joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45aed0
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x45af20
movzx ecx, byte [ebx]
xor eax, eax
test cl, cl
je 0x45af1d
xor edx, edx
mov esi, 0x100
lea esi, [esi]
movsx eax, cl
add ebx, 1
or eax, esi
add esi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
rol edx, cl
movzx ecx, byte [ebx]
imul eax, eax
xor edx, eax
test cl, cl
jne 0x45aef0
mov eax, edx
shr eax, 0x10
xor eax, edx
pop ebx
pop esi
ret
xor eax, eax
pop ebx
pop esi
ret

Function at 0x45e0f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [esp + 0x14c]
mov edi, dword [esp + 0x140]
mov esi, dword [esp + 0x148]
test ebx, ebx
je 0x45e25f
cmp ebx, dword [edi]
je 0x45e261
mov dword [esp], ebx
call fcn.00458c30
cmp eax, esi
jb 0x45e230
mov eax, dword [esp + 0x144]
lea ebp, [esp + 0xa0]
mov dword [esp + 8], esi
mov dword [esp], ebp
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov dword [esp + 0x1c], esi
cmp esi, 0x80
je 0x45e176
mov eax, pe_nt_image_headers32
sub eax, esi
add esi, ebp
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.msvcrt.dll_memset
xor eax, eax
movzx ecx, byte [ebp + eax]
xor ecx, 0x36
mov byte [esp + eax + 0x20], cl
add eax, 1
cmp eax, 0x80
jne 0x45e178
mov eax, dword [esp + 0x150]
lea esi, [edi + 0x1c]
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.00458f80
test eax, eax
je 0x45e252
mov dword [esp], ebx
call fcn.00458c30
mov dword [esp], esi
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
call fcn.004590d0
test eax, eax
je 0x45e252
xor eax, eax
movzx ecx, byte [ebp + eax]
xor ecx, 0x5c
mov byte [esp + eax + 0x20], cl
add eax, 1
cmp eax, 0x80
jne 0x45e1d6
mov eax, dword [esp + 0x150]
lea ebp, [edi + 0x34]
mov dword [esp + 4], ebx
mov dword [esp], ebp
mov dword [esp + 8], eax
call fcn.00458f80
test eax, eax
je 0x45e252
mov dword [esp], ebx
call fcn.00458c30
mov dword [esp], ebp
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
call fcn.004590d0
test eax, eax
je 0x45e252
mov dword [edi], ebx
jmp 0x45e273
mov edx, dword [esp + 0x150]
lea eax, [edi + 4]
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
call fcn.00458f80
test eax, eax
jne 0x45e28c
xor eax, eax
add esp, 0x12c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [edi]
mov eax, dword [esp + 0x144]
test eax, eax
jne 0x45e11f
lea esi, [edi + 0x1c]
add edi, 4
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.00458db0
test eax, eax
setne al
movzx eax, al
jmp 0x45e254
mov eax, dword [esp + 0x144]
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call fcn.004590d0
test eax, eax
je 0x45e252
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc]
lea ebp, [esp + 0xa0]
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.00459100
test eax, eax
je 0x45e252
mov esi, dword [esp + 0x1c]
jmp 0x45e151
Function at 0x45e670
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
push edi
mov edi, edx
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [eax]
mov dword [esp + 0x14], edx
mov edx, dword [eax + 4]
lea esi, [edi + 0x7e]
mov dword [esp + 0x18], eax
mov edi, 5
mov dword [esp + 0x10], 3
mov ecx, ebx
mov eax, edx
shr ebx, 0x10
shr edx, 0x10
mov word [esp], ax
movzx eax, word [esp]
rol dx, 0xb
sub esi, 8
rol word [esp], 0xd
mov ebp, eax
not ebp
and ebp, ecx
sub edx, ebp
mov ebp, eax
movzx eax, word [esi + 6]
and ebp, ebx
sub edx, ebp
mov ebp, ebx
sub dx, word [esi + 8]
not ebp
and ebp, edx
sub word [esp], bp
mov ebp, ebx
and ebp, ecx
sub word [esp], bp
mov ebp, ecx
sub word [esp], ax
not ebp
movzx eax, word [esp]
rol bx, 0xe
and ebp, eax
sub ebx, ebp
mov ebp, edx
and ebp, ecx
sub ebx, ebp
mov ebp, edx
sub bx, word [esi + 4]
not ebp
rol cx, 0xf
and ebp, ebx
sub ecx, ebp
mov ebp, eax
and ebp, edx
sub ecx, ebp
sub cx, word [esi + 2]
sub edi, 1
jne 0x45e6a4
sub dword [esp + 0x10], 1
je 0x45e760
xor eax, eax
mov ebp, dword [esp]
cmp dword [esp + 0x10], 2
sete al
and ebp, 0x3f
mov edi, eax
mov eax, dword [esp + 0x14]
add edi, 5
sub dx, word [eax + ebp*2]
mov ebp, ebx
and ebp, 0x3f
movzx ebp, word [eax + ebp*2]
sub word [esp], bp
mov ebp, ecx
and ebp, 0x3f
sub bx, word [eax + ebp*2]
mov ebp, edx
and ebp, 0x3f
sub cx, word [eax + ebp*2]
jmp 0x45e6a4
movzx eax, word [esp]
shl ebx, 0x10
movzx ecx, cx
mov edi, dword [esp + 0x18]
shl edx, 0x10
or ebx, ecx
or edx, eax
mov dword [edi], ebx
mov dword [edi + 4], edx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4645d0
Capabilities:
Hash data with md5

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x5c
test dl, 1
mov edi, edx
jne 0x464630
test edi, 2
jne 0x464640
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x464601
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x464609
mov byte [edi], 0
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x5b
test edi, 2
mov byte [edx], 0
je 0x4645ea
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x4645ea
Function at 0x467f20
Capabilities:
Hash data using sha256

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x70
test dl, 1
mov edi, edx
jne 0x467fa0
test edi, 2
jne 0x467fb0
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x467f51
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x467f59
mov byte [edi], 0
mov dword [edx], 0x6a09e667
mov eax, 1
mov dword [edx + 4], 0xbb67ae85
mov dword [edx + 8], 0x3c6ef372
mov dword [edx + 0xc], 0xa54ff53a
mov dword [edx + 0x10], 0x510e527f
mov dword [edx + 0x14], 0x9b05688c
mov dword [edx + 0x18], 0x1f83d9ab
mov dword [edx + 0x1c], 0x5be0cd19
mov dword [edx + 0x6c], 0x20
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x6f
test edi, 2
mov byte [edx], 0
je 0x467f3a
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x467f3a
Function at 0x468620
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x58]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebx, dword [eax]
test ebx, ebx
je 0x46867b
mov eax, dword [esp + 0x48]
test eax, eax
je 0x46867b
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
jmp 0x468654
test ebp, ebp
je 0x46866f
movzx eax, byte [edi + ebx]
add edx, 1
add ebx, 1
xor al, byte [edx - 1]
add ecx, 1
sub ebp, 1
and ebx, 0xf
mov byte [ecx - 1], al
jne 0x468650
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ebp
cmp dword [esp + 0x48], 0xf
jbe 0x468791
mov ecx, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x54], edi
mov edi, ebp
mov ebp, ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp], esi
mov dword [esp + 8], eax
call dword [esp + 0x5c]
mov ecx, dword [esp + 0x1c]
mov eax, 0x10
sub eax, 1
add byte [esi + eax], 1
jne 0x4686e1
test eax, eax
jne 0x4686c2
cmp ebx, 0xf
ja 0x4686e6
mov eax, dword [ecx + ebx]
xor eax, dword [edi + ebx]
mov dword [ebp + ebx], eax
add ebx, 4
cmp ebx, 0xf
jbe 0x4686d4
sub dword [esp + 0x18], 0x10
add ebp, 0x10
add edi, 0x10
cmp dword [esp + 0x18], 0xf
jbe 0x4686fc
xor ebx, ebx
jmp 0x4686a2
mov eax, dword [esp + 0x48]
mov edi, ecx
xor ebx, ebx
mov ebp, dword [esp + 0x48]
sub eax, 0x10
and eax, 0xfffffff0
and ebp, 0xf
add eax, 0x10
add dword [esp + 0x44], eax
add dword [esp + 0x40], eax
test ebp, ebp
jne 0x46872e
mov eax, dword [esp + 0x58]
mov dword [eax], ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 8], eax
call dword [esp + 0x5c]
mov eax, 0x10
sub eax, 1
movzx ecx, byte [esi + eax]
lea edx, [ecx + 1]
test dl, dl
mov byte [esi + eax], dl
jne 0x46875b
test eax, eax
jne 0x468746
mov ecx, dword [esp + 0x44]
lea esi, [edi + ebx]
xor eax, eax
mov edi, dword [esp + 0x40]
add ecx, ebx
add edi, ebx
lea esi, [esi]
movzx edx, byte [esi + eax]
xor dl, byte [edi + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, ebp
jne 0x468770
add ebx, eax
mov eax, dword [esp + 0x58]
mov dword [eax], ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [esp + 0x48]
jmp 0x46871c
Function at 0x4687a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x58]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov esi, dword [esp + 0x48]
mov eax, dword [eax]
mov ebx, dword [esp + 0x50]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x4687f4
test esi, esi
je 0x4687f4
mov edx, eax
mov edi, dword [esp + 0x54]
jmp 0x4687d5
test esi, esi
je 0x4687f0
movzx eax, byte [edi + edx]
add ebp, 1
add edx, 1
xor al, byte [ebp - 1]
add ecx, 1
sub esi, 1
and edx, 0xf
mov byte [ecx - 1], al
jne 0x4687d1
mov dword [esp + 0x1c], edx
movzx eax, byte [ebx + 0xc]
movzx edx, byte [ebx + 0xd]
shl eax, 0x18
shl edx, 0x10
or eax, edx
movzx edx, byte [ebx + 0xf]
or eax, edx
movzx edx, byte [ebx + 0xe]
shl edx, 8
or eax, edx
cmp esi, 0xf
jbe 0x46887d
mov edi, esi
shr edi, 4
mov edx, edi
add edx, eax
jae 0x468893
neg eax
mov edi, eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp], ebp
call dword [esp + 0x5c]
mov ecx, dword [esp + 0x14]
mov eax, 0xc
mov byte [ebx + 0xc], 0
mov byte [ebx + 0xd], 0
mov byte [ebx + 0xe], 0
mov byte [ebx + 0xf], 0
nop
sub eax, 1
add byte [ebx + eax], 1
jne 0x46886d
test eax, eax
jne 0x468860
xor eax, eax
shl edi, 4
sub esi, edi
add ecx, edi
add ebp, edi
cmp esi, 0xf
ja 0x468818
test esi, esi
jne 0x4688dd
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x58]
mov dword [eax], esi
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x18], edx
mov dword [esp + 4], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 8], edi
mov dword [esp], ebp
call dword [esp + 0x5c]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov eax, edx
shr eax, 0x18
mov byte [ebx + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [ebx + 0xd], al
mov eax, edx
shr eax, 8
mov byte [ebx + 0xe], al
mov eax, edx
mov byte [ebx + 0xf], dl
jmp 0x46886f
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x18], ecx
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 4], eax
mov dword [esp], eax
call dword [esp + 0x5c]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add eax, 1
mov edx, eax
shr edx, 0x18
mov byte [ebx + 0xc], dl
mov edx, eax
shr edx, 0x10
mov byte [ebx + 0xd], dl
mov edx, eax
shr edx, 8
test eax, eax
mov byte [ebx + 0xe], dl
mov byte [ebx + 0xf], al
jne 0x468968
mov al, 0xc
sub eax, 1
movzx edi, byte [ebx + eax]
lea edx, [edi + 1]
test dl, dl
mov byte [ebx + eax], dl
jne 0x468968
test eax, eax
jne 0x468953
mov edi, dword [esp + 0x1c]
xor eax, eax
mov ebx, dword [esp + 0x54]
add ecx, edi
add ebx, edi
add edi, ebp
movzx edx, byte [ebx + eax]
xor dl, byte [edi + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, esi
jne 0x468978
add dword [esp + 0x1c], eax
jmp 0x468881
Function at 0x4694e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
cmp dword [esp + 0x48], 0xc
mov ebp, dword [esp + 0x44]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x16c], 0
mov dword [ebx + 0x168], 0
je 0x4696a6
mov eax, dword [esp + 0x48]
xor edx, edx
mov edi, ebp
mov esi, dword [esp + 0x48]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
lea eax, [ebx + 0x60]
cmp esi, 0xf
mov dword [esp + 0x14], eax
jbe 0x4695cf
mov dword [esp + 0x44], ebp
mov ebp, esi
mov esi, dword [esp + 0x14]
nop
lea esi, [esi]
xor eax, eax
movzx edx, byte [edi + eax]
xor byte [ebx + eax], dl
add eax, 1
cmp eax, 0x10
jne 0x469592
mov dword [esp + 4], esi
sub ebp, 0x10
add edi, 0x10
mov dword [esp], ebx
call fcn.00468ae0
cmp ebp, 0xf
ja 0x469590
mov eax, dword [esp + 0x48]
mov ebp, dword [esp + 0x44]
and dword [esp + 0x48], 0xf
sub eax, 0x10
and eax, 0xfffffff0
lea ebp, [ebp + eax + 0x10]
mov eax, dword [esp + 0x48]
test eax, eax
je 0x4695ff
mov ecx, dword [esp + 0x48]
xor eax, eax
lea esi, [esi]
movzx edx, byte [ebp + eax]
xor byte [ebx + eax], dl
add eax, 1
cmp eax, ecx
jne 0x4695e0
mov eax, dword [esp + 0x14]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00468ae0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
shld edx, eax, 3
shl eax, 3
mov edi, edx
mov esi, eax
mov eax, esi
shrd eax, edx, 0x18
xor byte [ebx + 0xc], al
mov eax, esi
shrd eax, edi, 0x10
xor byte [ebx + 0xd], al
mov eax, esi
shrd eax, edi, 8
xor byte [ebx + 0xe], al
mov eax, esi
xor byte [ebx + 0xf], al
mov eax, dword [esp + 0x14]
xor byte [ebx + 0xb], dl
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00468ae0
movzx eax, byte [ebx + 0xc]
movzx edx, byte [ebx + 0xd]
shl eax, 0x18
shl edx, 0x10
or eax, edx
movzx edx, byte [ebx + 0xf]
or eax, edx
movzx edx, byte [ebx + 0xe]
shl edx, 8
or eax, edx
lea esi, [eax + 1]
mov eax, dword [ebx + 0x174]
mov dword [esp], ebx
mov dword [esp + 8], eax
lea eax, [ebx + 0x20]
mov dword [esp + 4], eax
call dword [ebx + 0x170]
mov eax, esi
shr eax, 0x18
mov byte [ebx + 0xc], al
mov eax, esi
shr eax, 0x10
mov byte [ebx + 0xd], al
mov eax, esi
shr eax, 8
mov byte [ebx + 0xe], al
mov eax, esi
mov byte [ebx + 0xf], al
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp]
mov esi, 2
mov dword [ebx], eax
mov eax, dword [ebp + 4]
mov dword [ebx + 4], eax
mov eax, dword [ebp + 8]
mov byte [ebx + 0xf], 1
mov dword [ebx + 8], eax
jmp 0x469667
Function at 0x4696d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor eax, eax
push edi
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov edx, dword [esi + 0x3c]
or edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x30]
mov ebx, dword [esi + 0x34]
jne 0x469705
mov eax, edi
xor edx, edx
add eax, ecx
adc edx, ebx
cmp edx, 0x20000000
jbe 0x46970d
xor eax, eax
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret
jae 0x469803
mov dword [esi + 0x34], edx
mov edx, dword [esi + 0x16c]
mov dword [esi + 0x30], eax
test edx, edx
je 0x469773
test edi, edi
jne 0x469734
jmp 0x46974e
test edi, edi
je 0x46974a
add ebp, 1
movzx eax, byte [ebp - 1]
sub edi, 1
xor byte [esi + edx + 0x40], al
add edx, 1
and edx, 0xf
jne 0x469730
test edx, edx
je 0x469761
mov dword [esi + 0x16c], edx
add esp, 0x14
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esi + 0x60]
mov dword [esp + 4], eax
lea eax, [esi + 0x40]
mov dword [esp], eax
call fcn.00468ae0
cmp edi, 0xf
jbe 0x4697d6
lea ecx, [esi + 0x40]
mov ebx, ebp
lea eax, [esi + 0x60]
mov dword [esp + 0xc], ecx
mov ecx, edi
mov dword [esp + 0x2c], ebp
mov ebp, eax
mov dword [esp + 0x30], edi
mov edi, ebx
mov ebx, ecx
xor eax, eax
movzx edx, byte [edi + eax]
xor byte [esi + eax + 0x40], dl
add eax, 1
cmp eax, 0x10
jne 0x469796
mov eax, dword [esp + 0xc]
sub ebx, 0x10
add edi, 0x10
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.00468ae0
cmp ebx, 0xf
ja 0x469794
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
lea eax, [edi - 0x10]
and edi, 0xf
and eax, 0xfffffff0
lea ebp, [ebp + eax + 0x10]
test edi, edi
je 0x4697f0
xor edx, edx
lea esi, [esi]
movzx eax, byte [ebp + edx]
xor byte [esi + edx + 0x40], al
add edx, 1
cmp edx, edi
jne 0x4697e0
mov dword [esi + 0x16c], edi
add esp, 0x14
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0
jbe 0x469713
xor eax, eax
jmp 0x469705
Function at 0x46a9b0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], edi
mov dword [esp], eax
call fcn.0046a580
test eax, eax
js 0x46abce
mov edx, dword [edi + 0xf0]
mov eax, edi
lea ebp, [edx*4]
test ebp, ebp
jle 0x46aa49
shl edx, 4
mov ecx, edi
add edx, edi
xor ebx, ebx
mov dword [esp + 0xc], edi
nop
lea esi, [esi]
mov esi, dword [ecx]
add ebx, 4
add ecx, 0x10
mov eax, dword [edx]
sub edx, 0x10
mov dword [ecx - 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [edx + 0x10], esi
mov esi, dword [ecx - 0xc]
mov dword [ecx - 0xc], eax
mov eax, dword [edx + 0x18]
mov dword [edx + 0x14], esi
mov esi, dword [ecx - 8]
mov dword [ecx - 8], eax
mov eax, dword [edx + 0x1c]
mov dword [edx + 0x18], esi
mov esi, dword [ecx - 4]
mov dword [ecx - 4], eax
mov dword [edx + 0x1c], esi
mov esi, ebp
sub esi, ebx
cmp ebx, esi
jl 0x46aa00
mov eax, dword [esp + 0xc]
mov edx, dword [edi + 0xf0]
mov ecx, 1
cmp edx, 1
mov ebp, ecx
jle 0x46abcc
lea esi, [esi]
add eax, 0x10
mov ebx, dword [eax]
add ebp, 1
movzx edx, bl
mov esi, ebx
movzx edx, byte [edx*4 + 0x4d31e0]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x4d31e0]
mov edx, dword [edx*4 + 0x4d19e0]
xor edx, dword [esi*4 + 0x4d25e0]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x4d31e0]
movzx esi, cl
movzx esi, byte [esi*4 + 0x4d31e0]
xor edx, dword [esi*4 + 0x4d21e0]
xor edx, dword [ebx*4 + 0x4d1de0]
mov ebx, dword [eax + 4]
mov dword [eax], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x4d31e0]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x4d31e0]
mov edx, dword [edx*4 + 0x4d19e0]
xor edx, dword [esi*4 + 0x4d25e0]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x4d31e0]
movzx esi, cl
movzx esi, byte [esi*4 + 0x4d31e0]
xor edx, dword [esi*4 + 0x4d21e0]
xor edx, dword [ebx*4 + 0x4d1de0]
mov ebx, dword [eax + 8]
mov dword [eax + 4], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x4d31e0]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x4d31e0]
mov edx, dword [edx*4 + 0x4d19e0]
xor edx, dword [esi*4 + 0x4d25e0]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x4d31e0]
movzx esi, cl
movzx esi, byte [esi*4 + 0x4d31e0]
xor edx, dword [esi*4 + 0x4d21e0]
xor edx, dword [ebx*4 + 0x4d1de0]
mov ebx, dword [eax + 0xc]
mov dword [eax + 8], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x4d31e0]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x4d31e0]
mov edx, dword [edx*4 + 0x4d19e0]
xor edx, dword [esi*4 + 0x4d25e0]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x4d31e0]
movzx esi, cl
movzx esi, byte [esi*4 + 0x4d31e0]
xor edx, dword [esi*4 + 0x4d21e0]
xor edx, dword [ebx*4 + 0x4d1de0]
mov dword [eax + 0xc], edx
cmp dword [edi + 0xf0], ebp
jg 0x46aa60
xor eax, eax
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x491f20
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x4a7478]
mov ebx, dword [ebp + 8]
test eax, eax
js 0x492002
test eax, eax
mov edi, dword [0x4f0888]
jne 0x491fa0
test edi, edi
mov dword [ebp - 0x1c], edi
je 0x491f93
mov eax, edi
lea esi, [ebp - 0x1c]
nop
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x491f87
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esp + 4], 1
mov dword [esp], 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call ecx
cmp eax, 6
je 0x491fd0
cmp eax, 8
jne 0x491ff5
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
test eax, eax
mov dword [ebp - 0x1c], eax
jne 0x491f50
mov eax, 5
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [0x4f0884]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x491f43
mov eax, dword [ebp - 0x1c]
mov edx, esi
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x1c], edi
mov dword [ebx + 0x10], eax
mov eax, ebx
call fcn.004919d0
cmp eax, 7
jne 0x491f98
mov eax, esi
call fcn.00491b50
lea esp, [ebp - 0xc]
mov eax, 3
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00491ac0
mov eax, dword [0x4a7478]
jmp 0x491f39

Function at 0x4920b0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [0x4a7478]
mov ebx, dword [ebp + 8]
test edx, edx
js 0x492126
test edx, edx
mov eax, dword [0x4f0888]
jne 0x4920fe
mov ecx, dword [ebx + 0xc]
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov edx, esi
mov eax, ebx
test ecx, ecx
jne 0x4920ef
call fcn.004919d0
cmp eax, 7
je 0x4920f7
call sub.msvcrt.dll_abort
nop
call fcn.00491bc0
jmp 0x4920e5
mov eax, esi
call fcn.00491b50
mov esi, dword [0x4f0884]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
push edi
jmp 0x4920cf
call fcn.00491ac0
mov edx, dword [0x4a7478]
jmp 0x4920c6
Function at 0x492140
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x492180
mov edx, dword [0x4a7478]
test edx, edx
js 0x4921c4
test edx, edx
mov eax, dword [0x4f0888]
jne 0x492198
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00491bc0
cmp eax, 7
je 0x492190
call sub.msvcrt.dll_abort
lea esi, [esi]
mov dword [esp], ebx
call fcn.00491f20
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x1c]
call fcn.00491b50
mov esi, dword [0x4f0884]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
sub esp, 4
jmp 0x492166
call fcn.00491ac0
mov edx, dword [0x4a7478]
jmp 0x49215d

Function at 0x492330
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x492360
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp fcn.0049e420
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 4
pop ebx
pop esi
jmp eax
Function at 0x10003357
Capabilities:
Create tcp socket

Disassembly:
push 6
push 1
push 2
call sub.WS2_32.dll_socket
pop edx
mov edx, dword [esp - 4]
jmp edx