joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd32000
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [str._Sk]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x23c], ecx
cmp dword [ebp + 0xc], 0
jne 0xd32026
xor al, al
jmp 0xd3223c
lea ecx, [ebp - 0x218]
call fcn.00b950e0
mov dword [ebp - 0x1fc], 0
push 4
lea eax, [ebp - 0x224]
push eax
mov ecx, dword [ebp + 8]
call fcn.00d29310
movzx ecx, al
test ecx, ecx
je 0xd320a1
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x20]
call fcn.00b96550
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.00cfd370
add esp, 8
push eax
lea ecx, [ebp - 0x218]
call fcn.00b9fd10
lea ecx, [ebp - 0x3c]
call fcn.00b94e90
lea ecx, [ebp - 0x20]
call fcn.00c50ca0
lea ecx, [ebp - 0x218]
call fcn.00b94c40
mov dword [ebp - 0x1fc], eax
jmp 0xd32108
push 0xd5ec5c
push 2
push 0
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp - 0x58]
push eax
mov ecx, dword [ebp + 8]
call fcn.00d28e60
mov ecx, eax
call fcn.00b9b350
push eax
call fcn.00b9e3d0
add esp, 8
mov byte [ebp - 0x231], al
lea ecx, [ebp - 0x74]
call fcn.00c50ca0
lea ecx, [ebp - 0x58]
call fcn.00c50ca0
movzx ecx, byte [ebp - 0x231]
test ecx, ecx
je 0xd32108
mov byte [ebp - 0x232], 0
lea ecx, [ebp - 0x218]
call fcn.00b94e90
mov al, byte [ebp - 0x232]
jmp 0xd3223c
mov edx, dword [ebp - 0x1fc]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
and eax, 4
jne 0xd32131
mov ecx, dword [ebp - 0x228]
and ecx, 0
je 0xd3219b
xor edx, edx
je 0xd3217e
lea eax, [ebp - 0x224]
push eax
push str._remove_or_unknown_drive
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 0x138]
call fcn.00d04170
mov ecx, eax
call fcn.00cff550
push eax
call fcn.00b916a0
add esp, 8
push eax
call fcn.00b916a0
add esp, 8
lea ecx, [ebp - 0x138]
call fcn.00d04580
jmp 0xd32131
mov byte [ebp - 0x233], 0
lea ecx, [ebp - 0x218]
call fcn.00b94e90
mov al, byte [ebp - 0x233]
jmp 0xd3223c
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x1fc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0xd321da
mov byte [ebp - 0x234], 1
lea ecx, [ebp - 0x218]
call fcn.00b94e90
mov al, byte [ebp - 0x234]
jmp 0xd3223c
xor edx, edx
je 0xd32217
push str._GetDiskFreeSpaceEx_returns_error
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 0x1f8]
call fcn.00d04170
mov ecx, eax
call fcn.00cff550
push eax
call fcn.00b916a0
add esp, 8
lea ecx, [ebp - 0x1f8]
call fcn.00d04580
jmp 0xd321da
mov byte [ebp - 0x235], 0
lea ecx, [ebp - 0x218]
call fcn.00b94e90
mov al, byte [ebp - 0x235]
jmp 0xd3223c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00cd8a41
mov esp, ebp
pop ebp
ret 8
Function at 0xd32250
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [str._Sk]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x154], ecx
lea ecx, [ebp - 0x140]
call fcn.00d289b0
mov dword [ebp - 0x148], 0
push 0
lea ecx, [ebp - 0x144]
call fcn.00d1b8e0
lea ecx, [ebp - 0x144]
call fcn.00cfda50
push eax
mov eax, dword [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0
jne 0xd32328
xor ecx, ecx
je 0xd322fb
push str.::GetCurrentDirectory___failed
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 2
push 4
push 0x1c0
push str.P:p_agentshpam2.eem_recipes201152726_base_branchesinputtools_win_release_branchgoogleclient_third_partylibjingle_files_talk_basewin32filesystem.cc
lea ecx, [ebp - 0xc8]
call fcn.00d04170
mov ecx, eax
call fcn.00cff550
push eax
call fcn.00b916a0
add esp, 8
lea ecx, [ebp - 0xc8]
call fcn.00d04580
jmp 0xd322b3
lea edx, [ebp - 0x140]
push edx
mov ecx, dword [ebp + 8]
call fcn.00d32400
lea ecx, [ebp - 0x144]
call fcn.00d324d0
lea ecx, [ebp - 0x140]
call fcn.00d1f370
mov eax, dword [ebp + 8]
jmp 0xd323e2
mov eax, dword [ebp - 0x14c]
cmp eax, dword [ebp - 0x148]
jg 0xd32338
jmp 0xd32388
xor ecx, ecx
mov eax, dword [ebp - 0x14c]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00cd7a7c
add esp, 4
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
push eax
lea ecx, [ebp - 0x144]
call fcn.00cfda10
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x148], ecx
mov edx, 1
test edx, edx
jne 0xd3228b
lea ecx, [ebp - 0x144]
call fcn.00cfda50
push eax
lea eax, [ebp - 0xe4]
push eax
call fcn.00d2a380
add esp, 8
push eax
lea ecx, [ebp - 0x140]
call fcn.00d28f80
lea ecx, [ebp - 0xe4]
call fcn.00c50ca0
lea ecx, [ebp - 0x140]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00d32400
lea ecx, [ebp - 0x144]
call fcn.00d324d0
lea ecx, [ebp - 0x140]
call fcn.00d1f370
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00cd8a41
mov esp, ebp
pop ebp
ret 4

Function at 0xd33a45
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0xd33a6c
call fcn.00cdaeef
mov dword [eax], esi
call fcn.00cdaedc
push 0x16
pop esi
mov dword [eax], esi
call fcn.00cd8cab
mov eax, esi
jmp 0xd33ac1
test dword [ebp + 0xc], 0xfffffff9
jne 0xd33a52
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0xd33a99
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00cdaf02
pop ecx
call fcn.00cdaedc
mov eax, dword [eax]
jmp 0xd33ac1
test al, 0x10
jne 0xd33abf
test al, 1
je 0xd33abf
test byte [ebp + 0xc], 2
je 0xd33abf
call fcn.00cdaeef
mov dword [eax], 5
call fcn.00cdaedc
mov dword [eax], 0xd
jmp 0xd33a90
xor eax, eax
pop esi
pop ebp
ret
Function at 0x4035ac
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x59b008], 0x8088405
inc edx
mov dword [ebx + 0x59b008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x41cb9c
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ebp
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x41cbcd
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cbb5
add dl, dl
jne 0x41cbd8
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41cc29
xor eax, eax
add dl, dl
jne 0x41cbe5
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x41ccc6
add dl, dl
jne 0x41cbf4
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cbff
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc0a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc15
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x41cc1f
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x41cbc4
mov eax, 1
add dl, dl
jne 0x41cc37
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x41cc42
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc2e
sub eax, ebx
mov ebx, 1
jne 0x41cc75
mov ecx, 1
add dl, dl
jne 0x41cc5b
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc66
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc52
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x41cc8c
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x41cc97
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x41cc83
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41cbc4
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x41cce7
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x41cbc4
pop ebp
sub edi, dword [ebp - 8]
mov dword [ebp - 0xc], edi
pop edi
pop esi
pop ebx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x41e0b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x58456f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov ecx, ebx
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41e161
add edx, ebx
mov eax, edx
mov esi, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
add edx, ebx
mov dword [ebp - 0x10], edx
mov edi, dword [eax + 0x20]
add edi, ebx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
cmp edx, 0xffff
jbe 0x41e14a
test esi, esi
jbe 0x41e161
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ac
test eax, eax
jne 0x41e13c
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41e161
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41e119
jmp 0x41e161
mov ecx, edx
sub ecx, dword [eax + 0x10]
cmp ecx, dword [eax + 0x14]
jae 0x41e161
mov eax, ecx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x584576
ret
Function at 0x41e9a4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x584f53
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41e9df
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41e9f8
lea eax, [ebp - 0x10]
mov edx, dword [0x59d248]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41ea0b
lea eax, [ebp - 0x10]
mov edx, dword [0x59d248]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41ea17
adc edx, 0
mov edx, dword [edx*4 + 0x59c0d8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406af4
mov esi, eax
cmp esi, 0xffffffff
je 0x41eb25
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d44
test eax, eax
je 0x41eb18
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41eb18
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406d9c
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d44
test eax, eax
je 0x41eb18
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41eb18
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41eb18
cmp dx, 0x150
ja 0x41eb18
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d44
test eax, eax
je 0x41eb18
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41eb18
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406aac
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41eb3d
inc ebx
cmp ebx, 0x19
jne 0x41e9d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x584f5a
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x61b53c
Capabilities:
Encode data using xor

Disassembly:
push 0x4402890e
xor eax, eax
push eax
call fcn.0061b483
jb 0x61b64c
push 4
push 0x1000
push 0x200
push 0
call eax
dec eax
js 0x61b64c
inc eax
push eax
mov edi, eax
xor ecx, ecx
xor eax, eax
mov al, cl
push ecx
mov ecx, 8
clc
rcr ax, 1
jae 0x61b580
xor ax, 0xa001
loop 0x61b576
mov word [edi], ax
inc edi
inc edi
pop ecx
inc ecx
cmp ecx, 0x100
jne 0x61b56c
mov esi, ebp
mov edi, dword [esp]
mov ecx, 0x7e4
dec ecx
xor eax, eax
xor ebx, ebx
xor bh, bh
mov bl, al
lodsb al, byte [esi]
xor bl, al
shl bx, 1
mov bx, word [edi + ebx]
xor bl, ah
mov ax, bx
loop 0x61b5a0
xor edx, edx
mov ecx, 0x7e4
dec ecx
mov edi, ecx
shr edi, 1
mov esi, ebp
test ah, 0x80
je 0x61b5cc
xor ax, 0xa097
test dh, 0x80
je 0x61b5d6
xor dx, 0xa097
mov bx, ax
add bx, ax
mov cx, dx
add cx, dx
lodsw ax, word [esi]
mov dl, ah
add ax, bx
mov ah, bh
add dx, cx
mov dh, ch
dec edi
jne 0x61b5c3
shl eax, 0x10
add eax, edx
mov edx, eax
shr eax, 4
and edx, 0xf0f0f0f
shl edx, 4
and eax, 0xf0f0f0f
or eax, edx
pop ebx
push eax
push ebx
push 0x2aad1211
xor eax, eax
push eax
call fcn.0061b483
jb 0x61b64c
pop ebx
push 0x8000
push 0
push ebx
call eax
call fcn.0061b330
jb 0x61b64c
push ecx
mov ecx, dword [ebp + 0x7e4]
add ecx, ebp
lea ebx, [ebp + 0x483]
sub ebx, dword [ebp + 0x7e8]
mov dword [ecx + 0x18], ebx
pop ecx
inc ecx
ret
xor ecx, ecx
ret

Function at 0x61b6e4
Capabilities:
Encode data using xor

Disassembly:
pop ecx
push 0x4402890e
xor eax, eax
push eax
call fcn.0061b483
jb 0x61b64c
push 4
push 0x1000
push 0x200
push 0
call eax
dec eax
js 0x61b7dc
inc eax
push eax
mov edi, eax
xor ecx, ecx
xor eax, eax
mov al, cl
push ecx
mov ecx, 8
clc
rcr ax, 1
jae 0x61b729
xor ax, 0xa001
loop 0x61b71f
mov word [edi], ax
inc edi
inc edi
pop ecx
inc ecx
cmp ecx, 0x100
jne 0x61b715
mov esi, ebp
mov edi, dword [esp]
mov ecx, 0x7e4
dec ecx
xor eax, eax
xor ebx, ebx
xor bh, bh
mov bl, al
lodsb al, byte [esi]
xor bl, al
shl bx, 1
mov bx, word [edi + ebx]
xor bl, ah
mov ax, bx
loop 0x61b749
xor edx, edx
mov ecx, 0x7e4
dec ecx
mov edi, ecx
shr edi, 1
mov esi, ebp
test ah, 0x80
je 0x61b775
xor ax, 0xa097
test dh, 0x80
je 0x61b77f
xor dx, 0xa097
mov bx, ax
add bx, ax
mov cx, dx
add cx, dx
lodsw ax, word [esi]
mov dl, ah
add ax, bx
mov ah, bh
add dx, cx
mov dh, ch
dec edi
jne 0x61b76c
shl eax, 0x10
add eax, edx
mov edx, eax
shr eax, 4
and edx, 0xf0f0f0f
shl edx, 4
and eax, 0xf0f0f0f
or eax, edx
pop ebx
push eax
push ebx
push 0x2aad1211
xor eax, eax
push eax
call fcn.0061b483
jb 0x61b7dc
pop ebx
push 0x8000
push 0
push ebx
call eax
call fcn.0061b128
jb 0x61b7dc
inc ecx
ret
xor ecx, ecx
jmp fcn.0061b6d8

Function at 0x61bc0a
Capabilities:
Encode data using xor

Disassembly:
push edi
push 0x613fd7ba
xor eax, eax
push eax
call fcn.0061b483
jb 0x61bd02
call eax
mov dword [ebp + 0x3ff6], eax
mov esi, 9
pop edi
mov eax, dword [ebp + 0x3ff6]
mov ecx, eax
imul eax, eax, 0x41c64e6d
add eax, 0x3039
mov dword [ebp + 0x3ff6], eax
xor eax, ecx
mov ecx, 0x19
xor edx, edx
div ecx
add edx, 0x61
mov bl, dl
mov byte [esi + edi], bl
dec esi
jge 0x61bc2c
ret
pop edi
ret
Function at 0x61c0c7
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp + 0x46f2], edx
add edx, 4
mov dword [ebp + 0x46f6], edx
mov ecx, 0x20
mov eax, dword [ebp + 0x46ea]
shl eax, 5
mov dword [ebp + 0x46ee], eax
mov esi, dword [ebp + 0x46f2]
mov eax, dword [esi]
shl eax, 4
mov edi, 0x46e2
add edi, ebp
mov edi, dword [edi]
add eax, edi
push eax
mov eax, dword [esi]
add eax, dword [ebp + 0x46ee]
push eax
mov eax, dword [esi]
shr eax, 5
mov edi, 0x46e6
add edi, ebp
mov edi, dword [edi]
add eax, edi
pop ebx
pop edx
xor ebx, edx
xor ebx, eax
mov edi, dword [ebp + 0x46f6]
mov eax, dword [edi]
sub eax, ebx
mov dword [edi], eax
mov esi, dword [ebp + 0x46f6]
mov eax, dword [esi]
shl eax, 4
mov edi, 0x46da
add edi, ebp
mov edi, dword [edi]
add eax, edi
push eax
mov eax, dword [esi]
add eax, dword [ebp + 0x46ee]
push eax
mov eax, dword [esi]
shr eax, 5
mov edi, 0x46de
add edi, ebp
mov edi, dword [edi]
add eax, edi
pop ebx
pop edx
xor ebx, edx
xor ebx, eax
mov edi, dword [ebp + 0x46f2]
mov eax, dword [edi]
sub eax, ebx
mov dword [edi], eax
mov eax, dword [ebp + 0x46ee]
sub eax, dword [ebp + 0x46ea]
mov dword [ebp + 0x46ee], eax
dec ecx
cmp ecx, 0
jne 0x61c0ea
ret

Function at 0x61c585
Capabilities:
Encode data using xor

Disassembly:
pushal
call fcn.0061bbae
popal
mov dword [ebp + 0x46f2], edx
add edx, 4
mov dword [ebp + 0x46f6], edx
mov ecx, 0x20
xor eax, eax
mov dword [ebp + 0x46ee], eax
mov esi, dword [ebp + 0x46f6]
mov eax, dword [esi]
shl eax, 4
mov edx, eax
mov eax, dword [esi]
shr eax, 5
xor eax, edx
xchg edx, eax
mov eax, dword [esi]
add eax, edx
mov edx, dword [ebp + 0x46ee]
mov edi, 0x46da
add edi, ebp
and edx, 3
add edi, edx
mov ebx, dword [edi]
mov edx, dword [ebp + 0x46ee]
add edx, ebx
xor eax, edx
mov edi, dword [ebp + 0x46f2]
mov ebx, dword [edi]
add eax, ebx
mov dword [edi], eax
mov eax, dword [ebp + 0x46ee]
add eax, dword [ebp + 0x46ea]
mov dword [ebp + 0x46ee], eax
mov esi, dword [ebp + 0x46f2]
mov eax, dword [esi]
shl eax, 4
mov edx, eax
mov eax, dword [esi]
shr eax, 5
xor eax, edx
xchg edx, eax
mov eax, dword [esi]
add eax, edx
mov edx, dword [ebp + 0x46ee]
mov edi, 0x46da
add edi, ebp
shr edx, 0xb
and edx, 3
add edi, edx
mov ebx, dword [edi]
mov edx, dword [ebp + 0x46ee]
add edx, ebx
xor eax, edx
mov edi, dword [ebp + 0x46f6]
mov ebx, dword [edi]
add eax, ebx
mov dword [edi], eax
dec ecx
cmp ecx, 0
jne 0x61c5a8
ret
Function at 0x61ca78
Capabilities:
Encode data using xor

Disassembly:
cmp dword [ebp + 0x47e6], 0
jne 0x61cacb
push 0x4402890e
xor eax, eax
push eax
call fcn.0061b483
push eax
push 4
push 0x1000
push 0x400
push 0
call eax
mov dword [ebp + 0x47e6], eax
pop eax
mov edx, dword [ebp + 0x47de]
cmp edx, 0
jne 0x61e923
push 4
push 0x1000
push 0x200
push 0
call eax
mov dword [ebp + 0x47de], eax
mov eax, dword [ebp + 0x47de]
mov edi, eax
xor ecx, ecx
xor eax, eax
mov al, cl
push ecx
mov ecx, 8
clc
rcr ax, 1
jae 0x61cae9
xor ax, 0xa001
loop 0x61cadf
mov word [edi], ax
inc edi
inc edi
pop ecx
inc ecx
cmp ecx, 0x100
jne 0x61cad5
mov esi, dword [esp + 4]
mov edi, dword [ebp + 0x47de]
mov ecx, dword [esp + 8]
dec ecx
xor eax, eax
xor ebx, ebx
xor bh, bh
mov bl, al
lodsb al, byte [esi]
xor bl, al
shl bx, 1
mov bx, word [edi + ebx]
xor bl, ah
mov ax, bx
loop 0x61cb0d
push eax
xor edx, edx
mov ecx, dword [esp + 0xc]
dec ecx
mov edi, ecx
shr edi, 1
mov esi, dword [esp + 8]
test ah, 0x80
je 0x61cb3b
xor ax, 0xa097
test dh, 0x80
je 0x61cb45
xor dx, 0xa097
mov bx, ax
add bx, ax
mov cx, dx
add cx, dx
lodsw ax, word [esi]
mov dl, ah
add ax, bx
mov ah, bh
add dx, cx
mov dh, ch
dec edi
jne 0x61cb32
shl eax, 0x10
pop ecx
mov ax, cx
push eax
mov ecx, 0x100
mov edx, 0xedb88320
mov esi, dword [ebp + 0x47e6]
lea eax, [ecx - 1]
push ecx
mov ecx, 8
shr eax, 1
jae 0x61cb89
xor eax, edx
loop 0x61cb83
pop ecx
mov dword [esi + ecx*4 - 4], eax
loop 0x61cb7a
pop eax
mov ebx, dword [esp + 4]
mov ecx, dword [esp + 8]
dec ecx
mov dl, byte [ebx]
xor dl, al
movzx edx, dl
shr eax, 8
xor eax, dword [esi + edx*4]
inc ebx
loop 0x61cb9c
not eax
xor al, ah
ret 8
Function at 0x61e8d4
Capabilities:
Encode data using xor

Disassembly:
cmp dword [ebp + 0x47e6], 0
jne 0x61e923
push 0x4402890e
xor eax, eax
push eax
call fcn.0061b483
push eax
push 4
push 0x1000
push 0x400
push 0
call eax
mov dword [ebp + 0x47e6], eax
pop eax
mov edx, dword [ebp + 0x47de]
cmp edx, 0
jne 0x61e923
push 4
push 0x1000
push 0x200
push 0
call eax
mov dword [ebp + 0x47de], eax
mov eax, dword [ebp + 0x47de]
mov edi, eax
xor ecx, ecx
xor eax, eax
mov al, cl
push ecx
mov ecx, 8
clc
rcr ax, 1
jae 0x61e941
xor ax, 0xa001
loop 0x61e937
mov word [edi], ax
inc edi
inc edi
pop ecx
inc ecx
cmp ecx, 0x100
jne 0x61e92d
mov esi, dword [esp + 4]
mov edi, dword [ebp + 0x47de]
mov ecx, dword [esp + 8]
dec ecx
xor eax, eax
xor ebx, ebx
xor bh, bh
mov bl, al
lodsb al, byte [esi]
xor bl, al
shl bx, 1
mov bx, word [edi + ebx]
xor bl, ah
mov ax, bx
loop 0x61e965
push eax
xor edx, edx
mov ecx, dword [esp + 0xc]
dec ecx
mov edi, ecx
shr edi, 1
mov esi, dword [esp + 8]
test ah, 0x80
je 0x61e993
xor ax, 0xa097
test dh, 0x80
je 0x61e99d
xor dx, 0xa097
mov bx, ax
add bx, ax
mov cx, dx
add cx, dx
lodsw ax, word [esi]
mov dl, ah
add ax, bx
mov ah, bh
add dx, cx
mov dh, ch
dec edi
jne 0x61e98a
shl eax, 0x10
pop ecx
mov ax, cx
push eax
mov ecx, 0x100
mov edx, 0xedb88320
mov esi, dword [ebp + 0x47e6]
lea eax, [ecx - 1]
push ecx
mov ecx, 8
shr eax, 1
jae 0x61e9e1
xor eax, edx
loop 0x61e9db
pop ecx
mov dword [esi + ecx*4 - 4], eax
loop 0x61e9d2
pop eax
mov ebx, dword [esp + 4]
mov ecx, dword [esp + 8]
dec ecx
mov dl, byte [ebx]
xor dl, al
movzx edx, dl
shr eax, 8
xor eax, dword [esi + edx*4]
inc ebx
loop 0x61e9f4
not eax
ret 8

Function at 0x61ea29
Capabilities:
Encode data using xor

Disassembly:
lea esi, [ebp + 0x492f]
mov eax, dword [esp + 8]
mov dword [esi], eax
mov dword [ebp + 0x4922], eax
mov eax, dword [esp + 4]
mov dword [esi + 4], eax
lea esi, [ebp + 0x491d]
mov dword [esi], eax
mov eax, dword [esp + 0xc]
lea esi, [ebp + 0x4927]
mov dword [esi], eax
mov eax, dword [esp + 0x10]
lea esi, [ebp + 0x492b]
mov dword [esi], eax
lea ebp, [ebp + 0x4922]
xor eax, eax
movzx ecx, byte [ebp]
xor edx, edx
xor edi, edi
xor ebx, ebx
push 1
pop esi
test cl, cl
je 0x61ea94
mov ebx, ecx
add edx, ecx
imul ebx, esi
xor ebx, edi
mov esi, ecx
movzx ecx, byte [edi + ebp + 1]
add ebx, edx
xor eax, ebx
inc edi
test cl, cl
jne 0x61ea7b
mov ebp, dword [esp + 0x14]
lea ebp, [ebp + 0x491d]
xor edi, edi
movzx ecx, byte [ebp]
test cl, cl
je 0x61eac1
mov ebx, ecx
add edx, ecx
imul ebx, esi
xor ebx, edi
mov esi, ecx
movzx ecx, byte [edi + ebp + 1]
add ebx, edx
xor eax, ebx
inc edi
test cl, cl
jne 0x61eaa8
and eax, 0xffffff
mov ebp, dword [esp + 0x14]
lea esi, [ebp + 0x492f]
mov word [esi + 8], ax
mov word [esi + 0xa], bx
xor ebx, ebx
xor edx, edx
xor ecx, ecx
lea edi, [ebp + 0x492f]
mov eax, dword [ebp + 0x4927]
mov bl, byte [edx + edi]
xor byte [ecx + eax], bl
inc ecx
inc edx
cmp ecx, dword [ebp + 0x492b]
jne 0x61eafc
xor ecx, ecx
cmp edx, 0xc
jne 0x61eaea
ret 0x14