joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45eaf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
xor ebx, ebx
xor edi, edi
mov eax, dword [esi + 0x6af8c]
mov dword [esi + 0x6af7c], 2
test eax, eax
je 0x45ed24
push ebp
cmp eax, 3
jb 0x45eb6b
mov ecx, dword [esi + 0x6af80]
mov edx, dword [esi + 0x6af78]
xor eax, eax
and edx, 0x3ff
mov al, byte [ecx + esi + 0x1af6e]
and eax, 0x7fff
shl edx, 5
xor eax, edx
and ecx, 0x7fff
mov dword [esi + 0x6af78], eax
mov ebx, dword [esi + eax*4 + 0x4af6c]
mov dword [esi + ecx*4 + 0x2af6c], ebx
mov eax, dword [esi + 0x6af78]
mov ecx, dword [esi + 0x6af80]
mov dword [esi + eax*4 + 0x4af6c], ecx
test ebx, ebx
je 0x45ebad
mov edx, dword [esi + 0x6af80]
sub edx, ebx
cmp edx, 0x7efa
ja 0x45ebad
mov eax, dword [esi + 0x6af8c]
mov ecx, dword [esi + 0x6af9c]
cmp ecx, eax
jbe 0x45eb95
mov dword [esi + 0x6af9c], eax
push ebx
push esi
call fcn.0045e850
mov edi, eax
mov eax, dword [esi + 0x6af8c]
add esp, 8
cmp edi, eax
jbe 0x45ebad
mov edi, eax
cmp edi, 3
jb 0x45ec98
mov ecx, dword [esi + 0x6af80]
lea eax, [edi - 3]
push eax
mov eax, dword [esi + 0x6af84]
sub ecx, eax
push ecx
push esi
call fcn.0045e020
mov ebp, dword [esi + 0x6af8c]
mov edx, dword [esi + 0x6af94]
add esp, 0xc
sub ebp, edi
cmp edi, edx
mov dword [esi + 0x6af8c], ebp
mov ecx, ebp
ja 0x45ec53
cmp ecx, 3
jb 0x45ec53
dec edi
mov ebp, dword [esi + 0x6af80]
mov ebx, dword [esi + 0x6af78]
inc ebp
xor ecx, ecx
mov edx, ebp
mov dword [esi + 0x6af80], ebp
and ebx, 0x3ff
mov cl, byte [esi + edx + 0x1af6e]
and edx, 0x7fff
and ecx, 0x7fff
shl ebx, 5
xor ecx, ebx
dec edi
mov dword [esi + 0x6af78], ecx
mov ebx, dword [esi + ecx*4 + 0x4af6c]
mov dword [esi + edx*4 + 0x2af6c], ebx
mov edx, dword [esi + 0x6af78]
mov ecx, dword [esi + 0x6af80]
mov dword [esi + edx*4 + 0x4af6c], ecx
jne 0x45ebf2
jmp 0x45ecc0
mov ecx, dword [esi + 0x6af80]
add ecx, edi
xor edi, edi
mov edx, ecx
mov dword [esi + 0x6af80], ecx
xor ecx, ecx
mov cl, byte [edx + esi + 0x1af6c]
lea ebp, [edx + esi]
xor edx, edx
mov dword [esi + 0x6af78], ecx
mov dl, byte [ebp + 0x1af6d]
and ecx, 0x3ff
and edx, 0x7fff
shl ecx, 5
xor edx, ecx
mov dword [esi + 0x6af78], edx
jmp 0x45ecc6
mov eax, dword [esi + 0x6af80]
xor ecx, ecx
mov cl, byte [eax + esi + 0x1af6c]
push ecx
push 0
push esi
call fcn.0045e020
mov edx, dword [esi + 0x6af8c]
add esp, 0xc
dec edx
mov dword [esi + 0x6af8c], edx
inc dword [esi + 0x6af80]
test eax, eax
je 0x45ed00
mov eax, dword [esi + 0x6af70]
test eax, eax
jl 0x45ecdd
lea ecx, [eax + esi + 0x1af6c]
jmp 0x45ecdf
xor ecx, ecx
mov edx, dword [esi + 0x6af80]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.0045de60
mov eax, dword [esi + 0x6af80]
add esp, 0x10
mov dword [esi + 0x6af70], eax
cmp dword [esi + 0x6af8c], 0x106
jae 0x45ed15
push esi
call fcn.0045e9b0
add esp, 4
mov eax, dword [esi + 0x6af8c]
test eax, eax
jne 0x45eb14
pop ebp
mov eax, dword [esi + 0x6af70]
test eax, eax
jl 0x45ed37
lea ecx, [eax + esi + 0x1af6c]
jmp 0x45ed39
xor ecx, ecx
mov edx, dword [esi + 0x6af80]
push 1
sub edx, eax
push edx
push ecx
push esi
call fcn.0045de60
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x45f3e0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov al, byte [ebx + 0x490]
push edi
cmp al, 1
je 0x45f41e
jbe 0x45f534
cmp al, 5
ja 0x45f534
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [ebx + 0x4e0]
push eax
push ecx
push edx
call fcn.0047d5e0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [ebx + 0x4a0]
mov esi, dword [esp + 0x1c]
xor ebp, ebp
cmp eax, ebp
je 0x45f445
cmp dword [ebx + 0x4a4], esi
jae 0x45f445
push eax
call fcn.0044f656
add esp, 4
mov dword [ebx + 0x4a0], ebp
cmp dword [ebx + 0x4a0], ebp
jne 0x45f465
lea eax, [esi + esi]
push eax
call fcn.0044f661
add esp, 4
mov dword [ebx + 0x4a0], eax
mov dword [ebx + 0x4a4], esi
mov edi, dword [ebx + 0x4a0]
mov ecx, esi
mov esi, dword [esp + 0x18]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x1c]
mov ecx, edx
and ecx, 3
cmp eax, ebp
rep movsb byte es:[edi], byte [esi]
jbe 0x45f534
mov eax, dword [ebx + 0x4a0]
mov edi, dword [ebx + 0x494]
mov edx, edi
mov cl, byte [eax + ebp]
and edx, 0xff
mov byte [esp + 0x18], cl
mov ecx, dword [ebx + 0x49c]
mov eax, dword [esp + 0x18]
mov esi, ecx
and eax, 0xff
and esi, 0xfffd
xor edx, eax
or esi, 2
shr edi, 8
mov eax, dword [edx*4 + 0x775df4]
mov edx, ecx
xor eax, edi
mov edi, dword [ebx + 0x498]
mov dword [ebx + 0x494], eax
and eax, 0xff
add eax, edi
and edx, 0xff
imul eax, eax, 0x8088405
inc eax
mov dword [ebx + 0x498], eax
shr eax, 0x18
xor eax, edx
mov dl, byte [esp + 0x18]
shr ecx, 8
mov eax, dword [eax*4 + 0x775df4]
xor eax, ecx
mov ecx, esi
xor ecx, 1
mov dword [ebx + 0x49c], eax
imul ecx, esi
mov eax, dword [esp + 0x1c]
shr ecx, 8
xor cl, dl
mov edx, dword [ebx + 0x4a0]
mov byte [edx + ebp], cl
inc ebp
cmp ebp, eax
jb 0x45f48b
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x463af0
Capabilities:
Hash data with crc32

Disassembly:
mov eax, dword [esp + 4]
push esi
xor ecx, ecx
lea edx, [eax + 0x831c]
mov eax, ecx
mov esi, 8
test al, 1
je 0x463b11
shr eax, 1
xor eax, 0xedb88320
jmp 0x463b13
shr eax, 1
dec esi
jne 0x463b04
mov dword [edx], eax
inc ecx
add edx, 4
cmp ecx, 0xff
jbe 0x463afd
pop esi
ret

Function at 0x463b30
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, eax
dec eax
test ecx, ecx
je 0x463b6f
mov ecx, dword [esp + 0xc]
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
lea esi, [eax + 1]
mov eax, dword [esp + 0x14]
xor edx, edx
mov ebx, eax
mov dl, byte [ecx]
and ebx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edi + edx*4 + 0x831c]
xor eax, edx
inc ecx
dec esi
jne 0x463b4d
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 8]
ret

Function at 0x466b80
Capabilities:
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
push esi
xor ecx, ecx
mov eax, ecx
mov esi, 8
test al, 1
je 0x466b9b
shr eax, 1
xor eax, 0xedb88320
jmp 0x466b9d
shr eax, 1
dec esi
jne 0x466b8e
mov dword [edx], eax
inc ecx
add edx, 4
cmp ecx, 0xff
jbe 0x466b87
pop esi
ret

Function at 0x466cc0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x466cfc
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
push edi
mov edi, dword [eax + 0x404]
xor edx, edx
mov dl, byte [eax + 0x404]
xor ebx, ebx
mov bl, byte [ecx]
xor edx, ebx
shr edi, 8
mov edx, dword [eax + edx*4 + 4]
xor edx, edi
inc ecx
dec esi
mov dword [eax + 0x404], edx
jne 0x466cd3
pop edi
pop ebx
pop esi
ret

Function at 0x466e70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x408
mov ecx, 0x100
xor eax, eax
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x18]
xor esi, esi
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
push eax
call fcn.00466b80
mov eax, dword [esp + 0x424]
mov ebx, 0xa28
add esp, 4
xor ecx, ecx
cmp eax, ebx
jbe 0x466f44
mov edi, dword [esp + 0x41c]
cmp word [ecx + edi], 0xea60
jne 0x466f1a
mov dx, word [ecx + edi + 2]
add ecx, 2
add ebx, 2
cmp dx, 0xa28
ja 0x466f1a
add ecx, 2
add ebx, 2
or eax, 0xffffffff
mov dword [esp + 0x10], ebx
test dx, dx
lea esi, [ecx + edi]
je 0x466f1a
and edx, 0xffff
mov dword [esp + 0x14], edx
mov ebp, edx
xor edx, edx
mov ebx, eax
mov dl, byte [esi]
and ebx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [esp + edx*4 + 0x18]
xor eax, edx
inc esi
dec ebp
jne 0x466eee
mov edx, dword [esp + 0x14]
add edx, ecx
not eax
cmp eax, dword [edx + edi]
je 0x466f34
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x420]
inc ecx
inc ebx
cmp ebx, eax
jb 0x466eb3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x408
ret
pop edi
pop esi
pop ebp
mov eax, 0x272a
pop ebx
add esp, 0x408
ret
mov ax, si
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x408
ret

Function at 0x4691d0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
call fcn.004558e1
add esp, 0xc
ret
Function at 0x46c8d0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
push edi
push esi
push ebx
call fcn.0046c930
add esp, 0xc
cmp eax, esi
jne 0x46c8f2
cmp edx, edi
je 0x46c8f8
pop edi
pop esi
xor eax, eax
pop ebx
ret
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x10]
push 0
push eax
push ecx
push edx
push ebx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x10]
pop edi
neg eax
sbb eax, eax
pop esi
and eax, ecx
pop ebx
ret
Function at 0x47d8f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
lea edi, [ebx + 0x104]
mov ecx, 0x41
mov esi, ebx
mov dword [esp + 0x14], edi
xor ebp, ebp
rep movsd dword es:[edi], dword [esi]
mov eax, 0x104
lea ecx, [ebx + ebp]
sub eax, ebp
push eax
push ecx
call dword [ebx + 0x20c]
add ebp, eax
add esp, 8
cmp ebp, 0x104
jb 0x47d90d
xor eax, eax
mov edx, dword [esp + 0x14]
mov cl, byte [edx + eax]
mov dl, byte [eax + ebx]
not cl
xor dl, cl
mov byte [eax + ebx], dl
inc eax
cmp eax, 0x104
jb 0x47d92e
push ebx
call fcn.0047d840
mov edx, dword [esp + 0x18]
push edx
call fcn.0047d840
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x47daa0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 0x9c]
cmp eax, 0xffffffff
je 0x47db25
cmp eax, 0x40
jbe 0x47dacc
lea eax, [esi + 0x40]
push eax
push esi
call fcn.0047ff40
add esp, 8
mov dword [esi + 0x9c], 0x14
mov edx, dword [esi + 0x9c]
mov ecx, 0x40
push edi
sub ecx, edx
lea edi, [edx + esi]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, esi
mov ecx, 0x10
mov edx, dword [eax]
add eax, 4
xor edx, 0x36363636
dec ecx
mov dword [eax - 4], edx
jne 0x47daf4
lea edi, [esi + 0x40]
push edi
call fcn.0047fe70
push edi
push 0x40
push esi
call fcn.0047feb0
add esp, 0x10
mov dword [esi + 0x9c], 0xffffffff
pop edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x47db3f
add esi, 0x40
push esi
push eax
mov eax, dword [esp + 0x10]
push eax
call fcn.0047feb0
add esp, 0xc
pop esi
ret

Function at 0x47db50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
push esi
push edi
mov edi, dword [esp + 0x28]
cmp dword [edi + 0x9c], 0xffffffff
je 0x47db6f
push edi
push 0
push 0
call fcn.0047daa0
add esp, 0xc
lea esi, [edi + 0x40]
lea eax, [esp + 8]
push esi
push eax
call fcn.0047ff40
add esp, 8
mov eax, edi
mov ecx, 0x10
mov edx, dword [eax]
add eax, 4
xor edx, 0x6a6a6a6a
dec ecx
mov dword [eax - 4], edx
jne 0x47db87
push esi
call fcn.0047fe70
push esi
push 0x40
push edi
call fcn.0047feb0
push esi
lea ecx, [esp + 0x1c]
push 0x14
push ecx
call fcn.0047feb0
lea edx, [esp + 0x24]
push esi
push edx
call fcn.0047ff40
mov ecx, dword [esp + 0x48]
add esp, 0x24
test ecx, ecx
jbe 0x47dbe0
mov edi, dword [esp + 0x20]
mov eax, ecx
lea esi, [esp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x14
ret
Function at 0x47ea60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x214
push esi
lea eax, [esp + 0x38]
push edi
push eax
call fcn.0047d9f0
mov edx, dword [esp + 0x228]
mov eax, dword [esp + 0x224]
lea ecx, [esp + 0x40]
push ecx
push edx
push eax
call fcn.0047da00
mov edx, dword [esp + 0x23c]
mov eax, dword [esp + 0x238]
mov ecx, 0x28
lea esi, [esp + 0x4c]
lea edi, [esp + 0x18c]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x18c]
push ecx
push edx
push eax
call fcn.0047daa0
mov ecx, dword [esp + 0x254]
add esp, 0x1c
dec ecx
mov eax, 0xcccccccd
mul ecx
shr edx, 4
inc edx
mov dword [esp + 0x10], edx
je 0x47ebec
push ebx
push ebp
mov dword [esp + 0x10], 0
mov ebx, 1
lea ebp, [esp + 0x1c]
xor edx, edx
mov ecx, 0x28
mov dword [esp + 0x1c], edx
lea esi, [esp + 0x184]
lea edi, [esp + 0xe4]
mov dword [esp + 0x20], edx
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], edx
mov ecx, ebx
mov dword [esp + 0x28], edx
mov eax, ebx
shr ecx, 0x10
mov dword [esp + 0x2c], edx
mov byte [esp + 0x31], cl
mov ecx, dword [esp + 0x238]
mov edx, ebx
shr eax, 0x18
shr edx, 8
mov byte [esp + 0x30], al
mov byte [esp + 0x32], dl
test ecx, ecx
mov byte [esp + 0x33], bl
mov eax, 4
jbe 0x47eba9
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0xe4]
lea edx, [esp + 0x30]
push ecx
push eax
push edx
call fcn.0047daa0
lea eax, [esp + 0xf0]
lea ecx, [esp + 0x3c]
push eax
push 0x14
push ecx
call fcn.0047db50
add esp, 0x18
xor eax, eax
mov dl, byte [esp + eax + 0x30]
mov cl, byte [esp + eax + 0x1c]
xor cl, dl
mov byte [esp + eax + 0x1c], cl
inc eax
cmp eax, 0x14
jb 0x47eb78
mov ecx, 0x28
lea esi, [esp + 0x44]
lea edi, [esp + 0xe4]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x14]
dec ecx
mov dword [esp + 0x14], ecx
jne 0x47eb4c
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, dword [esp + 0x240]
jae 0x47ebcc
mov esi, dword [esp + 0x23c]
mov dl, byte [eax + ebp]
inc ecx
mov byte [eax + esi], dl
inc eax
cmp ecx, 0x14
jb 0x47ebaf
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
inc ebx
add esi, 0x14
sub ebp, 0x14
mov dword [esp + 0x10], esi
lea eax, [ebx - 1]
cmp eax, ecx
jb 0x47eaee
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x214
ret
Function at 0x47fe70
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret
Function at 0x4927c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
mov eax, ecx
mov edx, 8
test al, 1
je 0x4927d6
shr eax, 1
xor eax, 0xedb88320
jmp 0x4927d8
shr eax, 1
dec edx
jne 0x4927c9
mov dword [ecx*4 + 0x7c9f30], eax
mov dword [ecx*4 + 0x7cc024], eax
inc ecx
cmp ecx, 0x100
jb 0x4927c2
push esi
push edi
mov esi, 0x7ca330
mov eax, dword [esi - 0x400]
mov ecx, esi
mov edx, 7
mov edi, eax
add ecx, 0x400
and edi, 0xff
shr eax, 8
mov edi, dword [edi*4 + 0x7c9f30]
xor eax, edi
dec edx
mov dword [ecx - 0x400], eax
jne 0x492806
add esi, 4
cmp esi, 0x7ca730
jbe 0x4927f9
pop edi
pop esi
ret

Function at 0x492840
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x7cc028]
test eax, eax
jne 0x49284e
call fcn.004927c0
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
test esi, esi
push edi
jbe 0x492885
test cl, 7
je 0x492885
xor edx, edx
mov edi, eax
mov dl, byte [ecx]
and edi, 0xff
xor edx, edi
shr eax, 8
mov edx, dword [edx*4 + 0x7c9f30]
xor eax, edx
dec esi
inc ecx
test esi, esi
ja 0x492860
cmp esi, 8
jb 0x492924
mov edi, esi
push ebx
push ebp
shr edi, 3
mov ebp, dword [ecx]
sub esi, 8
xor eax, ebp
add ecx, 8
mov ebx, eax
mov edx, eax
shr ebx, 0x10
and ebx, 0xff
shr edx, 0x18
mov ebp, dword [ebx*4 + 0x7cb330]
mov ebx, eax
mov edx, dword [edx*4 + 0x7caf30]
and eax, 0xff
shr ebx, 8
and ebx, 0xff
xor edx, ebp
mov ebp, dword [ebx*4 + 0x7cb730]
xor ebx, ebx
mov bl, byte [ecx - 2]
xor edx, ebp
mov ebp, dword [ebx*4 + 0x7ca330]
xor ebx, ebx
mov bl, byte [ecx - 3]
xor edx, ebp
mov ebp, dword [ebx*4 + 0x7ca730]
xor ebx, ebx
mov bl, byte [ecx - 4]
xor edx, ebp
mov ebp, dword [ebx*4 + 0x7cab30]
xor ebx, ebx
mov bl, byte [ecx - 1]
xor edx, ebp
mov ebp, dword [ebx*4 + 0x7c9f30]
mov ebx, dword [eax*4 + 0x7cbb30]
xor edx, ebp
xor edx, ebx
dec edi
mov eax, edx
jne 0x492895
pop ebp
pop ebx
test esi, esi
jbe 0x492946
xor edx, edx
mov edi, eax
mov dl, byte [ecx]
and edi, 0xff
xor edx, edi
shr eax, 8
mov edx, dword [edx*4 + 0x7c9f30]
xor eax, edx
inc ecx
dec esi
jne 0x492928
pop edi
pop esi
ret
Function at 0x492ab0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
mov esi, ecx
mov edx, dword [eax + 4]
push edi
mov edi, dword [eax]
mov ecx, dword [esi + 0x204]
mov ebp, dword [eax + 0xc]
mov dword [esp + 0x28], ecx
xor ecx, edi
mov edi, dword [esi + 0x20c]
mov dword [esp + 0x18], ecx
mov ecx, dword [esi + 0x208]
mov dword [esp + 0x14], 0
xor ecx, edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 8]
mov eax, dword [esi + 0x210]
xor edi, ecx
xor ebp, eax
mov eax, dword [esp + 0x14]
mov edx, ebp
and eax, 3
xor ebx, ebx
shl edx, 0xb
mov ecx, dword [esi + eax*4 + 0x204]
mov eax, ebp
shr eax, 0x15
or eax, edx
mov dword [esp + 0x24], ecx
add eax, edi
xor edx, edx
xor eax, ecx
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cl, byte [esp + 0x12]
mov dl, byte [ecx + esi + 0x104]
mov ecx, eax
shr ecx, 0x18
mov dh, byte [ecx + esi + 0x104]
xor ecx, ecx
mov cl, ah
and eax, 0xff
shl edx, 8
mov bl, byte [ecx + esi + 0x104]
xor ecx, ecx
mov cl, byte [eax + esi + 0x104]
or edx, ebx
mov ebx, dword [esp + 0x18]
mov eax, edi
shl edx, 8
or edx, ecx
mov ecx, dword [esp + 0x24]
xor edx, ebx
xor ebx, ebx
mov dword [esp + 0x20], edx
mov edx, edi
shr eax, 0xf
shl edx, 0x11
or eax, edx
xor edx, edx
xor eax, ebp
mov dword [esp + 0x18], edi
add eax, ecx
xor ecx, ecx
mov dword [esp + 0x10], eax
mov edi, dword [esp + 0x20]
mov cl, byte [esp + 0x12]
mov dl, byte [ecx + esi + 0x104]
mov ecx, eax
shr ecx, 0x18
mov dh, byte [ecx + esi + 0x104]
xor ecx, ecx
mov cl, ah
and eax, 0xff
shl edx, 8
mov bl, byte [ecx + esi + 0x104]
xor ecx, ecx
mov cl, byte [eax + esi + 0x104]
mov eax, dword [esp + 0x1c]
or edx, ebx
mov dword [esp + 0x1c], ebp
shl edx, 8
or edx, ecx
mov ecx, dword [esp + 0x14]
xor eax, edx
inc ecx
cmp ecx, 0x20
mov ebp, eax
mov dword [esp + 0x14], ecx
jl 0x492afc
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov ebp, edi
mov edi, dword [esp + 0x18]
xor edx, ebp
push ecx
mov dword [ecx], edx
mov edx, dword [esi + 0x208]
xor edx, eax
mov dword [ecx + 4], edx
mov eax, dword [esi + 0x20c]
xor eax, edi
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x20]
xor eax, dword [esi + 0x210]
mov dword [ecx + 0xc], eax
mov ecx, esi
call fcn.00492de0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 4
Function at 0x492c40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x30]
push ebx
push ebp
push esi
mov ebx, dword [eax]
mov esi, ecx
mov ebp, dword [eax + 0xc]
push edi
mov ecx, dword [esi + 0x204]
mov edi, dword [esi + 0x208]
mov dword [esp + 0x28], ecx
mov edx, dword [esi + 0x20c]
xor ecx, ebx
mov dword [esp + 0x14], 0x1f
mov dword [esp + 0x18], ecx
mov ecx, dword [eax + 4]
xor ecx, edi
mov edi, dword [eax + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi + 0x210]
xor edi, edx
xor ebp, ecx
mov ecx, dword [eax]
mov dword [esp + 0x2c], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x30], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x34], ecx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x38], edx
mov eax, dword [esp + 0x14]
mov edx, ebp
and eax, 3
xor ebx, ebx
shl edx, 0xb
mov ecx, dword [esi + eax*4 + 0x204]
mov eax, ebp
shr eax, 0x15
or eax, edx
mov dword [esp + 0x24], ecx
add eax, edi
xor edx, edx
xor eax, ecx
xor ecx, ecx
mov dword [esp + 0x10], eax
mov cl, byte [esp + 0x12]
mov dl, byte [ecx + esi + 0x104]
mov ecx, eax
shr ecx, 0x18
mov dh, byte [ecx + esi + 0x104]
xor ecx, ecx
mov cl, ah
and eax, 0xff
shl edx, 8
mov bl, byte [ecx + esi + 0x104]
xor ecx, ecx
mov cl, byte [eax + esi + 0x104]
or edx, ebx
mov ebx, dword [esp + 0x18]
mov eax, edi
shl edx, 8
or edx, ecx
mov ecx, dword [esp + 0x24]
xor edx, ebx
xor ebx, ebx
mov dword [esp + 0x20], edx
mov edx, edi
shr eax, 0xf
shl edx, 0x11
or eax, edx
xor edx, edx
xor eax, ebp
mov dword [esp + 0x18], edi
add eax, ecx
xor ecx, ecx
mov dword [esp + 0x10], eax
mov edi, dword [esp + 0x20]
mov cl, byte [esp + 0x12]
mov dl, byte [ecx + esi + 0x104]
mov ecx, eax
shr ecx, 0x18
mov dh, byte [ecx + esi + 0x104]
xor ecx, ecx
mov cl, ah
and eax, 0xff
shl edx, 8
mov bl, byte [ecx + esi + 0x104]
xor ecx, ecx
mov cl, byte [eax + esi + 0x104]
or edx, ebx
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x1c], ebp
shl edx, 8
or edx, ecx
mov ecx, dword [esp + 0x14]
xor edx, ebx
dec ecx
mov eax, edx
mov dword [esp + 0x14], ecx
mov ebp, eax
jns 0x492ca7
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov ebp, edi
mov edi, dword [esp + 0x18]
xor edx, ebp
mov dword [ecx], edx
mov edx, dword [esi + 0x208]
xor edx, eax
mov dword [ecx + 4], edx
mov eax, dword [esi + 0x20c]
xor eax, edi
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x1c]
xor eax, dword [esi + 0x210]
mov dword [ecx + 0xc], eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, esi
call fcn.00492de0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 4
Function at 0x492de0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
or esi, 0xffffffff
push edi
lea eax, [edx + 1]
sub esi, edx
mov edi, dword [ecx + 0x204]
xor edx, edx
mov dl, byte [eax - 1]
add eax, 4
mov edx, dword [edx*4 + 0x7cc024]
xor edi, edx
xor edx, edx
mov dword [ecx + 0x204], edi
mov dl, byte [eax - 4]
mov edi, dword [ecx + 0x208]
mov edx, dword [edx*4 + 0x7cc024]
xor edi, edx
xor edx, edx
mov dword [ecx + 0x208], edi
mov dl, byte [eax - 3]
mov edi, dword [ecx + 0x20c]
mov edx, dword [edx*4 + 0x7cc024]
xor edi, edx
xor edx, edx
mov dword [ecx + 0x20c], edi
mov dl, byte [eax - 2]
mov edi, dword [ecx + 0x210]
mov edx, dword [edx*4 + 0x7cc024]
xor edi, edx
lea edx, [esi + eax]
cmp edx, 0x10
mov dword [ecx + 0x210], edi
jl 0x492dee
pop edi
pop esi
ret 4

Function at 0x493390
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push ebp
push 0xffffffffffffffff
call fcn.00492840
mov word [esi + 0x214], ax
xor edx, edx
shr eax, 0x10
mov word [esi + 0x216], ax
mov word [esi + 0x21a], dx
mov word [esi + 0x218], dx
mov byte [esi + 0x21e], dl
mov byte [esi + 0x21d], dl
mov byte [esi + 0x21c], dl
mov al, byte [ebp]
add esp, 0xc
cmp al, dl
mov byte [esp + 0x10], al
je 0x49346b
push ebx
mov cl, byte [esi + 0x21d]
mov bl, byte [esi + 0x21c]
xor cl, al
add bl, al
mov byte [esi + 0x21d], cl
mov cl, byte [esi + 0x21e]
add cl, al
mov byte [esi + 0x21c], bl
mov bl, cl
mov di, word [esi + 0x218]
shr bl, 7
shl cl, 1
or bl, cl
mov ecx, dword [esp + 0x14]
and ecx, 0xff
mov byte [esi + 0x21e], bl
movzx ax, al
xor di, word [ecx*4 + 0x7cc024]
lea ecx, [ecx*4 + 0x7cc024]
xor edi, eax
mov word [esi + 0x218], di
mov ecx, dword [ecx]
shr ecx, 0x10
add ecx, eax
add word [esi + 0x21a], cx
mov al, byte [ebp + 1]
inc ebp
cmp al, dl
mov byte [esp + 0x14], al
jne 0x4933f0
pop ebx
pop edi
pop esi
pop ebp
ret 4

Function at 0x493580
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov edx, eax
dec eax
test edx, edx
je 0x493637
push esi
mov esi, dword [esp + 8]
push edi
lea edi, [eax + 1]
add word [ecx + 0x214], 0x1234
mov ax, word [ecx + 0x214]
mov edx, eax
shr edx, 1
and edx, 0xff
mov dx, word [edx*4 + 0x7cc024]
xor word [ecx + 0x216], dx
mov edx, eax
shr edx, 1
and edx, 0xff
mov edx, dword [edx*4 + 0x7cc024]
shr edx, 0x10
sub word [ecx + 0x218], dx
mov dx, word [ecx + 0x218]
xor edx, eax
mov word [ecx + 0x214], dx
mov dx, word [ecx + 0x21a]
mov eax, edx
shl eax, 0xf
shr dx, 1
or eax, edx
xor ax, word [ecx + 0x216]
mov edx, eax
shl edx, 0xf
shr ax, 1
or edx, eax
xor word [ecx + 0x214], dx
mov ax, word [ecx + 0x214]
mov word [ecx + 0x21a], dx
mov al, byte [esi]
xor edx, edx
mov dl, ah
xor al, dl
mov byte [esi], al
inc esi
dec edi
jne 0x493598
pop edi
pop esi
ret 8