joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d730
Capabilities:
Access peb ldr_data
Hide graphical window

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d1f03
push eax
mov eax, dword [0x537a80]
mov dword fs:[0], esp
sub esp, 0x20
push ebx
xor ebx, ebx
cmp eax, ebx
push esi
jne 0x47d7be
push 0x614
call fcn.004bdcbb
add esp, 4
mov dword [esp + 8], eax
cmp eax, ebx
mov dword [esp + 0x30], ebx
je 0x47d777
mov ecx, eax
call fcn.0048ff40
jmp 0x47d779
xor eax, eax
mov dword [0x537a80], eax
mov eax, dword [str.RaptisoftBugTracker]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov dword [esp + 0x50], 0xffffffff
mov dword [ecx], 0x4d6800
mov dword [ecx + 4], ebx
mov dword [ecx + 0xc], ebx
mov byte [ecx + 0x18], 1
mov dword [ecx + 8], ebx
mov dword [ecx + 0x14], ebx
mov byte [ecx + 0x10], bl
call fcn.00476c70
mov ecx, dword [0x537a80]
call fcn.0047d530
mov eax, dword [0x537aa8]
push ebx
push eax
call dword [sym.imp.user32.dll_EnableWindow]
push ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x4d6800
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x28], 1
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x20], bl
call fcn.00476c70
mov ecx, dword [str.http:__bugs.raptisoft.com_cgi_bin_errorreport.cgi]
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x34], 1
call fcn.00476e50
push 0x4dcc44
lea ecx, [esp + 0x10]
call fcn.00476f60
push 0x4dcc40
lea ecx, [esp + 0x10]
call fcn.00476f60
mov edx, dword [0x537648]
mov eax, dword [edx + 0x20]
push eax
lea ecx, [esp + 0x10]
call fcn.00476f60
push 0x4dcc3c
lea ecx, [esp + 0x10]
call fcn.00476f60
push str._ERRORREPORT_
lea ecx, [esp + 0x10]
call fcn.00476f60
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x537a88
call fcn.00476de0
lea ecx, [esp + 0x28]
call fcn.00477280
push str.__ERRORREPORT_
lea ecx, [esp + 0x10]
call fcn.00476f60
push 0x4dcc40
lea ecx, [esp + 0x10]
call fcn.00476f60
push 0xffff
push 0x1388
sub esp, 0x1c
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x2c], esp
push eax
call fcn.00476de0
mov ecx, dword [0x537a80]
call fcn.00490130
mov ecx, dword [0x537ab0]
mov esi, dword [sym.imp.user32.dll_ShowWindow]
push 1
push ecx
mov byte [0x537ab4], 1
mov byte [0x537ab5], bl
call esi
mov edx, dword [0x537aac]
push ebx
push edx
call esi
mov eax, dword [0x537ab0]
push str.Contacting_Raptisoft_...
push eax
call dword [sym.imp.user32.dll_SetWindowTextA]
mov ecx, dword [0x537aa4]
mov esi, dword [sym.imp.user32.dll_InvalidateRect]
push ebx
push ebx
push ecx
call esi
mov edx, dword [0x537ab0]
push ebx
push ebx
push edx
call esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00476e20
mov ecx, dword [esp + 0x28]
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x2c
ret
Function at 0x480040
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x4d1f99
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x34]
xor edi, edi
push edi
mov ecx, ebx
mov dword [esp + 0x10], esi
mov dword [esi], 0x4dd604
call fcn.00456930
push edi
lea ecx, [esi + 0x450]
mov dword [esp + 0x1c], edi
call fcn.00456930
mov eax, dword [esp + 0x20]
lea ecx, [eax + 2]
mov dword [esi + 0x14], eax
imul eax, eax, 0xc6c
push eax
mov byte [esp + 0x1c], 1
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi + 0x18], ecx
call fcn.004bdcb6
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x14]
lea edx, [eax + eax*8]
shl edx, 2
push edx
call fcn.004bdcb6
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x14]
lea eax, [eax + eax*2]
shl eax, 3
push eax
call fcn.004bdcb6
add esp, 0xc
mov ecx, ebx
mov dword [esi + 0x30], eax
mov dword [esi + 0x1c], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x2c], edi
call fcn.004569a0
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x48110c
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [eax], 0x20000000
mov dword [ebp - 4], edi
jne 0x481253
push ebx
push esi
push 4
pop esi
add eax, esi
mov ecx, dword [eax]
cmp ecx, 0x40020000
jne 0x4811b2
add eax, esi
mov ecx, dword [eax]
xor edx, edx
cmp ecx, 0x40000001
je 0x48115c
cmp ecx, 0x40010001
je 0x48115c
cmp ecx, 0x40020001
je 0x48115c
cmp ecx, 0x40030001
jne 0x481167
shr ecx, 0x10
and ecx, 0xf
inc ecx
mov edx, ecx
add eax, esi
cmp dword [eax], 0x40050002
jne 0x481179
inc edx
mov dword [ebp - 4], 0x1000
add eax, esi
mov ecx, edx
sub ecx, edi
je 0x4811ac
dec ecx
je 0x4811a6
dec ecx
je 0x4811a0
dec ecx
je 0x48119a
dec ecx
je 0x481194
dec ecx
jne 0x4811bf
or dword [ebp - 4], 0xe
jmp 0x4811bf
or dword [ebp - 4], 0xc
jmp 0x4811bf
or dword [ebp - 4], 0xa
jmp 0x4811bf
or dword [ebp - 4], 8
jmp 0x4811bf
or dword [ebp - 4], 6
jmp 0x4811bf
or dword [ebp - 4], 2
jmp 0x4811bf
cmp ecx, 0x40030000
jne 0x4811bf
mov dword [ebp - 4], esi
add eax, esi
cmp dword [eax], 0x40020003
push 0x10
pop ecx
jne 0x4811cf
or dword [ebp - 4], ecx
add eax, esi
cmp dword [eax], 0x40000004
jne 0x4811dd
or dword [ebp - 4], 0x20
add eax, esi
cmp dword [eax], 0x40040005
jne 0x4811eb
or dword [ebp - 4], 0x40
add eax, esi
cmp dword [eax], 0x40040006
jne 0x4811f9
or byte [ebp - 4], 0x80
add eax, esi
push 7
pop esi
mov edx, dword [eax]
mov ebx, esi
or ebx, 0x40000000
cmp ebx, edx
jne 0x48120e
push 3
jmp 0x481239
mov ebx, esi
or ebx, 0x40010000
cmp ebx, edx
je 0x48123f
mov ebx, esi
or ebx, 0x40020000
cmp ebx, edx
jne 0x48122b
xor edx, edx
inc edx
jmp 0x48123a
mov ebx, esi
or ebx, 0x40030000
cmp ebx, edx
jne 0x48124b
push 2
pop edx
shl edx, cl
or dword [ebp - 4], edx
add eax, 4
inc edi
inc ecx
inc ecx
inc esi
cmp ecx, 0x20
jb 0x4811fc
shl edi, 8
or dword [ebp - 4], edi
pop esi
pop ebx
cmp dword [eax], 0xffffffff
pop edi
je 0x481260
mov eax, 0x8876086c
jmp 0x48126a
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
xor eax, eax
leave
ret 8
Function at 0x48b5e0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x98
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0x78], esi
push edi
mov edi, ecx
jne 0x48b601
mov eax, 0x8876086c
jmp 0x48b6e3
cmp dword [ebp + 0x7c], esi
je 0x48b67b
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0x18], 2
je 0x48b65b
mov ebx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push esi
call ebx
mov dword [ebp + 0x6c], eax
add eax, 3
and eax, 0xfffffffc
call fcn.004bf500
mov dword [ebp + 0x7c], esp
push esi
push esi
push dword [ebp + 0x6c]
push dword [ebp + 0x7c]
push 0xffffffffffffffff
push dword [ebp + 0x78]
push esi
push esi
call ebx
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x78], eax
mov dword [ebp + 0x7c], esi
cmp dword [ebp + 0x7c], esi
je 0x48b67b
push esi
push 0x10000000
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 0x78]
call dword [sym.imp.kernel32.dll_CreateFileW]
jmp 0x48b694
push esi
push 0x10000000
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 0x78]
call dword [sym.imp.kernel32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [edi], eax
je 0x48b6d4
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.kernel32.dll_CreateFileMappingA]
cmp eax, 0xffffffff
mov dword [edi + 4], eax
je 0x48b6d4
push esi
push esi
push esi
push 4
push eax
call dword [sym.imp.kernel32.dll_MapViewOfFile]
cmp eax, esi
mov dword [edi + 8], eax
je 0x48b6d4
push esi
push dword [edi]
call dword [sym.imp.kernel32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [edi + 0xc], eax
jne 0x48b6e1
call dword [sym.imp.kernel32.dll_GetLastError]
mov eax, 0x88760b59
jmp 0x48b6e3
xor eax, eax
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8

Function at 0x48d4a0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test edx, edx
push ebx
mov ebx, dword [esp + 8]
je 0x48d500
push ebp
push esi
push edi
mov edi, edi
mov ecx, dword [edx]
mov edi, dword [ecx]
mov esi, dword [edx + 4]
add esi, edi
mov edi, dword [edx + 8]
cmp ebx, edi
jge 0x48d4c2
mov edi, ebx
xor ecx, ecx
test edi, edi
jle 0x48d4f0
jmp 0x48d4d0
movzx ebx, byte [ecx + esi]
mov ebp, eax
shr ebp, 0x18
xor ebx, ebp
mov ebx, dword [ebx*4 + 0x4fb0f0]
shl eax, 8
xor eax, ebx
inc ecx
cmp ecx, edi
jl 0x48d4d0
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0xc]
sub ebx, ecx
test edx, edx
mov dword [esp + 0x14], ebx
jne 0x48d4b0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x48ff40
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x4d20e1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esi], 0x4de198
xor ebx, ebx
push edi
lea edi, [esi + 8]
push ebx
mov ecx, edi
mov dword [esp + 0x14], esi
mov dword [edi], 0x4d6800
mov dword [edi + 4], ebx
mov dword [edi + 0xc], ebx
mov byte [edi + 0x18], 1
mov dword [edi + 8], ebx
mov dword [edi + 0x14], ebx
mov byte [edi + 0x10], bl
call fcn.00476c70
lea ebp, [esi + 0x24]
push ebx
mov ecx, ebp
mov dword [esp + 0x50], ebx
mov dword [ebp], 0x4d6800
mov dword [ebp + 4], ebx
mov dword [ebp + 0xc], ebx
mov byte [ebp + 0x18], 1
mov dword [ebp + 8], ebx
mov dword [ebp + 0x14], ebx
mov byte [ebp + 0x10], bl
call fcn.00476c70
lea ecx, [esi + 0x40]
push ebx
mov byte [esp + 0x50], 1
mov dword [ecx], 0x4d6800
mov dword [ecx + 4], ebx
mov dword [ecx + 0xc], ebx
mov byte [ecx + 0x18], 1
mov dword [ecx + 8], ebx
mov dword [ecx + 0x14], ebx
mov byte [ecx + 0x10], bl
call fcn.00476c70
cmp dword [0x5386c0], ebx
mov byte [esp + 0x4c], 2
jne 0x49004c
lea eax, [esi + 0x480]
push eax
push 0x101
call dword [sym.imp.ws2_32.dll_WSAStartup]
test eax, eax
jne 0x490096
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0x30
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0x48fcd0
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], str.WebWindow
mov dword [esp + 0x44], ebx
call dword [sym.imp.user32.dll_RegisterClassExA]
inc dword [0x5386c0]
push 0x4d4242
mov ecx, edi
mov dword [esi + 4], ebx
call fcn.00476e50
push 0x4d4242
mov ecx, ebp
call fcn.00476e50
push str.Raptisoftware
lea ecx, [esi + 0x40]
mov dword [esi + 0x45c], ebx
mov dword [esi + 0x474], ebx
mov dword [esi + 0x478], ebx
mov dword [esi + 0x460], 0xffffffff
call fcn.00476e50
mov ecx, dword [esp + 0x44]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x40
ret
Function at 0x492b74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x18]
imul eax, edi
add eax, edx
cmp edx, eax
mov dword [ebp - 0x18], eax
jae 0x492c95
mov eax, dword [ebp + 0x10]
lea eax, [edx + eax*4]
push ebx
push esi
mov dword [ebp + 0x14], eax
mov esi, 0xffc03fc0
mov eax, 0xff00ff
cmp edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
jae 0x492c79
mov ebx, dword [ebp + 0x14]
sub ebx, edx
dec ebx
shr ebx, 3
lea ecx, [edx + 4]
inc ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ebx
mov edx, dword [ecx + edi]
mov edi, dword [edi + ecx - 4]
mov dword [ebp - 0xc], edi
shr edi, 2
and edi, esi
mov dword [ebp - 4], edx
mov edx, dword [ecx]
mov ecx, dword [ecx - 4]
mov ebx, ecx
shr ebx, 2
and ebx, esi
add ebx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ebx, edi
mov edi, edx
shr edi, 2
and edi, esi
lea ebx, [ebx + edi - 0x7fff80]
mov edi, dword [ebp - 0xc]
and edi, eax
mov esi, ecx
and esi, eax
add esi, edi
mov edi, dword [ebp - 4]
and edi, eax
add esi, edi
mov edi, edx
and edi, eax
lea esi, [esi + edi + 0x20002]
mov edi, dword [ebp - 0xc]
shr ecx, 2
shr esi, 2
xor ebx, esi
shr edi, 2
mov esi, 0x3fc03fc0
and ecx, esi
and edi, esi
add ecx, edi
mov edi, dword [ebp - 4]
shr edi, 2
and edi, esi
add ecx, edi
mov edi, dword [ebp + 0x18]
shr edx, 2
and edx, esi
lea ecx, [ecx + edx + 0x800080]
and ebx, eax
xor ebx, ecx
mov ecx, dword [ebp - 8]
add dword [ebp - 8], 4
mov dword [ecx], ebx
mov ecx, dword [ebp - 0x10]
add ecx, 8
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
mov esi, 0xffc03fc0
jne 0x492bcb
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add dword [ebp + 8], ecx
lea ecx, [edi + edi]
add dword [ebp + 0x14], ecx
add edx, ecx
cmp edx, dword [ebp - 0x18]
mov dword [ebp + 0xc], edx
jb 0x492ba9
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret
Function at 0x492f61
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x4930a8
mov edx, 0xf81f
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x493083
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff07e0
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x1002]
mov ebp, eax
and ebp, 0xffff07e0
add ebp, ecx
mov ecx, edi
and ecx, 0xffff07e0
add ebp, ecx
mov ecx, esi
and ecx, 0xffff07e0
shr ebx, 2
lea ecx, [ecx + ebp + 0x40]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff07e0
lea eax, [eax + esi + 0x1002]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x492fca
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x492fa1
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x4931d5
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
mov edx, dword [esi + 0x18]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
add ebp, edx
cmp edx, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], ebp
jae 0x49331b
mov eax, 0x83e0
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [edx + esi*2]
mov dword [esp + 0x10], ebx
add edi, edx
cmp edx, esi
mov ebx, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x4932f6
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx edx, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
and ebp, eax
mov ebx, edx
and ebx, eax
add ebx, ebp
mov ebp, edi
and ebp, eax
add ebx, ebp
mov dword [esp + 0x24], ecx
and ecx, 0x7c1f
mov ebp, esi
and ebp, eax
lea ebx, [ebx + ebp + 0x10040]
mov ebp, edx
and ebp, 0x7c1f
add ebp, ecx
mov ecx, edi
and ecx, 0x7c1f
add ebp, ecx
mov ecx, esi
and ecx, 0x7c1f
lea ecx, [ecx + ebp + 0x802]
shr ecx, 2
shr ebx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and ecx, eax
and edx, eax
add edx, ecx
and edi, eax
add edx, edi
mov edi, dword [esp + 0x1c]
and esi, eax
and ebx, 0xffff7c1f
lea ecx, [edx + esi + 0x10040]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [ecx], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x49323e
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea edx, [edx + edi*2]
cmp edx, ebp
mov dword [esp + 0x20], edx
jb 0x493215
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x493324
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
push esi
mov esi, dword [ecx]
mov ebp, dword [esi + 0x105c]
push edi
mov edi, dword [esi + 0x1050]
imul ebp, edi
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x18]
add ebp, eax
cmp eax, ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebp
jae 0x49346e
mov edx, 0xf0f0
push ebx
mov ebx, dword [esp + 0x14]
mov esi, dword [esi + 0x1058]
lea esi, [eax + esi*2]
mov dword [esp + 0x10], ebx
add edi, eax
cmp eax, esi
mov ebx, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], esi
jae 0x493449
movzx ecx, word [ebx]
movzx esi, word [ebx + 2]
movzx eax, word [edi + 2]
movzx edi, word [edi]
mov ebp, ecx
mov ebx, eax
and bx, dx
and bp, dx
mov dword [esp + 0x24], ecx
and ecx, 0xffff0f0f
add ebx, ebp
mov ebp, edi
and bp, dx
add ebx, ebp
mov ebp, esi
and bp, dx
lea ebx, [ebx + ebp + 0x2020]
mov ebp, eax
and ebp, 0xffff0f0f
add ebp, ecx
mov ecx, edi
and ecx, 0xffff0f0f
add ebp, ecx
mov ecx, esi
and ecx, 0xffff0f0f
shr ebx, 2
lea ecx, [ecx + ebp + 0x202]
shr ecx, 2
xor ebx, ecx
mov ecx, dword [esp + 0x24]
and eax, edx
and ecx, edx
add eax, ecx
and edi, edx
add eax, edi
mov edi, dword [esp + 0x1c]
and esi, edx
and ebx, 0xffff0f0f
lea eax, [eax + esi + 0x2020]
shr eax, 2
xor ebx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
mov word [eax], bx
mov ebx, dword [esp + 0x18]
add ebx, 4
add edi, 4
cmp ebx, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edi
jb 0x49338d
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ebp, dword [esp + 0x30]
mov esi, dword [ecx + 4]
mov esi, dword [esi + 0x1050]
add dword [esp + 0x14], esi
mov esi, dword [ecx]
mov edi, dword [esi + 0x1050]
lea eax, [eax + edi*2]
cmp eax, ebp
mov dword [esp + 0x20], eax
jb 0x493364
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24
ret
Function at 0x493477
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
push ebp
mov ebp, dword [eax + 0x18]
mov eax, dword [edx + 0x18]
push esi
mov esi, dword [edx + 0x105c]
push edi
mov edi, dword [edx + 0x1050]
imul esi, edi
add esi, eax
cmp eax, esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], esi
jae 0x4935ad
push ebx
mov edx, dword [edx + 0x1058]
add edx, eax
add edi, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], edx
jae 0x493588
movzx ebp, byte [ebx]
movzx esi, byte [ebx + 1]
movzx eax, byte [edi + 1]
movzx edi, byte [edi]
mov edx, eax
push 0x1c
pop ecx
and edx, ecx
mov ebx, ebp
and ebx, ecx
add edx, ebx
mov ebx, edi
and ebx, ecx
add edx, ebx
mov ebx, esi
and ebx, ecx
lea edx, [edx + ebx + 8]
mov ecx, eax
and ecx, 0xffff00e3
mov ebx, ebp
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, edi
and ebx, 0xffff00e3
add ecx, ebx
mov ebx, esi
and ebx, 0xffff00e3
shr edx, 2
lea ecx, [ecx + ebx + 0x42]
mov ebx, dword [esp + 0x14]
shr ecx, 2
xor dl, cl
mov ecx, 0xe3
and ax, cx
and bp, cx
and di, cx
and si, cx
and dl, 0x1c
add eax, ebp
add eax, edi
mov edi, dword [esp + 0x18]
lea eax, [eax + esi + 0x42]
shr eax, 2
xor dl, al
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
inc ebx
inc ebx
inc edi
inc edi
cmp ebx, dword [esp + 0x24]
mov byte [eax], dl
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], edi
jb 0x4934d6
mov ecx, dword [esp + 0x28]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x2c]
mov edx, dword [ecx + 4]
add ebp, dword [edx + 0x1050]
mov edx, dword [ecx]
mov edi, dword [edx + 0x1050]
lea eax, [eax + edi*2]
cmp eax, esi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], eax
jb 0x4934b2
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
Function at 0x493651
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov edx, dword [ecx]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 0x18]
push ebp
mov ebp, dword [edx + 0x1050]
push edi
mov edi, dword [edx + 0x105c]
imul edi, ebp
mov dword [esp + 0xc], eax
mov eax, dword [edx + 0x18]
add edi, eax
cmp eax, edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], edi
jae 0x493795
push ebx
push esi
mov esi, 0xff1c
mov ebx, dword [esp + 0x14]
mov edx, dword [edx + 0x1058]
lea edx, [eax + edx*2]
mov dword [esp + 0x10], ebx
add ebp, eax
cmp eax, edx
mov ebx, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x28], edx
jae 0x49376f
movzx edx, word [ebx]
movzx edi, word [ebx + 2]
movzx eax, word [ebp + 2]
movzx ebp, word [ebp]
mov dword [esp + 0x18], edx
mov ebx, eax
mov ecx, 0xe3
and bx, cx
and dx, cx
add ebx, edx
mov edx, ebp
and dx, cx
add ebx, edx
mov edx, edi
and dx, cx
mov ecx, eax
and cx, si
and eax, esi
lea edx, [ebx + edx + 0x42]
mov ebx, dword [esp + 0x18]
and bx, si
shr edx, 2
add ecx, ebx
mov ebx, ebp
and bx, si
and ebp, esi
add ecx, ebx
mov ebx, edi
and bx, si
and edi, esi
lea ecx, [ecx + ebx + 0x208]
mov ebx, dword [esp + 0x1c]
shr ecx, 2
xor dl, cl
mov ecx, dword [esp + 0x18]
and ecx, esi
add eax, ecx
add eax, ebp
mov ebp, dword [esp + 0x20]
lea eax, [eax + edi + 0x208]
shr eax, 2
and edx, 0xffff00e3
xor edx, eax
mov eax, dword [esp + 0x10]
add dword [esp + 0x10], 2
add ebx, 4
add ebp, 4
cmp ebx, dword [esp + 0x28]
mov word [eax], dx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebp
jb 0x4936ba
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
mov edx, dword [ecx + 4]
mov edx, dword [edx + 0x1050]
add dword [esp + 0x14], edx
mov edx, dword [ecx]
mov ebp, dword [edx + 0x1050]
lea eax, [eax + ebp*2]
cmp eax, edi
mov dword [esp + 0x24], eax
jb 0x493691
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x24
ret