joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b0c8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov al, byte [0x44b10c]
mov byte [ebp - 5], al
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44b0e9
or byte [ebp - 5], 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44b0f9
or byte [ebp - 5], 4
test byte [ebp - 1], 0x20
je 0x44b103
or byte [ebp - 5], 2
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x45307c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
test dl, dl
je 0x45308e
add esp, 0xfffffff0
call fcn.00403d34
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.0041beec
mov eax, dword [0x4781dc]
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
mov dword [eax], 0x4535ec
mov eax, dword [0x4781ec]
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
mov dword [eax], 0x45360c
mov eax, dword [ebp - 4]
call fcn.0045362c
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov dl, 1
mov eax, dword [0x4131f4]
call fcn.004039f8
mov edx, dword [ebp - 4]
mov dword [edx + 0x4c], eax
mov dl, 1
mov eax, dword [0x4131f4]
call fcn.004039f8
mov edx, dword [ebp - 4]
mov dword [edx + 0x50], eax
mov dl, 1
mov eax, dword [0x4131f4]
call fcn.004039f8
mov edx, dword [ebp - 4]
mov dword [edx + 0x54], eax
mov dl, 1
mov eax, dword [0x4131f4]
call fcn.004039f8
mov edx, dword [ebp - 4]
mov dword [edx + 0x58], eax
mov dl, 1
mov eax, dword [0x4131f4]
call fcn.004039f8
mov edx, dword [ebp - 4]
mov dword [edx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov dword [ebp - 0x10], eax
push 0x5a
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_GetDeviceCaps
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 0x10]
push eax
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
mov eax, 0x44ea3c
push eax
push 0
push 0
mov eax, dword [0x47837c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41fdcc]
call fcn.00421210
mov edx, dword [ebp - 4]
mov dword [edx + 0x84], eax
mov dl, 1
mov eax, dword [0x41fdcc]
call fcn.00421210
mov edx, dword [ebp - 4]
mov dword [edx + 0x88], eax
mov dl, 1
mov eax, dword [0x41fdcc]
call fcn.00421210
mov edx, dword [ebp - 4]
mov dword [edx + 0x80], eax
mov eax, dword [ebp - 4]
call fcn.00453b78
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x4539c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x4539c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x4539c4
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x453216
call fcn.00403d8c
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x45377c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd98
push ebx
xor edx, edx
mov dword [ebp - 0x268], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x453947
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x453925
mov dl, 1
mov eax, dword [0x413858]
call fcn.004039f8
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404760
lea eax, [ebp - 0x11c]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x45390e
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
call fcn.0043fb40
test al, al
je 0x453902
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
mov dword [ebp - 0x264], eax
mov byte [ebp - 0x260], 0
lea ecx, [ebp - 0x264]
mov edx, 0x453958
lea eax, [ebp - 0x25c]
call fcn.00409a34
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x453902
xor eax, eax
push ebp
push 0x4538fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x14], pe_nt_image_headers32
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x453990
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4538e4
lea eax, [ebp - 0x268]
lea edx, [ebp - 0x21c]
mov ecx, pe_nt_image_headers32
call fcn.004049e0
mov edx, dword [ebp - 0x268]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x11c]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4538e4
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x21c]
mov ecx, pe_nt_image_headers32
call fcn.004049e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453902
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x10]
dec dword [ebp - 0x1c]
jne 0x4537f1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov dl, 1
call fcn.00417f00
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45394e
lea eax, [ebp - 0x268]
call fcn.00404760
ret
Function at 0x454480
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x479ba8]
cmp byte [eax + 0xa5], 0
jne 0x4544f7
cmp dword [0x479bc0], 0
jne 0x4544b5
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x45443c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x479bc0], eax
cmp dword [0x479bbc], 0
jne 0x4544d0
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x479bbc], eax
cmp dword [0x479bc4], 0
jne 0x4544f7
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x4543dc
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x479bc4], eax
pop ecx
pop ebp
ret

Function at 0x4545c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.00454558
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4545e1
xor eax, eax
call fcn.00454590
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 9], 0
je 0x4545fb
mov al, 1
call fcn.00454590
mov esp, ebp
pop ebp
ret

Function at 0x454cc4
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [0x479ba8]
cmp dword [eax + 0x30], 0
je 0x454d8e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x94], 0
jne 0x454d85
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 5]
mov byte [ebp - 0x10], al
lea eax, [ebp - 0x14]
push eax
push 0x454c44
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
cmp dword [eax + 8], 0
je 0x454d85
push 3
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 0x14], eax
push 0xffffffffffffffec
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x454d3f
mov dword [ebp - 0x14], 0xfffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x454d85
mov dword [ebp - 0xc], eax
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
call fcn.0041582c
push eax
call sub.user32.dll_SetWindowPos
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x454d54
mov eax, dword [ebp - 4]
inc dword [eax + 0x94]
mov esp, ebp
pop ebp
ret

Function at 0x455aa4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa4], 0
je 0x455ae9
push pe_nt_image_headers32
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 8]
call fcn.00404850
jmp 0x455afa
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x8c]
call fcn.004047b4
mov esp, ebp
pop ebp
ret
Function at 0x456dbc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x84], 0
je 0x456e0f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.0043a170
test al, al
je 0x456e0f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.00439dac
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x456e0f
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.00439dac
push eax
call sub.user32.dll_ShowWindow
pop ecx
pop ebp
ret

Function at 0x45771c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45778d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4785c8]
cmp dword [eax + 4], 0x12
jne 0x457777
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
jne 0x457777
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.00403a28
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x34], edx
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0045399c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457794
lea eax, [ebp - 8]
call fcn.00404760
ret
Function at 0x45bba4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x45bc0f
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
call sub.kernel32.dll_GetACP
test eax, eax
jns 0x45bbdd
call fcn.00403960
push eax
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.004049e0
mov eax, dword [ebp - 0xc]
pop edx
call fcn.0045bb8c
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45bc16
lea eax, [ebp - 0xc]
call fcn.00404760
ret
Function at 0x45db2c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor ecx, ecx
push ebp
push 0x45dc74
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov byte [ebp - 0xd], 0
cmp byte [0x476e64], 0
jne 0x45db69
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45dcd0
xor esi, esi
xor edi, edi
mov eax, dword [ebp - 0xc]
sub eax, 1
jae 0x45db7a
call fcn.00403968
test eax, eax
jb 0x45dc66
inc eax
mov dword [ebp - 0x14], eax
xor edx, edx
add esi, 1
jae 0x45db92
call fcn.00403968
and esi, 0xff
cmp esi, 0xff
jbe 0x45dba5
call fcn.00403960
xor eax, eax
mov al, byte [esi + 0x479c1c]
add edi, eax
jae 0x45dbb6
call fcn.00403968
and edi, 0xff
cmp edi, 0xff
jbe 0x45dbc9
call fcn.00403960
mov cl, byte [edi + 0x479c1c]
cmp esi, 0xff
jbe 0x45dbdc
call fcn.00403960
mov byte [esi + 0x479c1c], cl
cmp eax, 0xff
jbe 0x45dbee
call fcn.00403960
cmp edi, 0xff
jbe 0x45dbfb
call fcn.00403960
mov byte [edi + 0x479c1c], al
cmp esi, 0xff
jbe 0x45dc0e
call fcn.00403960
xor ecx, ecx
mov cl, byte [esi + 0x479c1c]
add eax, ecx
jae 0x45dc1f
call fcn.00403968
and eax, 0xff
cmp edx, 0x7fff
jbe 0x45dc31
call fcn.00403960
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + edx]
cmp eax, 0xff
jbe 0x45dc43
call fcn.00403960
xor cl, byte [eax + 0x479c1c]
cmp edx, 0x7fff
jbe 0x45dc56
call fcn.00403960
mov eax, dword [ebp - 8]
mov byte [eax + edx], cl
inc edx
dec dword [ebp - 0x14]
jne 0x45db88
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45dcd0
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460914
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
xor edx, edx
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
ret

Function at 0x460af0
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x460b0f
add edx, 3
sar edx, 2
test edx, edx
jle 0x460c1c
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
xor ecx, ecx
mov cl, byte [edi + esi]
cmp ecx, 0x3d
jg 0x460b45
je 0x460b85
sub ecx, 0x2b
je 0x460b7b
sub ecx, 4
je 0x460b80
dec ecx
sub ecx, 0xa
jb 0x460b6e
jmp 0x460b88
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x460b57
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x460b61
jmp 0x460b88
mov cl, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x460b88
mov cl, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x460b88
mov cl, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x460b88
mov byte [eax], 0x3e
jmp 0x460b88
mov byte [eax], 0x3f
jmp 0x460b88
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x460b27
mov al, byte [esp + 4]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
mov dl, byte [esp + 6]
cmp dl, 0xff
je 0x460bd9
cmp byte [esp + 7], 0xff
jne 0x460bd9
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x460c11
cmp dl, 0xff
je 0x460c11
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x460b1e
add esp, 0x10
pop ebp
pop edi
pop esi
ret
Function at 0x4615f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov edi, edx
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
add eax, 0x3c
mov esi, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 8]
mov dword [edx], eax
cmp esi, eax
jbe 0x46165c
mov ecx, dword [ebp - 8]
push ecx
push edi
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x10]
add eax, 0x28
push eax
call fcn.00460cc0
add esp, 0xc
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add dword [edx + 0x38], ecx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
xor eax, eax
jmp 0x461767
cmp ebx, edi
jne 0x46166a
mov eax, 0x1001
jmp 0x461767
mov edx, esi
sub edx, dword [ebp - 0x10]
push edx
push edi
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x10]
add ecx, 0x28
push ecx
call fcn.00460cc0
mov eax, esi
mov edx, esi
sub eax, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
sub dword [ebp - 8], edx
add edi, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ecx + 0x18]
xor eax, dword [edx + 0x28]
mov dword [ebx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x1c]
xor eax, dword [edx + 0x2c]
mov dword [ebx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x20]
xor eax, dword [edx + 0x30]
mov dword [ebx + 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x24]
xor eax, dword [edx + 0x34]
mov edx, ebx
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00463148
add ebx, esi
cmp esi, dword [ebp - 8]
ja 0x461719
mov eax, ebx
sub eax, esi
mov edx, dword [eax]
xor edx, dword [edi]
mov dword [ebx], edx
mov ecx, dword [eax + 4]
xor ecx, dword [edi + 4]
mov dword [ebx + 4], ecx
mov edx, dword [eax + 8]
xor edx, dword [edi + 8]
mov dword [ebx + 8], edx
mov eax, dword [eax + 0xc]
xor eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00463148
add edi, esi
add ebx, esi
sub dword [ebp - 8], esi
cmp esi, dword [ebp - 8]
jbe 0x4616de
mov eax, ebx
mov ecx, dword [ebp - 4]
sub eax, esi
mov edx, dword [eax]
mov dword [ecx + 0x18], edx
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 4]
mov dword [ecx + 0x1c], edx
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 8]
mov dword [ecx + 0x20], edx
mov edx, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [edx + 0x24], eax
mov eax, dword [ebp - 8]
push eax
push edi
mov ecx, dword [ebp - 4]
add ecx, 0x28
push ecx
call fcn.00460cc0
add esp, 0xc
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x38], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
sub dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x461770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebx + 0x3c]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x10
mov edi, edx
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [edx], eax
cmp eax, dword [ebp - 0xc]
jae 0x4617d0
mov ecx, dword [ebp - 4]
push ecx
push edi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.00460cc0
add esp, 0xc
mov edx, dword [ebp - 4]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x4618ad
cmp esi, edi
jne 0x4617de
mov eax, 0x1001
jmp 0x4618ad
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
push edx
push edi
mov ecx, dword [ebp - 0x10]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.00460cc0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
add edi, eax
add esp, 0xc
sub dword [ebp - 4], edx
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00463148
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [esi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [esi + 0xc], ecx
add esi, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jb 0x461883
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00463148
mov edx, dword [edi]
xor edx, dword [ebx + 0x18]
mov dword [esi], edx
mov ecx, dword [edi + 4]
xor ecx, dword [ebx + 0x1c]
mov dword [esi + 4], ecx
mov eax, dword [edi + 8]
xor eax, dword [ebx + 0x20]
mov dword [esi + 8], eax
mov edx, dword [edi + 0xc]
xor edx, dword [ebx + 0x24]
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub dword [ebp - 4], edx
add edi, eax
mov ecx, dword [ebp - 4]
add esi, eax
cmp ecx, dword [ebp - 0xc]
jae 0x461841
mov eax, dword [ebp - 4]
lea edx, [ebx + 0x28]
push eax
push edi
push edx
call fcn.00460cc0
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp - 4]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4618b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebx + 0x3c]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x10
mov edi, edx
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [edx], eax
cmp eax, dword [ebp - 0xc]
jae 0x461918
mov ecx, dword [ebp - 4]
push ecx
push edi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.00460cc0
add esp, 0xc
mov edx, dword [ebp - 4]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x461a0d
cmp esi, edi
jne 0x461926
mov eax, 0x1001
jmp 0x461a0d
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
push edx
push edi
mov ecx, dword [ebp - 0x10]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.00460cc0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
add edi, eax
add esp, 0xc
sub dword [ebp - 4], edx
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00463148
mov ecx, dword [ebx + 0x28]
xor dword [ebx + 0x18], ecx
mov eax, dword [ebx + 0x2c]
xor dword [ebx + 0x1c], eax
mov edx, dword [ebx + 0x30]
xor dword [ebx + 0x20], edx
mov ecx, dword [ebx + 0x34]
xor dword [ebx + 0x24], ecx
mov eax, dword [ebx + 0x18]
mov dword [esi], eax
mov edx, dword [ebx + 0x1c]
mov dword [esi + 4], edx
mov ecx, dword [ebx + 0x20]
mov dword [esi + 8], ecx
mov eax, dword [ebx + 0x24]
mov dword [esi + 0xc], eax
add esi, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jb 0x4619e3
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00463148
mov ecx, dword [edi]
xor dword [ebx + 0x18], ecx
mov eax, dword [edi + 4]
xor dword [ebx + 0x1c], eax
mov edx, dword [edi + 8]
xor dword [ebx + 0x20], edx
mov ecx, dword [edi + 0xc]
xor dword [ebx + 0x24], ecx
mov eax, dword [ebx + 0x18]
mov dword [esi], eax
mov edx, dword [ebx + 0x1c]
mov dword [esi + 4], edx
mov ecx, dword [ebx + 0x20]
mov dword [esi + 8], ecx
mov eax, dword [ebx + 0x24]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub dword [ebp - 4], edx
add edi, eax
mov ecx, dword [ebp - 4]
add esi, eax
cmp ecx, dword [ebp - 0xc]
jae 0x461995
mov eax, dword [ebp - 4]
lea edx, [ebx + 0x28]
push eax
push edi
push edx
call fcn.00460cc0
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp - 4]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x461b68
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ecx, dword [esp + 4]
mov esi, dword [ebx + 0x38]
mov edx, 0x10
lea eax, [ebx + 0x3c]
mov dword [ecx], edx
lea edx, [ebx + 0x18]
call fcn.00463148
xor ecx, ecx
mov eax, dword [esp]
mov edx, eax
lea eax, [ebx + 0x28]
cmp esi, ecx
jbe 0x461bab
mov bl, byte [eax]
inc ecx
xor bl, byte [eax - 0x10]
inc eax
mov byte [edx], bl
inc edx
cmp esi, ecx
ja 0x461b9d
mov eax, dword [esp + 4]
mov dword [eax], esi
xor eax, eax
pop ecx
pop edx
pop esi
pop ebx
ret