joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420810
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x28
test ecx, ecx
push ebx
push ebp
push esi
push edi
je 0x420824
lea esi, [ecx - 0x28]
mov dword [esp + 0x10], esi
jmp 0x420830
mov dword [esp + 0x10], 0
mov esi, dword [esp + 0x10]
cmp dword [esp + 0x48], 0
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], 1
je 0x4208cd
mov eax, dword [esp + 0x3c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov ebx, dword [esp + 0x40]
mov edi, eax
push edi
mov ecx, ebx
or ebp, 0xffffffff
call fcn.00412440
test eax, eax
je 0x4208b1
lea edx, [edi + 1]
push edx
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edx, dword [ebx]
test edx, edx
mov ebp, eax
jne 0x420888
xor eax, eax
jmp 0x4208a1
mov eax, edx
lea esi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x420890
sub eax, esi
sar eax, 1
js 0x4208c3
cmp eax, dword [edx - 8]
jg 0x4208c3
mov dword [edx - 0xc], eax
mov ecx, dword [ebx]
mov word [ecx + eax*2], 0
cmp ebp, edi
jge 0x420922
mov esi, dword [esp + 0x10]
mov dword [esp + 0x14], 0
jmp 0x4208e8
push 0x80070057
call fcn.00401000
mov edx, dword [esp + 0x40]
mov eax, dword [edx]
push eax
mov eax, dword [esp + 0x40]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
test eax, eax
mov dword [esp + 0x14], eax
jne 0x420957
push 0xffffffffffffffff
add esi, 0x28
call dword [sym.imp.USER32.dll_MessageBeep]
test esi, esi
je 0x4208fc
lea eax, [esi - 0x28]
jmp 0x4208fe
xor eax, eax
mov edx, dword [esp + 0x3c]
mov eax, dword [eax + 4]
push edx
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x18
cmp dword [esp + 0x4c], 0
je 0x420957
mov ecx, dword [ebx]
mov edx, dword [ecx - 0xc]
cmp edx, dword [esp + 0x50]
jle 0x420957
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x18]
push eax
push ecx
mov ecx, dword [esp + 0x18]
push edx
add ecx, 0x28
call fcn.004123a0
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 0x18
Function at 0x422202
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x45cefc]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00422141
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00422ac0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x422251
cmp dword [ebp - 0x1c], 5
jb 0x422269
jmp 0x422265
cmp dword [ebp - 0x10], 1
jne 0x422269
cmp dword [ebp - 0x1c], 4
ja 0x422265
jne 0x422269
cmp dword [ebp - 0x18], 0
jbe 0x422269
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x449080
call fcn.00418e10
test eax, eax
jge 0x42228a
mov byte [0x464e14], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004231f4
add ebp, 0x78
leave
ret

Function at 0x42243c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4641c0], 0
push esi
jne 0x4223af
call fcn.004222da
test eax, eax
je 0x4223f2
mov eax, dword [0x4641c0]
cmp eax, 1
jne 0x4223d0
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4223f2
pop esi
ret
push eax
call dword [0x4641c8]
test eax, eax
jne 0x42243a
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4223f6
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x4641c0]
call dword [0x4641c8]
mov edi, eax
test edi, edi
je 0x42241d
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x422439
lea edi, [esi + 0xff0]
push esi
push dword [0x4641c0]
call dword [0x4641c4]
add esi, 0x10
cmp esi, edi
jb 0x422423
mov eax, esi
pop edi
pop esi
ret
jmp 0x42239c

Function at 0x4231f4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45cefc]
jne 0x4231fe
repz ret
