joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479c48
Capabilities:
Enumerate disk volumes

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff80
mov edi, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_FindFirstVolumeA
mov esi, eax
cmp esi, 0xffffffff
je 0x479cca
mov eax, dword [edi + 0x30]
call fcn.0041a9d0
mov edx, dword [0x479930]
call fcn.004039c0
mov ebx, eax
lea eax, [ebx + 0xc]
mov edx, esp
mov ecx, 0x80
call fcn.00404820
jmp 0x479cb0
mov eax, dword [edi + 0x30]
call fcn.0041a9d0
mov edx, dword [0x479930]
call fcn.004039c0
mov ebx, eax
lea eax, [ebx + 0xc]
mov edx, esp
mov ecx, 0x80
call fcn.00404820
push 0x104
lea eax, [esp + 4]
push eax
push esi
call sub.kernel32.dll_FindNextVolumeA
test eax, eax
jne 0x479c8c
push esi
call sub.kernel32.dll_FindVolumeClose
add esp, 0x80
pop edi
pop esi
pop ebx
ret

Function at 0x479e9c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x479f89
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x44]
lea eax, [ebp - 4]
mov edx, 0x479fa0
call fcn.00404638
mov ebx, 2
lea eax, [ebp - 4]
call fcn.00404ae4
mov edx, ebx
add dl, 0x41
mov byte [eax], dl
mov eax, dword [ebp - 4]
call fcn.00404a8c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x479f59
push 0xff
lea eax, [ebp - 0x107]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a8c
push eax
call sub.kernel32.dll_QueryDosDeviceA
test eax, eax
jbe 0x479f59
push dword [ebp - 4]
push 0x479fac
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x107]
mov ecx, 0xff
call fcn.00404820
push dword [ebp - 0x10c]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040494c
mov edx, dword [ebp - 8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
cmp ebx, 0x1a
jne 0x479ede
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479f90
lea eax, [ebp - 0x10c]
call fcn.004045a0
lea eax, [ebp - 8]
mov edx, 2
call fcn.004045c4
ret

Function at 0x47a064
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a7c
xor eax, eax
push ebp
push 0x47a0fa
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 4]
call fcn.0040d58c
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 4]
call fcn.00404638
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x40
call fcn.004030ac
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x40
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebp - 4]
call fcn.00404a8c
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x4c]
call fcn.00409948
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a101
lea eax, [ebp - 0x50]
call fcn.004045a0
lea eax, [ebp - 4]
call fcn.004045a0
ret
Function at 0x47a108
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov dword [ebp - 0x208], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x47a2a3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x204]
xor ecx, ecx
mov edx, 0x200
call fcn.004030ac
lea eax, [ebx + 0x64]
xor ecx, ecx
mov edx, 0x1ea
call fcn.004030ac
push 0
push 0
push 0x7200
push edi
call sub.kernel32.dll_SetFilePointer_1
lea esi, [ebp - 0x204]
push 0
lea eax, [ebp - 4]
push eax
push 0x200
lea eax, [ebp - 0x204]
push eax
push edi
call sub.kernel32.dll_ReadFile_1
xor eax, eax
push ebp
push 0x47a27b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi + 4], 0
je 0x47a242
cmp dword [esi + 8], 0
je 0x47a242
mov eax, dword [esi]
mov dword [ebx + 0x5c], eax
mov eax, dword [esi + 4]
mov dword [ebx + 0x38], eax
mov eax, dword [esi + 8]
mov dword [ebx + 0x3c], eax
lea edx, [ebp - 0x208]
lea eax, [esi + 0xc]
call fcn.00409948
mov edx, dword [ebp - 0x208]
lea eax, [ebx + 0x40]
call fcn.004045f4
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x48], eax
lea edx, [ebp - 0x20c]
lea eax, [esi + 0x30]
call fcn.00409948
mov edx, dword [ebp - 0x20c]
lea eax, [ebx + 0x50]
call fcn.004045f4
lea edx, [ebp - 0x210]
lea eax, [esi + 0x34]
call fcn.00409948
mov edx, dword [ebp - 0x210]
lea eax, [ebx + 0x4c]
call fcn.004045f4
mov eax, dword [esi + 0x134]
mov dword [ebx + 0x54], eax
lea eax, [ebx + 0x60]
lea edx, [esi + 0x144]
mov ecx, 0x20
call fcn.00404820
lea edx, [ebx + 0x64]
mov eax, esi
mov ecx, 0x1ea
call fcn.004029a4
jmp 0x47a271
xor eax, eax
mov dword [ebx + 0x38], eax
xor eax, eax
mov dword [ebx + 0x3c], eax
lea eax, [ebx + 0x40]
call fcn.004045a0
xor eax, eax
mov dword [ebx + 0x48], eax
lea eax, [ebx + 0x50]
call fcn.004045a0
lea eax, [ebx + 0x4c]
call fcn.004045a0
lea eax, [ebx + 0x60]
call fcn.004045a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47a285
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a2aa
lea eax, [ebp - 0x210]
mov edx, 3
call fcn.004045c4
ret
Function at 0x47a460
Capabilities:
Enumerate disk volumes
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd9c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 0x258], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47a5ed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004045a0
push 0xff
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00404a8c
push eax
call sub.kernel32.dll_QueryDosDeviceA
test eax, eax
jbe 0x47a5c2
push 0x104
lea eax, [ebp - 0x214]
push eax
call sub.kernel32.dll_FindFirstVolumeA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x47a5c2
lea edx, [ebp - 8]
lea eax, [ebp - 0x214]
call fcn.00409948
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
call fcn.0040488c
mov ecx, eax
sub ecx, 5
mov edx, 5
mov eax, dword [ebp - 8]
call fcn.00404aec
push 0x40
lea eax, [ebp - 0x254]
push eax
mov eax, dword [ebp - 8]
call fcn.00404a8c
push eax
call sub.kernel32.dll_QueryDosDeviceA
lea edx, [ebp - 4]
lea eax, [ebp - 0x110]
call fcn.00409948
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x254]
call fcn.00409948
lea eax, [ebp - 0x258]
lea edx, [ebp - 0x254]
mov ecx, 0x40
call fcn.00404820
mov eax, dword [ebp - 0x258]
mov edx, dword [ebp - 4]
call fcn.0040891c
test eax, eax
jne 0x47a5a2
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.0040d5cc
lea eax, [ebp - 0x25c]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x264], eax
mov byte [ebp - 0x260], 0xb
lea edx, [ebp - 0x264]
xor ecx, ecx
mov eax, 0x47a604
call fcn.00409e38
mov edx, dword [ebp - 0x25c]
mov eax, ebx
call fcn.004045f4
jmp 0x47a5bc
push 0x104
lea eax, [ebp - 0x214]
push eax
push esi
call sub.kernel32.dll_FindNextVolumeA_1
test eax, eax
jne 0x47a4da
push esi
call sub.kernel32.dll_FindVolumeClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a5f4
lea eax, [ebp - 0x25c]
mov edx, 2
call fcn.004045c4
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004045c4
ret
Function at 0x47b89c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov ebx, 0x49e138
test edx, edx
jne 0x47b8ac
xor eax, eax
pop esi
pop ebx
ret
xor eax, 0xffffffff
cmp ecx, 8
jb 0x47b974
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
sub ecx, 8
cmp ecx, 8
jae 0x47b8b8
test ecx, ecx
je 0x47b993
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
mov esi, dword [ebx + esi*4]
shr eax, 8
xor esi, eax
mov eax, esi
inc edx
dec ecx
test ecx, ecx
jne 0x47b978
xor eax, 0xffffffff
pop esi
pop ebx
ret

Function at 0x47c26c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.004030ac
ret

Function at 0x47d548
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47d5bb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0xff]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
lea eax, [ebp - 0xff]
call fcn.00409948
lea edx, [ebp - 0x104]
mov eax, dword [ebx]
call fcn.0047b21c
mov edx, dword [ebp - 0x104]
mov eax, ebx
call fcn.004045f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d5c2
lea eax, [ebp - 0x104]
call fcn.004045a0
ret

Function at 0x47d5c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47d63b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0xff]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
lea eax, [ebp - 0xff]
call fcn.00409948
lea edx, [ebp - 0x104]
mov eax, dword [ebx]
call fcn.0047b21c
mov edx, dword [ebp - 0x104]
mov eax, ebx
call fcn.004045f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d642
lea eax, [ebp - 0x104]
call fcn.004045a0
ret
Function at 0x47d9d4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x47da42
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, esi
call fcn.0040488c
cmp eax, 2
jl 0x47da2c
cmp byte [esi + 1], 0x3a
jne 0x47da2c
lea eax, [ebp - 4]
mov edx, 0x47da58
call fcn.00404638
lea eax, [ebp - 4]
call fcn.00404ae4
mov dl, byte [esi]
mov byte [eax], dl
mov eax, dword [ebp - 4]
call fcn.00404a8c
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47da49
lea eax, [ebp - 4]
call fcn.004045a0
ret

Function at 0x480d98
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.004030ac
ret

Function at 0x48128c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 0x1008], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x481346
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1004]
xor ecx, ecx
mov edx, 0x1000
call fcn.004030ac
mov dword [ebp - 4], 0x1000
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1004]
push eax
call sub.kernel32.dll_GetComputerNameA
lea eax, [ebx + 4]
lea edx, [ebp - 0x1004]
mov ecx, 0x1000
call fcn.00404820
mov dword [ebx + 8], 1
lea eax, [ebx + 0x24]
mov edx, 0x48135c
call fcn.004045f4
lea eax, [ebx + 0x28]
mov edx, 0x48136c
call fcn.004045f4
lea edx, [ebp - 0x1008]
mov eax, dword [0x49e61c]
call fcn.004814ec
mov edx, dword [ebp - 0x1008]
lea eax, [ebx + 0x10]
call fcn.004045f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48134d
lea eax, [ebp - 0x1008]
call fcn.004045a0
ret

Function at 0x481404
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, edx
xor eax, eax
push ebp
push 0x481457
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406464
mov eax, dword [ebp - 4]
call fcn.00404e88
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x48143b
test al, 0x10
jne 0x48143f
xor ebx, ebx
jmp 0x481441
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48145e
lea eax, [ebp - 4]
call fcn.00404d00
ret

Function at 0x481640
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, edx
xor eax, eax
push ebp
push 0x481693
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406464
mov eax, dword [ebp - 4]
call fcn.00404e88
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x481677
test al, 0x10
je 0x48167b
xor ebx, ebx
jmp 0x48167d
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48169a
lea eax, [ebp - 4]
call fcn.00404d00
ret
Function at 0x4846a4
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push esp
push 0x202
call sub.wsock32.dll_WSAStartup
test eax, eax
add esp, 0x190
ret

Function at 0x484978
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov esi, ecx
test ebx, ebx
jle 0x4849af
mov eax, dword [ebp + 8]
push eax
push ebx
push esi
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_recv
test eax, eax
jg 0x4849a5
or edi, 0xffffffff
jmp 0x4849af
add esi, eax
sub ebx, eax
add edi, eax
test ebx, ebx
jg 0x48498d
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4849bc
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov esi, ecx
test ebx, ebx
jle 0x4849f3
mov eax, dword [ebp + 8]
push eax
push ebx
push esi
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_send
test eax, eax
jg 0x4849e9
or edi, 0xffffffff
jmp 0x4849f3
add esi, eax
sub ebx, eax
add edi, eax
test ebx, ebx
jg 0x4849d1
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x484a00
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 8], eax
test edi, edi
jle 0x484ab9
xor eax, eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.ws2_32.dll_WSASend
inc eax
jne 0x484a47
mov dword [ebp - 8], 0xffffffff
jmp 0x484ab9
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, edi
cdq
cmp edx, dword [esp + 4]
jne 0x484a5f
cmp eax, dword [esp]
seta al
jmp 0x484a62
setg al
add esp, 8
sub edi, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
add dword [ebp - 8], edx
test al, al
je 0x484ab1
jmp 0x484a7d
mov eax, dword [ebx]
sub dword [ebp - 0xc], eax
dec esi
add ebx, 8
cmp dword [ebp - 0xc], 0
jbe 0x484aa0
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [ebx]
cdq
cmp edx, dword [esp + 4]
jne 0x484a9c
cmp eax, dword [esp]
pop edx
pop eax
jbe 0x484a74
jmp 0x484aa0
pop edx
pop eax
jle 0x484a74
cmp dword [ebp - 0xc], 0
jbe 0x484ab1
mov eax, dword [ebp - 0xc]
add dword [ebx + 4], eax
mov eax, dword [ebp - 0xc]
sub dword [ebx], eax
test edi, edi
jg 0x484a21
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x489de0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x49f1d4]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x49f1d4]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x49f1d4]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x49f1d4]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x49ed58]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x489e0b
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x489ed8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x49f1d4]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x49f1d4]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x49f1d4]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x49f1d4]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x49ed58]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x489f13
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x489ff4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x49f1d4]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x49f1d4]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x49f1d4]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x49f1d4]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x49ed58]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
xor ecx, ecx
mov cl, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + 0x49f1d4]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x49f1d4]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x49f1d4]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x49f1d4]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x48a03f
add esp, 0xc
pop edi
pop esi
pop ebx
ret