joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x28
call fcn.004d3ef0
push ebx
push ebp
mov ebp, dword [esp + 0x34]
xor ebx, ebx
push esi
push ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], ebx
call fcn.00473680
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x453bb7
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x28
ret
push edi
push esi
call fcn.00437390
push ebx
push ebx
mov edi, eax
push ebx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x2c]
push ecx
push ebp
call fcn.004731b0
add esp, 0x1c
test eax, eax
je 0x453f16
mov edx, dword [esp + 0x18]
push edx
push ebx
lea eax, [esp + 0x30]
push ebx
push eax
call fcn.0044c330
push ebx
call fcn.00438b80
add esp, 0x14
cmp dword [esp + 0x28], eax
jne 0x453c95
mov edi, dword [edi + 0x14]
push ebx
push edi
call fcn.00461a50
add esp, 8
cmp eax, ebx
jle 0x453f16
push 0x35b
push str..cryptoecec_ameth.c
mov eax, dword [esp + 0x10]
test eax, eax
je 0x453f27
push eax
call fcn.0042e1f0
add esp, 4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x453f38
push eax
call fcn.0044c280
add esp, 4
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret

Function at 0x453c21
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
je 0x453c5e
mov eax, dword [esi + 0x3c]
xor edi, edi
mov ebx, dword [eax + esi + 0x78]
add ebx, esi
mov ebp, dword [ebx + 0x20]
add ebp, esi
cmp dword [ebx + 0x18], edi
jbe 0x453c5e
mov eax, dword [ebp + edi*4]
push dword [esp + 0x18]
add eax, esi
push eax
call fcn.00453cb9
pop ecx
pop ecx
test al, al
jne 0x453c65
inc edi
cmp edi, dword [ebx + 0x18]
jb 0x453c42
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov eax, dword [ebx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x453c60

Function at 0x453c7c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, dword [eax + 0xc]
add esi, 0xc
mov esi, dword [esi]
mov eax, dword [esi + 0x30]
test eax, eax
je 0x453c8e
test edi, edi
je 0x453c9d
mov dword [edi], eax
cmp dword [esp + 0xc], 0
je 0x453cb3
push dword [esi + 0x30]
call fcn.00453d33
pop ecx
cmp dword [esp + 0xc], eax
jne 0x453c8e
mov eax, dword [esi + 0x18]
pop edi
pop esi
ret
Function at 0x453d5f
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x10]
xor ebp, ebp
push eax
push ebp
mov dword [esp + 0x18], ebp
call fcn.00453c7c
push ebp
push dword [0x53bbd0]
mov ebx, eax
call fcn.00453c7c
mov esi, dword [0x53bbe4]
add esp, 0x10
mov edi, eax
cmp dword [esi], ebp
je 0x453dc2
push dword [esp + 0x10]
call fcn.00453ce0
pop ecx
cmp al, byte [esi]
je 0x453daa
cmp al, byte [esi + 1]
jne 0x453e88
push dword [esp + 0x10]
call fcn.00453d14
pop ecx
cmp eax, dword [esi + 4]
je 0x453dc2
cmp eax, dword [esi + 8]
jne 0x453e88
push 4
push 0x1000
push dword [0x53bbdc]
mov dword [esp + 0x20], ebp
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
mov edx, ebp
cmp dword [0x53bbe0], ebp
jbe 0x453e01
mov ecx, dword [str.VirtualProtect]
mov ecx, dword [ecx + edx]
mov dword [edx + esi], ecx
mov eax, dword [0x53bbe8]
add edx, eax
cmp edx, dword [0x53bbe0]
jb 0x453de6
push esi
push edi
call fcn.00453c21
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x453e88
mov esi, dword [0x53bc00]
lea eax, [esp + 0x14]
push eax
push dword [0x53bbe0]
push dword [0x53bc04]
push esi
call edi
mov edx, dword [0x53bc08]
add edx, ebx
push 8
pop ecx
mov ebx, dword [edx + 4]
cmp dword [0x53bc04], ecx
jbe 0x453e57
mov eax, dword [edx + ecx]
add eax, ebx
mov dword [esi + ecx], eax
mov eax, dword [0x53bbe8]
add ecx, eax
cmp ecx, dword [0x53bc04]
jb 0x453e40
mov eax, dword [0x53bbec]
mov dword [esi + 8], eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x18]
push dword [0x53bc04]
push esi
call edi
mov eax, dword [0x53bbf4]
mov ecx, dword [esi + 0xc]
add ecx, eax
mov eax, dword [0x53bbf4]
add ecx, esi
add esi, eax
push esi
call ecx
pop ecx
push ebp
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x457fd0
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.004d1130
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret

Function at 0x459810
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.004d1130
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
mov eax, 1
pop esi
ret

Function at 0x459870
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.004d1130
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
pop esi
ret
Function at 0x45ad60
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
lea eax, [ecx + 1]
ret

Function at 0x45ae00
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret
Function at 0x46cc50
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x46cd33
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
movzx edx, byte [esi]
jl 0x46ccce
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
inc ecx
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x46cd20
shl edx, 0x10
cmp edi, 2
jne 0x46ccdf
movzx eax, byte [esi + 1]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edi, 1
jne 0x46cd0d
lea edx, [edi + 0x3c]
jmp 0x46cd1a
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x46cc70
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x46ed10
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5c
call fcn.004d3ef0
mov eax, dword [0x53bd24]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x70]
push ebx
mov ebx, dword [esp + 0x64]
push ebp
mov ebp, dword [esp + 0x74]
push esi
mov esi, dword [esp + 0x88]
push edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x88]
dec edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], edi
test eax, eax
jne 0x46ed6d
call fcn.0043af40
mov dword [esp + 0x10], eax
test esi, esi
jne 0x46ed75
mov dword [esp + 0x14], eax
push eax
call fcn.0043b090
mov esi, eax
lea eax, [esi + esi]
sub edi, eax
lea edx, [edi - 1]
add esp, 4
cmp ebp, edx
jle 0x46edb9
push 0x3a
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0xa0
push 4
call fcn.0042cee0
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004cf1f2
add esp, 0x5c
ret
inc eax
cmp dword [esp + 0x1c], eax
jge 0x46edcb
push 0x40
push str..crypto_rsa_rsa_oaep.c
push 0x78
jmp 0x46ed95
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x84]
push 0
push ecx
lea eax, [ebx + 1]
mov byte [ebx], 0
push 0
lea ebx, [ebx + esi + 1]
push ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
push edx
push eax
call fcn.0043a170
add esp, 0x18
test eax, eax
je 0x46eda4
sub edi, ebp
dec edi
push edi
lea ecx, [ebx + esi]
push 0
push ecx
call fcn.004d1130
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
mov edx, ebx
sub edx, ebp
sub edx, esi
push ebp
lea eax, [edx + edi]
push ecx
push eax
mov byte [eax - 1], 1
call fcn.004d11b0
mov ebp, dword [esp + 0x30]
push esi
push ebp
call fcn.00426eb0
add esp, 0x20
test eax, eax
jle 0x46eda4
push 0x55
sub edi, esi
push str..crypto_rsa_rsa_oaep.c
push edi
call fcn.0042dff0
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
jne 0x46ee66
push 0x57
push str..crypto_rsa_rsa_oaep.c
push 0x41
jmp 0x46ed95
mov edx, dword [esp + 0x14]
push edx
push esi
push ebp
push edi
push eax
call fcn.0046eb90
add esp, 0x14
test eax, eax
jl 0x46eeb8
test edi, edi
jle 0x46ee9f
mov ebp, dword [esp + 0x10]
mov eax, ebx
sub ebp, ebx
mov ecx, edi
lea esp, [esp]
mov dl, byte [eax + ebp]
xor byte [eax], dl
inc eax
sub ecx, 1
jne 0x46ee90
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push eax
push edi
push ebx
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.0046eb90
add esp, 0x14
test eax, eax
jge 0x46eeda
mov edx, dword [esp + 0x10]
push edx
call fcn.0042e1f0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004cf1f2
add esp, 0x5c
ret
test esi, esi
jle 0x46eef1
lea ecx, [esp + 0x28]
mov eax, ebp
sub ecx, ebp
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub esi, 1
jne 0x46eee6
mov eax, dword [esp + 0x10]
push eax
call fcn.0042e1f0
mov ecx, dword [esp + 0x6c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004cf1f2
add esp, 0x5c
ret
Function at 0x46fd90
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x46fe59
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x46fdb1
cmp al, 0x6b
jne 0x46fe59
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x46fe1a
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x46fdd1
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x46fdd1
cmp al, 0xbb
jne 0x46fdfa
inc ecx
cmp ecx, esi
jl 0x46fdc1
sub esi, ecx
test ecx, ecx
jne 0x46fe1d
push 0x83
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.0042cee0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x7b
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.0042cee0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x46fe46
push 0x8b
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.0042cee0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.004d11b0
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x70
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.0042cee0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret

Function at 0x474070
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x10c], 0xffffffff
jne 0x474082
xor eax, eax
pop edi
ret
push ebx
push esi
push edi
call fcn.0043b030
mov ebx, dword [esp + 0x18]
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 4
mov dword [eax], esi
test ebx, ebx
je 0x474132
mov eax, dword [edi + 0x10c]
push ebp
cmp eax, esi
jne 0x4740d0
test esi, esi
jle 0x474111
mov ecx, ebx
lea eax, [edi + 0x8c]
mov ebp, esi
lea ebx, [ebx]
mov dl, byte [eax + 0x60]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub ebp, 1
jne 0x4740c0
jmp 0x474111
mov ecx, esi
sub ecx, eax
cmp ecx, 1
mov byte [eax + edi + 0xec], 0x80
jle 0x4740f5
dec ecx
push ecx
lea eax, [eax + edi + 0xed]
push 0
push eax
call fcn.004d1130
add esp, 0xc
test esi, esi
jle 0x474111
mov ecx, ebx
lea eax, [edi + 0xac]
mov ebp, esi
mov dl, byte [eax + 0x40]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub ebp, 1
jne 0x474103
push esi
push ebx
push ebx
push edi
call fcn.0043b040
add esp, 0x10
pop ebp
test eax, eax
jne 0x474132
push esi
push ebx
call fcn.00436720
add esp, 8
pop esi
pop ebx
xor eax, eax
pop edi
ret
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x47e720
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.004d3ef0
mov eax, dword [0x53bd24]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
test eax, eax
jbe 0x47e8b4
push ebx
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x18], eax
movzx ebx, byte [esi]
movzx eax, byte [esi + 1]
inc esi
movzx ecx, byte [esi + 1]
inc esi
movzx edx, byte [esi + 1]
shl eax, 8
or ebx, eax
inc esi
movzx eax, byte [esi + 1]
inc esi
shl ecx, 0x10
or ebx, ecx
movzx ecx, byte [esi + 1]
shl edx, 0x18
inc esi
or ebx, edx
movzx edx, byte [esi + 1]
inc esi
shl ecx, 8
or eax, ecx
movzx ecx, byte [esi + 1]
inc esi
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
inc esi
mov byte [edi], dl
mov byte [ebp], al
call fcn.00434940
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.00434a40
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.0044c860
push ebp
call fcn.00434940
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.00434a40
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.0044c860
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
inc eax
shr edx, 8
add esp, 0x30
mov byte [eax], dl
inc eax
inc eax
mov edx, ebx
shr edx, 0x10
mov byte [eax - 1], dl
mov edx, dword [esp + 0x14]
inc eax
shr ebx, 0x18
mov byte [eax - 1], bl
mov byte [eax], dl
mov ebx, edx
inc eax
inc eax
shr ebx, 8
mov byte [eax - 1], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax], bl
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 8
mov eax, ebp
mov byte [eax], cl
mov byte [eax + 1], dl
inc eax
inc eax
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
inc eax
shr ecx, 0x18
mov byte [eax], cl
mov ecx, dword [esp + 0x10]
inc eax
mov byte [eax], cl
mov edx, ecx
shr edx, 8
inc eax
mov byte [eax], dl
mov edx, ecx
inc eax
shr edx, 0x10
shr ecx, 0x18
sub dword [esp + 0x18], 1
mov byte [eax], dl
mov byte [eax + 1], cl
jne 0x47e763
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.004cf1f2
add esp, 0xa0
ret
Function at 0x480840
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.004d3ef0
mov eax, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x28]
test esi, esi
je 0x480885
test ebx, ebx
je 0x480885
mov cl, byte [esi + edi]
mov ebp, dword [esp + 0x18]
xor cl, byte [ebp]
mov eax, dword [esp + 0x1c]
mov byte [eax], cl
inc eax
inc ebp
inc esi
dec ebx
and esi, 0xf
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebp
jne 0x480860
cmp ebx, 0x10
jb 0x480900
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, edx
sub eax, edi
mov dword [esp + 0x20], eax
mov eax, ebx
shr eax, 4
mov ebp, ecx
mov dword [esp + 0x10], eax
shl eax, 4
add ecx, eax
sub ebp, edi
add edx, eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x24]
push edx
push edi
push edi
call dword [esp + 0x3c]
add esp, 0xc
cmp esi, 0x10
jae 0x4808ec
mov ecx, 0xf
sub ecx, esi
shr ecx, 2
lea eax, [esi + edi]
inc ecx
mov edx, dword [esp + 0x20]
mov edx, dword [edx + eax]
xor edx, dword [eax]
add eax, 4
sub ecx, 1
mov dword [eax + ebp - 4], edx
jne 0x4808d7
add dword [esp + 0x20], 0x10
sub ebx, 0x10
add ebp, 0x10
xor esi, esi
sub dword [esp + 0x10], 1
jne 0x4808b6
test ebx, ebx
je 0x48093d
mov eax, dword [esp + 0x24]
push eax
push edi
push edi
call dword [esp + 0x3c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
add esp, 0xc
lea eax, [esi + edi]
sub ebp, edi
sub ecx, edi
add esi, ebx
mov dl, byte [eax + ebp]
xor dl, byte [eax]
dec ebx
mov byte [eax + ecx], dl
inc eax
test ebx, ebx
jne 0x480923
mov eax, dword [esp + 0x2c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x2c]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x480b80
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x34
call fcn.004d3ef0
mov eax, dword [0x53bd24]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
push ebx
push esi
mov esi, dword [esp + 0x44]
mov ebx, edx
lea edx, [esi - 1]
push edi
mov edi, dword [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x4c]
cmp edx, 0x7f
ja 0x480d39
mov edx, dword [edi]
mov dword [esp + 0x18], edx
mov edx, dword [edi + 4]
push ebp
mov dword [esp + 0x20], edx
mov edx, dword [edi + 8]
push eax
mov dword [esp + 0x28], edx
mov edx, dword [edi + 0xc]
push edi
push edi
mov dword [esp + 0x34], edx
call ecx
lea eax, [esi + 7]
cdq
and edx, 7
add eax, edx
mov esi, eax
add esp, 0xc
sar esi, 3
cmp dword [esp + 0x58], 0
je 0x480c27
test esi, esi
jle 0x480c6e
mov eax, dword [esp + 0x14]
mov edx, edi
lea ebp, [esp + 0x2c]
sub edx, ebx
sub ebp, ebx
sub eax, ebx
mov ecx, ebx
mov dword [esp + 0x14], eax
lea ecx, [ecx]
mov al, byte [edx + ecx]
xor al, byte [ecx]
mov ebx, dword [esp + 0x14]
mov byte [ecx + ebp], al
mov byte [ebx + ecx], al
inc ecx
sub esi, 1
jne 0x480c10
jmp 0x480c6e
xor ebp, ebp
test esi, esi
jle 0x480c6e
lea eax, [esp + 0x2c]
mov ecx, eax
sub ebx, eax
mov eax, dword [esp + 0x14]
mov edx, edi
sub edx, ecx
sub eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
jmp 0x480c54
mov edx, dword [esp + 0x18]
lea ecx, [esp + ebp + 0x2c]
mov al, byte [ebx + ecx]
mov dl, byte [edx + ecx]
xor dl, al
mov byte [ecx], al
mov eax, dword [esp + 0x14]
inc ebp
cmp ebp, esi
mov byte [eax + ecx], dl
jl 0x480c50
mov eax, dword [esp + 0x4c]
mov ecx, eax
and ecx, reloc.WS2_32.dll_getsockopt
jns 0x480c81
dec ecx
or ecx, 0xfffffff8
inc ecx
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x14], ecx
test ecx, ecx
jne 0x480cc2
mov ecx, dword [esp + eax + 0x1c]
mov edx, dword [esp + eax + 0x20]
lea eax, [esp + eax + 0x1c]
mov dword [edi], ecx
mov ecx, dword [eax + 8]
mov dword [edi + 4], edx
mov edx, dword [eax + 0xc]
pop ebp
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004cf1f2
add esp, 0x34
ret
mov dl, 8
sub dl, cl
mov byte [esp + 0x13], dl
inc edi
lea esi, [esp + eax + 0x1d]
mov ebp, 4
movzx edx, byte [esi - 1]
mov al, byte [esi]
shl dl, cl
movzx ecx, byte [esp + 0x13]
mov bl, al
shr bl, cl
mov ecx, dword [esp + 0x14]
shl al, cl
movzx ecx, byte [esp + 0x13]
or dl, bl
mov byte [edi - 1], dl
mov dl, byte [esi + 1]
mov bl, dl
shr bl, cl
mov ecx, dword [esp + 0x14]
shl dl, cl
movzx ecx, byte [esp + 0x13]
or al, bl
mov byte [edi], al
mov al, byte [esi + 2]
mov bl, al
shr bl, cl
movzx ecx, byte [esp + 0x13]
or dl, bl
mov byte [edi + 1], dl
movzx edx, byte [esi + 3]
shr dl, cl
mov ecx, dword [esp + 0x14]
shl al, cl
add esi, 4
add edi, 4
or dl, al
sub ebp, 1
mov byte [edi - 2], dl
jne 0x480cd4
pop ebp
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004cf1f2
add esp, 0x34
ret