joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c6b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.00628620
push ebx
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov ebx, dword [esi + 0x14]
cmp edi, ebx
jbe 0x48c789
mov ecx, dword [esi + 0x18]
cmp edi, ecx
jb 0x48c73c
mov eax, edi
sub eax, ecx
add eax, 4
and eax, 0xfffffffc
add eax, ecx
mov ecx, dword [esi + 0x40]
mov dword [esi + 0x18], eax
shl eax, 4
test ecx, ecx
jne 0x48c70e
test eax, eax
je 0x48c72e
push eax
mov dword [0x70e32c], 0
call fcn.0063280d
add esp, 4
jmp 0x48c72e
test eax, eax
jne 0x48c724
push ecx
call fcn.0062f107
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push ecx
call fcn.0062f122
add esp, 8
test eax, eax
jne 0x48c739
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x40], eax
mov ecx, ebx
mov eax, edi
shl ecx, 4
mov edi, esi
sub eax, ebx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
nop dword [eax]
add ecx, dword [edi + 0x40]
mov edx, 1
mov bl, byte [ecx]
lea esi, [ecx + 0x10]
shr bl, 7
neg bl
push esi
and bl, 0x87
call fcn.0048c4f0
mov ecx, dword [ebp - 4]
add esp, 4
xor byte [esi + 0xf], bl
add ecx, 0x10
sub dword [ebp - 8], 1
mov dword [ebp - 4], ecx
jne 0x48c750
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov dword [esi + 0x14], edi
shl edi, 4
add edi, dword [esi + 0x40]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48d7c0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0048d2c0
add esp, 4
test eax, eax
js 0x48d9d2
mov eax, dword [esi + 0xf0]
push ebx
push edi
xor ebx, ebx
lea edi, [eax*4]
test edi, edi
jle 0x48d849
mov eax, dword [ebp + 8]
lea esi, [esi + edi*4]
add esi, 8
add eax, 8
nop dword [eax]
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x48d800
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xf0]
mov ebx, 1
cmp eax, ebx
jle 0x48d9ce
lea edi, [esi + 4]
nop dword [eax]
movzx eax, byte [edi + 0xd]
lea edi, [edi + 0x10]
mov edx, dword [edi - 4]
inc ebx
movzx ecx, byte [eax*4 + str.cc]
mov eax, edx
shr eax, 0x18
mov ecx, dword [ecx*4 + 0x6a3b90]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x6a4490]
movzx eax, byte [edi - 2]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x6a3f90]
movzx eax, dl
mov edx, dword [edi]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x6a54e0]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [edi - 4], ecx
movzx ecx, byte [eax*4 + str.cc]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x6a3f90]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x6a3b90]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x6a4490]
movzx eax, dl
mov edx, dword [edi + 4]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x6a54e0]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [edi], ecx
movzx ecx, byte [eax*4 + str.cc]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x6a3f90]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x6a3b90]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x6a4490]
movzx eax, dl
mov edx, dword [edi + 8]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x6a54e0]
mov eax, edx
shr eax, 0x10
movzx eax, al
mov dword [edi + 4], ecx
movzx ecx, byte [eax*4 + str.cc]
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x6a3f90]
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x6a3b90]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x6a4490]
movzx eax, dl
movzx eax, byte [eax*4 + str.cc]
xor ecx, dword [eax*4 + 0x6a54e0]
mov dword [edi + 8], ecx
cmp ebx, dword [esi + 0xf0]
jl 0x48d860
pop edi
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x48e8e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18
call fcn.00628620
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x14], esi
push edi
mov edi, edx
mov eax, dword [esi + 0x160]
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [ebp - 4], eax
mov dword [esi + 0x16c], 0
mov dword [esi + 0x168], 0
cmp ebx, 0xc
jne 0x48e955
movq xmm0, qword [edi]
movq qword [esi], xmm0
mov eax, dword [edi + 8]
lea edi, [ebx - 0xb]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x1000000
jmp 0x48ea49
mov dword [esi + 0x40], 0
lea edx, [esi + 0x40]
mov dword [edx + 4], 0
lea eax, [esi + 0x60]
mov dword [esi + 0x48], 0
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], edx
mov dword [esi + 0x4c], 0
mov dword [ebp - 0xc], eax
cmp ebx, 0x10
jb 0x48e9e8
mov eax, ebx
lea ecx, [esi + 0x41]
shr eax, 4
mov dword [ebp - 0x10], ecx
mov dword [ebp + 8], eax
lea edx, [edi + 2]
mov eax, ecx
mov esi, 4
nop dword [eax]
movzx ecx, byte [edx - 2]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 5]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 4]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 2], cl
sub esi, 1
jne 0x48e9a0
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
add esp, 8
add edi, 0x10
sub ebx, 0x10
sub dword [ebp + 8], 1
jne 0x48e993
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
test ebx, ebx
je 0x48ea0a
mov ecx, edx
nop
mov al, byte [edi]
lea edi, [edi + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub ebx, 1
jne 0x48e9f0
lea eax, [esi + 0x60]
push eax
push edx
call dword [ebp - 4]
add esp, 8
mov eax, dword [ebp - 0x18]
lea ebx, [esi + 0x40]
xor ecx, ecx
shld ecx, eax, 3
shl eax, 3
bswap eax
xor dword [esi + 0x4c], eax
lea eax, [esi + 0x60]
push eax
bswap ecx
xor dword [esi + 0x48], ecx
push ebx
call dword [ebp - 4]
mov edi, dword [esi + 0x4c]
add esp, 8
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
mov dword [esi + 8], eax
bswap edi
mov dword [esi + 0xc], ecx
mov dword [esi + 0x40], 0
lea eax, [esi + 0x20]
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
push dword [esi + 0x174]
push eax
mov eax, dword [esi + 0x170]
push esi
call eax
add esp, 0xc
inc edi
bswap edi
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48ea90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14
call fcn.00628620
mov eax, dword [ecx + 0x160]
mov dword [ebp - 8], eax
mov eax, dword [ecx + 0x164]
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 0x38]
or eax, dword [ecx + 0x3c]
push esi
push edi
mov edi, edx
mov dword [ebp - 0x14], ecx
je 0x48eacb
mov eax, 0xfffffffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
xor edx, edx
mov eax, esi
add eax, dword [ecx + 0x30]
adc edx, dword [ecx + 0x34]
cmp edx, 0x20000000
ja 0x48eb8c
jb 0x48eaee
test eax, eax
jne 0x48eb8c
mov dword [ecx + 0x34], edx
mov edx, dword [ecx + 0x16c]
mov dword [ecx + 0x30], eax
mov dword [ebp - 4], edx
test edx, edx
je 0x48eb41
test esi, esi
je 0x48eb32
mov al, byte [edi]
dec esi
xor byte [edx + ecx + 0x40], al
inc edi
inc edx
and edx, 0xf
mov dword [ebp - 4], edx
jne 0x48eb01
lea eax, [ecx + 0x60]
lea ebx, [ecx + 0x40]
mov dword [ebp - 0xc], eax
push eax
push ebx
call dword [ebp - 8]
mov eax, dword [ebp - 4]
add esp, 8
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], eax
jmp 0x48eb47
mov dword [ecx + 0x16c], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ecx + 0x60]
lea ebx, [ecx + 0x40]
mov eax, esi
and eax, 0xfffffff0
mov dword [ebp - 0xc], eax
je 0x48eb61
push eax
push edi
push edx
push ebx
call dword [ebp - 0x10]
add edi, dword [ebp - 0xc]
add esp, 0x10
sub esi, dword [ebp - 0xc]
test esi, esi
je 0x48eb77
mov dword [ebp - 4], esi
mov al, byte [edi]
lea edi, [edi + 1]
xor byte [ebx], al
lea ebx, [ebx + 1]
sub esi, 1
jne 0x48eb68
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x16c], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x490360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x48
call fcn.00628620
mov eax, dword [0x70d514]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x34], eax
mov dl, byte [esi]
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x40], esi
mov byte [ebp - 0x1d], dl
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], eax
push edi
lea edi, [esi + 0x10]
test dl, 0x40
jne 0x4903b5
push eax
push edi
push esi
call ecx
mov dl, byte [ebp - 0x1d]
add esp, 0xc
movzx eax, dl
xor ecx, ecx
and eax, 7
mov edx, 0xf
sub edx, eax
mov byte [esi], al
mov dword [ebp - 0x44], edx
cmp edx, 0xf
jae 0x4903e3
nop
movzx eax, byte [esi + edx]
or ecx, eax
mov byte [esi + edx], 0
inc edx
shl ecx, 8
cmp edx, 0xf
jb 0x4903d0
movzx eax, byte [esi + 0xf]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, ebx
je 0x490405
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.006284fa
mov esp, ebp
pop ebp
ret
mov eax, ebx
shr eax, 4
mov dword [ebp - 0x38], eax
test eax, eax
je 0x490441
push edi
push esi
push dword [ebp - 0x2c]
push eax
push dword [ebp - 0x28]
push dword [ebp - 0x24]
call dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
add esp, 0x18
shl eax, 4
add dword [ebp - 0x24], eax
add dword [ebp - 0x28], eax
sub ebx, eax
je 0x4904a2
shr eax, 4
mov ecx, esi
mov edx, eax
call fcn.00490010
jmp 0x490453
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, ebx
test eax, eax
je 0x4904a2
push dword [ebp - 0x2c]
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [ebp - 0x30]
add esp, 0xc
test ebx, ebx
je 0x49048f
mov esi, dword [ebp - 0x24]
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
mov eax, ecx
sub esi, eax
sub edx, eax
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edi, [edi + 1]
mov byte [edx + ecx - 1], al
xor byte [edi - 1], al
sub ebx, 1
jne 0x490474
mov esi, dword [ebp - 0x40]
mov ebx, dword [ebp - 0x2c]
lea eax, [esi + 0x10]
mov edi, dword [ebp - 0x30]
push ebx
push eax
push eax
call edi
add esp, 0xc
jmp 0x4904a8
mov edi, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x44]
cmp ecx, 0x10
jae 0x4904c6
mov eax, 0x10
sub eax, ecx
push eax
lea eax, [ecx + esi]
push 0
push eax
call fcn.0062b760
add esp, 0xc
push ebx
lea eax, [ebp - 0x1c]
push eax
push esi
call edi
mov eax, dword [ebp - 0x1c]
add esp, 0xc
xor dword [esi + 0x10], eax
mov eax, dword [ebp - 0x18]
xor dword [esi + 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [esi + 0x18], eax
mov eax, dword [ebp - 0x10]
xor dword [esi + 0x1c], eax
mov al, byte [ebp - 0x1d]
mov ecx, dword [ebp - 8]
pop edi
mov byte [esi], al
xor ecx, ebp
pop esi
xor eax, eax
pop ebx
call fcn.006284fa
mov esp, ebp
pop ebp
ret
Function at 0x490550
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24
call fcn.00628620
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
test esi, esi
je 0x49070e
push edi
cmp esi, 0x10
jb 0x4905f0
mov eax, esi
shr eax, 4
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 8]
mov eax, ecx
sub edi, ecx
mov edx, 4
mov ecx, ebx
sub ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov esi, ecx
nop dword [eax]
mov ecx, dword [edi + eax]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [esi + eax - 4], ecx
sub edx, 1
jne 0x4905a0
push dword [ebp + 0xc]
push ebx
push ebx
call dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, ebx
mov ecx, dword [ebp - 4]
sub esi, 0x10
mov dword [ebp - 8], ebx
add ecx, 0x10
add esp, 0xc
mov dword [ebp + 8], esi
add ebx, 0x10
mov dword [ebp - 4], ecx
sub dword [ebp - 0xc], 1
mov edx, esi
jne 0x490583
mov dword [ebp - 8], eax
mov dword [ebp + 8], edx
mov dword [ebp - 4], ecx
test edx, edx
je 0x490700
mov esi, eax
mov dword [ebp - 0xc], eax
sub esi, dword [ebp - 4]
lea edi, [ebx + 2]
mov dword [ebp - 0x18], esi
xor edx, edx
mov esi, ebx
inc ecx
sub esi, dword [ebp - 4]
mov dword [ebp - 0x1c], esi
mov esi, 1
sub esi, dword [ebp - 4]
mov dword [ebp - 0x20], esi
mov esi, 2
sub esi, dword [ebp - 4]
sub dword [ebp - 0xc], ebx
mov dword [ebp - 0x24], esi
mov esi, ebx
not esi
mov dword [ebp - 0x14], esi
mov esi, dword [ebp + 8]
nop dword [eax]
cmp edx, esi
jae 0x4906af
add eax, edx
mov dword [ebp - 0x10], eax
mov esi, eax
mov al, byte [ecx - 1]
xor al, byte [esi]
mov esi, dword [ebp + 8]
mov byte [edi - 2], al
mov eax, dword [ebp - 0x14]
add eax, edi
cmp eax, esi
jae 0x4906a9
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov al, byte [ecx + eax]
xor al, byte [ecx]
mov byte [ecx + esi], al
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp + 8]
add eax, ecx
cmp eax, esi
jae 0x4906a4
mov eax, dword [ebp - 0xc]
mov al, byte [eax + edi]
xor al, byte [ecx + 1]
mov byte [edi], al
mov eax, dword [ebp - 0x24]
add eax, ecx
cmp eax, esi
jae 0x49069f
mov esi, dword [ebp - 0x10]
add edx, 4
mov al, byte [ecx + 2]
add ecx, 4
xor al, byte [esi + 3]
mov esi, dword [ebp + 8]
mov byte [edi + 1], al
add edi, 4
mov eax, dword [ebp - 8]
cmp edx, 0x10
jb 0x490630
jmp 0x4906d1
add edx, 3
jmp 0x4906aa
add edx, 2
jmp 0x4906aa
inc edx
cmp edx, 0x10
jae 0x4906d1
mov esi, dword [ebp - 0xc]
lea ecx, [edx + ebx]
mov edi, 0x10
sub edi, edx
nop dword [eax]
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edi, 1
jne 0x4906c0
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
push ebx
push ebx
call dword [ebp + 0x14]
add esp, 0xc
mov eax, ebx
mov dword [ebp - 8], eax
cmp esi, 0x10
jbe 0x490700
mov ecx, dword [ebp - 4]
sub esi, 0x10
add ecx, 0x10
mov dword [ebp + 8], esi
add ebx, 0x10
mov dword [ebp - 4], ecx
test esi, esi
jne 0x4905f0
mov ecx, dword [ebp + 0x10]
pop edi
cmp ecx, eax
je 0x49070e
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x490a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.00628620
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov ebx, edx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov esi, dword [esi]
test esi, esi
je 0x490a6b
mov edx, dword [ebp + 0x10]
test edi, edi
je 0x490a6b
mov al, byte [esi + edx]
dec edi
xor al, byte [ecx]
inc esi
mov byte [ebx], al
inc ecx
inc ebx
mov dword [ebp - 4], ecx
and esi, 0xf
jne 0x490a54
cmp edi, 0x10
jb 0x490aed
mov edx, dword [ebp + 0x10]
mov eax, ebx
sub eax, edx
mov dword [ebp - 0xc], eax
mov eax, ecx
sub eax, edx
mov dword [ebp + 8], eax
mov eax, edi
shr eax, 4
mov dword [ebp - 8], eax
shl eax, 4
add ebx, eax
add ecx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
jmp 0x490aa3
mov edx, dword [ebp + 0x10]
push dword [ebp + 0xc]
push edx
push edx
call dword [ebp + 0x18]
add esp, 0xc
cmp esi, 0x10
jae 0x490ad8
mov eax, dword [ebp + 0x10]
mov edx, 0xf
sub edx, esi
add eax, esi
mov esi, dword [ebp + 8]
shr edx, 2
inc edx
mov ecx, dword [esi + eax]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [ebx + eax - 4], ecx
sub edx, 1
jne 0x490ac6
add dword [ebp + 8], 0x10
sub edi, 0x10
add ebx, 0x10
xor esi, esi
sub dword [ebp - 8], 1
jne 0x490aa0
mov ebx, dword [ebp - 0x10]
test edi, edi
je 0x490b22
push dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push eax
push eax
call dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp - 4]
sub ebx, eax
sub edx, eax
lea ecx, [esi + eax]
add esi, edi
nop
mov al, byte [ecx + edx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
sub edi, 1
jne 0x490b10
mov eax, dword [ebp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x490ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.00628620
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 4], ecx
mov edi, dword [edi]
test edi, edi
je 0x490edb
mov edx, dword [ebp + 0x14]
test esi, esi
je 0x490edb
mov al, byte [edi + edx]
dec esi
xor al, byte [ecx]
inc edi
mov byte [ebx], al
inc ecx
inc ebx
mov dword [ebp - 4], ecx
and edi, 0xf
jne 0x490ec4
cmp esi, 0x10
jb 0x490f57
mov edx, dword [ebp + 0x14]
mov eax, ecx
sub eax, edx
xor edi, edi
mov dword [ebp - 8], eax
mov eax, esi
shr eax, 4
mov dword [ebp - 0xc], edi
mov edi, ebx
mov dword [ebp + 8], eax
sub edi, edx
shl eax, 4
add ebx, eax
add ecx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 8]
mov dword [ebp - 4], ecx
jmp 0x490f13
mov edx, dword [ebp + 0x14]
push dword [ebp + 0xc]
push edx
push dword [ebp + 0x10]
call dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x10]
add esp, 0xc
call fcn.00490e70
mov eax, dword [ebp + 0x14]
mov edx, 4
mov ecx, dword [ebx + eax]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [edi + eax - 4], ecx
sub edx, 1
jne 0x490f30
sub esi, 0x10
add edi, 0x10
add ebx, 0x10
sub dword [ebp + 8], 1
jne 0x490f10
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x10]
test esi, esi
je 0x490f93
push dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x10]
add esp, 0xc
call fcn.00490e70
mov eax, dword [ebp + 0x14]
sub ebx, eax
mov edx, dword [ebp - 4]
sub edx, eax
lea ecx, [edi + eax]
add edi, esi
mov al, byte [ecx + edx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
sub esi, 1
jne 0x490f81
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x490fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.00628620
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov edi, dword [ebp + 0x18]
mov edx, ecx
mov dword [ebp - 4], edx
mov edi, dword [edi]
mov dword [ebp - 0xc], edi
test edi, edi
je 0x49101a
mov ecx, dword [ebp + 0x14]
nop dword [eax]
test esi, esi
je 0x49101a
mov al, byte [edi + ecx]
dec esi
xor al, byte [edx]
inc edi
mov byte [ebx], al
inc edx
inc ebx
mov dword [ebp - 4], edx
and edi, 0xf
mov dword [ebp - 0xc], edi
jne 0x491000
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 0xc]
bswap eax
mov dword [ebp + 8], eax
cmp esi, 0x10
jb 0x4910ac
mov edi, eax
push dword [ebp + 0x10]
mov ecx, esi
push dword [ebp + 0xc]
shr ecx, 4
lea eax, [ecx + edi]
neg edi
cmp eax, ecx
cmovae edi, ecx
mov dword [ebp - 8], edi
xor edi, edi
push dword [ebp - 8]
cmp eax, ecx
push ebx
cmovae edi, eax
push edx
mov dword [ebp + 8], edi
call dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x10]
mov eax, edi
add esp, 0x14
bswap eax
mov dword [ecx + 0xc], eax
test edi, edi
jne 0x49108f
mov edx, 0xc
mov eax, 1
mov edi, ecx
movzx ecx, byte [edx + edi - 1]
dec edx
add eax, ecx
mov byte [edx + edi], al
shr eax, 8
test edx, edx
jne 0x491077
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
shl eax, 4
sub esi, eax
add edx, eax
add ebx, eax
mov dword [ebp - 4], edx
cmp esi, 0x10
jae 0x491030
mov dword [ebp + 8], edi
mov edi, dword [ebp - 0xc]
test esi, esi
je 0x491102
mov eax, dword [ebp + 0x14]
xorps xmm0, xmm0
push ecx
push dword [ebp + 0xc]
push 1
push eax
push eax
movups xmmword [eax], xmm0
call dword [ebp + 0x1c]
mov eax, dword [ebp + 8]
add esp, 0x14
mov ecx, dword [ebp + 0x10]
add eax, 1
bswap eax
mov dword [ecx + 0xc], eax
jne 0x4910dc
call fcn.00490fa0
mov eax, dword [ebp + 0x14]
sub ebx, eax
mov edx, dword [ebp - 4]
sub edx, eax
lea ecx, [edi + eax]
add edi, esi
nop dword [eax + eax]
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub esi, 1
jne 0x4910f0
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x492090
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
mov cl, byte [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
add ebx, esi
movzx eax, cl
and eax, 1
push edi
lea edi, [esi + edx]
test esi, esi
je 0x4920ce
nop dword [eax]
movzx edx, byte [edi - 1]
lea edi, [edi - 1]
movzx ecx, cl
lea ebx, [ebx - 1]
xor edx, ecx
mov cl, byte [ebp + 0xc]
add eax, edx
mov byte [ebx], al
shr eax, 8
sub esi, 1
jne 0x4920b0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x492bb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x70e5ac]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x492c1e
test ebx, ebx
jne 0x492c2c
push 0xc
mov dword [0x70e32c], ebx
call fcn.0063280d
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x492c2c
xorps xmm0, xmm0
movq qword [ebx], xmm0
push ebx
mov dword [ebx + 8], 0
push dword [0x70e5ac]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x492c2c
push ebx
call fcn.0062f107
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push dword [0x70e5ac]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x493240
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
mov ebx, ecx
test ebx, ebx
je 0x493310
cmp dword [ebx], 0
je 0x493255
call fcn.004cbbe0
cmp dword [ebx + 4], 0
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
je 0x4932a3
call ecx
push dword [0x716ce4]
mov esi, eax
call edi
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
je 0x493297
push 0
push dword [0x716ce4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, edi
call fcn.004814e0
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebx + 8], 0
je 0x493305
call ecx
push dword [0x717100]
mov esi, eax
call edi
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push dword [0x717100]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, edi
call fcn.004b64f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x7170fc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push dword [0x7170fc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, edi
call fcn.004b64f0
push ebx
call fcn.0062f107
add esp, 4
pop edi
pop esi
pop ebx
ret