joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44fed4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x44fee8
add esp, 0xfffffff0
call fcn.00408b24
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x449f70]
call fcn.0046d9b4
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x44ef10]
call fcn.00470784
mov dword [esi + 8], eax
mov dl, 1
mov eax, dword [0x44ef10]
call fcn.00470784
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x10], eax
mov eax, esi
test bl, bl
je 0x44ff3d
call fcn.00408b7c
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ba6f0
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x4ba733
cmp byte [ebx + 0x11], 0
jne 0x4ba733
cmp byte [ebx + 0x24], 0
jne 0x4ba733
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4ba74a
mov ecx, dword [0x54d9b4]
mov dl, 1
mov eax, dword [0x48a31c]
call fcn.00427eec
call fcn.004099d8
pop ebx
ret
mov ecx, dword [0x54d9b4]
mov dl, 1
mov eax, dword [0x48a31c]
call fcn.00427eec
call fcn.004099d8
pop ebx
ret

Function at 0x4bb0b8
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4bb106
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004ba59c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bb11f
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4bb128
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004ba59c
dec esi
jne 0x4bb14a
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x5080dc
Capabilities:
Allocate or change rwx memory
Enumerate pe sections

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffefc
mov esi, edx
lea edi, [esp + 0xc]
push ecx
mov ecx, 0x3e
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
push eax
call fcn.00508084
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
movzx eax, word [eax + 6]
push eax
mov eax, 0x5549e8
mov ecx, 1
mov edx, dword [0x507f90]
call fcn.0040d024
add esp, 4
mov eax, dword [esp + 4]
mov eax, dword [eax]
movzx edi, word [eax + 6]
dec edi
test edi, edi
jl 0x508237
inc edi
xor esi, esi
mov eax, dword [esp + 8]
cmp dword [eax + 0x10], 0
jne 0x5081b0
mov ebp, dword [esp + 0x44]
test ebp, ebp
jle 0x5081a1
push 0x40
push 0x1000
push ebp
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 4]
call fcn.00507ff8
push eax
call sub.kernel32.dll_VirtualAlloc
mov ebx, eax
mov eax, dword [0x5549e8]
mov dword [eax + esi*8], ebx
mov eax, dword [0x5549e8]
mov dword [eax + esi*8 + 4], ebp
mov eax, dword [esp + 8]
mov dword [eax + 8], ebx
mov eax, ebx
xor ecx, ecx
mov edx, ebp
call fcn.00407d5c
push 0
push 0x28
lea eax, [esp + 0x10]
call fcn.00507fc8
jmp 0x50822f
push 0x40
push 0x1000
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0xc]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 4]
call fcn.00507ff8
push eax
call sub.kernel32.dll_VirtualAlloc
mov ebx, eax
mov eax, dword [0x5549e8]
mov dword [eax + esi*8], ebx
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x10]
mov edx, dword [0x5549e8]
mov dword [edx + esi*8 + 4], eax
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x14]
xor edx, edx
push edx
push eax
mov eax, dword [esp + 8]
call fcn.00507ff8
mov edx, dword [esp + 8]
mov edx, dword [edx + 0x10]
mov ecx, ebx
xchg edx, ecx
call fcn.00407380
mov eax, dword [esp + 8]
mov dword [eax + 8], ebx
push 0
push 0x28
lea eax, [esp + 0x10]
call fcn.00507fc8
inc esi
dec edi
jne 0x508145
add esp, 0x104
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5086bc
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
test eax, 0x4000000
je 0x5086d1
or edx, 0x200
test eax, 0x20000000
je 0x508704
test eax, 0x40000000
je 0x5086f0
test eax, 0x80000000
je 0x5086eb
or edx, 0x40
jmp 0x50872b
or edx, 0x20
jmp 0x50872b
test eax, 0x80000000
je 0x5086ff
or edx, 0x80
jmp 0x50872b
or edx, 0x10
jmp 0x50872b
test eax, 0x40000000
je 0x50871c
test eax, 0x80000000
je 0x508717
or edx, 4
jmp 0x50872b
or edx, 2
jmp 0x50872b
test eax, 0x80000000
je 0x508728
or edx, 8
jmp 0x50872b
or edx, 1
mov eax, edx
pop ebp
ret 4
Function at 0x509a10
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x509ae0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x509afc
call fcn.0040a7d4
mov ebx, 1
mov esi, 0x40
push esi
push ebx
push 0x509b54
push 0
lea eax, [ebp - 0xc]
push eax
call sub.advapi32.dll_CryptAcquireContextW
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
xor eax, eax
push ebp
push 0x509ab9
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 0xd], 0
je 0x509a8a
mov eax, dword [ebp - 8]
add eax, 8
push eax
push 8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CryptGenRandom
test eax, eax
jne 0x509a98
call fcn.005098f8
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x509ac0
cmp byte [ebp - 0xd], 0
je 0x509ab6
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CryptReleaseContext
pop eax
jmp eax

Function at 0x50a0f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe8
mov edi, edx
mov esi, eax
test esi, esi
je 0x50a15d
test edi, edi
je 0x50a15d
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, edi
mov edx, dword [eax]
call dword [edx]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, dword [esp]
mov edx, dword [esp + 4]
cmp edx, dword [esp + 0xc]
jne 0x50a132
cmp eax, dword [esp + 8]
jae 0x50a145
jmp 0x50a134
jge 0x50a145
mov eax, dword [esp]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
jmp 0x50a155
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov ebx, eax
jmp 0x50a15f
xor ebx, ebx
test ebx, ebx
jle 0x50a1a6
mov edx, dword [esi + 4]
mov ecx, dword [edi + 4]
mov eax, ebx
test eax, eax
jns 0x50a172
add eax, 3
sar eax, 2
dec eax
test eax, eax
jl 0x50a188
inc eax
mov esi, dword [ecx]
xor dword [edx], esi
add edx, 4
add ecx, 4
dec eax
jne 0x50a17b
mov eax, ebx
and eax, 0x80000003
jns 0x50a196
dec eax
or eax, 0xfffffffc
inc eax
dec eax
test eax, eax
jl 0x50a1a6
inc eax
movzx ebx, byte [ecx]
xor byte [edx], bl
inc edx
inc ecx
dec eax
jne 0x50a19c
add esp, 0x18
pop edi
pop esi
pop ebx
ret
Function at 0x50a1b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd0
mov edi, ecx
mov esi, edx
mov ebx, eax
test ebx, ebx
je 0x50a27b
test esi, esi
je 0x50a27b
test edi, edi
je 0x50a27b
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, esi
mov edx, dword [eax]
call dword [edx]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
cmp edx, dword [esp + 0x14]
jne 0x50a206
cmp eax, dword [esp + 0x10]
jae 0x50a21a
jmp 0x50a208
jge 0x50a21a
mov eax, dword [esp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
jmp 0x50a22a
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, edi
mov edx, dword [eax]
call dword [edx]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
cmp edx, dword [esp + 0x24]
jne 0x50a24e
cmp eax, dword [esp + 0x20]
jae 0x50a262
jmp 0x50a250
jge 0x50a262
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
jmp 0x50a272
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
jmp 0x50a280
xor eax, eax
mov dword [esp], eax
cmp dword [esp], 0
jle 0x50a2dc
mov edx, dword [ebx + 4]
mov ecx, dword [esi + 4]
mov ebx, dword [edi + 4]
mov eax, dword [esp]
test eax, eax
jns 0x50a299
add eax, 3
sar eax, 2
dec eax
test eax, eax
jl 0x50a2b4
inc eax
mov esi, dword [ecx]
xor esi, dword [ebx]
mov dword [edx], esi
add edx, 4
add ecx, 4
add ebx, 4
dec eax
jne 0x50a2a2
mov esi, edx
mov edx, ecx
mov ecx, ebx
mov eax, dword [esp]
and eax, 0x80000003
jns 0x50a2c9
dec eax
or eax, 0xfffffffc
inc eax
dec eax
test eax, eax
jl 0x50a2dc
inc eax
movzx ebx, byte [edx]
xor bl, byte [ecx]
mov byte [esi], bl
inc esi
inc edx
inc ecx
dec eax
jne 0x50a2cf
add esp, 0x30
pop edi
pop esi
pop ebx
ret
Function at 0x50fefc
Capabilities:
Encode data using xor
Encrypt data using hc-128

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
mov eax, dword [eax + edx*4]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x10
jne 0x50ff0e
mov dword [ebp - 8], 0x10
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [eax + edx*4 - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [eax + edx*4 - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
shr eax, 0x11
mov edx, dword [ebp - 0x10]
shl edx, 0xf
or eax, edx
mov edx, dword [ebp - 0x10]
shr edx, 0x13
mov ecx, dword [ebp - 0x10]
shl ecx, 0xd
or edx, ecx
xor eax, edx
mov edx, dword [ebp - 0x10]
shr edx, 0xa
xor eax, edx
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add eax, dword [edx + ecx*4 - 0x1c]
mov edx, dword [ebp - 0x14]
shr edx, 7
mov ecx, dword [ebp - 0x14]
shl ecx, 0x19
or edx, ecx
mov ecx, dword [ebp - 0x14]
shr ecx, 0x12
mov ebx, dword [ebp - 0x14]
shl ebx, 0xe
or ecx, ebx
xor edx, ecx
mov ecx, dword [ebp - 0x14]
shr ecx, 3
xor edx, ecx
add eax, edx
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
add eax, dword [edx + ecx*4 - 0x40]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + edx*4], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x40
jne 0x50ff30
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50ffd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov dword [ebp - 4], edx
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
mov ebx, dword [ebp - 8]
mov esi, dword [ecx + ebx*8]
mov dword [eax + edx*8], esi
mov esi, dword [ecx + ebx*8 + 4]
mov dword [eax + edx*8 + 4], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x10
jne 0x50ffe3
mov dword [ebp - 8], 0x10
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [eax + edx*8 - 0x10]
mov dword [ebp - 0x18], ecx
mov ecx, dword [eax + edx*8 - 0xc]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [eax + edx*8 - 0x78]
mov dword [ebp - 0x20], ecx
mov ecx, dword [eax + edx*8 - 0x74]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
shrd eax, edx, 0x13
shr edx, 0x13
push edx
push eax
mov edx, dword [ebp - 0x18]
shl edx, 0xd
xor eax, eax
or eax, dword [esp]
or edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 0x14]
shr eax, 0x1d
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
shld edx, eax, 3
shl eax, 3
or eax, dword [esp]
or edx, dword [esp + 4]
add esp, 8
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
shrd eax, edx, 6
shr edx, 6
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
add eax, dword [ecx + ebx*8 - 0x38]
adc edx, dword [ecx + ebx*8 - 0x34]
push edx
push eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
shrd eax, edx, 1
shr edx, 1
push edx
push eax
mov edx, dword [ebp - 0x20]
shl edx, 0x1f
xor eax, eax
or eax, dword [esp]
or edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
shrd eax, edx, 8
shr edx, 8
push edx
push eax
mov edx, dword [ebp - 0x20]
shl edx, 0x18
xor eax, eax
or eax, dword [esp]
or edx, dword [esp + 4]
add esp, 8
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
shrd eax, edx, 7
shr edx, 7
xor eax, dword [esp]
xor edx, dword [esp + 4]
add esp, 8
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp - 8]
add eax, dword [ecx + ebx*8 - 0x80]
adc edx, dword [ecx + ebx*8 - 0x7c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax + edx*8], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + edx*8 + 4], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x50
jne 0x51000d
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x510158
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 0x2c], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
shr eax, 6
mov edx, dword [ebp - 0x14]
shl edx, 0x1a
or eax, edx
mov edx, dword [ebp - 0x14]
shr edx, 0xb
mov ecx, dword [ebp - 0x14]
shl ecx, 0x15
or edx, ecx
xor eax, edx
mov edx, dword [ebp - 0x14]
shr edx, 0x19
mov ecx, dword [ebp - 0x14]
shl ecx, 7
or edx, ecx
xor eax, edx
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x1c]
mov edx, dword [ebp - 0x18]
and edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
not ecx
and ecx, dword [ebp - 0x20]
xor edx, ecx
add eax, edx
mov edx, dword [ebp - 0x10]
add eax, dword [edx*4 + 0x54ada8]
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
add eax, dword [edx + ecx*4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
shr eax, 2
mov edx, dword [ebp - 4]
mov edx, dword [edx]
shl edx, 0x1e
or eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx]
shr edx, 0xd
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
shl ecx, 0x13
or edx, ecx
xor eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx]
shr edx, 0x16
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
shl ecx, 0xa
or edx, ecx
xor eax, edx
mov edx, dword [ebp - 4]
mov edx, dword [edx]
and edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
and ecx, dword [ebp - 0x28]
xor edx, ecx
mov ecx, dword [ebp - 0x24]
and ecx, dword [ebp - 0x28]
xor edx, ecx
add eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov edx, dword [ebp - 4]
mov dword [edx + 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov dword [edx], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x40
jne 0x510169
mov esp, ebp
pop ebp
ret
Function at 0x5177b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
xor eax, eax
mov esi, 4
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 4]
movzx ebx, byte [ecx]
movzx edi, byte [edx]
shl edi, 5
lea edi, [edi*8 + 0x54b304]
xor al, byte [edi + ebx]
inc ecx
inc edx
dec esi
jne 0x5177e3
mov edx, dword [ebp - 0x14]
mov byte [edx], al
inc dword [ebp - 0x14]
add dword [ebp - 0x10], 4
dec dword [ebp - 0xc]
jne 0x5177d6
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x518270
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], eax
mov ecx, 4
lea eax, [ebp - 8]
lea edx, [ebp - 4]
movzx ebx, byte [eax]
movzx ebx, byte [ebx + str.cw]
mov byte [edx], bl
inc edx
inc eax
dec ecx
jne 0x518285
mov eax, dword [ebp - 4]
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x5185dc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
xor ecx, ecx
lea ebx, [ecx + edx]
mov esi, dword [eax + 0x10]
mov ebx, dword [esi + ebx*4 + 0x14]
xor dword [eax + ecx*4 + 0x14], ebx
inc ecx
cmp ecx, 4
jne 0x5185e0
pop esi
pop ebx
ret
Function at 0x52fde4
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov esi, ecx
mov edi, edx
mov dword [esp + 0x14], eax
mov eax, edi
test eax, eax
je 0x52fdfe
sub eax, 4
mov eax, dword [eax]
mov dword [esp], eax
cmp dword [esp], 2
jge 0x52fe1b
mov ecx, 0x136
mov edx, 0x52ff60
mov eax, 0x530040
call fcn.0040a1e8
mov eax, dword [esp]
mov ebx, dword [edi + eax*4 - 4]
mov eax, dword [esi]
test eax, eax
je 0x52fe2d
sub eax, 4
mov eax, dword [eax]
cmp eax, dword [esp]
je 0x52fe4b
mov eax, dword [esp]
push eax
mov eax, esi
mov ecx, 1
mov edx, dword [0x411a50]
call fcn.0040d024
add esp, 4
mov ecx, dword [esp]
shl ecx, 2
mov edx, dword [esi]
mov eax, edi
call fcn.00407380
xor eax, eax
mov dword [esp + 4], eax
mov eax, 0x34
cdq
idiv dword [esp]
add eax, 5
cmp eax, 0
jb 0x52ff49
mov dword [esp + 0xc], eax
add dword [esp + 4], 0x9e3779b9
mov eax, dword [esp + 4]
shr eax, 2
and eax, 3
mov dword [esp + 8], eax
mov eax, dword [esp]
sub eax, 2
test eax, eax
jb 0x52feee
inc eax
mov dword [esp + 0x10], eax
xor eax, eax
mov edx, dword [esi]
mov edx, dword [edx + eax*4 + 4]
mov ecx, ebx
shr ecx, 5
mov edi, edx
shl edi, 2
xor ecx, edi
mov edi, edx
shr edi, 3
mov ebp, ebx
shl ebp, 4
xor edi, ebp
add ecx, edi
mov edi, 3
and edi, eax
xor edi, dword [esp + 8]
mov ebp, dword [esp + 0x14]
xor ebx, dword [ebp + edi*4]
xor edx, dword [esp + 4]
add ebx, edx
xor ecx, ebx
mov edx, dword [esi]
add ecx, dword [edx + eax*4]
mov ebx, ecx
mov edx, dword [esi]
mov dword [edx + eax*4], ebx
inc eax
dec dword [esp + 0x10]
jne 0x52fea0
mov eax, dword [esi]
mov eax, dword [eax]
mov edx, ebx
shr edx, 5
mov ecx, eax
shl ecx, 2
xor edx, ecx
mov ecx, eax
shr ecx, 3
mov edi, ebx
shl edi, 4
xor ecx, edi
add edx, ecx
mov ecx, dword [esp]
dec ecx
and ecx, 3
xor ecx, dword [esp + 8]
mov edi, dword [esp + 0x14]
xor ebx, dword [edi + ecx*4]
xor eax, dword [esp + 4]
add ebx, eax
xor edx, ebx
mov eax, dword [esi]
mov ecx, dword [esp]
add edx, dword [eax + ecx*4 - 4]
mov ebx, edx
mov eax, dword [esi]
mov edx, dword [esp]
mov dword [eax + edx*4 - 4], ebx
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xffffffff
jne 0x52fe79
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x530068
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
mov esi, ecx
mov ebx, edx
mov dword [esp + 0x10], eax
mov eax, ebx
test eax, eax
je 0x530082
sub eax, 4
mov eax, dword [eax]
mov dword [esp], eax
cmp dword [esp], 2
jge 0x53009f
mov ecx, 0x158
mov edx, 0x5301d8
mov eax, 0x5302b8
call fcn.0040a1e8
mov eax, dword [esi]
test eax, eax
je 0x5300aa
sub eax, 4
mov eax, dword [eax]
cmp eax, dword [esp]
je 0x5300c8
mov eax, dword [esp]
push eax
mov eax, esi
mov ecx, 1
mov edx, dword [0x411a50]
call fcn.0040d024
add esp, 4
mov ecx, dword [esp]
shl ecx, 2
mov edx, dword [esi]
mov eax, ebx
call fcn.00407380
mov eax, 0x34
xor edx, edx
div dword [esp]
add eax, 6
imul eax, eax, 0x9e3779b9
mov dword [esp + 4], eax
mov eax, dword [esi]
mov edx, dword [eax]
cmp dword [esp + 4], 0
je 0x5301c2
mov eax, dword [esp + 4]
shr eax, 2
and eax, 3
mov dword [esp + 8], eax
mov eax, dword [esp]
dec eax
cmp eax, 1
jb 0x530160
mov ecx, dword [esi]
mov ecx, dword [ecx + eax*4 - 4]
mov ebx, ecx
shr ebx, 5
mov edi, edx
shl edi, 2
xor ebx, edi
mov edi, edx
shr edi, 3
mov ebp, ecx
shl ebp, 4
xor edi, ebp
add ebx, edi
mov edi, 3
and edi, eax
xor edi, dword [esp + 8]
mov ebp, dword [esp + 0x10]
xor ecx, dword [ebp + edi*4]
xor edx, dword [esp + 4]
add ecx, edx
xor ebx, ecx
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
sub edx, ebx
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
dec eax
test eax, eax
jne 0x530114
mov eax, dword [esi]
mov ecx, dword [esp]
mov eax, dword [eax + ecx*4 - 4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
shr eax, 5
mov ecx, edx
shl ecx, 2
xor eax, ecx
mov ecx, edx
shr ecx, 3
mov ebx, dword [esp + 0xc]
shl ebx, 4
xor ecx, ebx
add eax, ecx
mov ecx, dword [esp + 8]
xor ecx, 0
mov ebx, dword [esp + 0x10]
mov ecx, dword [ebx + ecx*4]
xor ecx, dword [esp + 0xc]
xor edx, dword [esp + 4]
add ecx, edx
xor eax, ecx
mov edx, dword [esi]
mov edx, dword [edx]
sub edx, eax
mov eax, dword [esi]
mov dword [eax], edx
sub dword [esp + 4], 0x9e3779b9
cmp dword [esp + 4], 0
jne 0x5300fd
add esp, 0x14
pop ebp
pop edi
pop esi
pop ebx
ret