joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441e30
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x110], ecx
mov dword [ecx], 0xc
lea edi, [esi + 2]
lea ebx, [ebx]
movzx ebx, byte [eax + 1]
movzx edx, byte [eax]
shl ebx, 8
or edx, ebx
movzx ebx, byte [eax + 2]
shl ebx, 0x10
or edx, ebx
movzx ebx, byte [eax + 3]
shl ebx, 0x18
or edx, ebx
movzx ebx, byte [eax + 5]
mov dword [ebp + esi*4 - 0x104], edx
movzx edx, byte [eax + 4]
shl ebx, 8
or edx, ebx
movzx ebx, byte [eax + 6]
shl ebx, 0x10
or edx, ebx
movzx ebx, byte [eax + 7]
shl ebx, 0x18
or edx, ebx
mov dword [ebp + esi*4 - 0x100], edx
add eax, 8
add esi, 2
dec edi
jne 0x441e60
mov dword [ecx + 4], 0xb7e15163
mov eax, 1
mov edx, dword [ecx + eax*4]
sub edx, 0x61c88647
mov dword [ecx + eax*4 + 4], edx
inc eax
cmp eax, 0x1a
jl 0x441ec0
xor eax, eax
xor edi, edi
mov dword [ebp - 0x108], eax
xor esi, esi
mov dword [ebp - 0x10c], 0x4e
jmp 0x441ef6
mov ecx, dword [ebp - 0x110]
add eax, esi
add eax, dword [ecx + edi*4 + 4]
inc edi
rol eax, 3
mov dword [ecx + edi*4], eax
mov ecx, dword [ebp - 0x108]
lea ebx, [esi + eax]
lea edx, [esi + eax]
add edx, dword [ebp + ecx*4 - 0x104]
mov ecx, ebx
neg ecx
and ecx, 0x1f
mov esi, edx
shr esi, cl
mov ecx, ebx
and ecx, 0x1f
shl edx, cl
mov ecx, dword [ebp - 0x108]
or esi, edx
mov dword [ebp + ecx*4 - 0x104], esi
cmp edi, 0x1a
jl 0x441f3e
xor edi, edi
inc ecx
mov dword [ebp - 0x108], ecx
cmp ecx, 4
jl 0x441f54
mov dword [ebp - 0x108], 0
dec dword [ebp - 0x10c]
jne 0x441ef0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x441f70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x645bd0
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
add ebx, 0x10
push ebx
mov dword [ebp - 0xdc], eax
mov esi, edx
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0xe0], 0
call fcn.004effa4
mov edx, dword [esi]
mov edi, eax
mov dword [edi], edx
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp + 0xc]
mov dword [edi + 8], ecx
mov edx, dword [esi + 0xc]
mov ecx, dword [ebp - 0xd8]
push eax
mov dword [edi + 0xc], edx
push ecx
lea edx, [edi + 0x10]
push edx
call fcn.005dd900
push 0x6c632c
lea ecx, [ebp - 0xd4]
call fcn.00441e30
push 1
lea eax, [ebp - 0xd4]
push eax
push ebx
mov eax, edi
mov ecx, edi
call fcn.00441920
push edi
lea esi, [ebp - 0x2c]
call fcn.00440d40
add esp, 0x24
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x18], 8
mov esi, dword [ebp - 0x2c]
jae 0x442031
lea esi, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
add edx, edx
xor eax, eax
cmp edx, ecx
jbe 0x44205b
lea esp, [esp]
movzx ebx, byte [esi + ecx]
xor ebx, eax
and ebx, 0xff
shr eax, 8
xor eax, dword [ebx*4 + 0x68c148]
inc ecx
cmp ecx, edx
jb 0x442040
lea ecx, [ebp - 0xd8]
not eax
push ecx
mov ebx, 4
lea esi, [ebp - 0x48]
mov dword [ebp - 0xd8], eax
call fcn.00440d40
add esp, 4
mov byte [ebp - 4], 1
test edi, edi
je 0x44208b
push edi
call fcn.004effaf
add esp, 4
mov esi, dword [ebp - 0xdc]
lea edx, [ebp - 0x48]
push edx
push esi
lea ebx, [ebp - 0x2c]
call fcn.0040ac60
mov edi, 8
add esp, 8
cmp dword [ebp - 0x34], edi
jb 0x4420b7
mov eax, dword [ebp - 0x48]
push eax
call fcn.004effaf
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], 0
mov word [ebp - 0x48], cx
cmp dword [ebp - 0x18], edi
jb 0x4420dc
mov edx, dword [ebp - 0x2c]
push edx
call fcn.004effaf
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x447a20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push ebx
mov dword [eax], 0
cmp dword [0x6c5330], 0
push esi
je 0x447a7d
mov eax, dword [0x6ce8d8]
test eax, eax
je 0x447a4d
push eax
call dword [0x6c5384]
add esp, 4
lea ebx, [ebp - 4]
mov eax, 0x14
call fcn.004453e0
mov eax, dword [0x6ce8d8]
test eax, eax
je 0x447a6d
push eax
call dword [0x6c538c]
add esp, 4
mov esi, dword [ebp - 4]
test esi, esi
jne 0x447a8c
lea eax, [esi + 7]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x14
call dword [0x6c5354]
add esp, 4
mov esi, eax
jmp 0x447a70
cmp dword [0x6c5334], 0
je 0x447abc
mov ecx, dword [ebp + 0xc]
lea edx, [esi + 4]
push edx
push 0
push esi
push 0x4479f0
push 0
push 0
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edi
call fcn.005dfd06
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x447acc
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp dword [esi + 8], 0
jne 0x447ae5
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call dword [ebp + 0xc]
add esp, 4
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4499a0
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x4499cd
push esi
lea esp, [esp]
movzx ecx, cl
movzx ecx, byte [ecx + 0x688908]
lea esi, [eax*8]
xor ecx, esi
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x4499b0
pop esi
ret
Function at 0x449a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [esi*8]
cmp eax, 0x400
jbe 0x449a4e
mov esi, 0x80
cmp esi, dword [edi]
jne 0x449a5a
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x6ce778]
test eax, eax
je 0x449a65
call eax
lea ecx, [esi*8]
push 0
push ecx
call fcn.004454c0
mov esi, eax
mov eax, dword [0x6ce77c]
add esp, 8
mov dword [ebp - 4], esi
test eax, eax
je 0x449a87
call eax
test esi, esi
je 0x449a52
mov edx, dword [edi + 0xc]
push edx
call fcn.004457c0
add esp, 4
push esi
mov dword [edi + 0xc], esi
call dword [0x6c5360]
mov ebx, eax
shr ebx, 3
add esp, 4
lea eax, [ebx*8]
push eax
push 0
push esi
mov dword [ebp + 8], ebx
mov dword [edi], ebx
call fcn.005de050
mov ecx, dword [edi + 8]
add esp, 0xc
mov dword [edi + 8], 0
test ecx, ecx
je 0x449b69
mov esi, dword [ecx + 0xc]
mov dl, byte [esi]
xor eax, eax
test dl, dl
je 0x449afd
movzx edx, dl
movzx edx, byte [edx + 0x688908]
lea ebx, [eax*8]
xor edx, ebx
inc esi
xor eax, edx
mov dl, byte [esi]
test dl, dl
jne 0x449ade
mov ebx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
xor edx, edx
div ebx
mov eax, dword [ebp - 4]
lea eax, [eax + edx*8]
test eax, eax
je 0x449b45
mov esi, dword [eax]
test esi, esi
je 0x449b1b
mov edx, dword [eax + 4]
jmp 0x449b1d
xor edx, edx
inc esi
mov dword [eax], esi
mov dword [eax + 4], ecx
test edx, edx
je 0x449b45
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x449b3d
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x449b5e
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x449b5e
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x449b54
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x449ad3
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x468160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
mov edi, dword [ebx]
mov eax, edi
call fcn.0045b250
mov esi, dword [edi + 0x10]
mov edi, dword [edi + 0x14]
mov eax, esi
add eax, 0xffffffff
adc edi, 0xffffffff
test edi, edi
ja 0x468221
jb 0x468194
cmp eax, 0x7ffffffe
ja 0x468221
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebx]
mov word [ebp - 0x24], ax
mov dword [ebp - 0x14], eax
movsx eax, byte [ecx + 0x44]
mov eax, dword [ecx + eax*4 + 0x78]
mov edx, dword [ecx + 0x18]
mov eax, dword [eax + 0x3c]
movzx edi, word [ecx + 0x20]
sub eax, edx
cmp edi, eax
jae 0x4681bf
mov eax, edi
cmp esi, eax
ja 0x4681d4
mov ecx, 0x1010
mov dword [ebp - 0x1c], edx
mov word [ebp - 0x24], cx
mov dword [ebp - 0x20], esi
jmp 0x4681e7
push 1
push 0
lea eax, [ebp - 0x2c]
call fcn.004634e0
add esp, 8
test eax, eax
jne 0x468248
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
push 0
push edx
push eax
push ecx
call fcn.004676f0
mov edx, dword [ebp + 0x10]
add esp, 0x10
test dword [ebp - 0x24], 0x2460
mov dword [edx], eax
jne 0x468211
cmp dword [ebp - 0x14], 0
je 0x468219
lea eax, [ebp - 0x2c]
call fcn.00462be0
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
push 0x69639c
push 0x11196
push str.database_corruption_at_line__d_of___.10s_
push 0xb
mov dword [eax], 0
call fcn.00447800
add esp, 0x10
mov eax, 0xb
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x480490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], eax
test eax, eax
jle 0x480573
cmp esi, 2
jge 0x4804bc
xor esi, 1
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4804e2
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x10]
mov ecx, esi
add ecx, ecx
mov ecx, dword [edx + ecx*8]
push ecx
push eax
call fcn.004485d0
add esp, 8
test eax, eax
jne 0x480563
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
add esi, esi
mov esi, dword [eax + esi*8 + 0xc]
mov edi, dword [esi + 0x14]
test edi, edi
je 0x48052f
mov cl, byte [ebx]
xor eax, eax
mov edx, ebx
test cl, cl
je 0x48051f
nop
movzx ecx, cl
movzx ecx, byte [ecx + 0x688908]
lea ebx, [eax*8]
xor ecx, ebx
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x480500
mov ebx, dword [ebp + 0xc]
xor edx, edx
div dword [esi + 8]
mov esi, dword [edi + edx*8]
lea eax, [edi + edx*8]
mov edi, dword [eax + 4]
jmp 0x480535
mov edi, dword [esi + 0x10]
mov esi, dword [esi + 0xc]
test esi, esi
je 0x480558
lea esp, [esp]
mov edx, dword [edi + 0xc]
push ebx
push edx
dec esi
call fcn.004485d0
add esp, 8
test eax, eax
je 0x48055c
mov edi, dword [edi]
test esi, esi
jne 0x480540
xor edi, edi
jmp 0x480563
mov edi, dword [edi + 8]
test edi, edi
jne 0x480573
mov esi, dword [ebp - 4]
inc esi
mov dword [ebp - 4], esi
cmp esi, dword [ebp - 8]
jl 0x4804b4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x480670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [eax + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor ecx, ecx
xor esi, esi
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
test edx, edx
jle 0x48074c
mov eax, dword [eax + 0x10]
mov dword [ebp - 8], eax
push edi
mov eax, ecx
cmp ecx, 2
jge 0x4806a1
xor eax, 1
mov ecx, dword [ebp + 0xc]
shl eax, 4
add eax, dword [ebp - 8]
mov edi, dword [eax + 0xc]
test ecx, ecx
je 0x4806c1
mov edx, dword [eax]
push edx
push ecx
call fcn.004485d0
add esp, 8
test eax, eax
jne 0x480733
mov esi, dword [edi + 0x24]
test esi, esi
je 0x480701
mov cl, byte [ebx]
xor eax, eax
mov edx, ebx
test cl, cl
je 0x4806f1
movzx ecx, cl
movzx ecx, byte [ecx + 0x688908]
lea ebx, [eax*8]
xor ecx, ebx
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x4806d2
mov ebx, dword [ebp + 8]
xor edx, edx
div dword [edi + 0x18]
mov edi, dword [esi + edx*8]
lea eax, [esi + edx*8]
mov esi, dword [eax + 4]
jmp 0x480707
mov esi, dword [edi + 0x20]
mov edi, dword [edi + 0x1c]
test edi, edi
je 0x480728
jmp 0x480710
mov edx, dword [esi + 0xc]
push ebx
push edx
dec edi
call fcn.004485d0
add esp, 8
test eax, eax
je 0x48072c
mov esi, dword [esi]
test edi, edi
jne 0x480710
xor esi, esi
jmp 0x480733
mov esi, dword [esi + 8]
test esi, esi
jne 0x480743
mov ecx, dword [ebp - 4]
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, dword [ebp - 0xc]
jl 0x480697
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x483610
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x6c3afc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [esi]
mov dword [ebp - 0x40], edx
mov edx, dword [ecx + 0x10]
add eax, eax
mov eax, dword [edx + eax*8]
mov dword [ebp - 0x30], eax
mov eax, 1
push edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], eax
jmp 0x483653
mov esi, dword [ebp - 0x28]
push eax
push str.sqlite_stat_d
lea ecx, [ebp - 0x1c]
push ecx
push 0x18
call fcn.00447710
mov edi, dword [esi]
mov eax, dword [edi + 0x14]
xor ebx, ebx
add esp, 0x10
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x38], eax
cmp eax, ebx
jle 0x48376f
mov esi, ebx
cmp ebx, 2
jge 0x48368c
xor esi, 1
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4836af
mov ecx, dword [edi + 0x10]
mov edx, esi
add edx, edx
mov edx, dword [ecx + edx*8]
push edx
push eax
call fcn.004485d0
add esp, 8
test eax, eax
jne 0x48373b
mov eax, dword [edi + 0x10]
add esi, esi
mov esi, dword [eax + esi*8 + 0xc]
mov ebx, dword [esi + 0x14]
test ebx, ebx
je 0x4836fd
mov cl, byte [ebp - 0x1c]
xor eax, eax
lea edi, [ebp - 0x1c]
test cl, cl
je 0x4836ec
jmp 0x4836d0
movzx ecx, cl
movzx edx, byte [ecx + 0x688908]
lea ecx, [eax*8]
inc edi
xor edx, ecx
mov cl, byte [edi]
xor eax, edx
test cl, cl
jne 0x4836d0
xor edx, edx
div dword [esi + 8]
mov edi, dword [ebx + edx*8 + 4]
mov esi, dword [ebx + edx*8]
lea eax, [ebx + edx*8]
jmp 0x483703
mov edi, dword [esi + 0x10]
mov esi, dword [esi + 0xc]
test esi, esi
je 0x483722
mov eax, dword [edi + 0xc]
lea edx, [ebp - 0x1c]
push edx
push eax
dec esi
call fcn.004485d0
add esp, 8
test eax, eax
je 0x48372b
mov edi, dword [edi]
test esi, esi
jne 0x483707
mov dword [ebp - 0x20], 0
jmp 0x483735
mov edi, dword [edi + 8]
mov dword [ebp - 0x20], edi
test edi, edi
jne 0x48374e
mov edi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x24]
inc ebx
mov dword [ebp - 0x24], ebx
cmp ebx, dword [ebp - 0x38]
jl 0x483682
cmp dword [ebp - 0x20], 0
je 0x48376f
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
push ecx
mov ecx, dword [ebp - 0x30]
push edx
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x1c]
push eax
push ecx
push str.DELETE_FROM__Q._s_WHERE__s_Q
push edx
call fcn.004803f0
add esp, 0x18
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 4
jle 0x483650
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005dd8e2
mov esp, ebp
pop ebp
ret
Function at 0x486a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [edx]
push esi
xor esi, esi
push edi
mov dword [esp + 0xc], esi
test ebx, ebx
je 0x486b35
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x1b8]
test esi, esi
je 0x486af6
mov cl, byte [ebx]
xor eax, eax
mov edx, ebx
test cl, cl
je 0x486ae3
movzx ecx, cl
movzx ecx, byte [ecx + 0x688908]
lea edi, [eax*8]
xor ecx, edi
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x486ac4
mov edi, dword [ebp + 8]
xor edx, edx
div dword [edi + 0x1ac]
mov edi, dword [esi + edx*8]
lea eax, [esi + edx*8]
mov esi, dword [eax + 4]
jmp 0x486b02
mov esi, dword [edi + 0x1b4]
mov edi, dword [edi + 0x1b0]
test edi, edi
je 0x486b1e
mov edx, dword [esi + 0xc]
push ebx
push edx
dec edi
call fcn.004485d0
add esp, 8
test eax, eax
je 0x486b29
mov esi, dword [esi]
test edi, edi
jne 0x486b06
mov edx, dword [ebp + 0xc]
mov esi, dword [esp + 0xc]
xor eax, eax
jmp 0x486b3b
mov eax, dword [esi + 8]
mov edx, dword [ebp + 0xc]
mov esi, dword [esp + 0xc]
jmp 0x486b3b
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
test eax, eax
je 0x486b4d
movzx ecx, byte [esi + 0x6892a8]
lea ecx, [ecx + ecx*4]
lea eax, [eax + ecx*4 - 0x14]
cmp dword [eax + 0xc], 0
jne 0x486b6d
inc esi
mov dword [esp + 0xc], esi
cmp esi, 3
jl 0x486aa5
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax]
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov ecx, dword [eax + 0xc]
pop edi
pop esi
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], 0
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48d050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push ebx
xor eax, eax
test dword [edx + 0x18], 0x80000
push esi
push edi
mov dword [ebp - 4], eax
je 0x48d198
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 0x10]
test edi, edi
je 0x48d0b6
lea ebx, [ebx]
mov eax, dword [edi + 0x14]
test eax, eax
jle 0x48d0ac
lea edx, [edi + 0x24]
mov esi, eax
lea esp, [esp]
mov ecx, dword [edx]
cmp ecx, 0x1f
jle 0x48d09c
or eax, 0xffffffff
jmp 0x48d0a3
mov eax, 1
shl eax, cl
or dword [ebp - 4], eax
add edx, 8
dec esi
jne 0x48d090
mov edi, dword [edi + 4]
test edi, edi
jne 0x48d080
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 0x40]
mov esi, dword [edi + 0x44]
mov ebx, dword [eax]
test esi, esi
je 0x48d0ff
mov cl, byte [ebx]
xor eax, eax
mov edx, ebx
test cl, cl
je 0x48d0ef
lea esp, [esp]
movzx ecx, cl
movzx ecx, byte [ecx + 0x688908]
lea esi, [eax*8]
xor ecx, esi
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x48d0d0
mov esi, dword [edi + 0x44]
xor edx, edx
div dword [edi + 0x38]
mov edi, dword [esi + edx*8]
lea eax, [esi + edx*8]
mov esi, dword [eax + 4]
jmp 0x48d105
mov esi, dword [edi + 0x40]
mov edi, dword [edi + 0x3c]
test edi, edi
je 0x48d195
lea ecx, [ecx]
mov edx, dword [esi + 0xc]
push ebx
push edx
dec edi
call fcn.004485d0
add esp, 8
test eax, eax
je 0x48d132
mov esi, dword [esi]
test edi, edi
jne 0x48d110
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esi + 8]
xor ebx, ebx
cmp esi, ebx
je 0x48d195
jmp 0x48d140
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push esi
push ecx
push edx
xor eax, eax
mov dword [ebp - 8], ebx
call fcn.0048b580
mov eax, dword [ebp - 8]
add esp, 0x10
cmp eax, ebx
je 0x48d18e
movzx ecx, word [eax + 0x2e]
cmp ecx, ebx
jle 0x48d18e
mov edx, dword [eax + 4]
mov edi, ecx
mov edi, edi
movzx ecx, word [edx]
cmp cx, 0x1f
jle 0x48d17e
or eax, 0xffffffff
jmp 0x48d185
mov eax, 1
shl eax, cl
or dword [ebp - 4], eax
add edx, 2
dec edi
jne 0x48d170
mov esi, dword [esi + 0xc]
cmp esi, ebx
jne 0x48d140
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48d1a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push ebx
push esi
jne 0x48d1e7
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
mov ebx, dword [esi + 0x40]
lea eax, [ebp + 0xc]
push eax
push ecx
add ebx, 0x38
call fcn.00449b80
add esp, 8
test eax, eax
je 0x48d1ce
cmp dword [eax + 8], 0
jne 0x48d1dc
cmp dword [esi + 0x10], 0
jne 0x48d1dc
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push edi
mov edi, dword [eax + 0x10]
test edi, edi
je 0x48d236
mov esi, dword [edi + 0x14]
xor edx, edx
test esi, esi
jle 0x48d22c
lea ecx, [edi + 0x24]
mov edi, edi
mov eax, dword [ecx]
mov ebx, dword [ebp + 0xc]
cmp dword [ebx + eax*4], 0
jge 0x48d2e8
mov ebx, dword [ebp + 8]
movsx ebx, word [ebx + 0x20]
cmp eax, ebx
jne 0x48d224
cmp dword [ebp + 0x10], 0
jne 0x48d2e8
inc edx
add ecx, 8
cmp edx, esi
jl 0x48d200
mov edi, dword [edi + 4]
test edi, edi
jne 0x48d1f2
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x40]
mov esi, dword [ebx + 0x44]
mov edi, dword [eax]
test esi, esi
je 0x48d27f
mov cl, byte [edi]
xor eax, eax
mov edx, edi
test cl, cl
je 0x48d26f
lea esp, [esp]
movzx ecx, cl
movzx ecx, byte [ecx + 0x688908]
lea esi, [eax*8]
xor ecx, esi
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x48d250
mov esi, dword [ebx + 0x44]
xor edx, edx
div dword [ebx + 0x38]
mov ebx, dword [esi + edx*8]
lea eax, [esi + edx*8]
mov esi, dword [eax + 4]
jmp 0x48d285
mov esi, dword [ebx + 0x40]
mov ebx, dword [ebx + 0x3c]
test ebx, ebx
je 0x48d2a8
lea esp, [esp]
mov edx, dword [esi + 0xc]
push edi
push edx
dec ebx
call fcn.004485d0
add esp, 8
test eax, eax
je 0x48d2b1
mov esi, dword [esi]
test ebx, ebx
jne 0x48d290
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [esi + 8]
test esi, esi
je 0x48d2a8
jmp 0x48d2c0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push eax
push ecx
push edx
mov eax, esi
call fcn.0048c8d0
add esp, 0xc
test eax, eax
jne 0x48d2e8
mov esi, dword [esi + 0xc]
test esi, esi
jne 0x48d2c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b9610
Capabilities:
Capture webcam image

Disassembly:
push esi
push edi
push 0
push 0
mov esi, ecx
mov eax, dword [esi + 0x36c]
push 0x419
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [sym.imp.DuiLib.dll_public:_class_DuiLib::CControlUI____thiscall_DuiLib::CPaintManagerUI::FindControl_wchar_t_const__const]
push str.lock
lea ecx, [esi + 0x2c]
call edi
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xcc]
push 0
call eax
push str.unlock
lea ecx, [esi + 0x2c]
call edi
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xcc]
push 1
call eax
pop edi
pop esi
ret