joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459924
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x4ab3b0]
cmp byte [eax + 0xc], 0
je 0x459a91
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x459a8a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4acb8c], 0
jne 0x459978
push 0x459a98
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x459aa0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acb8c], eax
cmp dword [0x4a8dac], 0
jne 0x459a73
push 0x459ab0
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4a8dac], eax
cmp dword [0x4a8dac], 0
je 0x459a73
push 0x459abc
mov eax, dword [0x4a8dac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acb90], eax
push 0x459acc
mov eax, dword [0x4a8dac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acb94], eax
push 0x459ae0
mov eax, dword [0x4a8dac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acb98], eax
push 0x459af8
mov eax, dword [0x4a8dac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acb9c], eax
push 0x459b10
mov eax, dword [0x4a8dac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acba0], eax
push 0x459b24
mov eax, dword [0x4a8dac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acba4], eax
push 0x459b3c
mov eax, dword [0x4a8dac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acba8], eax
push 0x459b54
mov eax, dword [0x4a8dac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acbac], eax
push 0x459b70
mov eax, dword [0x4a8dac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acbb0], eax
push 0x459b7c
mov eax, dword [0x4a8dac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x4acbb4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x459a91
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x45d930
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404870
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x45d97f
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.00404af0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46373c
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404d30
xor eax, eax
push ebp
push 0x46386a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x46383d
xor eax, eax
push ebp
push 0x463836
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404b40
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x46380b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor eax, eax
push ebp
push 0x4637fa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404b40
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.00404d40
mov edx, ebx
pop ecx
call fcn.00402a78
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463801
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x4aaea4]
mov dl, 1
mov eax, dword [0x4080a8]
call fcn.0040d2d8
call fcn.004042ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463871
lea eax, [ebp - 4]
call fcn.00404870
ret
Function at 0x463878
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff8c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x463a29
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
mov edx, 0x1b
mov al, 0x2d
call fcn.00404f30
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x463a40
call fcn.00404b8c
mov eax, ebx
call fcn.00421f54
mov edi, eax
dec edi
test edi, edi
jl 0x463930
inc edi
xor esi, esi
mov edx, esi
mov eax, ebx
call fcn.00421f28
mov edx, dword [0x439c08]
call fcn.00403cac
test al, al
je 0x46392c
push dword [ebp - 0xc]
mov edx, esi
mov eax, ebx
call fcn.00421f28
lea edx, [ebp - 0x14]
call fcn.0044db88
push dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
mov edx, 3
mov al, 0x20
call fcn.00404f30
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404c00
inc esi
dec edi
jne 0x4638de
mov al, byte [0x463a44]
push eax
lea eax, [ebp - 0x1c]
push eax
xor ecx, ecx
mov edx, 0x463a50
mov eax, dword [ebp - 0xc]
call fcn.0040e9d8
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
call fcn.00404908
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x68], 0xb
lea edx, [ebp - 0x70]
mov eax, ebx
call fcn.0044db88
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x64], eax
mov byte [ebp - 0x60], 0xb
mov eax, 0x463a40
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x50], 0xb
lea edx, [ebp - 0x74]
mov eax, dword [ebx + 0x2f8]
call fcn.0044db88
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x48], 0xb
mov eax, 0x463a40
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0xb
mov eax, 0x463a40
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
lea edx, [ebp - 0x6c]
mov ecx, 9
mov eax, 0x463a5c
call fcn.0040a26c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463a30
lea eax, [ebp - 0x74]
mov edx, 2
call fcn.00404894
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00404894
lea eax, [ebp - 0x14]
call fcn.00404870
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404894
ret
Function at 0x467bb8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4180b4]
call fcn.0040537c
xor eax, eax
push ebp
push 0x467cfc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4a8fa8], 0
jne 0x467c0b
mov ecx, dword [0x4aae40]
mov dl, 1
mov eax, dword [0x4080a8]
call fcn.0040d2d8
call fcn.004042ac
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.004032bc
mov eax, ebx
call fcn.00405120
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x467d0c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004065a8
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405130
test eax, eax
jle 0x467ca3
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x467c9c
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404b08
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404af0
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408fd0
test eax, eax
jne 0x467c9c
mov ebx, 0x15
jmp 0x467ca8
mov ebx, 0x10
jmp 0x467ca8
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4a8fa8]
call fcn.00467b10
mov eax, dword [ebp - 8]
call fcn.00467b10
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004065c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x467d03
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404894
lea eax, [ebp - 0x10]
mov edx, dword [0x4180b4]
call fcn.0040544c
ret

Function at 0x469448
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x4694b3
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
call sub.kernel32.dll_GetACP
test eax, eax
jns 0x469481
call fcn.00403a58
push eax
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404af0
mov eax, dword [ebp - 0xc]
pop edx
call fcn.00469430
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4694ba
lea eax, [ebp - 0xc]
call fcn.00404870
ret
Function at 0x46a1a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x46a20b
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
call sub.kernel32.dll_GetACP
test eax, eax
jns 0x46a1d9
call fcn.00403a58
push eax
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404af0
mov eax, dword [ebp - 0xc]
pop edx
call fcn.0046a188
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a212
lea eax, [ebp - 0xc]
call fcn.00404870
ret

Function at 0x46c0ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor ecx, ecx
push ebp
push 0x46c1f4
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov byte [ebp - 0xd], 0
cmp byte [0x4a9074], 0
jne 0x46c0e9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46c250
xor esi, esi
xor edi, edi
mov eax, dword [ebp - 0xc]
sub eax, 1
jae 0x46c0fa
call fcn.00403a60
test eax, eax
jb 0x46c1e6
inc eax
mov dword [ebp - 0x14], eax
xor edx, edx
add esi, 1
jae 0x46c112
call fcn.00403a60
and esi, 0xff
cmp esi, 0xff
jbe 0x46c125
call fcn.00403a58
xor eax, eax
mov al, byte [esi + 0x4acc98]
add edi, eax
jae 0x46c136
call fcn.00403a60
and edi, 0xff
cmp edi, 0xff
jbe 0x46c149
call fcn.00403a58
mov cl, byte [edi + 0x4acc98]
cmp esi, 0xff
jbe 0x46c15c
call fcn.00403a58
mov byte [esi + 0x4acc98], cl
cmp eax, 0xff
jbe 0x46c16e
call fcn.00403a58
cmp edi, 0xff
jbe 0x46c17b
call fcn.00403a58
mov byte [edi + 0x4acc98], al
cmp esi, 0xff
jbe 0x46c18e
call fcn.00403a58
xor ecx, ecx
mov cl, byte [esi + 0x4acc98]
add eax, ecx
jae 0x46c19f
call fcn.00403a60
and eax, 0xff
cmp edx, 0x7fff
jbe 0x46c1b1
call fcn.00403a58
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + edx]
cmp eax, 0xff
jbe 0x46c1c3
call fcn.00403a58
xor cl, byte [eax + 0x4acc98]
cmp edx, 0x7fff
jbe 0x46c1d6
call fcn.00403a58
mov eax, dword [ebp - 8]
mov byte [eax + edx], cl
inc edx
dec dword [ebp - 0x14]
jne 0x46c108
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46c250
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x470f54
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x470fe6
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
cmp byte [esi + 0x30], 0
jne 0x470f9b
lea edx, [ebp - 8]
mov eax, dword [ebx]
call fcn.00408df0
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004048c4
lea edx, [ebp - 0xc]
mov eax, dword [esi + 0x34]
call fcn.004090c4
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx]
call fcn.00404e84
mov esi, eax
push ebx
mov ecx, esi
sub ecx, 1
jno 0x470fbf
call fcn.00403a60
mov eax, dword [ebx]
mov edx, 1
call fcn.00404da0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470fed
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404894
ret

Function at 0x472268
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0x67452301
xor edx, edx
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], edx
mov dword [eax + 0x14], edx
ret

Function at 0x472444
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x472463
add edx, 3
sar edx, 2
test edx, edx
jle 0x472570
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
xor ecx, ecx
mov cl, byte [edi + esi]
cmp ecx, 0x3d
jg 0x472499
je 0x4724d9
sub ecx, 0x2b
je 0x4724cf
sub ecx, 4
je 0x4724d4
dec ecx
sub ecx, 0xa
jb 0x4724c2
jmp 0x4724dc
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4724ab
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4724b5
jmp 0x4724dc
mov cl, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4724dc
mov cl, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4724dc
mov cl, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4724dc
mov byte [eax], 0x3e
jmp 0x4724dc
mov byte [eax], 0x3f
jmp 0x4724dc
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x47247b
mov al, byte [esp + 4]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
mov dl, byte [esp + 6]
cmp dl, 0xff
je 0x47252d
cmp byte [esp + 7], 0xff
jne 0x47252d
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x472565
cmp dl, 0xff
je 0x472565
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x472472
add esp, 0x10
pop ebp
pop edi
pop esi
ret
Function at 0x472f48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov edi, edx
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
add eax, 0x3c
mov esi, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 8]
mov dword [edx], eax
cmp esi, eax
jbe 0x472fb0
mov ecx, dword [ebp - 8]
push ecx
push edi
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x10]
add eax, 0x28
push eax
call fcn.00472614
add esp, 0xc
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add dword [edx + 0x38], ecx
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
xor eax, eax
jmp 0x4730bb
cmp ebx, edi
jne 0x472fbe
mov eax, 0x1001
jmp 0x4730bb
mov edx, esi
sub edx, dword [ebp - 0x10]
push edx
push edi
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x10]
add ecx, 0x28
push ecx
call fcn.00472614
mov eax, esi
mov edx, esi
sub eax, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
sub dword [ebp - 8], edx
add edi, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ecx + 0x18]
xor eax, dword [edx + 0x28]
mov dword [ebx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x1c]
xor eax, dword [edx + 0x2c]
mov dword [ebx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x20]
xor eax, dword [edx + 0x30]
mov dword [ebx + 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ecx + 0x24]
xor eax, dword [edx + 0x34]
mov edx, ebx
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00474a9c
add ebx, esi
cmp esi, dword [ebp - 8]
ja 0x47306d
mov eax, ebx
sub eax, esi
mov edx, dword [eax]
xor edx, dword [edi]
mov dword [ebx], edx
mov ecx, dword [eax + 4]
xor ecx, dword [edi + 4]
mov dword [ebx + 4], ecx
mov edx, dword [eax + 8]
xor edx, dword [edi + 8]
mov dword [ebx + 8], edx
mov eax, dword [eax + 0xc]
xor eax, dword [edi + 0xc]
mov dword [ebx + 0xc], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.00474a9c
add edi, esi
add ebx, esi
sub dword [ebp - 8], esi
cmp esi, dword [ebp - 8]
jbe 0x473032
mov eax, ebx
mov ecx, dword [ebp - 4]
sub eax, esi
mov edx, dword [eax]
mov dword [ecx + 0x18], edx
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 4]
mov dword [ecx + 0x1c], edx
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 8]
mov dword [ecx + 0x20], edx
mov edx, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov dword [edx + 0x24], eax
mov eax, dword [ebp - 8]
push eax
push edi
mov ecx, dword [ebp - 4]
add ecx, 0x28
push ecx
call fcn.00472614
add esp, 0xc
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x38], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
sub dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4730c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebx + 0x3c]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x10
mov edi, edx
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [edx], eax
cmp eax, dword [ebp - 0xc]
jae 0x473124
mov ecx, dword [ebp - 4]
push ecx
push edi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.00472614
add esp, 0xc
mov edx, dword [ebp - 4]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x473201
cmp esi, edi
jne 0x473132
mov eax, 0x1001
jmp 0x473201
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
push edx
push edi
mov ecx, dword [ebp - 0x10]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.00472614
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
add edi, eax
add esp, 0xc
sub dword [ebp - 4], edx
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00474a9c
mov ecx, dword [ebx + 0x18]
xor ecx, dword [ebx + 0x28]
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
xor eax, dword [ebx + 0x2c]
mov dword [esi + 4], eax
mov edx, dword [ebx + 0x20]
xor edx, dword [ebx + 0x30]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0x24]
xor ecx, dword [ebx + 0x34]
mov dword [esi + 0xc], ecx
add esi, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jb 0x4731d7
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00474a9c
mov edx, dword [edi]
xor edx, dword [ebx + 0x18]
mov dword [esi], edx
mov ecx, dword [edi + 4]
xor ecx, dword [ebx + 0x1c]
mov dword [esi + 4], ecx
mov eax, dword [edi + 8]
xor eax, dword [ebx + 0x20]
mov dword [esi + 8], eax
mov edx, dword [edi + 0xc]
xor edx, dword [ebx + 0x24]
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub dword [ebp - 4], edx
add edi, eax
mov ecx, dword [ebp - 4]
add esi, eax
cmp ecx, dword [ebp - 0xc]
jae 0x473195
mov eax, dword [ebp - 4]
lea edx, [ebx + 0x28]
push eax
push edi
push edx
call fcn.00472614
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp - 4]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47320c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
mov dword [ebp - 4], ecx
lea eax, [ebx + 0x3c]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x10
mov edi, edx
mov edx, dword [ebx + 0x38]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
add eax, dword [ebp - 4]
mov dword [edx], eax
cmp eax, dword [ebp - 0xc]
jae 0x47326c
mov ecx, dword [ebp - 4]
push ecx
push edi
mov eax, dword [ebp - 0x10]
add eax, ebx
add eax, 0x28
push eax
call fcn.00472614
add esp, 0xc
mov edx, dword [ebp - 4]
add dword [ebx + 0x38], edx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ecx], eax
xor eax, eax
jmp 0x473361
cmp esi, edi
jne 0x47327a
mov eax, 0x1001
jmp 0x473361
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 0x10]
push edx
push edi
mov ecx, dword [ebp - 0x10]
add ecx, ebx
add ecx, 0x28
push ecx
call fcn.00472614
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
add edi, eax
add esp, 0xc
sub dword [ebp - 4], edx
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00474a9c
mov ecx, dword [ebx + 0x28]
xor dword [ebx + 0x18], ecx
mov eax, dword [ebx + 0x2c]
xor dword [ebx + 0x1c], eax
mov edx, dword [ebx + 0x30]
xor dword [ebx + 0x20], edx
mov ecx, dword [ebx + 0x34]
xor dword [ebx + 0x24], ecx
mov eax, dword [ebx + 0x18]
mov dword [esi], eax
mov edx, dword [ebx + 0x1c]
mov dword [esi + 4], edx
mov ecx, dword [ebx + 0x20]
mov dword [esi + 8], ecx
mov eax, dword [ebx + 0x24]
mov dword [esi + 0xc], eax
add esi, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0xc]
jb 0x473337
lea edx, [ebx + 0x18]
mov eax, dword [ebp - 8]
call fcn.00474a9c
mov ecx, dword [edi]
xor dword [ebx + 0x18], ecx
mov eax, dword [edi + 4]
xor dword [ebx + 0x1c], eax
mov edx, dword [edi + 8]
xor dword [ebx + 0x20], edx
mov ecx, dword [edi + 0xc]
xor dword [ebx + 0x24], ecx
mov eax, dword [ebx + 0x18]
mov dword [esi], eax
mov edx, dword [ebx + 0x1c]
mov dword [esi + 4], edx
mov ecx, dword [ebx + 0x20]
mov dword [esi + 8], ecx
mov eax, dword [ebx + 0x24]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
sub dword [ebp - 4], edx
add edi, eax
mov ecx, dword [ebp - 4]
add esi, eax
cmp ecx, dword [ebp - 0xc]
jae 0x4732e9
mov eax, dword [ebp - 4]
lea edx, [ebx + 0x28]
push eax
push edi
push edx
call fcn.00472614
add esp, 0xc
mov ecx, dword [ebx + 0x38]
and ecx, 0xf0000000
add ecx, dword [ebp - 4]
mov dword [ebx + 0x38], ecx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
sub dword [eax], edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4734bc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ecx, dword [esp + 4]
mov esi, dword [ebx + 0x38]
mov edx, 0x10
lea eax, [ebx + 0x3c]
mov dword [ecx], edx
lea edx, [ebx + 0x18]
call fcn.00474a9c
xor ecx, ecx
mov eax, dword [esp]
mov edx, eax
lea eax, [ebx + 0x28]
cmp esi, ecx
jbe 0x4734ff
mov bl, byte [eax]
inc ecx
xor bl, byte [eax - 0x10]
inc eax
mov byte [edx], bl
inc edx
cmp esi, ecx
ja 0x4734f1
mov eax, dword [esp + 4]
mov dword [eax], esi
xor eax, eax
pop ecx
pop edx
pop esi
pop ebx
ret