jmp fcn.0042873c
Function at 0x42a761
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004253f7
xor ebx, ebx
cmp dword [0x464c98], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x42a836
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x42a7a1
xor eax, eax
jmp 0x42a8fa
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x42a79a
push eax
call fcn.00425394
mov dword [esp], 0x449860
push edi
mov dword [0x464c98], eax
call esi
push eax
call fcn.00425394
mov dword [esp], 0x44984c
push edi
mov dword [0x464c9c], eax
call esi
push eax
call fcn.00425394
mov dword [0x464ca0], eax
lea eax, [ebp - 8]
push eax
call fcn.0042464e
test eax, eax
pop ecx
pop ecx
je 0x42a804
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00423d6b
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x42a836
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00425394
cmp eax, ebx
pop ecx
mov dword [0x464ca8], eax
je 0x42a836
push 0x449818
push edi
call esi
push eax
call fcn.00425394
pop ecx
mov dword [0x464ca4], eax
mov eax, dword [0x464ca4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x42a8af
cmp dword [0x464ca8], esi
je 0x42a8af
push eax
call fcn.00425400
pop ecx
call eax
cmp eax, ebx
je 0x42a87c
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x464ca8]
call fcn.00425400
pop ecx
call eax
test eax, eax
je 0x42a87c
test byte [ebp - 0x18], 1
jne 0x42a8af
lea eax, [ebp - 0xc]
push eax
call fcn.00424685
test eax, eax
pop ecx
je 0x42a897
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00423d6b
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x42a8a6
or dword [ebp + 0x10], 0x200000
jmp 0x42a8e0
or dword [ebp + 0x10], 0x40000
jmp 0x42a8e0
mov eax, dword [0x464c9c]
cmp eax, esi
je 0x42a8e0
push eax
call fcn.00425400
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x42a8e0
mov eax, dword [0x464ca0]
cmp eax, esi
je 0x42a8e0
push dword [ebp - 4]
push eax
call fcn.00425400
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x464c98]
call fcn.00425400
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x433ca0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push esi
xor eax, eax
push edi
mov dl, al
shr dl, 4
movzx edi, dl
mov cl, al
and cl, 0xf
movzx esi, cl
mov byte [esp + 0xf], cl
mov ecx, edi
movzx edi, byte [edi + 0x45e1e0]
xor ecx, esi
movzx esi, byte [esi + 0x45e1d0]
mov cl, byte [ecx + 0x45e1f0]
xor edi, esi
movzx esi, byte [edi + 0x45e210]
movzx ebx, byte [esi + 0x45e1d0]
movzx ecx, cl
movzx edi, byte [ecx + 0x45e1e0]
xor ecx, esi
xor edi, ebx
mov bl, byte [edi + 0x45e250]
movzx esi, dl
shl bl, 4
or bl, byte [ecx + 0x45e230]
movzx ecx, byte [esp + 0xf]
mov edx, esi
movzx esi, byte [esi + 0x45e1e0]
xor edx, ecx
movzx ecx, byte [ecx + 0x45e1d0]
mov dl, byte [edx + 0x45e200]
xor esi, ecx
movzx esi, byte [esi + 0x45e220]
movzx edi, byte [esi + 0x45e1d0]
movzx ecx, dl
movzx edx, byte [ecx + 0x45e1e0]
xor edx, edi
movzx edx, byte [edx + 0x45e260]
shl dl, 4
xor ecx, esi
or dl, byte [ecx + 0x45e240]
mov byte [eax + 0x473ee0], bl
mov byte [eax + 0x473fe0], dl
add eax, 1
cmp eax, 0x100
jb 0x433ca6
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x435a50
Capabilities:
Encrypt data using blowfish

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push esi
push 0x1048
push 0x45e270
push ebx
call fcn.004234f0
mov ecx, dword [esp + 0x24]
add esp, 0xc
cmp ecx, 0x48
jle 0x435a7a
mov ecx, 0x48
push edi
mov edi, dword [esp + 0x20]
mov eax, edi
add ecx, edi
lea esi, [ebx + 8]
mov dword [esp + 0x18], 6
push ebp
nop
movzx edx, byte [eax]
add eax, 1
cmp eax, ecx
jb 0x435a9c
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
add eax, 1
or edx, ebp
cmp eax, ecx
jb 0x435aad
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
add eax, 1
or edx, ebp
cmp eax, ecx
jb 0x435abe
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
add eax, 1
or edx, ebp
cmp eax, ecx
jb 0x435acf
mov eax, edi
xor dword [esi - 8], edx
movzx edx, byte [eax]
add eax, 1
cmp eax, ecx
jb 0x435ade
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
add eax, 1
or edx, ebp
cmp eax, ecx
jb 0x435aef
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
add eax, 1
or edx, ebp
cmp eax, ecx
jb 0x435b00
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
add eax, 1
or edx, ebp
cmp eax, ecx
jb 0x435b11
mov eax, edi
xor dword [esi - 4], edx
movzx edx, byte [eax]
add eax, 1
cmp eax, ecx
jb 0x435b20
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
add eax, 1
or edx, ebp
cmp eax, ecx
jb 0x435b31
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
add eax, 1
or edx, ebp
cmp eax, ecx
jb 0x435b42
mov eax, edi
movzx ebp, byte [eax]
shl edx, 8
add eax, 1
or edx, ebp
cmp eax, ecx
jb 0x435b53
mov eax, edi
xor dword [esi], edx
add esi, 0xc
sub dword [esp + 0x1c], 1
jne 0x435a90
xor edi, edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
xor esi, esi
pop ebp
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.00442750
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [ebx + esi*4], ecx
mov dword [ebx + esi*4 + 4], edx
add esi, 2
add esp, 8
cmp esi, 0x12
jl 0x435b70
xor esi, esi
pop edi
lea eax, [esp + 8]
push ebx
push eax
call fcn.00442750
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [ebx + esi*4 + 0x48], ecx
mov dword [ebx + esi*4 + 0x4c], edx
add esi, 2
add esp, 8
cmp esi, 0x400
jl 0x435b98
pop esi
pop ebx
add esp, 8
ret
Function at 0x43ec80
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret

Function at 0x43ee60
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret
Function at 0x444279
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x4442a6
call fcn.00425d84
mov dword [eax], esi
call fcn.00425d71
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00423e67
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x444282
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4442d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00425d97
pop ecx
call fcn.00425d71
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x4442fc
test al, 1
je 0x4442fc
test byte [esp + 0xc], 2
je 0x4442fc
call fcn.00425d84
mov dword [eax], 5
call fcn.00425d71
mov dword [eax], 0xd
jmp 0x4442cc
xor eax, eax
pop esi
ret

Function at 0x444466
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x444493
call fcn.00425d84
mov dword [eax], esi
call fcn.00425d71
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00423e67
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4444b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00425d97
pop ecx
jmp 0x44448e
test byte [esp + 0xc], 0x80
je 0x4444bd
and eax, 0xfffffffe
jmp 0x4444c0
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x4444a2
xor eax, eax
pop esi
ret
Function at 0x4a1e44
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x1c], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4
Function at 0x4a61d8
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 4], 0
and dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret 4

Function at 0x4a63e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
movzx eax, byte [edi + 0x3a0a0]
mov edx, eax
mov ecx, eax
shr ecx, 2
and edx, 3
movzx esi, byte [edx + 0x35110]
movzx edx, byte [edx + 0x35114]
xor esi, ecx
mov ecx, eax
shr ecx, 1
xor ecx, eax
shr ecx, 1
xor ecx, edx
xor ecx, eax
xor esi, eax
mov ebx, ecx
imul ecx, ecx, 0x1000100
imul ebx, ebx, 0x10100
add ebx, esi
add ecx, esi
movzx esi, byte [edi + 0x39fa0]
mov edx, edi
shl ebx, 8
add ebx, eax
shl eax, 0x10
add eax, ecx
shl edx, 2
mov dword [edx + 0x397a0], eax
mov edi, esi
and edi, 3
movzx ecx, byte [edi + 0x35110]
movzx edi, byte [edi + 0x35114]
mov eax, esi
shr eax, 2
xor ecx, eax
mov eax, esi
shr eax, 1
xor eax, esi
shr eax, 1
xor eax, edi
xor eax, esi
mov dword [edx + 0x38fa0], ebx
mov ebx, eax
xor ecx, esi
imul ebx, ebx, 0x101
mov edi, esi
shl edi, 8
add edi, ecx
imul ecx, ecx, 0x1000001
shl eax, 8
shl edi, 0x10
add edi, ebx
add eax, esi
shl eax, 8
mov dword [edx + 0x393a0], edi
mov edi, dword [ebp - 4]
add eax, ecx
inc edi
cmp edi, 0x100
mov dword [edx + 0x39ba0], eax
mov dword [ebp - 4], edi
jb 0x4a63f4
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4ab786
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
or eax, 0xffffffff
test esi, esi
je 0x4ab7b0
mov ecx, dword [esp + 8]
xor edx, edx
mov dl, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x351c0]
inc ecx
dec esi
jne 0x4ab796
not eax
pop esi
ret 8

Function at 0x4ab818
Capabilities:
Encode data using xor

Disassembly:
push esi
or esi, 0xffffffff
xor eax, eax
mov ecx, 0x400
xor edx, edx
mov dl, byte [eax + 0x351c0]
xor edx, esi
and edx, 0xff
shr esi, 8
xor esi, dword [edx*4 + 0x351c0]
inc eax
cmp eax, ecx
jl 0x4ab823
push ecx
push 0x351c0
call fcn.004ab786
mov ecx, 0x6fcf9e13
sub eax, ecx
neg eax
sbb eax, eax
not esi
sub esi, ecx
inc eax
neg esi
sbb esi, esi
inc esi
and eax, esi
pop esi
ret
Function at 0x4acec2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor eax, eax
mov ecx, 0x800
mov edi, ebx
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x4acf68
mov esi, dword [ebp + 8]
lea edi, [ebx + 0x180]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
pop eax
movsd dword es:[edi], dword [esi]
mov dword [ebp + 0xc], eax
jmp 0x4acefe
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 0x10]
shl ecx, 4
lea esi, [eax + 8]
shl esi, 5
add ecx, ebx
add esi, ebx
mov edi, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ecx
movsd dword es:[edi], dword [esi]
call fcn.004acda4
sar dword [ebp + 0xc], 1
cmp dword [ebp + 0xc], 0
jg 0x4acefb
lea eax, [ebx + 0x80]
mov edi, eax
lea esi, [ebx + 0x110]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call fcn.004acda4
mov dword [ebp + 0xc], 4
mov esi, dword [ebp + 0xc]
mov eax, esi
shl esi, 5
shl eax, 4
add eax, ebx
add esi, ebx
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
call fcn.004acda4
sar dword [ebp + 0xc], 1
cmp dword [ebp + 0xc], 0
jg 0x4acf42
jmp 0x4acfb1
cmp ecx, 1
jle 0x4acfb1
lea eax, [ecx - 2]
push 8
shl eax, 4
pop edx
shl ecx, 4
mov dword [ebp + 0xc], edx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jmp 0x4acf8d
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, edx
shl ecx, 4
lea esi, [eax + edx]
shl esi, 4
add ecx, ebx
add esi, ebx
mov edi, ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ecx
movsd dword es:[edi], dword [esi]
call fcn.004ace3e
sar dword [ebp + 0xc], 1
cmp dword [ebp + 0xc], 0
