joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b5cd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x51df40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [eax], 0
mov dword [ebp - 0x28], ecx
mov ecx, dword [edi + 0x148]
mov edx, ecx
mov eax, dword [edi + 0x14c]
mov ebx, eax
mov esi, dword [edi + 0x154]
shld ebx, edx, 3
shl edx, 3
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], edx
mov edx, dword [edi + 0x150]
mov ebx, edx
shld esi, ebx, 3
shl ebx, 3
or ecx, eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
jne 0x4b5d49
and edx, 0xf
or edx, ecx
je 0x4b5d49
lea eax, [edi + 0x178]
push eax
push eax
push edi
call fcn.004b58e0
add esp, 0xc
mov ebx, dword [ebp + 0x1c]
lea eax, [ebx - 4]
cmp eax, 0xc
ja 0x4b5e8e
mov eax, dword [edi + 0x148]
lea esi, [edi + 0x178]
and eax, 0xf
or eax, 0
je 0x4b5d77
push esi
push esi
push edi
call fcn.004b58e0
add esp, 0xc
push ebx
lea eax, [edi + 0x158]
push eax
push dword [ebp - 0x28]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x24]
add esp, 0xc
or eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
jne 0x4b5da0
mov eax, edx
or eax, dword [ebp - 0x1c]
je 0x4b5e7b
mov ebx, dword [ebp - 0x1c]
mov ecx, edx
mov eax, ebx
mov byte [ebp - 0x11], bl
shr eax, 0x18
mov byte [ebp - 0x14], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0x13], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0x12], al
mov eax, ebx
shrd ecx, eax, 0x18
mov eax, ebx
mov byte [ebp - 0xd], dl
mov byte [ebp - 0x10], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, edx
mov edx, dword [ebp - 0x24]
shrd eax, ebx, 8
mov ebx, dword [ebp - 0x20]
mov byte [ebp - 0xe], al
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
mov eax, ebx
mov byte [ebp - 0xf], cl
mov ecx, edx
shrd ecx, eax, 0x18
mov eax, ebx
mov byte [ebp - 9], bl
mov byte [ebp - 8], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, edx
mov byte [ebp - 5], dl
shrd eax, ebx, 8
mov byte [ebp - 7], cl
lea edx, [ebp - 0x13]
mov byte [ebp - 6], al
mov ebx, 4
lea eax, [edi + 0x179]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 4]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 2]
xor byte [eax - 2], cl
sub ebx, 1
jne 0x4b5e31
push esi
push esi
push edi
call fcn.004b58e0
mov ebx, dword [ebp + 0x1c]
add esp, 0xc
xor ecx, ecx
test ebx, ebx
je 0x4b5e7b
mov edx, dword [ebp - 0x28]
nop
mov al, byte [esi + ecx]
xor byte [edx + ecx], al
inc ecx
cmp ecx, ebx
jb 0x4b5e70
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xffffffec
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
Function at 0x4b5f80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x51df40]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], 0
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], edi
test esi, esi
je 0x4b611f
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
movups xmmword [edi + 0x168], xmm0
push ebx
lea ebx, [edi + 0x168]
mov dword [ebp - 0x20], ebx
movups xmmword [edi + 0x178], xmm0
mov dword [edi + 0x188], eax
mov dword [edi + 0x148], 0
mov dword [edi + 0x14c], 0
mov dword [edi + 0x150], 0
mov dword [edi + 0x154], 0
cmp esi, 0xc
jne 0x4b601b
movq xmm0, qword [ecx]
movq qword [ebx], xmm0
mov eax, dword [ecx + 8]
mov dword [ebx + 8], eax
mov byte [edi + 0x177], 1
jmp 0x4b60f7
mov ecx, 8
movlpd qword [ebp - 0x14], xmm0
mov eax, esi
mul ecx
mov ecx, edx
mov byte [ebp - 9], dl
shr ecx, 0x18
mov ebx, eax
mov byte [ebp - 0xc], cl
mov eax, edx
mov ecx, edx
mov byte [ebp - 5], bl
shr ecx, 0x10
mov byte [ebp - 0xb], cl
mov ecx, edx
shr ecx, 8
mov byte [ebp - 0xa], cl
mov ecx, ebx
shrd ecx, eax, 0x18
mov eax, edx
mov byte [ebp - 8], cl
mov ecx, ebx
shrd ecx, eax, 0x10
mov eax, ebx
mov ebx, dword [ebp - 0x20]
shrd eax, edx, 8
mov byte [ebp - 7], cl
mov byte [ebp - 6], al
mov eax, dword [ebp - 0x18]
nop
mov edi, 0x10
cmp esi, edi
cmovb edi, esi
test edi, edi
je 0x4b6096
mov edx, eax
mov esi, edi
mov eax, ebx
mov cl, byte [edx]
lea edx, [edx + 1]
xor byte [eax], cl
lea eax, [eax + 1]
sub esi, 1
jne 0x4b6084
mov esi, dword [ebp + 0x14]
push ebx
push ebx
push dword [ebp - 0x1c]
call fcn.004b58e0
mov eax, dword [ebp - 0x18]
sub esi, edi
add eax, edi
mov dword [ebp + 0x14], esi
add esp, 0xc
mov dword [ebp - 0x18], eax
test esi, esi
jne 0x4b6070
mov edi, dword [ebp - 0x1c]
lea edx, [ebp - 0x13]
mov esi, 4
lea ecx, [edi + 0x169]
movzx eax, byte [edx - 1]
lea edx, [edx + 4]
xor byte [ecx - 1], al
lea ecx, [ecx + 4]
movzx eax, byte [edx - 4]
xor byte [ecx - 4], al
movzx eax, byte [edx - 3]
xor byte [ecx - 3], al
movzx eax, byte [edx - 2]
xor byte [ecx - 2], al
sub esi, 1
jne 0x4b60c5
push ebx
push ebx
push edi
call fcn.004b58e0
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [edi + 0x158]
push eax
push 0x10
push ebx
push edi
call fcn.004a5920
add esp, 0x14
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xffffffec
pop edi
xor ecx, ebp
pop esi
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
Function at 0x4b6350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [ecx + 0x150]
and eax, 0xf
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
je 0x4b63db
mov edx, 0x10
sub edx, eax
cmp edx, ebx
cmova edx, ebx
xor esi, esi
mov dword [ebp + 0x10], edx
test edx, edx
je 0x4b63a7
lea edx, [ecx + 0x178]
mov ecx, dword [ebp + 0x10]
add edx, eax
mov al, byte [esi + edi]
lea edx, [edx + 1]
xor byte [edx - 1], al
inc esi
cmp esi, ecx
jb 0x4b6390
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
add eax, edx
lea esi, [ecx + 0x178]
mov dword [ebp - 4], esi
cmp eax, 0x10
jne 0x4b63c8
push esi
push esi
push ecx
call fcn.004b58e0
mov ecx, dword [ebp + 8]
add esp, 0xc
mov edx, dword [ebp + 0x10]
add dword [ecx + 0x150], edx
adc dword [ecx + 0x154], 0
sub ebx, edx
add edi, edx
jmp 0x4b63e4
lea esi, [ecx + 0x178]
mov dword [ebp - 4], esi
add dword [ecx + 0x150], ebx
adc dword [ecx + 0x154], 0
cmp ebx, 0x10
jb 0x4b6466
add ecx, 0x179
mov eax, ebx
shr eax, 4
mov dword [ebp - 8], ecx
mov dword [ebp + 0x10], eax
nop word [eax + eax]
lea edx, [edi + 2]
mov eax, ecx
mov esi, 4
nop word [eax + eax]
movzx ecx, byte [edx - 2]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 5]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 4]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 2], cl
sub esi, 1
jne 0x4b6420
mov esi, dword [ebp - 4]
push esi
push esi
push dword [ebp + 8]
call fcn.004b58e0
mov ecx, dword [ebp - 8]
add esp, 0xc
sub ebx, 0x10
add edi, 0x10
sub dword [ebp + 0x10], 1
jne 0x4b6410
test ebx, ebx
je 0x4b647f
nop word [eax + eax]
mov al, byte [edi]
lea edi, [edi + 1]
xor byte [esi], al
lea esi, [esi + 1]
sub ebx, 1
jne 0x4b6470
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b6620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x51df40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x28]
mov edx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0x30]
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x14]
push edi
push ebx
push eax
push dword [ebp + 0x20]
mov dword [ebp - 0x18], ebx
push ecx
push dword [ebp + 0x18]
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.004b6490
mov edi, dword [ebp + 0x30]
add esp, 0x2c
test eax, eax
jne 0x4b6760
mov ebx, dword [ebp + 0x2c]
xor esi, esi
xor al, al
test edi, edi
je 0x4b6718
cmp edi, 8
jb 0x4b6718
mov edx, edi
xorps xmm4, xmm4
and edx, 0xfffffff8
xorps xmm3, xmm3
xor ecx, ecx
nop word [eax + eax]
movd xmm2, dword [ecx + ebx]
xorps xmm0, xmm0
movd xmm1, dword [ebp + ecx - 0x14]
lea ecx, [eax + 4]
punpcklbw xmm2, xmm0
add al, 8
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movzx ecx, cl
por xmm4, xmm2
movd xmm2, dword [ecx + ebx]
movd xmm1, dword [ebp + ecx - 0x14]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
movzx ecx, al
pxor xmm2, xmm1
por xmm3, xmm2
cmp ecx, edx
jb 0x4b66a0
por xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd esi, xmm3
movzx ecx, al
cmp ecx, edi
jae 0x4b6736
nop
movzx edx, byte [ecx + ebx]
inc al
movzx ecx, byte [ebp + ecx - 0x14]
xor edx, ecx
movzx ecx, al
or esi, edx
cmp ecx, edi
jb 0x4b6720
test esi, esi
je 0x4b675e
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call fcn.004a0f10
add esp, 8
mov eax, 0xfffffff1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
Function at 0x4b6850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x51df40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x18]
lea eax, [ebp - 0x24]
push edi
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], esi
push eax
push 0x10
lea eax, [edi + 0x10]
mov dword [ebp - 0x24], 0
push eax
lea eax, [edi + 0x20]
push eax
movups xmmword [ebp - 0x14], xmm0
call fcn.004a5920
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x4b68bf
or dword [edi + 0x78], 0x10
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.004a0f10
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
xor ebx, ebx
test edx, edx
je 0x4b69bb
mov edi, dword [ebp + 0x14]
cmp edx, 0x40
jb 0x4b6995
lea eax, [edi - 1]
lea ecx, [edx - 1]
add eax, edx
add ecx, esi
cmp esi, eax
ja 0x4b68ee
cmp ecx, edi
jae 0x4b6995
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
add eax, ecx
mov dword [ebp - 0x1c], eax
lea eax, [ecx + edx]
lea eax, [ebp + eax - 0x15]
cmp esi, eax
ja 0x4b6912
lea eax, [edx - 1]
add eax, esi
cmp eax, dword [ebp - 0x1c]
jae 0x4b6995
mov eax, edx
lea esi, [edi + 0x30]
and eax, 0xffffffc0
lea edx, [ebp - 4]
mov dword [ebp - 0x20], eax
add ecx, edx
mov eax, dword [ebp - 0x18]
mov edx, edi
add eax, 0x10
sub edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp + 0x10]
mov edi, dword [ebp - 0x1c]
movups xmm0, xmmword [esi - 0x30]
add ebx, 0x40
lea ecx, [ecx + 0x40]
lea esi, [esi + 0x40]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ecx - 0x50]
pxor xmm1, xmm0
movups xmm0, xmmword [ecx - 0x40]
movups xmmword [eax - 0x50], xmm1
movups xmm1, xmmword [edi + eax - 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [esi - 0x50]
movups xmmword [eax - 0x40], xmm1
movups xmm1, xmmword [ecx - 0x30]
pxor xmm1, xmm0
movups xmm0, xmmword [esi - 0x40]
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [ecx - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ebx, dword [ebp - 0x20]
jb 0x4b6936
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x20], ebx
cmp ebx, edx
jae 0x4b69bb
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp + 0xc]
lea ecx, [esi + ebx]
sub edi, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
add eax, ebx
add esi, eax
sub edx, ebx
mov al, byte [edi + ecx]
lea esi, [esi + 1]
xor al, byte [esi - 1]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub edx, 1
jne 0x4b69a7
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.004a0f10
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
Function at 0x4b6f70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0x78]
test cl, 0x10
jne 0x4b7123
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x4b710f
test cl, 8
jne 0x4b7123
mov edx, dword [esi + 0x68]
test cl, 4
jne 0x4b6fbc
cmp ebx, edx
ja 0x4b7123
mov al, byte [esi + 0x69]
xor byte [esi], al
xor byte [esi + 1], dl
or ecx, 4
mov dword [esi + 0x78], ecx
jmp 0x4b6fd0
mov eax, dword [esi + 0x70]
add eax, ebx
cmp eax, edx
ja 0x4b7123
nop dword [eax]
mov edx, dword [esi + 0x70]
mov eax, 0x10
add edx, 2
mov ecx, ebx
and edx, 0xf
sub eax, edx
mov dword [ebp - 4], edx
cmp eax, ebx
cmovbe ecx, eax
xor bl, bl
mov dword [ebp + 8], ecx
test ecx, ecx
je 0x4b709e
cmp ecx, 0x40
jb 0x4b709e
mov edi, dword [ebp + 0xc]
dec cl
lea eax, [edx + ecx]
movzx ecx, cl
movzx eax, al
add ecx, edi
add eax, esi
mov dword [ebp - 8], eax
movzx eax, dl
add eax, esi
cmp eax, ecx
ja 0x4b7023
cmp dword [ebp - 8], edi
jae 0x4b709b
mov eax, dword [ebp + 8]
mov bh, 0x20
and eax, 0xffffffc0
xor ecx, ecx
mov dword [ebp - 8], eax
movups xmm1, xmmword [ecx + edi]
lea eax, [ecx + edx]
add bl, 0x40
movups xmm0, xmmword [eax + esi]
pxor xmm1, xmm0
movups xmmword [eax + esi], xmm1
mov al, bh
sub al, 0x10
movzx ecx, al
movups xmm1, xmmword [ecx + edi]
lea eax, [ecx + edx]
movzx ecx, bh
movups xmm0, xmmword [eax + esi]
pxor xmm1, xmm0
movups xmmword [eax + esi], xmm1
lea eax, [ecx + edx]
movups xmm0, xmmword [eax + esi]
movups xmm1, xmmword [ecx + edi]
pxor xmm1, xmm0
movups xmmword [eax + esi], xmm1
mov al, bh
add bh, 0x40
add al, 0x10
movzx ecx, al
movups xmm1, xmmword [ecx + edi]
lea eax, [ecx + edx]
movzx ecx, bl
movups xmm0, xmmword [eax + esi]
pxor xmm1, xmm0
movups xmmword [eax + esi], xmm1
cmp ecx, dword [ebp - 8]
jb 0x4b7030
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 4]
movzx edx, bl
cmp edx, ecx
jae 0x4b70c0
mov eax, dword [ebp + 0xc]
lea ecx, [edx + edi]
inc bl
mov al, byte [edx + eax]
xor byte [ecx + esi], al
mov ecx, dword [ebp + 8]
movzx edx, bl
cmp edx, ecx
jb 0x4b70a8
mov edx, dword [esi + 0x70]
lea eax, [ecx + edi]
mov ebx, dword [ebp + 0x10]
add edx, ecx
add dword [ebp + 0xc], ecx
sub ebx, ecx
mov dword [esi + 0x70], edx
mov dword [ebp + 0x10], ebx
cmp eax, 0x10
je 0x4b70e0
cmp edx, dword [esi + 0x68]
jne 0x4b70fb
lea eax, [ebp - 0xc]
push eax
push esi
push 0x10
lea eax, [esi + 0x20]
push esi
push eax
call fcn.004a5920
add esp, 0x14
test eax, eax
jne 0x4b7118
mov edx, dword [esi + 0x70]
test ebx, ebx
jne 0x4b6fd0
cmp edx, dword [esi + 0x68]
jne 0x4b710f
or dword [esi + 0x78], 8
mov dword [esi + 0x70], ebx
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
or dword [esi + 0x78], 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xfffffff3
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bc9e0
Capabilities:
Encrypt data using camellia

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov ebx, dword [ecx]
xor ebx, dword [eax]
mov ecx, dword [ecx + 4]
xor ecx, dword [eax + 4]
mov eax, ecx
shr eax, 0x18
movzx esi, byte [eax + 0x4ffe38]
mov eax, ecx
shr eax, 0x10
movzx eax, al
shl esi, 8
movzx eax, byte [eax + 0x4fff38]
or esi, eax
mov eax, ecx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + 0x500038]
or esi, eax
movzx eax, cl
shl esi, 8
movzx eax, byte [eax + 0x4ffd38]
or esi, eax
mov eax, ebx
shr eax, 0x18
mov edx, esi
rol edx, 8
movzx ecx, byte [eax + 0x4ffd38]
mov eax, ebx
shr eax, 0x10
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + 0x4ffe38]
or ecx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + 0x4fff38]
or ecx, eax
movzx eax, bl
shl ecx, 8
movzx eax, byte [eax + 0x500038]
or ecx, eax
xor edx, ecx
mov ecx, dword [ebp + 0x10]
mov eax, edx
rol eax, 0x10
xor esi, eax
mov eax, esi
ror eax, 8
xor edx, eax
mov eax, edx
ror eax, 8
xor eax, dword [ecx]
xor eax, esi
xor dword [ecx + 4], edx
pop esi
mov dword [ecx], eax
pop ebx
pop ebp
ret
Function at 0x4be2b0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push 0x500530
push 0x500430
mov eax, dword [edx]
xor eax, dword [ecx]
mov dword [ebp + 0xc], eax
mov eax, dword [edx + 4]
xor eax, dword [ecx + 4]
mov dword [ebp + 0x10], eax
mov eax, dword [edx + 8]
xor eax, dword [ecx + 8]
mov dword [ebp - 4], eax
mov eax, dword [edx + 0xc]
xor eax, dword [ecx + 0xc]
push 0x500330
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push str.cw
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.004be450
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp + 0xc]
push eax
call fcn.004be140
mov edx, dword [ebp + 0x14]
add esp, 0x30
mov ecx, dword [ebp + 8]
mov eax, dword [edx]
xor eax, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [edx + 4]
xor eax, dword [ebp + 0x10]
mov dword [ecx + 4], eax
mov eax, dword [edx + 8]
xor eax, dword [ebp - 4]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0xc]
xor eax, dword [ebp - 8]
mov dword [ecx + 0xc], eax
mov esp, ebp
pop ebp
ret

Function at 0x4be350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 0x14]
sub esp, 0xc
push ebx
mov bl, al
shr eax, 5
push esi
and bl, 0x1f
push edi
and eax, reloc.WS2_32.dll_closesocket
jns 0x4be371
dec eax
or eax, 0xfffffffc
inc eax
mov esi, dword [ebp + 0x10]
mov dword [ebp + 0x14], eax
movzx eax, al
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 4
mov edx, dword [esi + eax*4]
mov eax, edx
mov ecx, edx
and eax, 0xff0000
shr ecx, 0x10
xor eax, ecx
mov ecx, edx
shl ecx, 0x10
and edx, 0xff00
xor ecx, edx
shr eax, 8
shl ecx, 8
mov dl, bl
xor eax, ecx
mov cl, 0x20
sub cl, bl
neg dl
sbb dl, dl
and dl, cl
movzx ecx, dl
mov dword [ebp - 0xc], ecx
movzx ecx, bl
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
sub ebx, edi
mov ecx, dword [ebp + 0x14]
lea edi, [edi + 4]
inc cl
and cl, 3
mov dword [ebp + 0x14], ecx
movzx ecx, cl
mov edx, dword [esi + ecx*4]
mov esi, edx
mov ecx, edx
and esi, 0xff0000
shr ecx, 0x10
xor esi, ecx
mov ecx, edx
shl ecx, 0x10
and edx, 0xff00
xor ecx, edx
shr esi, 8
shl ecx, 8
xor esi, ecx
mov ecx, dword [ebp - 8]
shl eax, cl
mov edx, esi
mov ecx, dword [ebp - 0xc]
shr edx, cl
or eax, edx
mov edx, eax
mov ecx, eax
shr ecx, 0x10
and edx, 0xff0000
xor edx, ecx
mov ecx, eax
and ecx, 0xff00
shl eax, 0x10
xor ecx, eax
shr edx, 8
shl ecx, 8
mov eax, esi
mov esi, dword [ebp + 0x10]
xor edx, ecx
xor edx, dword [ebx + edi - 4]
sub dword [ebp - 4], 1
mov dword [edi - 4], edx
jne 0x4be3c7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c2dc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x18]
cmp dword [ebp + 0xc], ecx
push ebx
mov ebx, ecx
cmovl ebx, dword [ebp + 0xc]
xor eax, eax
shl ecx, 2
add ecx, 0x10
push esi
setb al
neg eax
push edi
mov edi, dword [ebp + 8]
or eax, ecx
push eax
mov dword [ebp + 8], ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edx, dword [ebp + 0x18]
mov esi, eax
mov eax, dword [ebp + 0x10]
mov cl, dl
add cl, cl
add esp, 4
mov dword [eax], esi
mov eax, edx
shr eax, 0x1f
or al, 0x12
mov byte [esi + 6], cl
mov byte [esi + 2], al
lea eax, [edx + edx]
sar eax, 0x18
mov byte [esi + 3], al
mov eax, edx
sar eax, 0xf
mov byte [esi + 4], al
mov eax, edx
sar eax, 7
mov byte [esi + 5], al
mov word [esi], 0x20
mov eax, dword [edi]
shr eax, 0xf
and al, 1
or al, cl
mov byte [esi + 6], al
add esi, 7
add ebx, 0xffffffff
je 0x4c2e7f
nop
mov eax, dword [edi]
shr eax, 7
mov byte [esi], al
mov eax, dword [edi]
mov ecx, eax
add al, al
shr ecx, 0x1f
or cl, al
mov byte [esi + 1], cl
mov eax, dword [edi]
shr eax, 0x17
mov byte [esi + 2], al
mov ecx, dword [edi]
mov eax, dword [edi + 4]
add edi, 4
shr eax, 0xf
shr ecx, 0xf
xor al, cl
and al, 1
xor al, cl
mov byte [esi + 3], al
add esi, 4
sub ebx, 1
jne 0x4c2e40
mov edx, dword [ebp + 0x18]
mov eax, dword [edi]
sub edx, dword [ebp + 8]
shr eax, 7
mov byte [esi], al
mov eax, dword [edi]
mov ecx, eax
add al, al
shr ecx, 0x1f
or cl, al
shl edx, 2
mov byte [esi + 1], cl
mov eax, dword [edi]
shr eax, 0x17
mov byte [esi + 2], al
mov eax, dword [edi]
shr eax, 0xf
and al, 0xfe
mov dword [ebp + 0x18], edx
mov byte [esi + 3], al
add esi, 4
test edx, edx
je 0x4c2ec5
push edx
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
add esi, dword [ebp + 0x18]
mov eax, dword [ebp + 0x10]
or byte [esi - 1], 1
mov byte [esi], 0xc0
pop edi
sub esi, dword [eax]
mov eax, dword [ebp + 0x14]
inc esi
mov dword [eax], esi
mov al, 1
pop esi
pop ebx
pop ebp
ret
Function at 0x4c3050
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
cmp edi, 8
jl 0x4c3105
push ebx
mov ebx, edi
shr ebx, 3
mov eax, ebx
neg eax
lea edi, [edi + eax*8]
mov eax, dword [ebp + 8]
movzx edx, byte [esi]
movzx ecx, byte [esi + 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 3]
shl edx, 8
or edx, ecx
xor eax, edx
mov ecx, eax
shr ecx, 0x10
movzx edx, cl
mov ecx, eax
shr ecx, 8
movzx ecx, cl
mov edx, dword [edx*4 + 0x502478]
xor edx, dword [ecx*4 + 0x502078]
mov ecx, eax
shr ecx, 0x18
movzx eax, al
xor edx, dword [ecx*4 + 0x502878]
movzx ecx, byte [esi + 6]
xor edx, dword [ecx*4 + 0x501078]
movzx ecx, byte [esi + 5]
xor edx, dword [ecx*4 + 0x501478]
movzx ecx, byte [esi + 7]
xor edx, dword [ecx*4 + 0x500c78]
movzx ecx, byte [esi + 4]
add esi, 8
xor edx, dword [ecx*4 + 0x501878]
xor edx, dword [eax*4 + 0x501c78]
mov eax, edx
sub ebx, 1
jne 0x4c3074
pop ebx
jmp 0x4c3108
mov eax, dword [ebp + 8]
test edi, edi
je 0x4c312c
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
mov edx, eax
shl eax, 8
shr edx, 0x18
xor edx, ecx
xor eax, dword [edx*4 + 0x500c78]
sub edi, 1
jne 0x4c3110
pop edi
pop esi
pop ebp
ret
Function at 0x4d500a
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4d5049
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4d5049
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4d5049
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4d5049
cmp dword [ecx + 0x74], 0xe
jbe 0x4d5049
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret