joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4764a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x1c]
mov edx, ecx
mov dword [ebp - 4], edx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
test ebx, ebx
jne 0x4764e4
cmp byte [edx + 5], bl
jne 0x4764df
mov eax, edi
cmp esi, edi
jb 0x4764db
mov eax, esi
mov ecx, edi
sub eax, ecx
mov ecx, 0x7ffff000
cmp ecx, eax
sbb ebx, ebx
and ebx, 5
add ebx, 5
jmp 0x4764e4
mov ecx, esi
jmp 0x4764c8
mov ebx, 5
cmp byte [edx + 5], 0
jne 0x476544
cmp ebx, 5
je 0x47651f
mov eax, ebx
cmp ebx, 0xa
jne 0x47663b
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
lea esi, [edx + 6]
add esi, ecx
mov word [ecx + edx], 0x25ff
mov dword [ecx + edx + 2], esi
mov ecx, dword [ebp + 0x18]
add ecx, edi
pop edi
mov dword [esi], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov ecx, dword [ebp + 0x10]
sub edi, esi
mov eax, dword [ebp + 0x18]
sub edi, ecx
mov edx, dword [ebp + 0xc]
add eax, 0xfffffffb
add eax, edi
pop edi
pop esi
mov dword [edx + ecx + 1], eax
mov eax, ebx
mov byte [edx + ecx], 0xe9
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [edx]
mov ecx, edx
mov eax, dword [eax + 0x18]
call eax
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x476564
mov edx, dword [eax + 0x3c]
add edx, eax
cmp dword [edx], 0x4550
je 0x476566
xor edx, edx
movzx ecx, word [edx + 0x14]
movzx eax, word [edx + 6]
add ecx, 0x18
mov edi, dword [ebp + 0x10]
add ecx, edx
add edi, esi
mov dword [ebp + 0x1c], eax
xor edx, edx
xor esi, esi
cmp dx, ax
jae 0x4765a4
test edi, edi
je 0x47659b
mov edx, dword [ecx + 0x14]
cmp edi, edx
jb 0x47659b
mov eax, dword [ecx + 0x10]
add eax, edx
cmp edi, eax
jb 0x4765a6
mov eax, dword [ebp + 0x1c]
inc esi
add ecx, 0x28
cmp si, ax
jb 0x476584
xor ecx, ecx
mov eax, dword [ecx + 0xc]
sub eax, dword [ecx + 0x14]
add eax, dword [ebp + 8]
add eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
mov dword [ebp + 0x1c], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0x18]
call eax
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4765d6
mov esi, dword [eax + 0x3c]
add esi, eax
cmp dword [esi], 0x4550
je 0x4765d8
xor esi, esi
movzx edx, word [esi + 0x14]
xor ecx, ecx
movzx eax, word [esi + 6]
add edx, 0x18
mov edi, dword [ebp + 0x14]
add edx, esi
add edi, dword [ebp + 0x18]
xor esi, esi
mov dword [ebp + 8], eax
cmp si, ax
jae 0x476617
test edi, edi
je 0x47660e
mov esi, dword [edx + 0x14]
cmp edi, esi
jb 0x47660e
mov eax, dword [edx + 0x10]
add eax, esi
cmp edi, eax
jb 0x476619
mov eax, dword [ebp + 8]
inc ecx
add edx, 0x28
cmp cx, ax
jb 0x4765f7
xor edx, edx
mov ecx, dword [edx + 0xc]
sub ecx, dword [edx + 0x14]
add ecx, dword [ebp + 0x14]
add ecx, dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub ecx, dword [ebp + 0x1c]
sub ecx, 5
mov byte [eax + edx], 0xe9
mov dword [eax + edx + 1], ecx
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x480c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov dword [esp - 0x38], 0x7d0841aa
push ebx
push esi
mov esi, ecx
xchg edi, edi
push edi
cmp dword [esi + 4], 2
jbe 0x480ca2
mov dword [esp - 0x44], 0x2aec1e13
push dword [esi]
call fcn.0048b6f0
add esp, 4
mov dword [esp - 0x20], 0x540a29b0
mov ebx, dword [ebp + 8]
mov ecx, ebx
lea edx, [ecx + 2]
mov dword [esp - 0x28], esp
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x480cae
mov dword [esp - 0x44], ecx
sub ecx, edx
mov edx, esi
sar ecx, 1
mov dword [esi + 4], ecx
mov dword [esp - 0x28], 0xf883c37
cmp ecx, 2
jbe 0x480d25
lea eax, [ecx + 1]
xchg ebp, ebp
mov edx, 0x9f68136
xor edx, 0x21d57a79
xor edx, 0x17e28d9c
sub edx, 0xc0cf2af
mov dword [esp - 0x10], ebp
sub edx, 0x2bff65c9
xor edx, 0x7b51e59
xor ecx, ecx
mov ebp, ebp
mul edx
seto cl
neg ecx
or ecx, eax
mov dword [esp - 0x10], ebx
push ecx
call fcn.0048b720
mov edx, eax
mov dword [esp - 0xc], 0x5fe263ab
add esp, 4
mov dword [esi], edx
xor edi, edi
mov esp, esp
cmp dword [esi + 4], edi
jbe 0x480d80
sub ebx, edx
mov dword [esp - 0x34], esp
mov ecx, edi
lea edx, [edx + 2]
and ecx, 3
mov eax, 0xc02d750
mov ecx, ecx
xor eax, 0x33cde3c9
xor eax, 0x4dca2687
xor eax, 0x97d581c
mov esi, esi
sub eax, 0x63ce9955
xor eax, 0x64d794ed
shl ecx, 3
mov dword [esp - 0x2c], edi
inc edi
sar eax, cl
cbw
mov dword [esp - 0x10], ebx
xor ax, word [ebx + edx - 2]
mov word [edx - 2], ax
cmp edi, dword [esi + 4]
jb 0x480d34
mov dword [esp - 0x18], esp
pop edi
mov eax, esi
pop esi
xchg ebp, ebp
pop ebx
pop ebp
ret 4
Function at 0x481260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, ecx
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
mov esi, esi
xor ecx, ecx
push esi
mov esi, 0x2a26d85a
xchg edi, edi
sub esi, 0x11c5b4f3
add esi, 0x3cbdacee
xor esi, 0x25166e9
sub esi, 0x574fb6ba
xchg ebx, ebx
push edi
mov eax, dword [ebx + 4]
add eax, 2
mov dword [ebp - 0xc], eax
mov dword [esp - 0x20], edx
mul esi
seto cl
neg ecx
or ecx, eax
mov dword [esp - 0x30], 0x2e18e85f
push ecx
call fcn.0048b720
mov dword [ebp - 4], eax
add esp, 4
xchg esi, esi
mov eax, dword [ebx + 4]
mov dword [ebp + 0xc], eax
cmp eax, esi
jbe 0x4812d3
mov dword [esp - 0xc], 0xe418954
mov ebx, dword [ebx]
xor ecx, ecx
inc eax
mul esi
mov ecx, ecx
seto cl
neg ecx
or ecx, eax
push ecx
mov esi, esi
call fcn.0048b720
mov esi, eax
add esp, 4
mov eax, dword [ebp + 0xc]
xchg edx, edx
xor edi, edi
mov dword [ebp - 8], esi
test eax, eax
je 0x48136c
mov dword [esp - 0x18], 0x66ef3f56
mov edx, esi
sub ebx, esi
mov esi, eax
mov ecx, edi
mov dword [esp - 0x28], edx
lea edx, [edx + 2]
and ecx, 3
mov eax, 0x610ed4ab
mov dword [esp - 0x1c], 0x26faa1c9
sub eax, 0x47ec8ac0
xor eax, 0xef31eb9
xor eax, 0x5e016452
mov dword [esp - 0x10], edi
xor eax, 0x79993e88
add eax, 0x469d1779
xor eax, 0x5980141
shl ecx, 3
xchg edx, edx
inc edi
sar eax, cl
cbw
mov ecx, ecx
xor ax, word [ebx + edx - 2]
mov word [edx - 2], ax
cmp edi, esi
jb 0x48130a
mov dword [esp - 0x1c], 0x34e2fe03
mov esi, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp - 0xc]
mov ebp, ebp
xor ecx, ecx
mov ebx, dword [ebp - 4]
push esi
xchg esp, esp
push edi
push ebx
mov word [esi + eax*2], cx
call fcn.0048c0a0
mov ebx, ebx
push esi
call fcn.0048b6f0
mov ax, word [ebp + 0x10]
mov dword [esp - 0x3c], esi
add esp, 0x10
mov word [ebx + edi*2 - 4], ax
mov edx, ebx
xor eax, eax
mov dword [esp - 0x44], 0xe1c604e
mov word [ebx + edi*2 - 2], ax
mov edi, dword [ebp + 8]
lea ecx, [edx + 2]
mov dword [edi], eax
mov dword [esp - 0x2c], esi
mov ax, word [edx]
add edx, 2
test ax, ax
mov dword [esp - 0x1c], 0x69bd77d1
jne 0x4813b9
sub edx, ecx
mov esi, edi
sar edx, 1
xchg edi, edi
mov dword [edi + 4], edx
cmp edx, 2
jbe 0x481423
mov edi, edi
xor ecx, ecx
mov eax, edx
mov edx, 0x55a01594
xchg ebp, ebp
add edx, 0x1e6fe615
xor edx, 0x34ce81e7
xor edx, 0x6bd93050
add edx, 0x497c1d56
mov esi, esi
sub edx, 0x74946772
mul edx
seto cl
neg ecx
xchg ebx, ebx
or ecx, eax
push ecx
call fcn.0048b720
mov esi, eax
xchg ebp, ebp
add esp, 4
mov dword [edi], esi
xor edx, edx
cmp dword [edi + 4], edx
xchg edi, edi
jbe 0x481479
sub ebx, esi
mov ecx, edx
xchg ecx, ecx
lea esi, [esi + 2]
and ecx, 3
mov eax, 0x19f267c6
xor eax, 0x45894f05
mov dword [esp - 0x14], ecx
sub eax, 0x4c7c1abf
add eax, 0x5275e93d
sub eax, 0x3f86cc03
add eax, 0x508ff902
mov ebx, ebx
shl ecx, 3
inc edx
sar eax, cl
xchg ebp, ebp
cbw
xor ax, word [ebx + esi - 2]
mov word [esi - 2], ax
mov edx, edx
cmp edx, dword [edi + 4]
jb 0x48142e
mov ebx, dword [ebp - 4]
push ebx
xchg esi, esi
call fcn.0048b6f0
add esp, 4
mov eax, edi
pop edi
mov edi, edi
pop esi
pop ebx
mov esp, ebp
pop ebp
mov dword [esp - 0x3c], esp
ret
Function at 0x4814a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [esp - 0x18], ecx
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
mov ebx, ebx
push edi
mov dword [ebp - 0xc], esi
mov ebx, dword [esi + 4]
mov dword [esp - 0x1c], 0x603227ee
lea eax, [ecx + 4]
mov dword [ebp - 8], eax
mov eax, dword [eax]
add eax, ebx
mov ebp, ebp
mov dword [esi + 4], eax
cmp eax, 2
jbe 0x481584
cmp ebx, 2
mov dword [esp - 0x40], 0x74235c0d
jbe 0x4814eb
mov edi, dword [esi]
jmp 0x4814ed
mov edi, esi
xor ecx, ecx
mov edx, 0x46f627ec
sub edx, 0xc13fc3
xchg edi, edi
add edx, 0x35bdef6a
sub edx, 0x5c69f1e7
sub edx, 0x1f88e5aa
mul edx
mov ecx, ecx
seto cl
neg ecx
or ecx, eax
mov dword [esp - 0xc], 0x5e606693
push ecx
call fcn.0048b720
add esp, 4
mov dword [ebp - 4], eax
mov dword [esp - 0x1c], 0x5471ad64
test ebx, ebx
je 0x481567
mov ecx, eax
sub edi, eax
mov ecx, ecx
mov edx, ebx
jmp 0x48154a
mov ax, word [edi + ecx]
lea ecx, [ecx + 2]
xchg esi, esi
mov word [ecx - 2], ax
sub edx, 1
jne 0x48154a
mov eax, dword [ebp - 4]
mov dword [esp - 0x10], 0x6711c9f8
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
xor edi, edi
mov edx, dword [edx]
mov esp, esp
cmp edx, 2
ja 0x48158b
test edx, edx
je 0x48163e
xchg edx, edx
jmp 0x481590
mov eax, esi
mov dword [ebp - 4], eax
jmp 0x48156a
mov ecx, dword [ecx]
mov dword [ebp + 8], ecx
lea esi, [eax + ebx*2]
mov esi, esi
jmp 0x48159e
lea ecx, [edi + ebx]
mov edx, 0x2fb6f931
add edx, 0x2d707435
mov ebx, ebx
xor edx, 0x43406ae6
add edx, 0x4b0bbd12
sub edx, 0xfcdb24f
add edx, 0x19d911fd
mov dword [esp - 0x24], 0x1c160c34
and ecx, 3
lea esi, [esi + 2]
shl ecx, 3
xchg ecx, ecx
mov eax, 0x461ba922
add eax, 0x29ba2275
xor eax, 0x4e8bc537
mov dword [esp - 0x14], 0x66b0a251
xor eax, 0x4fdfe89b
xor eax, 0x4dfcf766
sub eax, 0x132c400
xor eax, 0x5134691d
mov dword [esp - 0x38], esi
sar edx, cl
mov ecx, edi
and ecx, 3
shl ecx, 3
mov esp, esp
sar eax, cl
mov ecx, dword [ebp + 8]
xor dl, al
movsx ax, dl
mov dword [esp - 0x44], ebp
xor ax, word [ecx + edi*2]
inc edi
mov word [esi - 2], ax
xchg edi, edi
mov eax, dword [ebp - 8]
cmp edi, dword [eax]
jb 0x48159e
mov esi, dword [ebp - 0xc]
xchg ecx, ecx
cmp ebx, 2
jbe 0x481651
push dword [esi]
mov dword [esp - 0xc], ebx
call fcn.0048b6f0
add esp, 4
cmp dword [esi + 4], 2
mov ebp, ebp
jbe 0x481660
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov edx, edx
pop edi
mov eax, esi
pop esi
mov dword [esp - 0x24], 0x11066a9b
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x481680
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov dword [esp - 0x30], 0x79e77324
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [esp - 0x18], ecx
push edi
mov edi, ecx
mov dword [ebp - 0xc], edi
lea edx, [esi + 2]
mov dword [esp - 0x1c], ebp
mov ecx, dword [edi + 4]
mov dword [ebp - 8], ecx
lea ebx, [ebx]
mov ax, word [esi]
mov dword [esp - 0x40], 0x2795fa64
add esi, 2
test ax, ax
jne 0x4816b0
mov dword [esp - 0x34], edx
sub esi, edx
sar esi, 1
lea eax, [ecx + esi]
mov dword [edi + 4], eax
mov ecx, ecx
cmp eax, 2
jbe 0x481773
cmp ecx, 2
jbe 0x4816ed
mov dword [esp - 0x18], 0x63f9f73c
mov ebx, dword [edi]
jmp 0x4816ef
mov ebx, edi
xor ecx, ecx
xchg esp, esp
mov edx, 0x3599e077
sub edx, 0xb078f13
add edx, 0x4c748168
xor edx, 0x601825ba
mov dword [esp - 0x30], esp
xor edx, 0x3ec77fec
add edx, 0xfe5c882
sub edx, 0x39bf511a
mul edx
mov dword [esp - 0x18], 0x7303d122
seto cl
neg ecx
or ecx, eax
push ecx
mov esp, esp
call fcn.0048b720
mov ecx, eax
add esp, 4
mov eax, dword [ebp - 8]
mov esi, esi
mov dword [ebp - 4], ecx
test eax, eax
je 0x481778
mov dword [esp - 0x20], ecx
sub ebx, ecx
mov edx, eax
mov edi, edi
mov ax, word [ebx + ecx]
mov dword [esp - 0x3c], 0x7cb1085f
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
sub edx, 1
xchg edx, edx
jne 0x481754
mov ecx, dword [ebp - 4]
jmp 0x481778
mov ecx, edi
mov dword [ebp - 4], edi
xor edx, edx
test esi, esi
xchg ecx, ecx
je 0x4817fa
mov edi, dword [ebp - 8]
lea ebx, [ecx + edi*2]
jmp 0x481790
lea ecx, [edx + edi]
mov eax, 0xfe6e2f5
sub eax, 0x4549437
mov dword [esp - 0x28], esp
sub eax, 0x6a418d1
xor eax, 0x4810b447
xor eax, 0x19af104c
mov dword [esp - 0xc], 0x4d6f6d6b
sub eax, 0x13100b47
add eax, 0x313c9da1
and ecx, 3
mov dword [esp - 0x10], edi
lea ebx, [ebx + 2]
shl ecx, 3
sar eax, cl
mov dword [esp - 0x40], 0x2522d0c7
mov ecx, dword [ebp + 8]
cbw
xor ax, word [ecx + edx*2]
mov dword [esp - 0x10], 0x787f1ae2
inc edx
mov word [ebx - 2], ax
cmp edx, esi
mov dword [esp - 0x38], esp
jb 0x481790
mov edi, dword [ebp - 0xc]
cmp dword [ebp - 8], 2
jbe 0x48180c
xchg ecx, ecx
push dword [edi]
call fcn.0048b6f0
add esp, 4
cmp dword [edi + 4], 2
mov dword [esp - 0x3c], 0x71c89783
mov eax, edi
jbe 0x481825
mov edx, dword [ebp - 4]
mov dword [edi], edx
mov dword [esp - 0x2c], edi
pop edi
pop esi
pop ebx
mov ebp, ebp
mov esp, ebp
pop ebp
ret 4
Function at 0x481a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov dword [esp - 0x1c], 0x2e4b3e63
mov esi, dword [ebp + 8]
mov dword [esi], 0x35af412f
xor dword [esi], 0x19bcd3fb
add dword [esi], 0x34cd5617
xchg ebx, ebx
sub dword [esi], 0x16c6f8d9
sub dword [esi], 0xec08dc7
xor dword [esi], 0x1807724c
xor dword [esi], 0x235e1007
mov dword [esp - 0x28], esp
mov dword [esi + 4], 0x4c095aa5
xor dword [esi + 4], 0x5e42db92
xor dword [esi + 4], 0x66e339e6
mov esi, esi
xor dword [esi + 4], 0x689eb912
sub dword [esi + 4], 0x1c3601c3
mov eax, dword [ecx + 4]
cmp edx, eax
mov ecx, ecx
jae 0x481bdf
cmp eax, 2
jbe 0x481a8f
mov dword [esp - 0x24], esi
mov ecx, dword [ecx]
push ebx
sub eax, edx
lea ecx, [ecx + edx*2]
mov dword [esp - 0x10], ebx
push edi
mov edi, dword [ebp + 0x10]
mov ebx, esi
mov dword [esp - 0x24], esi
cmp eax, edi
mov dword [ebp + 8], ecx
cmovb edi, eax
mov dword [esp - 0x3c], 0x2fbdc0cf
mov dword [esi + 4], edi
cmp edi, 2
jbe 0x481b12
xor ecx, ecx
xchg esi, esi
mov eax, edi
mov edx, 0x3a7d3565
sub edx, 0x196eb8b8
mov dword [esp - 0x3c], 0x4379108e
sub edx, 0x1062bab1
xor edx, 0x6f37e19d
xor edx, 0x7f9c2063
mov dword [esp - 0x24], ebp
mul edx
seto cl
neg ecx
mov ebx, ebx
or ecx, eax
push ecx
call fcn.0048b720
mov edx, dword [ebp + 0xc]
mov ecx, ecx
mov ebx, eax
mov ecx, dword [ebp + 8]
add esp, 4
mov dword [esp - 0x44], 0x31ed000c
mov dword [esi], ebx
xor edi, edi
cmp dword [esi + 4], edi
mov dword [esp - 0xc], 0x8b22af6
jbe 0x481bc6
sub ecx, ebx
mov dword [ebp + 8], ecx
jmp 0x481b34
lea ecx, [edi + edx]
mov eax, 0x1a4d1e47
add eax, 0x6c11d50
add eax, 0x48874057
mov dword [esp - 0x34], 0x53e3c397
add eax, 0x762ceb5
sub eax, 0x2fdc2ab3
add eax, 0x32620450
mov esp, esp
and ecx, 3
lea ebx, [ebx + 2]
shl ecx, 3
mov edx, 0x612ed4ce
mov dword [esp - 0x28], 0x44cf402d
sub edx, 0x460250ea
add edx, 0x5e353e38
sub edx, 0x61ea810
mov ebp, ebp
add edx, 0x3b0a34
sar edx, cl
mov ecx, edi
and ecx, 3
xchg edx, edx
inc edi
shl ecx, 3
sar eax, cl
xor dl, al
mov esi, esi
mov eax, dword [ebp + 8]
movsx cx, dl
mov edx, dword [ebp + 0xc]
mov dword [esp - 0xc], ebx
xor cx, word [eax + ebx - 2]
mov word [ebx - 2], cx
cmp edi, dword [esi + 4]
mov dword [esp - 0x1c], ebp
jb 0x481b34
pop edi
pop ebx
mov dword [esp - 0x30], 0x100df1d2
mov eax, esi
pop esi
pop ebp
mov dword [esp - 0x3c], 0x4e56fd7
ret 0xc
mov eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x481c70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov dword [esp - 0x40], 0x75b5e93c
push ebx
mov ebx, ecx
push esi
mov esi, dword [ebp + 0xc]
mov edi, edi
push edi
mov eax, dword [ebx]
cmp esi, 7
mov dword [esp - 0x40], edi
ja case.default.0x481c93
jmp dword [esi*4 + 0x481ea8]
mov ecx, edx
and ecx, 3
sub esi, ecx
mov dword [esp - 0x18], esp
sub ecx, 1
je 0x481ce6
sub ecx, 1
mov ebx, ebx
je 0x481ccd
sub ecx, 1
jne 0x481cfb
movzx ecx, byte [edx]
xchg edi, edi
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4bb1a0]
xchg esi, esi
inc edx
movzx ecx, byte [edx]
xor ecx, eax
xchg esi, esi
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4bb1a0]
mov dword [esp - 0x40], ecx
inc edx
movzx ecx, byte [edx]
xor ecx, eax
shr eax, 8
xchg ebx, ebx
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4bb1a0]
inc edx
mov edi, esi
mov ecx, ecx
shr edi, 3
test edi, edi
je 0x481d9f
mov dword [esp - 0x3c], 0xdf049ea
xor eax, dword [edx]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4bb1a0]
xchg edx, edx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4bb1a0]
movzx ecx, al
xchg edx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x4bb1a0]
movzx ecx, al
mov ebp, ebp
shr eax, 8
xor eax, dword [ecx*4 + 0x4bb1a0]
xor eax, dword [edx + 4]
add edx, 8
mov dword [esp - 0x2c], ecx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4bb1a0]
mov dword [esp - 0x44], esp
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4bb1a0]
mov edi, edi
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4bb1a0]
mov edi, edi
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x4bb1a0]
xchg edi, edi
sub edi, 1
jne 0x481d12
and esi, 7
mov dword [esp - 0x38], 0xf45e6d9
jmp 0x481c8a
movzx ecx, byte [edx]
xor ecx, eax
mov dword [esp - 0x2c], edx
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4bb1a0]
inc edx
xchg edi, edi
movzx ecx, byte [edx]
xor ecx, eax
shr eax, 8
xchg ebx, ebx
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4bb1a0]
inc edx
mov dword [esp - 0x14], ebp
movzx ecx, byte [edx]
xor ecx, eax
shr eax, 8
mov dword [esp - 0x14], ebx
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4bb1a0]
inc edx
xor eax, dword [edx]
mov esp, esp
movzx ecx, al
shr eax, 8
pop edi
xchg esp, esp
pop esi
xor eax, dword [ecx*4 + 0x4bb1a0]
movzx ecx, al
mov dword [esp - 0x28], edi
shr eax, 8
xor eax, dword [ecx*4 + 0x4bb1a0]
movzx ecx, al
mov edx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x4bb1a0]
movzx ecx, al
shr eax, 8
mov dword [esp - 0xc], 0x384c62ba
xor eax, dword [ecx*4 + 0x4bb1a0]
mov dword [ebx], eax
pop ebx
pop ebp
mov edi, edi
ret 8
movzx ecx, byte [edx]
xor ecx, eax
mov dword [esp - 0x40], 0xdb59b67
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4bb1a0]
xchg ebp, ebp
inc edx
movzx ecx, byte [edx]
xor ecx, eax
mov esi, esi
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4bb1a0]
xchg edi, edi
inc edx
movzx ecx, byte [edx]
xor ecx, eax
shr eax, 8
xchg ebp, ebp
movzx ecx, cl
xor eax, dword [ecx*4 + 0x4bb1a0]
pop edi
mov dword [esp - 0x24], 0x23c32f08
pop esi
mov dword [ebx], eax
pop ebx
pop ebp
xchg edx, edx
ret 8
Function at 0x481ed0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4bb1a4], 0
jne 0x481fbc
xchg ebp, ebp
xor edx, edx
nop
mov ecx, edx
mov ebp, ebp
mov eax, edx
and ecx, 1
shr eax, 1
neg ecx
mov dword [esp - 0x3c], 0x42f668bf
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
xchg edx, edx
and eax, 1
neg eax
and eax, 0xedb88320
xchg esi, esi
xor eax, ecx
mov ecx, eax
shr eax, 1
xchg ebx, ebx
and ecx, 1
neg ecx
and ecx, 0xedb88320
xchg esi, esi
xor ecx, eax
mov eax, ecx
shr ecx, 1
xchg edx, edx
and eax, 1
neg eax
and eax, 0xedb88320
xchg ebx, ebx
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
mov dword [esp - 0x14], esi
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov esi, esi
shr ecx, 1
and eax, 1
neg eax
mov dword [esp - 0x28], 0x1a5da928
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
xchg edi, edi
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov ebx, ebx
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [esp - 0x44], 0x24af1a92
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [esp - 0x30], 0x7b361d5c
xor eax, ecx
mov dword [edx*4 + 0x4bb1a0], eax
inc edx
cmp edx, 0x100
mov dword [esp - 0x34], 0x6018b149
jb 0x481ee2
ret
Function at 0x482ab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [esp - 0x40], esi
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, 0x251880fb
mov dword [esp - 0x18], esi
add edx, 0x28e141ea
sub edx, 0x1caf5321
add edx, 0x267a1134
mov dword [esp - 0x10], esp
sub edx, 0x57c480f4
push edi
mov dword [ebp - 4], ecx
mov edi, esi
xchg esp, esp
shr edi, 2
xor ecx, ecx
mov eax, edi
mul edx
mov ebp, ebp
seto cl
neg ecx
or ecx, eax
push ecx
xchg esi, esi
call fcn.0048b720
add esp, 4
mov ebx, eax
mov dword [esp - 0x14], ebx
push esi
mov esi, dword [ebp - 4]
push ebx
xchg esi, esi
lea ecx, [esi + 4]
call fcn.00477390
test al, al
je 0x482b80
xchg ebx, ebx
mov esi, dword [esi]
test edi, edi
je 0x482b4a
mov dword [esp - 0x40], ebx
mov eax, dword [ebp + 8]
mov edx, ebx
sub edx, eax
lea ecx, [ecx]
xchg ebx, ebx
mov ecx, dword [edx + eax]
lea eax, [eax + 4]
xor ecx, esi
xchg edi, edi
mov dword [eax - 4], ecx
sub edi, 1
jne 0x482b38
push ebx
mov dword [esp - 0x18], ebp
call fcn.0048b6f0
add esp, 4
mov al, 0x2c
mov dword [esp - 0x28], ebp
add al, 0x23
sub al, 0x2f
add al, 0x49
sub al, 0x49
mov dword [esp - 0xc], 0x6eda86e2
xor al, 0x71
xor al, 0x50
pop edi
pop esi
mov dword [esp - 0x10], ecx
pop ebx
mov esp, ebp
pop ebp
xchg esi, esi
ret 8
push ebx
call fcn.0048b6f0
xchg esp, esp
add esp, 4
xor al, al
pop edi
xchg esi, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
mov dword [esp - 0x28], 0x2ded73f2
ret 8

Function at 0x482ba0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edi, edi
push ecx
push ebx
push esi
xchg ebx, ebx
mov esi, dword [ebp + 0xc]
mov ebx, ecx
shr esi, 2
mov esp, esp
xor ecx, ecx
mov eax, esi
mov dword [ebp - 4], ebx
mov dword [esp - 0x3c], esi
mov edx, 0x92a17d9
add edx, 0x45e8bdcc
sub edx, 0x10e5d73e
sub edx, 0x2e233a65
xchg edx, edx
sub edx, 0x1009c3fe
mul edx
push edi
mov dword [esp - 0x20], edi
seto cl
neg ecx
or ecx, eax
mov dword [esp - 0x1c], 0x3e775bb1
push ecx
call fcn.0048b720
mov ebx, dword [ebx]
add esp, 4
mov ecx, ecx
mov edi, eax
test esi, esi
je 0x482c30
mov dword [esp - 0x1c], 0x6fc0ab8f
mov edx, dword [ebp + 8]
mov ecx, edi
sub edx, edi
lea esp, [esp]
mov dword [esp - 0x28], ebp
mov eax, dword [edx + ecx]
lea ecx, [ecx + 4]
xor eax, ebx
mov dword [ecx - 4], eax
xchg edx, edx
sub esi, 1
jne 0x482c1e
push dword [ebp + 0xc]
mov edx, edx
mov ecx, dword [ebp - 4]
push edi
add ecx, 4
call fcn.00477900
xchg esi, esi
push edi
test al, al
je 0x482c81
call fcn.0048b6f0
mov dword [esp - 0x34], 0x65afb2ef
add esp, 4
mov al, 0x41
sub al, 0x3a
add al, 0x2f
xchg ecx, ecx
add al, 0x1a
sub al, 0x2b
sub al, 0x21
sub al, 3
mov dword [esp - 0x38], 0x4cf44cc2
pop edi
pop esi
pop ebx
mov dword [esp - 0x18], 0x75b7c79e
mov esp, ebp
pop ebp
ret 8
call fcn.0048b6f0
add esp, 4
xor al, al
pop edi
mov dword [esp - 0x3c], 0x219aa0cf
pop esi
pop ebx
mov esp, ebp
pop ebp
xchg ecx, ecx
ret 8
Function at 0x482ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x599d427c
mov edi, edi
xor eax, 0x1a1bb24e
sub eax, 0x216ff43e
xor eax, 0x67624d9c
sub eax, 0x3175e97f
mov dword [esp - 0x34], ecx
xor eax, 0x13fedce1
call fcn.0048c8c0
push ebx
mov dword [esp - 0xc], edx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebp, ebp
call fcn.0048c8f0
mov ebx, eax
mov edi, 0x5927ba42
sub edi, 0x35dc9ca4
mov dword [esp - 0x3c], esp
sub edi, 0xe21bb6e
add edi, 0x929d794
xor edi, 0x7df65d31
sub edi, 0x63a564f5
mov dword [esp - 0x1c], 0x625d2caa
and ebx, 0x3ff
jbe 0x482d43
call fcn.0048c8f0
mov ebp, ebp
movzx esi, ax
shl esi, 0x10
call fcn.0048c8f0
xchg ebx, ebx
movzx eax, ax
or eax, esi
mov dword [ebp + edi*4 - 0x1008], eax
inc edi
mov dword [esp - 0xc], 0x45e007fa
cmp edi, ebx
jb 0x482d16
lea eax, [ebx*4]
xor ecx, ecx
mov ebx, ebx
mov dword [ebp - 8], eax
mov edx, 0x56c292b
add edx, 0x5d4438e2
mov dword [esp - 0x44], esp
add edx, 0x16a0d341
sub edx, 0x6ee1924f
xor edx, 0xf87aa5c
sub edx, 0x5e8089f
xchg edx, edx
mov eax, ebx
mul edx
seto cl
mov dword [esp - 0x40], esp
neg ecx
or ecx, eax
push ecx
mov esi, esi
call fcn.0048b720
mov edi, eax
add esp, 4
xchg esi, esi
mov eax, dword [ebp - 4]
mov esi, dword [eax]
test ebx, ebx
je 0x482dca
xchg edi, edi
lea edx, [ebp - 0x1008]
mov ecx, edi
sub edx, edi
mov eax, dword [edx + ecx]
mov edx, edx
lea ecx, [ecx + 4]
xor eax, esi
mov dword [ecx - 4], eax
sub ebx, 1
mov dword [esp - 0x28], 0x3f5bf1bb
jne 0x482dad
mov eax, dword [ebp - 4]
push dword [ebp - 8]
mov dword [esp - 0x14], edi
lea ecx, [eax + 4]
push edi
call fcn.00477900
test al, al
mov dword [esp - 0x1c], 0x56d10277
push edi
setne bl
call fcn.0048b6f0
xchg ebx, ebx
add esp, 4
mov al, bl
pop edi
mov ebp, ebp
pop esi
pop ebx
mov esp, ebp
mov esi, esi
pop ebp
ret