joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409540
Capabilities:
Clear file content

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdi, rdx
mov rsi, rcx
call fcn.00409308
xor ebx, ebx
cmp al, bl
je 0x409568
cmp qword [rsp + 0x50], rdi
je 0x40956c
xor al, al
jmp 0x40957a
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, ebx
setne al
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x40b4ac
Capabilities:
Get disk size

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov r12, rcx
lea rcx, [0x004cfd10]
mov rdi, r9
mov rsi, r8
mov rbx, rdx
xor bpl, bpl
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetDiskFreeSpaceExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x40b512
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov rcx, r12
call rax
test eax, eax
mov rax, qword [rsp + 0x40]
mov qword [rsi], rax
mov rax, qword [rsp + 0x48]
setne bpl
mov qword [rdi], rax
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x40b564
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
imul rcx, rax
test bpl, bpl
mov qword [rbx], rcx
jne 0x40b562
mov eax, dword [rsp + 0x38]
imul rax, rcx
mov qword [rsi], rax
mov eax, dword [rsp + 0x3c]
imul rax, qword [rbx]
mov qword [rdi], rax
mov al, 1
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x40bf8c
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
lea rcx, [rsp + 0x20]
call fcn.0040bf64
xor r8d, r8d
cmp eax, r8d
je 0x40bfcb
cmp qword [rsp + 0x20], r8
je 0x40bfcb
mov rcx, r8
lea eax, [r8 + 0x40]
mov rdx, qword [rsp + 0x20]
shr rdx, cl
inc rcx
and edx, 1
add r8d, edx
dec rax
jne 0x40bfb0
mov eax, r8d
jmp 0x40bfda
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x50]
add rsp, 0x68
ret

Function at 0x40bfe0
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x60
movabs rax, 0x100000000
mov rbx, rcx
mov dword [rsp + 0x20], 0x40
mov qword [rcx], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x40c022
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x48], rax
cmovb rax, qword [rsp + 0x48]
mov qword [rbx], rax
mov al, 1
add rsp, 0x60
pop rbx
ret
Function at 0x4282dc
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov r13d, edx
xor edx, edx
mov rbp, r8
mov r14, rcx
lea r8d, [rdx + 0x40]
lea rcx, [rsp + 0x20]
mov rsi, r9
call sub.msvcrt.dll_memset
xor ebx, ebx
test rbp, rbp
je 0x4283a9
mov rdi, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xc0]
test rdi, rdi
je 0x428338
test bl, bl
jne 0x428338
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
test eax, eax
jne 0x4283ab
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x18]
mov r11, qword [r12]
mov r8d, r13d
mov rdx, r14
mov rcx, r12
call qword [r11 + 0x20]
mov r11, qword [r12]
lea rdx, [rsp + 0x20]
mov rcx, r12
call qword [r11 + 0x28]
mov r11, qword [r12]
mov rcx, r12
call qword [r11 + 0x30]
cmp eax, 0x40
ja 0x4283ba
xor ecx, ecx
test eax, eax
je 0x428394
lea r8d, [rax - 1]
lea rdx, [rsp + 0x20]
shr r8d, 2
inc r8d
xor ecx, dword [rdx]
add rdx, 4
dec r8
jne 0x428389
test rsi, rsi
je 0x42839d
cmp ecx, dword [rsi]
jne 0x4283ba
inc rbx
cmp rbx, rbp
jb 0x428322
xor eax, eax
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 1
jmp 0x4283ab

Function at 0x4283c4
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
je 0x428557
mov eax, edx
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
dec rax
jne 0x4283ce
mov eax, ecx
ret
Function at 0x4285e8
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
test edx, edx
mov r10, rcx
je 0x428632
mov r11, rcx
mov ebx, edx
mov r9d, dword [r8]
mov ecx, dword [r8 + 4]
movzx eax, r9w
shr r9d, 0x10
imul eax, eax, 0x9069
add eax, r9d
mov dword [r8], eax
movzx eax, cx
shr ecx, 0x10
imul eax, eax, 0x4650
add eax, ecx
mov dword [r8 + 4], eax
mov byte [r11], al
inc r11
dec rbx
jne 0x4285fa
mov rcx, r10
add rsp, 0x20
pop rbx
jmp fcn.004285ac

Function at 0x429900
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor ecx, ecx
call fcn.004abc90
mov ecx, 0x500
call fcn.004abba0
xor ebx, ebx
cmp rax, rbx
mov rdi, rax
je 0x4299fa
mov eax, ebx
mov rcx, rdi
mov r8d, 0x100
mov byte [rcx], al
inc eax
inc rcx
cmp eax, r8d
jb 0x429935
mov edx, 0xffffffff
mov r9, rdi
mov eax, edx
lea r10, [0x0050d820]
xor al, byte [r9]
inc r9
movzx ecx, al
mov eax, edx
mov edx, dword [r10 + rcx*4]
shr eax, 8
xor edx, eax
dec r8
jne 0x429949
not edx
cmp edx, 0x29058c73
jne 0x4299fa
mov edx, 0x1f123bb5
mov r9d, 0x159a55e5
lea r8, [rdi + 0x100]
mov r10d, 0x400
movzx ecx, r9w
shr r9d, 0x10
imul ecx, ecx, 0x9069
add r9d, ecx
movzx ecx, dx
shr edx, 0x10
imul ecx, ecx, 0x4650
add edx, ecx
mov byte [r8], dl
inc r8
dec r10
mov dword [rsp + 0x54], edx
mov al, dl
jne 0x429991
mov esi, ebx
mov r12d, esi
mov ebp, ebx
add r12, rdi
mov edx, ebp
mov rcx, r12
call fcn.004cb5d0
mov edx, ebp
mov rcx, r12
mov r11d, eax
call fcn.004285ac
cmp eax, r11d
jne 0x4299fa
inc ebp
cmp ebp, 0x20
jb 0x4299cb
inc esi
cmp esi, 0x4e0
jb 0x4299c3
mov bl, 1
mov rcx, rdi
call fcn.004abc90
mov al, bl
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x44fb78
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rdi
sub rsp, 0x28
mov rax, rdx
mov rdx, qword [rcx]
mov rbx, rcx
mov rcx, rax
mov rdi, r8
call qword [sym.imp.msvcrt.dll_fputs]
mov rdx, qword [rbx]
lea rcx, [0x004d70d0]
call qword [sym.imp.msvcrt.dll_fputs]
mov rdx, rdi
mov rcx, rbx
call fcn.00402908
mov rcx, rax
add rsp, 0x28
pop rdi
pop rbx
jmp fcn.00402568

Function at 0x44ff90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rdx]
mov rdx, qword [rcx]
mov rsi, rcx
lea rcx, str.Open
mov bl, r8b
call qword [sym.imp.msvcrt.dll_fputs]
mov rdx, qword [rsi]
lea rax, str.WARNING
lea rcx, str.ERROR
test bl, bl
cmovne rcx, rax
call qword [sym.imp.msvcrt.dll_fputs]
mov rdx, qword [rsi]
lea rcx, str.:_Can_not_open_the_file_as__
call qword [sym.imp.msvcrt.dll_fputs]
mov rdx, rdi
mov rcx, rsi
call fcn.00402588
lea rcx, str.__archive
mov rdx, qword [rax]
mov rbx, rax
call qword [sym.imp.msvcrt.dll_fputs]
mov rcx, rbx
add rsp, 0x20
pop rdi
pop rsi
pop rbx
jmp fcn.00402568

Function at 0x453928
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
cmp dword [rcx + 8], ebx
jbe 0x4539ae
mov rbp, rbx
mov r12, rbx
mov rax, qword [rsi]
mov rdx, qword [r12 + rax]
mov rcx, rdi
call fcn.00402938
mov rdx, qword [rdi]
lea rcx, [0x004d29f0]
call qword [sym.imp.msvcrt.dll_fputs]
mov r11, qword [rsi + 0x10]
mov edx, dword [r11 + rbp]
lea rcx, [rsp + 0x28]
call fcn.00406dc4
nop
mov rdx, qword [rax]
mov rcx, rdi
call fcn.00402588
mov rcx, rax
call fcn.00402568
nop
mov rcx, qword [rsp + 0x28]
call fcn.004023c4
inc ebx
add r12, 8
add rbp, 4
cmp ebx, dword [rsi + 8]
jb 0x45394f
mov rdx, qword [rdi]
lea rcx, str.________________
call qword [sym.imp.msvcrt.dll_fputs]
mov rcx, rdi
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
jmp fcn.00402568

Function at 0x46a1d0
Capabilities:
Parse pe header

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
cmp rdx, 0x200
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov dword [r8], 0
mov dword [r8 + 4], 0
jb 0x46a253
cmp word [rcx], 0x5a4d
jne 0x46a253
mov r9d, dword [rcx + 0x3c]
cmp r9d, 0x1000
jae 0x46a253
lea ecx, [r9 + 0x200]
cmp rcx, rdx
ja 0x46a253
test r9b, 7
jne 0x46a253
lea rdx, [rbx + r9]
cmp dword [rdx], 0x4550
jne 0x46a253
movzx ecx, word [rdx + 4]
sub ecx, 0x14c
je 0x46a28d
sub ecx, 0x74
je 0x46a286
sub ecx, 2
je 0x46a286
sub ecx, 2
je 0x46a27f
sub ecx, 0x3c
je 0x46a278
cmp ecx, 0x8464
je 0x46a28d
mov rdx, rsi
mov rcx, rbx
call fcn.00469f94
test eax, eax
jne 0x46a271
mov rdx, rsi
mov rcx, rbx
call fcn.0046a050
test eax, eax
je 0x46a2b3
mov eax, 1
jmp 0x46a2c1
mov eax, 0x3030401
jmp 0x46a292
mov eax, 0x3030701
jmp 0x46a292
mov eax, 0x3030501
jmp 0x46a292
mov eax, 0x3030103
cmp word [rdx + 0x14], 0x400
ja 0x46a253
movzx ecx, word [rdx + 0x18]
cmp ecx, 0x10b
je 0x46a2ae
cmp ecx, 0x20b
jne 0x46a253
mov dword [r8], eax
jmp 0x46a271
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.0046a114
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x47160c
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
cmp edx, 8
mov r9, rcx
jb 0x471633
mov ecx, edx
shr rcx, 3
mov eax, dword [r9 + 4]
add edx, 0xfffffff8
xor eax, dword [r9]
add r9, 8
xor r8d, eax
dec rcx
jne 0x47161d
cmp edx, 4
jb 0x47163f
xor r8d, dword [r9]
add r9, 4
and edx, 3
cmp edx, 2
jbe 0x471654
movzx eax, byte [r9]
shl eax, 0x10
xor r8d, eax
inc r9
cmp edx, 1
jbe 0x471666
movzx ecx, byte [r9]
shl ecx, 8
xor r8d, ecx
inc r9
test edx, edx
je 0x471671
movzx ecx, byte [r9]
xor r8d, ecx
mov eax, r8d
ret
Function at 0x48623c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx eax, word [rcx + 2]
cmp ax, word [rdx + 2]
je 0x486249
xor al, al
ret
movzx r10d, word [rdx]
cmp word [rcx], r10w
jne 0x486256
mov al, 1
ret
cmp ax, 8
mov r8d, 0xffff
je 0x486270
cmp ax, 6
ja 0x486276
mov r8d, 0x7fff
jmp 0x486276
mov r8d, 0x7ff9
movzx eax, r10w
xor r9d, r9d
xor ax, word [rcx]
bt ax, 0xb
jae 0x4862c9
cmp dword [rcx + 0x30], r9d
mov rax, qword [rcx + 0x28]
mov r11d, r9d
jbe 0x4862a5
cmp byte [rax], 0x80
jae 0x4862c9
inc r11d
inc rax
cmp r11d, dword [rcx + 0x30]
jb 0x486294
mov r11d, dword [rdx + 0x30]
mov rax, qword [rdx + 0x28]
mov edx, r9d
cmp r11d, r9d
jbe 0x4862c4
cmp byte [rax], 0x80
jae 0x4862c9
inc edx
inc rax
cmp edx, r11d
jb 0x4862b5
btr r8d, 0xb
movzx ecx, word [rcx]
movzx edx, r10w
and ecx, r8d
and edx, r8d
cmp ecx, edx
sete al
ret

Function at 0x4952b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [rcx + 0x40], 0xa
mov r8, rcx
jae 0x495323
nop
nop
mov r9d, dword [r8]
cmp r9d, 8
jae 0x4952f8
mov r10, qword [r8 + 8]
cmp r10, qword [r8 + 0x10]
je 0x4953f4
movzx edx, byte [r10]
lea eax, [r9 + 8]
mov ecx, 0x18
sub ecx, r9d
mov dword [r8], eax
lea rax, [r10 + 1]
shl edx, cl
mov qword [r8 + 8], rax
or dword [r8 + 4], edx
mov eax, dword [r8 + 4]
add dword [r8], 0xfffffff8
mov ecx, eax
shl eax, 8
mov dword [r8 + 4], eax
mov eax, dword [r8 + 0x40]
shr ecx, 0x18
mov byte [rax + r8 + 0x70de], cl
inc dword [r8 + 0x40]
cmp dword [r8 + 0x40], 0xa
jb 0x4952c0
mov dword [r8 + 0x70e8], 0
movzx eax, byte [r8 + 0x70e4]
shl eax, 8
mov dword [r8 + 0x70e8], eax
movzx ecx, byte [r8 + 0x70e5]
or ecx, eax
shl ecx, 8
mov dword [r8 + 0x70e8], ecx
movzx edx, byte [r8 + 0x70e6]
or edx, ecx
shl edx, 8
mov dword [r8 + 0x70e8], edx
movzx eax, byte [r8 + 0x70e7]
or eax, edx
mov dword [r8 + 0x70e8], eax
cmp byte [r8 + 0x70de], 0x31
jne 0x4953f7
cmp byte [r8 + 0x70df], 0x41
jne 0x4953f7
cmp byte [r8 + 0x70e0], 0x59
jne 0x4953f7
cmp byte [r8 + 0x70e1], 0x26
jne 0x4953f7
cmp byte [r8 + 0x70e2], 0x53
jne 0x4953f7
cmp byte [r8 + 0x70e3], 0x59
jne 0x4953f7
cmp byte [r8 + 0x70f0], 0
jne 0x4953c6
inc qword [r8 + 0x70f8]
inc qword [r8 + 0x7100]
mov byte [r8 + 0x70f0], 1
mov eax, dword [r8 + 0x70ec]
rol eax, 1
xor eax, dword [r8 + 0x70e8]
mov dword [r8 + 0x70ec], eax
mov dword [r8 + 0x3c], 2
xor eax, eax
ret
cmp byte [r8 + 0x70de], 0x17
jne 0x49549b
cmp byte [r8 + 0x70df], 0x72
jne 0x49549b
cmp byte [r8 + 0x70e0], 0x45
jne 0x49549b
cmp byte [r8 + 0x70e1], 0x38
jne 0x49549b
cmp byte [r8 + 0x70e2], 0x50
jne 0x49549b
cmp byte [r8 + 0x70e3], 0x90
jne 0x49549b
cmp byte [r8 + 0x70f0], 0
jne 0x49544c
inc qword [r8 + 0x70f8]
mov edx, dword [r8 + 4]
mov byte [r8 + 0x70f0], 1
test edx, edx
je 0x495464
mov byte [r8 + 0x70f2], 1
mov eax, dword [r8]
mov dword [r8 + 0x3c], 0xb
mov ecx, eax
and ecx, 7
sub eax, ecx
shl edx, cl
mov dword [r8], eax
mov eax, dword [r8 + 0x70ec]
mov dword [r8 + 4], edx
cmp dword [r8 + 0x70e8], eax
je 0x4953f4
mov byte [r8 + 0x70f1], 1
mov eax, 1
ret
Function at 0x499790
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x2c], 8
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x28]
mov r8d, edx
mov rdx, qword [rcx]
mov qword [rcx + 0x20], rax
mov rax, qword [rcx + 0x8cf8]
mov qword [rsp + 0x60], rsi
xor esi, esi
mov rbx, rcx
mov dword [rsp + 0x28], esi
mov byte [rsp + 0x30], sil
mov dword [rcx + 0x8ce8], esi
mov r9d, dword [rax + 0x19c]
call fcn.00498fc0
mov rcx, qword [rbx + 0x8cf8]
cmp byte [rcx + 0x1e4], sil
je 0x499816
mov eax, dword [rbx + 0x8cec]
mov rcx, qword [rcx + 0x1a8]
imul rax, rax, 0x8e28
mov rcx, qword [rax + rcx + 0x8d18]
call fcn.004c3cc0
cmp dword [rbx + 0x8ce8], esi
mov edx, esi
jbe 0x499857
lea r8, [rbx + 0x7ce8]
nop
nop
nop
mov rcx, qword [rbx + 0x8cf8]
inc edx
add r8, 4
mov eax, dword [rcx + 0x1a0]
rol eax, 1
xor eax, dword [r8 - 4]
mov dword [rcx + 0x1a0], eax
cmp edx, dword [rbx + 0x8ce8]
jb 0x499830
mov eax, dword [rsp + 0x28]
movzx r9d, byte [rsp + 0x30]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x8cf8]
lea r8d, [rax*8 + 8]
mov qword [rsp + 0x58], rbp
sub r8d, dword [rsp + 0x2c]
call fcn.00499250
mov rbp, qword [rbx + 0x8cf8]
cmp byte [rbp + 0x1e4], sil
je 0x499926
mov qword [rsp + 0x68], rdi
mov edi, dword [rbx + 0x8cec]
inc edi
cmp edi, dword [rbp + 0x1e0]
cmove edi, esi
cmp qword [rbp + 0x200], rsi
je 0x4998fc
lea rcx, [rbp + 0x160]
call fcn.00410ab8
mov ecx, 0xf
lea rdx, [rbx + 0x8d20]
sub ecx, dword [rbp + 0x158]
lea r8, [rsp + 0x20]
shr rcx, 3
lea r11, [rcx + rax]
mov rax, qword [rbx + 0x8cf8]
mov qword [rsp + 0x20], r11
mov rcx, qword [rax + 0x200]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov esi, eax
mov rcx, qword [rbx + 0x8cf8]
mov r8d, edi
mov rdx, qword [rcx + 0x1a8]
imul r8, r8, 0x8e28
lea rcx, [r8 + rdx + 0x8d18]
call fcn.004c3d30
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x48
ret
Function at 0x4a9bf0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
xor ebx, ebx
cmp r8, 0x40
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, r8
mov qword [rax - 0x48], rbx
mov qword [rax - 0x40], rbx
mov qword [rax - 0x38], rbx
mov qword [rax - 0x30], rbx
mov qword [rax - 0x28], rbx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x10], rbx
mov rbp, rdx
mov rsi, rcx
jbe 0x4a9c5a
call fcn.004c2340
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call fcn.004c29f0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.004c2b80
jmp 0x4a9c69
test r8, r8
je 0x4a9c69
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_memcpy
mov rdi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x78]
mov rax, rbx
nop
nop
xor byte [rsp + rax + 0x20], 0x36
xor byte [rsp + rax + 0x21], 0x36
add rax, 2
cmp rax, 0x40
jb 0x4a9c80
mov rcx, rsi
call fcn.004c2340
lea rdx, [rsp + 0x20]
mov r8d, 0x40
mov rcx, rsi
call fcn.004c29f0
nop
xor byte [rsp + rbx + 0x20], 0x6a
xor byte [rsp + rbx + 0x21], 0x6a
add rbx, 2
cmp rbx, 0x40
jb 0x4a9cb0
lea rcx, [rsi + 0x60]
call fcn.004c2340
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x60]
mov r8d, 0x40
call fcn.004c29f0
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret

Function at 0x4a9d80
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xe8
mov qword [rax + 8], rbx
xor ebx, ebx
cmp r8, 0x40
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, r8
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov rsi, rdx
mov rbp, rcx
jbe 0x4a9e28
lea rcx, [rax - 0x68]
call fcn.004c2340
lea rcx, [rsp + 0x80]
mov r8, rdi
mov rdx, rsi
call fcn.004c29f0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.004c2b80
mov r11, rbx
nop
nop
nop
mov eax, dword [rsp + r11 + 0x60]
add r11, 4
cmp r11, 0x14
bswap eax
mov dword [rsp + r11 + 0x1c], eax
jb 0x4a9e10
jmp 0x4a9e5b
test rdi, rdi
mov r8, rbx
je 0x4a9e5b
mov eax, r8d
mov rdx, r8
mov ecx, 3
and eax, 3
shr rdx, 2
inc r8
sub ecx, eax
movzx eax, byte [r8 + rsi - 1]
shl ecx, 3
shl eax, cl
or dword [rsp + rdx*4 + 0x20], eax
cmp r8, rdi
jb 0x4a9e30
mov rdi, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x100]
mov rax, rbx
nop
xor dword [rsp + rax*4 + 0x20], 0x36363636
inc rax
cmp rax, 0x10
jb 0x4a9e70
mov rcx, rbp
call fcn.004c2340
lea rdx, [rsp + 0x20]
mov r8d, 0x10
mov rcx, rbp
call fcn.004c2cd0
nop
xor dword [rsp + rbx*4 + 0x20], 0x6a6a6a6a
inc rbx
cmp rbx, 0x10
jb 0x4a9ea0
lea rcx, [rbp + 0x60]
call fcn.004c2340
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x60]
mov r8d, 0x10
call fcn.004c2cd0
mov rbp, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe8
ret
Function at 0x4a9f70
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xa8
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rbx, rdx
mov qword [rax + 0x20], rdi
mov edi, r8d
lea rdx, [rsp + 0x20]
mov r8d, 5
mov rsi, rcx
call fcn.004c2c70
lea rdx, [rsp + 0x60]
lea rcx, [rsi + 0x60]
mov r8d, 5
call fcn.004c2c70
test edi, edi
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov eax, dword [rbx + 0x10]
mov dword [rsp + 0x30], eax
je 0x4aa021
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.004c2370
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x60]
lea rcx, [rsi + 0x60]
call fcn.004c2370
mov eax, dword [rsp + 0x24]
mov r11d, dword [rsp + 0x20]
xor dword [rbx + 4], eax
mov eax, dword [rsp + 0x28]
xor dword [rbx], r11d
xor dword [rbx + 8], eax
mov eax, dword [rsp + 0x2c]
xor dword [rbx + 0xc], eax
mov eax, dword [rsp + 0x30]
xor dword [rbx + 0x10], eax
dec rdi
jne 0x4a9fd3
mov rdi, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xc0]
mov rbp, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa8
ret

Function at 0x4aa930
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
test r8, r8
mov eax, dword [rcx + 4]
mov qword [rsp + 0x30], rbx
movsxd rbx, dword [rcx]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x20], r12
lea rbp, [rcx + rax*4 + 8]
mov rsi, r8
mov rdi, rdx
mov r12, rcx
je 0x4aaa08
cmp ebx, 0x10
je 0x4aa998
lea rdx, [rbp + rbx]
nop
nop
nop
movzx eax, byte [rdx]
inc rdi
inc ebx
xor byte [rdi - 1], al
inc rdx
dec rsi
je 0x4aa998
cmp ebx, 0x10
jne 0x4aa980
cmp rsi, 0x10
jb 0x4aa9c4
mov rbx, rsi
lea rcx, [rbp + 0x10]
mov rdx, rdi
shr rbx, 4
mov r8, rbx
call qword [0x0050f830]
shl rbx, 4
add rdi, rbx
sub rsi, rbx
mov ebx, 0x10
test rsi, rsi
je 0x4aaa04
xor ebx, ebx
lea rcx, [rbp + 0x10]
mov rdx, rbp
mov qword [rbp], rbx
lea r8d, [rbx + 1]
mov qword [rbp + 8], rbx
call qword [0x0050f830]
nop
nop
nop
movzx eax, byte [rbp]
inc rdi
inc ebx
xor byte [rdi - 1], al
inc rbp
dec rsi
jne 0x4aa9f0
mov dword [r12], ebx
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x4ab0c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x108
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rsi, rdx
lea rdx, [rsp + 0x60]
mov qword [rax + 0x20], rdi
call fcn.004c2b80
movabs r11, 0x3636363636363636
xor ebx, ebx
mov edi, 4
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
mov rcx, rbx
mov rdx, rdi
movzx eax, byte [rsp + rcx + 0x60]
add rcx, 5
xor byte [rsp + rcx + 0x1b], al
movzx eax, byte [rsp + rcx + 0x5c]
xor byte [rsp + rcx + 0x1c], al
movzx eax, byte [rsp + rcx + 0x5d]
xor byte [rsp + rcx + 0x1d], al
movzx eax, byte [rsp + rcx + 0x5e]
xor byte [rsp + rcx + 0x1e], al
movzx eax, byte [rsp + rcx + 0x5f]
xor byte [rsp + rcx + 0x1f], al
dec rdx
jne 0x4ab122
lea rcx, [rsp + 0xa0]
call fcn.004c2340
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xa0]
mov r8d, 0x40
call fcn.004c29f0
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0xa0]
call fcn.004c2b80
movabs r11, 0x5c5c5c5c5c5c5c5c
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
movzx eax, byte [rsp + rbx + 0x60]
add rbx, 5
xor byte [rsp + rbx + 0x1b], al
movzx eax, byte [rsp + rbx + 0x5c]
xor byte [rsp + rbx + 0x1c], al
movzx eax, byte [rsp + rbx + 0x5d]
xor byte [rsp + rbx + 0x1d], al
movzx eax, byte [rsp + rbx + 0x5e]
xor byte [rsp + rbx + 0x1e], al
movzx eax, byte [rsp + rbx + 0x5f]
xor byte [rsp + rbx + 0x1f], al
dec rdi
jne 0x4ab1c1
lea rcx, [rsp + 0xa0]
call fcn.004c2340
lea r8d, [rdi + 0x40]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xa0]
call fcn.004c29f0
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0xa0]
call fcn.004c2b80
mov rdi, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x118]
lea rcx, [rsp + 0x78]
mov rax, qword [rcx]
mov qword [rsi], rax
mov rax, qword [rcx + 8]
mov qword [rsi + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rsi + 0x10], rax
mov rax, qword [rcx + 0x18]
mov qword [rsi + 0x18], rax
mov rsi, qword [rsp + 0x120]
add rsp, 0x108
ret