joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456bf0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54dfd6
mov eax, dword fs:[0]
push eax
mov eax, 0x6194
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x456db2
push esi
call fcn.00490e40
test al, al
je 0x456db2
push esi
call fcn.00491110
test al, al
jne 0x456db2
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x456c57
sub esi, ecx
push edi
sar esi, 1
call fcn.004a2d90
cmp word [eax], 0
je 0x456db2
push 0x800
lea eax, [ebp - 0x1010]
push eax
push 0x5578cc
push edi
call fcn.004a25d0
lea ecx, [ebp - 0x106c]
call fcn.004bd0e0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1010]
push eax
lea ecx, [ebp - 0x106c]
call fcn.004bd180
push 2
push 0
push 2
lea eax, [ebp - 0x106c]
push eax
lea ecx, [ebp - 0x61a0]
call fcn.004b8e10
mov byte [ebp - 4], 1
lea eax, [ebp - 0x20b4]
push eax
lea ecx, [ebp - 0x61a0]
mov dword [ebp - 0x10a4], 0
mov dword [ebp - 0x10a0], 0
mov dword [ebp - 0x109c], 0
mov dword [ebp - 0x1098], 0
mov dword [ebp - 0x1094], 0
mov dword [ebp - 0x1090], 0
call fcn.004b9b00
test eax, eax
jne 0x456d83
nop
push esi
lea eax, [ebp - 0x20b4]
push edi
push eax
call fcn.00538b7d
add esp, 0xc
test eax, eax
jne 0x456d83
lea eax, [ebp - 0x20b4]
push eax
call fcn.004914c0
cmp byte [ebp - 0x10a8], 0
je 0x456d61
test byte [ebp - 0x1074], 1
je 0x456d6d
lea eax, [ebp - 0x20b4]
push eax
call fcn.00490630
jmp 0x456d6d
lea eax, [ebp - 0x20b4]
push eax
call fcn.004906b0
lea eax, [ebp - 0x20b4]
push eax
lea ecx, [ebp - 0x61a0]
call fcn.004b9b00
test eax, eax
je 0x456d20
push edi
call fcn.00490630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x61a0]
call fcn.004b8f00
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x106c]
test eax, eax
je 0x456db2
push eax
call fcn.00537b6f
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052f708
mov esp, ebp
pop ebp
ret 4

Function at 0x456dd0
Capabilities:
Get common file path

Disassembly:
cmp dword [esp + 8], 0x104
jb 0x456df5
push dword [esp + 4]
push 0
push 0
push 0x10
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x456df5
mov al, 1
ret 8
push ebx
push dword [esp + 0xc]
xor bl, bl
push str.unknown_folder
push dword [esp + 0x10]
call fcn.004bd090
mov al, bl
pop ebx
ret 8
Function at 0x45ca50
Capabilities:
Get common file path

Disassembly:
cmp dword [0x5933f8], 1
je fcn.004fda50
push dword [esp + 8]
lea eax, [ecx + 0x103c]
push eax
push dword [esp + 0xc]
call fcn.004bd090
ret 8

Function at 0x45d690
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x1c
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
lea eax, [esp + 8]
mov esi, ecx
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
lea eax, [esp + 8]
push eax
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [esp + 8]
push eax
push 0
push 0x1012
push dword [esi + 0x28]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
movsx edi, ax
call dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
movsx esi, ax
call dword [sym.imp.USER32.dll_GetKeyState]
test byte [esp + 0x10], 1
