joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e85e
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebx + 8], 0
je 0x45e89a
mov eax, dword [ecx]
movd xmm0, eax
pshufd xmm0, xmm0, 0
aeskeygenassist xmm0, xmm0, 0
movaps xmmword [ebp - 0x10], xmm0
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
jmp 0x45e8d0
movzx eax, byte [ecx]
mov al, byte [eax*4 + 0x40ac01]
mov byte [edx], al
movzx eax, byte [ecx + 1]
mov al, byte [eax*4 + 0x40ac01]
mov byte [edx + 1], al
movzx eax, byte [ecx + 2]
mov al, byte [eax*4 + 0x40ac01]
mov byte [edx + 2], al
movzx eax, byte [ecx + 3]
mov al, byte [eax*4 + 0x40ac01]
mov byte [edx + 3], al
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4

Function at 0x45e8da
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
test byte [0x4914dc], 6
push esi
mov esi, edx
mov edx, dword [ebp + 8]
push edi
jne 0x45e937
movups xmm2, xmmword [esi]
mov edi, dword [ecx + 0x1d0]
lea eax, [ecx + 0x10]
movups xmm0, xmmword [ecx]
movups xmm1, xmmword [eax]
add eax, 0x10
pxor xmm2, xmm0
aesenc xmm2, xmm1
jmp 0x45e926
movups xmm1, xmmword [eax]
movups xmm0, xmmword [eax + 0x10]
aesenc xmm2, xmm1
add eax, 0x20
aesenc xmm2, xmm0
cmp eax, edi
jb 0x45e912
movups xmm0, xmmword [eax]
aesenclast xmm2, xmm0
movups xmmword [edx], xmm2
jmp 0x45e93f
push edx
mov edx, esi
call fcn.00489dd0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x45e948
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
test byte [0x4914dc], 6
push esi
mov esi, edx
mov edx, dword [ebp + 8]
jne 0x45e99d
mov eax, dword [ecx + 0x1d0]
movups xmm2, xmmword [esi]
mov ecx, dword [ecx + 0x1d4]
movups xmm1, xmmword [eax]
pxor xmm2, xmm1
jmp 0x45e980
movups xmm1, xmmword [eax]
aesdec xmm2, xmm1
movups xmm0, xmmword [eax + 0x10]
add eax, 0x20
aesdec xmm2, xmm0
cmp eax, ecx
jb 0x45e978
movups xmm0, xmmword [eax]
aesdeclast xmm2, xmm0
movups xmmword [edx], xmm2
jmp 0x45e9a5
push edx
mov edx, esi
call fcn.0048a010
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x45f110
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebx + 0x10]
push esi
mov esi, edx
mov dword [ebp - 8], esi
push edi
movups xmm3, xmmword [esi]
cmp eax, 0x10
jb 0x45f19f
mov edi, dword [ebx + 8]
mov esi, ecx
mov edx, dword [ebx + 0xc]
sub edi, edx
shr eax, 4
mov ecx, dword [esi + 0x1d0]
movups xmm1, xmmword [edi + edx]
mov dword [ebp - 4], ecx
lea ecx, [esi + 0x10]
movups xmm0, xmmword [esi]
movups xmm2, xmmword [ecx]
add ecx, 0x10
pxor xmm3, xmm1
pxor xmm3, xmm0
aesenc xmm3, xmm2
jmp 0x45f184
movups xmm1, xmmword [ecx]
movups xmm0, xmmword [ecx + 0x10]
aesenc xmm3, xmm1
add ecx, 0x20
aesenc xmm3, xmm0
cmp ecx, dword [ebp - 4]
jb 0x45f170
movups xmm0, xmmword [ecx]
aesenclast xmm3, xmm0
movups xmmword [edx], xmm3
add edx, 0x10
sub eax, 1
jne 0x45f148
mov esi, dword [ebp - 8]
pop edi
movups xmmword [esi], xmm3
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc
Function at 0x477aa1
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [0x4bbb2c]
push ebx
push esi
mov esi, ecx
push edi
test eax, eax
jne 0x477acb
push eax
push 0xf4240
push dword [0x4c1324]
push dword [0x4c1320]
call sym.BootLib.dll__alldiv
mov dword [0x4bbb2c], eax
mul esi
mov ecx, eax
mov esi, edx
rdtsc
mov edi, eax
mov ebx, edx
rdtsc
sub eax, edi
sbb edx, ebx
cmp edx, esi
jb 0x477ad7
ja 0x477ae7
cmp eax, ecx
jb 0x477ad7
pop edi
pop esi
pop ebx
ret

Function at 0x478ac3
Capabilities:
Reference processor manufacturer constants

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push ebx
push esi
push edi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00488e18
cmp al, 1
jne 0x478b5c
mov eax, 0x40000080
lea edi, [ebp - 0x10]
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
nop
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp dword [ebp - 0xc], 0x7263694d
jne 0x478b5c
cmp dword [ebp - 8], 0x666f736f
jne 0x478b5c
cmp dword [ebp - 4], 0x53562074
jne 0x478b5c
mov eax, 0x40000081
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
nop
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp dword [ebp - 0x10], 0x31235356
jne 0x478b5c
mov eax, 0x40000082
xor ecx, ecx
push ebx
cpuid
mov esi, ebx
pop ebx
nop
mov dword [edi], eax
mov dword [edi + 4], esi
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
test byte [ebp - 0x10], 2
je 0x478b5c
mov al, 1
jmp 0x478b5e
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x47bad8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
clc
div ecx
test edx, edx
je 0x47bae6
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0047b7f8
and eax, 0x8d2c1ff9
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x47bb88
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.0047b808
push eax
push esi
push dword [ebp + 8]
call fcn.0047b7bd
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0047b808
push eax
push esi
push dword [ebp + 8]
call fcn.0047b7bd
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f

Function at 0x47bc35
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0047b808
push eax
push esi
push dword [ebp + 8]
call fcn.0047b7bd
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0047b7f8
pop edi
dec ecx
aad 0xb5
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
invalid
inc ebp
Function at 0x485f06
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
or ecx, 0xffffffff
cmp dword [ebp + 8], esi
jbe 0x485f2f
movzx eax, byte [esi + edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x407f80]
inc esi
cmp esi, dword [ebp + 8]
jb 0x485f16
not ecx
mov eax, ecx
pop esi
pop ebp
ret 4

Function at 0x48619c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x10], edx
xor ecx, ecx
xor edx, edx
push edi
mov dword [eax], ecx
lea eax, [ebp - 0xc]
push eax
push 0x20
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], ecx
pop ecx
call fcn.00482d22
mov edi, dword [ebp - 0xc]
mov esi, eax
test esi, esi
js 0x486274
xor edx, edx
mov ecx, ebx
inc edx
call fcn.0047ffbe
mov esi, eax
test esi, esi
js 0x486274
lea eax, [ebp - 4]
mov ecx, ebx
push eax
lea edx, [ebp - 8]
call fcn.0047ff16
mov esi, eax
push 0x20
pop ebx
test esi, esi
js 0x486277
cmp word [ebp - 4], bx
je 0x48620f
mov esi, 0xc000000d
jmp 0x486277
push ebx
push dword [ebp - 8]
push edi
call sym.BootLib.dll_memmove
mov ebx, dword [ebp - 0x10]
add esp, 0xc
xor edx, edx
mov ecx, ebx
inc edx
call fcn.0047ffbe
mov esi, eax
test esi, esi
js 0x486274
lea eax, [ebp - 4]
mov ecx, ebx
push eax
lea edx, [ebp - 8]
call fcn.0047ff16
mov esi, eax
push 0x20
pop ebx
test esi, esi
js 0x486277
cmp word [ebp - 4], bx
jne 0x486208
mov edx, dword [ebp - 8]
mov ecx, edi
sub edx, edi
mov esi, ebx
mov al, byte [edx + ecx]
xor byte [ecx], al
inc ecx
sub esi, 1
jne 0x486255
push dword [ebp + 8]
mov edx, edi
mov ecx, 0x2000
push ebx
call fcn.00482efe
mov esi, eax
jmp 0x486277
push 0x20
pop ebx
test edi, edi
je 0x486286
push 0
mov edx, ebx
mov ecx, edi
call fcn.00482d62
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x4862d4
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov bl, byte [ebp + 0x20]
mov al, 0xe
sub al, byte [ebp + 8]
sub bl, 2
and bl, 0xfe
push esi
mov esi, dword [ebp + 0x10]
shl bl, 2
push edi
or bl, al
mov edi, ecx
mov dword [ebp - 8], edi
mov byte [ebp - 0x18], bl
test esi, esi
je 0x486307
or bl, 0x40
mov byte [ebp - 0x18], bl
push dword [ebp + 8]
lea eax, [ebp - 0x17]
push edx
push eax
call sym.BootLib.dll_memcpy
mov ebx, dword [ebp + 0x18]
add esp, 0xc
mov ecx, ebx
push 0xf
pop eax
cmp dword [ebp + 8], eax
jae 0x486331
mov byte [ebp + eax - 0x18], cl
shr ecx, 8
dec eax
cmp eax, dword [ebp + 8]
ja 0x486324
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
mov edx, eax
call fcn.0045e8da
push 0x10
pop edi
test esi, esi
je 0x4863b3
xor ecx, ecx
push 2
pop eax
cmp esi, 0xff00
jb 0x48635e
not byte [ebp - 0x18]
mov ecx, eax
xor byte [ebp - 0x17], 0xfe
push 4
pop eax
lea edi, [ebp - 0x18]
mov ebx, esi
lea edx, [eax - 1]
add edi, ecx
xor byte [edi + edx], bl
shr ebx, 8
sub edx, 1
jns 0x486368
mov ebx, dword [ebp + 0x18]
add ecx, eax
mov edx, dword [ebp + 0xc]
push 0x10
pop edi
cmp ecx, edi
jne 0x486395
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x18]
push eax
mov edx, eax
call fcn.0045e8da
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov al, byte [edx]
xor byte [ebp + ecx - 0x18], al
inc ecx
inc edx
mov dword [ebp + 0xc], edx
sub esi, 1
jne 0x48637e
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x18]
push eax
mov edx, eax
call fcn.0045e8da
mov esi, dword [ebp + 0x14]
cmp ebx, edi
jb 0x4863f1
mov eax, ebx
shr eax, 4
mov dword [ebp + 8], eax
mov eax, dword [esi]
xor dword [ebp - 0x18], eax
mov eax, dword [esi + 4]
xor dword [ebp - 0x14], eax
mov eax, dword [esi + 8]
xor dword [ebp - 0x10], eax
mov eax, dword [esi + 0xc]
xor dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, eax
push eax
call fcn.0045e8da
add esi, edi
sub ebx, edi
sub dword [ebp + 8], 1
jne 0x4863c2
test ebx, ebx
je 0x486419
lea eax, [ebp - 0x18]
xor edx, edx
sub esi, eax
lea ecx, [ebp - 0x18]
add ecx, edx
mov al, byte [esi + ecx]
xor byte [ecx], al
inc edx
cmp edx, ebx
jb 0x4863fc
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x18]
push eax
mov edx, eax
call fcn.0045e8da
push dword [ebp + 0x20]
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x1c]
call sym.BootLib.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x18]
mov byte [eax], 0
inc eax
sub edi, 1
jne 0x48642e
pop edi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x48643e
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf
pop ebx
sub ebx, esi
mov edi, ecx
push esi
push edx
mov dword [ebp - 8], edi
lea eax, [ebx - 1]
mov byte [ebp - 0x18], al
lea eax, [ebp - 0x17]
push eax
call sym.BootLib.dll_memcpy
lea eax, [ebp - 0x17]
add esp, 0xc
add eax, esi
test ebx, ebx
je 0x48647c
mov byte [eax], 0
inc eax
sub ebx, 1
jne 0x486473
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
lea edx, [ebp - 0x18]
call fcn.0045e8da
mov edx, dword [ebp + 0x18]
test edx, edx
je 0x4864a4
mov ecx, dword [ebp + 0x14]
lea esi, [ebp - 0x28]
sub esi, ecx
mov al, byte [esi + ecx]
xor byte [ecx], al
inc ecx
sub edx, 1
jne 0x486499
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
push 0x10
pop ebx
mov byte [ebp - 9], 1
cmp edi, ebx
jb 0x4864fc
mov eax, edi
shr eax, 4
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x18]
call fcn.0045e8da
mov eax, dword [ebp - 0x28]
xor dword [esi], eax
mov eax, dword [ebp - 0x24]
xor dword [esi + 4], eax
mov eax, dword [ebp - 0x20]
xor dword [esi + 8], eax
mov eax, dword [ebp - 0x1c]
xor dword [esi + 0xc], eax
add byte [ebp - 9], 1
jne 0x4864f2
lea ecx, [ebp - 9]
dec ecx
add byte [ecx], 1
je 0x4864ec
add esi, ebx
sub edi, ebx
sub dword [ebp + 8], 1
jne 0x4864bd
test edi, edi
je 0x48651f
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x18]
call fcn.0045e8da
lea ecx, [ebp - 0x28]
sub ecx, esi
mov al, byte [ecx + esi]
xor byte [esi], al
inc esi
sub edi, 1
jne 0x486514
mov ecx, ebx
lea eax, [ebp - 0x28]
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x486524
lea eax, [ebp - 0x18]
mov byte [eax], 0
inc eax
sub ebx, 1
jne 0x486530
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x486730
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, ecx
mov dword [ebp - 0x1c], 5
push esi
push edi
mov edi, edx
mov dword [ebp - 0x28], ebx
lea ecx, [ebx + 0x40]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x24], ecx
mov eax, dword [ebx + edi*4 - 0x18]
mov esi, dword [ebx + edi*4 - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebx + edi*4 - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + edi*4 - 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebx + edi*4]
mov dword [ebp - 0x2c], eax
mov edx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp edx, ecx
jb 0x48680f
mov edi, dword [edx - 0x1c]
lea ebx, [edx - 0x20]
xor esi, eax
mov ecx, dword [edx - 0x24]
sub dword [edx - 4], esi
mov eax, edi
mov esi, dword [ebx]
rol eax, 0xd
xor eax, dword [ebp - 0xc]
sub dword [edx - 8], eax
mov eax, esi
xor eax, dword [ebp - 0x14]
sub dword [edx - 0xc], eax
mov eax, ecx
rol eax, 9
xor eax, dword [ebp - 8]
sub dword [edx - 0x10], eax
mov eax, edi
mov edx, dword [edx - 0x28]
xor eax, edx
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 4]
sub dword [ebx - 0x14], eax
mov eax, ebx
mov eax, dword [eax - 0x2c]
mov dword [ebp - 0x18], eax
rol eax, 0xd
xor eax, esi
sub dword [ebx - 0x18], eax
mov eax, ebx
mov eax, dword [eax - 0x30]
mov dword [ebp - 0xc], eax
xor eax, ecx
sub edi, eax
mov eax, ebx
mov ebx, dword [ebp - 0x20]
mov dword [eax - 0x1c], edi
mov eax, dword [eax - 0x34]
mov dword [ebp - 0x14], eax
rol eax, 9
xor eax, edx
mov edx, dword [ebp - 4]
sub esi, eax
mov dword [ebx], esi
mov esi, dword [ebp - 0x18]
mov eax, dword [edx - 0x38]
mov edx, ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp edx, dword [ebp - 0x24]
jae 0x486781
mov ebx, dword [ebp - 0x28]
mov edi, dword [edx - 0x1c]
xor esi, eax
sub dword [edx - 4], esi
mov eax, edi
mov esi, dword [edx - 0x20]
mov ecx, dword [ebp - 0x2c]
rol eax, 0xd
xor eax, dword [ebp - 0xc]
sub dword [edx - 8], eax
mov eax, esi
xor eax, dword [ebp - 0x14]
sub dword [edx - 0xc], eax
mov ecx, dword [ecx - 4]
mov eax, ecx
rol eax, 9
xor eax, dword [ebp - 8]
sub dword [edx - 0x10], eax
mov eax, edi
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 4]
mov edx, dword [ebx + edx*4 - 8]
xor eax, edx
sub dword [ecx - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebx + eax*4 - 0xc]
mov dword [ebp - 0x18], eax
rol eax, 0xd
xor eax, esi
sub dword [ecx - 0x18], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebx + eax*4 - 0x10]
mov dword [ebp - 0xc], eax
xor eax, dword [ebp - 0x20]
sub edi, eax
mov dword [ecx - 0x1c], edi
mov edi, dword [ebp - 0x10]
mov eax, dword [ebx + edi*4 - 0x14]
mov dword [ebp - 0x14], eax
rol eax, 9
xor eax, edx
sub esi, eax
sub dword [ebp - 0x1c], 1
mov dword [ecx - 0x20], esi
lea ecx, [ebx + 0x40]
mov eax, dword [ebx + edi*4 - 0x18]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 8], eax
lea eax, [ebx + edi*4]
jne 0x486771
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4868aa
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push edi
push 5
pop ebx
mov eax, dword [esi + edx*4 - 0x14]
mov ecx, dword [esi + edx*4 - 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + edx*4 - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + edx*4 - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + edx*4 - 4]
mov dword [ebp - 8], eax
lea eax, [edx*4 - 0x40]
lea edx, [eax + esi]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], ebx
cmp esi, edx
ja 0x4869e7
mov ebx, dword [ebp - 0x14]
lea edi, [esi + 8]
mov esi, dword [ebp - 0x18]
mov edx, eax
shr edx, 6
inc edx
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
xor eax, esi
rol edx, 9
add eax, dword [edi - 4]
xor edx, ebx
add edx, dword [edi - 8]
mov esi, ecx
mov ecx, ebx
rol esi, 0xd
mov ebx, dword [ebp - 8]
xor esi, edx
add esi, dword [edi]
xor ecx, eax
add ecx, dword [edi + 4]
rol ebx, 9
xor ebx, esi
mov dword [ebp - 4], ecx
add ebx, dword [edi + 8]
mov dword [edi - 8], edx
mov dword [edi + 4], ecx
xor ecx, edx
add ecx, dword [edi + 0xc]
mov edx, dword [ebp - 4]
mov dword [edi - 4], eax
rol eax, 0xd
xor eax, ebx
rol edx, 9
add eax, dword [edi + 0x10]
xor edx, eax
mov dword [edi], esi
add edx, dword [edi + 0x18]
lea edi, [edi + 0x40]
xor esi, ecx
mov dword [edi - 0x38], ebx
add esi, dword [edi - 0x2c]
xor ebx, esi
mov dword [edi - 0x34], ecx
add ebx, dword [edi - 0x24]
mov dword [ebp - 4], edx
rol ecx, 0xd
xor ecx, edx
mov dword [edi - 0x30], eax
add ecx, dword [edi - 0x20]
mov edx, ebx
xor edx, eax
mov dword [edi - 0x2c], esi
add edx, dword [edi - 0x1c]
mov eax, dword [ebp - 4]
mov dword [edi - 0x28], eax
xor eax, edx
add eax, dword [edi - 0x14]
rol esi, 9
mov dword [edi - 0x24], ebx
xor esi, ecx
add esi, dword [edi - 0x18]
mov dword [edi - 0x1c], edx
mov dword [ebp - 0xc], edx
mov edx, eax
rol ebx, 0xd
xor edx, ecx
add edx, dword [edi - 0xc]
xor ebx, esi
add ebx, dword [edi - 0x10]
sub dword [ebp - 0x10], 1
mov dword [edi - 0x20], ecx
mov ecx, eax
mov dword [edi - 0x18], esi
mov dword [edi - 0x14], eax
mov dword [edi - 0x10], ebx
mov dword [edi - 0xc], edx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
jne 0x48690a
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x20]
sub ebx, 1
mov dword [ebp - 0x1c], ebx
jne 0x4868f0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4869f8
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ecx]
lea edx, [ecx + edx*4]
push ebx
mov ebx, dword [ecx + 0x10]
push esi
mov esi, dword [ecx + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 8]
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 0xc]
add ecx, 0x40
push 3
mov dword [ebp - 0x10], eax
pop eax
mov dword [ebp - 8], esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
mov edi, edx
mov dword [ebp - 4], edi
cmp edi, ecx
jb 0x486b6c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi - 0xc]
xor eax, edx
rol ebx, 0x19
xor ebx, esi
rol edx, 0x19
mov esi, dword [edi - 4]
sub esi, ebx
mov ebx, dword [edi - 8]
sub ebx, eax
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
rol eax, 0xa
xor eax, esi
mov edi, dword [edi - 0x10]
sub ecx, eax
mov eax, ebx
xor edx, ecx
xor eax, dword [ebp - 8]
sub edi, eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], edi
mov edx, dword [eax - 0x14]
sub edx, dword [ebp - 0xc]
mov dword [eax - 8], ebx
mov dword [eax - 0xc], ecx
mov dword [eax - 4], esi
xor esi, edi
mov dword [eax - 0x10], edi
mov eax, dword [eax - 0x18]
sub eax, esi
rol ebx, 0xa
mov esi, dword [ebp - 4]
xor ebx, edx
mov dword [ebp - 0x18], eax
xor eax, ecx
mov ecx, dword [ebp - 0x18]
mov edi, dword [esi - 0x1c]
sub edi, ebx
mov dword [esi - 0x18], ecx
mov ebx, dword [esi - 0x20]
sub ebx, eax
mov dword [esi - 0x14], edx
mov eax, dword [ebp - 0x14]
rol eax, 0x19
xor eax, edi
mov dword [ebp - 0x10], ebx
mov dword [esi - 0x20], ebx
xor ebx, edx
mov edx, dword [ebp - 4]
mov dword [esi - 0x1c], edi
mov esi, dword [esi - 0x24]
sub esi, eax
rol ecx, 0xa
mov eax, dword [ebp - 4]
xor ecx, esi
mov edx, dword [edx - 0x28]
sub edx, ebx
xor edi, edx
mov dword [ebp - 0xc], edx
mov ebx, dword [eax - 0x2c]
mov eax, dword [eax - 0x30]
sub ebx, ecx
sub eax, edi
mov edi, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov dword [edi - 0x30], eax
mov eax, dword [ebp - 0x10]
rol eax, 0x19
mov dword [edi - 0x28], edx
xor eax, ebx
lea edx, [edi - 0x34]
mov dword [edi - 0x24], esi
mov ecx, dword [edx]
sub ecx, eax
mov dword [edi - 0x2c], ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
lea ecx, [edi - 0x38]
xor eax, esi
mov esi, dword [ecx]
sub esi, eax
lea eax, [edi - 0x3c]
mov edi, dword [eax]
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 0xc]
xor ebx, dword [ebp - 0x14]
rol esi, 0xa
xor esi, dword [ebp - 0x10]
sub edi, esi
mov dword [ebp - 8], edi
mov edi, dword [ebp - 4]
add edi, 0xffffffc0
mov dword [ebp - 4], edi
mov esi, dword [edi]
sub esi, ebx
mov ebx, dword [ebp - 0x10]
mov dword [edx], ebx
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], edx
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0xc], esi
mov dword [edi], esi
mov esi, dword [ebp - 8]
cmp edi, ecx
jae 0x486a3c
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
sub eax, 1
mov dword [ebp - 0x1c], eax
jne 0x486a2f
pop edi
pop esi
pop ebx
leave
ret