joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x401c66
pop dword [ebp - 0x2c]
mov eax, 0xd9ccee4
add eax, 0xf2a34d82
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xff54d64d
add dword [ebp - 0x3c], 0x4efd6efe
mov dword [ebp - 0x38], 0x5ee9c04
sub dword [ebp - 0x38], 0xd3bb4fbf
mov dword [ebp - 0x34], 0xed6ae2a4
sub dword [ebp - 0x34], 0xa11e9e76
mov dword [ebp - 0x30], 0x1cc8f80f
sub dword [ebp - 0x30], 0x1cc8f80f
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x7434997c
add dword [ebp - 0x3c], 0x3dcfda
mov dword [ebp - 0x38], 0x8d00aa29
sub dword [ebp - 0x38], 0x4b9448b4
mov dword [ebp - 0x34], 0xe353b3a7
sub dword [ebp - 0x34], 0x7fe4473b
mov dword [ebp - 0x30], 0xebce4104
sub dword [ebp - 0x30], 0xebce4104
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x384e0245
sub eax, 0x380dd219
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x39056
push 0
call eax
mov ecx, 0x2a958f18
sub ecx, 0x2a953cef
mov edx, eax
mov ebx, 0x55463728
add ebx, 0xaafa38d8
add ebx, dword [ebp - 0x2c]
mov edi, 0xcf8cff02
add dword [ebp - 4], 0x7a064d80
mov esi, dword [ebx]
mov dword [ebp - 0x24], 0x9074dadb
add esi, edi
mov dword [ebp - 4], 0xb845ece0
mov dword [edx], esi
xor dword [ebp - 4], 0xf3d9c626
add edx, 0x5218851
add edx, 0xfade77b3
add ebx, 0xd9609214
sub ebx, 0xd9609210
loop 0x401d7d
add eax, 0x13b77
xor ebx, ebx
add ebx, eax
add eax, 0xf5ea2930
add eax, 0xa15d6d5
mov ecx, 0xbdab6c16
add ecx, 0x429493ea
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x407c8f
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
xor ecx, ecx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], ecx
jbe 0x407cef
push 0x40
pop eax
xor edx, edx
mov dword [ebp - 0x10], ecx
div dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
xor edx, edx
inc eax
call fcn.004c5fe0
and eax, dword [ebp - 0xc]
and edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
call fcn.004c5fe0
mov ecx, dword [ebp - 8]
xor edi, eax
mov eax, dword [ebp - 4]
xor esi, edx
dec eax
inc ecx
add eax, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
cmp ecx, dword [ebp + 0x10]
jb 0x407cbd
mov eax, edi
mov edx, esi
pop edi
pop esi
leave
ret 0xc
Function at 0x419cee
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
or ecx, 0xffffffff
cmp dword [ebp + 8], esi
jbe 0x419d17
movzx eax, byte [esi + edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4d57d0]
inc esi
cmp esi, dword [ebp + 8]
jb 0x419cfe
not ecx
mov eax, ecx
pop esi
pop ebp
ret 4
Function at 0x435980
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
call fcn.0043593f
mov esi, eax
call fcn.0043593f
mov ebx, eax
cmp ebx, esi
je 0x435992
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
call fcn.0043593f
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x4359a5
push 0
pop ecx
rdtsc
mov edi, eax
mov esi, 0x6b46
sub esi, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
sbb ecx, dword [ebp - 8]
add edi, esi
push 0
adc edx, ecx
sub eax, ebx
imul eax, eax, 0xd68b
push eax
push edx
push edi
call fcn.004c5d90
push 0
push 0xf4240
push edx
push eax
call fcn.004c2ae0
pop edi
pop esi
mov dword [0x517830], eax
xor eax, eax
mov dword [0x517834], edx
pop ebx
leave
ret

Function at 0x4363c7
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0
push 0xf4240
push dword [0x517834]
rdtsc
push dword [0x517830]
mov esi, ecx
mov edi, eax
mov ebx, edx
call fcn.004c5d90
push 0
push esi
push edx
push eax
call fcn.004c2ae0
mov ecx, eax
mov esi, edx
add ecx, edi
adc esi, ebx
rdtsc
cmp edx, esi
jl 0x4363fe
jg 0x43640a
cmp eax, ecx
jb 0x4363fe
pop edi
pop esi
pop ebx
ret
Function at 0x454167
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
push esi
push edi
movzx edi, word [ecx + 6]
xor ecx, ecx
movzx eax, ax
add edx, eax
test edi, edi
je 0x45419e
mov esi, dword [ebp + 8]
cmp esi, dword [edx + 0xc]
jb 0x454196
mov eax, dword [edx + 0x10]
add eax, dword [edx + 0xc]
cmp esi, eax
jb 0x4541a6
add edx, 0x28
inc ecx
cmp ecx, edi
jb 0x454187
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
mov eax, edx
jmp 0x4541a0
Function at 0x45c568
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x10], edx
xor ecx, ecx
xor edx, edx
push edi
mov dword [eax], ecx
lea eax, [ebp - 0xc]
push eax
push 0x20
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], ecx
pop ecx
call fcn.00458ea4
mov edi, dword [ebp - 0xc]
mov esi, eax
test esi, esi
js 0x45c640
xor edx, edx
mov ecx, ebx
inc edx
call fcn.0045643c
mov esi, eax
test esi, esi
js 0x45c640
lea eax, [ebp - 4]
mov ecx, ebx
push eax
lea edx, [ebp - 8]
call fcn.00456394
mov esi, eax
push 0x20
pop ebx
test esi, esi
js 0x45c643
cmp word [ebp - 4], bx
je 0x45c5db
mov esi, 0xc000000d
jmp 0x45c643
push ebx
push dword [ebp - 8]
push edi
call fcn.004c62d0
mov ebx, dword [ebp - 0x10]
add esp, 0xc
xor edx, edx
mov ecx, ebx
inc edx
call fcn.0045643c
mov esi, eax
test esi, esi
js 0x45c640
lea eax, [ebp - 4]
mov ecx, ebx
push eax
lea edx, [ebp - 8]
call fcn.00456394
mov esi, eax
push 0x20
pop ebx
test esi, esi
js 0x45c643
cmp word [ebp - 4], bx
jne 0x45c5d4
mov edx, dword [ebp - 8]
mov ecx, edi
sub edx, edi
mov esi, ebx
mov al, byte [edx + ecx]
xor byte [ecx], al
inc ecx
sub esi, 1
jne 0x45c621
push dword [ebp + 8]
mov edx, edi
mov ecx, 0x2000
push ebx
call fcn.00459080
mov esi, eax
jmp 0x45c643
push 0x20
pop ebx
test edi, edi
je 0x45c652
push 0
mov edx, ebx
mov ecx, edi
call fcn.00458ee4
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x45c6a0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4e5478]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], ecx
mov cl, byte [ebp + 0x20]
sub cl, 2
mov dword [ebp - 0x24], eax
push ebx
mov ebx, dword [ebp + 8]
and cl, 0xfe
mov al, 0xe
shl cl, 2
sub al, bl
push esi
mov esi, dword [ebp + 0x10]
or cl, al
mov byte [ebp - 0x18], cl
push edi
test esi, esi
je 0x45c6e3
or cl, 0x40
mov byte [ebp - 0x18], cl
push ebx
push edx
lea eax, [ebp - 0x17]
push eax
call fcn.004c5a50
mov edi, dword [ebp + 0x18]
add esp, 0xc
mov ecx, edi
push 0xf
pop eax
cmp ebx, eax
jae 0x45c709
mov byte [ebp + eax - 0x18], cl
shr ecx, 8
dec eax
cmp eax, ebx
ja 0x45c6fd
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
mov edx, eax
call fcn.0047d672
push 0x10
pop ebx
test esi, esi
je 0x45c78c
xor ecx, ecx
push 2
pop eax
cmp esi, 0xff00
jb 0x45c737
not byte [ebp - 0x18]
mov ecx, eax
xor byte [ebp - 0x17], 0xfe
push 4
pop eax
lea edi, [ebp - 0x18]
mov ebx, esi
lea edx, [eax - 1]
add edi, ecx
xor byte [edi + edx], bl
shr ebx, 8
sub edx, 1
jns 0x45c741
mov edi, dword [ebp + 0x18]
add ecx, eax
mov edx, dword [ebp + 0xc]
push 0x10
pop ebx
cmp ecx, ebx
jne 0x45c76e
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
mov edx, eax
call fcn.0047d672
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov al, byte [edx]
xor byte [ebp + ecx - 0x18], al
inc ecx
inc edx
mov dword [ebp + 0xc], edx
sub esi, 1
jne 0x45c757
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
mov edx, eax
call fcn.0047d672
mov esi, dword [ebp + 0x14]
cmp edi, ebx
jb 0x45c7cd
mov eax, edi
shr eax, 4
mov dword [ebp - 0x20], eax
mov eax, dword [esi]
xor dword [ebp - 0x18], eax
mov eax, dword [esi + 4]
xor dword [ebp - 0x14], eax
mov eax, dword [esi + 8]
xor dword [ebp - 0x10], eax
mov eax, dword [esi + 0xc]
xor dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov edx, eax
push eax
call fcn.0047d672
add esi, ebx
sub edi, ebx
sub dword [ebp - 0x20], 1
jne 0x45c79b
mov dword [ebp + 0x18], edi
test edi, edi
je 0x45c7f8
mov ecx, dword [ebp + 0x18]
lea eax, [ebp - 0x18]
xor edi, edi
sub esi, eax
lea edx, [ebp - 0x18]
add edx, edi
mov al, byte [esi + edx]
xor byte [edx], al
inc edi
cmp edi, ecx
jb 0x45c7db
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
mov edx, eax
call fcn.0047d672
push dword [ebp + 0x20]
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x24]
call fcn.004c5a50
add esp, 0xc
lea eax, [ebp - 0x18]
mov byte [eax], 0
inc eax
sub ebx, 1
jne 0x45c80d
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040548e
leave
ret 0x1c
Function at 0x45c828
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4e5478]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 0xf
pop eax
sub eax, esi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], eax
dec al
push esi
mov byte [ebp - 0x18], al
lea eax, [ebp - 0x17]
push edx
push eax
call fcn.004c5a50
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x17]
add esp, 0xc
add ecx, esi
test eax, eax
je 0x45c879
mov byte [ecx], 0
inc ecx
sub eax, 1
jne 0x45c870
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x18]
call fcn.0047d672
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x45c89f
lea edx, [ebp - 0x28]
sub edx, ebx
mov al, byte [edx + ebx]
xor byte [ebx], al
inc ebx
sub ecx, 1
jne 0x45c894
mov esi, dword [ebp + 0x10]
push 0x10
pop ebx
mov byte [ebp - 9], 1
cmp esi, ebx
jb 0x45c8f4
mov eax, esi
shr eax, 4
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x18]
call fcn.0047d672
mov eax, dword [ebp - 0x28]
xor dword [edi], eax
mov eax, dword [ebp - 0x24]
xor dword [edi + 4], eax
mov eax, dword [ebp - 0x20]
xor dword [edi + 8], eax
mov eax, dword [ebp - 0x1c]
xor dword [edi + 0xc], eax
add byte [ebp - 9], 1
jne 0x45c8ea
lea ecx, [ebp - 9]
dec ecx
add byte [ecx], 1
je 0x45c8e4
add edi, ebx
sub esi, ebx
sub dword [ebp - 0x2c], 1
jne 0x45c8b5
test esi, esi
je 0x45c917
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x18]
call fcn.0047d672
lea ecx, [ebp - 0x28]
sub ecx, edi
mov al, byte [ecx + edi]
xor byte [edi], al
inc edi
sub esi, 1
jne 0x45c90c
mov ecx, ebx
lea eax, [ebp - 0x28]
mov byte [eax], 0
inc eax
sub ecx, 1
jne 0x45c91c
lea eax, [ebp - 0x18]
mov byte [eax], 0
inc eax
sub ebx, 1
jne 0x45c928
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040548e
leave
ret 0x14
Function at 0x45cb7e
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, ecx
mov dword [ebp - 0x1c], 5
push esi
push edi
mov edi, edx
mov dword [ebp - 0x28], ebx
lea ecx, [ebx + 0x40]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x24], ecx
mov eax, dword [ebx + edi*4 - 0x18]
mov esi, dword [ebx + edi*4 - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebx + edi*4 - 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + edi*4 - 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebx + edi*4]
mov dword [ebp - 0x2c], eax
mov edx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp edx, ecx
jb 0x45cc5d
mov edi, dword [edx - 0x1c]
lea ebx, [edx - 0x20]
xor esi, eax
mov ecx, dword [edx - 0x24]
sub dword [edx - 4], esi
mov eax, edi
mov esi, dword [ebx]
rol eax, 0xd
xor eax, dword [ebp - 0xc]
sub dword [edx - 8], eax
mov eax, esi
xor eax, dword [ebp - 0x14]
sub dword [edx - 0xc], eax
mov eax, ecx
rol eax, 9
xor eax, dword [ebp - 8]
sub dword [edx - 0x10], eax
mov eax, edi
mov edx, dword [edx - 0x28]
xor eax, edx
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 4]
sub dword [ebx - 0x14], eax
mov eax, ebx
mov eax, dword [eax - 0x2c]
mov dword [ebp - 0x18], eax
rol eax, 0xd
xor eax, esi
sub dword [ebx - 0x18], eax
mov eax, ebx
mov eax, dword [eax - 0x30]
mov dword [ebp - 0xc], eax
xor eax, ecx
sub edi, eax
mov eax, ebx
mov ebx, dword [ebp - 0x20]
mov dword [eax - 0x1c], edi
mov eax, dword [eax - 0x34]
mov dword [ebp - 0x14], eax
rol eax, 9
xor eax, edx
mov edx, dword [ebp - 4]
sub esi, eax
mov dword [ebx], esi
mov esi, dword [ebp - 0x18]
mov eax, dword [edx - 0x38]
mov edx, ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
cmp edx, dword [ebp - 0x24]
jae 0x45cbcf
mov ebx, dword [ebp - 0x28]
mov edi, dword [edx - 0x1c]
xor esi, eax
sub dword [edx - 4], esi
mov eax, edi
mov esi, dword [edx - 0x20]
mov ecx, dword [ebp - 0x2c]
rol eax, 0xd
xor eax, dword [ebp - 0xc]
sub dword [edx - 8], eax
mov eax, esi
xor eax, dword [ebp - 0x14]
sub dword [edx - 0xc], eax
mov ecx, dword [ecx - 4]
mov eax, ecx
rol eax, 9
xor eax, dword [ebp - 8]
sub dword [edx - 0x10], eax
mov eax, edi
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 4]
mov edx, dword [ebx + edx*4 - 8]
xor eax, edx
sub dword [ecx - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebx + eax*4 - 0xc]
mov dword [ebp - 0x18], eax
rol eax, 0xd
xor eax, esi
sub dword [ecx - 0x18], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebx + eax*4 - 0x10]
mov dword [ebp - 0xc], eax
xor eax, dword [ebp - 0x20]
sub edi, eax
mov dword [ecx - 0x1c], edi
mov edi, dword [ebp - 0x10]
mov eax, dword [ebx + edi*4 - 0x14]
mov dword [ebp - 0x14], eax
rol eax, 9
xor eax, edx
sub esi, eax
sub dword [ebp - 0x1c], 1
mov dword [ecx - 0x20], esi
lea ecx, [ebx + 0x40]
mov eax, dword [ebx + edi*4 - 0x18]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 8], eax
lea eax, [ebx + edi*4]
jne 0x45cbbf
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45ccf8
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push edi
push 5
pop ebx
mov eax, dword [esi + edx*4 - 0x14]
mov ecx, dword [esi + edx*4 - 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + edx*4 - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + edx*4 - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + edx*4 - 4]
mov dword [ebp - 8], eax
lea eax, [edx*4 - 0x40]
lea edx, [eax + esi]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], ebx
cmp esi, edx
ja 0x45ce35
mov ebx, dword [ebp - 0x14]
lea edi, [esi + 8]
mov esi, dword [ebp - 0x18]
mov edx, eax
shr edx, 6
inc edx
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
xor eax, esi
rol edx, 9
add eax, dword [edi - 4]
xor edx, ebx
add edx, dword [edi - 8]
mov esi, ecx
mov ecx, ebx
rol esi, 0xd
mov ebx, dword [ebp - 8]
xor esi, edx
add esi, dword [edi]
xor ecx, eax
add ecx, dword [edi + 4]
rol ebx, 9
xor ebx, esi
mov dword [ebp - 4], ecx
add ebx, dword [edi + 8]
mov dword [edi - 8], edx
mov dword [edi + 4], ecx
xor ecx, edx
add ecx, dword [edi + 0xc]
mov edx, dword [ebp - 4]
mov dword [edi - 4], eax
rol eax, 0xd
xor eax, ebx
rol edx, 9
add eax, dword [edi + 0x10]
xor edx, eax
mov dword [edi], esi
add edx, dword [edi + 0x18]
lea edi, [edi + 0x40]
xor esi, ecx
mov dword [edi - 0x38], ebx
add esi, dword [edi - 0x2c]
xor ebx, esi
mov dword [edi - 0x34], ecx
add ebx, dword [edi - 0x24]
mov dword [ebp - 4], edx
rol ecx, 0xd
xor ecx, edx
mov dword [edi - 0x30], eax
add ecx, dword [edi - 0x20]
mov edx, ebx
xor edx, eax
mov dword [edi - 0x2c], esi
add edx, dword [edi - 0x1c]
mov eax, dword [ebp - 4]
mov dword [edi - 0x28], eax
xor eax, edx
add eax, dword [edi - 0x14]
rol esi, 9
mov dword [edi - 0x24], ebx
xor esi, ecx
add esi, dword [edi - 0x18]
mov dword [edi - 0x1c], edx
mov dword [ebp - 0xc], edx
mov edx, eax
rol ebx, 0xd
xor edx, ecx
add edx, dword [edi - 0xc]
xor ebx, esi
add ebx, dword [edi - 0x10]
sub dword [ebp - 0x10], 1
mov dword [edi - 0x20], ecx
mov ecx, eax
mov dword [edi - 0x18], esi
mov dword [edi - 0x14], eax
mov dword [edi - 0x10], ebx
mov dword [edi - 0xc], edx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
jne 0x45cd58
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], esi
mov esi, dword [ebp - 0x20]
sub ebx, 1
mov dword [ebp - 0x1c], ebx
jne 0x45cd3e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45ce46
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ecx]
lea edx, [ecx + edx*4]
push ebx
mov ebx, dword [ecx + 0x10]
push esi
mov esi, dword [ecx + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 8]
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 0xc]
add ecx, 0x40
push 3
mov dword [ebp - 0x10], eax
pop eax
mov dword [ebp - 8], esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], eax
mov edi, edx
mov dword [ebp - 4], edi
cmp edi, ecx
jb 0x45cfba
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi - 0xc]
xor eax, edx
rol ebx, 0x19
xor ebx, esi
rol edx, 0x19
mov esi, dword [edi - 4]
sub esi, ebx
mov ebx, dword [edi - 8]
sub ebx, eax
mov edi, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
rol eax, 0xa
xor eax, esi
mov edi, dword [edi - 0x10]
sub ecx, eax
mov eax, ebx
xor edx, ecx
xor eax, dword [ebp - 8]
sub edi, eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], edi
mov edx, dword [eax - 0x14]
sub edx, dword [ebp - 0xc]
mov dword [eax - 8], ebx
mov dword [eax - 0xc], ecx
mov dword [eax - 4], esi
xor esi, edi
mov dword [eax - 0x10], edi
mov eax, dword [eax - 0x18]
sub eax, esi
rol ebx, 0xa
mov esi, dword [ebp - 4]
xor ebx, edx
mov dword [ebp - 0x18], eax
xor eax, ecx
mov ecx, dword [ebp - 0x18]
mov edi, dword [esi - 0x1c]
sub edi, ebx
mov dword [esi - 0x18], ecx
mov ebx, dword [esi - 0x20]
sub ebx, eax
mov dword [esi - 0x14], edx
mov eax, dword [ebp - 0x14]
rol eax, 0x19
xor eax, edi
mov dword [ebp - 0x10], ebx
mov dword [esi - 0x20], ebx
xor ebx, edx
mov edx, dword [ebp - 4]
mov dword [esi - 0x1c], edi
mov esi, dword [esi - 0x24]
sub esi, eax
rol ecx, 0xa
mov eax, dword [ebp - 4]
xor ecx, esi
mov edx, dword [edx - 0x28]
sub edx, ebx
xor edi, edx
mov dword [ebp - 0xc], edx
mov ebx, dword [eax - 0x2c]
mov eax, dword [eax - 0x30]
sub ebx, ecx
sub eax, edi
mov edi, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov dword [edi - 0x30], eax
mov eax, dword [ebp - 0x10]
rol eax, 0x19
mov dword [edi - 0x28], edx
xor eax, ebx
lea edx, [edi - 0x34]
mov dword [edi - 0x24], esi
mov ecx, dword [edx]
sub ecx, eax
mov dword [edi - 0x2c], ebx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
lea ecx, [edi - 0x38]
xor eax, esi
mov esi, dword [ecx]
sub esi, eax
lea eax, [edi - 0x3c]
mov edi, dword [eax]
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 0xc]
xor ebx, dword [ebp - 0x14]
rol esi, 0xa
xor esi, dword [ebp - 0x10]
sub edi, esi
mov dword [ebp - 8], edi
mov edi, dword [ebp - 4]
add edi, 0xffffffc0
mov dword [ebp - 4], edi
mov esi, dword [edi]
sub esi, ebx
mov ebx, dword [ebp - 0x10]
mov dword [edx], ebx
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov dword [ecx], edx
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0xc], esi
mov dword [edi], esi
mov esi, dword [ebp - 8]
cmp edi, ecx
jae 0x45ce8a
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
sub eax, 1
mov dword [ebp - 0x1c], eax
jne 0x45ce7d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45cfcc
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, ecx
mov dword [ebp - 0x18], 3
add edx, 0xfffffff0
mov dword [ebp - 0x20], ebx
push esi
push edi
mov eax, dword [ebx + 0xc]
mov edi, dword [ebx + 0x14]
mov esi, dword [ebx + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebx + edx*4]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x1c], eax
mov ecx, ebx
mov dword [ebp - 8], ecx
cmp ebx, eax
ja 0x45d097
mov ecx, dword [ebx]
xor edi, esi
mov esi, dword [ebx + 0x1c]
add edi, ecx
xor edx, esi
mov ecx, dword [ebx + 0x24]
mov dword [ebx], edi
mov edi, dword [ebx + 0x18]
mov eax, edi
rol eax, 0xa
xor eax, dword [ebp - 4]
add dword [ebx + 4], eax
mov eax, dword [ebx + 0x20]
mov dword [ebp - 8], eax
rol eax, 0x19
xor eax, dword [ebp - 0x10]
add dword [ebx + 0xc], eax
mov eax, ecx
xor eax, edi
add dword [ebx + 8], edx
add dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x28]
mov dword [ebp - 0x14], eax
rol eax, 0xa
xor eax, esi
add dword [ebx + 0x14], eax
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 4]
add eax, edi
mov edi, dword [ebx + 0x34]
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x30]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
rol eax, 0x19
xor eax, ecx
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp - 8]
add eax, esi
mov esi, dword [ebp - 0x14]
mov dword [ebx + 0x1c], eax
add ebx, 0x20
cmp ebx, dword [ebp - 0x1c]
jbe 0x45d013
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
xor edi, esi
mov esi, dword [ecx + 0x1c]
add dword [ecx], edi
xor edx, esi
mov edi, dword [ecx + 0x18]
mov eax, edi
add dword [ecx + 8], edx
rol eax, 0xa
xor eax, dword [ebp - 4]
add dword [ecx + 4], eax
mov edx, dword [ebx]
mov eax, edx
rol eax, 0x19
xor eax, dword [ebp - 0x10]
add dword [ecx + 0xc], eax
mov ecx, dword [ebx + 4]
mov eax, ecx
xor eax, edi
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 8]
add dword [ecx + 0x10], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x14], eax
rol eax, 0xa
xor eax, esi
add dword [ecx + 0x14], eax
mov eax, dword [ebx + 0xc]
xor edx, eax
add edx, edi
mov dword [ebp - 4], eax
mov edi, ecx
mov dword [edi + 0x18], edx
mov edx, dword [ebx + 0x10]
mov eax, edx
rol eax, 0x19
xor eax, dword [ebp - 0x10]
add eax, esi
sub dword [ebp - 0x18], 1
mov esi, dword [ebp - 0x14]
mov dword [edi + 0x1c], eax
mov edi, dword [ebx + 0x14]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edi
jne 0x45d004
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45d116
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, edx
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ecx + 8]
mov dword [ebp - 0x10], eax
add eax, 8
shr edx, 4
push esi
mov esi, dword [ecx]
push edi
mov edi, dword [ecx + 4]
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], edx
mov edx, dword [ebp - 8]
xor dword [eax - 8], esi
xor dword [eax - 4], edi
xor dword [eax], ebx
lea eax, [eax + 0x40]
xor dword [eax - 0x3c], edx
xor dword [eax - 0x28], esi
xor dword [eax - 0x24], edi
xor dword [eax - 0x20], ebx
xor dword [eax - 0x1c], edx
sub dword [ebp - 4], 1
jne 0x45d146
mov eax, dword [ebp + 8]
mov esi, dword [ecx + 0x10]
add eax, 0xfffffff4
mov edi, dword [ecx + 0x14]
mov ebx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x1c]
mov edx, dword [ebp - 0xc]
cmp eax, 4
jb 0x45d1a5
mov eax, dword [ebp - 0x10]
add eax, 0x18
xor dword [eax - 8], esi
xor dword [eax - 4], edi
xor dword [eax], ebx
lea eax, [eax + 0x40]
xor dword [eax - 0x3c], ecx
xor dword [eax - 0x28], esi
xor dword [eax - 0x24], edi
xor dword [eax - 0x20], ebx
xor dword [eax - 0x1c], ecx
sub edx, 1
jne 0x45d186
pop edi
pop esi
pop ebx
leave
ret 4