cwde
jne 0x45d723
test edi, 0x8000
jne 0x45d723
test esi, 0x8000
jne 0x45d723
test eax, 0x8000
jne 0x45d723
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.0052f708
add esp, 0x1c
ret
mov ecx, dword [esp + 0x20]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0052f708
add esp, 0x1c
ret
Function at 0x461250
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2004
call fcn.0052f720
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x2000], eax
push esi
push 1
push str.RestoreFolder
push 0x557ad0
mov esi, ecx
call fcn.004cf550
push 0x800
push 0x557718
test eax, eax
je 0x4612e8
lea eax, [esp + 0xc]
push eax
push str.LastFolder
push 0x557ad0
call fcn.004cf7c0
cmp word [esp + 4], 0
je 0x46138b
lea eax, [esp + 4]
push eax
call fcn.00490c30
test al, al
je 0x46138b
push 0x800
lea eax, [esp + 8]
push eax
lea eax, [esi + 0x103c]
push eax
call fcn.004bd090
pop esi
mov ecx, dword [esp + 0x2000]
xor ecx, esp
call fcn.0052f708
add esp, 0x2004
ret
lea eax, [esp + 0x100c]
push eax
push str.StartFolder
push 0x5579a8
call fcn.004cf7c0
xor eax, eax
mov word [esp + 4], ax
lea eax, [esp + 4]
push 0x800
push eax
lea eax, [esp + 0x100c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x46138b
cmp eax, 0x800
jae 0x46138b
cmp word [esp + 4], 0
je 0x46138b
mov ecx, 0x557b90
lea eax, [esp + 4]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x461366
test dx, dx
je 0x461362
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x461366
add eax, 4
add ecx, 4
test dx, dx
jne 0x461340
xor eax, eax
jmp 0x46136b
sbb eax, eax
or eax, 1
test eax, eax
je 0x46138b
push 0x800
lea eax, [esp + 8]
add esi, 0x103c
push eax
push esi
call fcn.004bd090
push esi
call fcn.0040faf0
mov ecx, dword [esp + 0x2004]
pop esi
xor ecx, esp
call fcn.0052f708
add esp, 0x2004
ret
Function at 0x4630d0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
test esi, esi
je 0x4631e9
mov edi, esi
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4630e3
sub edi, ecx
sar edi, 1
je 0x4631e9
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x463109
pop edi
pop esi
ret 4
push ebx
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea eax, [edi*2 + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x46314f
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x46314f
lea ecx, [edi + 1]
push ecx
push eax
push esi
call fcn.004c0d50
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
lea eax, [edi*2 + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x46319a
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
test ebp, ebp
je 0x463199
lea ecx, [edi + 1]
push ecx
push ebp
push esi
call fcn.004c0d50
push ebp
push ebp
call dword [sym.imp.USER32.dll_CharToOemA]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 7
call dword [sym.imp.USER32.dll_SetClipboardData]
pop ebp
lea eax, [edi*2 + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
pop ebx
test edi, edi
je 0x4631e3
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
test ecx, ecx
je 0x4631e3
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x4631c3
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, 1
pop esi
ret 4

Function at 0x464720
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
mov ebx, ecx
call fcn.00495590
cmp eax, 0x600
jb 0x46474d
mov ecx, dword [ebx]
movzx eax, byte [esp + 0xc]
push eax
push ecx
mov edx, dword [ecx]
mov esi, dword [edx + 0x10]
mov ecx, esi
call dword [0x55670c]
call esi
pop esi
pop ebx
ret 4
mov ecx, dword [ebx + 8]
mov al, byte [esp + 0xc]
mov byte [ecx + 0x18], al
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x4647c9
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
xor ecx, ecx
mov edx, 2
lea esi, [eax + 1]
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0052f903
add esp, 4
mov edi, eax
push esi
push edi
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
push 0
push 0xb1
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
push 1
push 8
push 0x102
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push edi
call fcn.0052f90c
add esp, 4
pop edi
pop esi
pop ebx
ret 4
Function at 0x466de0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x86c
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x868], eax
push esi
mov esi, dword [esp + 0x878]
lea eax, [esp + 0x6c]
push edi
push 0x200
push 0x557718
push eax
push 0x566b78
push dword [0x588dec]
call fcn.004cf7c0
cmp word [esp + 0x70], 0
lea eax, [esp + 0xc]
mov edi, dword [esp + 0x878]
push edi
je 0x466e78
push 0x566b80
push 0x32
push eax
call fcn.00404ce0
add esp, 0x10
lea eax, [esp + 0x70]
push 0x200
push 0x557718
push eax
lea eax, [esp + 0x18]
push eax
push dword [0x588dec]
call fcn.004cf7c0
cmp word [esp + 0x70], 0
je 0x466ec1
lea eax, [esp + 0x70]
mov ecx, esi
push eax
call fcn.004ba4d0
jmp 0x466f1e
push str.PE_d
push 0x32
push eax
call fcn.00404ce0
push 0x400
lea eax, [esp + 0x484]
push 0
push eax
call fcn.00531c60
add esp, 0x1c
lea eax, [esp + 0x470]
push 0x400
push 0
push eax
lea eax, [esp + 0x18]
push eax
push dword [0x588dec]
call fcn.004cf5f0
mov edx, eax
test edx, edx
jne 0x466ec8
xor al, al
jmp 0x466ffc
xor ecx, ecx
test edx, edx
jle 0x466edf
mov edi, edi
lea eax, [ecx + 0x49]
xor byte [esp + ecx + 0x470], al
inc ecx
cmp ecx, edx
jl 0x466ed0
push 0x200
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x478]
push eax
call fcn.004c0b50
xor eax, eax
mov ecx, esi
mov word [esp + 0x46e], ax
lea eax, [esp + 0x70]
push eax
call fcn.004ba4d0
push 0x400
lea eax, [esp + 0x474]
push eax
call fcn.004ba540
push ebx
push edi
push 0x566b94
lea eax, [esp + 0x18]
push 0x32
push eax
call fcn.00404ce0
add esp, 0x10
lea ebx, [esi + 0x10]
lea eax, [esp + 0x10]
push 0xc8
push 0x557718
push ebx
push eax
push dword [0x588dec]
call fcn.004cf7c0
push edi
push 0x566b9c
lea eax, [esp + 0x18]
push 0x32
push eax
call fcn.00404ce0
add esp, 0x10
lea eax, [esi + 0x1a0]
push 0x800
push 0x557718
push eax
lea eax, [esp + 0x1c]
push eax
push dword [0x588dec]
call fcn.004cf7c0
push edi
push 0x566ba4
lea eax, [esp + 0x18]
push 0x32
push eax
call fcn.00404ce0
add esp, 0x10
lea eax, [esp + 0x10]
push 0
push eax
push dword [0x588dec]
call fcn.004cf550
test eax, eax
lea edi, [esi + 0x11a0]
setne al
cmp word [ebx], 0
mov byte [esi + 0x11b0], al
je 0x466fd0
push ebx
mov ecx, edi
call fcn.004ba4d0
jmp 0x466fea
cmp edi, esi
je 0x466fe4
push dword [esp + 0xc]
mov ecx, edi
push dword [esi + 4]
push dword [esi]
call fcn.00404d10
mov al, byte [esi + 0xc]
mov byte [edi + 0xc], al
push 0x400
lea eax, [esp + 0x78]
push eax
call fcn.004ba540
mov al, 1
pop ebx
mov ecx, dword [esp + 0x870]
pop edi
pop esi
xor ecx, esp
call fcn.0052f708
add esp, 0x86c
ret 8

Function at 0x471e60
Capabilities:
Check if file exists

Disassembly:
mov byte [ecx + 0x2428], 0
jmp fcn.0048f200
Function at 0x47aee0
Capabilities:
Hash data using sha256

Disassembly:
cmp dword [0x5ddd64], 2
jl 0x47af05
movaps xmm0, xmmword [0x566e30]
movaps xmmword [0x5cc110], xmm0
movaps xmm0, xmmword [0x566e20]
movaps xmmword [0x5cc120], xmm0
push esi
mov esi, dword [esp + 8]
push 0xf0
push 0
push esi
call fcn.00531c60
mov dword [esi + 0x100], 0
add esp, 0xc
mov byte [esi + 0x104], 0
mov eax, dword [esi + 0xf4]
mov dword [eax], 0x6a09e667
mov eax, dword [esi + 0xf4]
mov dword [eax + 4], 0xbb67ae85
mov eax, dword [esi + 0xf4]
mov dword [eax + 8], 0x3c6ef372
mov eax, dword [esi + 0xf4]
mov dword [eax + 0xc], 0xa54ff53a
mov eax, dword [esi + 0xf4]
mov dword [eax + 0x10], 0x510e527f
mov eax, dword [esi + 0xf4]
mov dword [eax + 0x14], 0x9b05688c
mov eax, dword [esi + 0xf4]
mov dword [eax + 0x18], 0x1f83d9ab
mov eax, dword [esi + 0xf4]
mov dword [eax + 0x1c], 0x5be0cd19
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0xc]
xor dword [ecx + 8], eax
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0x10]
or eax, 0x2000
shl eax, 0x10
xor dword [ecx + 0xc], eax
pop esi
ret 0xc

Function at 0x47b170
Capabilities:
Hash data using sha256

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x10]
push 0x200
push 0
lea eax, [edi + 0x948]
push eax
call fcn.00531c60
add esp, 0xc
mov dword [edi + 0xb48], 0
lea eax, [edi + 0x840]
push 1
push 0
push eax
call fcn.0047aee0
mov dword [esp + 8], 0
lea esi, [edi + 0xf4]
cmp dword [0x5ddd64], 2
jl 0x47b1da
movaps xmm0, xmmword [0x566e30]
movaps xmmword [0x5cc110], xmm0
movaps xmm0, xmmword [0x566e20]
movaps xmmword [0x5cc120], xmm0
push 0xf0
lea eax, [esi - 0xf4]
push 0
push eax
call fcn.00531c60
mov dword [esi + 0xc], 0
add esp, 0xc
mov byte [esi + 0x10], 0
mov eax, dword [esi]
mov ecx, dword [esp + 8]
mov dword [eax], 0x6a09e667
mov eax, dword [esi]
mov dword [eax + 4], 0xbb67ae85
mov eax, dword [esi]
mov dword [eax + 8], 0x3c6ef372
mov eax, dword [esi]
mov dword [eax + 0xc], 0xa54ff53a
mov eax, dword [esi]
mov dword [eax + 0x10], 0x510e527f
mov eax, dword [esi]
mov dword [eax + 0x14], 0x9b05688c
mov eax, dword [esi]
mov dword [eax + 0x18], 0x1f83d9ab
mov eax, dword [esi]
mov dword [eax + 0x1c], 0x5be0cd19
mov eax, dword [esi]
xor dword [eax], 0x2080020
mov eax, dword [esi]
xor dword [eax + 8], ecx
inc ecx
mov eax, dword [esi]
add esi, 0x108
mov dword [esp + 8], ecx
xor dword [eax + 0xc], 0x20000000
cmp ecx, 8
jb 0x47b1b5
mov byte [edi + 0x944], 1
mov byte [edi + 0x83c], 1
pop edi
pop esi
pop ecx
ret 4
Function at 0x47b470
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54fb50
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x58bb30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea ecx, [edi + 0x14]
call fcn.004a52f0
mov dword [ebp - 4], 0
lea ecx, [edi + 0x14]
mov eax, dword [ebp + 8]
push 0x40000
push eax
push 0x47baa0
mov dword [edi], eax
mov dword [edi + 0x3c], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 1
mov dword [edi + 4], 0
call fcn.004a5600
lea ecx, [edi + 0x14]
call fcn.004a5400
mov dword [edi + 0x10], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x47fda0
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
xor ecx, ecx
push edi
mov word [esi + 0xd432], cx
mov byte [esi + 0xd429], cl
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebp, eax
mov byte [esp + 0x13], 1
push 0
push 0
push ebp
call fcn.004bc800
mov edi, eax
test edi, edi
je 0x47fed9
sub edi, ebp
sar edi, 1
add edi, 2
lea ecx, [edi + edi]
push ecx
call fcn.00538da8
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x47fed9
push edi
push ebx
push ebp
call fcn.004bc800
mov ebp, eax
test ebp, ebp
je 0x47fed9
cmp byte [esp + 0x13], 0
jne 0x47fec6
cmp byte [esp + 0x18], 0
je 0x47febe
movzx eax, word [ebx]
cmp eax, 0x2d
je 0x47fe29
cmp eax, 0x2f
jne 0x47fe8c
cmp byte [esi + 0xd429], 0
jne 0x47fe8c
cmp word [ebx + 2], 0x2d
lea edi, [ebx + 2]
jne 0x47fe4a
cmp word [edi + 2], 0
jne 0x47fe4a
mov byte [esi + 0xd429], 1
push 0x566f18
push edi
call fcn.004c1160
test eax, eax
jne 0x47fe60
mov byte [esi + 0x2014], 1
push 2
push 0x566f24
push edi
call fcn.004c11b0
test eax, eax
jne 0x47fec6
push edi
mov ecx, esi
call fcn.00480050
push ebx
call fcn.00537b6f
add esp, 4
mov byte [esp + 0x13], 0
jmp 0x47fdc3
cmp word [esi + 0xd432], 0
lea eax, [esi + 0xd432]
jne 0x47fec6
push 0x810
push ebx
push eax
call fcn.00538bb7
add esp, 0xc
push ebx
call fcn.00537b6f
add esp, 4
mov byte [esp + 0x13], 0
jmp 0x47fdc3
push ebx
mov ecx, esi
call fcn.0047fa80
push ebx
call fcn.00537b6f
add esp, 4
mov byte [esp + 0x13], 0
jmp 0x47fdc3
cmp byte [esp + 0x18], 0
jne 0x47ff56
cmp dword [esi + 0xf468], 0
jne 0x47ff02
cmp byte [esi + 0xd428], 0
jne 0x47ff02
push 0x5578cc
lea ecx, [esi + 0xf454]
call fcn.004bd180
movzx eax, word [esi + 0xd432]
push eax
call fcn.004c10e0
movzx eax, ax
cmp eax, 0x58
je 0x47ff25
cmp eax, 0x45
je 0x47ff25
cmp eax, 0x50
je 0x47ff25
xor cl, cl
jmp 0x47ff27
mov cl, 1
cmp byte [esi + 0x7309], 0
je 0x47ff3b
test cl, cl
je 0x47ff3b
mov byte [esi + 0x7309], 0
cmp eax, 0x4c
je 0x47ff45
cmp eax, 0x56
jne 0x47ff56
cmp word [esi + 0xd434], 0x42
jne 0x47ff56
mov byte [esi + 0xd430], 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0xc
Function at 0x4826b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
test esi, esi
je 0x4826e3
test bl, 7
je 0x4826e3
movzx edx, byte [ebx]
inc ebx
movzx ecx, al
xor edx, ecx
shr eax, 8
mov dword [esp + 0x10], ebx
xor eax, dword [edx*4 + 0x5cc740]
sub esi, 1
jne 0x4826c2
cmp esi, 8
jb 0x482779
push edi
mov edi, esi
shr edi, 3
xor eax, dword [ebx]
sub esi, 8
mov ebx, dword [ebx + 4]
mov ecx, ebx
shr ecx, 0x10
movzx edx, cl
mov ecx, ebx
shr ecx, 8
movzx ecx, cl
mov edx, dword [edx*4 + 0x5ccb40]
xor edx, dword [ecx*4 + 0x5ccf40]
mov ecx, eax
shr ecx, 0x10
movzx ecx, cl
xor edx, dword [ecx*4 + 0x5cdb40]
mov ecx, eax
shr ecx, 8
movzx ecx, cl
xor edx, dword [ecx*4 + 0x5cdf40]
mov ecx, ebx
shr ecx, 0x18
xor edx, dword [ecx*4 + 0x5cc740]
mov ecx, eax
shr ecx, 0x18
movzx eax, al
xor edx, dword [ecx*4 + 0x5cd740]
movzx ecx, bl
mov ebx, dword [esp + 0x14]
add ebx, 8
mov dword [esp + 0x14], ebx
xor edx, dword [ecx*4 + 0x5cd340]
xor edx, dword [eax*4 + 0x5ce340]
mov eax, edx
sub edi, 1
jne 0x4826f2
pop edi
test esi, esi
je 0x48279a
lea ecx, [ecx]
movzx edx, byte [ebx]
lea ebx, [ebx + 1]
movzx ecx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x5cc740]
sub esi, 1
jne 0x482780
pop esi
pop ebx
ret 0xc
Function at 0x4827a0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x1c]
test ebp, ebp
je 0x4827eb
test cl, 7
je 0x4827eb
movzx ecx, byte [ecx]
dec ebp
movzx eax, bl
xor ecx, eax
mov dword [esp + 0x1c], ebp
shrd ebx, edx, 8
shr edx, 8
xor ebx, dword [ecx*8 + 0x5ce740]
xor edx, dword [ecx*8 + 0x5ce744]
mov ecx, dword [esp + 0x18]
inc ecx
mov dword [esp + 0x18], ecx
test ebp, ebp
jne 0x4827b7
mov eax, ebp
shr eax, 3
lea eax, [ecx + eax*8]
mov dword [esp + 8], eax
cmp ecx, eax
jae 0x4828db
push esi
mov ebp, eax
push edi
xor ebx, dword [ecx]
mov ecx, dword [ecx + 4]
xor ecx, edx
mov eax, ecx
mov dword [esp + 0x10], ecx
mov esi, dword [esp + 0x10]
shr eax, 0x10
movzx edx, al
mov eax, ecx
shr eax, 8
movzx eax, al
mov edi, dword [edx*8 + 0x5cef40]
mov edx, dword [edx*8 + 0x5cef44]
xor edx, dword [eax*8 + 0x5cf744]
xor edi, dword [eax*8 + 0x5cf740]
movzx eax, cl
mov ecx, ebx
xor edx, dword [eax*8 + 0x5cff44]
xor edi, dword [eax*8 + 0x5cff40]
mov eax, esi
shrd ecx, eax, 0x18
movzx eax, cl
mov ecx, ebx
xor edx, dword [eax*8 + 0x5d0744]
xor edi, dword [eax*8 + 0x5d0740]
mov eax, esi
shrd ecx, eax, 0x10
movzx eax, cl
mov ecx, ebx
xor edx, dword [eax*8 + 0x5d0f44]
xor edi, dword [eax*8 + 0x5d0f40]
mov eax, esi
shrd ecx, eax, 8
shr esi, 0x18
movzx eax, cl
mov ecx, dword [esp + 0x20]
add ecx, 8
mov dword [esp + 0x20], ecx
xor edx, dword [eax*8 + 0x5d1744]
xor edi, dword [eax*8 + 0x5d1740]
xor edi, dword [esi*8 + 0x5ce740]
xor edx, dword [esi*8 + 0x5ce744]
movzx eax, bl
mov ebx, edi
mov dword [esp + 0x10], edi
xor ebx, dword [eax*8 + 0x5d1f40]
xor edx, dword [eax*8 + 0x5d1f44]
cmp ecx, ebp
jb 0x482803
mov ebp, dword [esp + 0x24]
pop edi
pop esi
and ebp, 7
jbe 0x48290b
movzx ecx, byte [ecx]
movzx eax, bl
xor ecx, eax
shrd ebx, edx, 8
shr edx, 8
xor ebx, dword [ecx*8 + 0x5ce740]
xor edx, dword [ecx*8 + 0x5ce744]
mov ecx, dword [esp + 0x18]
inc ecx
mov dword [esp + 0x18], ecx
sub ebp, 1
jne 0x4828e0
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret 0x10
Function at 0x483030
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
sub esp, 0x164
mov eax, dword [0x58bb30]
xor eax, esp
mov dword [esp + 0x160], eax
push ebx
mov ebx, dword [esp + 0x16c]
push esi
mov esi, dword [esp + 0x174]
push edi
cmp dword [ebx], 2
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], esi
jne 0x48312b
mov eax, dword [ebx + 4]
push ebp
push 0
push 0
push 0
push 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x140]
push eax
push 4
lea eax, [esp + 0x28]
push eax
push 0x20
push esi
call fcn.00484470
lea eax, [esp + 0x131]
xor ebp, ebp
mov esi, 2
mov dword [esp + 0x10], ebp
sub esi, eax
lea ecx, [esp + 0x131]
mov eax, 3
sub eax, ecx
lea ebx, [ebp + 1]
mov dword [esp + 0x14], eax
jmp 0x4830c0
lea edx, [esp + 0x131]
add edx, ebp
movzx edi, byte [edx + 2]
lea ecx, [edx + eax]
movzx eax, byte [edx + 1]
and ecx, 3
shl ecx, 3
shl edi, cl
lea ecx, [edx + esi]
and ecx, 3
shl ecx, 3
shl eax, cl
mov ecx, ebp
xor edi, eax
and ecx, 3
movzx eax, byte [edx - 1]
add ebp, 4
shl ecx, 3
shl eax, cl
mov ecx, ebx
xor edi, eax
and ecx, 3
movzx eax, byte [edx]
add ebx, 4
shl ecx, 3
shl eax, cl
xor edi, eax
mov eax, dword [esp + 0x14]
xor edi, dword [esp + 0x10]
mov dword [esp + 0x10], edi
cmp ebx, 0x21
jb 0x4830c0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
pop ebp
mov dword [ebx + 4], edi
cmp dword [ebx], 3
jne 0x4832bd
lea eax, [esp + 0xec]
xor edx, edx
sub esi, eax
nop
lea ecx, [esp + 0xec]
add ecx, edx
inc edx
mov al, byte [esi + ecx]
xor al, 0x36
mov byte [ecx], al
cmp edx, 0x20
jb 0x483140
lea eax, [esp + 0x1c]
mov dword [esp + 0x10c], 0x36363636
push eax
mov dword [esp + 0x114], 0x36363636
mov dword [esp + 0x118], 0x36363636
mov dword [esp + 0x11c], 0x36363636
mov dword [esp + 0x120], 0x36363636
mov dword [esp + 0x124], 0x36363636
mov dword [esp + 0x128], 0x36363636
mov dword [esp + 0x12c], 0x36363636
call fcn.004bc070
push 0x40
lea eax, [esp + 0xf0]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.004bc0c0
push 0x20
lea edi, [ebx + 4]
push edi
lea eax, [esp + 0x24]
push eax
call fcn.004bc0c0
lea eax, [esp + 0x12c]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004bbf60
xor eax, eax
lea edx, [esp + 0xec]
add edx, eax
inc eax
mov cl, byte [esi + edx]
xor cl, 0x5c
mov byte [edx], cl
cmp eax, 0x20
jb 0x4831f0
lea eax, [esp + 0x84]
mov dword [esp + 0x10c], 0x5c5c5c5c
push eax
mov dword [esp + 0x114], 0x5c5c5c5c
mov dword [esp + 0x118], 0x5c5c5c5c
mov dword [esp + 0x11c], 0x5c5c5c5c
mov dword [esp + 0x120], 0x5c5c5c5c
mov dword [esp + 0x124], 0x5c5c5c5c
mov dword [esp + 0x128], 0x5c5c5c5c
mov dword [esp + 0x12c], 0x5c5c5c5c
call fcn.004bc070
push 0x40
lea eax, [esp + 0xf0]
push eax
lea eax, [esp + 0x8c]
push eax
call fcn.004bc0c0
push 0x20
lea eax, [esp + 0x130]
push eax
lea eax, [esp + 0x8c]
push eax
call fcn.004bc0c0
lea eax, [esp + 0x14c]
push eax
lea eax, [esp + 0x88]
push eax
call fcn.004bbf60
mov ecx, 8
lea esi, [esp + 0x14c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x16c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0052f708
add esp, 0x164
ret 8