joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495ac8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004e3eb0
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
cmp byte [edi + 4], 0
jne 0x495b49
push 0x800
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x495b02
and dword [edi], eax
jmp 0x495b45
push ecx
lea eax, [ebp - 0x1004]
push eax
mov ecx, eax
call fcn.0049910b
pop ecx
pop ecx
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x495b45
push str.CryptProtectMemory
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptUnprotectMemory
push dword [edi]
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [edi + 0xc], eax
mov byte [edi + 4], 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.004b7879
leave
ret

Function at 0x495cef
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x519af4]
push esi
mov esi, ecx
push edi
mov edi, edx
test eax, eax
jne 0x495d10
mov ecx, 0x519aec
call fcn.00495ac8
mov eax, dword [0x519af4]
mov ecx, edi
and ecx, 0xfffffff0
cmp byte [ebp + 8], 0
je 0x495d46
test eax, eax
je 0x495d60
push 0
push ecx
push esi
call eax
test eax, eax
jne 0x495d7f
push str.CryptProtectMemory_failed
mov esi, 0x515c44
push esi
call fcn.0049e47e
pop ecx
pop ecx
push 2
mov ecx, esi
call fcn.0049e566
jmp 0x495d7f
mov eax, dword [0x519af8]
test eax, eax
je 0x495d60
push 0
push ecx
push esi
call eax
test eax, eax
jne 0x495d7f
push str.CryptUnprotectMemory_failed
jmp 0x495d2e
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ebx, eax
test edi, edi
je 0x495d7e
lea eax, [ebx + 0x4b]
add al, dl
lea ecx, [edx + esi]
xor byte [ecx], al
inc edx
cmp edx, edi
jb 0x495d6f
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x499603
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.004e3eb0
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
movzx eax, word [edi]
test ax, ax
je 0x4997c0
mov esi, edi
xor edx, edx
mov dword [ebp - 0x1008], edx
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x49963a
sub esi, ecx
mov ecx, edi
sar esi, 1
call fcn.0049953d
test al, al
je 0x4996e6
mov ecx, edi
call fcn.004990a0
test al, al
je 0x499693
lea eax, [esi + 4]
mov esi, 0x800
cmp eax, esi
jae 0x4997c0
push esi
mov edx, 0x50260c
mov ecx, ebx
call fcn.00498a2a
push esi
mov edx, edi
mov ecx, ebx
call fcn.00498a58
pop ecx
pop ecx
mov al, 1
jmp 0x4997c2
movzx eax, word [edi]
push 0x5c
pop ecx
cmp ax, cx
jne 0x4997c0
cmp word [edi + 2], cx
jne 0x4997c0
lea eax, [esi + 6]
mov esi, 0x800
cmp eax, esi
jae 0x4997c0
push esi
mov edx, 0x50260c
mov ecx, ebx
call fcn.00498a2a
push esi
mov edx, 0x506928
mov ecx, ebx
call fcn.00498a58
lea edx, [edi + 2]
push esi
mov ecx, ebx
call fcn.00498a58
add esp, 0xc
jmp 0x49968c
lea eax, [ebp - 0x1004]
push eax
push 0x7ff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x4997c0
cmp eax, 0x7ff
ja 0x4997c0
movzx ecx, word [edi]
call fcn.00499090
test al, al
je 0x49974f
lea eax, [esi + 6]
mov esi, 0x800
cmp eax, esi
jae 0x4997c0
push esi
mov edx, 0x50260c
mov ecx, ebx
call fcn.00498a2a
xor eax, eax
lea edx, [ebp - 0x1004]
push esi
mov ecx, ebx
mov word [ebp - 0x1000], ax
call fcn.00498a58
mov edx, edi
jmp 0x4996d9
lea ecx, [ebp - 0x1004]
call fcn.004990d3
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1008]
jne 0x49975d
sub ecx, edx
lea eax, [esi + 4]
sar ecx, 1
mov esi, 0x800
add eax, ecx
cmp eax, esi
jae 0x4997c0
push esi
mov edx, 0x50260c
mov ecx, ebx
call fcn.00498a2a
push esi
lea edx, [ebp - 0x1004]
mov ecx, ebx
call fcn.00498a58
cmp word [edi], 0x2e
pop ecx
pop ecx
jne 0x4997b1
movzx ecx, word [edi + 2]
call fcn.00499090
test al, al
je 0x4997b1
add edi, 4
push esi
mov edx, edi
mov ecx, ebx
call fcn.00498a58
jmp 0x49968b
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret
Function at 0x49a33c
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x1a48], 0
mov dword [esi], 0x506988
je 0x49a36e
push edi
mov edi, dword [esi + 0x1a4c]
test edi, edi
je 0x49a36d
mov ecx, edi
call fcn.00494d6c
push 0xc608
push edi
call fcn.004b788c
pop ecx
pop ecx
pop edi
lea ecx, [esi + 0x5840]
call fcn.00495903
lea ecx, [esi + 0x34f8]
call fcn.00495903
lea ecx, [esi + 0x2474]
call fcn.004987a2
lea ecx, [esi + 0x1a68]
call fcn.004ac4c5
lea ecx, [esi + 0x1970]
call fcn.004a147b
lea ecx, [esi + 0x1040]
call fcn.004964a8
mov ecx, esi
pop esi
jmp fcn.004a004d

Function at 0x49ebe9
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x14]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x49ec4c
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x49ec3e
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
test eax, eax
mov ecx, dword [ebp - 4]
setne al
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret
Function at 0x4a004d
Capabilities:
Delete file

Disassembly:
cmp dword [ecx + 8], 0xffffffff
mov dword [ecx], str._JoJ
je 0x4a006e
cmp byte [ecx + 0x15], 0
jne 0x4a006e
cmp byte [ecx + 0x1c], 0
jne fcn.004a039b
jmp fcn.004a0322
ret

Function at 0x4a03c2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
mov esi, ecx
jne 0x4a03d9
mov al, 1
jmp 0x4a0480
cmp dword [esi + 0x10], 1
lea edi, [esi + 8]
jne 0x4a03ec
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi], eax
and dword [ebp - 8], 0
xor bl, bl
cmp dword [esi + 0x10], 0
je 0x4a0441
xor edx, edx
mov dword [ebp - 4], edx
cmp dword [ebp + 0xc], edx
jbe 0x4a0462
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 8]
push 0
push eax
sub ecx, edx
mov eax, 0x4000
cmp ecx, eax
cmovb eax, ecx
push eax
mov eax, dword [ebp + 8]
add eax, edx
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete bl
jne 0x4a045e
mov edx, dword [ebp - 4]
add edx, 0x4000
mov dword [ebp - 4], edx
cmp edx, dword [ebp + 0xc]
jb 0x4a0402
jmp 0x4a045e
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ebx, [eax - 1]
neg ebx
sbb bl, bl
inc bl
test bl, bl
jne 0x4a047a
cmp byte [esi + 0x1e], 0
je 0x4a047a
cmp dword [esi + 0x10], 0
jne 0x4a047a
push 5
mov ecx, 0x515c44
call fcn.0049e566
mov byte [esi + 0xc], 1
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4a09da
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004e3eb0
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov bl, dl
mov esi, ecx
call fcn.00498e60
movzx eax, word [eax]
cmp eax, 0x2e
je 0x4a0a16
cmp eax, 0x20
je 0x4a0a16
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4a0a48
mov ecx, esi
call fcn.004a0d47
cmp eax, 0xffffffff
jne 0x4a0a5a
push ecx
lea edx, [ebp - 0x1004]
mov ecx, esi
call fcn.00499603
pop ecx
test al, al
je 0x4a0a5a
push 0
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4a0a5a
test bl, bl
je 0x4a0a56
mov edx, dword [ebp + 8]
mov ecx, esi
call fcn.004a0da2
xor eax, eax
jmp 0x4a0a72
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
push 2
pop eax
cmp ecx, eax
je 0x4a0a72
xor eax, eax
cmp ecx, 3
sete al
inc eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret

Function at 0x4a0d47
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.004e3eb0
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a0d92
push ecx
lea edx, [ebp - 0x1004]
mov ecx, ebx
call fcn.00499603
pop ecx
test al, al
je 0x4a0d92
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret
Function at 0x4a0da2
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.004e3eb0
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
mov eax, ecx
push esi
push eax
mov dword [ebp - 0x1008], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
test eax, eax
jne 0x4a0e00
push ecx
mov ecx, dword [ebp - 0x1008]
lea edx, [ebp - 0x1004]
call fcn.00499603
pop ecx
test al, al
je 0x4a0e00
push esi
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret

Function at 0x4a1179
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1268
call fcn.004e3eb0
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x125c]
push edi
mov edi, edx
mov dword [ebp - 0x1260], esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
mov dword [ebp - 0x1264], ebx
cmp ebx, 0xffffffff
jne 0x4a1210
push ecx
lea edx, [ebp - 0x100c]
mov ecx, edi
call fcn.00499603
pop ecx
test al, al
je 0x4a11ea
lea eax, [ebp - 0x125c]
push eax
lea eax, [ebp - 0x100c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x1264], eax
cmp eax, ebx
jne 0x4a1210
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4a1203
cmp eax, 3
je 0x4a1203
cmp eax, 0x12
je 0x4a1203
mov al, 1
jmp 0x4a1205
xor al, al
mov byte [esi + 0x1044], al
jmp 0x4a1300
push 0x800
mov edx, edi
mov ecx, esi
call fcn.00498a2a
lea edx, [ebp - 0x1230]
mov ecx, esi
call fcn.00499019
mov edi, dword [ebp - 0x1254]
xor eax, eax
add eax, dword [ebp - 0x123c]
mov ebx, dword [ebp - 0x1258]
mov dword [esi + 0x1000], eax
mov eax, dword [ebp - 0x125c]
mov dword [esi + 0x1008], eax
mov eax, dword [ebp - 0x1250]
pop ecx
mov ecx, dword [ebp - 0x1240]
adc ecx, 0
mov dword [esi + 0x1030], eax
mov eax, dword [ebp - 0x124c]
mov dword [esi + 0x1004], ecx
mov ecx, dword [ebp - 0x1260]
mov dword [esi + 0x1034], eax
mov eax, dword [ebp - 0x1244]
push 0x64
mov dword [ecx + 0x103c], eax
mov dword [esi + 0x102c], edi
mov dword [esi + 0x1028], ebx
mov esi, dword [ebp - 0x1248]
mov dword [ecx + 0x1038], esi
pop ecx
mul ecx
push 0x64
mov ecx, eax
mov eax, esi
mov esi, dword [ebp - 0x1260]
pop edx
mul edx
push 0x64
mov dword [esi + 0x1010], eax
add ecx, edx
mov eax, edi
mov dword [esi + 0x1014], ecx
pop edi
mul edi
mov ecx, eax
mov eax, ebx
mul edi
mov dword [esi + 0x1018], eax
add ecx, edx
mov eax, dword [ebp - 0x124c]
mul edi
mov dword [esi + 0x101c], ecx
mov ecx, eax
mov eax, dword [ebp - 0x1250]
mul edi
add ecx, edx
mov dword [esi + 0x1020], eax
mov dword [esi + 0x1024], ecx
and dword [esi + 0x1040], 0
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x1264]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004b7879
leave
ret
Function at 0x4aa4c2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
xor edx, edx
mov word [ecx + 0x925], dx
mov byte [ecx + 0x924], dl
mov al, byte [esi]
test al, al
je 0x4aa50c
push ebx
mov ah, dl
mov bl, dl
add dl, al
xor ah, al
add al, bl
mov byte [ecx + 0x924], dl
mov bl, al
mov byte [ecx + 0x925], ah
add al, al
shr bl, 7
or bl, al
inc esi
mov byte [ecx + 0x926], bl
mov al, byte [esi]
test al, al
jne 0x4aa4e3
pop ebx
pop esi
pop ebp
ret 4

Function at 0x4aa511
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
lea ecx, [esi + 0x414]
call fcn.004ac1f2
mov edi, dword [ebp + 8]
mov edx, edi
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4aa52b
sub edx, ecx
or ecx, 0xffffffff
push edx
mov edx, edi
call fcn.004ac238
mov word [esi + 0x928], ax
shr eax, 0x10
mov word [esi + 0x92a], ax
xor eax, eax
mov dword [esi + 0x92c], eax
mov al, byte [edi]
pop ecx
test al, al
je 0x4aa5a7
push ebx
xor ebx, ebx
mov dword [ebp + 8], ebx
movzx ecx, al
movzx eax, al
mov dx, word [esi + ecx*4 + 0x414]
xor dx, ax
xor dx, bx
mov word [esi + 0x92c], dx
mov cx, word [esi + ecx*4 + 0x416]
add cx, ax
movzx ebx, dx
add cx, word [ebp + 8]
inc edi
mov word [esi + 0x92e], cx
movzx ecx, cx
mov dword [ebp + 8], ecx
mov al, byte [edi]
test al, al
jne 0x4aa565
pop ebx
pop edi
pop esi
pop ebp
ret 4

Function at 0x4aa5ad
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
test eax, eax
je 0x4aa656
push esi
push edi
dec eax
mov ecx, 0x1234
add cx, word [ebx + 0x928]
mov dword [ebp + 0xc], eax
movzx eax, cx
mov word [ebx + 0x928], ax
movzx edi, cx
mov eax, edi
shr eax, 1
movzx ecx, al
mov ax, word [ebx + ecx*4 + 0x414]
xor word [ebx + 0x92a], ax
mov ax, word [ebx + ecx*4 + 0x416]
sub word [ebx + 0x92c], ax
movzx ecx, word [ebx + 0x92e]
movzx edx, word [ebx + 0x92a]
movzx esi, word [ebx + 0x92c]
ror cx, 1
xor cx, dx
mov eax, ecx
shr cx, 1
shl eax, 0xf
or ax, cx
mov ecx, dword [ebp + 8]
mov word [ebx + 0x92e], ax
xor eax, esi
xor eax, edi
movzx eax, ax
mov word [ebx + 0x928], ax
shr eax, 8
xor byte [ecx], al
inc ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], ecx
test eax, eax
jne 0x4aa5c0
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x4aa9a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edx, dword [eax]
lea edi, [ebp - 0x14]
mov ebx, ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [eax + 4]
mov esi, eax
push 0x1f
xor ecx, dword [ebx + 0x918]
xor edx, dword [ebx + 0x914]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x20], ecx
mov ecx, dword [eax + 8]
xor ecx, dword [ebx + 0x91c]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x18], ecx
mov ecx, dword [eax + 0xc]
xor ecx, dword [ebx + 0x920]
movsd dword es:[edi], dword [esi]
pop eax
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x24], eax
movsd dword es:[edi], dword [esi]
mov edi, edx
and eax, 3
ror ecx, 0x15
add ecx, dword [ebp - 0x18]
mov edx, dword [ebx + eax*4 + 0x914]
xor ecx, edx
mov eax, ecx
shr eax, 0x10
movzx eax, al
movzx esi, byte [eax + ebx + 0x814]
mov eax, ecx
shr eax, 0x18
movzx eax, byte [eax + ebx + 0x814]
shl eax, 8
or esi, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + ebx + 0x814]
or esi, eax
movzx eax, cl
shl esi, 8
movzx eax, byte [eax + ebx + 0x814]
or esi, eax
xor esi, edi
mov edi, dword [ebp - 0x18]
mov ecx, edi
mov dword [ebp - 0x18], esi
ror ecx, 0xf
xor ecx, dword [ebp - 0x1c]
add ecx, edx
mov eax, ecx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + ebx + 0x814]
mov eax, ecx
shr eax, 0x18
movzx eax, byte [eax + ebx + 0x814]
shl eax, 8
or edx, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + ebx + 0x814]
or edx, eax
movzx eax, cl
shl edx, 8
movzx eax, byte [eax + ebx + 0x814]
or edx, eax
mov eax, dword [ebp - 0x1c]
xor edx, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov ecx, edx
mov eax, dword [ebp - 0x24]
sub eax, 1
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], eax
jns 0x4aa9fe
mov eax, dword [ebx + 0x914]
mov ecx, dword [ebp - 0x30]
xor eax, esi
mov dword [ecx], eax
mov eax, dword [ebx + 0x918]
xor eax, edx
mov dword [ecx + 4], eax
mov eax, dword [ebx + 0x91c]
xor eax, edi
mov dword [ecx + 8], eax
mov eax, dword [ebx + 0x920]
xor eax, dword [ebp - 0x20]
mov dword [ecx + 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov ecx, ebx
call fcn.004aab18
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret 4
Function at 0x4aab18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x920]
add edx, 2
push ebx
mov ebx, dword [ecx + 0x91c]
push esi
mov esi, dword [ecx + 0x914]
push edi
mov edi, dword [ecx + 0x918]
mov dword [ebp - 4], eax
mov dword [ebp + 8], 4
movzx eax, byte [edx - 2]
xor esi, dword [ecx + eax*4 + 0x414]
mov dword [ecx + 0x914], esi
movzx eax, byte [edx - 1]
mov dword [ebp - 8], esi
mov esi, dword [ebp - 4]
xor edi, dword [ecx + eax*4 + 0x414]
mov dword [ecx + 0x918], edi
movzx eax, byte [edx]
lea edx, [edx + 4]
xor ebx, dword [ecx + eax*4 + 0x414]
mov dword [ecx + 0x91c], ebx
movzx eax, byte [edx - 3]
xor esi, dword [ecx + eax*4 + 0x414]
sub dword [ebp + 8], 1
mov eax, esi
mov dword [ebp - 4], esi
mov esi, dword [ebp - 8]
mov dword [ecx + 0x920], eax
jne 0x4aab48
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4aaee8
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e0
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, ecx
mov dword [ebp - 0x1d0], ecx
mov ecx, dword [ebp + 8]
push ebx
mov dword [ebp - 0x1dc], ecx
mov ebx, edx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x1e0], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x1cc], ecx
mov ecx, dword [ebp + 0x20]
mov dword [ebp - 0x1c8], edx
mov dword [ebp - 0x1d4], ecx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x1d8], edi
cmp ebx, 0x40
jbe 0x4aaf77
lea ecx, [ebp - 0x1c4]
call fcn.004acbcc
push ebx
mov edx, eax
call fcn.004ace1a
pop ecx
lea edx, [ebp - 0x6c]
lea ecx, [ebp - 0x1c4]
call fcn.004ace82
mov edx, dword [ebp - 0x1c8]
lea eax, [ebp - 0x6c]
push 0x20
mov dword [ebp - 0x1d0], eax
pop ebx
test edi, edi
je 0x4aaf95
cmp byte [edx], 0
je 0x4aaf95
mov esi, edi
lea edi, [ebp - 0xf4]
push 0x1a
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x1d8]
jmp 0x4aafee
xor edx, edx
test ebx, ebx
je 0x4aafb3
mov esi, eax
lea eax, [ebp - 0x4c]
sub esi, eax
lea ecx, [ebp - 0x4c]
add ecx, edx
mov al, byte [esi + ecx]
xor al, 0x36
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x4aafa2
cmp ebx, 0x40
jae 0x4aafce
push 0x40
pop eax
sub eax, ebx
push eax
lea eax, [ebp - 0x4c]
add eax, ebx
push 0x36
push eax
call fcn.004b8c50
add esp, 0xc
lea ecx, [ebp - 0xf4]
call fcn.004acbcc
push 0x40
lea edx, [ebp - 0x4c]
call fcn.004ace1a
pop ecx
test edi, edi
je 0x4ab001
mov edx, dword [ebp - 0x1c8]
cmp byte [edx], 0
jne 0x4ab001
push 0x1a
pop ecx
lea esi, [ebp - 0xf4]
rep movsd dword es:[edi], dword [esi]
mov byte [edx], 1
push dword [ebp + 0xc]
mov edx, dword [ebp - 0x1dc]
lea ecx, [ebp - 0xf4]
call fcn.004ace1a
pop ecx
lea edx, [ebp - 0x8c]
lea ecx, [ebp - 0xf4]
call fcn.004ace82
mov edi, dword [ebp - 0x1cc]
test edi, edi
je 0x4ab051
mov eax, dword [ebp - 0x1d4]
cmp byte [eax], 0
je 0x4ab051
mov esi, edi
lea edi, [ebp - 0x15c]
push 0x1a
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x1cc]
jmp 0x4ab0ae
test ebx, ebx
je 0x4ab073
mov esi, dword [ebp - 0x1d0]
lea eax, [ebp - 0x4c]
sub esi, eax
xor edx, edx
lea ecx, [ebp - 0x4c]
add ecx, edx
mov al, byte [esi + ecx]
xor al, 0x5c
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x4ab062
cmp ebx, 0x40
jae 0x4ab08e
push 0x40
pop eax
sub eax, ebx
push eax
lea eax, [ebp - 0x4c]
add eax, ebx
push 0x5c
push eax
call fcn.004b8c50
add esp, 0xc
lea ecx, [ebp - 0x15c]
call fcn.004acbcc
push 0x40
lea edx, [ebp - 0x4c]
call fcn.004ace1a
pop ecx
test edi, edi
je 0x4ab0c1
mov eax, dword [ebp - 0x1d4]
cmp byte [eax], 0
jne 0x4ab0c1
push 0x1a
pop ecx
lea esi, [ebp - 0x15c]
rep movsd dword es:[edi], dword [esi]
mov byte [eax], 1
push 0x20
lea edx, [ebp - 0x8c]
lea ecx, [ebp - 0x15c]
call fcn.004ace1a
mov edx, dword [ebp - 0x1e0]
pop ecx
lea ecx, [ebp - 0x15c]
call fcn.004ace82
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret
Function at 0x4ab0f5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1ac
mov eax, dword [0x513010]
xor eax, esp
mov dword [esp + 0x1a8], eax
push ebx
push esi
push edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x14], eax
lea edi, [esp + 0x148]
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
xor eax, eax
push eax
movsd dword es:[edi], dword [esi]
push eax
push eax
push eax
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x118]
push eax
lea eax, [esp + 0x15c]
push 0x14
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x174], 0x1000000
call fcn.004aaee8
mov eax, dword [ebp + 0x1c]
lea esi, [esp + 0x124]
add esp, 0x1c
mov dword [esp + 0xfc], ebx
dec eax
lea edi, [esp + 0x128]
mov dword [esp + 0xf0], eax
xor edx, edx
mov byte [esp + 0xf], dl
push 8
pop ecx
push 0x10
pop eax
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x104], eax
mov eax, edx
push 0x20
rep movsd dword es:[edi], dword [esi]
mov byte [esp + 0x12], dl
mov dword [esp + 0x18], eax
pop ebx
mov ecx, dword [esp + eax + 0xf0]
mov dword [esp + 0x10], ecx
test ecx, ecx
je 0x4ab24e
mov edx, dword [esp + 0x18]
lea eax, [esp + 0xe]
mov ecx, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x17]
push eax
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x1a4]
push eax
lea eax, [esp + 0x11c]
push ebx
push eax
call fcn.004aaee8
add esp, 0x1c
lea esi, [esp + 0x194]
lea edi, [esp + 0x108]
xor edx, edx
mov eax, edx
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
movups xmm0, xmmword [esp + eax + 0x128]
movups xmm1, xmmword [esp + eax + 0x108]
xorps xmm1, xmm0
movups xmmword [esp + eax + 0x128], xmm1
add eax, 0x10
cmp eax, ebx
jb 0x4ab221
sub dword [esp + 0x10], 1
jne 0x4ab1d2
mov eax, dword [esp + 0x14]
mov edi, dword [esp + eax + 0xfc]
lea esi, [esp + 0x128]
push 8
add eax, 4
mov dword [esp + 0x18], eax
pop ecx
rep movsd dword es:[edi], dword [esi]
cmp eax, 0xc
jb 0x4ab1c3
push 0x44
pop ecx
lea eax, [esp + 0x148]
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0x4ab27b
mov ecx, ebx
lea eax, [esp + 0x128]
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0x4ab28c
mov ecx, ebx
lea eax, [esp + 0x108]
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0x4ab29d
lea eax, [esp + 0x194]
mov byte [eax], dl
inc eax
sub ebx, 1
jne 0x4ab2ac
mov ecx, dword [esp + 0x1b4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004b7879
mov esp, ebp
pop ebp
ret
Function at 0x4ab511
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x513010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov ebx, edx
xor ecx, ecx
mov dword [ebp - 0x2c], ebx
push edi
cmp dword [esi], 2
lea edi, [esi + 4]
jne 0x4ab57d
mov eax, dword [edi]
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 0x28], eax
mov ecx, ebx
lea eax, [ebp - 0x24]
push eax
push 4
lea eax, [ebp - 0x28]
push eax
push 0x20
pop edx
call fcn.004aaee8
xor edx, edx
add esp, 0x1c
and dword [ebp - 0x28], edx
mov ebx, dword [ebp - 0x28]
movzx eax, byte [ebp + edx - 0x24]
mov ecx, edx
and ecx, 3
shl ecx, 3
shl eax, cl
xor eax, ebx
inc edx
mov ebx, eax
cmp edx, 0x20
jb 0x4ab55d
mov ebx, dword [ebp - 0x2c]
xor ecx, ecx
mov dword [edi], eax
cmp dword [esi], 3
jne 0x4ab5a2
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x24]
mov ecx, ebx
push eax
push 0x20
push edi
push 0x20
pop edx
call fcn.004aaee8
add esp, 0x1c
lea esi, [ebp - 0x24]
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b7879
leave
ret