joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4376f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x24]
mov edx, str.adb_getsockname
mov ecx, esi
call fcn.004351f0
test eax, eax
je 0x437713
cmp dword [eax], 0x57887c
je 0x437735
cmp byte [0x5ac048], 0
js 0x437769
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 9
mov eax, 0xffffffff
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [eax + 0xc]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
jne 0x43772d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp byte [0x5ac048], 0
mov edi, eax
js 0x4377ee
mov ecx, edi
call fcn.00435990
jmp 0x437728
call fcn.004ce330
cmp eax, 1
jg 0x43771c
call dword [sym.imp.msvcrt.dll__errno]
mov ebx, dword [eax]
lea edi, [esp + 0xc]
mov ecx, edi
push 0xffffffffffffffff
push 0
push 1
push 0
push 0x414
push str.system_core_adb_sysdeps_win32.cpp
call fcn.004ce350
mov ecx, edi
call fcn.004ce340
mov edi, eax
lea eax, [esp + 4]
push esi
push str.adb_getsockname:_invalid_fd__d
push eax
call fcn.004cf170
add esp, 0xc
mov eax, dword [esp + 4]
push dword [eax - 0xc]
push eax
push edi
call fcn.0055d520
add esp, 0xc
mov eax, dword [esp + 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x56dff0
jne 0x437894
lea ecx, [esp + 0xc]
call fcn.004ce390
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], ebx
jmp 0x43771c
call fcn.004ce330
cmp eax, 1
jg 0x437760
call dword [sym.imp.msvcrt.dll__errno]
mov ebp, dword [eax]
lea ebx, [esp + 0xc]
mov ecx, ebx
push 0xffffffffffffffff
push 0
push 1
push 0
push 0x41d
push str.system_core_adb_sysdeps_win32.cpp
call fcn.004ce350
mov ecx, ebx
call fcn.004ce340
mov ebx, eax
lea eax, [esp + 8]
push edi
push eax
call fcn.004cfe30
add esp, 8
lea eax, [esp + 4]
push dword [esp + 8]
push esi
push str.adb_getsockname:_setsockopt_on_fd__d_failed:__s_n
push eax
call fcn.004cf170
add esp, 0x10
mov eax, dword [esp + 4]
push dword [eax - 0xc]
push eax
push ebx
call fcn.0055d520
add esp, 0xc
mov eax, dword [esp + 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x56dff0
jne 0x4378b5
mov eax, dword [esp + 8]
lea ecx, [eax - 0xc]
cmp ecx, 0x56dff0
jne 0x4378cd
lea ecx, [esp + 0xc]
call fcn.004ce390
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], ebp
jmp 0x437760
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x4377d8
lea eax, [esp + 8]
push eax
call fcn.00533980
jmp 0x4377d8
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x43786f
mov eax, esp
push eax
call fcn.00533980
jmp 0x43786f
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x43787e
mov eax, esp
push eax
call fcn.00533980
jmp 0x43787e
Function at 0x439b80
Capabilities:
Create directory

Disassembly:
push esi
sub esp, 8
mov eax, dword [esp + 0x10]
mov ecx, esp
mov esi, 0xffffffff
mov dword [esp], 0x56dfec
push ecx
push eax
call fcn.004d0490
add esp, 8
test al, al
je 0x439bb2
push dword [esp]
call dword [sym.imp.msvcrt.dll__wmkdir]
add esp, 4
mov esi, eax
mov eax, dword [esp]
lea ecx, [eax - 0xc]
cmp ecx, 0x56dfe0
jne 0x439bc7
mov eax, esi
add esp, 8
pop esi
ret
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x439bc0
lea eax, [esp + 4]
push eax
call fcn.00529f90
jmp 0x439bc0

Function at 0x439f70
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov ecx, esi
call fcn.00439df0
test eax, eax
je 0x439fab
imul edi, ebp
mov ecx, ebx
mov edx, edi
push eax
push esi
call fcn.0043b210
add esp, 8
cmp eax, 0xffffffff
je 0x439fb4
xor edx, edx
div ebp
jmp 0x439fb6
pop esi
pop edi
pop ebx
pop ebp
jmp sub.msvcrt.dll_fwrite
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x43a6c0
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebp, dword [esp + 0x2c]
mov ebx, dword [esp + 0x24]
lea eax, [esp + 0xc]
push 0
push eax
push ebp
push dword [esp + 0x34]
push dword [ebx + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43a6f9
mov eax, dword [esp + 0xc]
cmp eax, ebp
jae 0x43a713
mov dword [ebx + 8], 1
jmp 0x43a713
cmp byte [0x5ac048], 0
js 0x43a71b
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 5
mov eax, 0xffffffff
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
call fcn.004ce330
cmp eax, 1
jg 0x43a702
call dword [sym.imp.msvcrt.dll__errno]
mov edi, dword [eax]
lea esi, [esp + 8]
mov ecx, esi
push 0xffffffffffffffff
push 0
push 1
push 0
push 0x11e
push str.system_core_adb_sysdeps_win32.cpp
call fcn.004ce350
mov ecx, esi
call fcn.004ce340
mov esi, eax
add ebx, 0x10
lea eax, [esp + 4]
push ebx
push ebp
push str.adb_file_write:_could_not_write__d_bytes_from__s
push eax
call fcn.004cf170
add esp, 0x10
mov eax, dword [esp + 4]
push dword [eax - 0xc]
push eax
push esi
call fcn.0055d520
add esp, 0xc
mov eax, dword [esp + 4]
lea ecx, [eax - 0xc]
cmp ecx, 0x56dff0
jne 0x43a7a0
lea ecx, [esp + 8]
call fcn.004ce390
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], edi
jmp 0x43a702
mov edx, 0xffffffff
lock xadd dword [eax - 4], edx
test edx, edx
jg 0x43a78a
mov eax, esp
push eax
call fcn.00533980
jmp 0x43a78a
Function at 0x445810
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, dword [esp + 0x1c]
push esi
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call sym.adb.exe_AES_set_encrypt_key
add esp, 0xc
test eax, eax
js 0x445a24
mov ecx, dword [esi + 0xf0]
lea eax, [ecx*4]
test eax, eax
jle 0x44589e
mov ecx, 4
nop word [eax + eax]
mov edx, dword [esi + ecx*4 - 0x10]
mov edi, dword [esi + eax*4]
mov dword [esi + ecx*4 - 0x10], edi
mov dword [esi + eax*4], edx
mov edx, dword [esi + ecx*4 - 0xc]
mov edi, dword [esi + eax*4 + 4]
mov dword [esi + ecx*4 - 0xc], edi
mov dword [esi + eax*4 + 4], edx
mov edx, dword [esi + ecx*4 - 8]
mov edi, dword [esi + eax*4 + 8]
mov dword [esi + ecx*4 - 8], edi
mov dword [esi + eax*4 + 8], edx
mov edx, dword [esi + ecx*4 - 4]
mov edi, dword [esi + eax*4 + 0xc]
mov dword [esi + ecx*4 - 4], edi
mov dword [esi + eax*4 + 0xc], edx
add eax, 0xfffffffc
cmp ecx, eax
lea ecx, [ecx + 4]
jl 0x445850
mov ecx, dword [esi + 0xf0]
xor eax, eax
cmp ecx, 2
jl 0x445a24
lea ecx, [esi + 0x1c]
mov eax, 1
nop word cs:[eax + eax]
nop dword [eax + eax]
mov ebx, dword [ecx - 0xc]
inc eax
mov edi, ebx
movzx ebp, bh
movzx edx, bl
shr ebx, 0x18
shr edi, 0xe
movzx ebx, byte [ebx*4 + 0x57cc68]
movzx ebp, byte [ebp*4 + 0x57cc68]
movzx edx, byte [edx*4 + 0x57cc68]
and edi, 0x3fc
movzx edi, byte [edi + 0x57cc68]
mov edi, dword [edi*4 + 0x57dc68]
xor edi, dword [ebx*4 + 0x57d868]
mov ebx, dword [ecx - 8]
xor edi, dword [ebp*4 + 0x57e068]
movzx ebp, bl
xor edi, dword [edx*4 + 0x57e468]
mov edx, ebx
shr edx, 0xe
and edx, 0x3fc
movzx edx, byte [edx + 0x57cc68]
mov dword [ecx - 0xc], edi
movzx edi, bh
shr ebx, 0x18
movzx ebx, byte [ebx*4 + 0x57cc68]
movzx edi, byte [edi*4 + 0x57cc68]
mov edx, dword [edx*4 + 0x57dc68]
xor edx, dword [ebx*4 + 0x57d868]
xor edx, dword [edi*4 + 0x57e068]
movzx edi, byte [ebp*4 + 0x57cc68]
xor edx, dword [edi*4 + 0x57e468]
mov dword [ecx - 8], edx
mov ebx, dword [ecx - 4]
mov edx, ebx
movzx edi, bh
movzx ebp, bl
shr ebx, 0x18
shr edx, 0xe
movzx ebx, byte [ebx*4 + 0x57cc68]
movzx edi, byte [edi*4 + 0x57cc68]
and edx, 0x3fc
movzx edx, byte [edx + 0x57cc68]
mov edx, dword [edx*4 + 0x57dc68]
xor edx, dword [ebx*4 + 0x57d868]
xor edx, dword [edi*4 + 0x57e068]
movzx edi, byte [ebp*4 + 0x57cc68]
xor edx, dword [edi*4 + 0x57e468]
mov dword [ecx - 4], edx
mov ebx, dword [ecx]
mov edx, ebx
movzx edi, bh
movzx ebp, bl
shr ebx, 0x18
shr edx, 0xe
movzx ebx, byte [ebx*4 + 0x57cc68]
movzx edi, byte [edi*4 + 0x57cc68]
and edx, 0x3fc
movzx edx, byte [edx + 0x57cc68]
mov edx, dword [edx*4 + 0x57dc68]
xor edx, dword [ebx*4 + 0x57d868]
xor edx, dword [edi*4 + 0x57e068]
movzx edi, byte [ebp*4 + 0x57cc68]
xor edx, dword [edi*4 + 0x57e468]
mov dword [ecx], edx
add ecx, 0x10
cmp eax, dword [esi + 0xf0]
jl 0x4458c0
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x445a30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov edi, dword [esp + 0x44]
lea eax, [edi - 0x10]
cmp eax, 0x7fffffe7
mov eax, 0xffffffff
ja 0x445b1d
mov ecx, edi
and ecx, 7
jne 0x445b1d
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x38]
lea eax, [eax + 8]
push edi
push dword [esp + 0x44]
mov dword [esp + 0x1c], eax
push eax
call sub.msvcrt.dll_memmove
add esp, 0xc
test esi, esi
mov eax, 0x57b1c0
mov ebx, 1
cmovne eax, esi
mov esi, edi
xor ecx, ecx
mov edi, esp
movsd xmm0, qword [eax]
shr esi, 3
mov dword [esp + 0x10], esi
movsd qword [esp], xmm0
nop dword [eax + eax]
mov ebp, dword [esp + 0x14]
test esi, esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ebx
je 0x445af5
movsd xmm0, qword [ebp]
movsd qword [esp + 8], xmm0
push dword [esp + 0x34]
push edi
push edi
call sym.adb.exe_AES_encrypt
add esp, 0xc
mov eax, ebx
xor byte [esp + 7], bl
xor byte [esp + 6], bh
shr eax, 0x10
xor byte [esp + 5], al
mov eax, ebx
inc ebx
shr eax, 0x18
xor byte [esp + 4], al
movsd xmm0, qword [esp + 8]
movsd qword [ebp], xmm0
add ebp, 8
dec esi
jne 0x445ab0
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x18]
inc ecx
add ebx, esi
cmp ecx, 6
jne 0x445aa0
movsd xmm0, qword [esp]
mov eax, dword [esp + 0x3c]
movsd qword [eax], xmm0
mov eax, dword [esp + 0x44]
add eax, 8
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x445b30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov esi, dword [esp + 0x4c]
mov eax, 0xffffffff
cmp esi, 0x18
jb 0x445c40
mov ecx, esi
and ecx, 0x80000007
jne 0x445c40
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x40]
mov edi, dword [esp + 0x44]
mov edx, 0x57b1c0
movsd xmm0, qword [eax]
test ecx, ecx
cmovne edx, ecx
lea ecx, [esi - 8]
add eax, 8
mov dword [esp], edx
mov dword [esp + 4], ecx
movsd qword [esp + 0x18], xmm0
push ecx
push eax
push edi
call sub.msvcrt.dll_memmove
add esp, 0xc
shr esi, 3
mov ecx, 1
sub ecx, esi
lea eax, [esi + esi*2]
mov dword [esp + 0xc], ecx
lea ecx, [esi - 1]
lea ebx, [eax + eax - 6]
lea esi, [esp + 0x18]
mov dword [esp + 8], ecx
mov ecx, 5
nop word cs:[eax + eax]
nop
mov ebp, dword [esp + 8]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ebx
test ebp, ebp
je 0x445c14
mov eax, ebx
xor byte [esp + 0x1f], bl
xor byte [esp + 0x1e], bh
shr eax, 0x10
xor byte [esp + 0x1d], al
mov eax, ebx
shr eax, 0x18
xor byte [esp + 0x1c], al
movsd xmm0, qword [edi + ebp*8 - 8]
movsd qword [esp + 0x20], xmm0
push dword [esp + 0x3c]
push esi
push esi
call sym.adb.exe_AES_decrypt
add esp, 0xc
movsd xmm0, qword [esp + 0x20]
dec ebx
movsd qword [edi + ebp*8 - 8], xmm0
dec ebp
jne 0x445bd0
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
add ebx, dword [esp + 0xc]
dec ecx
cmp ecx, 6
jb 0x445bc0
push 8
push dword [esp + 4]
push esi
call sym.adb.exe_CRYPTO_memcmp
add esp, 0xc
cmp eax, 1
sbb eax, eax
not eax
or eax, dword [esp + 4]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x446010
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
cmp dword [esp + 0x10], 1
jne 0x44602c
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call sym.adb.exe_AES_encrypt
add esp, 0xc
ret
jmp sym.adb.exe_AES_decrypt
Function at 0x4469c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov ebp, dword [esp + 0x40]
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x3c]
mov ebx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov esi, dword [ebp]
test eax, eax
je 0x446a0c
test esi, esi
je 0x446a0c
nop word cs:[eax + eax]
movzx ecx, byte [edi + esi]
inc esi
xor cl, byte [edx]
inc edx
mov byte [ebx], cl
inc ebx
lea ecx, [eax - 1]
and esi, 0xf
je 0x446a0e
cmp eax, 1
mov eax, ecx
jne 0x4469f0
jmp 0x446a0e
mov ecx, eax
cmp ecx, 0x10
jb 0x446a97
lea eax, [ecx - 0x10]
mov ebp, edx
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
and eax, 0xfffffff0
mov dword [esp + 0x10], eax
nop
mov dword [esp], ecx
push dword [esp + 0x38]
push edi
push edi
call sym.adb.exe_AES_encrypt
add esp, 0xc
cmp esi, 0xf
ja 0x446a62
nop word cs:[eax + eax]
mov eax, dword [edi + esi]
xor eax, dword [ebp + esi]
mov dword [ebx + esi], eax
add esi, 4
cmp esi, 0x10
jb 0x446a50
mov ecx, dword [esp]
add ebx, 0x10
add ebp, 0x10
xor esi, esi
add ecx, 0xfffffff0
cmp ecx, 0xf
ja 0x446a30
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 4]
mov ebx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ebp, dword [esp + 0x40]
xor esi, esi
sub eax, ecx
lea ebx, [ebx + ecx + 0x10]
lea edx, [edx + ecx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x446ba7
push dword [esp + 0x38]
push edi
push edi
mov ebp, edx
mov dword [esp + 0xc], ecx
call sym.adb.exe_AES_encrypt
add esp, 0xc
mov eax, dword [esp]
mov edx, esi
cmp eax, 0x20
jb 0x446b84
mov ecx, dword [esp]
lea eax, [ebx + esi]
mov dword [esp + 8], ebx
lea ecx, [ecx + esi]
lea edx, [ebx + ecx]
lea ebx, [ebp + ecx]
add ecx, edi
cmp eax, ebx
lea ebx, [ebp + esi]
setb byte [esp + 4]
cmp ebx, edx
setb bl
cmp eax, ecx
lea eax, [edi + esi]
setb cl
cmp eax, edx
mov eax, dword [esp]
mov edx, esi
setb ch
test byte [esp + 4], bl
mov ebx, dword [esp + 8]
jne 0x446b84
mov eax, dword [esp]
and cl, ch
mov edx, esi
jne 0x446b84
mov eax, dword [esp]
mov dword [esp + 0xc], ebp
mov edx, eax
and edx, 0xffffffe0
lea ecx, [esi + edx]
mov dword [esp + 4], edx
sub eax, edx
xor edx, edx
mov dword [esp + 0x14], ecx
lea ecx, [ebx + esi + 0x10]
lea ebx, [edi + esi + 0x10]
mov dword [esp + 0x10], ecx
lea ecx, [ebp + esi + 0x10]
nop dword [eax + eax]
movups xmm0, xmmword [ecx + edx - 0x10]
movups xmm2, xmmword [ebx + edx - 0x10]
movups xmm1, xmmword [ecx + edx]
movups xmm3, xmmword [ebx + edx]
mov ebp, dword [esp + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm1
movups xmmword [ebp + edx - 0x10], xmm2
movups xmmword [ebp + edx], xmm3
add edx, 0x20
cmp dword [esp + 4], edx
jne 0x446b40
mov ecx, dword [esp + 4]
mov ebx, dword [esp + 8]
mov ebp, dword [esp + 0xc]
mov edx, dword [esp + 0x14]
cmp dword [esp], ecx
je 0x446ba0
add ebx, edx
add edi, edx
add ebp, edx
xor ecx, ecx
nop dword [eax]
movzx edx, byte [edi + ecx]
xor dl, byte [ebp + ecx]
mov byte [ebx + ecx], dl
inc ecx
cmp eax, ecx
jne 0x446b90
add esi, dword [esp]
mov ebp, dword [esp + 0x40]
mov dword [ebp], esi
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x447410
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov esi, dword [ecx]
mov ecx, dword [ecx + 4]
mov edx, dword [eax + 4]
mov edi, dword [eax]
cmp ecx, edx
mov eax, edx
mov dword [esp], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
cmovb eax, ecx
test eax, eax
je 0x447493
mov dword [esp + 0xc], eax
xor eax, eax
xor ebp, ebp
nop word [eax + eax]
mov ecx, dword [esp + 8]
mov ebx, dword [ecx + ebp*4]
mov ecx, dword [esp + 4]
mov edi, dword [ecx + ebp*4]
mov esi, ebx
inc ebp
sub esi, edi
xor edi, ebx
xor esi, ebx
lea ecx, [edi - 1]
or esi, edi
not edi
xor esi, ebx
and ecx, edi
sar esi, 0x1f
sar ecx, 0x1f
mov edi, esi
and eax, ecx
not ecx
not edi
and edi, 1
or edi, esi
and ecx, edi
or ecx, eax
cmp ebp, dword [esp + 0xc]
mov eax, ecx
jb 0x447450
jmp 0x447495
xor ecx, ecx
mov ebp, dword [esp]
mov edi, dword [esp + 4]
mov esi, dword [esp + 8]
mov ebx, ebp
sub ebx, edx
jae 0x44752b
mov ebx, edx
xor esi, esi
sub ebx, ebp
cmp ebx, 7
jbe 0x44750a
mov eax, ebx
lea esi, [edi + ebp*4 + 0x10]
pxor xmm0, xmm0
pxor xmm1, xmm1
and eax, 0xfffffff8
add ebp, eax
mov dword [esp], ebp
mov ebp, eax
nop dword [eax]
movdqu xmm2, xmmword [esi - 0x10]
movdqu xmm3, xmmword [esi]
add esi, 0x20
add ebp, 0xfffffff8
por xmm0, xmm2
por xmm1, xmm3
jne 0x4474d0
por xmm1, xmm0
mov ebp, dword [esp]
cmp ebx, eax
pshufd xmm0, xmm1, 0x4e
por xmm0, xmm1
pshufd xmm1, xmm0, 0xe5
por xmm1, xmm0
movd esi, xmm1
je 0x447518
sub edx, ebp
lea eax, [edi + ebp*4]
nop
or esi, dword [eax]
add eax, 4
dec edx
jne 0x447510
mov eax, esi
dec esi
not eax
and esi, eax
sar esi, 0x1f
not esi
or ecx, esi
jmp 0x4475af
cmp edx, ebp
jae 0x4475af
xor edi, edi
cmp ebx, 7
jbe 0x44758a
mov eax, ebx
lea edi, [esi + edx*4 + 0x10]
pxor xmm0, xmm0
pxor xmm1, xmm1
and eax, 0xfffffff8
add edx, eax
mov ebp, eax
nop
movdqu xmm2, xmmword [edi - 0x10]
movdqu xmm3, xmmword [edi]
add edi, 0x20
add ebp, 0xfffffff8
por xmm0, xmm2
por xmm1, xmm3
jne 0x447550
por xmm1, xmm0
mov ebp, dword [esp]
cmp ebx, eax
pshufd xmm0, xmm1, 0x4e
por xmm0, xmm1
pshufd xmm1, xmm0, 0xe5
por xmm1, xmm0
movd edi, xmm1
je 0x447598
sub ebp, edx
lea eax, [esi + edx*4]
nop
or edi, dword [eax]
add eax, 4
dec ebp
jne 0x447590
mov eax, edi
dec edi
not eax
and edi, eax
sar edi, 0x1f
mov eax, edi
and edi, ecx
not eax
and eax, 1
or eax, edi
mov ecx, eax
mov eax, ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x449770
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
xor edi, edi
mov ebx, dword [eax + 4]
mov edx, dword [ecx + 4]
mov eax, ebx
sub eax, edx
mov dword [esp], eax
jge 0x449809
mov eax, dword [esp + 0x20]
mov ecx, edx
xor edi, edi
mov esi, ebx
sub ecx, ebx
cmp ecx, 7
mov ebp, dword [eax]
jbe 0x449800
mov eax, ecx
lea edi, [ebp + ebx*4 + 0x10]
pxor xmm0, xmm0
pxor xmm1, xmm1
and eax, 0xfffffff8
lea esi, [ebx + eax]
mov dword [esp + 4], eax
nop dword [eax + eax]
movdqu xmm2, xmmword [edi - 0x10]
movdqu xmm3, xmmword [edi]
add edi, 0x20
add eax, 0xfffffff8
por xmm0, xmm2
por xmm1, xmm3
jne 0x4497c0
por xmm1, xmm0
cmp ecx, dword [esp + 4]
pshufd xmm0, xmm1, 0x4e
por xmm0, xmm1
pshufd xmm1, xmm0, 0xe5
por xmm1, xmm0
movd edi, xmm1
je 0x449809
nop dword [eax]
or edi, dword [ebp + esi*4]
inc esi
cmp esi, edx
jl 0x449800
cmp edx, ebx
jge 0x449888
mov eax, dword [esp + 0x1c]
mov esi, dword [eax]
mov eax, dword [esp]
cmp eax, 7
ja 0x44981f
mov ebp, edx
jmp 0x449878
mov ecx, eax
movd xmm1, edi
lea edi, [esi + edx*4 + 0x10]
pxor xmm0, xmm0
and ecx, 0xfffffff8
lea ebp, [edx + ecx]
mov eax, ecx
nop word cs:[eax + eax]
nop
movdqu xmm2, xmmword [edi - 0x10]
movdqu xmm3, xmmword [edi]
add edi, 0x20
add eax, 0xfffffff8
por xmm1, xmm2
por xmm0, xmm3
jne 0x449840
por xmm0, xmm1
cmp dword [esp], ecx
pshufd xmm1, xmm0, 0x4e
por xmm1, xmm0
pshufd xmm0, xmm1, 0xe5
por xmm0, xmm1
movd edi, xmm0
je 0x449888
mov ecx, ebx
lea eax, [esi + ebp*4]
sub ecx, ebp
nop
or edi, dword [eax]
add eax, 4
dec ecx
jne 0x449880
mov ebp, dword [esp + 0x1c]
cmp ebx, edx
cmovle edx, ebx
test edx, edx
jle 0x4498fd
mov eax, dword [esp + 0x20]
mov esi, dword [ebp]
mov ebx, dword [eax]
xor eax, eax
cmp edx, 3
jbe 0x4498f0
mov eax, edx
movd xmm0, edi
xor ecx, ecx
and eax, 0xfffffffc
movdqu xmm1, xmmword [esi + ecx*4]
movdqu xmm2, xmmword [ebx + ecx*4]
add ecx, 4
cmp eax, ecx
pxor xmm2, xmm1
por xmm0, xmm2
jne 0x4498b0
pshufd xmm1, xmm0, 0x4e
cmp edx, eax
por xmm1, xmm0
pshufd xmm0, xmm1, 0xe5
por xmm0, xmm1
movd edi, xmm0
je 0x4498fd
nop word cs:[eax + eax]
nop dword [eax]
mov ecx, dword [ebx + eax*4]
xor ecx, dword [esi + eax*4]
inc eax
or edi, ecx
cmp eax, edx
jl 0x4498f0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0xc]
xor eax, eax
xor ecx, dword [ebp + 0xc]
or ecx, edi
sete al
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44f4d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov ebx, dword [esp + 0x58]
mov eax, ecx
mov edi, 1
mov dword [esp], edx
mov ecx, ebx
shl edi, cl
push edx
mov dword [esp + 0x18], eax
push eax
call fcn.00447880
add esp, 8
test eax, eax
je 0x44f58a
mov eax, dword [esp + 0x50]
mov esi, dword [esp + 0x54]
cmp ebx, 3
mov dword [esp + 0x10], edi
mov dword [esp + 4], eax
jg 0x44f591
cmp dword [esp], 0
jle 0x44f6c5
mov edx, dword [esp + 0x10]
mov ecx, esi
xor ecx, 0x80000000
lea eax, [edx*4]
xor edx, edx
mov dword [esp + 8], eax
nop dword [eax + eax]
mov edi, dword [esp + 0x10]
mov dword [esp + 0xc], edx
xor edx, edx
xor ebx, ebx
nop dword [eax]
mov ebp, edx
mov eax, dword [esp + 4]
xor ebp, esi
dec ebp
and ebp, ecx
sar ebp, 0x1f
and ebp, dword [eax + edx*4]
inc edx
or ebx, ebp
cmp edx, edi
jl 0x44f550
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
mov edx, dword [edx]
add dword [esp + 4], edi
mov dword [edx + eax*4], ebx
mov edx, eax
inc edx
cmp edx, dword [esp]
jne 0x44f540
jmp 0x44f6c5
xor eax, eax
jmp 0x44f6d4
add ebx, 0xfffffffe
mov edx, 1
mov edi, esi
mov ecx, ebx
shl edx, cl
sar edi, cl
cmp dword [esp], 0
mov dword [esp + 8], edx
jle 0x44f6c5
mov edx, dword [esp + 8]
mov ecx, edi
mov eax, edi
mov dword [esp + 0x18], ebx
xor ecx, 0x80000000
xor eax, 2
dec eax
and eax, ecx
lea ebp, [edx - 1]
sar eax, 0x1f
and ebp, esi
lea esi, [edi - 1]
mov dword [esp + 0x2c], eax
and esi, ecx
mov dword [esp + 0x34], ebp
xor ebp, 0x80000000
sar esi, 0x1f
mov dword [esp + 0x20], ebp
mov dword [esp + 0xc], esi
mov esi, edi
xor edi, 3
xor esi, 1
dec edi
dec esi
and edi, ecx
and esi, ecx
lea ecx, [edx + edx]
mov edx, 3
sar edi, 0x1f
mov dword [esp + 0x28], ecx
mov ecx, ebx
sar esi, 0x1f
mov dword [esp + 0x38], edi
shl edx, cl
mov dword [esp + 0x30], esi
mov dword [esp + 0x24], edx
xor edx, edx
nop
mov ecx, dword [esp + 0xc]
cmp ebx, 0x1f
mov edi, 0
mov dword [esp + 0x1c], edx
je 0x44f69b
xor edi, edi
xor ebp, ebp
nop word cs:[eax + eax]
mov eax, dword [esp + 4]
mov esi, dword [eax + ebp*4]
mov edx, dword [esp + 8]
lea ebx, [ebp + edx]
and esi, ecx
mov ebx, dword [eax + ebx*4]
mov ecx, dword [esp + 0x28]
lea ecx, [ebp + ecx]
mov ecx, dword [eax + ecx*4]
and ecx, dword [esp + 0x2c]
or ecx, esi
mov esi, dword [esp + 0x24]
lea esi, [ebp + esi]
mov esi, dword [eax + esi*4]
and ebx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
and esi, dword [esp + 0x38]
or esi, ecx
mov ecx, ebp
inc ebp
or esi, ebx
mov ebx, dword [esp + 0x20]
xor ecx, eax
dec ecx
and ecx, ebx
sar ecx, 0x1f
and ecx, esi
or edi, ecx
mov ecx, dword [esp + 0xc]
cmp ebp, edx
jl 0x44f640
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0x18]
mov ecx, dword [ecx]
mov dword [ecx + edx*4], edi
inc edx
mov ecx, dword [esp + 0x10]
cmp edx, dword [esp]
lea eax, [eax + ecx*4]
mov dword [esp + 4], eax
jne 0x44f620
mov eax, dword [esp]
mov ecx, dword [esp + 0x14]
mov dword [ecx + 4], eax
mov eax, 1
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret