joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469860
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
push ebx
push esi
mov esi, dword [esp + 0x34]
push edi
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00448dc0
lea ecx, [esp + 0x14]
push ecx
call fcn.00448d20
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.004491b0
mov edi, dword [esp + 0x54]
mov esi, dword [esp + 0x58]
add esp, 0x18
cmp word [edi], 0
push esi
je 0x4698b4
lea ecx, [edi + 2]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.004491b0
add esp, 0xc
jmp 0x4698bc
call fcn.00448da0
add esp, 4
lea edx, [esp + 0x20]
mov eax, esi
sub edx, esi
lea ecx, [edi + 0x16]
mov esi, 5
lea esp, [esp]
mov ebx, dword [eax]
mov edi, dword [edx + eax]
xor edi, ebx
xor edi, dword [ecx]
mov dword [eax], edi
add ecx, 4
add eax, 4
dec esi
jne 0x4698d0
pop edi
pop esi
pop ebx
add esp, 0x28
ret
Function at 0x4698f0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x68
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
push eax
call fcn.00448da0
lea ecx, [esp + 0x54]
push ecx
call fcn.00448da0
mov ebx, dword [esp + 0x84]
mov esi, dword [esp + 0x88]
mov edi, ebx
lea edx, [esp + 0x1c]
add esp, 8
sub edi, esi
sub ebx, edx
lea eax, [esi + 0x14]
xor ecx, ecx
mov dword [esp + 0x10], 5
lea edx, [esp + ecx + 0x14]
mov ebp, dword [ebx + edx]
xor ebp, dword [eax - 0x14]
add eax, 4
mov dword [edx], ebp
mov edx, dword [edi + eax - 4]
mov ebp, dword [eax - 4]
xor edx, ebp
mov dword [esp + ecx + 0x50], edx
mov edx, dword [esp + 0x10]
add ecx, 4
dec edx
mov dword [esp + 0x10], edx
jne 0x469933
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00449480
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x74]
push ecx
call fcn.004491b0
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x54]
push eax
call fcn.00448dc0
lea ecx, [esp + 0x44]
push ecx
call fcn.00448d20
mov ecx, dword [esp + 0xa8]
add esp, 0x20
cmp word [ecx], 0
mov eax, esi
je 0x4699f5
mov ebp, dword [esp + 0x84]
lea edx, [esp + 0x28]
lea ebx, [esp + 0x3c]
add ecx, 2
sub edx, esi
sub ebx, esi
sub ebp, esi
mov dword [esp + 0x88], 5
mov edi, edi
mov esi, dword [ebx + eax]
xor esi, dword [edx + eax]
add eax, 4
xor esi, dword [eax + edi - 4]
add ecx, 4
xor esi, dword [eax - 4]
xor esi, dword [ecx - 4]
mov dword [eax + ebp - 4], esi
dec dword [esp + 0x88]
jne 0x4699d0
jmp 0x469a27
mov ebx, dword [esp + 0x84]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x3c]
sub ecx, esi
sub edx, esi
sub ebx, esi
mov esi, 5
nop
mov ebp, dword [eax + edi]
xor ebp, dword [eax + edx]
add eax, 4
xor ebp, dword [eax + ecx - 4]
xor ebp, dword [eax - 4]
dec esi
mov dword [eax + ebx - 4], ebp
jne 0x469a10
mov edi, dword [esp + 0x84]
mov esi, dword [esp + 0x7c]
lea ecx, [esp + 0x14]
sub esi, edi
mov eax, edi
sub ecx, edi
mov edx, 5
mov ebx, dword [esi + eax]
xor ebx, dword [eax]
mov dword [ecx + eax], ebx
add eax, 4
dec edx
jne 0x469a41
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.004491b0
add esp, 0xc
lea ecx, [esp + 0x28]
lea eax, [edi + 0x14]
mov edx, 5
mov edi, dword [esi + eax]
mov ebp, dword [eax - 0x14]
mov ebx, dword [ecx]
xor edi, ebp
xor edi, ebx
mov dword [eax], edi
add ecx, 4
add eax, 4
dec edx
jne 0x469a72
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x68
ret

Function at 0x469aa0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
push esi
mov esi, dword [esp + 0x34]
lea eax, [esp + 4]
push eax
push esi
call fcn.00448dc0
lea ecx, [esp + 0x20]
push ecx
call fcn.00448da0
lea ecx, [esp + 0x24]
add esp, 0xc
mov eax, esi
sub ecx, esi
mov edx, 5
lea ecx, [ecx]
mov esi, dword [eax + 0x14]
xor esi, dword [eax]
mov dword [ecx + eax], esi
add eax, 4
dec edx
jne 0x469ad0
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
push edx
mov edx, dword [esp + 0x34]
push eax
lea ecx, [esp + 0xc]
push ecx
push edx
call fcn.004698f0
add esp, 0x10
pop esi
add esp, 0x28
ret
Function at 0x469b50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x64
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x78]
lea eax, [esp + 0x38]
push eax
push edi
call fcn.00449480
lea ecx, [esp + 0x18]
push ecx
lea edx, [edi + 0x14]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.004491b0
mov edx, edi
lea ecx, [esp + 0x24]
add esp, 0x14
sub edx, ecx
xor eax, eax
mov esi, 5
jmp 0x469b90
mov ebp, dword [esp + eax + 0x10]
lea ecx, [esp + eax + 0x10]
mov ebx, dword [edx + ecx]
xor ebx, ebp
mov dword [esp + eax + 0x24], ebx
add eax, 4
dec esi
jne 0x469b90
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.00448dc0
lea ecx, [esp + 0x54]
push ecx
call fcn.00448d20
mov eax, dword [esp + 0x8c]
mov esi, dword [esp + 0x88]
add esp, 0xc
cmp word [eax], 0
je 0x469bfb
lea ecx, [eax + 2]
xor eax, eax
mov edx, 5
mov ebp, dword [esp + eax + 0x24]
mov ebx, dword [esp + eax + 0x4c]
xor ebx, ebp
xor ebx, dword [ecx]
mov dword [eax + esi], ebx
add ecx, 4
add eax, 4
dec edx
jne 0x469be1
jmp 0x469c13
xor eax, eax
mov ecx, 5
mov edx, dword [esp + eax + 0x4c]
xor edx, dword [esp + eax + 0x24]
mov dword [eax + esi], edx
add eax, 4
dec ecx
jne 0x469c02
lea eax, [esp + 0x10]
push eax
call fcn.00469b30
add esp, 4
xor eax, eax
mov ecx, 5
jmp 0x469c30
mov ebp, dword [esp + eax + 0x10]
mov edx, dword [esp + eax + 0x24]
xor ebp, edx
mov dword [esp + eax + 0x10], ebp
add eax, 4
dec ecx
jne 0x469c30
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.004491b0
lea edx, [esp + 0x44]
push edx
push edi
call fcn.00448dc0
lea eax, [esp + 0x4c]
push eax
call fcn.00448d20
add esp, 0x18
lea ecx, [esi + 0x14]
xor eax, eax
mov edx, 5
mov esi, dword [esp + eax + 0x60]
xor esi, dword [esp + eax + 0x38]
mov dword [ecx], esi
add eax, 4
add ecx, 4
dec edx
jne 0x469c76
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x64
ret
Function at 0x471a60
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0xd0], edx
test edx, edx
jne 0x471af6
mov dword [ecx + 0x10], 0xf3bcc908
mov dword [ecx + 0x14], 0x6a09e667
mov dword [ecx + 0x18], 0x84caa73b
mov dword [ecx + 0x1c], 0xbb67ae85
mov dword [ecx + 0x20], 0xfe94f82b
