joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4835a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66127d
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x6d6ec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [ebp - 4], 0
lea ecx, [esi + 0x3c]
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
movups xmmword [esi + 0x18], xmm0
movq qword [esi + 0x28], xmm0
mov dword [esi + 0x30], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x34], 0xffffffff
mov dword [esi + 0xc], 2
mov dword [esi + 0x38], 0
call fcn.004b6a30
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x44], 0
mov word [esi + 0x48], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x49b390
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x662cf3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x6d6ec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
lea eax, [edi + 0xc]
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi], vtable.Concurrency::streams::details::streambuf_state_manager_unsigned_char_.0
push eax
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.0060caa0
lea ecx, [edi + 0x14]
mov al, 1
lea edx, [edi + 0x15]
mov byte [ecx], 0
lea esi, [edi + 0x16]
mov byte [edx], 0
add edi, 0x17
mov byte [esi], 0
mov byte [edi], 0
xchg byte [ecx], al
mov al, 1
xchg byte [edx], al
xor al, al
xchg byte [esi], al
xor al, al
xchg byte [edi], al
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi], vtable.Concurrency::streams::details::basic_producer_consumer_buffer_unsigned_char_.0
mov dword [edi + 0x18], 1
mov dword [edi + 0x1c], eax
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
lea esi, [edi + 0x68]
mov dword [edi + 0x2c], 0
xorps xmm0, xmm0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
movups xmmword [edi + 0x44], xmm0
push 8
movq qword [edi + 0x54], xmm0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x60], 0xffffffff
mov dword [edi + 0x38], 2
mov dword [edi + 0x64], 0
mov byte [ebp - 4], 1
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.0061f577
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
lea esi, [edi + 0x7c]
mov byte [ebp - 4], 2
push 8
mov dword [ebp + 8], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.0061f577
add esp, 0xc
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4b1150
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x664ebe
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x6d6ec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ebp - 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
lea edi, [ecx + 0x10]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], edi
mov ecx, edi
push 0x6a60ec
mov dword [ebp - 0x14], edi
call fcn.00423c90
lea esi, [edi + 0x18]
xorps xmm0, xmm0
mov dword [ebp - 0x18], esi
xor eax, eax
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
movups xmmword [esi + 0x18], xmm0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], 7
mov word [esi + 0x18], ax
movups xmmword [esi + 0x30], xmm0
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], 7
mov word [esi + 0x30], ax
push 0x6a60ec
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 5
call fcn.00423c90
xor eax, eax
xorps xmm0, xmm0
movups xmmword [esi + 0x60], xmm0
mov dword [esi + 0x70], 0
xor ecx, ecx
mov dword [esi + 0x74], 7
mov word [esi + 0x60], ax
movups xmmword [esi + 0x78], xmm0
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], 7
mov word [esi + 0x78], ax
mov dword [esi + 0x90], 0xffffffff
mov dword [edi + 0xac], eax
movups xmmword [edi + 0xb0], xmm0
mov dword [edi + 0xc0], eax
mov dword [edi + 0xc4], 7
mov word [edi + 0xb0], ax
mov dword [edi + 0xc8], eax
mov dword [edi + 0xcc], eax
mov dword [edi + 0xd0], eax
mov eax, dword [ebp - 0x10]
movups xmmword [eax + 0xe8], xmm0
mov dword [eax + 0xf8], 0
mov dword [eax + 0xfc], 7
mov word [eax + 0xe8], cx
mov dword [eax + 0x100], ecx
mov dword [eax + 0x104], ecx
mov dword [eax + 0x108], ecx
mov byte [eax + 0x110], cl
mov dword [eax + 0x118], 0x1c9c380
mov dword [eax + 0x11c], ecx
mov dword [eax + 0x120], ecx
mov word [eax + 0x124], 0x100
mov dword [eax + 0x14c], ecx
mov dword [eax + 0x174], ecx
mov byte [eax + 0x178], cl
mov dword [eax + 0x17c], 0xa
mov byte [eax + 0x180], cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4be8f0
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x66610d
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x6d6ec0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x24], esi
push 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
call fcn.0061f577
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 1
lea eax, [esi + 4]
mov dword [ebp - 0x18], eax
test edi, edi
je 0x4bea3a
mov ecx, dword [esi]
xorps xmm0, xmm0
mov esi, dword [eax]
sub esi, ecx
mov dword [ebp - 0x1c], ecx
shr esi, 1
movups xmmword [edi], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
cmp esi, 0x7ffffffe
ja 0x4beadc
cmp esi, 7
ja 0x4be9a0
mov dword [edi + 0x10], esi
add esi, esi
push esi
push ecx
push edi
mov dword [edi + 0x14], 7
call fcn.006217b0
add esp, 0xc
xor eax, eax
mov word [esi + edi], ax
jmp 0x4bea3f
mov eax, esi
or eax, 7
cmp eax, 0x7ffffffe
jbe 0x4be9ea
mov eax, SysReAllocString
mov dword [ebp - 0x14], SysReAllocString
add eax, eax
cmp eax, 0x1000
jb 0x4bea09
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x4beae6
push ecx
call fcn.0061f577
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4beae1
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x4bea12
mov ecx, 0xa
cmp eax, ecx
cmovb eax, ecx
mov dword [ebp - 0x14], eax
inc eax
cmp eax, 0x7fffffff
ja 0x4beae6
add eax, eax
jne 0x4be9ba
jmp 0x4bea12
push eax
call fcn.0061f577
add esp, 4
mov ecx, dword [ebp - 0x14]
mov dword [edi + 0x10], esi
add esi, esi
push esi
push dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
push eax
mov dword [edi], eax
mov dword [edi + 0x14], ecx
call fcn.006217b0
mov eax, dword [ebp - 0x10]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax], cx
jmp 0x4bea3f
xor edi, edi
mov dword [ebp - 0x18], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], 0
mov dword [esi], edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 1
call fcn.004be6a0
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov esi, dword [esi]
mov ecx, dword [edi]
mov eax, dword [eax]
cmp ecx, eax
je 0x4beac6
sub eax, ecx
cmp dword [esi + 0x14], 7
mov ecx, esi
jbe 0x4bea7d
mov ecx, dword [esi]
push 0
push eax
push ecx
call dword [sym.imp.CRYPT32.dll_CryptUnprotectMemory]
test eax, eax
je 0x4beaeb
cmp dword [esi + 0x14], 7
mov edx, esi
jbe 0x4bea95
mov edx, dword [esi]
mov eax, dword [edi + 0xc]
mov ecx, dword [esi + 0x10]
sub ecx, eax
lea eax, [edx + eax*2]
je 0x4beaad
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4beaa2
mov eax, dword [edi + 0xc]
cmp dword [esi + 0x10], eax
jb 0x4beb0c
mov dword [esi + 0x10], eax
cmp dword [esi + 0x14], 7
jbe 0x4beac0
mov esi, dword [esi]
xor ecx, ecx
mov word [esi + eax*2], cx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.00402f70
call fcn.00636c1b
call fcn.00402ea0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004be830
add esp, 8
lea eax, [ebp - 0x38]
push 0x6d196c
push eax
call fcn.0062173b
call fcn.0044f820
int3
Function at 0x4d2d00
Capabilities:
Read http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x667a75
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x6d6ec0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x50], eax
mov edi, dword [eax]
add edi, 0x2c
mov ecx, edi
mov esi, dword [edi]
push dword [esi + 4]
push edi
call fcn.0045e020
push 0
lea eax, [ebp - 0x44]
mov dword [esi + 4], esi
push eax
push 0
push 0
mov dword [esi], esi
mov dword [esi + 8], esi
mov esi, dword [ebp - 0x48]
push 0x13
mov dword [edi + 4], 0
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
push esi
mov dword [ebp - 0x44], 0
call edi
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
movups xmmword [ebp - 0x28], xmm0
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x4d2dad
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov word [ebp + eax*2 - 0x28], cx
jmp 0x4d2db8
push 0
push eax
lea ecx, [ebp - 0x28]
call fcn.0044ca40
cmp dword [ebp - 0x14], 7
lea ecx, [ebp - 0x44]
push 0
push ecx
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
push eax
push 0
push 0x13
push esi
call edi
call fcn.00637999
cmp dword [ebp - 0x14], 7
lea esi, [ebp - 0x28]
mov edi, eax
lea eax, [ebp - 0x4c]
cmova esi, dword [ebp - 0x28]
push 0xa
push eax
push esi
mov dword [edi], 0
call fcn.0062cf6a
add esp, 0xc
cmp esi, dword [ebp - 0x4c]
je 0x4d2f06
cmp dword [edi], 0x22
je 0x4d2f10
mov ecx, dword [ebp - 0x14]
movzx edi, ax
mov dword [ebp - 4], 0xffffffff
cmp ecx, 7
jbe 0x4d2e4e
mov edx, dword [ebp - 0x28]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4d2e44
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d2f1a
push ecx
push edx
call fcn.0061f90d
add esp, 8
mov esi, dword [ebp - 0x50]
push dword [ebp - 0x48]
mov eax, dword [esi]
mov word [eax + 0x44], di
lea eax, [ebp - 0x40]
push eax
call fcn.004d2ae0
add esp, 8
mov ecx, dword [esi]
add ecx, 0x48
mov dword [ebp - 4], 1
cmp ecx, eax
je 0x4d2e89
cmp dword [eax + 0x14], 7
mov edx, eax
jbe 0x4d2e80
mov edx, dword [eax]
push dword [eax + 0x10]
push edx
call fcn.00446de0
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 7
jbe 0x4d2ec6
mov edx, dword [ebp - 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4d2ebc
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d2f1f
push ecx
push edx
call fcn.0061f90d
add esp, 8
xor eax, eax
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
mov eax, dword [esi]
add eax, 0x2c
mov dword [ebp - 0x2c], 7
push eax
push dword [ebp - 0x54]
call fcn.004acaa0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0061f478
mov esp, ebp
pop ebp
ret
push str.invalid_stoi_argument
call fcn.0060d5bc
push str.stoi_argument_out_of_range
call fcn.0060d5fc
call fcn.00636c1b
call fcn.00636c1b
int3
Function at 0x4d8ea0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x668435
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x6d6ec0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x38], esi
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], 0x3f
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x28], xmm0
call fcn.004538c0
movups xmm0, xmmword [str.HashVerificationFilter:_message_hash_or_MAC_not_valid]
mov edx, dword [ebp - 0x2c]
mov ecx, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], 0x35
mov dword [ebp - 0x14], edx
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x6741e0]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x6741f0]
movups xmmword [ecx + 0x20], xmm0
mov eax, dword [0x674200]
mov dword [ecx + 0x30], eax
mov al, byte [0x674204]
mov byte [ecx + 0x34], al
mov byte [ecx + 0x35], 0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movq qword [esi + 4], xmm0
mov dword [esi], vtable.CryptoPP::Exception.0
lea edi, [esi + 0x10]
mov dword [esi + 0xc], 3
lea eax, [ebp - 0x30]
cmp edx, 0xf
mov byte [ebp - 4], 1
push eax
movups xmmword [edi], xmm0
lea esi, [ebp - 0x28]
mov dword [edi + 0x10], 0
push edi
mov dword [edi + 0x14], 0
cmova esi, ecx
mov dword [ebp - 0x30], 0x3f
call fcn.004538c0
mov ecx, eax
mov dword [edi + 0x10], 0x35
mov eax, dword [ebp - 0x30]
add esp, 0x10
mov dword [edi + 0x14], eax
mov dword [edi], ecx
movups xmm0, xmmword [esi]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [esi + 0x20]
movups xmmword [ecx + 0x20], xmm0
mov eax, dword [esi + 0x30]
mov dword [ecx + 0x30], eax
mov ax, word [esi + 0x34]
mov word [ecx + 0x34], ax
mov eax, dword [ebp - 0x2c]
cmp eax, 0xf
jbe 0x4d8fee
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x28]
cmp ecx, 0x1000
jb 0x4d8fe4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4d9012
mov eax, edx
push ecx
push eax
call fcn.0061f90d
add esp, 8
mov eax, dword [ebp - 0x34]
mov dword [eax], vtable.CryptoPP::HashVerificationFilter::HashVerificationFailed.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0061f478
mov esp, ebp
pop ebp
ret
call fcn.00636c1b
int3
Function at 0x4ed4e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov edi, dword [esp + 0x14]
cmp eax, 4
jb 0x4ed514
mov esi, eax
shr esi, 2
nop dword [eax]
mov ecx, dword [edi]
sub eax, 4
xor ecx, dword [edx]
add edi, 4
or ebx, ecx
add edx, 4
sub esi, 1
jne 0x4ed500
mov esi, ebx
mov ecx, ebx
shr esi, 8
xor ebp, ebp
or esi, ebx
shr ecx, 0x10
and esi, 0xff00
or esi, ecx
movzx ecx, bl
shr esi, 8
or esi, ecx
test eax, eax
je 0x4ed5f4
mov ebx, edi
sub ebx, edx
cmp eax, 8
jb 0x4ed5d3
mov ecx, eax
xorps xmm4, xmm4
and ecx, 0xfffffff8
xorps xmm3, xmm3
mov dword [esp + 0x1c], ecx
lea ecx, [edx + 4]
nop dword [eax]
movd xmm2, dword [edi + ebp]
lea ecx, [ecx + 8]
movd xmm1, dword [ecx - 0xc]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
add ebp, 8
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [ecx - 8]
orps xmm4, xmm2
movd xmm2, dword [ebx + ecx - 8]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp ebp, dword [esp + 0x1c]
jb 0x4ed560
orps xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd ecx, xmm3
or esi, ecx
cmp ebp, eax
jae 0x4ed5f4
lea edi, [edx + ebp]
sub eax, ebp
nop dword [eax + eax]
movzx edx, byte [ebx + edi]
lea edi, [edi + 1]
movzx ecx, byte [edi - 1]
xor edx, ecx
or esi, edx
sub eax, 1
jne 0x4ed5e0
pop edi
test esi, esi
pop esi
pop ebp
sete al
pop ebx
ret
Function at 0x4ed600
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x24
test eax, eax
je 0x4ed7a8
mov edx, dword [esp + 0x2c]
push ebx
mov ebx, dword [esp + 0x34]
push esi
mov esi, dword [esp + 0x30]
push edi
cmp eax, 4
jb 0x4ed643
mov edi, eax
shr edi, 2
mov ecx, dword [edx]
sub eax, 4
xor ecx, dword [ebx]
add edx, 4
mov dword [esi], ecx
add ebx, 4
add esi, 4
sub edi, 1
jne 0x4ed628
mov dword [esp + 0x40], eax
push ebp
xor ebp, ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], ebx
test eax, eax
je 0x4ed7a4
cmp eax, 8
jb 0x4ed789
lea ecx, [ebx - 1]
lea edi, [esi - 1]
add ecx, eax
add edi, eax
cmp esi, ecx
ja 0x4ed679
cmp edi, ebx
jae 0x4ed789
lea ecx, [edx - 1]
add ecx, eax
cmp esi, ecx
ja 0x4ed68a
cmp edi, edx
jae 0x4ed789
cmp eax, 0x40
jb 0x4ed73e
mov edi, eax
mov ecx, eax
mov eax, edx
and edi, 0x3f
sub eax, ebx
mov dword [esp + 0x30], edi
mov dword [esp + 0x1c], eax
sub ecx, edi
mov eax, esi
mov dword [esp + 0x2c], ecx
sub eax, ebx
lea edi, [esi + 0x20]
mov dword [esp + 0x20], eax
lea ecx, [ebx + 0x10]
mov ebx, dword [esp + 0x20]
mov eax, edx
sub eax, esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
lea eax, [edx + 0x30]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x44]
movups xmm1, xmmword [edx + ebp]
mov edx, dword [esp + 0x24]
lea ecx, [ecx + 0x40]
movups xmm0, xmmword [ecx - 0x50]
lea edi, [edi + 0x40]
xorps xmm1, xmm0
movups xmmword [edi - 0x60], xmm1
movups xmm0, xmmword [ecx - 0x40]
movups xmm1, xmmword [esi + ecx - 0x40]
xorps xmm1, xmm0
movups xmmword [ebx + ecx - 0x40], xmm1
movups xmm1, xmmword [edx + edi - 0x40]
mov edx, dword [esp + 0x28]
movups xmm0, xmmword [ecx - 0x30]
xorps xmm1, xmm0
movups xmmword [edi - 0x40], xmm1
movups xmm1, xmmword [edx + ebp]
mov edx, dword [esp + 0x10]
add ebp, 0x40
movups xmm0, xmmword [ecx - 0x20]
xorps xmm1, xmm0
movups xmmword [edi - 0x30], xmm1
cmp ebp, dword [esp + 0x2c]
jb 0x4ed6d5
cmp dword [esp + 0x30], 8
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
jb 0x4ed785
and eax, 0xfffffff8
lea ecx, [ebx + ebp]
mov dword [esp + 0x30], eax
sub edx, ebx
mov edi, dword [esp + 0x30]
mov eax, esi
sub eax, ebx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], eax
mov eax, edx
mov edx, dword [esp + 0x28]
movq xmm1, qword [ecx + eax]
lea ecx, [ecx + 8]
movq xmm0, qword [ecx - 8]
add ebp, 8
xorps xmm1, xmm0
movq qword [edx + ecx - 8], xmm1
cmp ebp, edi
jb 0x4ed760
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x10]
cmp ebp, eax
jae 0x4ed7a4
sub edx, ebx
lea edi, [ebx + ebp]
sub esi, ebx
sub eax, ebp
mov cl, byte [edi + edx]
lea edi, [edi + 1]
xor cl, byte [edi - 1]
mov byte [esi + edi - 1], cl
sub eax, 1
jne 0x4ed792
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x4f06c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor edx, edx
movaps xmm5, xmmword [0x6764f0]
push esi
mov esi, dword [esp + 0xc]
movups xmm4, xmmword [eax]
pshufb xmm4, xmmword [0x6764e0]
mov eax, dword [esp + 0x10]
movaps xmm3, xmm4
add eax, 0xffffffe0
je 0x4f07fb
dec eax
lea ecx, [esi + 8]
shr eax, 5
inc eax
mov edx, eax
shl edx, 5
nop dword [eax + eax]
movq qword [ecx - 8], xmm3
movaps xmm2, xmm3
lea ecx, [ecx + 0x20]
movaps xmm0, xmm3
movaps xmm1, xmm3
pclmulqdq xmm1, xmm4, 0
pclmulqdq xmm0, xmm4, 1
pclmulqdq xmm2, xmm4, 0x10
xorps xmm2, xmm0
movaps xmm0, xmm1
pslldq xmm0, 8
xorps xmm2, xmm0
movaps xmm0, xmm1
psrldq xmm1, 8
pclmulqdq xmm0, xmm5, 0x10
xorps xmm2, xmm0
movaps xmm0, xmm3
xorps xmm1, xmm2
psllq xmm1, 1
pclmulqdq xmm0, xmm4, 0x11
pclmulqdq xmm1, xmm5, 0
xorps xmm1, xmm0
movaps xmm0, xmm2
psrldq xmm0, 8
xorps xmm1, xmm0
punpcklqdq xmm2, xmm1
psllq xmm1, 1
psrlq xmm2, 0x3f
xorps xmm2, xmm1
movaps xmm0, xmm2
movaps xmm1, xmm2
movups xmmword [ecx - 0x18], xmm2
movups xmmword [ecx - 0x20], xmm3
movq qword [ecx - 0x20], xmm2
movaps xmm3, xmm2
pclmulqdq xmm1, xmm4, 0
pclmulqdq xmm0, xmm4, 1
pclmulqdq xmm3, xmm4, 0x10
xorps xmm3, xmm0
movaps xmm0, xmm1
pslldq xmm0, 8
xorps xmm3, xmm0
movaps xmm0, xmm1
psrldq xmm1, 8
pclmulqdq xmm0, xmm5, 0x10
xorps xmm3, xmm0
xorps xmm1, xmm3
movaps xmm0, xmm3
psllq xmm1, 1
psrldq xmm0, 8
pclmulqdq xmm1, xmm5, 0
pclmulqdq xmm2, xmm4, 0x11
xorps xmm1, xmm2
xorps xmm1, xmm0
punpcklqdq xmm3, xmm1
psrlq xmm3, 0x3f
psllq xmm1, 1
xorps xmm3, xmm1
sub eax, 1
jne 0x4f0700
movaps xmm2, xmm3
movq qword [edx + esi], xmm3
pclmulqdq xmm2, xmm4, 0x10
movaps xmm0, xmm3
movaps xmm1, xmm3
pclmulqdq xmm0, xmm4, 1
xorps xmm2, xmm0
pclmulqdq xmm1, xmm4, 0
movaps xmm0, xmm1
pslldq xmm0, 8
xorps xmm2, xmm0
movaps xmm0, xmm1
pclmulqdq xmm0, xmm5, 0x10
xorps xmm2, xmm0
psrldq xmm1, 8
xorps xmm1, xmm2
movaps xmm0, xmm3
psllq xmm1, 1
pclmulqdq xmm0, xmm4, 0x11
pclmulqdq xmm1, xmm5, 0
xorps xmm1, xmm0
movaps xmm0, xmm2
psrldq xmm0, 8
xorps xmm1, xmm0
punpcklqdq xmm2, xmm1
psrlq xmm2, 0x3f
psllq xmm1, 1
xorps xmm2, xmm1
movups xmmword [edx + esi + 0x10], xmm2
movups xmmword [edx + esi + 8], xmm3
movq qword [edx + esi + 8], xmm2
pop esi
ret
Function at 0x4fae30
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4faedf
push esi
call fcn.005149d0
add esp, 4
test al, al
jne 0x4faedf
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4fae57
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.0051e270
add esp, 0xc
test eax, eax
je 0x4fae8b
sub eax, esi
push eax
push 0x2e
push esi
call fcn.0051e270
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x4fae8d
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x4faebe
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.0050f210
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x4faea0
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x5020d0
Capabilities:
Convert ip address from string

Disassembly:
sub esp, 0x14
mov eax, dword [0x6d6ec0]
xor eax, esp
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov eax, dword [ecx]
push edi
mov edi, dword [esp + 0x28]
mov eax, dword [eax + 4]
and eax, 0xa
cmp al, 0xa
mov eax, dword [ecx + 0xc]
jne 0x502107
mov esi, dword [eax + 0x78]
mov ebx, dword [eax + 0x7c]
mov ebp, dword [eax + 0x80]
jmp 0x502113
mov esi, dword [eax + 0x30]
mov ebx, dword [eax + 0x34]
mov ebp, dword [eax + 0x500]
test esi, esi
je 0x5021f4
mov eax, dword [edi]
test eax, eax
je 0x502150
mov ecx, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x502143
test dl, dl
je 0x50213f
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x502143
add ecx, 2
add eax, 2
test dl, dl
jne 0x502123
xor eax, eax
jmp 0x502148
sbb eax, eax
or eax, 1
test eax, eax
je 0x5021f4
push edi
call fcn.00502080
push esi
call dword [0x6d480c]
mov edx, eax
add esp, 8
mov dword [edi], edx
test edx, edx
je 0x5021aa
test ebx, ebx
je 0x5021cb
mov ecx, ebx
nop
mov al, byte [esi]
cmp al, byte [ecx]
jne 0x502190
test al, al
je 0x50218c
mov al, byte [esi + 1]
cmp al, byte [ecx + 1]
jne 0x502190
add esi, 2
add ecx, 2
test al, al
jne 0x502170
xor eax, eax
jmp 0x502195
sbb eax, eax
or eax, 1
test eax, eax
je 0x5021cb
push ebx
call dword [0x6d480c]
add esp, 4
mov dword [edi + 4], eax
test eax, eax
jne 0x5021ce
push edi
call fcn.00502080
add esp, 4
mov eax, 0x1b
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0061f478
add esp, 0x14
ret
mov dword [edi + 4], edx
mov esi, dword [edi]
test esi, esi
je 0x50222a
cmp byte [esi], 0
je 0x50222a
mov ebx, dword [sym.imp.WS2_32.dll_inet_pton]
lea eax, [esp + 0x10]
push eax
push esi
push 2
call ebx
test eax, eax
je 0x502213
mov dword [edi + 0xc], 1
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov dword [edi + 0x10], ebp
mov dword [edi + 0x14], eax
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0061f478
add esp, 0x14
ret
lea eax, [esp + 0x10]
push eax
push esi
push 0x17
call ebx
test eax, eax
je 0x50222a
mov dword [edi + 0xc], 2
jmp 0x5021f4
mov ecx, dword [edi]
mov dword [edi + 0xc], 0
cmp byte [ecx], 0
je 0x5021f4
mov esi, ecx
lea edx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x502240
sub esi, edx
je 0x502253
cmp byte [ecx + esi - 1], 0x2e
jne 0x502253
dec esi
cmp esi, 0xffff
jae 0x5021f4
lea eax, [esi + 1]
push eax
push 1
call dword [0x6d4810]
add esp, 8
mov dword [edi + 8], eax
test eax, eax
je 0x5021aa
push esi
push dword [edi]
push eax
call fcn.0050f270
mov eax, dword [edi + 8]
add esp, 0xc
mov byte [esi + eax], 0
jmp 0x5021f4