jg 0x4acf84
mov esi, dword [ebp - 4]
mov eax, esi
shl eax, 8
push 2
pop edi
lea eax, [eax + ebx + 0x10]
mov dword [ebp + 0xc], edi
mov dword [ebp - 0xc], eax
shl esi, 4
mov edx, dword [ebp - 0xc]
lea eax, [esi + edi]
shl eax, 4
add eax, ebx
cmp edi, 1
lea ecx, [eax + 0x10]
jle 0x4ad01b
dec edi
mov dword [ebp - 8], edi
mov edi, dword [edx]
xor edi, dword [eax]
add edx, 4
mov dword [ecx], edi
mov edi, dword [edx]
xor edi, dword [eax + 4]
add ecx, 4
mov dword [ecx], edi
add edx, 4
mov edi, dword [edx]
xor edi, dword [eax + 8]
add ecx, 4
mov dword [ecx], edi
add edx, 4
mov edi, dword [edx]
xor edi, dword [eax + 0xc]
add ecx, 4
mov dword [ecx], edi
add ecx, 4
add edx, 4
dec dword [ebp - 8]
jne 0x4acfe0
mov edi, dword [ebp + 0xc]
add edi, edi
cmp edi, 0x10
mov dword [ebp + 0xc], edi
jl 0x4acfc9
mov ecx, dword [ebp - 4]
inc ecx
cmp ecx, 0x20
mov dword [ebp - 4], ecx
jl 0x4acede
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4ad03c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor eax, eax
and dword [ebp + 0xc], eax
mov ecx, 0x400
mov edi, esi
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x4ad0e4
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov dword [esi + 0x180], ecx
mov eax, dword [eax + 4]
push 4
mov dword [esi + 0x184], eax
pop edi
lea eax, [edi + 0x10]
lea ecx, [edi + 8]
shl ecx, 5
mov edx, dword [ecx + esi]
shl eax, 4
add eax, esi
mov dword [eax], edx
mov ecx, dword [ecx + esi + 4]
push eax
mov dword [eax + 4], ecx
call fcn.004ace00
sar edi, 1
test edi, edi
jg 0x4ad078
mov ecx, dword [esi + 0x110]
lea eax, [esi + 0x80]
mov dword [eax], ecx
mov ecx, dword [esi + 0x114]
push eax
mov dword [eax + 4], ecx
call fcn.004ace00
push 4
pop edi
mov eax, edi
mov ecx, edi
shl ecx, 5
mov edx, dword [ecx + esi]
shl eax, 4
add eax, esi
mov dword [eax], edx
mov ecx, dword [ecx + esi + 4]
push eax
mov dword [eax + 4], ecx
call fcn.004ace00
sar edi, 1
test edi, edi
jg 0x4ad0be
jmp 0x4ad122
cmp eax, 1
jle 0x4ad122
lea edi, [eax - 2]
shl edi, 4
push 8
shl eax, 4
pop ebx
mov dword [ebp - 8], eax
jmp 0x4ad0fd
mov eax, dword [ebp - 8]
add eax, ebx
lea ecx, [edi + ebx]
shl ecx, 4
mov edx, dword [ecx + esi]
mov ecx, dword [ecx + esi + 4]
shl eax, 4
add eax, esi
push eax
mov dword [eax], edx
mov dword [eax + 4], ecx
call fcn.004ace90
sar ebx, 1
test ebx, ebx
jg 0x4ad0fa
mov edi, dword [ebp + 0xc]
mov eax, edi
shl eax, 8
push 2
pop ebx
lea eax, [eax + esi + 0x10]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], eax
shl edi, 4
mov edx, dword [ebp - 0xc]
lea eax, [edi + ebx]
shl eax, 4
add eax, esi
cmp ebx, 1
lea ecx, [eax + 0x10]
jle 0x4ad18c
dec ebx
mov dword [ebp - 4], ebx
mov ebx, dword [edx]
xor ebx, dword [eax]
add edx, 4
mov dword [ecx], ebx
mov ebx, dword [edx]
xor ebx, dword [eax + 4]
add ecx, 4
mov dword [ecx], ebx
add edx, 4
mov ebx, dword [edx]
xor ebx, dword [eax + 8]
add ecx, 4
mov dword [ecx], ebx
add edx, 4
mov ebx, dword [edx]
xor ebx, dword [eax + 0xc]
add ecx, 4
mov dword [ecx], ebx
add ecx, 4
add edx, 4
dec dword [ebp - 4]
jne 0x4ad151
mov ebx, dword [ebp - 8]
add ebx, ebx
cmp ebx, 0x10
mov dword [ebp - 8], ebx
jl 0x4ad13a
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0x10
jl 0x4ad056
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4ad878
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x60]
sub esp, 0x19c
mov eax, dword [0x37908]
push ebx
mov ebx, dword [ebp + 0x68]
mov dword [ebp + 0x5c], eax
mov eax, dword [ebp + 0x70]
push esi
mov esi, dword [ebp + 0x6c]
cmp esi, 0x40
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x78]
push edi
mov dword [ebp - 0x24], eax
jle 0x4ad8d5
lea eax, [ebp - 0x13c]
push eax
call fcn.004a61d8
lea eax, [ebp - 0x13c]
push eax
push esi
push ebx
call fcn.004a620a
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004a62b4
push 0x14
lea ebx, [ebp - 0xc]
pop esi
lea eax, [ebp - 0x84]
push eax
call fcn.004a61d8
xor ecx, ecx
test esi, esi
jle 0x4ad8ff
mov edi, ebx
lea eax, [ebp + 0x1c]
sub edi, eax
lea eax, [ebp + ecx + 0x1c]
mov dl, byte [edi + eax]
xor dl, 0x36
inc ecx
cmp ecx, esi
mov byte [eax], dl
jl 0x4ad8ee
cmp esi, 0x40
jge 0x4ad920
push 0x40
pop ecx
sub ecx, esi
mov edx, ecx
shr ecx, 2
lea edi, [ebp + esi + 0x1c]
mov eax, 0x36363636
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0x84]
push eax
push 0x40
lea eax, [ebp + 0x1c]
push eax
call fcn.004a620a
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0x74]
push dword [ebp - 0x28]
call fcn.004a620a
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004a62b4
lea eax, [ebp - 0xe0]
push eax
call fcn.004a61d8
xor ecx, ecx
test esi, esi
jle 0x4ad97e
mov edi, ebx
lea eax, [ebp + 0x1c]
sub edi, eax
lea eax, [ebp + ecx + 0x1c]
mov dl, byte [edi + eax]
xor dl, 0x5c
inc ecx
cmp ecx, esi
mov byte [eax], dl
jl 0x4ad96d
cmp esi, 0x40
jge 0x4ad99f
push 0x40
pop ecx
sub ecx, esi
mov edx, ecx
shr ecx, 2
lea edi, [ebp + esi + 0x1c]
mov eax, 0x5c5c5c5c
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0xe0]
push eax
push 0x40
lea eax, [ebp + 0x1c]
push eax
call fcn.004a620a
lea eax, [ebp - 0xe0]
push eax
push 0x14
pop esi
push esi
lea eax, [ebp - 0x20]
push eax
call fcn.004a620a
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp + 8]
push eax
call fcn.004a62b4
cmp dword [ebp + 0x7c], esi
jle 0x4ad9dd
mov dword [ebp + 0x7c], esi
push dword [ebp + 0x7c]
lea eax, [ebp + 8]
push dword [ebp - 0x24]
push eax
call fcn.004ad858
mov ecx, dword [ebp + 0x5c]
pop edi
pop esi
pop ebx
call fcn.004af89a
add ebp, 0x60
leave
ret 0x18
Function at 0x4ad9fe
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x5c]
sub esp, 0xb4
mov eax, dword [0x37908]
mov edx, dword [ebp + 0x70]
push ebx
push esi
mov esi, dword [ebp + 0x6c]
push edi
mov dword [ebp + 0x58], eax
mov eax, dword [ebp + 0x64]
mov dword [ebp - 0x58], eax
xor eax, eax
lea edi, [ebp - 0x54]
stosd dword es:[edi], eax
mov al, byte [ebp + 0x7c]
mov byte [ebp - 0x51], al
mov ecx, edx
mov eax, ecx
shr ecx, 2
mov ebx, dword [ebp + 0x78]
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x54]
and ecx, 3
push 0x14
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + edx - 0x50], eax
lea eax, [ebp + 0x44]
push eax
add edx, 4
push edx
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x68]
push dword [ebp - 0x58]
call fcn.004ad878
mov eax, dword [ebp + 0x74]
cmp eax, 1
push 5
pop ecx
lea esi, [ebp + 0x44]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
jle 0x4adaad
lea ecx, [ebp + 0x30]
sub ebx, ecx
lea esi, [eax - 1]
push 0x14
lea eax, [ebp + 0x30]
push eax
push 0x14
lea eax, [ebp + 0x44]
push eax
push dword [ebp + 0x68]
push dword [ebp - 0x58]
call fcn.004ad878
xor edx, edx
lea eax, [ebp + edx + 0x30]
lea ecx, [ebx + eax]
mov al, byte [eax]
xor byte [ecx], al
mov byte [ebp + edx + 0x44], al
inc edx
cmp edx, 0x14
jl 0x4ada95
dec esi
jne 0x4ada7c
mov ecx, dword [ebp + 0x58]
pop edi
pop esi
pop ebx
call fcn.004af89a
add ebp, 0x5c
leave
ret 0x1c