joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4681a8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x468212
mov eax, ebx
call fcn.0046a57c
test al, al
jne 0x468212
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004054d8
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x4681ff
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x46821f
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040543c
jmp 0x46821f
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040543c
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x4696a0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x46970e
mov eax, esi
call fcn.00451eb4
test al, al
je 0x46970e
mov eax, dword [ebx + 0x84]
call fcn.00451b14
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x46970e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x469702
push 0
mov eax, dword [ebx + 0x84]
call fcn.00451b14
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00449984
jmp 0x46970e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004694dc
pop esi
pop ebx
ret

Function at 0x46e168
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.004294f4
cmp ebx, dword [ebp - 8]
jge 0x46e1cb
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042991c
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042991c
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.00429948
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x46e191
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x46e1d4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.004294f4
cmp ebx, dword [ebp - 8]
jge 0x46e237
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042991c
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042991c
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.00429948
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x46e1fd
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x48aa18
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48aa88
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, 0x104
call fcn.00405b08
mov eax, dword [ebx]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 4]
test esi, esi
je 0x48aa52
sub esi, 4
mov esi, dword [esi]
mov eax, dword [ebx]
call fcn.00405878
push eax
push esi
call sub.KERNEL32.DLL_GetTempPathA
mov edx, ebx
xchg edx, eax
call fcn.00405b08
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.0048a6d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48aa8f
lea eax, [ebp - 8]
call fcn.004053e8
ret
Function at 0x49328c
Capabilities:
Hash data with md5

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff70
mov ebx, ecx
mov edi, edx
mov dword [esp], eax
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
mov eax, edi
add eax, eax
add eax, eax
add eax, eax
xor edx, edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
lea eax, [esp + 0x10]
xor ecx, ecx
mov edx, 0x80
call fcn.00403a34
mov esi, edi
and esi, 0x3f
mov eax, 0x38
sub eax, esi
test eax, eax
jg 0x4932f3
mov ebp, 0x78
sub ebp, esi
jmp 0x4932fa
mov ebp, 0x38
sub ebp, esi
mov byte [esp + esi + 0x10], 0x80
lea edx, [esp + 0x10]
mov eax, dword [esp]
add eax, edi
sub eax, esi
mov ecx, esi
call fcn.0040312c
lea edx, [esp + 8]
mov edx, dword [edx]
lea eax, [esi + ebp]
lea ecx, [esp + eax + 0x10]
mov dword [ecx], edx
lea edx, [esp + 8]
add edx, 4
mov edx, dword [edx]
lea eax, [esp + eax + 0x14]
mov dword [eax], edx
xor esi, esi
lea eax, [esi + 0x40]
cmp edi, eax
jb 0x49333f
mov eax, dword [esp]
add eax, esi
jmp 0x49334d
cmp edi, esi
jb 0x493349
lea eax, [esp + 0x10]
jmp 0x49334d
lea eax, [esp + 0x50]
lea edx, [ebx + 8]
push edx
lea edx, [ebx + 0xc]
push edx
lea ecx, [ebx + 4]
mov edx, ebx
call fcn.00492668
add esi, 0x40
lea eax, [ebp + edi + 8]
cmp esi, eax
jne 0x493331
add esp, 0x90
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x493590
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffcc
mov esi, edx
mov dword [esp], eax
lea edx, [esp + 4]
mov eax, dword [esp]
add eax, 0x2c
mov ecx, 0x10
call fcn.0040312c
lea edx, [esp + 0x14]
mov eax, esi
mov ecx, 0x10
call fcn.0040312c
xor ecx, ecx
mov eax, dword [esp]
add eax, 0x2c
movzx edx, byte [esi + ecx]
xor dl, byte [eax]
lea ebx, [ecx + 0x20]
mov byte [esp + ebx + 4], dl
inc ecx
inc eax
cmp ecx, 0x10
jne 0x4935c7
xor edx, edx
xor ecx, ecx
mov edi, 0x30
lea eax, [esp + 4]
movzx edx, byte [edx + str._.C]
xor byte [eax], dl
movzx edx, byte [eax]
inc eax
dec edi
jne 0x4935e8
lea eax, [ecx + edx]
and eax, 0xff
mov edx, eax
inc ecx
cmp ecx, 0x12
jne 0x4935df
mov edx, dword [esp]
add edx, 0x2c
lea eax, [esp + 4]
mov ecx, 0x10
call fcn.0040312c
mov edx, dword [esp]
movzx edx, byte [edx + 0x17]
xor ecx, ecx
mov eax, dword [esp]
add eax, 8
movzx ebx, byte [esi + ecx]
xor edx, ebx
movzx edx, byte [edx + str._.C]
xor byte [eax], dl
movzx edx, byte [eax]
inc ecx
inc eax
cmp ecx, 0x10
jne 0x49362b
add esp, 0x34
pop edi
pop esi
pop ebx
ret
Function at 0x49c6d4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x38], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x39], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x4c], edx
mov dl, 1
mov eax, dword [0x49aa40]
call fcn.0049aa9c
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x49c7e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x49d050
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov dword [eax + 0x14], edx
mov dword [eax + 0x10], 0x49d320
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov dword [eax + 0x1c], edx
mov dword [eax + 0x18], 0x49d7a8
mov eax, dword [ebp - 0x14]
mov byte [eax + 0x30], 1
mov eax, dword [ebp - 0xc]
call fcn.00402f28
mov edx, dword [ebp - 4]
mov dword [edx + 0x28], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
call fcn.0040312c
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x2c], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x30], 0
mov dword [eax + 0x34], 0
xor eax, eax
push ebp
push 0x49c7b2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
call fcn.0049aacc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x49c7c3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.00402f44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49c7eb
mov eax, dword [ebp - 0x14]
call fcn.00404468
ret
Function at 0x49eb44
Capabilities:
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffef4
mov esi, eax
mov dword [esp + 0x10], edx
lea eax, [esp + 0x94]
xor ecx, ecx
mov edx, 0x78
call fcn.00403a34
lea eax, [esp + 0x14]
xor ecx, ecx
mov edx, 0x80
call fcn.00403a34
lea eax, [esp + 0x94]
mov dword [esp], eax
mov eax, dword [esp]
add eax, 0x38
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x38
mov dword [esp + 8], eax
xor ecx, ecx
mov eax, str.91__
movzx ebx, byte [eax]
dec ebx
mov edx, ebx
and edx, 7
shr ebx, 3
movzx ebx, byte [esi + ebx]
and ebx, dword [edx*4 + 0x5daa94]
jbe 0x49ebbf
mov edx, dword [esp]
mov byte [edx + ecx], 1
jmp 0x49ebc6
mov edx, dword [esp]
mov byte [edx + ecx], 0
inc ecx
inc eax
cmp ecx, 0x38
jne 0x49eb9d
xor eax, eax
mov dword [esp + 0xc], eax
mov edi, 0x5daab4
mov eax, dword [esp + 8]
xor ecx, ecx
mov edx, 8
call fcn.00403a34
xor ecx, ecx
cmp ecx, 0x1c
jae 0x49ebf6
mov eax, 0x1c
jmp 0x49ebfb
mov eax, 0x38
movzx ebx, byte [edi]
add ebx, ecx
cmp eax, ebx
jbe 0x49ec08
mov eax, ebx
jmp 0x49ec0d
mov eax, ebx
sub eax, 0x1c
mov edx, dword [esp]
movzx eax, byte [edx + eax]
mov edx, dword [esp + 4]
mov byte [edx + ecx], al
inc ecx
cmp ecx, 0x38
jne 0x49ebea
xor ecx, ecx
mov esi, 0x5daa64
movzx eax, byte [esi]
mov edx, dword [esp + 4]
cmp byte [edx + eax - 1], 0
jbe 0x49ec63
mov eax, ecx
mov ebx, 6
xor edx, edx
div ebx
mov ebx, edx
mov eax, ecx
mov ebp, 6
xor edx, edx
div ebp
mov edx, dword [esp + 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebx*4 + 0x5daa94]
shr eax, 2
pop edx
or byte [edx], al
inc ecx
inc esi
cmp ecx, 0x30
jne 0x49ec28
mov edx, dword [esp + 8]
movzx edx, byte [edx]
shl edx, 0x18
mov ecx, dword [esp + 8]
movzx ecx, byte [ecx + 2]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp + 8]
movzx ecx, byte [ecx + 4]
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 8]
movzx ecx, byte [ecx + 6]
or edx, ecx
mov eax, dword [esp + 0xc]
add eax, eax
mov dword [esp + eax*4 + 0x14], edx
mov edx, dword [esp + 8]
movzx edx, byte [edx + 1]
shl edx, 0x18
mov ecx, dword [esp + 8]
movzx ecx, byte [ecx + 3]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp + 8]
movzx ecx, byte [ecx + 5]
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 8]
movzx ecx, byte [ecx + 7]
or edx, ecx
mov dword [esp + eax*4 + 0x18], edx
inc dword [esp + 0xc]
inc edi
cmp dword [esp + 0xc], 0x10
jne 0x49ebd8
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
mov ecx, 0x80
call fcn.0040312c
add esp, 0x10c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49ed04
Capabilities:
Encrypt data using des
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffef4
mov esi, eax
mov dword [esp + 0x10], edx
lea eax, [esp + 0x94]
xor ecx, ecx
mov edx, 0x78
call fcn.00403a34
lea eax, [esp + 0x14]
xor ecx, ecx
mov edx, 0x80
call fcn.00403a34
lea eax, [esp + 0x94]
mov dword [esp], eax
mov eax, dword [esp]
add eax, 0x38
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
add eax, 0x38
mov dword [esp + 8], eax
xor ecx, ecx
mov eax, str.91__
movzx ebx, byte [eax]
dec ebx
mov edx, ebx
and edx, 7
shr ebx, 3
movzx ebx, byte [esi + ebx]
and ebx, dword [edx*4 + 0x5daa94]
jbe 0x49ed7f
mov edx, dword [esp]
mov byte [edx + ecx], 1
jmp 0x49ed86
mov edx, dword [esp]
mov byte [edx + ecx], 0
inc ecx
inc eax
cmp ecx, 0x38
jne 0x49ed5d
xor eax, eax
mov dword [esp + 0xc], eax
mov edi, 0x5daab4
mov eax, dword [esp + 8]
xor ecx, ecx
mov edx, 8
call fcn.00403a34
xor ecx, ecx
cmp ecx, 0x1c
jae 0x49edb6
mov eax, 0x1c
jmp 0x49edbb
mov eax, 0x38
movzx ebx, byte [edi]
add ebx, ecx
cmp eax, ebx
jbe 0x49edc8
mov eax, ebx
jmp 0x49edcd
mov eax, ebx
sub eax, 0x1c
mov edx, dword [esp]
movzx eax, byte [edx + eax]
mov edx, dword [esp + 4]
mov byte [edx + ecx], al
inc ecx
cmp ecx, 0x38
jne 0x49edaa
xor ecx, ecx
mov esi, 0x5daa64
movzx eax, byte [esi]
mov edx, dword [esp + 4]
cmp byte [edx + eax - 1], 0
jbe 0x49ee23
mov eax, ecx
mov ebx, 6
xor edx, edx
div ebx
mov ebx, edx
mov eax, ecx
mov ebp, 6
xor edx, edx
div ebp
mov edx, dword [esp + 8]
lea eax, [edx + eax]
push eax
mov eax, dword [ebx*4 + 0x5daa94]
shr eax, 2
pop edx
or byte [edx], al
inc ecx
inc esi
cmp ecx, 0x30
jne 0x49ede8
mov edx, dword [esp + 8]
movzx edx, byte [edx]
shl edx, 0x18
mov ecx, dword [esp + 8]
movzx ecx, byte [ecx + 2]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp + 8]
movzx ecx, byte [ecx + 4]
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 8]
movzx ecx, byte [ecx + 6]
or edx, ecx
mov eax, dword [esp + 0xc]
add eax, eax
mov dword [esp + eax*4 + 0x14], edx
mov edx, dword [esp + 8]
movzx edx, byte [edx + 1]
shl edx, 0x18
mov ecx, dword [esp + 8]
movzx ecx, byte [ecx + 3]
shl ecx, 0x10
or edx, ecx
mov ecx, dword [esp + 8]
movzx ecx, byte [ecx + 5]
shl ecx, 8
or edx, ecx
mov ecx, dword [esp + 8]
movzx ecx, byte [ecx + 7]
or edx, ecx
mov dword [esp + eax*4 + 0x18], edx
inc dword [esp + 0xc]
inc edi
cmp dword [esp + 0xc], 0x10
jne 0x49ed98
xor ecx, ecx
mov eax, ecx
add eax, eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x14]
mov edx, 0x1e
sub edx, dword [esp + 0xc]
mov ebx, dword [esp + edx*4 + 0x14]
mov esi, dword [esp + 0xc]
mov dword [esp + esi*4 + 0x14], ebx
mov dword [esp + edx*4 + 0x14], eax
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x18]
mov edx, 0x1f
sub edx, dword [esp + 0xc]
mov ebx, dword [esp + edx*4 + 0x14]
mov esi, dword [esp + 0xc]
mov dword [esp + esi*4 + 0x18], ebx
mov dword [esp + edx*4 + 0x14], eax
inc ecx
cmp ecx, 8
jne 0x49eea7
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
mov ecx, 0x80
call fcn.0040312c
add esp, 0x10c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x49f0fc
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov dword [esp + 4], edx
mov dword [esp], eax
mov ebx, 0x5daac4
mov eax, ecx
mov esi, dword [esp]
mov esi, dword [esi]
mov edi, dword [esp + 4]
mov edi, dword [edi]
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dx, 4
mov eax, edi
call fcn.0049ef30
mov edx, dword [esp + 0xc]
add edx, edx
add edx, edx
mov ecx, dword [esp + 8]
xor eax, dword [ecx + edx*4]
mov edx, eax
and edx, 0x3f
xor esi, dword [ebx + edx*4 + 0x600]
mov edx, eax
shr edx, 8
and edx, 0x3f
xor esi, dword [ebx + edx*4 + 0x400]
mov edx, eax
shr edx, 0x10
and edx, 0x3f
xor esi, dword [ebx + edx*4 + 0x200]
shr eax, 0x18
and eax, 0x3f
xor esi, dword [ebx + eax*4]
mov eax, dword [esp + 0xc]
add eax, eax
add eax, eax
mov edx, dword [esp + 8]
mov eax, dword [edx + eax*4 + 4]
xor eax, edi
mov edx, eax
and edx, 0x3f
xor esi, dword [ebx + edx*4 + 0x700]
mov edx, eax
shr edx, 8
and edx, 0x3f
xor esi, dword [ebx + edx*4 + 0x500]
mov edx, eax
shr edx, 0x10
and edx, 0x3f
xor esi, dword [ebx + edx*4 + 0x300]
shr eax, 0x18
and eax, 0x3f
xor esi, dword [ebx + eax*4 + 0x100]
mov dx, 4
mov eax, esi
call fcn.0049ef30
mov edx, dword [esp + 0xc]
add edx, edx
add edx, edx
mov ecx, dword [esp + 8]
xor eax, dword [ecx + edx*4 + 8]
mov edx, eax
and edx, 0x3f
xor edi, dword [ebx + edx*4 + 0x600]
mov edx, eax
shr edx, 8
and edx, 0x3f
xor edi, dword [ebx + edx*4 + 0x400]
mov edx, eax
shr edx, 0x10
and edx, 0x3f
xor edi, dword [ebx + edx*4 + 0x200]
shr eax, 0x18
and eax, 0x3f
xor edi, dword [ebx + eax*4]
mov eax, dword [esp + 0xc]
add eax, eax
add eax, eax
mov edx, dword [esp + 8]
mov eax, dword [edx + eax*4 + 0xc]
xor eax, esi
mov edx, eax
and edx, 0x3f
xor edi, dword [ebx + edx*4 + 0x700]
mov edx, eax
shr edx, 8
and edx, 0x3f
xor edi, dword [ebx + edx*4 + 0x500]
mov edx, eax
shr edx, 0x10
and edx, 0x3f
xor edi, dword [ebx + edx*4 + 0x300]
shr eax, 0x18
and eax, 0x3f
xor edi, dword [ebx + eax*4 + 0x100]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 8
jne 0x49f125
mov eax, dword [esp]
mov dword [eax], esi
mov eax, dword [esp + 4]
mov dword [eax], edi
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x49f274
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov esi, 0x5daac4
mov dword [esp], ecx
mov edi, edx
lea ecx, [esp + 8]
lea edx, [esp + 4]
call fcn.0049ef7c
lea edx, [esp + 8]
lea eax, [esp + 4]
call fcn.0049efbc
xor ebx, ebx
mov dx, 4
mov eax, dword [esp + 8]
call fcn.0049ef30
movzx edx, bx
add edx, edx
add edx, edx
xor eax, dword [edi + edx*4]
mov edx, eax
and edx, 0x3f
mov edx, dword [esi + edx*4 + 0x600]
xor edx, dword [esp + 4]
mov ecx, eax
shr ecx, 8
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x400]
mov ecx, eax
shr ecx, 0x10
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x200]
shr eax, 0x18
and eax, 0x3f
xor edx, dword [esi + eax*4]
mov dword [esp + 4], edx
movzx eax, bx
add eax, eax
add eax, eax
mov eax, dword [edi + eax*4 + 4]
xor eax, dword [esp + 8]
mov edx, eax
and edx, 0x3f
mov edx, dword [esi + edx*4 + 0x700]
xor edx, dword [esp + 4]
mov ecx, eax
shr ecx, 8
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x500]
mov ecx, eax
shr ecx, 0x10
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x300]
shr eax, 0x18
and eax, 0x3f
xor edx, dword [esi + eax*4 + 0x100]
mov dword [esp + 4], edx
mov dx, 4
mov eax, dword [esp + 4]
call fcn.0049ef30
movzx edx, bx
add edx, edx
add edx, edx
xor eax, dword [edi + edx*4 + 8]
mov edx, eax
and edx, 0x3f
mov edx, dword [esi + edx*4 + 0x600]
xor edx, dword [esp + 8]
mov ecx, eax
shr ecx, 8
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x400]
mov ecx, eax
shr ecx, 0x10
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x200]
shr eax, 0x18
and eax, 0x3f
xor edx, dword [esi + eax*4]
mov dword [esp + 8], edx
movzx eax, bx
add eax, eax
add eax, eax
mov eax, dword [edi + eax*4 + 0xc]
xor eax, dword [esp + 4]
mov edx, eax
and edx, 0x3f
mov edx, dword [esi + edx*4 + 0x700]
xor edx, dword [esp + 8]
mov ecx, eax
shr ecx, 8
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x500]
mov ecx, eax
shr ecx, 0x10
and ecx, 0x3f
xor edx, dword [esi + ecx*4 + 0x300]
shr eax, 0x18
and eax, 0x3f
xor edx, dword [esi + eax*4 + 0x100]
mov dword [esp + 8], edx
inc ebx
cmp bx, 8
jne 0x49f2a0
lea edx, [esp + 8]
lea eax, [esp + 4]
call fcn.0049f05c
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
call fcn.0049ef9c
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x49f444
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
test edi, edi
jne 0x49f469
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov al, 1
jmp 0x49f5b5
mov eax, dword [ebx + 0x310]
mov edx, eax
add edx, edi
shr edx, 3
add edx, edx
add edx, edx
add edx, edx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
cmp edx, dword [ebp - 0xc]
jae 0x49f498
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
xor eax, eax
jmp 0x49f5b5
test eax, eax
jbe 0x49f53a
mov edx, 8
sub edx, eax
mov dword [ebp - 8], edx
cmp edi, dword [ebp - 8]
jae 0x49f4ca
lea edx, [ebx + eax + 0x308]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.0040312c
add dword [ebx + 0x310], edi
xor edi, edi
jmp 0x49f53a
lea edx, [ebx + eax + 0x308]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
call fcn.0040312c
mov eax, dword [ebp - 8]
add dword [ebp - 4], eax
sub edi, dword [ebp - 8]
mov eax, dword [ebx + 0x308]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x30c]
mov dword [ebp - 0x10], eax
mov ecx, esi
mov edx, ebx
lea eax, [ebx + 0x308]
call fcn.0049f410
lea eax, [ebx + 0x300]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x304]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x300], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x304], eax
xor eax, eax
mov dword [ebx + 0x310], eax
cmp edi, 8
jb 0x49f591
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov dword [ebp - 0x14], edx
mov edx, dword [eax + 4]
mov dword [ebp - 0x10], edx
mov ecx, esi
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0049f410
lea eax, [ebx + 0x300]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
lea eax, [ebx + 0x304]
mov eax, dword [eax]
xor dword [esi], eax
add esi, 4
mov eax, dword [ebp - 0x14]
mov dword [ebx + 0x300], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x304], eax
add dword [ebp - 4], 8
sub edi, 8
cmp edi, 8
jae 0x49f53f
test edi, edi
jbe 0x49f5ab
lea edx, [ebx + 0x308]
mov eax, dword [ebp - 4]
mov ecx, edi
call fcn.0040312c
mov dword [ebx + 0x310], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x49fb98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test edi, edi
jne 0x49fbb9
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov al, 1
jmp 0x49fd02
mov eax, dword [ebx + 0x1210]
mov edx, eax
add edx, edi
shr edx, 3
add edx, edx
add edx, edx
add edx, edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
mov edx, dword [edx]
cmp edx, dword [ebp - 8]
jae 0x49fbe8
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
xor eax, eax
jmp 0x49fd02
test eax, eax
jbe 0x49fc89
mov edx, 8
sub edx, eax
mov dword [ebp - 4], edx
cmp edi, dword [ebp - 4]
jae 0x49fc19
lea edx, [ebx + eax + 0x1208]
mov eax, esi
mov ecx, edi
call fcn.0040312c
add dword [ebx + 0x1210], edi
xor edi, edi
jmp 0x49fc89
lea edx, [ebx + eax + 0x1208]
mov eax, esi
mov ecx, dword [ebp - 4]
call fcn.0040312c
sub edi, dword [ebp - 4]
lea eax, [ebx + 0x1208]
mov eax, dword [eax]
lea edx, [ebx + 0x1200]
xor eax, dword [edx]
lea edx, [ebp - 0x10]
mov dword [edx], eax
lea eax, [ebx + 0x120c]
mov eax, dword [eax]
lea edx, [ebx + 0x1204]
xor eax, dword [edx]
lea edx, [ebp - 0xc]
mov dword [edx], eax
mov ecx, dword [ebp + 0xc]
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.0049fa68
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebx + 0x1200], edx
mov edx, dword [eax + 4]
mov dword [ebx + 0x1204], edx
add dword [ebp + 0xc], 8
mov eax, dword [ebp - 4]
add esi, eax
xor eax, eax
mov dword [ebx + 0x1210], eax
cmp edi, 8
jb 0x49fcdf
mov eax, dword [esi]
lea edx, [ebx + 0x1200]
xor eax, dword [edx]
lea edx, [ebp - 0x10]
mov dword [edx], eax
add esi, 4
mov eax, dword [esi]
lea edx, [ebx + 0x1204]
xor eax, dword [edx]
lea edx, [ebp - 0xc]
mov dword [edx], eax
add esi, 4
mov ecx, dword [ebp + 0xc]
mov edx, ebx
lea eax, [ebp - 0x10]
call fcn.0049fa68
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov dword [ebx + 0x1200], edx
mov edx, dword [eax + 4]
mov dword [ebx + 0x1204], edx
add dword [ebp + 0xc], 8
sub edi, 8
cmp edi, 8
jae 0x49fc8e
test edi, edi
jbe 0x49fcf8
lea edx, [ebx + 0x1208]
mov eax, esi
mov ecx, edi
call fcn.0040312c
mov dword [ebx + 0x1210], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [eax], edx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8