mov dword [ecx + 0x24], 0x3c6ef372
mov dword [ecx + 0x28], 0x5f1d36f1
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0xade682d1
mov dword [ecx + 0x34], 0x510e527f
mov dword [ecx + 0x38], 0x2b3e6c1f
mov dword [ecx + 0x3c], 0x9b05688c
mov dword [ecx + 0x40], 0xfb41bd6b
mov dword [ecx + 0x44], 0x1f83d9ab
mov dword [ecx + 0x48], 0x137e2179
mov dword [ecx + 0x4c], 0x5be0cd19
ret
mov dword [ecx + 0x10], 0xc1059ed8
mov dword [ecx + 0x14], 0xcbbb9d5d
mov dword [ecx + 0x18], 0x367cd507
mov dword [ecx + 0x1c], 0x629a292a
mov dword [ecx + 0x20], 0x3070dd17
mov dword [ecx + 0x24], 0x9159015a
mov dword [ecx + 0x28], 0xf70e5939
mov dword [ecx + 0x2c], 0x152fecd8
mov dword [ecx + 0x30], 0xffc00b31
mov dword [ecx + 0x34], 0x67332667
mov dword [ecx + 0x38], 0x68581511
mov dword [ecx + 0x3c], 0x8eb44a87
mov dword [ecx + 0x40], 0x64f98fa7
mov dword [ecx + 0x44], 0xdb0c2e0d
mov dword [ecx + 0x48], 0xbefa4fa4
mov dword [ecx + 0x4c], 0x47b5481d
ret
Function at 0x47a880
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
lea eax, [esi + 1]
push eax
push 0
push ebx
call fcn.00496340
xor ecx, ecx
add esp, 0xc
mov dword [ebp - 0x10], ecx
test esi, esi
je 0x47a91b
mov eax, dword [ebp + 8]
movzx eax, al
mov dword [ebp - 0xc], eax
xor edi, edi
test eax, eax
je 0x47a913
mov eax, dword [ebp + 0xc]
lea edx, [ecx + ebx]
mov bl, byte [edx]
mov esi, ecx
mov dword [ebp - 0x18], edx
mov eax, dword [eax + 4]
shl eax, 5
mov dword [ebp - 0x14], eax
cmp eax, esi
ja 0x47a8d8
xor eax, eax
jmp 0x47a8f0
mov eax, dword [ebp + 0xc]
mov edx, esi
shr edx, 5
mov ecx, esi
and ecx, 0x1f
mov eax, dword [eax + 8]
mov eax, dword [eax + edx*4]
shr eax, cl
and eax, 1
add esi, dword [ebp - 8]
mov ecx, edi
shl al, cl
inc edi
or bl, al
mov eax, dword [ebp - 0x14]
cmp edi, dword [ebp - 0xc]
jb 0x47a8d0
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov byte [eax], bl
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
inc ecx
mov dword [ebp - 0x10], ecx
cmp ecx, esi
jb 0x47a8b4
mov edi, 1
xor ah, ah
cmp esi, edi
jb 0x47a962
mov ch, byte [edi + ebx]
mov dl, 1
mov bl, ch
xor ch, ah
and bl, ah
mov eax, dword [ebp - 4]
mov byte [edi + eax], ch
mov al, ch
and al, 1
sub dl, al
mov eax, dword [ebp - 4]
mov cl, byte [edi + eax - 1]
mov al, cl
imul dl
shl dl, 7
mov ah, al
or dl, cl
and ah, ch
or ah, bl
mov ebx, dword [ebp - 4]
xor byte [edi + ebx], al
mov byte [edi + ebx - 1], dl
inc edi
cmp edi, esi
jbe 0x47a926
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47caf0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov edx, 1
push ebx
push esi
push edi
xor esi, esi
mov eax, edx
mov dword [ebp + esi*4 - 0x808], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x408], esi
movsx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor edx, ecx
and edx, 0xff
cmp esi, 0x100
jl 0x47cb03
mov esi, 1
mov edx, 0x5be920
nop
mov eax, esi
mov dword [edx], esi
and al, 0x80
movsx ecx, al
neg ecx
sbb ecx, ecx
add esi, esi
and ecx, 0x1b
add edx, 4
xor esi, ecx
and esi, 0xff
cmp edx, 0x5be948
jl 0x47cb40
mov eax, 1
mov byte [0x5bf150], 0x63
mov byte [0x5bd083], 0
mov dword [ebp - 4], eax
jmp 0x47cb80
mov ecx, dword [ebp + eax*4 - 0x408]
lea eax, [ebp - 0x40c]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
and ecx, 0xff
mov edx, ecx
xor ebx, ecx
sar edx, 7
lea eax, [ecx + ecx]
or edx, eax
and edx, 0xff
mov esi, edx
xor ebx, edx
sar esi, 7
lea eax, [edx + edx]
or esi, eax
and esi, 0xff
mov ecx, esi
sar ecx, 7
lea eax, [esi + esi]
or ecx, eax
mov eax, dword [ebp - 4]
xor ecx, 0x63
and ecx, 0xff
xor ecx, esi
xor ebx, ecx
mov byte [eax + 0x5bf150], bl
mov byte [ebx + 0x5bd020], al
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x100
jl 0x47cb80
mov ebx, 0xff
xor esi, esi
mov dword [ebp - 8], ebx
movzx edx, byte [esi + 0x5bf150]
mov eax, edx
and al, 0x80
movsx ecx, al
neg ecx
lea eax, [edx + edx]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
and ecx, 0xff
mov eax, ecx
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, ecx
movzx ecx, byte [esi + 0x5bd020]
mov dword [esi*4 + 0x5bd120], eax
rol eax, 8
mov dword [esi*4 + 0x5bd520], eax
rol eax, 8
mov dword [esi*4 + 0x5bd920], eax
rol eax, 8
mov dword [esi*4 + 0x5bdd20], eax
test ecx, ecx
je 0x47ccc0
mov ecx, dword [ebp + ecx*4 - 0x408]
mov eax, dword [ebp - 0x3d0]
add eax, ecx
cdq
idiv ebx
mov eax, dword [ebp - 0x3e4]
add eax, ecx
mov edi, dword [ebp + edx*4 - 0x808]
cdq
idiv ebx
mov eax, dword [ebp - 0x3d4]
add eax, ecx
mov ebx, dword [ebp + edx*4 - 0x808]
cdq
idiv dword [ebp - 8]
mov eax, dword [ebp + edx*4 - 0x808]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3dc]
add eax, ecx
mov ecx, 0xff
cdq
idiv ecx
mov eax, dword [ebp + edx*4 - 0x808]
jmp 0x47ccc9
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ebx
xor eax, eax
shl eax, 8
xor eax, dword [ebp - 4]
shl eax, 8
xor eax, ebx
mov ebx, 0xff
shl eax, 8
xor eax, edi
mov dword [esi*4 + 0x5be120], eax
rol eax, 8
mov dword [esi*4 + 0x5be520], eax
rol eax, 8
mov dword [esi*4 + 0x5be950], eax
rol eax, 8
mov dword [esi*4 + 0x5bed50], eax
inc esi
cmp esi, 0x100
jl 0x47cc03
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47dbd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x4dd840]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
push 0x118
lea eax, [esp + 0x14]
mov esi, edx
push 0
push eax
mov ebx, ecx
call fcn.00496340
push dword [ebp + 8]
lea edi, [ebx + 8]
mov edx, esi
lea ecx, [esp + 0x20]
mov dword [ebx + 4], edi
call fcn.0047cd20
mov edx, eax
add esp, 0x10
mov dword [esp + 0xc], edx
test edx, edx
jne 0x47ddb3
mov ecx, dword [esp + 0x10]
mov dword [ebx], ecx
shl ecx, 4
add ecx, dword [esp + 0x14]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
sub ecx, 0x10
mov dword [edi + 0xc], eax
add edi, 0x10
mov esi, dword [ebx]
dec esi
test esi, esi
jle 0x47dd9d
jmp 0x47dc60
movzx eax, byte [ecx + 3]
dec esi
movzx edx, byte [eax + 0x5bf150]
movzx eax, byte [ecx + 2]
mov edx, dword [edx*4 + 0x5bed50]
movzx eax, byte [eax + 0x5bf150]
xor edx, dword [eax*4 + 0x5be950]
movzx eax, byte [ecx + 1]
movzx eax, byte [eax + 0x5bf150]
xor edx, dword [eax*4 + 0x5be520]
movzx eax, byte [ecx]
movzx eax, byte [eax + 0x5bf150]
xor edx, dword [eax*4 + 0x5be120]
mov dword [edi], edx
movzx eax, byte [ecx + 4]
movzx edx, byte [eax + 0x5bf150]
movzx eax, byte [ecx + 7]
mov edx, dword [edx*4 + 0x5be120]
movzx eax, byte [eax + 0x5bf150]
xor edx, dword [eax*4 + 0x5bed50]
movzx eax, byte [ecx + 6]
movzx eax, byte [eax + 0x5bf150]
xor edx, dword [eax*4 + 0x5be950]
movzx eax, byte [ecx + 5]
movzx eax, byte [eax + 0x5bf150]
xor edx, dword [eax*4 + 0x5be520]
mov dword [edi + 4], edx
movzx eax, byte [ecx + 8]
movzx edx, byte [eax + 0x5bf150]
movzx eax, byte [ecx + 0xb]
mov edx, dword [edx*4 + 0x5be120]
movzx eax, byte [eax + 0x5bf150]
xor edx, dword [eax*4 + 0x5bed50]
movzx eax, byte [ecx + 0xa]
movzx eax, byte [eax + 0x5bf150]
xor edx, dword [eax*4 + 0x5be950]
movzx eax, byte [ecx + 9]
movzx eax, byte [eax + 0x5bf150]
xor edx, dword [eax*4 + 0x5be520]
mov dword [edi + 8], edx
movzx eax, byte [ecx + 0xc]
movzx edx, byte [eax + 0x5bf150]
movzx eax, byte [ecx + 0xf]
mov edx, dword [edx*4 + 0x5be120]
movzx eax, byte [eax + 0x5bf150]
xor edx, dword [eax*4 + 0x5bed50]
movzx eax, byte [ecx + 0xe]
movzx eax, byte [eax + 0x5bf150]
xor edx, dword [eax*4 + 0x5be950]
movzx eax, byte [ecx + 0xd]
sub ecx, 0x10
movzx eax, byte [eax + 0x5bf150]
xor edx, dword [eax*4 + 0x5be520]
mov dword [edi + 0xc], edx
add edi, 0x10
test esi, esi
jg 0x47dc60
mov edx, dword [esp + 0xc]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0xc], eax
mov eax, 0x118
lea ecx, [esp + 0x10]
lea esp, [esp]
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec eax
jne 0x47ddc0
mov ecx, dword [esp + 0x12c]
mov eax, edx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00493329
mov esp, ebp
pop ebp
ret
Function at 0x47e9d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], ecx
test al, 0xf
je 0x47e9ec
mov eax, 0xffffffde
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
test edx, edx
jne 0x47ea8e
test eax, eax
je 0x47eb4e
mov ecx, dword [ebp + 0xc]
dec eax
mov esi, dword [ebp + 0x14]
mov edi, ecx
mov ebx, dword [ebp + 0x10]
sub edi, esi
shr eax, 4
lea edx, [ecx + 0xf]
inc eax
mov dword [ebp - 0xc], edx
mov dword [ebp + 8], eax
lea ebx, [ebx]
mov ecx, dword [ebp - 4]
mov edx, ebx
movdqu xmm2, xmmword [ebx]
push esi
call fcn.0047e3f0
add esp, 4
cmp esi, dword [ebp - 0xc]
ja 0x47ea60
lea eax, [esi + 0xf]
cmp eax, dword [ebp + 0xc]
jb 0x47ea60
mov ecx, esi
mov edx, 0x10
mov al, byte [edi + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
dec edx
jne 0x47ea46
mov eax, dword [ebp + 0xc]
jmp 0x47ea73
mov eax, dword [ebp + 0xc]
movdqu xmm0, xmmword [esi]
movdqu xmm1, xmmword [eax]
pxor xmm1, xmm0
movdqu xmmword [esi], xmm1
add esi, 0x10
add ebx, 0x10
sub edi, 0x10
dec dword [ebp + 8]
movdqu xmmword [eax], xmm2
jne 0x47ea20
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x47eb4e
mov ecx, dword [ebp + 0xc]
lea edx, [eax - 1]
mov edi, dword [ebp + 0x10]
mov ebx, ecx
mov esi, dword [ebp + 0x14]
sub ebx, edi
shr edx, 4
inc edx
mov dword [ebp + 8], ebx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], esi
lea eax, [edi + 0xf]
cmp esi, eax
ja 0x47eac1
lea eax, [esi + 0xf]
cmp eax, edi
jae 0x47eacf
lea eax, [ecx + 0xf]
cmp esi, eax
ja 0x47eb00
lea eax, [esi + 0xf]
cmp eax, ecx
jb 0x47eb00
mov ebx, esi
mov eax, edi
mov esi, dword [ebp + 8]
sub ebx, edi
mov edx, 0x10
lea ecx, [ecx]
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [ebx + eax - 1], cl
dec edx
jne 0x47eae0
mov esi, dword [ebp - 8]
mov ebx, dword [ebp + 8]
jmp 0x47eb10
movdqu xmm1, xmmword [ecx]
movdqu xmm0, xmmword [edi]
pxor xmm1, xmm0
movdqu xmmword [esi], xmm1
cmp dword [ebp - 0x10], 1
mov edx, esi
mov ecx, dword [ebp - 4]
push esi
jne 0x47eb23
call fcn.0047ddf0
jmp 0x47eb28
call fcn.0047e3f0
movdqu xmm0, xmmword [esi]
mov ecx, dword [ebp + 0xc]
sub ebx, 0x10
add esi, 0x10
mov dword [ebp + 8], ebx
add esp, 4
mov dword [ebp - 8], esi
add edi, 0x10
dec dword [ebp - 0xc]
movdqu xmmword [ecx], xmm0
jne 0x47eab3
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47f640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x4dd840]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push 0x40
mov dword [ebp - 0x50], eax
mov esi, ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x4c], edx
push 0
push eax
call fcn.00496340
mov eax, dword [ebx]
add esp, 0xc
mov dword [ebp - 0x48], 0
test eax, eax
jne 0x47f681
xor al, al
jmp 0x47f684
mov al, byte [eax + 8]
movzx ecx, al
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], ecx
test eax, eax
je 0x47f761
push edi
cmp eax, ecx
mov edi, ecx
cmovb edi, eax
mov eax, dword [ebx]
test eax, eax
je 0x47f6f1
push dword [ebx + 4]
mov eax, dword [eax + 0x10]
call eax
mov eax, dword [ebx]
add esp, 4
test eax, eax
je 0x47f6f1
push dword [ebp + 0xc]
mov eax, dword [eax + 0x14]
push dword [ebp - 0x50]
push dword [ebx + 4]
call eax
mov eax, dword [ebx]
add esp, 0xc
test eax, eax
je 0x47f6f1
mov eax, dword [eax + 0x14]
lea ecx, [ebp - 0x48]
push 4
push ecx
push dword [ebx + 4]
call eax
mov eax, dword [ebx]
add esp, 0xc
test eax, eax
je 0x47f6f1
mov eax, dword [eax + 0x18]
lea ecx, [ebp - 0x44]
push ecx
push dword [ebx + 4]
call eax
add esp, 8
xor eax, eax
test edi, edi
je 0x47f74c
cmp edi, 0x10
jb 0x47f73c
lea edx, [esi - 1]
lea ecx, [ebp + edi - 0x45]
add edx, edi
cmp esi, ecx
ja 0x47f710
lea ecx, [ebp - 0x44]
cmp edx, ecx
jae 0x47f73c
mov ecx, edi
mov edx, edi
and ecx, 0xf
sub edx, ecx
lea esp, [esp]
movdqu xmm0, xmmword [esi]
movdqu xmm1, xmmword [ebp + eax - 0x44]
add eax, 0x10
pxor xmm1, xmm0
movdqu xmmword [esi], xmm1
add esi, 0x10
cmp eax, edx
jb 0x47f720
cmp eax, edi
jae 0x47f74c
mov cl, byte [ebp + eax - 0x44]
inc eax
xor byte [esi], cl
inc esi
cmp eax, edi
jb 0x47f740
mov eax, dword [ebp - 0x4c]
inc byte [ebp - 0x45]
sub eax, edi
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x4c], eax
jne 0x47f696
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00493329
mov esp, ebp
pop ebp
ret
Function at 0x480080
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], edx
xor edx, edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
cmp dword [ecx + 0xa4], edx
je 0x4800a5
mov eax, 0xffffbf80
mov esp, ebp
pop ebp
ret
push ebx
push esi
mov esi, dword [ecx + 4]
push edi
mov edi, dword [ebp + 0x10]
lea ebx, [esi - 3]
test edi, edi
je 0x48010d
lea ecx, [edi - 3]
cmp ecx, 6
ja 0x4800e2
call fcn.00471690
mov dword [ebp - 8], eax
test eax, eax
je 0x4800e2
mov ecx, 0x4bd250
cmp dword [0x4bd250], edx
je 0x4800e2
cmp dword [ecx + 0x10], edi
je 0x4800ee
add ecx, 0x14
cmp dword [ecx], edx
jne 0x4800d6
pop edi
pop esi
mov eax, 0xffffbf80
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], eax
mov eax, 0xfffffff6
sub eax, edx
mov dword [ebp - 0xc], edx
add ebx, eax
mov eax, dword [ebp - 8]
mov al, byte [eax + 8]
movzx eax, al
jmp 0x480110
mov eax, dword [ebp + 0x14]
sub ebx, eax
mov dword [ebp - 8], eax
cmp ebx, 8
jb 0x4800e2
cmp ebx, esi
ja 0x4800e2
mov eax, dword [ebp + 0x1c]
lea esi, [eax + 1]
push ebx
push 0xff
mov byte [eax], 0
mov byte [esi], 1
inc esi
push esi
call fcn.00496340
add esi, ebx
mov ebx, dword [ebp - 8]
add esp, 0xc
mov byte [esi], 0
inc esi
test edi, edi
jne 0x480156
push ebx
push dword [ebp + 0x18]
push esi
call fcn.00493790
add esp, 0xc
jmp 0x4801a1
mov ecx, dword [ebp - 0xc]
mov byte [esi], 0x30
push ecx
push dword [ebp - 0x10]
lea eax, [ecx + 8]
add al, bl
mov byte [esi + 1], al
lea eax, [ecx + 4]
mov byte [esi + 2], 0x30
mov byte [esi + 3], al
mov byte [esi + 4], 6
mov byte [esi + 5], cl
add esi, 6
push esi
call fcn.00493790
add esi, dword [ebp - 0xc]
push ebx
push dword [ebp + 0x18]
mov word [esi], 5
lea eax, [esi + 4]
mov byte [esi + 2], 4
push eax
mov byte [esi + 3], bl
call fcn.00493790
add esp, 0x18
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebx + 4]
push esi
push 1
call fcn.0049722c
mov edi, eax
add esp, 8
test edi, edi
je 0x4801d3
push esi
push 1
call fcn.0049722c
add esp, 8
mov dword [ebp - 0xc], eax
push edi
test eax, eax
jne 0x4801df
call fcn.00493e96
add esp, 4
pop edi
pop esi
mov eax, 0xfffffff0
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x1c]
mov edx, dword [ebp - 0x18]
mov ecx, ebx
push dword [ebp + 8]
call fcn.0047f3c0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x480254
push dword [ebp - 0xc]
mov edx, edi
mov ecx, ebx
call fcn.0047f150
mov esi, eax
add esp, 4
mov dword [ebp - 0x18], esi
test esi, esi
jne 0x480254
mov esi, dword [ebx + 4]
xor dl, dl
test esi, esi
je 0x480232
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x1c]
sub ebx, ecx
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
or dl, al
dec esi
jne 0x480221
mov ebx, dword [ebp - 0x14]
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
je 0x480242
mov esi, 0xffffbd00
jmp 0x480254
push dword [ebx + 4]
push edi
push dword [ebp + 0x1c]
call fcn.00493790
mov esi, dword [ebp - 0x18]
add esp, 0xc
push edi
call fcn.00493e96
push dword [ebp - 0xc]
call fcn.00493e96
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret