joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4606ac
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4606c3
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 5], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, ebx
call fcn.00404750
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x460786
xor eax, eax
push ebp
push 0x46077f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x46071e
call fcn.00403d58
jmp 0x460786
cmp ebx, 0x7fffffff
jb 0x46072d
call fcn.00403d58
jmp 0x460786
mov eax, dword [ebp - 4]
mov edx, ebx
call fcn.004048dc
push 0
lea eax, [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_ReadFile
test eax, eax
jne 0x460758
call fcn.00403d58
jmp 0x460786
cmp ebx, dword [ebp - 0x10]
je 0x460764
call fcn.00403d58
jmp 0x460786
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460786
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov al, byte [ebp - 5]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x460790
Capabilities:
Get file attributes
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
mov byte [ebp - 1], 0
mov eax, ebx
call fcn.00409040
test al, al
je 0x4607d4
mov eax, ebx
call fcn.00404750
push eax
call sub.kernel32.dll_GetFileAttributesA
mov edi, eax
test edi, 1
je 0x4607d4
and edi, 0xfffffffe
push edi
mov eax, ebx
call fcn.00404750
push eax
call sub.kernel32.dll_SetFileAttributesA
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov eax, ebx
call fcn.00404750
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x460858
xor eax, eax
push ebp
push 0x460851
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404550
mov ebx, eax
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_WriteFile_1
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x46083a
cmp ebx, dword [ebp - 0xc]
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460858
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460b70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x460c57
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00402ef4
mov dword [ebp - 0x4c], 0x44
lea eax, [ebp - 0x5c]
xor ecx, ecx
mov edx, 0x10
call fcn.00402ef4
xor esi, esi
test ebx, ebx
je 0x460be5
lea ecx, [ebp - 0x60]
mov dl, 0x22
mov eax, edi
call fcn.0040874c
push dword [ebp - 0x60]
push 0x460c74
push ebx
lea eax, [ebp - 8]
mov edx, 3
call fcn.00404610
jmp 0x460bef
lea eax, [ebp - 8]
mov edx, edi
call fcn.00404328
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00404750
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x460c39
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x5c]
mov esi, eax
cmp dword [ebp + 8], 0
je 0x460c39
mov edx, dword [ebp + 8]
push edx
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460c5e
lea eax, [ebp - 0x60]
call fcn.00404290
lea eax, [ebp - 8]
call fcn.00404290
ret

Function at 0x460d38
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x460e34
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x40000
call fcn.004027e8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x460e15
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004192d4
xor eax, eax
push ebp
push 0x460df8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x44]
mov eax, ebx
call fcn.00404750
push eax
push 0x40000
mov eax, dword [ebp - 8]
push eax
push 0
push 0
mov eax, esi
call fcn.00404750
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
test eax, eax
je 0x460de2
mov ebx, dword [ebp - 8]
jmp 0x460ddd
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00404488
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, ebx
call fcn.004095e8
inc eax
add ebx, eax
cmp byte [ebx], 0
jne 0x460dbe
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460dff
mov eax, dword [ebp - 4]
call fcn.00419390
ret
Function at 0x460f98
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x460fa1
mov eax, dword [ebp - 4]
add esp, 4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.00404750
push eax
push 0x2000
lea eax, [ebp - 0x2000]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00404750
push eax
mov eax, edi
call fcn.00404750
push eax
mov eax, esi
call fcn.00404750
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov ecx, eax
lea edx, [ebp - 0x2000]
mov eax, dword [ebp + 8]
call fcn.00404380
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x461a20
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00407224
ret

Function at 0x461bbc
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
lea eax, [ebp - 0x68]
call fcn.00461a20
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, ebx
call fcn.00404750
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x461cd2
xor eax, eax
push ebp
push 0x461ccb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x461cb4
xor eax, eax
push ebp
push 0x461cad
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x461c96
xor eax, eax
push ebp
push 0x461c8f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GetFileSize
mov ecx, eax
lea eax, [ebp - 0x68]
mov edx, dword [ebp - 0x10]
call fcn.00461a54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461c96
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461cb4
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461cd2
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x68]
call fcn.00461ad4
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4706cc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.00404750
push eax
push 0x800
lea eax, [ebp - 0x800]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00404750
push eax
mov eax, edi
call fcn.00404750
push eax
mov eax, esi
call fcn.00404750
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov ecx, eax
lea edx, [ebp - 0x800]
mov eax, dword [ebp + 8]
call fcn.00404380
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x474614
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41580c]
call fcn.00404ce4
xor eax, eax
push ebp
push 0x474758
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4af1d0], 0
jne 0x474667
mov ecx, dword [0x4b57d4]
mov dl, 1
mov eax, dword [0x407810]
call fcn.0040c874
call fcn.00403cac
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402ef4
mov eax, ebx
call fcn.00404ad4
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x474768
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405d94
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404ae4
test eax, eax
jle 0x4746ff
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4746f8
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404518
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.00404500
mov eax, dword [ebp - 0x48]
pop edx
call fcn.0040868c
test eax, eax
jne 0x4746f8
mov ebx, 0x15
jmp 0x474704
mov ebx, 0x10
jmp 0x474704
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4af1d0]
call fcn.0047456c
mov eax, dword [ebp - 8]
call fcn.0047456c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00405dac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47475f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004042b4
lea eax, [ebp - 0x10]
mov edx, dword [0x41580c]
call fcn.00404db4
ret

Function at 0x4775a4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404740
xor eax, eax
push ebp
push 0x477602
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 4]
call fcn.00477680
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
je 0x4775ea
lea eax, [ebp - 4]
call fcn.00477680
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 5
jne 0x4775ec
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477609
lea eax, [ebp - 4]
call fcn.00404290
ret
Function at 0x477610
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404740
xor eax, eax
push ebp
push 0x477674
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xe
lea eax, [ebp - 0x1a]
push eax
lea eax, [ebp - 4]
call fcn.00477680
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov edx, ebx
lea eax, [ebp - 0x1a]
call fcn.004097d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47767b
lea eax, [ebp - 4]
call fcn.00404290
ret

Function at 0x477c6c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404740
xor eax, eax
push ebp
push 0x477d65
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.00477354
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409418
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0047862c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409390
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004786a0
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477d6c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004042b4
ret
Function at 0x477d74
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404740
xor eax, eax
push ebp
push 0x477e7d
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.00477354
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x477e43
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00409418
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0047862c
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409390
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.004786a0
jmp 0x477e55
xor edx, edx
mov eax, ebx
call fcn.0047862c
xor edx, edx
mov eax, ebx
call fcn.004786a0
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477e84
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004042b4
ret

Function at 0x47e5ec
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.0047e820
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.0047e820
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x47e660
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x47e685
inc esi
mov eax, edi
call fcn.0047e644
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.0047e5ec
inc ebx
dec esi
jne 0x47e66f
pop edi
pop esi
pop ebx
ret
Function at 0x47e714
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404740
xor eax, eax
push ebp
push 0x47e789
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0047e68c
mov dword [ebp - 8], 0xc
lea esi, [ebp - 0x14]
mov eax, edi
call fcn.0047e644
mov ebx, eax
xor bl, byte [esi]
mov edx, ebx
mov eax, edi
call fcn.0047e5ec
mov byte [esi], bl
inc esi
dec dword [ebp - 8]
jne 0x47e754
mov bl, byte [ebp - 9]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e790
lea eax, [ebp - 4]
call fcn.00404290
ret
Function at 0x47f140
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47f324
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x47f2e0
mov eax, dword [ebp - 4]
call fcn.00480abc
cmp ebx, eax
jge 0x47f2e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.00475c60
mov edx, dword [0x47770c]
call fcn.004036d0
mov esi, eax
mov eax, esi
call fcn.004785c0
test al, al
je 0x47f2d6
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x47f2ca
xor eax, eax
push ebp
push 0x47f2c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0047f6f8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041a810
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.004048dc
mov eax, dword [ebp - 8]
call fcn.004047a8
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0047f4bc
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f30e
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x47f2c2
mov eax, dword [ebp - 4]
call fcn.0047f77c
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.004097d4
jmp 0x47f30e
mov eax, dword [ebp - 8]
call fcn.00404290
jmp 0x47f30e
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.00408ea8
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x4161b4]
call fcn.0040c7f4
call fcn.00403cac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f32b
lea eax, [ebp - 0x54]
call fcn.00404290
ret
Function at 0x4846c4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x4b2750]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4b2750]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4b2750]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4b2750]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4b26d4]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x4846ef
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4847bc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x4b2750]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4b2750]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4b2750]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4b2750]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4b26d4]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x4847f7
add esp, 0xc
pop edi
pop esi
pop ebx
ret