bl, 0x66
mov esi, esi
mov eax, dword [esi + 4]
lea esi, [esi + 8]
seto byte [ebp + eax]
jmp dword [esi]
mov dl, byte [ebp + 0xb]
test al, 0xc3
add esp, 0x2c
mov byte [esi + 0xba], bl
test ax, ax
jb 0x440af4
shr di, 0x40
mov bp, bp
mov byte [esi + 0xbb], dl
lea esi, [esi]
shr bx, 0x40
xchg ebp, edi
xchg edi, ebp
mov ch, ch
push edx
mov dx, 0x7d1d
xchg dh, dh
pop edx
shr si, 0x40
mov word [esi + 0xbc], di
mov cx, cx
jne 0x431739
je 0x44c689
push cs
sub byte [eax], ch
jmp 0x42baa0
lea esp, [esp + 4]
shl bl, 0x20
mov eax, dword [ebp - 8]
lea eax, [eax]
jne 0x44c635
shr edi, 0x40
je 0x460973
push ebx
out dx, al
je 0x44c635
and eax, 0x4468b9b
mov cx, cx
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
adc byte [ebp + ebx], al
shr al, 0x40
jmp dword [esi]
Function at 0x462685
Capabilities:
Check os version
Encode data using base64
Encrypt data using aes mixcolumns step
Parse credit card information

Disassembly:
jmp 0x44d937
push 0xe
pop ebp
ret
inc edx
out dx, eax
mov eax, dword [esi + 4]
jne 0x45e2ec
shr dx, 0x40
je 0x4506ae
je 0x45e2ec
invalid
mov eax, 1
adc byte [ecx + 0xf], 0x8e
mov ch, 0x46
mov ebx, dword [esi + 8]
mov eax, dword [ebp + eax]
mov ebx, dword [ebp + ebx]
shr cx, 0x40
jmp 0x43698c
pop dword [esp - 4]
shr ax, 0x40
je 0x45444b
jne 0x462698
add al, 0x16
xchg ecx, edx
xchg ecx, edx
xchg edx, ecx
shl ax, 0x20
inc eax
cmp eax, 0x43
jb 0x4642e9
jae 0x4626b2
rcl ch, cl
mov ecx, ebp
xor eax, eax
jb 0x45ac83
js 0x44adeb
jns 0x4626c6
mov byte [0xfa8949b], al
mov dword [edi], ebx
xchg esi, edi
push dword [ecx + edi*4]
jns 0x44adeb
xor al, 0xb9
call fcn.0043818a
add esp, 0x10
jno 0x464c4c
jo 0x4626e3
pop edi
add eax, 0x2563800f
add byte [eax], al
jo 0x464c4c
fcomp dword [ecx - 0x24761377]
pop ebp
ret
invalid
test ax, ax
jb 0x45069a
jne 0x444266
je 0x464c61
cmp ebp, dword [edx + 0xe8b8e72]
mov ecx, dword [esi]
lea eax, [ebp - 0x180]
jno 0x44423a
jo 0x464c74
jo 0x464c49
in eax, dx
jo 0x44423a
xor al, 0x63
push 0x452966
ret
Function at 0x4815a0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
cmp dword [esp + 0x10c], 0
push ebx
push esi
push edi
push ebp
jne 0x4815c4
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
cmp dword [esp + 0x124], 0
jne 0x4815de
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
xor eax, eax
mov edx, dword [esp + 0x11c]
mov ax, word [edx]
add eax, 7
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x11c]
sar eax, 3
mov si, ax
lea eax, [esp + 0x18]
movzx ebp, si
push ebp
push edx
push eax
call fcn.004941c0
add esp, 0xc
cmp si, 0xfc
jbe 0x481629
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
mov eax, dword [esp + 0x124]
push eax
call fcn.00490fb0
mov esi, dword [esp + 0x124]
add esp, 4
test esi, esi
jne 0x4816d7
xor cx, cx
mov eax, dword [esp + 0x124]
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x481659
xor di, di
xor edx, edx
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
mov edx, dword [esp + 0x11c]
xor eax, eax
mov cl, byte [esi]
mov al, byte [ebx + edx + 2]
xor edx, edx
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x481675
jmp 0x48179a
mov edx, dword [esp + 0x11c]
push ebp
lea eax, [esp + 0x1c]
push edx
push eax
add esi, 2
call fcn.004941c0
lea eax, [esp + ebp + 0x24]
add esp, 0xc
push 4
push esi
push eax
call fcn.004941c0
xor cx, cx
mov eax, dword [esp + 0x130]
add esp, 0xc
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x481711
xor di, di
xor edx, edx
add ebp, 4
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
xor edx, edx
xor eax, eax
mov cl, byte [esi]
mov al, byte [esp + ebx + 0x18]
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x481730
lea eax, [esp + 0x18]
push 0
push 0x100
push eax
call fcn.004941a0
add esp, 0xc
mov edx, dword [esp + 0x14]
push 0x100
mov eax, dword [esp + 0x128]
push edx
push eax
call fcn.00491000
add esp, 0xc
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x481900
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x174
push esi
push edi
mov esi, dword [esp + 0x194]
mov dword [esi], 0
mov ecx, dword [eax]
test ecx, ecx
jne 0x48192c
mov ax, 0xcc
pop edi
pop esi
add esp, 0x174
ret
lea eax, [esp + 0x20]
mov edx, dword [esp + 0x184]
push eax
push edx
push ecx
call fcn.004815a0
add esp, 0xc
test ax, ax
jne 0x481a78
xor eax, eax
mov al, byte [esp + 0x190]
test eax, eax
je 0x481974
cmp eax, 1
je 0x4819ee
mov ax, 0xa
pop edi
mov dword [esi], 0
pop esi
add esp, 0x174
ret
mov eax, dword [esp + 0x188]
test eax, eax
je 0x481995
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00491000
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.00491160
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 0x18
shr cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x4819ab
xor eax, eax
mov dword [esp + 8], edi
lea ecx, [esp + 0xb]
mov dl, byte [esp + eax + 0x1c]
sub ecx, eax
inc eax
xor byte [ecx], dl
cmp eax, 4
jb 0x4819d6
mov eax, dword [esp + 8]
jmp 0x481a5f
mov eax, dword [esp + 0x188]
test eax, eax
je 0x481a0f
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00491000
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.00491160
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x481a25
xor eax, eax
mov dword [esp + 8], edi
mov cl, byte [esp + eax + 0x1c]
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 4
jb 0x481a4d
mov eax, dword [esp + 8]
push 0
mov dword [esi], eax
lea eax, [esp + 0x24]
push 0x15c
push eax
call fcn.004941a0
xor ax, ax
add esp, 0xc
pop edi
pop esi
add esp, 0x174
ret
Function at 0x482270
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
push ebp
test esi, esi
je 0x4822d7
mov edi, dword [esp + 0x14]
mov cl, byte [edi]
xor ebp, ebp
mov bp, ax
mov dl, cl
shr ax, 4
and ebp, 0xf
and dl, 0xf
xor ebx, ebx
mov bl, dl
and cl, 0xf3
shr cl, 2
inc edi
mov edx, dword [ebx*4 + 0x5d2e40]
xor ebx, ebx
xor dx, ax
xor eax, eax
xor dx, word [ebp*4 + 0x5d2e40]
mov al, cl
mov bx, dx
mov eax, dword [eax + 0x5d2e40]
shr dx, 4
and ebx, 0xf
xor ax, dx
xor ax, word [ebx*4 + 0x5d2e40]
dec esi
jne 0x482283
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4822e0
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push ebx
mov dword [eax], 0
cmp dword [esp + 0x1c], 1
push esi
push edi
push ebp
jae 0x482302
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
xor edi, edi
mov ebp, dword [esp + 0x28]
cmp ebp, edi
je 0x482400
lea eax, [edi*4]
mov ecx, 3
sub edx, edx
xor ebx, ebx
div ecx
mov edx, dword [esp + 0x1c]
lea esi, [edx + eax]
mov eax, dword [esp + 0x24]
add eax, edi
inc esi
inc esi
mov dword [esp + 0x10], eax
mov al, byte [eax]
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x14], al
mov dl, byte [ecx + 1]
and al, 3
xor ecx, ecx
mov bl, al
mov al, dl
shl ebx, 4
and dl, 0xf
shr al, 4
mov cl, al
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], 0
or ebx, ecx
mov cl, byte [eax + 2]
xor eax, eax
and ebx, 0x3f
mov al, dl
mov dl, cl
shl eax, 2
and cl, 0x3f
shr dl, 6
mov byte [esp + 0x10], dl
xor edx, edx
or eax, dword [esp + 0x10]
mov dl, cl
mov dword [esp + 0x10], 0
mov cl, byte [esp + 0x14]
shr cl, 2
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 2], cl
mov cl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 1], cl
cmp ebp, 3
mov ecx, ebp
jb 0x4823b9
mov ecx, 3
cmp ecx, 1
jne 0x4823c7
mov byte [esi], 0x3d
mov byte [esi + 1], 0x3d
jmp 0x4823e9
and eax, 0x3f
inc esi
cmp ecx, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 1], al
jne 0x4823de
mov byte [esi], 0x3d
jmp 0x4823e9
and edx, 0x3f
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
sub ebp, 3
mov eax, dword [esp + 0x20]
add edi, 3
add dword [eax], 4
cmp edi, dword [esp + 0x28]
jb 0x482310
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x482a30
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
push esi
xor ebx, ebx
mov esi, dword [esp + 0xc]
mov ecx, 4
mov al, byte [esi + 2]
mov bl, byte [eax + str._.C]
mov eax, dword [esp + 0x10]
cmp eax, ecx
jle 0x482a68
mov edx, ebx
inc ecx
and edx, 0xff
inc ebx
mov dl, byte [edx + str._.C]
xor byte [esi + ecx - 1], dl
cmp ecx, eax
jl 0x482a50
pop esi
pop ebx
ret
Function at 0x482d00
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [esp + 8]
push ebx
and ax, 0x8000
push esi
mov dx, word [esp + 0x10]
mov ecx, dword [esp + 0xc]
cmp ax, 1
sbb eax, eax
add dx, dx
inc eax
or ax, dx
mov word [esp + 0x10], ax
xor byte [esp + 0x11], al
mov ax, word [esp + 0x10]
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
mov esi, 0x55
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
mov eax, 0x58
mov dl, byte [esp + 0x10]
mov bl, byte [esp + 0x10]
and dl, 0x80
add bl, bl
shr dl, 7
add ecx, 2
or dl, bl
mov byte [esp + 0x10], dl
mov dl, byte [esp + 0x11]
and dl, 1
mov bl, byte [esp + 0x11]
shl dl, 7
shr bl, 1
or dl, bl
mov byte [esp + 0x11], dl
mov bl, byte [esp + 0x10]
xor byte [esp + 0x11], bl
mov dx, word [esp + 0x10]
not dx
mov word [esp + 0x10], dx
xor word [ecx - 2], dx
add word [esp + 0x10], si
dec eax
jne 0x482d83
pop esi
pop ebx
ret

Function at 0x4849c0
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
sub esp, 8
mov al, byte [esp + 0xc]
push ebx
and ax, 0xf
push esi
mov word [esp + 0xa], ax
push edi
mov eax, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
lea ecx, [eax + ebp - 1]
mov dword [esp + 0x14], ecx
xor bl, bl
mov edi, dword [esp + 0x14]
test bp, bp
lea esi, [ebp - 1]
je 0x484a11
mov dl, byte [edi]
mov eax, edi
dec edi
mov cl, bl
mov bl, dl
add dl, dl
shr bl, 7
or dl, cl
mov byte [eax], dl
mov ax, si
dec si
test ax, ax
jne 0x4849f5
test bl, bl
je 0x484a1c
mov eax, dword [esp + 0x14]
or byte [eax], 1
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x4849e7
xor si, si
test ebp, ebp
je 0x484a49
mov dl, byte [esp + 0x1c]
mov eax, dword [esp + 0x20]
movzx ecx, si
inc si
xor byte [ecx + eax], dl
movzx ecx, si
cmp ecx, ebp
jb 0x484a32
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x4851e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov cl, byte [esp + 8]
push ebx
mov edx, dword [esp + 0x10]
push esi
xor si, si
push edi
cmp dword [esp + 0x1c], 0
push ebp
je 0x48520a
movzx eax, si
inc si
xor byte [eax + edx], cl
movzx ebx, si
cmp ebx, dword [esp + 0x20]
jb 0x4851f9
xor ax, ax
mov al, cl
and ax, 0xf
mov word [esp + 0x12], ax
mov di, word [esp + 0x20]
xor cl, cl
dec di
mov esi, edx
cmp word [esp + 0x20], 0
je 0x48524c
mov al, byte [esi]
mov ebp, esi
inc esi
mov bl, cl
shl bl, 7
mov cl, al
shr al, 1
and cl, 1
or bl, al
mov byte [ebp], bl
mov bp, di
dec di
test bp, bp
jne 0x48522b
test cl, cl
je 0x485253
or byte [edx], 0x80
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x485218
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x488fc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x88
push ebx
lea ecx, [eax + 7]
shr ecx, 3
push esi
push edi
and eax, 7
mov esi, dword [esp + 0x98]
push ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
jne 0x488ff0
mov dword [esp + 0x18], 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x24], eax
je 0x4890e2
mov eax, dword [esp + 0x10]
xor dword [esi], eax
mov ecx, dword [esp + 0x14]
xor dword [esi + 4], ecx
cmp dword [esp + 0x20], 0
jne 0x4890b2
cmp dword [esp + 0x1c], 2
push 0
jbe 0x489093
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.00489190
add esp, 0xc
cmp dword [0x5d3308], 0
jne 0x48917d
mov eax, dword [esp + 0x28]
lea ebx, [esp + 0x30]
mov edi, 0x19
mov dword [esp + 0x30], eax
mov eax, dword [ebx]
mov cl, 0x20
add eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov dword [ebx + 4], eax
add ebx, 4
mov eax, dword [esp + 0x28]
mov edx, dword [ebx - 4]
and dl, 0x1f
sub cl, dl
shl eax, cl
mov cl, dl
shr ebp, cl
or eax, ebp
xor dword [esp + 0x34], eax
dec edi
jne 0x489064
jmp 0x4890c0
push 0
push esi
call fcn.00489190
add esp, 0xc
cmp dword [0x5d3308], 0
je 0x4890c0
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
lea eax, [esp + 0x30]
push eax
push esi
call fcn.004894b0
add esp, 8
mov eax, dword [esi]
add esi, 8
mov dword [esp + 0x10], eax
inc dword [esp + 0x20]
mov ecx, dword [esi - 4]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
cmp eax, dword [esp + 0x24]
jb 0x489017
xor eax, eax
cmp dword [esp + 0x18], eax
je 0x4890f8
mov cl, byte [esi + eax]
xor byte [esp + eax + 0x10], cl
inc eax
cmp eax, dword [esp + 0x18]
jb 0x4890ea
cmp dword [esp + 0x1c], 2
jbe 0x489113
lea eax, [esp + 0x30]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.004894b0
add esp, 8
jmp 0x489138
cmp dword [esp + 0x1c], 1
jne 0x489127
mov eax, dword [esi]
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x10]
push 0
push 0
push eax
call fcn.00489190
add esp, 0xc
cmp dword [esp + 0x1c], 1
jbe 0x489170
xor ecx, ecx
cmp dword [esp + 0x18], ecx
je 0x489157
mov dl, byte [esi + ecx - 8]
lea eax, [esi + ecx]
inc ecx
mov byte [eax], dl
cmp ecx, dword [esp + 0x18]
jb 0x489147
mov eax, dword [esp + 0x10]
mov dword [esi - 8], eax
mov ecx, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi - 4], ecx
pop esi
pop ebx
add esp, 0x88
ret
mov eax, dword [esp + 0x10]
mov dword [esi], eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 4], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
Function at 0x4894b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
push ebp
mov eax, dword [esi]
add esi, 8
mov ebp, 0xc
add dword [edx + 4], eax
mov ecx, dword [esi - 4]
add dword [edx], ecx
mov ebx, dword [edx]
mov edi, dword [edx + 4]
xor edi, ebx
mov cl, 0x20
shr ebx, 4
mov eax, edi
and bl, 0x1f
add esi, 8
sub cl, bl
shr eax, cl
mov cl, bl
shl edi, cl
or eax, edi
mov cl, 0x20
sub eax, dword [esi - 8]
mov dword [edx + 4], eax
mov edi, dword [edx]
xor edi, eax
shr eax, 7
mov ebx, edi
and al, 0x1f
sub cl, al
shr ebx, cl
mov cl, al
shl edi, cl
or ebx, edi
add ebx, dword [esi - 4]
dec ebp
mov dword [edx], ebx
jne 0x4894ce
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x489520
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x90
push ebx
lea ecx, [eax + 7]
shr ecx, 3
push esi
push edi
and eax, 7
mov ebx, dword [esp + 0xa0]
push ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jne 0x489550
mov dword [esp + 0x10], 8
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
cmp dword [esp + 0x14], 1
jbe 0x489645
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x14]
sub eax, 2
mov dword [esp + 0x2c], eax
je 0x489645
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x28], 0
jne 0x489605
lea eax, [esp + 0x30]
push 0
push eax
push ebx
call fcn.00489190
add esp, 0xc
cmp dword [0x5d3308], 0
jne 0x489742
mov eax, dword [esp + 0x30]
lea edi, [esp + 0x38]
mov esi, 0x19
mov dword [esp + 0x38], eax
mov eax, dword [edi]
mov cl, 0x20
add eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov dword [edi + 4], eax
add edi, 4
mov eax, dword [esp + 0x30]
mov edx, dword [edi - 4]
and dl, 0x1f
sub cl, dl
shl eax, cl
mov cl, dl
shr ebp, cl
or eax, ebp
xor dword [esp + 0x3c], eax
dec esi
jne 0x4895d6
jmp 0x489613
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.00489750
add esp, 8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor dword [ebx], eax
mov edx, dword [esp + 0x20]
xor dword [ebx + 4], ecx
mov eax, dword [esp + 0x24]
add ebx, 8
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
inc dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
cmp ecx, dword [esp + 0x2c]
jb 0x489594
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x10], eax
je 0x48966e
mov eax, dword [esp + 0x10]
lea esi, [ebx + 8]
lea edi, [esp + 0x18]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x14], 1
jne 0x489696
push 0
push 0
push ebx
call fcn.00489190
add esp, 0xc
cmp dword [0x5d3308], 0
je 0x4896cc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
cmp dword [esp + 0x14], 2
jne 0x4896be
push 0
push 0
push ebx
call fcn.00489190
add esp, 0xc
cmp dword [0x5d3308], 0
je 0x4896cc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.00489750
add esp, 8
cmp dword [esp + 0x14], 1
jbe 0x489735
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
xor dword [esp + 0x18], eax
xor dword [esp + 0x1c], ecx
xor ecx, ecx
cmp dword [esp + 0x10], ecx
je 0x4896ff
mov dl, byte [ebx + ecx + 8]
lea eax, [ebx + ecx]
inc ecx
mov byte [eax], dl
cmp ecx, dword [esp + 0x10]
mov dl, byte [esp + ecx + 0x17]
mov byte [eax + 8], dl
jb 0x4896e8
cmp dword [esp + 0x14], 2
jne 0x489727
push 0
push 0
push ebx
call fcn.00489190
add esp, 0xc
cmp dword [0x5d3308], 0
je 0x489735
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.00489750
add esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
xor dword [ebx], eax
xor dword [ebx + 4], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret