joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462c10
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x28]
lea ecx, [eax - 1]
cmp ecx, 0xffff
jb 0x462c45
push eax
push str.Zip:_Invalid_filename_of_length__zu
push str.ziparchive
push 5
call fcn.004932d0
add esp, 0x10
mov eax, 0xfffffff6
jmp 0x462d5b
mov edx, dword [esp + 0x20]
lea eax, [esp + 0x24]
mov ebx, dword [eax + 4]
mov ecx, dword [edx + 0x28]
mov ebp, dword [edx + 0x3c]
cmp ebx, 4
mov dword [esp + 8], ecx
mov ecx, dword [edx + 0x38]
mov dword [esp + 4], ecx
mov ecx, dword [eax]
mov eax, ebx
mov edx, ecx
mov edx, ebx
mov dword [esp], ecx
jb 0x462cb7
mov edx, dword [esp]
mov ecx, ebx
mov eax, ebx
nop dword [eax + eax]
imul esi, dword [edx], 0x5bd1e995
imul eax, eax, 0x5bd1e995
add ecx, 0xfffffffc
add edx, 4
mov edi, esi
shr edi, 0x18
xor edi, esi
imul esi, edi, 0x5bd1e995
xor eax, esi
cmp ecx, 3
ja 0x462c80
mov ecx, dword [esp]
lea edx, [ebx - 4]
mov esi, edx
and esi, 0xfffffffc
sub edx, esi
lea ecx, [esi + ecx + 4]
cmp edx, 1
je 0x462cd8
cmp edx, 2
je 0x462ccf
cmp edx, 3
jne 0x462ce3
movzx edx, byte [ecx + 2]
shl edx, 0x10
xor eax, edx
movzx edx, byte [ecx + 1]
shl edx, 8
xor eax, edx
movzx ecx, byte [ecx]
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov ecx, eax
mov edx, dword [esp + 4]
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0x5bd1e995
mov edi, eax
dec edx
shr edi, 0xf
xor edi, eax
mov eax, 0xfffffff9
and edi, edx
mov esi, dword [ebp + edi*8]
test esi, esi
jne 0x462d1b
jmp 0x462d5b
inc edi
and edi, edx
mov esi, dword [ebp + edi*8]
test esi, esi
je 0x462d56
movzx ecx, word [ebp + edi*8 + 4]
cmp ecx, ebx
jne 0x462d10
test ebx, ebx
je 0x462d42
add esi, dword [esp + 8]
push ebx
push dword [esp + 4]
push esi
mov esi, edx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
mov edx, esi
add esp, 0xc
test eax, eax
jne 0x462d10
mov ecx, dword [esp + 0x20]
mov edx, edi
push dword [esp + 0x2c]
call fcn.00462d70
add esp, 0x10
jmp 0x462d5e
mov eax, 0xfffffff9
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x464ec0
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], 1
mov dword [esp + 8], ebx
pop ebx
jmp fcn.00464890
Function at 0x477910
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x477948
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x47793e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x47794a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x477930
xor eax, eax
pop ebx
pop esi
ret

Function at 0x48d0e0
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov al, byte [0x537988]
mov esi, dword [esp + 0x38]
mov edi, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
mov ebx, dword [esp + 0x3c]
test al, al
je 0x48d1d6
push dword [0x537984]
push dword [0x537980]
push edi
push ebp
call fcn.004e3240
add esp, 0x10
mov edi, eax
mov eax, dword [esp + 0x4c]
and eax, 2
add eax, 2
push 0
push 0
push 0
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
je 0x48d179
mov ebx, eax
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
sub ebp, edi
mov edx, 4
add eax, edi
test cl, 2
mov ecx, 0xf001f
cmovne edx, ecx
push eax
push ebp
push 0
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x48d1aa
mov ecx, dword [esp + 0x48]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [esi + 8], edi
mov dword [esi + 0xc], ebx
jmp 0x48d1cc
cmp dword [esp + 0x48], 0
jne 0x48d1b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ee
jne 0x48d1b1
mov dword [esi], 0x518e43
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
jmp 0x48d1cc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 0xc], 0
mov dword [esi + 8], 0
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x537988
call fcn.0048b430
add esp, 4
test eax, eax
je 0x48d104
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x1c]
mov dword [0x537984], 0
mov dword [0x537980], eax
push 0x537988
call fcn.0048b4c0
add esp, 4
jmp 0x48d104
Function at 0x48f690
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
push esi
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
not eax
test ecx, ecx
je 0x48f6c6
mov edx, dword [esp + 0x10]
nop word cs:[eax + eax]
nop
movzx esi, byte [edx]
movzx edi, al
shr eax, 8
inc edx
xor edi, esi
xor eax, dword [edi*4 + 0x518fe0]
dec ecx
jne 0x48f6b0
not eax
pop esi
pop edi
ret

Function at 0x48f6d0
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x48f70d
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
xor ebp, ebp
nop word cs:[eax + eax]
mov eax, esi
sub eax, ebp
push eax
push edi
push ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
test eax, eax
js 0x48f711
je 0x48f71f
add ebp, eax
add edi, eax
cmp ebp, esi
jb 0x48f6f0
xor eax, eax
jmp 0x48f724
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, eax
xor eax, eax
sub eax, dword [ecx]
jmp 0x48f724
mov eax, 0xffffffea
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x48fb40
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x1c]
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x48fba8
mov edi, dword [esp + 0x20]
mov esi, eax
push 0
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
call fcn.00461960
add esp, 0x10
test edx, edx
js 0x48fb9f
test ebx, ebx
mov dword [esp], esi
je 0x48fbc4
mov esi, dword [esp]
xor ebp, ebp
nop
mov eax, ebx
sub eax, ebp
push eax
push esi
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
add esp, 0xc
test eax, eax
js 0x48fbb4
je 0x48fbdb
add ebp, eax
add esi, eax
cmp ebp, ebx
jb 0x48fb80
jmp 0x48fbc4
push esi
call fcn.00476980
add esp, 4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
xor edi, edi
sub edi, dword [eax]
jmp 0x48fbeb
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov edi, dword [eax]
test edi, edi
jle 0x48fbc4
neg edi
jmp 0x48fbe0
mov eax, dword [esp + 0x18]
mov esi, dword [esp]
mov ecx, dword [eax + 0x14]
push esi
push ebx
push eax
call dword [ecx]
add esp, 0xc
mov edi, eax
push esi
jmp 0x48fbe3
mov edi, 0xffffffea
push dword [esp]
call fcn.00476980
add esp, 4
mov eax, edi
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49a7a0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push ebx
push edi
push esi
mov ecx, dword [esp + 0x18]
cmp ecx, 0x80
je 0x49a7c9
cmp ecx, 0x100
je 0x49a7c9
mov eax, 0xfffffffe
cmp ecx, 0xc0
jne 0x49a9d5
mov esi, dword [esp + 0x1c]
push esi
push ecx
push dword [esp + 0x1c]
call fcn.0049a480
add esp, 0xc
test eax, eax
js 0x49a9d5
mov ecx, dword [esi + 0xf0]
lea eax, [ecx*4]
test eax, eax
jle 0x49a84e
mov ecx, 4
nop dword [eax]
mov edx, dword [esi + ecx*4 - 0x10]
mov edi, dword [esi + eax*4]
mov dword [esi + ecx*4 - 0x10], edi
mov dword [esi + eax*4], edx
mov edx, dword [esi + ecx*4 - 0xc]
mov edi, dword [esi + eax*4 + 4]
mov dword [esi + ecx*4 - 0xc], edi
mov dword [esi + eax*4 + 4], edx
mov edx, dword [esi + ecx*4 - 8]
mov edi, dword [esi + eax*4 + 8]
mov dword [esi + ecx*4 - 8], edi
mov dword [esi + eax*4 + 8], edx
mov edx, dword [esi + ecx*4 - 4]
mov edi, dword [esi + eax*4 + 0xc]
mov dword [esi + ecx*4 - 4], edi
mov dword [esi + eax*4 + 0xc], edx
add eax, 0xfffffffc
cmp ecx, eax
lea ecx, [ecx + 4]
jl 0x49a800
mov ecx, dword [esi + 0xf0]
xor eax, eax
cmp ecx, 2
jl 0x49a9d5
mov eax, 2
lea edx, [esi + 0x1c]
nop word cs:[eax + eax]
nop dword [eax + eax]
mov ebx, dword [edx - 0xc]
mov edi, ebx
movzx ebp, bh
movzx ecx, bl
shr ebx, 0x18
shr edi, 0xe
movzx ebx, byte [ebx*4 + 0x51e6a0]
movzx ebp, byte [ebp*4 + 0x51e6a0]
movzx ecx, byte [ecx*4 + 0x51e6a0]
and edi, 0x3fc
movzx edi, byte [edi + 0x51e6a0]
mov edi, dword [edi*4 + 0x51eec8]
xor edi, dword [ebx*4 + 0x51eac8]
mov ebx, dword [edx - 8]
xor edi, dword [ebp*4 + 0x51f2c8]
movzx ebp, bl
xor edi, dword [ecx*4 + 0x51f6c8]
mov ecx, ebx
shr ecx, 0xe
and ecx, 0x3fc
movzx ecx, byte [ecx + 0x51e6a0]
mov dword [edx - 0xc], edi
movzx edi, bh
shr ebx, 0x18
movzx ebx, byte [ebx*4 + 0x51e6a0]
movzx edi, byte [edi*4 + 0x51e6a0]
mov ecx, dword [ecx*4 + 0x51eec8]
xor ecx, dword [ebx*4 + 0x51eac8]
xor ecx, dword [edi*4 + 0x51f2c8]
movzx edi, byte [ebp*4 + 0x51e6a0]
xor ecx, dword [edi*4 + 0x51f6c8]
mov dword [edx - 8], ecx
mov ebx, dword [edx - 4]
mov ecx, ebx
movzx edi, bh
movzx ebp, bl
shr ebx, 0x18
shr ecx, 0xe
movzx ebx, byte [ebx*4 + 0x51e6a0]
movzx edi, byte [edi*4 + 0x51e6a0]
and ecx, 0x3fc
movzx ecx, byte [ecx + 0x51e6a0]
mov ecx, dword [ecx*4 + 0x51eec8]
xor ecx, dword [ebx*4 + 0x51eac8]
xor ecx, dword [edi*4 + 0x51f2c8]
movzx edi, byte [ebp*4 + 0x51e6a0]
xor ecx, dword [edi*4 + 0x51f6c8]
mov dword [edx - 4], ecx
mov ebx, dword [edx]
mov ecx, ebx
movzx edi, bh
movzx ebp, bl
shr ebx, 0x18
shr ecx, 0xe
movzx ebx, byte [ebx*4 + 0x51e6a0]
movzx edi, byte [edi*4 + 0x51e6a0]
and ecx, 0x3fc
movzx ecx, byte [ecx + 0x51e6a0]
mov ecx, dword [ecx*4 + 0x51eec8]
xor ecx, dword [ebx*4 + 0x51eac8]
xor ecx, dword [edi*4 + 0x51f2c8]
movzx edi, byte [ebp*4 + 0x51e6a0]
xor ecx, dword [edi*4 + 0x51f6c8]
mov dword [edx], ecx
cmp eax, dword [esi + 0xf0]
jge 0x49a9d3
inc eax
add edx, 0x10
jmp 0x49a870
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49a9e0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 0x80
je 0x49a9f9
cmp eax, 0x100
je 0x49a9f9
cmp eax, 0xc0
jne 0x49a9fe
jmp fcn.0049a480
mov eax, 0xfffffffe
ret
Function at 0x49b210
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [esp + 8]
cmp eax, 0x80
je 0x49b229
cmp eax, 0x100
je 0x49b229
cmp eax, 0xc0
jne 0x49b22e
jmp fcn.0049a7a0
mov eax, 0xfffffffe
ret

Function at 0x49b240
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x44]
lea eax, [edi - 0x10]
cmp eax, 0x7fffffe7
mov eax, 0xffffffff
ja 0x49b33b
mov ecx, edi
and ecx, 7
jne 0x49b33b
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov esi, 0x51fbc8
test eax, eax
cmovne esi, eax
lea eax, [ecx + 8]
push edi
push dword [esp + 0x44]
mov dword [esp + 0x1c], eax
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
add esp, 0xc
movsd xmm0, qword [esi]
shr edi, 3
xor eax, eax
mov ebx, 1
mov esi, esp
mov dword [esp + 0x10], edi
movsd qword [esp], xmm0
jmp 0x49b2c4
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
inc eax
add ebx, edi
cmp eax, 6
je 0x49b327
mov ebp, dword [esp + 0x14]
test edi, edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
je 0x49b2b0
nop word cs:[eax + eax]
nop
movsd xmm0, qword [ebp]
movsd qword [esp + 8], xmm0
push dword [esp + 0x34]
push esi
push esi
call fcn.0049aa10
add esp, 0xc
mov eax, ebx
xor byte [esp + 7], bl
xor byte [esp + 6], bh
shr eax, 0x10
xor byte [esp + 5], al
mov eax, ebx
inc ebx
shr eax, 0x18
xor byte [esp + 4], al
movsd xmm0, qword [esp + 8]
movsd qword [ebp], xmm0
add ebp, 8
dec edi
jne 0x49b2e0
jmp 0x49b2b0
movsd xmm0, qword [esp]
mov eax, dword [esp + 0x3c]
movsd qword [eax], xmm0
mov eax, dword [esp + 0x44]
add eax, 8
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49b350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov esi, dword [ebp + 0x18]
mov eax, 0xffffffff
cmp esi, 0x18
jb 0x49b486
mov ecx, esi
and ecx, 0x80000007
jne 0x49b486
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
lea ecx, [esi - 8]
mov dword [esp + 0x14], ecx
movsd xmm0, qword [eax]
add eax, 8
movsd qword [esp + 4], xmm0
push ecx
push eax
push edi
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov ecx, edi
add esp, 0xc
shr esi, 3
lea eax, [esi + esi*2]
lea ebx, [eax + eax - 6]
mov eax, 1
sub eax, esi
mov dword [esp + 0x1c], eax
lea eax, [esi - 1]
lea esi, [esp + 4]
mov dword [esp + 0x18], eax
mov eax, 5
jmp 0x49b3e2
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
add ebx, dword [esp + 0x1c]
dec eax
cmp eax, 6
jae 0x49b448
mov edi, dword [esp + 0x18]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebx
test edi, edi
je 0x49b3d0
nop word cs:[eax + eax]
nop dword [eax]
mov eax, ebx
xor byte [esp + 0xb], bl
xor byte [esp + 0xa], bh
shr eax, 0x10
xor byte [esp + 9], al
mov eax, ebx
shr eax, 0x18
xor byte [esp + 8], al
movsd xmm0, qword [ecx + edi*8 - 8]
movsd qword [esp + 0xc], xmm0
push dword [ebp + 8]
push esi
push esi
call fcn.0049adf0
mov ecx, dword [ebp + 0x10]
add esp, 0xc
movsd xmm0, qword [esp + 0xc]
dec ebx
movsd qword [ecx + edi*8 - 8], xmm0
dec edi
jne 0x49b400
jmp 0x49b3d0
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x2c], ecx
mov ecx, eax
test eax, eax
mov eax, 0x51fbc8
cmovne eax, ecx
lea ecx, [esp + 0x28]
push 8
push eax
push ecx
call sym.fastboot.exe_CRYPTO_memcmp
add esp, 0xc
mov ecx, eax
xor eax, eax
cmp ecx, 1
sbb eax, eax
not eax
or eax, dword [esp + 0x14]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49bbf0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
cmp dword [esp + 0x10], 1
jne 0x49bc0c
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call fcn.0049aa10
add esp, 0xc
ret
jmp fcn.0049adf0
Function at 0x49c750
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, dword [esp + 0x3c]
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov esi, dword [edi]
test eax, eax
je 0x49c79d
test esi, esi
je 0x49c79d
nop word cs:[eax + eax]
nop
movzx ecx, byte [edx + esi]
inc esi
xor cl, byte [ebp]
inc ebp
mov byte [ebx], cl
inc ebx
lea ecx, [eax - 1]
and esi, 0xf
je 0x49c79f
cmp eax, 1
mov eax, ecx
jne 0x49c780
jmp 0x49c79f
mov ecx, eax
cmp ecx, 0x10
jb 0x49c800
mov edi, ecx
mov dword [esp], ecx
jmp 0x49c7c0
add edi, 0xfffffff0
add ebx, 0x10
add ebp, 0x10
xor esi, esi
cmp edi, 0xf
jbe 0x49c7f4
push dword [esp + 0x34]
push edx
push edx
call fcn.0049aa10
mov edx, dword [esp + 0x44]
add esp, 0xc
cmp esi, 0xf
ja 0x49c7b0
nop word [eax + eax]
mov eax, dword [edx + esi]
xor eax, dword [ebp + esi]
mov dword [ebx + esi], eax
add esi, 4
cmp esi, 0x10
jb 0x49c7e0
jmp 0x49c7b0
mov ecx, dword [esp]
mov edi, dword [esp + 0x3c]
xor esi, esi
and ecx, 0xf
test ecx, ecx
je 0x49c921
push dword [esp + 0x34]
push edx
push edx
mov edi, edx
mov dword [esp + 0xc], ecx
call fcn.0049aa10
mov ecx, dword [esp + 0xc]
add esp, 0xc
cmp ecx, 0x20
jae 0x49c832
mov edx, edi
mov edi, dword [esp + 0x3c]
mov eax, ecx
jmp 0x49c910
lea eax, [ebx + esi]
add ecx, esi
lea edx, [ebp + esi]
mov dword [esp + 0xc], eax
lea eax, [ebx + ecx]
mov dword [esp + 8], edx
mov dword [esp + 0x10], eax
lea eax, [ebp + ecx]
add ecx, edi
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
cmp eax, dword [esp + 4]
setb byte [esp + 4]
cmp dword [esp + 8], edx
setb byte [esp + 8]
cmp eax, ecx
lea ecx, [edi + esi]
mov ah, byte [esp + 8]
setb al
cmp ecx, edx
setb cl
test byte [esp + 4], ah
jne 0x49c905
and al, cl
jne 0x49c905
mov eax, dword [esp]
lea ecx, [ebp + esi + 0x10]
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x38]
mov edx, eax
and edx, 0xffffffe0
lea ecx, [ecx + esi + 0x10]
mov dword [esp + 0xc], ecx
lea ecx, [ebx + esi + 0x10]
sub eax, edx
mov dword [esp + 4], edx
add esi, edx
xor edx, edx
nop word [eax + eax]
mov edi, dword [esp + 8]
movups xmm0, xmmword [edi + edx - 0x10]
movups xmm1, xmmword [edi + edx]
mov edi, dword [esp + 0xc]
movups xmm2, xmmword [edi + edx - 0x10]
movups xmm3, xmmword [edi + edx]
xorps xmm2, xmm0
xorps xmm3, xmm1
movups xmmword [ecx + edx - 0x10], xmm2
movups xmmword [ecx + edx], xmm3
add edx, 0x20
cmp dword [esp + 4], edx
jne 0x49c8c0
mov ecx, dword [esp + 4]
mov edi, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
cmp dword [esp], ecx
jne 0x49c910
jmp 0x49c921
mov eax, dword [esp]
mov edi, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
movzx ecx, byte [edx + esi]
xor cl, byte [ebp + esi]
dec eax
mov byte [ebx + esi], cl
lea esi, [esi + 1]
jne 0x49c910
mov dword [edi], esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49d470
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov esi, dword [ecx]
mov ecx, dword [ecx + 4]
mov ebx, dword [eax + 4]
mov edx, dword [eax]
cmp ecx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp], esi
cmovb ebx, ecx
test ebx, ebx
je 0x49d4e0
xor eax, eax
xor ebp, ebp
nop word cs:[eax + eax]
nop dword [eax + eax]
mov ecx, dword [esp]
mov edi, dword [edx + ebp*4]
mov ecx, dword [ecx + ebp*4]
mov esi, ecx
sub esi, edi
xor edi, ecx
xor esi, ecx
or esi, edi
xor esi, ecx
mov ecx, edi
dec edi
sar esi, 0x1f
xor ecx, 0x80000000
or esi, 1
test edi, ecx
cmovns eax, esi
inc ebp
cmp ebp, ebx
jb 0x49d4b0
jmp 0x49d4e2
xor eax, eax
mov ecx, dword [esp + 8]
mov edi, edx
mov edx, dword [esp + 4]
mov ebx, ecx
sub ebx, edx
jae 0x49d57b
mov ebx, edx
xor esi, esi
sub ebx, ecx
cmp ebx, 7
jbe 0x49d558
mov ebp, ebx
lea esi, [edi + ecx*4 + 0x10]
pxor xmm0, xmm0
pxor xmm1, xmm1
and ebp, 0xfffffff8
add ecx, ebp
mov dword [esp], ebp
nop word [eax + eax]
movdqu xmm2, xmmword [esi - 0x10]
movdqu xmm3, xmmword [esi]
add esi, 0x20
add ebp, 0xfffffff8
por xmm0, xmm2
por xmm1, xmm3
jne 0x49d520
por xmm1, xmm0
cmp ebx, dword [esp]
pshufd xmm0, xmm1, 0x4e
por xmm0, xmm1
pshufd xmm1, xmm0, 0xe5
por xmm1, xmm0
movd esi, xmm1
je 0x49d568
sub edx, ecx
lea ecx, [edi + ecx*4]
nop dword [eax]
or esi, dword [ecx]
add ecx, 4
dec edx
jne 0x49d560
mov ecx, esi
dec esi
not ecx
and esi, ecx
sar esi, 0x1f
not esi
or eax, esi
jmp 0x49d60f
cmp edx, ecx
jae 0x49d60f
mov esi, dword [esp]
xor edi, edi
cmp ebx, 7
jbe 0x49d5ea
mov ebp, ebx
lea edi, [esi + edx*4 + 0x10]
pxor xmm0, xmm0
pxor xmm1, xmm1
and ebp, 0xfffffff8
add edx, ebp
mov esi, ebp
nop word cs:[eax + eax]
nop dword [eax]
movdqu xmm2, xmmword [edi - 0x10]
movdqu xmm3, xmmword [edi]
add edi, 0x20
add ebp, 0xfffffff8
por xmm0, xmm2
por xmm1, xmm3
jne 0x49d5b0
por xmm1, xmm0
cmp ebx, esi
mov esi, dword [esp]
pshufd xmm0, xmm1, 0x4e
por xmm0, xmm1
pshufd xmm1, xmm0, 0xe5
por xmm1, xmm0
movd edi, xmm1
je 0x49d5f8
sub ecx, edx
lea edx, [esi + edx*4]
nop
or edi, dword [edx]
add edx, 4
dec ecx
jne 0x49d5f0
mov ecx, edi
dec edi
not ecx
and edi, ecx
sar edi, 0x1f
mov ecx, edi
and edi, eax
not ecx
and ecx, 1
or ecx, edi
mov eax, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49f390
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
xor edx, edx
test esi, esi
setne bl
test ecx, ecx
je 0x49f411
cmp dword [ecx + 0xc], 0
mov eax, 0xffffffff
jne 0x49f53f
mov eax, dword [ecx + 4]
mov dl, bl
mov edi, dword [ecx]
mov ecx, edx
cmp eax, edx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
cmovb ecx, eax
test ecx, ecx
je 0x49f41b
xor eax, eax
xor ebp, ebp
mov ebx, esi
mov dword [esp], ecx
nop dword [eax]
mov ecx, dword [esp + 4]
mov edi, dword [ecx + ebp*4]
mov ecx, edi
mov esi, edi
sub ecx, ebx
xor esi, ebx
xor ecx, edi
or ecx, esi
xor ecx, edi
mov edi, esi
dec esi
sar ecx, 0x1f
xor edi, 0x80000000
or ecx, 1
test esi, edi
cmovns eax, ecx
inc ebp
cmp ebp, dword [esp]
jb 0x49f3e0
jmp 0x49f41f
mov eax, 1
jmp 0x49f53f
xor eax, eax
mov ebx, esi
mov ecx, dword [esp + 8]
mov ebp, ecx
sub ebp, edx
jae 0x49f498
mov esi, ebx
mov ebx, edx
xor edi, edi
sub ebx, ecx
cmp ebx, 7
jbe 0x49f47b
mov edi, ebx
movd xmm0, esi
pxor xmm1, xmm1
and edi, 0xfffffff8
pshufd xmm2, xmm0, 0
pxor xmm0, xmm0
add ecx, edi
mov ebp, edi
por xmm0, xmm2
por xmm1, xmm2
add edi, 0xfffffff8
jne 0x49f450
por xmm1, xmm0
cmp ebx, ebp
pshufd xmm0, xmm1, 0x4e
por xmm0, xmm1
pshufd xmm1, xmm0, 0xe5
por xmm1, xmm0
movd edi, xmm1
je 0x49f485
sub edx, ecx
nop dword [eax]
or edi, esi
dec edx
jne 0x49f480
mov ecx, edi
dec edi
not ecx
and edi, ecx
sar edi, 0x1f
not edi
or eax, edi
jmp 0x49f53f
jbe 0x49f53f
xor esi, esi
cmp ebp, 7
ja 0x49f4a9
mov edi, edx
jmp 0x49f513
mov edi, dword [esp + 4]
mov ebx, ebp
pxor xmm0, xmm0
xor esi, esi
pxor xmm1, xmm1
and ebx, 0xfffffff8
lea ecx, [ebx + edx]
mov dword [esp], ecx
nop word cs:[eax + eax]
nop dword [eax]
mov ecx, esi
add esi, 8
or ecx, edx
cmp ebx, esi
movdqu xmm2, xmmword [edi + ecx*4]
movdqu xmm3, xmmword [edi + ecx*4 + 0x10]
por xmm0, xmm2
por xmm1, xmm3
jne 0x49f4d0
por xmm1, xmm0
mov ecx, dword [esp + 8]
mov edi, dword [esp]
cmp ebp, ebx
pshufd xmm0, xmm1, 0x4e
por xmm0, xmm1
pshufd xmm1, xmm0, 0xe5
por xmm1, xmm0
movd esi, xmm1
je 0x49f528
mov edx, dword [esp + 4]
sub ecx, edi
lea edx, [edx + edi*4]
nop dword [eax]
or esi, dword [edx]
add edx, 4
dec ecx
jne 0x49f520
mov ecx, esi
dec esi
not ecx
and esi, ecx
sar esi, 0x1f
mov ecx, esi
and esi, eax
not ecx
and ecx, 1
or ecx, esi
mov eax, ecx
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x49f750
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
xor edi, edi
mov ebx, dword [eax + 4]
mov edx, dword [ecx + 4]
mov eax, ebx
sub eax, edx
mov dword [esp], eax
jge 0x49f7e9
mov eax, dword [esp + 0x20]
mov ecx, edx
xor edi, edi
mov esi, ebx
sub ecx, ebx
cmp ecx, 7
mov ebp, dword [eax]
jbe 0x49f7e0
mov eax, ecx
lea edi, [ebp + ebx*4 + 0x10]
pxor xmm0, xmm0
pxor xmm1, xmm1
and eax, 0xfffffff8
lea esi, [ebx + eax]
mov dword [esp + 4], eax
nop dword [eax + eax]
movdqu xmm2, xmmword [edi - 0x10]
movdqu xmm3, xmmword [edi]
add edi, 0x20
add eax, 0xfffffff8
por xmm0, xmm2
por xmm1, xmm3
jne 0x49f7a0
por xmm1, xmm0
cmp ecx, dword [esp + 4]
pshufd xmm0, xmm1, 0x4e
por xmm0, xmm1
pshufd xmm1, xmm0, 0xe5
por xmm1, xmm0
movd edi, xmm1
je 0x49f7e9
nop dword [eax]
or edi, dword [ebp + esi*4]
inc esi
cmp esi, edx
jl 0x49f7e0
cmp edx, ebx
jge 0x49f868
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp]
mov esi, dword [eax]
cmp ecx, 7
ja 0x49f7ff
mov ebp, edx
jmp 0x49f858
and ecx, 0xfffffff8
movd xmm1, edi
lea edi, [esi + edx*4 + 0x10]
pxor xmm0, xmm0
lea ebp, [edx + ecx]
mov eax, ecx
nop word cs:[eax + eax]
nop dword [eax]
movdqu xmm2, xmmword [edi - 0x10]
movdqu xmm3, xmmword [edi]
add edi, 0x20
add eax, 0xfffffff8
por xmm1, xmm2
por xmm0, xmm3
jne 0x49f820
por xmm0, xmm1
cmp dword [esp], ecx
pshufd xmm1, xmm0, 0x4e
por xmm1, xmm0
pshufd xmm0, xmm1, 0xe5
por xmm0, xmm1
movd edi, xmm0
je 0x49f868
mov eax, ebx
lea ecx, [esi + ebp*4]
sub eax, ebp
nop
or edi, dword [ecx]
add ecx, 4
dec eax
jne 0x49f860
mov ebp, dword [esp + 0x1c]
cmp ebx, edx
cmovle edx, ebx
test edx, edx
jle 0x49f8dd
mov eax, dword [esp + 0x20]
mov esi, dword [ebp]
mov ebx, dword [eax]
xor eax, eax
cmp edx, 3
jbe 0x49f8d0
mov eax, edx
movd xmm0, edi
xor ecx, ecx
and eax, 0xfffffffc
movdqu xmm1, xmmword [esi + ecx*4]
movdqu xmm2, xmmword [ebx + ecx*4]
add ecx, 4
cmp eax, ecx
pxor xmm2, xmm1
por xmm0, xmm2
jne 0x49f890
pshufd xmm1, xmm0, 0x4e
cmp edx, eax
por xmm1, xmm0
pshufd xmm0, xmm1, 0xe5
por xmm0, xmm1
movd edi, xmm0
je 0x49f8dd
nop word cs:[eax + eax]
nop dword [eax]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi + eax*4]
inc eax
or edi, ecx
cmp eax, edx
jl 0x49f8d0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0xc]
xor eax, eax
xor ecx, dword [ebp + 0xc]
or ecx, edi
sete al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret