joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484d10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x2c], edi
test esi, esi
je 0x484efd
test edi, edi
je 0x484d3d
cmp dword [edi + 0x200], 0
jne 0x484d4c
mov eax, 0xffff
add word [esi + 0x28], ax
jne 0x484efd
mov ebx, dword [esi + 8]
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x484e9f
jmp 0x484d60
mov esi, dword [ebx + 0x14]
mov dword [esp + 0x18], esi
test edi, edi
je 0x484d78
cmp dword [edi + 0x200], 0
jne 0x484e3f
mov esi, dword [ebx]
mov dword [esp + 0x30], esi
mov ecx, esi
test esi, esi
je 0x484d9e
cmp byte [esi], 0
je 0x484d96
lea esp, [esp]
inc ecx
cmp byte [ecx], 0
jne 0x484d90
sub ecx, esi
and ecx, 0x3fffffff
mov eax, dword [ebx + 0x18]
add eax, 0x18
mov dword [esp + 0x10], ecx
mov edx, dword [eax]
mov dword [esp + 0x14], eax
mov dword [esp + 0x34], edx
test edx, edx
je 0x484e11
xor eax, eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], esi
test ecx, ecx
jle 0x484e05
mov ebx, ecx
mov edi, eax
mov ecx, esi
lea ebx, [ebx]
movzx eax, byte [ecx]
lea edx, [edi*8]
movzx esi, byte [eax + 0x5dcd28]
xor esi, edx
dec ebx
xor edi, esi
lea ecx, [ecx + 1]
test ebx, ebx
jg 0x484dd0
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x30]
mov dword [esp + 0xc], edi
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
xor edx, edx
div dword [esp + 0x34]
mov eax, dword [esp + 0x14]
jmp 0x484e13
xor edx, edx
push edx
mov dword [esp + 0x14], edx
push ecx
mov edx, esi
mov ecx, eax
call fcn.00451050
add esp, 8
test eax, eax
je 0x484e3b
push dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov edx, eax
call fcn.00451100
add esp, 4
mov esi, dword [esp + 0x18]
test edi, edi
je 0x484e4c
cmp dword [edi + 0x200], 0
jne 0x484e60
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x484e60
dec dword [eax]
jne 0x484e60
push eax
call fcn.0044d3b0
add esp, 4
mov edx, dword [ebx + 0x24]
mov ecx, edi
call fcn.0047bde0
mov edx, dword [ebx + 0x10]
mov ecx, edi
call fcn.0044d450
test byte [ebx + 0x38], 0x10
je 0x484e84
mov edx, dword [ebx + 0x20]
mov ecx, edi
call fcn.0044d450
mov edx, ebx
mov ecx, edi
call fcn.0044d450
mov ebx, esi
mov dword [esp + 0x1c], esi
test esi, esi
jne 0x484d60
mov esi, dword [esp + 0x20]
mov edx, esi
mov ecx, edi
call fcn.00492200
mov edx, esi
mov ecx, edi
call fcn.00484c90
mov edx, dword [esi]
mov ecx, edi
call fcn.0044d450
mov edx, dword [esi + 0x14]
mov ecx, edi
call fcn.0044d450
mov esi, dword [esi + 0xc]
test esi, esi
je 0x484edd
mov edx, esi
mov ecx, edi
call fcn.0049b280
mov edx, esi
mov ecx, edi
call fcn.0044d450
mov esi, dword [esp + 0x20]
mov ecx, edi
mov edx, dword [esi + 0x18]
call fcn.0047caa0
mov edx, esi
mov ecx, edi
call fcn.004abb40
mov edx, esi
mov ecx, edi
call fcn.0044d450
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x487590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x629688]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebx]
add edx, edx
mov eax, dword [eax + 0x10]
push esi
mov esi, dword [eax + edx*8]
mov eax, 1
push edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], eax
lea esp, [esp]
push eax
push str.sqlite_stat_d
lea eax, [ebp - 0x1c]
push eax
push 0x18
call fcn.0044ef80
mov ecx, dword [ebx]
add esp, 0x10
cmp byte [ebp - 0x1c], 0
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x1c]
je 0x487606
lea esp, [esp]
inc edx
cmp byte [edx], 0
jne 0x487600
lea eax, [ebp - 0x1c]
sub edx, eax
mov eax, dword [ecx + 0x14]
and edx, 0x3fffffff
xor ebx, ebx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x44], eax
test eax, eax
jle 0x487741
mov edi, ebx
cmp ebx, 2
jge 0x487631
xor edi, 1
test esi, esi
je 0x48768f
mov ecx, dword [ecx + 0x10]
mov edx, edi
add edx, edx
mov eax, esi
mov esi, dword [ecx + edx*8]
mov ecx, dword [ebp - 0x24]
mov cl, byte [ecx]
test cl, cl
je 0x48766d
lea ebx, [ebx]
movzx edx, byte [esi]
movzx ecx, cl
mov cl, byte [ecx + 0x5dcd28]
cmp cl, byte [edx + 0x5dcd28]
jne 0x48766d
mov cl, byte [eax + 1]
inc eax
inc esi
test cl, cl
jne 0x487650
movzx eax, byte [eax]
movzx ecx, byte [esi]
movzx eax, byte [eax + 0x5dcd28]
movzx ecx, byte [ecx + 0x5dcd28]
sub eax, ecx
jne 0x487703
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx + 0x10]
add edi, edi
mov ecx, dword [eax + edi*8 + 0xc]
add ecx, 8
mov dword [ebp - 0x20], ecx
cmp dword [ecx + 0xc], 0
je 0x4876db
xor esi, esi
mov edi, edx
lea ebx, [ebp - 0x1c]
test edx, edx
jle 0x4876d0
nop
movzx eax, byte [ebx]
lea ecx, [esi*8]
movzx edx, byte [eax + 0x5dcd28]
xor edx, ecx
dec edi
xor esi, edx
lea ebx, [ebx + 1]
test edi, edi
jg 0x4876b0
mov ecx, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x34]
mov eax, esi
xor edx, edx
div dword [ecx]
jmp 0x4876dd
xor edx, edx
push edx
push dword [ebp - 0x28]
lea edx, [ebp - 0x1c]
call fcn.00451050
add esp, 8
test eax, eax
je 0x4876fc
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x487720
jmp 0x487706
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x487706
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
inc ebx
mov dword [ebp - 0x34], ebx
cmp ebx, dword [ebp - 0x44]
jl 0x487627
test eax, eax
je 0x487741
push dword [ebp - 0x3c]
mov esi, dword [ebp - 0x24]
push dword [ebp - 0x40]
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x1c]
push eax
push esi
push str.DELETE_FROM__Q._s_WHERE__s_Q
push ebx
call fcn.00484610
add esp, 0x18
jmp 0x487744
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 4
jle 0x4875d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00586d1b
mov esp, ebp
pop ebp
ret
Function at 0x4bea40
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bb936
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x629688]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
jne 0x4beac7
mov eax, dword [0x634974]
test al, 1
jne 0x4beaa9
or eax, 1
mov dword [0x634974], eax
mov dword [ebp - 4], 0
call fcn.00448ef0
push 0x5c0980
call fcn.00586165
add esp, 4
mov dword [ebp - 4], 0xffffffff
push str.OPM_db_is_not_initialized_in_opd_getOpdSchemaVersion
push 0x5e96ac
push 0x6348e0
call fcn.00449f70
add esp, 0xc
mov eax, 1
jmp 0x4beb45
push 0x35
push str.SELECT_value_FROM_opm_meta_WHERE_keyschema_version
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.004082e0
mov dword [ebp - 4], 1
cmp dword [ebp - 0x14], 0x10
mov ecx, dword [esi]
lea edx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
push edi
call fcn.004bdf10
mov edi, eax
add esp, 4
test edi, edi
jne 0x4beb32
push 0x43
push str.SELECT_value_FROM_opm_meta_WHERE_keyschema_compatibility_version
lea ecx, [ebp - 0x28]
call fcn.004082e0
cmp dword [ebp - 0x14], 0x10
mov ecx, dword [esi]
lea edx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
push ebx
call fcn.004bdf10
add esp, 4
mov edi, eax
cmp dword [ebp - 0x14], 0x10
jb 0x4beb43
push dword [ebp - 0x28]
call fcn.0058603b
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00586d1b
mov esp, ebp
pop ebp
ret 8
Function at 0x4c1df0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bbe2e
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x629688]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x21c], 0x100
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x4c1e93
mov eax, dword [0x634974]
test al, 1
jne 0x4c1e71
or eax, 1
mov dword [0x634974], eax
mov dword [ebp - 4], 0
call fcn.00448ef0
push 0x5c0980
call fcn.00586165
add esp, 4
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._Failed_in_getting_user_name_error:_d
push 0x5e96ac
push 0x6348e0
call fcn.00449f70
add esp, 0x10
xor al, al
jmp 0x4c1ed0
cmp word [ebp - 0x218], 0
jne 0x4c1ea1
xor ecx, ecx
jmp 0x4c1ebf
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4c1eb0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00408410
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00586d1b
mov esp, ebp
pop ebp
ret
Function at 0x4c2840
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5bc068
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x629688]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 0
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x2c]
mov edi, edx
xor al, al
push edx
rep stosb byte es:[edi], al
call fcn.005864b7
mov dword [esp + 0x1c], 0xffffffff
mov ecx, dword [esi + 0xc]
add esp, 4
test ecx, ecx
je 0x4c289b
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [esp + 0x20], 1
je 0x4c28ab
push esi
call fcn.0058603b
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x4c31d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5bc033
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x629688]
xor eax, esp
mov dword [esp + 0x48], eax
push esi
push edi
mov eax, dword [0x629688]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [esp + 0x6c]
mov esi, dword [esp + 0x68]
mov dword [edi + 0xc], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 4
mov dword [edi + 0x14], 0
mov dword [esp + 0x60], 2
mov dword [edi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [edi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
xor ecx, ecx
mov dword [edi + 0x2c], 0
call fcn.00448ae0
mov dword [edi + 0x30], 0
mov dword [esp + 0x60], 3
xor ecx, ecx
mov dword [edi + 0x4c], 0
call fcn.00448ae0
mov dword [edi + 0x50], 0
push 0
push 0x62e3ec
push 0x62dee4
mov byte [esp + 0x6c], 4
push 0
push esi
mov dword [edi], vtable.CryptoPP::StreamTransformationFilter.1.0
mov dword [edi + 4], vtable.CryptoPP::StreamTransformationFilter.0
mov dword [edi + 0x54], esi
call fcn.0058b40c
add esp, 0x14
test eax, eax
je 0x4c330b
push str.StreamTransformationFilter:_please_use_AuthenticatedEncryptionFilter_and_AuthenticatedDecryptionFilter_for_AuthenticatedSymmetricCipher
lea ecx, [esp + 0x40]
call fcn.00407ed0
lea ecx, [esp + 0x14]
mov byte [esp + 0x60], 5
call fcn.00586c3b
push 0xffffffffffffffff
mov byte [esp + 0x64], 6
push 0
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x20], vtable.CryptoPP::Exception.0
mov dword [esp + 0x2c], 1
mov dword [esp + 0x44], 0xf
mov dword [esp + 0x40], 0
mov byte [esp + 0x30], 0
call fcn.004086b0
push 0x60e5b4
lea eax, [esp + 0x18]
mov byte [esp + 0x64], 5
push eax
mov dword [esp + 0x1c], vtable.CryptoPP::InvalidArgument.0
call fcn.00586d2a
push ecx
lea eax, [esp + 0x10]
push eax
mov edx, str.BlockPaddingScheme
lea ecx, [esp + 0x44]
call fcn.004c4420
add esp, 8
push eax
mov ecx, edi
mov byte [esp + 0x64], 7
call fcn.004c28d0
mov byte [esp + 0x60], 4
mov ecx, dword [esp + 0x40]
test ecx, ecx
je 0x4c3342
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, edi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00586d1b
add esp, 0x58
ret 0x10
Function at 0x4c3370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5bc0a0
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x629688]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x18], 0
mov edx, dword [esi + 0x50]
mov ecx, dword [esi + 0x4c]
mov edi, edx
xor al, al
push edx
rep stosb byte es:[edi], al
call fcn.005864b7
mov dword [esp + 0x1c], 1
mov edx, dword [esi + 0x30]
mov ecx, dword [esi + 0x2c]
mov edi, edx
xor al, al
push edx
rep stosb byte es:[edi], al
call fcn.005864b7
mov dword [esp + 0x20], 0xffffffff
mov ecx, dword [esi + 0xc]
add esp, 8
test ecx, ecx
je 0x4c33e5
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [esp + 0x20], 1
je 0x4c33f5
push esi
call fcn.0058603b
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x4c6cc0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5bc8d8
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x629688]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], 0
mov eax, dword [ecx]
push esi
mov eax, dword [eax + 0x30]
call eax
mov bl, al
mov dword [esp + 0x14], 0xffffffff
test esi, esi
je 0x4c6d10
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx]
mov al, bl
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x4c6d30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5bc908
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x629688]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
call dword [eax + 0x24]
mov esi, eax
mov dword [esp + 0x10], esi
push dword [esp + 0x30]
mov dword [esp + 0x20], 0
push dword [esp + 0x30]
mov eax, dword [edi]
push esi
mov ecx, edi
call dword [eax + 0x28]
push dword [esp + 0x28]
mov eax, dword [esi]
push dword [esp + 0x28]
mov ecx, esi
call dword [eax + 0xc]
mov eax, dword [edi]
push esi
mov eax, dword [eax + 0x30]
mov ecx, edi
call eax
mov dword [esp + 0x1c], 0xffffffff
mov edx, dword [esi]
push 1
mov ecx, esi
mov bl, al
call dword [edx]
mov al, bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x10
Function at 0x4c7700
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5bc3f8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x629688]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push esi
push edi
mov eax, dword [0x629688]
xor eax, esp
push eax
lea eax, [esp + 0x78]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [esp + 0x8c]
mov edi, dword [esp + 0x88]
push ecx
lea ecx, [esp + 0x60]
mov dword [esp + 0x14], ebx
call fcn.004c7570
add esp, 4
mov esi, eax
push 0x5f3ed4
lea eax, [esp + 0x30]
push edi
push eax
mov dword [esp + 0x8c], 0
call fcn.0041c780
add esp, 0xc
push esi
push eax
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x8c], 1
call fcn.004c7500
add esp, 0xc
push str._is_not_a_valid_key_length
push eax
lea eax, [esp + 0x4c]
push eax
mov byte [esp + 0x8c], 2
call fcn.00415860
add esp, 0xc
mov esi, eax
mov ecx, ebx
mov byte [esp + 0x80], 3
call fcn.00586c3b
mov byte [esp + 0x80], 4
lea ecx, [ebx + 0x10]
push 0xffffffffffffffff
mov dword [ebx], vtable.CryptoPP::Exception.0
mov dword [ebx + 0xc], 1
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push esi
mov byte [ecx], 0
call fcn.004086b0
cmp dword [esp + 0x58], 0x10
mov dword [ebx], vtable.CryptoPP::InvalidArgument.0
jb 0x4c7801
push dword [esp + 0x44]
call fcn.0058603b
add esp, 4
cmp dword [esp + 0x28], 0x10
mov dword [esp + 0x58], 0xf
mov dword [esp + 0x54], 0
mov byte [esp + 0x44], 0
jb 0x4c7829
push dword [esp + 0x14]
call fcn.0058603b
add esp, 4
cmp dword [esp + 0x40], 0x10
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
jb 0x4c7851
push dword [esp + 0x2c]
call fcn.0058603b
add esp, 4
cmp dword [esp + 0x70], 0x10
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
jb 0x4c7879
push dword [esp + 0x5c]
call fcn.0058603b
add esp, 4
mov eax, ebx
mov dword [ebx], vtable.CryptoPP::InvalidKeyLength.0
mov ecx, dword [esp + 0x78]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00586d1b
add esp, 0x74
ret 8

Function at 0x4c81b0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push esi
xor eax, eax
push edi
movzx edx, byte [eax + 0x5e04a8]
mov edi, edx
shr edi, 7
mov esi, edi
imul edi, edi, 0x11b
imul esi, esi, 0x1b000000
mov ecx, edx
shl ecx, 0x19
xor esi, ecx
mov ecx, edx
shl ecx, 8
or ecx, edx
shl ecx, 8
or esi, ecx
lea ecx, [edx + edx]
xor edi, ecx
xor edi, edx
xor ecx, ecx
or edi, esi
or ecx, esi
mov dword [eax*8 + 0x631ab0], ecx
mov dword [eax*8 + 0x631ab4], edi
inc eax
cmp eax, 0x100
jl 0x4c81b4
xorps xmm0, xmm0
pop edi
movlpd qword [0x6322b8], xmm0
movlpd qword [0x6322b0], xmm0
mov byte [0x631532], 1
pop esi
ret
Function at 0x4c8230
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor edx, edx
push esi
mov dword [esp + 0x18], edx
push edi
lea ecx, [ecx]
movzx edi, byte [edx + 0x5e03a8]
mov eax, edi
shr eax, 5
mov edx, eax
mov ebx, eax
and eax, 1
mov dword [esp + 0x14], eax
and edx, 4
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], edi
lea ecx, [edi + edi]
xor ecx, edi
mov edx, edi
lea ebp, [ecx + ecx]
xor ebp, dword [esp + 0x10]
shr edi, 7
mov eax, edi
imul edi, edi, 0x11b
imul eax, eax, 0x1b000000
shl ebp, 0x19
xor ebp, eax
mov eax, dword [esp + 0x14]
imul eax, eax, 0x1b000000
xor ebp, eax
and ebx, 2
mov eax, ebx
imul eax, eax, 0x1b000000
xor ebp, eax
shr edx, 6
mov esi, edx
and edx, 1
mov eax, edx
imul edx, edx, 0x11b00
imul eax, eax, 0x1b000000
xor ebp, eax
and esi, 2
mov eax, esi
imul esi, esi, 0x11b00
imul eax, eax, 0x1b000000
xor ebp, eax
mov eax, dword [esp + 0x18]
imul eax, eax, 0x1b000000
xor ebp, eax
mov eax, dword [esp + 0x14]
shl ecx, 2
imul eax, eax, 0x11b00
xor ecx, dword [esp + 0x10]
shl ecx, 8
xor ecx, eax
mov eax, ebx
imul eax, eax, 0x11b00
xor ecx, eax
xor ecx, edx
xor ecx, esi
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov eax, esi
imul eax, eax, 0x11b00
xor ecx, eax
mov eax, dword [esp + 0x10]
or ebp, ecx
lea ecx, [eax*8]
xor ecx, eax
mov eax, edx
imul edx, edx, 0x11b
imul eax, eax, 0x11b0000
shl ecx, 0x10
xor ecx, eax
mov eax, ebx
imul eax, eax, 0x11b0000
xor ecx, eax
mov eax, esi
imul eax, eax, 0x11b0000
xor ecx, eax
mov eax, dword [esp + 0x10]
or ebp, ecx
lea ecx, [eax*4]
xor ecx, eax
add ecx, ecx
xor ecx, edi
xor ecx, edx
imul ebx, ebx, 0x11b
imul esi, esi, 0x11b
xor ecx, ebx
mov edx, eax
xor ecx, esi
xor ecx, edx
or edx, ebp
xor eax, eax
or eax, edx
mov edx, dword [esp + 0x1c]
or ecx, ebp
mov dword [edx*8 + 0x633fb8], eax
mov dword [edx*8 + 0x633fbc], ecx
inc edx
mov dword [esp + 0x1c], edx
cmp edx, 0x100
jl 0x4c8240
pop edi
pop esi
pop ebp
mov byte [0x631531], 1
pop ebx
add esp, 0x10
ret
Function at 0x4d3ac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, ecx
mov ecx, 0x5e06ba
sub ecx, edx
push ebx
mov dword [ebp - 4], ecx
push esi
mov ecx, 0x5e06bb
sub ecx, edx
push edi
mov dword [ebp - 8], ecx
mov edi, 0x5e06b8
mov ebx, 0x5e06b9
mov ecx, 0x5e06bc
sub edi, edx
sub ebx, edx
sub ecx, edx
mov byte [edx], 0xda
lea eax, [edx + 1]
mov dword [ebp - 0xc], ecx
mov esi, 0x33
movzx ecx, byte [edi + eax]
xor cl, byte [edx]
lea eax, [eax + 5]
mov byte [eax - 5], cl
movzx ecx, byte [ebx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 4], cl
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 3], cl
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 2], cl
mov ecx, dword [ebp - 0xc]
movzx ecx, byte [ecx + eax - 5]
xor cl, byte [edx]
mov byte [eax - 1], cl
dec esi
jne 0x4d3b02
pop edi
pop esi
mov eax, 0x100
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4db370
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x629688]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x5e1cec
push eax
mov ebx, ecx
mov byte [ebp - 0x69], 0
call fcn.0058994b
mov esi, eax
add esp, 8
mov dword [ebp - 0x78], esi
test esi, esi
jne 0x4db407
call fcn.0058c30d
push dword [eax]
call fcn.0058f5d5
mov edx, eax
add esp, 4
cmp byte [edx], 0
jne 0x4db3d8
xor ecx, ecx
push ecx
push edx
lea ecx, [ebx + 0x1c]
call fcn.004082e0
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00586d1b
mov esp, ebp
pop ebp
ret 4
mov ecx, edx
lea esi, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4db3e0
sub ecx, esi
push ecx
push edx
lea ecx, [ebx + 0x1c]
call fcn.004082e0
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00586d1b
mov esp, ebp
pop ebp
ret 4
push edi
mov edi, dword [ebx + 0x14]
mov dword [ebp - 0x74], edi
test edi, edi
jne 0x4db41f
push esi
call fcn.005890ae
mov al, 1
jmp 0x4db56d
test byte [ebx + 0x34], 1
je 0x4db4ec
cmp dword [ebx + 0x18], 0x10
lea edi, [ebx + 4]
mov dword [ebp - 0x7c], edi
jb 0x4db43a
mov edi, dword [edi]
mov dword [ebp - 0x7c], edi
push esi
push 1
lea eax, [ebp - 0x70]
push 2
push eax
mov word [ebp - 0x70], 0xfeff
call fcn.0058a2cd
add esp, 0x10
cmp eax, 1
jne 0x4db4cf
push dword [ebp - 0x74]
mov edx, edi
xor ecx, ecx
call fcn.004dbb40
mov edi, eax
xor ecx, ecx
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00582537
push dword [ebp - 0x74]
mov edx, dword [ebp - 0x7c]
mov esi, eax
mov ecx, esi
call fcn.004dbb40
push dword [ebp - 0x78]
lea eax, [edi + edi]
push 1
push eax
push esi
call fcn.0058a2cd
cmp eax, 1
push esi
sete byte [ebp - 0x69]
call fcn.00586d16
push edi
push dword [ebp - 0x74]
lea eax, [ebp - 0x68]
push str._d_bytes_to_BOM___d_wide_chars
push eax
call fcn.00586419
add esp, 0x30
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebx + 0x1c]
call fcn.004080a0
cmp byte [ebp - 0x69], 0
jne 0x4db4e7
call fcn.0058c30d
push dword [eax]
call fcn.0058f5d5
add esp, 4
lea ecx, [ebx + 0x1c]
push eax
call fcn.004080a0
push dword [ebp - 0x78]
jmp 0x4db565
cmp dword [ebx + 0x18], 0x10
lea eax, [ebx + 4]
jb 0x4db4f7
mov eax, dword [eax]
push esi
push 1
push edi
push eax
call fcn.0058a2cd
cmp eax, 1
push edi
lea eax, [ebp - 0x68]
push str._d_bytes
push eax
sete byte [ebp - 0x69]
call fcn.00586419
add esp, 0x1c
cmp byte [ebp - 0x68], 0
jne 0x4db524
xor ecx, ecx
jmp 0x4db539
lea ecx, [ebp - 0x68]
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4db530
sub ecx, edx
push ecx
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebx + 0x1c]
call fcn.004082e0
cmp byte [ebp - 0x69], 0
jne 0x4db564
call fcn.0058c30d
push dword [eax]
call fcn.0058f5d5
add esp, 4
lea ecx, [ebx + 0x1c]
push eax
call fcn.004080a0
push esi
call fcn.005890ae
mov al, byte [ebp - 0x69]
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00586d1b
mov esp, ebp
pop ebp
ret 4