joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477f10
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call 0x3ffea8
ret

Function at 0x47b0f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call 0x3fd34c
xor eax, eax
push ebp
push 0x482b29
push dword fs:[eax]
mov dword fs:[eax], esp
mov ax, word [esi + 4]
mov word [ebx + 4], ax
mov ax, word [esi + 6]
mov word [ebx + 6], ax
mov ax, word [esi + 8]
mov word [ebx + 8], ax
mov ax, word [esi + 0xa]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xc]
call fcn.0047cb14
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1e]
mov word [ebx + 0x1e], ax
mov ax, word [esi + 0x20]
mov word [ebx + 0x22], ax
mov ax, word [esi + 0x22]
mov word [ebx + 0x24], ax
mov ax, word [esi + 0x24]
mov word [ebx + 0x26], ax
mov eax, dword [esi + 0x26]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2a]
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004020a4
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0047badc
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040201c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0047bb50
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482b30
lea eax, [ebp - 0xc]
mov edx, 3
call 0x3fcec0
ret
Function at 0x47b1f8
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp - 4]
call 0x3fd34c
xor eax, eax
push ebp
push 0x482c41
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
mov ax, word [esi + 4]
mov word [ebx + 6], ax
mov ax, word [esi + 6]
mov word [ebx + 8], ax
mov ax, word [esi + 8]
mov word [ebx + 0xa], ax
mov eax, dword [esi + 0xa]
call fcn.0047cb14
mov dword [ebx + 0xc], eax
mov eax, dword [esi + 0xe]
mov dword [ebx + 0x10], eax
mov eax, dword [esi + 0x12]
mov dword [ebx + 0x14], eax
mov eax, dword [esi + 0x16]
mov dword [ebx + 0x18], eax
mov ax, word [esi + 0x1a]
mov word [ebx + 0x1c], ax
mov ax, word [esi + 0x1c]
mov word [ebx + 0x20], ax
mov word [ebx + 0x22], 0
mov word [ebx + 0x24], 0
mov word [ebx + 0x26], 0
xor eax, eax
mov dword [ebx + 0x28], eax
xor eax, eax
mov dword [ebx + 0x2c], eax
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
cmp dword [ebp - 4], 0
je 0x47b2c7
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004020a4
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0047badc
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0040201c
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.0047bb50
jmp 0x47b2d9
xor edx, edx
mov eax, ebx
call fcn.0047badc
xor edx, edx
mov eax, ebx
call fcn.0047bb50
xor eax, eax
mov dword [ebx + 0x44], eax
mov byte [ebx + 0x48], 0
mov byte [ebx + 0x4a], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482c48
lea eax, [ebp - 0xc]
mov edx, 3
call 0x3fcec0
ret

Function at 0x482374
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov ecx, dword [edi + 0x170]
mov edx, ebx
mov eax, edi
call fcn.004825a8
mov esi, eax
mov dword [edi + 0x170], esi
and esi, 0xff
add dword [edi + 0x174], esi
imul esi, dword [edi + 0x174], 0x8088405
inc esi
mov dword [edi + 0x174], esi
mov edx, esi
shr edx, 0x18
mov ecx, dword [edi + 0x178]
mov eax, edi
call fcn.004825a8
mov dword [edi + 0x178], eax
pop edi
pop esi
pop ebx
ret

Function at 0x4823e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x48240d
inc esi
mov eax, edi
call fcn.004823cc
xor byte [ebx], al
mov dl, byte [ebx]
mov eax, edi
call fcn.00482374
inc ebx
dec esi
jne 0x4823f7
pop edi
pop esi
pop ebx
ret
Function at 0x482ec8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48a9ec
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x483068
mov eax, dword [ebp - 4]
call fcn.00484850
cmp ebx, eax
jge 0x483068
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.004797b4
mov edx, dword [0x4824d0]
call 0x3fc1a0
mov esi, eax
mov eax, esi
call fcn.0047ba70
test al, al
je 0x48305e
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov edi, dword [esi + 0x44]
test edi, edi
jne 0x483052
xor eax, eax
push ebp
push 0x48a98b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00483480
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call case.0x41356e.18
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call 0x3fd4e8
mov eax, dword [ebp - 8]
call 0x3fd3b4
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.00483244
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a9d6
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x48304a
mov eax, dword [ebp - 4]
call fcn.00483504
ret
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.00402488
jmp 0x483096
mov eax, dword [ebp - 8]
call 0x3fce9c
jmp 0x483096
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.00401b2c
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x416914]
call fcn.00405520
call 0x3fc784
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48a9f3
lea eax, [ebp - 0x54]
call 0x3fce9c
ret
Function at 0x488468
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x4af998]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4af998]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4af998]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4af998]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4af91c]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x488493
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x488560
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
xor ebx, ebx
mov bl, cl
mov ebx, dword [ebx*4 + 0x4af998]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4af998]
mov ebx, ecx
shr ebx, 0x10
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4af998]
mov dword [esp + 8], ebx
shr ecx, 0x18
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4af998]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4af91c]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x48859b
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x48867c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4af998]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4af998]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4af998]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4af998]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x4af91c]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
xor ecx, ecx
mov cl, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + 0x4af998]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4af998]
mov ebx, edi
shr ebx, 0x10
and ebx, 0xff
mov esi, dword [ebx*4 + 0x4af998]
mov ebx, edi
shr ebx, 0x18
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4af998]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x4886c7
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x422b90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xd0
mov esi, esp
mov dword [esi + 0xb8], ebp
mov dword [esi + 0xbc], esp
mov dword [esi + 0xc8], 0xffffffff
mov dword [esi + 0xc4], 0x424380
mov dword [esi + 8], edx
mov edx, dword [ebp + 8]
mov dword [esi + 0xc], ecx
lea ecx, [esi + 0xc0]
mov eax, dword fs:[0]
mov dword [esi + 0xc0], eax
mov dword fs:[0], ecx
cmp byte [edx], 9
jne 0x422c27
movups xmm0, xmmword [edx + 0x18]
lea eax, [edx + 8]
mov dword [esi + 0xc8], 0
lea ecx, [esi + 0x40]
movaps xmmword [esi + 0x80], xmm0
push eax
push ecx
call fcn.005ab5a0
add esp, 8
movsd xmm0, qword [esi + 0x40]
movsd xmm1, qword [esi + 0x48]
mov byte [esi + 7], 9
movsd qword [esi + 0x2f], xmm0
movsd qword [esi + 0x37], xmm1
jmp 0x422c90
lea ecx, [esi + 0x40]
mov dword [esi + 0xc8], 0
call fcn.00423d00
movsd xmm2, qword [esi + 0x49]
movsd xmm1, qword [esi + 0x50]
movzx eax, byte [esi + 0x40]
movsd xmm0, qword [esi + 0x41]
movsd qword [esi + 0x30], xmm2
movsd qword [esi + 0x37], xmm1
movups xmm2, xmmword [esi + 0x58]
movsd xmm1, qword [esi + 0x68]
mov byte [esi + 7], al
movsd qword [esi + 0x28], xmm0
movaps xmmword [esi + 0x80], xmm2
movsd qword [esi + 0x90], xmm1
movsd xmm2, qword [esi + 0x70]
movsd xmm1, qword [esi + 0x78]
movsd qword [esi + 0x98], xmm2
movsd qword [esi + 0xa0], xmm1
movsd xmm0, qword [esi + 0x37]
movsd xmm1, qword [esi + 0x30]
mov edx, dword [esi + 8]
movsd xmm3, qword [esi + 0x28]
movsd xmm2, qword [esi + 0x90]
movsd qword [esi + 0x1f], xmm0
movsd qword [esi + 0x18], xmm1
movsd xmm1, qword [esi + 0x98]
movzx eax, byte [edx]
movsd qword [esi + 0x10], xmm3
movsd qword [esi + 0x40], xmm2
movsd qword [esi + 0x48], xmm1
movsd xmm1, qword [esi + 0xa0]
cmp eax, 9
movsd qword [esi + 0x50], xmm1
je 0x422cf9
cmp eax, 0xa
je 0x422d0b
mov ecx, dword [esi + 8]
mov dword [esi + 0xc8], 1
call fcn.004046a0
jmp 0x422d0b
lea ecx, [edx + 8]
mov dword [esi + 0xc8], 1
call fcn.00423b10
movzx eax, byte [esi + 7]
mov ecx, dword [esi + 8]
movsd xmm0, qword [esi + 0x10]
movsd xmm1, qword [esi + 0x18]
mov edx, dword [esi + 0xc]
mov byte [ecx], al
movsd qword [ecx + 1], xmm0
movsd xmm0, qword [esi + 0x1f]
movsd qword [ecx + 9], xmm1
mov eax, dword [ebp + 8]
movsd xmm1, qword [esi + 0x48]
movsd qword [ecx + 0x10], xmm0
movaps xmm0, xmmword [esi + 0x80]
movsd xmm2, qword [eax + 0x28]
movups xmmword [ecx + 0x18], xmm0
movsd qword [ecx + 0x30], xmm1
movsd xmm1, qword [eax + 0x30]
movsd xmm0, qword [esi + 0x40]
movsd qword [edx + 0x28], xmm2
movsd xmm2, qword [eax + 0x18]
movsd qword [edx + 0x30], xmm1
movsd xmm1, qword [eax + 0x20]
movsd qword [ecx + 0x28], xmm0
movsd xmm0, qword [esi + 0x50]
movsd qword [edx + 0x18], xmm2
movsd xmm2, qword [eax]
movsd qword [edx + 0x20], xmm1
movsd xmm1, qword [eax + 0x10]
movsd qword [ecx + 0x38], xmm0
movsd xmm0, qword [eax + 0x38]
movsd qword [edx], xmm2
movsd qword [edx + 0x10], xmm1
movsd xmm1, qword [eax + 8]
mov eax, dword [esi + 0xc0]
movsd qword [edx + 0x38], xmm0
movsd qword [edx + 8], xmm1
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4276a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x58
mov ecx, dword [esp + 0x6c]
mov edx, dword [0x636418]
mov eax, dword [esp + 0x70]
mov ecx, dword [ecx]
movzx edx, byte [edx]
cmp dl, 1
jne 0x4276e2
movsd xmm0, qword [eax]
movsd xmm1, qword [eax + 8]
lea edx, [esp + 0x14]
movsd qword [esp + 0x1c], xmm1
movsd qword [esp + 0x14], xmm0
call fcn.00428b50
jmp 0x4278b4
mov dword [esp + 8], ecx
mov esi, dword [eax]
mov ebx, dword [eax + 4]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
lea edx, [esp + 0x14]
cmp eax, 2
mov dword [esp + 0xc], eax
jb 0x4277ff
mov ebp, dword [esp + 0xc]
xor edi, edi
mov dword [esp], ebx
mov dword [esp + 4], ecx
shr ebp, 1
nop word cs:[eax + eax]
nop dword [eax + eax]
mov eax, 0x20
push eax
push 0
push edx
mov ebx, edx
call fcn.00588b30
add esp, 0xc
movsd xmm1, qword [esp + 0x1c]
movsd xmm0, qword [esp + 0x14]
movsd xmm2, qword [esp + 0x24]
mov eax, 0x20
movsd qword [esp + 0x40], xmm1
movsd xmm1, qword [esp + 0x2c]
movsd qword [esp + 0x38], xmm0
movsd qword [esp + 0x48], xmm2
movsd qword [esp + 0x50], xmm1
push eax
push 0
push ebx
call fcn.00588b30
add esp, 0xc
mov eax, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 8]
movsd xmm0, qword [esi]
add edx, eax
movsd qword [esp + 0x14], xmm0
mov dword [esp + 0x1c], ecx
bswap edx
mov dword [esp + 0x20], edx
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 8]
lea ecx, [eax + ecx + 1]
add eax, 2
mov dword [esi + 0x10], eax
bswap ecx
movsd xmm0, qword [esi]
movsd qword [esp + 0x24], xmm0
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], ecx
push ebx
push dword [esp + 0xc]
lea eax, [esp + 0x40]
push eax
call fcn.00501d10
mov edx, ebx
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0xc]
add esp, 0xc
movups xmm0, xmmword [ebx + edi]
movups xmm2, xmmword [esp + 0x38]
movups xmm1, xmmword [ebx + edi + 0x10]
movups xmm3, xmmword [esp + 0x48]
xorps xmm2, xmm0
xorps xmm3, xmm1
movups xmmword [ecx + edi], xmm2
movups xmmword [ecx + edi + 0x10], xmm3
add edi, 0x20
dec ebp
jne 0x427720
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
test al, 1
je 0x4278b4
mov ebp, dword [esi + 8]
and eax, 0xffffffe
shl eax, 4
add ecx, eax
add ebx, eax
mov eax, dword [esi + 0x10]
mov dword [esp + 4], ecx
mov dword [esp], ebp
mov ebp, dword [esi + 0xc]
add ebp, eax
inc eax
mov dword [esi + 0x10], eax
bswap ebp
movsd xmm0, qword [esi]
movsd qword [esp + 0xc], xmm0
push 0x20
push 0
push edx
mov esi, edx
call fcn.00588b30
add esp, 0xc
movsd xmm1, qword [esp + 0x1c]
movsd xmm0, qword [esp + 0x14]
movsd xmm2, qword [esp + 0x2c]
mov eax, dword [esp]
movsd qword [esp + 0x40], xmm1
movsd xmm1, qword [esp + 0x24]
movsd qword [esp + 0x38], xmm0
movsd qword [esp + 0x50], xmm2
movsd qword [esp + 0x48], xmm1
movsd xmm1, qword [esp + 0xc]
movsd qword [esp + 0x38], xmm1
mov dword [esp + 0x40], eax
lea eax, [esp + 0x38]
mov dword [esp + 0x44], ebp
push eax
push edi
push esi
call fcn.00501d10
add esp, 0xc
movups xmm0, xmmword [esp + 0x14]
movups xmm1, xmmword [ebx]
mov eax, dword [esp + 4]
xorps xmm1, xmm0
movups xmmword [eax], xmm1
add esp, 0x58
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x428aa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [edx + 0x10]
mov eax, dword [edx + 0xc]
movsd xmm0, qword [edx]
mov edi, dword [edx + 8]
add eax, esi
movsd qword [esp], xmm0
mov dword [esp + 8], edi
inc esi
bswap eax
mov dword [edx + 0x10], esi
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
movdqa xmm0, xmmword [esp]
pxor xmm0, xmmword [ecx]
aesenc xmm0, xmmword [ecx + 0x10]
aesenc xmm0, xmmword [ecx + 0x20]
aesenc xmm0, xmmword [ecx + 0x30]
aesenc xmm0, xmmword [ecx + 0x40]
aesenc xmm0, xmmword [ecx + 0x50]
aesenc xmm0, xmmword [ecx + 0x60]
aesenc xmm0, xmmword [ecx + 0x70]
aesenc xmm0, xmmword [ecx + 0x80]
aesenc xmm0, xmmword [ecx + 0x90]
aesenc xmm0, xmmword [ecx + 0xa0]
aesenc xmm0, xmmword [ecx + 0xb0]
aesenc xmm0, xmmword [ecx + 0xc0]
aesenc xmm0, xmmword [ecx + 0xd0]
aesenclast xmm0, xmmword [ecx + 0xe0]
movdqu xmmword [eax], xmm0
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret
Function at 0x42d8d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov esi, dword [edx + 8]
mov edi, dword [edx + 4]
mov ebp, ecx
mov bl, 1
lea eax, [esi + 1]
cmp eax, edi
mov dword [edx + 8], eax
jae 0x42d907
mov ecx, dword [edx]
mov bl, 1
movzx ecx, byte [ecx + eax]
cmp ecx, 0x2b
je 0x42d8ff
cmp ecx, 0x2d
jne 0x42d907
xor ebx, ebx
add esi, 2
mov eax, esi
mov dword [edx + 8], esi
cmp eax, edi
jae 0x42daa2
mov esi, dword [edx]
mov dword [esp + 4], ebx
lea ecx, [eax + 1]
movzx ebx, byte [esi + eax]
mov dword [edx + 8], ecx
add bl, 0xd0
cmp bl, 0xa
jae 0x42daac
mov dword [esp], ebp
mov ebp, dword [esp + 0x2c]
movzx ebx, bl
cmp ecx, edi
jae 0x42d998
neg edi
add eax, 2
jmp 0x42d953
movzx ecx, cl
lea ebx, [ebx + ebx*4]
lea ebx, [ecx + ebx*2]
lea ecx, [edi + eax + 1]
inc eax
cmp ecx, 1
je 0x42d998
movzx ecx, byte [esi + eax - 1]
add cl, 0xd0
cmp cl, 0xa
jae 0x42d998
cmp ebx, 0xccccccc
mov dword [edx + 8], eax
jl 0x42d940
jne 0x42d972
cmp cl, 7
jbe 0x42d940
xor eax, eax
or ebp, dword [esp + 0x30]
movzx esi, byte [esp + 4]
movzx edi, byte [esp + 0x28]
mov ecx, dword [esp]
sete al
push esi
push eax
push edi
call fcn.005aa8c0
add esp, 0x20
jmp 0x42da7e
mov edi, dword [esp + 0x34]
cmp byte [esp + 4], 0
je 0x42d9b2
lea eax, [edi + ebx]
sar eax, 0x1f
add eax, 0x80000000
add edi, ebx
jmp 0x42d9c0
xor eax, eax
cmp edi, ebx
setns al
add eax, 0x7fffffff
sub edi, ebx
cmovo edi, eax
mov eax, dword [esp + 0x30]
movd xmm1, ebp
movd xmm0, eax
mov eax, edi
punpckldq xmm1, xmm0
neg eax
punpckldq xmm1, xmmword [0x5b51d0]
cmovs eax, edi
cmp eax, 0x135
subpd xmm1, xmmword [0x5b51e0]
movapd xmm0, xmm1
unpckhpd xmm0, xmm1
addsd xmm0, xmm1
jb 0x42da83
movsd xmm2, qword [0x5b51f0]
mov esi, dword [esp]
xorpd xmm1, xmm1
ucomisd xmm0, xmm1
jne 0x42da18
jnp 0x42da63
test edi, edi
jns 0x42dace
divsd xmm0, xmm2
add edi, 0x134
mov eax, edi
neg eax
cmovs eax, edi
cmp eax, 0x134
ja 0x42da10
mov ecx, dword [0x6363fc]
test edi, edi
movsd xmm1, qword [ecx + eax*8]
js 0x42da95
mulsd xmm0, xmm1
ucomisd xmm0, qword [0x5b51f8]
jae 0x42dace
movsd xmm1, qword [0x5b5200]
ucomisd xmm1, xmm0
jae 0x42dace
cmp byte [esp + 0x28], 0
jne 0x42da72
xorpd xmm0, xmmword [0x5b5210]
movsd qword [esi + 8], xmm0
xor eax, eax
mov dword [esi], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [esp]
mov ecx, dword [0x6363fc]
test edi, edi
movsd xmm1, qword [ecx + eax*8]
jns 0x42da47
divsd xmm0, xmm1
cmp byte [esp + 0x28], 0
je 0x42da6a
jmp 0x42da72
mov dword [esp + 8], 5
jmp 0x42dab4
mov dword [esp + 8], 0xd
lea eax, [esp + 8]
push eax
push edx
call fcn.005aa950
add esp, 8
mov dword [ebp + 4], eax
mov dword [ebp], 1
jmp 0x42da7b
lea eax, [esp + 8]
mov dword [esp + 8], 0xe
push eax
push edx
call fcn.005aa950
add esp, 8
mov dword [esi + 4], eax
mov eax, 1
jmp 0x42da79