joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444bf1
Capabilities:
Check os version
Encode data using base64

Disassembly:
add esp, 4
xor eax, eax
jb 0x43ff31
sub cl, 0x34
shl al, 0x20
mov dl, byte [ebp + eax - 0xf0]
xor dl, cl
jb 0x434a66
add dl, 0x58
xchg bl, dh
xchg dh, bl
mov byte [ebp + eax - 8], dl
mov dx, dx
inc eax
cmp eax, 8
jl 0x444c05
jge 0x444c34
add dword [eax], esi
pop ss
enter 0x73e9, 0xfffffffffffffff8
invalid
jmp fcn.004444ac

Function at 0x447980
Capabilities:
Check os version
Encode data using base64

Disassembly:
je 0x436183
ret 0xdef1
add ebx, 0
test bh, 0xf8
xor eax, eax
jb 0x449559
jne 0x4329ee
je 0x4361a0
cpuid
test ebx, eax
je 0x4329ee
xor eax, 0x4468b64
mov cl, cl
shl ax, 0x20
mov eax, dword [ebp + eax]
xchg al, cl
xchg cl, al
mov ebx, dword [esi + 8]
shr cx, 0x40
mov al, byte [eax]
lea esi, [esi + 0xc]
and byte [ebp + ebx], al
jb 0x43097e
shr si, 0x40
jmp dword [esi]
clc
lodsb al, byte [esi]
call fcn.00434a50
add eax, 0x24648dec
add al, 0xf5
sub word [ebp + ebx], ax
jmp dword [esi]
pop dword [esp - 4]
je 0x44e328
jne 0x44798f
pop ebx
out 0x6e, al
xor eax, eax
jb 0x43d649
pop esi
mov esp, ebp
jne 0x44e321
je 0x4479a4
sahf
dec dword [edi]
test byte [edi + 0x69], dh
add byte [eax], al
je 0x44e321
invalid
and eax, 0xb3d5e807
invalid
pop ebp
ret
shr bh, 0x40
mov al, byte [ebp - 0x62]
cmp al, 1
jne 0x44e37d
je 0x44e33a
cwde
dec esp
mov cl, byte [ebp - 0x60]
xor eax, eax
jb 0x43d652
sub cl, 0x34
shl eax, 0x20
mov dl, byte [ebp + eax - 0xf0]
xor dl, cl
jb 0x43ff2a
add dl, 0x58
mov bp, bp
mov byte [ebp + eax - 8], dl
lea ecx, [ecx]
inc eax
cmp eax, 8
jl 0x44e34b
jge 0x44e376
in eax, dx
mov ch, 0xe9
xor dword [ecx - 1], esp
push dword [0x89023cb3]
imul al
or cl, byte [edx]
add bh, al
dec esp
jmp fcn.004444ac
cmp al, 2
mov esi, esi
call 0x452d90
invalid

Function at 0x449d2a
Capabilities:
Check os version
Encode data using base64

Disassembly:
push 0x424d59
ret
mov dl, byte [ebp + 0xb]
test al, 0xc3
add esp, 0x2c
mov byte [esi + 0xba], bl
test ax, ax
jb 0x429ec4
shr di, 0x40
mov bp, bp
mov byte [esi + 0xbb], dl
lea esi, [esi]
shr bx, 0x40
xchg ebp, edi
xchg edi, ebp
mov ch, ch
push edx
mov dx, 0x7d1d
xchg dh, dh
pop edx
shr si, 0x40
mov word [esi + 0xbc], di
mov cx, cx
jne 0x41ab09
je 0x435a59
push cs
sub byte [eax], ch
jmp 0x414e70
lea esp, [esp + 4]
shl bl, 0x20
mov eax, dword [ebp - 8]
lea eax, [eax]
jne 0x435a05
shr edi, 0x40
je 0x449d43
push ebx
out dx, al
je 0x435a05
and eax, 0x4468b9b
mov cx, cx
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
adc byte [ebp + ebx], al
shr al, 0x40
jmp dword [esi]
Function at 0x44ba55
Capabilities:
Check os version
Encode data using base64

Disassembly:
jmp 0x436d07
push 0xe
add ecx, 0x74
jmp 0x42d613
push eax
push ecx
call fcn.00423194
cmp bx, bx
add esp, 0xc
neg al
sbb eax, eax
stc
and al, 0xea
jb 0x439a7b
add eax, 0x16
mov ebx, ebx
pop esi
xchg ch, dl
xchg dl, ch
mov esp, ebp
pop ebp
ret
pop ebp
ret
shl bp, 0x20
lea esi, [esi + 0xc]
or dword [ebx], eax
jb 0x437fc2
jmp dword [esi]
or edx, esp
shr dh, 0x40
mov eax, dword [esi + 4]
movzx eax, byte [ebp + eax]
push 0x4478b0
ret
inc edx
out dx, eax
mov eax, dword [esi + 4]
jne 0x4476bc
shr dx, 0x40
je 0x439a7e
xchg esi, eax
ret
je 0x4476bc
invalid
mov eax, 1
adc byte [ecx + 0xf], 0x8e
mov ch, 0x46
mov ebx, dword [esi + 8]
mov eax, dword [ebp + eax]
mov ebx, dword [ebp + ebx]
shr cx, 0x40
jmp 0x41fd5c
pop dword [esp - 4]
shr ax, 0x40
je 0x43d81b
jne 0x44ba68
add al, 0x16
xchg ecx, edx
xchg ecx, edx
xchg edx, ecx
shl ax, 0x20
inc eax
cmp eax, 0x43
jb 0x44d6b9
jae 0x44ba82
rcl ch, cl
mov ecx, ebp
xor eax, eax
jb 0x444053
js 0x4341bb
jns 0x44ba96
mov byte [0xfa8949b], al
mov dword [edi], ebx
xchg esi, edi
push dword [ecx + edi*4]
jns 0x4341bb
xor al, 0xb9
call fcn.0042155a
add esp, 0x10
jno 0x44e01c
jo 0x44bab3
pop edi
add eax, 0x2563800f
add byte [eax], al
jo 0x44e01c
fcomp dword [ecx - 0x24761377]
pop ebp
ret
invalid
test ax, ax
jb 0x439a6a
jne 0x42d636
je 0x44e031
cmp ebp, dword [edx + 0xe8b8e72]
mov ecx, dword [esi]
lea eax, [ebp - 0x180]
jno 0x42d60a
jo 0x44e044
jo 0x44e019
in eax, dx
jo 0x42d60a
xor al, 0x63
push 0x43bd36
ret

Function at 0x44d341
Capabilities:
Check os version
Encode data using base64

Disassembly:
lcall 0x445d, 0x8bf68909
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
mov al, byte [ebp + eax]
lea esi, [esi + 0xc]
inc esi
add al, 0x8b
push esi
or byte [edx - 0x72fffabc], cl
jbe 0x425743
cmc
cmp byte [ebx + edx], al
jne 0x431160
je 0x425746
je 0x42572b
jmp 0x425756
je 0x431160
add esp, 4
and edx, 7
jb 0x425723
and bp, bp
sub eax, edx
push eax
push esi
mov si, si
xchg edi, eax
xchg edi, eax
call fcn.00452508
jmp fcn.0041dfc3
Function at 0x4511d0
Capabilities:
Get file size

Disassembly:
pop ebp
ret
jne 0x440cf5
je 0x43a448
and al, bh
je 0x440cf5
invalid
push 8
lea ecx, [ebp - 0x10]
push 0x475384
push ecx
call fcn.00423194
add esp, 0xc
test al, al
jb 0x423f68
jne 0x44e45a
je 0x440d20
mov dl, byte [ecx - 0x13]
ret 0x86a
push 8
lea edx, [ebp - 8]
push 0
push edx
call fcn.0041e94f
mov eax, dword [esi]
push 0x100
js 0x44d018
shr edi, 0x40
jns 0x440d43
pop esi
xchg eax, edi
dec ecx
jns 0x44d018
fiadd dword [ebx - 0x77f4ba76]
fcmovnb st(0), st(0)
loope fcn.00440d73
fidiv dword [edx - 0x3dbbb71]
call fcn.004219a2
lea ecx, [ebp - 0x11c]
push eax
shr ax, 0x40
push ecx
call fcn.0044b066
lea edx, [ebp - 0x11c]
push 0
push edx
call fcn.0044dd13
lea eax, [ebp - 0x11c]
jmp 0x450a34
mov dword [edi + 4], eax
shr edx, 7
and edx, 0x1f
jb 0x43e91c
xor eax, ebx
jb 0x41a78b
sub ecx, edx
shr edi, 0x40
mov ebx, eax
shr ebx, cl
mov ecx, edx
push 0x41985f
ret
push 0
mov bl, bl
jmp 0x450a39
push eax
call fcn.004244e3
lea ecx, [ebp - 0x11c]
ja 0x416e2a
jbe 0x450a52
nop
cpuid
ret 0x860f
jbe 0x416e2a
sbb byte [ebx + 0x8c681], 0
add byte [ecx - 0x2ff6f78b], cl
jb 0x43cc7f
shl ah, 0x20
mov edx, dword [esi - 8]
sub eax, edx
mov edx, eax
ja 0x44ddbf
xchg al, dh
xchg dh, al
jbe 0x450a84
aad 0x80
jne 0x450a94
jbe 0x44ddbf
xchg byte [0xd8ffffd3], dh
cmp al, 0x66
fdivr dword [esi]
add ebp, 0x1f300000
jb 0x44ce51
cmp byte [eax - 0x3d], 0x26
iretd
jmp dword [esi]
add esp, 4
cmp word [ebp + 0xa], ax
je 0x43a43e
jne 0x450ba2
mov dl, 0x55
xor eax, eax
jb 0x44b093
pop esi
mov esp, ebp
ja 0x43a43a
jbe 0x450bb9
cpuid
ret
jbe 0x43a43a
xor al, 0xb8
jne 0x41fdb6
shr ecx, 0x40
shl edi, 0x20
mov bp, bp
je 0x450bd4
mov ch, 0xcc
je 0x41fdb6
invalid
push ebp
mov ebp, esp
js 0x41b9a6
jns 0x4511df
mov eax, 0x890fe59b
shl dword [edi + 0x6fdafffc], 0x8b
jns 0x41b9a6
fisubr dword [edi - 0x75]
push es
jmp 0x4511ea
push eax
call fcn.0043c88e
jno 0x450b8e
jo 0x4511fd
cpuid
test ebx, 0xf98b800f
invalid
jo 0x450b8e
mov dword [edi - 0x2cd2618], 0xc1168bff
jecxz 0x45122f

Function at 0x453e2c
Capabilities:
Check os version
Encode data using base64
Encode data using xor

Disassembly:
shl ch, 0x20
mov ecx, dword [esi]
add esi, 8
and ecx, ecx
jae 0x41db5e
rol esp, 6
jae 0x41db6e
jae 0x441523
cmp dword [edi + 0x25000239], 0xffffffde
mov si, si
and eax, 0xf68966de
mov eax, dword [eax]
lea esi, [esi + 0xc]
adc dword [ebp + ebx], eax
mov edx, edx
jno 0x44d324
mov dx, dx
jo 0x41db83
sbb al, 0x43
fnstsw word [ecx]
jo 0x44d324
fsubr dword [esi + 0x5448b]
lea esi, [esi + 0xc]
mov dword [ebx], eax
mov edi, edi
jmp dword [esi]
pop dword [esp - 4]
jne 0x43448a
shl ax, 0x20
je 0x453e3f
add edi, dword [ecx + 0x6870fb5]
popfd
cld
push dword [esi + 4]
ja 0x41db4b
jbe 0x453e4b
jae 0x453e5d
leave
pop ebx
jbe 0x41db4b
add byte [esi - 0x3f], ah
ljmp 0xd340
Function at 0x454990
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
cmp dword [esp + 0x10c], 0
push ebx
push esi
push edi
push ebp
jne 0x4549b4
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
cmp dword [esp + 0x124], 0
jne 0x4549ce
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
xor eax, eax
mov edx, dword [esp + 0x11c]
mov ax, word [edx]
add eax, 7
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x11c]
sar eax, 3
mov si, ax
lea eax, [esp + 0x18]
movzx ebp, si
push ebp
push edx
push eax
call fcn.004642b0
add esp, 0xc
cmp si, 0xfc
jbe 0x454a19
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
mov eax, dword [esp + 0x124]
push eax
call fcn.004610a0
mov esi, dword [esp + 0x124]
add esp, 4
test esi, esi
jne 0x454ac7
xor cx, cx
mov eax, dword [esp + 0x124]
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x454a49
xor di, di
xor edx, edx
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
mov edx, dword [esp + 0x11c]
xor eax, eax
mov cl, byte [esi]
mov al, byte [ebx + edx + 2]
xor edx, edx
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x454a65
jmp 0x454b8a
mov edx, dword [esp + 0x11c]
push ebp
lea eax, [esp + 0x1c]
push edx
push eax
add esi, 2
call fcn.004642b0
lea eax, [esp + ebp + 0x24]
add esp, 0xc
push 4
push esi
push eax
call fcn.004642b0
xor cx, cx
mov eax, dword [esp + 0x130]
add esp, 0xc
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x454b01
xor di, di
xor edx, edx
add ebp, 4
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
xor edx, edx
xor eax, eax
mov cl, byte [esi]
mov al, byte [esp + ebx + 0x18]
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x454b20
lea eax, [esp + 0x18]
push 0
push 0x100
push eax
call fcn.00464290
add esp, 0xc
mov edx, dword [esp + 0x14]
push 0x100
mov eax, dword [esp + 0x128]
push edx
push eax
call fcn.004610f0
add esp, 0xc
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x454cf0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x174
push esi
push edi
mov esi, dword [esp + 0x194]
mov dword [esi], 0
mov ecx, dword [eax]
test ecx, ecx
jne 0x454d1c
mov ax, 0xcc
pop edi
pop esi
add esp, 0x174
ret
lea eax, [esp + 0x20]
mov edx, dword [esp + 0x184]
push eax
push edx
push ecx
call fcn.00454990
add esp, 0xc
test ax, ax
jne 0x454e68
xor eax, eax
mov al, byte [esp + 0x190]
test eax, eax
je 0x454d64
cmp eax, 1
je 0x454dde
mov ax, 0xa
pop edi
mov dword [esi], 0
pop esi
add esp, 0x174
ret
mov eax, dword [esp + 0x188]
test eax, eax
je 0x454d85
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004610f0
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.00461250
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 0x18
shr cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x454d9b
xor eax, eax
mov dword [esp + 8], edi
lea ecx, [esp + 0xb]
mov dl, byte [esp + eax + 0x1c]
sub ecx, eax
inc eax
xor byte [ecx], dl
cmp eax, 4
jb 0x454dc6
mov eax, dword [esp + 8]
jmp 0x454e4f
mov eax, dword [esp + 0x188]
test eax, eax
je 0x454dff
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004610f0
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.00461250
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x454e15
xor eax, eax
mov dword [esp + 8], edi
mov cl, byte [esp + eax + 0x1c]
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 4
jb 0x454e3d
mov eax, dword [esp + 8]
push 0
mov dword [esi], eax
lea eax, [esp + 0x24]
push 0x15c
push eax
call fcn.00464290
xor ax, ax
add esp, 0xc
pop edi
pop esi
add esp, 0x174
ret
Function at 0x455660
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
push ebp
test esi, esi
je 0x4556c7
mov edi, dword [esp + 0x14]
mov cl, byte [edi]
xor ebp, ebp
mov bp, ax
mov dl, cl
shr ax, 4
and ebp, 0xf
and dl, 0xf
xor ebx, ebx
mov bl, dl
and cl, 0xf3
shr cl, 2
inc edi
mov edx, dword [ebx*4 + 0x475f90]
xor ebx, ebx
xor dx, ax
xor eax, eax
xor dx, word [ebp*4 + 0x475f90]
mov al, cl
mov bx, dx
mov eax, dword [eax + 0x475f90]
shr dx, 4
and ebx, 0xf
xor ax, dx
xor ax, word [ebx*4 + 0x475f90]
dec esi
jne 0x455673
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4556d0
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
push ebx
mov dword [eax], 0
cmp dword [esp + 0x1c], 1
push esi
push edi
push ebp
jae 0x4556f2
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
xor edi, edi
mov ebp, dword [esp + 0x28]
cmp ebp, edi
je 0x4557f0
lea eax, [edi*4]
mov ecx, 3
sub edx, edx
xor ebx, ebx
div ecx
mov edx, dword [esp + 0x1c]
lea esi, [edx + eax]
mov eax, dword [esp + 0x24]
add eax, edi
inc esi
inc esi
mov dword [esp + 0x10], eax
mov al, byte [eax]
mov ecx, dword [esp + 0x10]
mov byte [esp + 0x14], al
mov dl, byte [ecx + 1]
and al, 3
xor ecx, ecx
mov bl, al
mov al, dl
shl ebx, 4
and dl, 0xf
shr al, 4
mov cl, al
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], 0
or ebx, ecx
mov cl, byte [eax + 2]
xor eax, eax
and ebx, 0x3f
mov al, dl
mov dl, cl
shl eax, 2
and cl, 0x3f
shr dl, 6
mov byte [esp + 0x10], dl
xor edx, edx
or eax, dword [esp + 0x10]
mov dl, cl
mov dword [esp + 0x10], 0
mov cl, byte [esp + 0x14]
shr cl, 2
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 2], cl
mov cl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 1], cl
cmp ebp, 3
mov ecx, ebp
jb 0x4557a9
mov ecx, 3
cmp ecx, 1
jne 0x4557b7
mov byte [esi], 0x3d
mov byte [esi + 1], 0x3d
jmp 0x4557d9
and eax, 0x3f
inc esi
cmp ecx, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi - 1], al
jne 0x4557ce
mov byte [esi], 0x3d
jmp 0x4557d9
and edx, 0x3f
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], al
sub ebp, 3
mov eax, dword [esp + 0x20]
add edi, 3
add dword [eax], 4
cmp edi, dword [esp + 0x28]
jb 0x455700
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x455e20
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
push esi
xor ebx, ebx
mov esi, dword [esp + 0xc]
mov ecx, 4
mov al, byte [esi + 2]
mov bl, byte [eax + str._.C]
mov eax, dword [esp + 0x10]
cmp eax, ecx
jle 0x455e58
mov edx, ebx
inc ecx
and edx, 0xff
inc ebx
mov dl, byte [edx + str._.C]
xor byte [esi + ecx - 1], dl
cmp ecx, eax
jl 0x455e40
pop esi
pop ebx
ret
Function at 0x4560f0
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [esp + 8]
push ebx
and ax, 0x8000
push esi
mov dx, word [esp + 0x10]
mov ecx, dword [esp + 0xc]
cmp ax, 1
sbb eax, eax
add dx, dx
inc eax
or ax, dx
mov word [esp + 0x10], ax
xor byte [esp + 0x11], al
mov ax, word [esp + 0x10]
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
mov esi, 0x55
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
mov eax, 0x58
mov dl, byte [esp + 0x10]
mov bl, byte [esp + 0x10]
and dl, 0x80
add bl, bl
shr dl, 7
add ecx, 2
or dl, bl
mov byte [esp + 0x10], dl
mov dl, byte [esp + 0x11]
and dl, 1
mov bl, byte [esp + 0x11]
shl dl, 7
shr bl, 1
or dl, bl
mov byte [esp + 0x11], dl
mov bl, byte [esp + 0x10]
xor byte [esp + 0x11], bl
mov dx, word [esp + 0x10]
not dx
mov word [esp + 0x10], dx
xor word [ecx - 2], dx
add word [esp + 0x10], si
dec eax
jne 0x456173
pop esi
pop ebx
ret

Function at 0x457db0
Capabilities:
Encode data using xor

Disassembly:
xor ax, ax
sub esp, 8
mov al, byte [esp + 0xc]
push ebx
and ax, 0xf
push esi
mov word [esp + 0xa], ax
push edi
mov eax, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x24]
lea ecx, [eax + ebp - 1]
mov dword [esp + 0x14], ecx
xor bl, bl
mov edi, dword [esp + 0x14]
test bp, bp
lea esi, [ebp - 1]
je 0x457e01
mov dl, byte [edi]
mov eax, edi
dec edi
mov cl, bl
mov bl, dl
add dl, dl
shr bl, 7
or dl, cl
mov byte [eax], dl
mov ax, si
dec si
test ax, ax
jne 0x457de5
test bl, bl
je 0x457e0c
mov eax, dword [esp + 0x14]
or byte [eax], 1
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x457dd7
xor si, si
test ebp, ebp
je 0x457e39
mov dl, byte [esp + 0x1c]
mov eax, dword [esp + 0x20]
movzx ecx, si
inc si
xor byte [ecx + eax], dl
movzx ecx, si
cmp ecx, ebp
jb 0x457e22
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x4585d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov cl, byte [esp + 8]
push ebx
mov edx, dword [esp + 0x10]
push esi
xor si, si
push edi
cmp dword [esp + 0x1c], 0
push ebp
je 0x4585fa
movzx eax, si
inc si
xor byte [eax + edx], cl
movzx ebx, si
cmp ebx, dword [esp + 0x20]
jb 0x4585e9
xor ax, ax
mov al, cl
and ax, 0xf
mov word [esp + 0x12], ax
mov di, word [esp + 0x20]
xor cl, cl
dec di
mov esi, edx
cmp word [esp + 0x20], 0
je 0x45863c
mov al, byte [esi]
mov ebp, esi
inc esi
mov bl, cl
shl bl, 7
mov cl, al
shr al, 1
and cl, 1
or bl, al
mov byte [ebp], bl
mov bp, di
dec di
test bp, bp
jne 0x45861b
test cl, cl
je 0x458643
or byte [edx], 0x80
mov ax, word [esp + 0x12]
dec word [esp + 0x12]
test ax, ax
jne 0x458608
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x45c3b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x88
push ebx
lea ecx, [eax + 7]
shr ecx, 3
push esi
push edi
and eax, 7
mov esi, dword [esp + 0x98]
push ebp
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
jne 0x45c3e0
mov dword [esp + 0x18], 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x24], eax
je 0x45c4d2
mov eax, dword [esp + 0x10]
xor dword [esi], eax
mov ecx, dword [esp + 0x14]
xor dword [esi + 4], ecx
cmp dword [esp + 0x20], 0
jne 0x45c4a2
cmp dword [esp + 0x1c], 2
push 0
jbe 0x45c483
lea eax, [esp + 0x2c]
push eax
push esi
call fcn.0045c580
add esp, 0xc
cmp dword [0x476458], 0
jne 0x45c56d
mov eax, dword [esp + 0x28]
lea ebx, [esp + 0x30]
mov edi, 0x19
mov dword [esp + 0x30], eax
mov eax, dword [ebx]
mov cl, 0x20
add eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov dword [ebx + 4], eax
add ebx, 4
mov eax, dword [esp + 0x28]
mov edx, dword [ebx - 4]
and dl, 0x1f
sub cl, dl
shl eax, cl
mov cl, dl
shr ebp, cl
or eax, ebp
xor dword [esp + 0x34], eax
dec edi
jne 0x45c454
jmp 0x45c4b0
push 0
push esi
call fcn.0045c580
add esp, 0xc
cmp dword [0x476458], 0
je 0x45c4b0
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
lea eax, [esp + 0x30]
push eax
push esi
call fcn.0045c8a0
add esp, 8
mov eax, dword [esi]
add esi, 8
mov dword [esp + 0x10], eax
inc dword [esp + 0x20]
mov ecx, dword [esi - 4]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
cmp eax, dword [esp + 0x24]
jb 0x45c407
xor eax, eax
cmp dword [esp + 0x18], eax
je 0x45c4e8
mov cl, byte [esi + eax]
xor byte [esp + eax + 0x10], cl
inc eax
cmp eax, dword [esp + 0x18]
jb 0x45c4da
cmp dword [esp + 0x1c], 2
jbe 0x45c503
lea eax, [esp + 0x30]
lea ecx, [esp + 0x10]
push eax
push ecx
call fcn.0045c8a0
add esp, 8
jmp 0x45c528
cmp dword [esp + 0x1c], 1
jne 0x45c517
mov eax, dword [esi]
mov dword [esp + 0x10], eax
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ecx
lea eax, [esp + 0x10]
push 0
push 0
push eax
call fcn.0045c580
add esp, 0xc
cmp dword [esp + 0x1c], 1
jbe 0x45c560
xor ecx, ecx
cmp dword [esp + 0x18], ecx
je 0x45c547
mov dl, byte [esi + ecx - 8]
lea eax, [esi + ecx]
inc ecx
mov byte [eax], dl
cmp ecx, dword [esp + 0x18]
jb 0x45c537
mov eax, dword [esp + 0x10]
mov dword [esi - 8], eax
mov ecx, dword [esp + 0x14]
pop ebp
pop edi
mov dword [esi - 4], ecx
pop esi
pop ebx
add esp, 0x88
ret
mov eax, dword [esp + 0x10]
mov dword [esi], eax
mov ecx, dword [esp + 0x14]
mov dword [esi + 4], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x88
ret
Function at 0x45c8a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
push ebp
mov eax, dword [esi]
add esi, 8
mov ebp, 0xc
add dword [edx + 4], eax
mov ecx, dword [esi - 4]
add dword [edx], ecx
mov ebx, dword [edx]
mov edi, dword [edx + 4]
xor edi, ebx
mov cl, 0x20
shr ebx, 4
mov eax, edi
and bl, 0x1f
add esi, 8
sub cl, bl
shr eax, cl
mov cl, bl
shl edi, cl
or eax, edi
mov cl, 0x20
sub eax, dword [esi - 8]
mov dword [edx + 4], eax
mov edi, dword [edx]
xor edi, eax
shr eax, 7
mov ebx, edi
and al, 0x1f
sub cl, al
shr ebx, cl
mov cl, al
shl edi, cl
or ebx, edi
add ebx, dword [esi - 4]
dec ebp
mov dword [edx], ebx
jne 0x45c8be
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45c910
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x90
push ebx
lea ecx, [eax + 7]
shr ecx, 3
push esi
push edi
and eax, 7
mov ebx, dword [esp + 0xa0]
push ebp
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jne 0x45c940
mov dword [esp + 0x10], 8
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
cmp dword [esp + 0x14], 1
jbe 0x45ca35
mov dword [esp + 0x28], 0
mov eax, dword [esp + 0x14]
sub eax, 2
mov dword [esp + 0x2c], eax
je 0x45ca35
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x28], 0
jne 0x45c9f5
lea eax, [esp + 0x30]
push 0
push eax
push ebx
call fcn.0045c580
add esp, 0xc
cmp dword [0x476458], 0
jne 0x45cb32
mov eax, dword [esp + 0x30]
lea edi, [esp + 0x38]
mov esi, 0x19
mov dword [esp + 0x38], eax
mov eax, dword [edi]
mov cl, 0x20
add eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x30]
mov dword [edi + 4], eax
add edi, 4
mov eax, dword [esp + 0x30]
mov edx, dword [edi - 4]
and dl, 0x1f
sub cl, dl
shl eax, cl
mov cl, dl
shr ebp, cl
or eax, ebp
xor dword [esp + 0x3c], eax
dec esi
jne 0x45c9c6
jmp 0x45ca03
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.0045cb40
add esp, 8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor dword [ebx], eax
mov edx, dword [esp + 0x20]
xor dword [ebx + 4], ecx
mov eax, dword [esp + 0x24]
add ebx, 8
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
inc dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
cmp ecx, dword [esp + 0x2c]
jb 0x45c984
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x10], eax
je 0x45ca5e
mov eax, dword [esp + 0x10]
lea esi, [ebx + 8]
lea edi, [esp + 0x18]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x14], 1
jne 0x45ca86
push 0
push 0
push ebx
call fcn.0045c580
add esp, 0xc
cmp dword [0x476458], 0
je 0x45cabc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
cmp dword [esp + 0x14], 2
jne 0x45caae
push 0
push 0
push ebx
call fcn.0045c580
add esp, 0xc
cmp dword [0x476458], 0
je 0x45cabc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.0045cb40
add esp, 8
cmp dword [esp + 0x14], 1
jbe 0x45cb25
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
xor dword [esp + 0x18], eax
xor dword [esp + 0x1c], ecx
xor ecx, ecx
cmp dword [esp + 0x10], ecx
je 0x45caef
mov dl, byte [ebx + ecx + 8]
lea eax, [ebx + ecx]
inc ecx
mov byte [eax], dl
cmp ecx, dword [esp + 0x10]
mov dl, byte [esp + ecx + 0x17]
mov byte [eax + 8], dl
jb 0x45cad8
cmp dword [esp + 0x14], 2
jne 0x45cb17
push 0
push 0
push ebx
call fcn.0045c580
add esp, 0xc
cmp dword [0x476458], 0
je 0x45cb25
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret
lea eax, [esp + 0x38]
push eax
push ebx
call fcn.0045cb40
add esp, 8
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
xor dword [ebx], eax
xor dword [ebx + 4], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x90
ret